Lkft-triage

lkft-triage@lists.linaro.org

22 participants
34202 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.143 release. There are 452 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.143-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.143-rc1 Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common() Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Call the spectral chicken in the Zen2 init function Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function Petr Machata <petrm(a)nvidia.com> Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: add-addr: always drop other suboptions Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Jason Gunthorpe <jgg(a)ziepe.ca> RDMA: During rereg_mr ensure that REREG_ACCESS is compatible Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Wupeng Ma <mawupeng1(a)huawei.com> mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Jane Chu <jane.chu(a)oracle.com> mm/memory-failure: fix missing ->mf_stats count in hugetlb poison David Hildenbrand <david(a)redhat.com> mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb() David Hildenbrand <david(a)redhat.com> mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio David Hildenbrand <david(a)redhat.com> mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb() Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Kai Aizen <kai.aizen.dev(a)gmail.com> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: use u32 for register interactions Thomas Gleixner <tglx(a)linutronix.de> serial: samsung_tty: Use port lock wrappers Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Pratyush Yadav (Google) <pratyush(a)kernel.org> memfd: deny writeable mappings when implying SEAL_WRITE Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw Paolo Abeni <pabeni(a)redhat.com> mptcp: handle first subflow closing consistently Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> Bluetooth: hci_qca: Migrate to serdev specific shutdown function Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> serdev: Provide a bustype shutdown function Ricardo B. Marliere <ricardo(a)marliere.net> serdev: make serdev_bus_type const SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() Alistair Popple <apopple(a)nvidia.com> mm/memory: fix spurious warning when unmapping device-private/exclusive pages Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Paolo Abeni <pabeni(a)redhat.com> mptcp: introduce the mptcp_init_skb helper David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> iio: adc: npcm: Convert to platform remove callback returning void Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Jann Horn <jannh(a)google.com> af_unix: Fix UAF read of tail->len in unix_stream_data_wait() Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Cache state->msg in unix_stream_read_generic(). David Howells <dhowells(a)redhat.com> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer David Howells <dhowells(a)redhat.com> rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Justin Iurman <justin.iurman(a)gmail.com> ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Eric Dumazet <edumazet(a)google.com> ipv6/addrconf: annotate data-races around devconf fields (II) Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Paolo Abeni <pabeni(a)redhat.com> mptcp: reset rcv wnd on disconnect Paolo Abeni <pabeni(a)redhat.com> mptcp: cleanup fallback dummy mapping generation Paolo Abeni <pabeni(a)redhat.com> mptcp: use plain bool instead of custom binary enum Sam Daly <sam(a)samdaly.ie> octeontx2-af: CGX: add bounds check to cgx_speed_mbps index Justin Stitt <justinstitt(a)google.com> octeontx2-af: replace deprecated strncpy with strscpy Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require net admin for CIFS SWN netlink Ido Schimmel <idosch(a)nvidia.com> genetlink: Use internal flags for multicast groups Guopeng Zhang <zhangguopeng(a)kylinos.cn> cgroup/cpuset: Reset DL migration state on can_attach() failure Asim Viladi Oglu Manizada <manizada(a)pm.me> ksmbd: fix OOB write in QUERY_INFO for compound requests Thomas Zimmermann <tzimmermann(a)suse.de> fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros Corey Minyard <corey(a)minyard.net> ipmi:ssif: NULL thread on error Corey Minyard <corey(a)minyard.net> ipmi:ssif: Remove unnecessary indention Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() Lorenzo Stoakes <ljs(a)kernel.org> mm/hugetlb: avoid false positive lockdep assertion Johan Hovold <johan(a)kernel.org> driver core: reject devices with unregistered buses Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Christian König <christian.koenig(a)amd.com> drm/amdgpu: restart the CS if some parts of the VM are still invalidated Andrew Martin <andrew.martin(a)amd.com> drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 Muhammad Bilal <meatuni001(a)gmail.com> drm/amdkfd: fix NULL dereference in get_queue_ids() Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: fix OF node refcount Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Validate XDomain request packet size before type cast Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Set mandatory idle clocks before CMD0 Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type David Carlier <devnexen(a)gmail.com> mm/hugetlb: restore reservation on error in hugetlb folio copy paths Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Update comments find_equal_scalars->sync_linked_regs Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking Eduard Zingerman <eddyz87(a)gmail.com> bpf: Remove mark_precise_scalar_ids() Eduard Zingerman <eddyz87(a)gmail.com> bpf: Track equal scalars history on per-instruction level Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-af: fix memory leak in rvu_setup_hw_resources() Andre Heider <a.heider(a)gmail.com> nvmem: layouts: onie-tlv: fix hang on unknown types Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Nikolay Kuratov <kniv(a)yandex-team.ru> net/mlx5: Reorder completion before putting command entry in cmd_work_handler Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Zhenghang Xiao <kipreyyy(a)gmail.com> misc: fastrpc: fix use-after-free race in fastrpc_map_create Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Hyunwoo Kim <imv4bel(a)gmail.com> inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Yuqi Xu <xuyuqiabc(a)gmail.com> wifi: nl80211: reject oversized EMA RNR lists Tao Cui <cuitao(a)kylinos.cn> selftests: mptcp: add test for extra_subflows underflow on userspace PM Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Paolo Abeni <pabeni(a)redhat.com> mptcp: allow subflow rcv wnd to shrink Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Sechang Lim <rhkrqnwk98(a)gmail.com> udp: clear skb->dev before running a sockmap verdict Cunlong Li <shenxiaogll(a)gmail.com> zram: fix use-after-free in zram_bvec_write_partial() Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Wentao Liang <vulab(a)iscas.ac.cn> drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Sean Christopherson <seanjc(a)google.com> KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Point the error offset correctly for eprobe argument error Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Yuqi Xu <xuyq21(a)lenovo.com> Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Fix driver removal with disabled KMS Pengyu Luo <mitltlatltl(a)gmail.com> clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ensure safe access to master conntrack Ido Schimmel <idosch(a)nvidia.com> ipv6: Fix a potential NPD in cleanup_prefix_route() Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Lorenzo Bianconi <lorenzo(a)kernel.org> net: mvpp2: Add metadata support for xdp mode Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack: destroy stale expectfn expectations on unregister Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Chih Kai Hsu <hsu.chih.kai(a)realtek.com> r8152: handle the return value of usb_reset_device() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: phy: clean the sfp upstream if phy probing fails Yao Sang <sangyao(a)kylinos.cn> net/mlx4: avoid GCC 10 __bad_copy_from() false positive Eric Dumazet <edumazet(a)google.com> tcp: restrict SO_ATTACH_FILTER to priv users Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: wm_adsp: Fix NULL dereference when removing firmware controls Yun Zhou <yun.zhou(a)windriver.com> gpio: mvebu: fix NULL pointer dereference in suspend/resume Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Brian Foster <bfoster(a)redhat.com> iomap: don't revert iov_iter on partially completed buffered writes Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VPIPT I-cache handling Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Gabriele Monaco <gmonaco(a)redhat.com> tools/rv: Fix cleanup after failed trace setup Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_ncm: Fix net_device lifecycle with device_move Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Rui Qi <qirui.001(a)bytedance.com> ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: fix spurious notification on VNI update Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: send notification on VNI add Nithin Dabilpuram <ndabilpuram(a)marvell.com> octeontx2-af: npc: Fix CPT channel mask in npc_install_flow Lorenzo Bianconi <lorenzo(a)kernel.org> net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown Kurt Kanzenbach <kurt(a)linutronix.de> ptp: vclock: Switch from RCU to SRCU Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix backward compatibility with userspace Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() Tapio Reijonen <tapio.reijonen(a)vaisala.com> net: fec: fix pinctrl default state restore order on resume David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Kuniyuki Iwashima <kuniyu(a)google.com> hsr: Remove WARN_ONCE() in hsr_addr_is_self(). Kuniyuki Iwashima <kuniyu(a)google.com> net: Annotate sk->sk_write_space() for UDP SOCKMAP. Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Jiayuan Chen <jiayuan.chen(a)linux.dev> netfilter: nft_ct: bail out on template ct in get eval Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Nicolò Coccia <n.coccia96(a)gmail.com> net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/core) Protect regulator operations with mutex Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix SuperSpeed root hub wMaxPacketSize Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Mickaël Salaün <mic(a)digikod.net> landlock: Fix handling of disconnected directories Aleksandr Nogikh <nogikh(a)google.com> x86/kexec: Disable KCOV instrumentation after load_segments() Doruk Tan Ozturk <doruk(a)0sec.ai> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Jeremy Erazo <mendozayt13(a)gmail.com> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Dmitriy Zharov <contact(a)zharov.dev> Input: xpad - add support for ASUS ROG RAIKIRI II Qbeliw Tanaka <q.tanaka(a)gmx.com> Input: xpad - add "Nova 2 Lite" from GameSir Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Sean Christopherson <seanjc(a)google.com> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Qiang Ma <maqianga(a)uniontech.com> KVM: arm64: PMU: Preserve AArch32 counter low bits Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: xpad - fix out-of-bounds access for Share button Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Prathamesh Shete <pshete(a)nvidia.com> soc/tegra: pmc: Fix unsafe generic_handle_irq() call Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> x86/kexec: add a sanity check on previous kernel's ima kexec buffer Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> ima: verify the previous kernel's IMA buffer lies in addressable RAM Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Will Deacon <will(a)kernel.org> arm64: io: Extract user memory type in ioremap_prot() Will Deacon <will(a)kernel.org> arm64: io: Rename ioremap_prot() to __ioremap_prot() Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Jakub Kicinski <kuba(a)kernel.org> inet: frags: flush pending skbs in fqdir_pre_exit() Jakub Kicinski <kuba(a)kernel.org> inet: frags: add inet_frag_queue_flush() Thomas Zimmermann <tzimmermann(a)suse.de> drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup Thomas Zimmermann <tzimmermann(a)suse.de> drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: fix inverted error logic Sean Young <sean(a)mess.org> media: rc: fix race between unregister and urb/irq callbacks Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> mm/page_alloc: clear page->private in free_pages_prepare() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid role confusion in tp_list Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Sean Shen <grayhat(a)foxmail.com> ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: mxc: fix irq_high handling Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() David Jeffery <djeffery(a)redhat.com> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Ziyu Zhang <ziyuzhang201(a)gmail.com> vsock: keep poll shutdown state consistent Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nf_tables: fix dst corruption in same register operation Jeremy Sowden <jeremy(a)azazel.net> netfilter: bitwise: add support for doing AND, OR and XOR directly Jeremy Sowden <jeremy(a)azazel.net> netfilter: bitwise: rename some boolean operation functions Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Carlos Eduardo Gallo Filho <gcarlos(a)disroot.org> drm: Remove plane hsub/vsub alignment requirement for core helpers Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/arch/arm64/silicon-errata.rst | 48 +++ Makefile | 4 +- arch/arm/include/asm/io.h | 15 +- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 +++ arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/io.h | 25 +- arch/arm64/include/asm/kvm_mmu.h | 5 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 64 ++-- arch/arm64/kernel/acpi.c | 2 +- arch/arm64/kernel/cpu_errata.c | 34 +- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/mm.c | 2 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 69 +--- arch/arm64/kvm/hyp/pgtable.c | 2 +- arch/arm64/kvm/hyp/vhe/tlb.c | 21 +- arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/mm/ioremap.c | 8 +- arch/mips/dec/platform.c | 109 +++++- arch/x86/kernel/Makefile | 14 + arch/x86/kernel/cpu/amd.c | 33 +- arch/x86/kernel/setup.c | 6 + arch/x86/kvm/svm/avic.c | 35 +- arch/x86/mm/Makefile | 2 + drivers/auxdisplay/line-display.c | 2 +- drivers/base/bus.c | 11 +- drivers/block/zram/zram_drv.c | 2 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 38 +-- drivers/char/ipmi/ipmi_msghandler.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 29 +- drivers/clk/qcom/dispcc-sc8280xp.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 49 ++- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 ++- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/bridge/sil-sii8620.c | 1 + drivers/gpu/drm/drm_fb_helper.c | 12 +- drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 ++++++- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 + drivers/gpu/drm/i915/display/intel_psr.c | 34 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/gpu/drm/virtio/virtgpu_drv.c | 5 +- drivers/gpu/drm/virtio/virtgpu_submit.c | 4 +- drivers/hid/bpf/hid_bpf_dispatch.c | 3 +- drivers/hid/hid-core.c | 35 +- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-picolcd_cir.c | 1 + drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/wacom_sys.c | 19 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 49 ++- drivers/hwmon/pmbus/pmbus_core.c | 117 +++++-- drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +-- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/npcm_adc.c | 31 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 ++-- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 16 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++ drivers/infiniband/core/umem.c | 16 + drivers/infiniband/core/verbs.c | 38 --- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 + drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 + drivers/infiniband/hw/mana/mana_ib.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 5 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 4 + drivers/infiniband/hw/mlx5/umr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_qp.c | 7 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 5 + drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/srp/ib_srp.c | 30 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/keyboard/atkbd.c | 15 + drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/md/bcache/super.c | 3 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/media/cec/core/cec-core.c | 2 +- drivers/media/common/siano/smsir.c | 1 + drivers/media/i2c/ir-kbd-i2c.c | 2 + drivers/media/pci/bt8xx/bttv-input.c | 3 +- drivers/media/pci/cx23885/cx23885-input.c | 1 + drivers/media/pci/cx88/cx88-input.c | 3 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/mantis/mantis_input.c | 1 + drivers/media/pci/saa7134/saa7134-input.c | 1 + drivers/media/pci/smipcie/smipcie-ir.c | 1 + drivers/media/pci/ttpci/budget-ci.c | 1 + drivers/media/rc/ati_remote.c | 6 +- drivers/media/rc/ene_ir.c | 2 +- drivers/media/rc/fintek-cir.c | 3 +- drivers/media/rc/igorplugusb.c | 3 +- drivers/media/rc/iguanair.c | 1 + drivers/media/rc/img-ir/img-ir-hw.c | 3 +- drivers/media/rc/img-ir/img-ir-raw.c | 3 +- drivers/media/rc/imon.c | 3 +- drivers/media/rc/ir-hix5hd2.c | 2 +- drivers/media/rc/ir_toy.c | 1 + drivers/media/rc/ite-cir.c | 2 +- drivers/media/rc/mceusb.c | 1 + drivers/media/rc/rc-ir-raw.c | 5 - drivers/media/rc/rc-loopback.c | 1 + drivers/media/rc/rc-main.c | 6 +- drivers/media/rc/redrat3.c | 4 +- drivers/media/rc/st_rc.c | 2 +- drivers/media/rc/streamzap.c | 7 +- drivers/media/rc/sunxi-cir.c | 1 + drivers/media/rc/ttusbir.c | 4 +- drivers/media/rc/winbond-cir.c | 2 +- drivers/media/rc/xbox_remote.c | 5 +- drivers/media/usb/au0828/au0828-input.c | 1 + drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1 + drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6 +- drivers/media/usb/em28xx/em28xx-input.c | 1 + drivers/misc/fastrpc.c | 107 +++--- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/litex_mmc.c | 20 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci.c | 1 + drivers/net/bonding/bond_main.c | 12 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 3 +- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 +++-- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 13 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 32 +- .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx4/cq.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 13 +- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 72 +++- drivers/net/ethernet/microchip/lan743x_main.c | 32 ++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/microsoft/mana/mana_en.c | 72 ++-- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/hyperv/netvsc.c | 19 +- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 8 +- drivers/net/phy/mscc/mscc_main.c | 23 +- drivers/net/phy/phy_device.c | 6 + drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/usb/r8152.c | 7 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/vxlan/vxlan_vnifilter.c | 5 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvmem/layouts/onie-tlv.c | 3 +- drivers/of/kexec.c | 15 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 34 +- drivers/ptp/ptp_vclock.c | 14 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_lib.c | 27 +- drivers/scsi/scsi_transport_fc.c | 77 +++-- drivers/slimbus/qcom-ngd-ctrl.c | 5 +- drivers/soc/qcom/ice.c | 36 +- drivers/soc/tegra/pmc.c | 104 ++++-- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/av7110/av7110_ir.c | 1 + drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/tee/optee/supp.c | 107 ++++-- drivers/thunderbolt/property.c | 38 ++- drivers/thunderbolt/xdomain.c | 14 +- drivers/tty/serdev/core.c | 23 +- drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 +++++----- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 17 +- drivers/tty/serial/samsung_tty.c | 129 ++++--- drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 +++++------- drivers/tty/serial/zs.h | 1 - drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 + drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 26 +- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_ncm.c | 33 +- drivers/usb/gadget/function/f_uvc.c | 26 +- drivers/usb/gadget/function/u_ether.c | 28 +- drivers/usb/gadget/function/u_ether.h | 26 ++ drivers/usb/gadget/function/u_ncm.h | 2 +- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 77 +++-- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 +- drivers/usb/serial/io_ti.c | 11 + drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 +- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/video/fbdev/Kconfig | 1 + drivers/video/fbdev/core/fbcon.c | 9 + drivers/video/fbdev/vt8500lcdfb.c | 4 +- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/hpfs/alloc.c | 2 +- fs/iomap/buffered-io.c | 4 - fs/smb/client/netlink.c | 6 +- fs/smb/server/oplock.c | 15 +- fs/smb/server/smb2pdu.c | 143 ++++++-- fs/smb/server/smbacl.c | 51 ++- fs/smb/server/smbacl.h | 2 + include/drm/display/drm_dp.h | 1 + include/drm/drm_fourcc.h | 5 +- include/linux/bpf_verifier.h | 4 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 + include/linux/compiler_types.h | 4 + include/linux/hid.h | 15 +- include/linux/hid_bpf.h | 4 +- include/linux/hugetlb.h | 16 +- include/linux/ima.h | 1 + include/linux/mlx5/vport.h | 4 +- include/linux/mm.h | 8 - include/linux/parport.h | 1 + include/linux/serdev.h | 1 + include/linux/syscalls.h | 4 + include/media/rc-core.h | 2 - include/net/act_api.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/genetlink.h | 9 +- include/net/inet_frag.h | 18 +- include/net/ip_vs.h | 3 +- include/net/ipv6_frag.h | 9 +- include/net/netfilter/nf_conntrack_core.h | 5 + include/net/netfilter/nf_conntrack_helper.h | 1 + include/net/netfilter/nf_tables.h | 7 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 44 +-- include/rdma/ib_verbs.h | 48 --- include/rdma/iter.h | 88 +++++ include/uapi/linux/netfilter/nf_tables.h | 18 +- ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/bpf/verifier.c | 369 +++++++++++++-------- kernel/cgroup/cpuset.c | 8 +- kernel/events/core.c | 16 +- kernel/pid.c | 8 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 2 - lib/debugobjects.c | 2 +- mm/damon/ops-common.c | 4 +- mm/damon/sysfs-schemes.c | 8 +- mm/gup.c | 2 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 118 ++++--- mm/memfd.c | 12 +- mm/memory-failure.c | 94 +++--- mm/memory.c | 2 +- mm/memory_hotplug.c | 2 +- mm/mempolicy.c | 2 +- mm/migrate.c | 18 +- mm/page_alloc.c | 1 + net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 + net/batman-adv/bat_iv_ogm.c | 82 ++++- net/batman-adv/bat_v_ogm.c | 59 ++-- net/batman-adv/bridge_loop_avoidance.c | 57 +++- net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 67 ++-- net/batman-adv/translation-table.c | 43 ++- net/batman-adv/tvlv.c | 28 +- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 42 ++- net/bluetooth/6lowpan.c | 2 + net/bluetooth/bnep/core.c | 50 ++- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_sync.c | 9 +- net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/hidp/core.c | 23 +- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 87 ++++- net/bluetooth/l2cap_sock.c | 16 +- net/bluetooth/mgmt.c | 17 +- net/bluetooth/rfcomm/core.c | 69 ++-- net/bluetooth/rfcomm/sock.c | 26 +- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 ++ net/core/drop_monitor.c | 2 +- net/core/filter.c | 17 +- net/core/skbuff.c | 20 +- net/core/sock.c | 13 +- net/ethtool/eeprom.c | 10 +- net/hsr/hsr_forward.c | 4 +- net/hsr/hsr_framereg.c | 10 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 4 +- net/ipv4/inet_fragment.c | 54 ++- net/ipv4/ip_fragment.c | 21 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 +- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nf_nat_h323.c | 2 + net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/udp.c | 8 + net/ipv6/addrconf.c | 53 +-- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 35 +- net/ipv6/ioam6.c | 8 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6_vti.c | 25 +- net/ipv6/mcast.c | 22 +- net/ipv6/ndisc.c | 18 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/route.c | 5 + net/ipv6/seg6_hmac.c | 8 +- net/ipv6/sit.c | 1 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 58 ++-- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 1 + net/mptcp/options.c | 73 ++-- net/mptcp/pm.c | 49 ++- net/mptcp/pm_netlink.c | 18 +- net/mptcp/protocol.c | 102 ++++-- net/mptcp/protocol.h | 17 +- net/mptcp/sockopt.c | 8 +- net/mptcp/subflow.c | 20 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/nf_conntrack_ecache.c | 2 + net/netfilter/nf_conntrack_expect.c | 10 +- net/netfilter/nf_conntrack_helper.c | 19 ++ net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_netlink.c | 28 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_nat_core.c | 2 + net/netfilter/nf_nat_sip.c | 1 + net/netfilter/nf_synproxy_core.c | 26 +- net/netfilter/nft_bitwise.c | 184 ++++++++-- net/netfilter/nft_byteorder.c | 13 +- net/netfilter/nft_ct.c | 8 +- net/netfilter/nft_ct_fast.c | 2 +- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 +- net/netlink/af_netlink.c | 11 +- net/netlink/genetlink.c | 4 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 + net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/openvswitch/datapath.c | 1 + net/psample/psample.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/rxrpc/ar-internal.h | 12 +- net/rxrpc/call_event.c | 27 +- net/rxrpc/call_object.c | 2 + net/rxrpc/conn_event.c | 30 +- net/rxrpc/insecure.c | 8 +- net/rxrpc/recvmsg.c | 68 +++- net/rxrpc/rxkad.c | 115 +++---- net/sched/act_api.c | 7 +- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 --- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 21 +- net/socket.c | 11 +- net/unix/af_unix.c | 38 +-- net/vmw_vsock/af_vsock.c | 49 ++- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 14 +- net/vmw_vsock/vmci_transport.c | 12 +- net/wireless/nl80211.c | 3 + net/xfrm/espintcp.c | 4 + net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 23 +- net/xfrm/xfrm_user.c | 5 +- security/integrity/ima/ima_kexec.c | 35 ++ security/landlock/errata/abi-1.h | 16 + security/landlock/fs.c | 40 ++- sound/core/pcm_native.c | 7 +- sound/core/timer.c | 1 + .../motu/motu-register-dsp-message-parser.c | 14 +- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/codecs/wm_adsp.c | 3 + sound/soc/fsl/fsl_sai.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 +- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 +-- .../selftests/bpf/progs/verifier_scalar_ids.c | 333 ++++++++++++------- .../selftests/bpf/progs/verifier_spill_fill.c | 4 +- .../bpf/progs/verifier_subprog_precision.c | 2 +- tools/testing/selftests/bpf/verifier/precise.c | 2 +- .../test.d/dynevent/eprobes_syntax_errors.tc | 2 +- tools/testing/selftests/mm/hmm-tests.c | 50 +++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 + tools/testing/selftests/ptp/testptp.c | 62 +--- tools/verification/rv/src/in_kernel.c | 2 +- virt/kvm/kvm_main.c | 3 +- 508 files changed, 5864 insertions(+), 3002 deletions(-)

2 months, 3 weeks

[PATCH 6.1 000/522] 6.1.176-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.176 release. There are 522 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.176-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.176-rc1 Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function Ben Hutchings <benh(a)debian.org> apparmor: validate default DFA states are in bounds Ben Hutchings <benh(a)debian.org> fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter Petr Machata <petrm(a)nvidia.com> Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/v3d: Reject empty multisync extension to prevent infinite loop SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() Corey Minyard <corey(a)minyard.net> ipmi:ssif: NULL thread on error Corey Minyard <corey(a)minyard.net> ipmi:ssif: Remove unnecessary indention Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Corey Minyard <corey(a)minyard.net> ipmi:ssif: Fix a shutdown race Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Arnaldo Carvalho de Melo <acme(a)redhat.com> perf build: Remove -Wno-unused-but-set-variable from the flex flags when building with clang < 13.0.0 Arnaldo Carvalho de Melo <acme(a)redhat.com> tools build: Add 3-component logical version comparators Ian Rogers <irogers(a)google.com> perf build: Disable fewer bison warnings Ian Rogers <irogers(a)google.com> perf parse-events: Make YYDEBUG dependent on doing a debug build Ian Rogers <irogers(a)google.com> perf build: Conditionally define NDEBUG Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Tejun Heo <tj(a)kernel.org> blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Wupeng Ma <mawupeng1(a)huawei.com> mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Jane Chu <jane.chu(a)oracle.com> mm/memory-failure: fix missing ->mf_stats count in hugetlb poison David Hildenbrand <david(a)redhat.com> mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb() David Hildenbrand <david(a)redhat.com> mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio David Hildenbrand <david(a)redhat.com> mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb() Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: align #define values Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: remove unused symbols Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() John Keeping <john(a)metanate.com> usb: gadget: f_hid: tidy error handling in hidg_alloc Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: use u32 for register interactions Thomas Gleixner <tglx(a)linutronix.de> serial: samsung_tty: Use port lock wrappers Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> iio: adc: npcm: Convert to platform remove callback returning void Ruan Jinjie <ruanjinjie(a)huawei.com> iio: adc: fix the return value handle for platform_get_irq() Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Fix per-pad high-speed termination calibration Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Disable trk clk when not in use Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Johan Hovold <johan(a)kernel.org> spi: qup: fix error pointer deref after DMA setup failure Yang Yingliang <yangyingliang(a)huawei.com> spi: qup: switch to use modern name Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Make driver_data info const David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Create wrapper to walk PCI config space David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Add private data for per-device data Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Paolo Abeni <pabeni(a)redhat.com> mptcp: reset rcv wnd on disconnect Sam Daly <sam(a)samdaly.ie> octeontx2-af: CGX: add bounds check to cgx_speed_mbps index Justin Stitt <justinstitt(a)google.com> octeontx2-af: replace deprecated strncpy with strscpy Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Justin Iurman <justin.iurman(a)gmail.com> ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Jiexun Wang <wangjiexun2025(a)gmail.com> Bluetooth: serialize accept_q access Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Init sk_peer_* on bt_sock_alloc Alistair Popple <apopple(a)nvidia.com> mm/memory: fix spurious warning when unmapping device-private/exclusive pages Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require net admin for CIFS SWN netlink Ido Schimmel <idosch(a)nvidia.com> genetlink: Use internal flags for multicast groups Guopeng Zhang <zhangguopeng(a)kylinos.cn> cgroup/cpuset: Reset DL migration state on can_attach() failure Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: st-ssc4: switch to use modern name Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Piyush Sachdeva <s.piyush1024(a)gmail.com> smb: client: Use FullSessionKey for AES-256 encryption key derivation Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: topcliff-pch: Convert to platform remove callback returning void Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Li Zetao <lizetao1(a)huawei.com> spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: microchip-core-qspi: Convert to platform remove callback returning void Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Yang Yingliang <yangyingliang(a)huawei.com> spi: uniphier: switch to use modern name Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: uniphier: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Zeng Heng <zengheng4(a)huawei.com> mtd: spi-nor: core: fix implicit declaration warning Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Andi Shyti <andi.shyti(a)kernel.org> spi: s3c64xx: Use devm_clk_get_enabled() Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Yang Yingliang <yangyingliang(a)huawei.com> spi: zynq-qspi: switch to use modern name Ruan Jinjie <ruanjinjie(a)huawei.com> spi: spi-zynq: Do not check for 0 return after calling platform_get_irq() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: zynq-qspi: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: spi-ti-qspi: switch to use modern name Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: spi-ti-qspi: Convert to platform remove callback returning void Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> spi: Convert to SPI_CONTROLLER_HALF_DUPLEX Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: sun4i: switch to use modern name Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: sun4i: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: synquacer: switch to use modern name Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: synquacer: Convert to platform remove callback returning void Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Eric Biggers <ebiggers(a)google.com> net: ipv6: stop checking crypto_ahash_alignmask Eric Biggers <ebiggers(a)google.com> net: ipv4: stop checking crypto_ahash_alignmask Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Avoid -Wflex-array-member-not-at-end warning Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Vignesh Viswanathan <quic_viswanat(a)quicinc.com> net: qrtr: ns: Change servers radix tree to xarray Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: imx: Convert to platform remove callback returning void Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Jiazi Li <jqqlijiazi(a)gmail.com> f2fs: use kfree() instead of kvfree() to free some memory Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Lorenzo Stoakes <ljs(a)kernel.org> mm/hugetlb: avoid false positive lockdep assertion Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Christian König <christian.koenig(a)amd.com> drm/amdgpu: restart the CS if some parts of the VM are still invalidated Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: fix OF node refcount Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Validate XDomain request packet size before type cast Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Set mandatory idle clocks before CMD0 Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-af: fix memory leak in rvu_setup_hw_resources() Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Nikolay Kuratov <kniv(a)yandex-team.ru> net/mlx5: Reorder completion before putting command entry in cmd_work_handler Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Zhenghang Xiao <kipreyyy(a)gmail.com> misc: fastrpc: fix use-after-free race in fastrpc_map_create Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Yuqi Xu <xuyuqiabc(a)gmail.com> wifi: nl80211: reject oversized EMA RNR lists Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Paolo Abeni <pabeni(a)redhat.com> mptcp: allow subflow rcv wnd to shrink Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Sechang Lim <rhkrqnwk98(a)gmail.com> udp: clear skb->dev before running a sockmap verdict Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Yuqi Xu <xuyq21(a)lenovo.com> Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ensure safe access to master conntrack Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Lorenzo Bianconi <lorenzo(a)kernel.org> net: mvpp2: Add metadata support for xdp mode Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack: destroy stale expectfn expectations on unregister Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Chih Kai Hsu <hsu.chih.kai(a)realtek.com> r8152: handle the return value of usb_reset_device() Douglas Anderson <dianders(a)chromium.org> r8152: Block future register access if register access fails Hayes Wang <hayeswang(a)realtek.com> r8152: reduce the control transfer of rtl8152_get_version() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Yao Sang <sangyao(a)kylinos.cn> net/mlx4: avoid GCC 10 __bad_copy_from() false positive Eric Dumazet <edumazet(a)google.com> tcp: restrict SO_ATTACH_FILTER to priv users Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: wm_adsp: Fix NULL dereference when removing firmware controls Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Brian Foster <bfoster(a)redhat.com> iomap: don't revert iov_iter on partially completed buffered writes Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VPIPT I-cache handling Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_ncm: Fix net_device lifecycle with device_move Edward Lo <loyuantsung(a)gmail.com> fs/ntfs3: Return error for inconsistent extended attributes Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Rui Qi <qirui.001(a)bytedance.com> ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: fix spurious notification on VNI update Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: send notification on VNI add Nithin Dabilpuram <ndabilpuram(a)marvell.com> octeontx2-af: npc: Fix CPT channel mask in npc_install_flow Kurt Kanzenbach <kurt(a)linutronix.de> ptp: vclock: Switch from RCU to SRCU Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix backward compatibility with userspace Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() Tapio Reijonen <tapio.reijonen(a)vaisala.com> net: fec: fix pinctrl default state restore order on resume David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Kuniyuki Iwashima <kuniyu(a)google.com> net: Annotate sk->sk_write_space() for UDP SOCKMAP. Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Nicolò Coccia <n.coccia96(a)gmail.com> net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix not releasing workqueue on .release() Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix SuperSpeed root hub wMaxPacketSize Jiayuan Chen <jiayuan.chen(a)shopee.com> bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: restore set elements when delete set fails Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Vladislav Nikolaev <vlad102nikolaev(a)gmail.com> RDMA/rxe: Complete the rxe_cleanup_task backport Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Harini Katakam <harini.katakam(a)amd.com> phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table Sabrina Dubroca <sd(a)queasysnail.net> net: gro: don't merge zcopy skbs Jiasheng Jiang <jiashengjiangcool(a)gmail.com> RDMA/rxe: Fix double free in rxe_srq_from_init Ben Hutchings <benh(a)debian.org> Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Eric Dumazet <edumazet(a)google.com> net/packet: convert po->running to an atomic flag Eric Dumazet <edumazet(a)google.com> net/packet: convert po->has_vnet_hdr to an atomic flag Eric Dumazet <edumazet(a)google.com> net/packet: convert po->tp_loss to an atomic flag Eric Dumazet <edumazet(a)google.com> net/packet: convert po->tp_tx_has_off to an atomic flag Martin KaFai Lau <martin.lau(a)kernel.org> selftests/bpf: S/iptables/iptables-legacy/ in the bpf_nf and xdp_synproxy test Daniel Borkmann <daniel(a)iogearbox.net> selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test Paul Chaignon <paul.chaignon(a)gmail.com> Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: enhance align selftest's expected log matching Stanislav Fomichev <sdf(a)google.com> selftests/bpf: Update bpf_clone_redirect expected return code Yonghong Song <yonghong.song(a)linux.dev> bpf: Fix a few selftest failures due to llvm18 change Jiri Olsa <jolsa(a)kernel.org> selftests/bpf: Add read_build_id function Paul Chaignon <paul.chaignon(a)gmail.com> Revert "selftests/bpf: Add tests for _opts variants of bpf_*_get_fd_by_id()" Paul Chaignon <paul.chaignon(a)gmail.com> Revert "selftests/bpf: Workaround strict bpf_lsm return value check." Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: Convert test_global_funcs test to test_loader framework Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: add generic BPF program tester-loader Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> mm/page_alloc: clear page->private in free_pages_prepare() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Petr Machata <petrm(a)nvidia.com> selftests: forwarding: lib: Add helpers for checksum handling Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Hongtao Lee <lihongtao(a)kylinos.cn> tools/bootconfig: Fix buf leaks in apply_xbc Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tools/bootconfig: Cleanup bootconfig footer size calculations Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Carlos Eduardo Gallo Filho <gcarlos(a)disroot.org> drm: Remove plane hsub/vsub alignment requirement for core helpers Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/arm64/silicon-errata.rst | 46 ++++ Makefile | 4 +- arch/arm/include/asm/io.h | 15 +- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 +++++ arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 52 +++-- arch/arm64/kernel/cpu_errata.c | 34 ++- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +--- arch/arm64/kvm/hyp/pgtable.c | 2 +- arch/arm64/kvm/hyp/vhe/tlb.c | 19 +- arch/arm64/mm/mmu.c | 36 ++-- arch/loongarch/kernel/syscall.c | 3 +- arch/x86/kernel/cpu/amd.c | 18 +- block/blk-cgroup.c | 32 +-- drivers/auxdisplay/line-display.c | 2 +- drivers/base/power/domain.c | 10 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 33 ++- drivers/char/ipmi/ipmi_msghandler.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 42 ++-- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 47 +++-- drivers/crypto/nx/nx-842.h | 24 ++- drivers/crypto/nx/nx-common-powernv.c | 31 ++- drivers/crypto/nx/nx-common-pseries.c | 33 ++- drivers/dma/idxd/init.c | 1 - drivers/dma/idxd/sysfs.c | 1 + drivers/gpio/gpio-rockchip.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 +++-- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 ++++++++-- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 34 ++- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +-- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/v3d/v3d_gem.c | 5 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/hid/hid-core.c | 33 ++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/wacom_sys.c | 19 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 56 ++++- drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +++-- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/bcm_iproc_adc.c | 4 +- drivers/iio/adc/lpc32xx_adc.c | 4 +- drivers/iio/adc/npcm_adc.c | 31 +-- drivers/iio/adc/spear_adc.c | 4 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 +++--- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 16 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 ++++ drivers/infiniband/core/verbs.c | 38 ---- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 1 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/umr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_qp.c | 4 +- drivers/infiniband/sw/rxe/rxe_srq.c | 3 - drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/srp/ib_srp.c | 30 ++- drivers/input/keyboard/atkbd.c | 15 ++ drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/media/rc/igorplugusb.c | 16 +- drivers/media/rc/ttusbir.c | 13 +- drivers/misc/fastrpc.c | 102 +++++---- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/litex_mmc.c | 20 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci.c | 1 + drivers/mtd/spi-nor/core.c | 1 + drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/bonding/bond_main.c | 19 +- drivers/net/bonding/bond_options.c | 2 + drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 3 +- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 ++++--- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 13 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 32 +-- .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/mellanox/mlx4/cq.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +- drivers/net/ethernet/microchip/lan743x_main.c | 32 +++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/microsoft/mana/mana_en.c | 72 ++++--- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++-- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/hyperv/netvsc.c | 19 +- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 9 +- drivers/net/phy/mscc/mscc_main.c | 38 +--- drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/usb/r8152.c | 211 ++++++++++++++++--- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/vxlan/vxlan_vnifilter.c | 5 +- drivers/net/wireguard/send.c | 20 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 + drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 17 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/parport/share.c | 11 +- drivers/phy/tegra/xusb-tegra186.c | 38 +++- drivers/phy/tegra/xusb.h | 1 + drivers/platform/x86/intel/vsec.c | 77 +++++-- drivers/platform/x86/intel/vsec.h | 2 +- drivers/ptp/ptp_vclock.c | 14 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_transport_fc.c | 77 +++---- drivers/slimbus/qcom-ngd-ctrl.c | 5 +- drivers/spi/spi-amd.c | 2 +- drivers/spi/spi-cavium-thunderx.c | 2 +- drivers/spi/spi-falcon.c | 2 +- drivers/spi/spi-imx.c | 8 +- drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-lp8841-rtc.c | 2 +- drivers/spi/spi-microchip-core-qspi.c | 47 ++--- drivers/spi/spi-mxs.c | 2 +- drivers/spi/spi-omap-uwire.c | 2 +- drivers/spi/spi-pic32-sqi.c | 2 +- drivers/spi/spi-qcom-qspi.c | 2 +- drivers/spi/spi-qup.c | 169 +++++++-------- drivers/spi/spi-rockchip-sfc.c | 2 +- drivers/spi/spi-s3c64xx.c | 44 +--- drivers/spi/spi-sprd-adi.c | 2 +- drivers/spi/spi-st-ssc4.c | 76 +++---- drivers/spi/spi-sun4i.c | 84 ++++---- drivers/spi/spi-sun6i.c | 9 +- drivers/spi/spi-synquacer.c | 92 ++++---- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 97 +++++---- drivers/spi/spi-topcliff-pch.c | 6 +- drivers/spi/spi-uniphier.c | 216 ++++++++++--------- drivers/spi/spi-xcomm.c | 2 +- drivers/spi/spi-zynq-qspi.c | 89 +++----- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/spi/spi.c | 61 +++--- drivers/staging/greybus/hid.c | 2 +- drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 ++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/tee/optee/supp.c | 107 +++++++--- drivers/thermal/thermal_core.c | 7 +- drivers/thunderbolt/property.c | 38 +++- drivers/thunderbolt/xdomain.c | 14 +- drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 57 ++--- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 75 +++---- drivers/tty/serial/samsung_tty.c | 130 ++++++------ drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 40 ++-- drivers/tty/serial/zs.h | 2 +- drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/dwc3/dwc3-xilinx.c | 26 +-- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_hid.c | 20 +- drivers/usb/gadget/function/f_ncm.c | 33 ++- drivers/usb/gadget/function/u_ether.c | 28 ++- drivers/usb/gadget/function/u_ether.h | 26 +++ drivers/usb/gadget/function/u_ncm.h | 2 +- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 76 ++++--- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 +- drivers/usb/serial/io_ti.c | 11 + drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 ++- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 ++- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/video/fbdev/core/fb_defio.c | 164 +++++++++++++-- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/vt8500lcdfb.c | 2 +- fs/btrfs/inode.c | 2 + fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 8 +- fs/btrfs/sysfs.c | 5 +- fs/btrfs/sysfs.h | 3 +- fs/ceph/dir.c | 6 +- fs/erofs/decompressor.c | 1 + fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 5 +- fs/f2fs/inline.c | 13 +- fs/f2fs/node.c | 4 +- fs/f2fs/segment.c | 10 +- fs/f2fs/super.c | 29 ++- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/hfsplus/bfind.c | 51 +++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/hpfs/alloc.c | 2 +- fs/iomap/buffered-io.c | 4 - fs/ntfs3/xattr.c | 1 + fs/smb/client/cifsacl.c | 128 +++++++++-- fs/smb/client/ioctl.c | 2 +- fs/smb/client/netlink.c | 6 +- fs/smb/client/smb2transport.c | 32 ++- fs/smb/server/smb2pdu.c | 11 + fs/smb/server/smbacl.c | 17 +- fs/udf/super.c | 4 +- fs/xfs/xfs_buf.c | 1 + include/drm/display/drm_dp.h | 1 + include/drm/drm_fourcc.h | 5 +- include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 + include/linux/compiler_types.h | 4 + include/linux/damon.h | 2 + include/linux/fb.h | 4 +- include/linux/hid.h | 15 +- include/linux/hugetlb.h | 14 +- include/linux/mm.h | 5 - include/linux/parport.h | 1 + include/linux/printk.h | 13 ++ include/linux/syscalls.h | 4 + include/net/act_api.h | 1 + include/net/bluetooth/bluetooth.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/bonding.h | 1 + include/net/genetlink.h | 9 +- include/net/ip_vs.h | 3 +- include/net/mctp.h | 3 + include/net/netfilter/nf_conntrack_core.h | 5 + include/net/netfilter/nf_conntrack_helper.h | 1 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 36 +--- include/rdma/ib_verbs.h | 48 ----- include/rdma/iter.h | 88 ++++++++ ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/cgroup/cpuset.c | 8 +- kernel/pid.c | 8 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/debugobjects.c | 2 +- lib/mpi/mpicoder.c | 2 +- lib/test_hmm.c | 86 ++++---- mm/damon/core.c | 37 +++- mm/damon/lru_sort.c | 84 +++++--- mm/damon/ops-common.c | 4 +- mm/damon/reclaim.c | 84 +++++--- mm/gup.c | 2 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 113 +++++++--- mm/memory-failure.c | 92 ++++---- mm/memory.c | 2 +- mm/memory_hotplug.c | 2 +- mm/mempolicy.c | 2 +- mm/migrate.c | 18 +- mm/page_alloc.c | 1 + net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 + net/batman-adv/bat_iv_ogm.c | 82 ++++++-- net/batman-adv/bat_v_ogm.c | 59 +++--- net/batman-adv/bridge_loop_avoidance.c | 57 +++-- net/batman-adv/main.c | 1 + net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 109 +++++++--- net/batman-adv/tp_meter.h | 1 + net/batman-adv/translation-table.c | 43 +++- net/batman-adv/tvlv.c | 28 ++- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 46 +++- net/bluetooth/6lowpan.c | 2 + net/bluetooth/af_bluetooth.c | 113 ++++++++-- net/bluetooth/bnep/core.c | 50 +++-- net/bluetooth/hci_sync.c | 5 + net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/hidp/core.c | 23 +- net/bluetooth/hidp/sock.c | 10 +- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 87 +++++++- net/bluetooth/l2cap_sock.c | 35 +--- net/bluetooth/mgmt.c | 17 +- net/bluetooth/rfcomm/core.c | 69 ++++-- net/bluetooth/rfcomm/sock.c | 26 ++- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 ++- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 +++ net/core/drop_monitor.c | 2 +- net/core/filter.c | 17 +- net/core/gro.c | 3 + net/core/skbuff.c | 20 +- net/core/sock.c | 13 +- net/ethtool/eeprom.c | 5 +- net/hsr/hsr_forward.c | 4 +- net/hsr/hsr_framereg.c | 6 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/ah4.c | 31 +-- net/ipv4/esp4.c | 4 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 +- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nf_nat_h323.c | 2 + net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/udp.c | 8 + net/ipv6/ah6.c | 29 ++- net/ipv6/datagram.c | 54 ++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 21 +- net/ipv6/ip6_vti.c | 25 ++- net/ipv6/mcast.c | 8 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/route.c | 5 + net/ipv6/sit.c | 1 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/mac80211/mlme.c | 4 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 9 +- net/mptcp/options.c | 43 ++-- net/mptcp/pm.c | 34 ++- net/mptcp/pm_netlink.c | 45 ++-- net/mptcp/protocol.c | 29 ++- net/mptcp/sockopt.c | 8 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/nf_conntrack_ecache.c | 2 + net/netfilter/nf_conntrack_expect.c | 10 +- net/netfilter/nf_conntrack_helper.c | 19 ++ net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_netlink.c | 28 ++- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_nat_core.c | 2 + net/netfilter/nf_nat_sip.c | 1 + net/netfilter/nf_synproxy_core.c | 26 ++- net/netfilter/nf_tables_api.c | 41 +++- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_set_bitmap.c | 4 +- net/netfilter/nft_set_hash.c | 8 +- net/netfilter/nft_set_pipapo.c | 5 +- net/netfilter/nft_set_rbtree.c | 4 +- net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 +-- net/netlink/af_netlink.c | 11 +- net/netlink/genetlink.c | 4 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 + net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/openvswitch/datapath.c | 1 + net/packet/af_packet.c | 74 ++++--- net/packet/diag.c | 6 +- net/packet/internal.h | 8 +- net/psample/psample.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/qrtr/ns.c | 180 ++++++---------- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/sched/act_api.c | 7 +- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 ---- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 21 +- net/socket.c | 11 +- net/vmw_vsock/vmci_transport.c | 4 +- net/wireless/nl80211.c | 3 + net/xfrm/espintcp.c | 4 + net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 35 +++- net/xfrm/xfrm_user.c | 5 +- security/apparmor/policy_unpack.c | 27 +-- sound/aoa/codecs/onyx.c | 104 +++------ sound/aoa/codecs/tas.c | 113 ++++------ sound/aoa/core/gpio-feature.c | 20 +- sound/aoa/core/gpio-pmf.c | 26 +-- sound/aoa/soundbus/i2sbus/core.c | 3 + sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++++------- sound/core/pcm_native.c | 7 +- sound/core/timer.c | 1 + .../motu/motu-register-dsp-message-parser.c | 14 +- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/codecs/wm_adsp.c | 3 + sound/soc/intel/boards/bytcht_es8316.c | 29 ++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++-- tools/bootconfig/main.c | 23 +- tools/perf/Makefile.config | 1 + tools/perf/util/Build | 32 ++- tools/perf/util/expr.y | 4 +- tools/perf/util/parse-events.y | 3 + tools/perf/util/pmu.y | 3 + tools/scripts/utilities.mak | 20 ++ tools/testing/selftests/bpf/DENYLIST.s390x | 1 - tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/prog_tests/align.c | 18 +- tools/testing/selftests/bpf/prog_tests/bpf_nf.c | 6 +- tools/testing/selftests/bpf/prog_tests/empty_skb.c | 12 +- .../bpf/prog_tests/libbpf_get_fd_by_id_opts.c | 87 -------- .../selftests/bpf/prog_tests/ns_current_pid_tgid.c | 73 ------- .../selftests/bpf/prog_tests/test_global_funcs.c | 131 +++--------- .../selftests/bpf/prog_tests/xdp_synproxy.c | 6 +- tools/testing/selftests/bpf/progs/bpf_misc.h | 5 + .../selftests/bpf/progs/test_global_func1.c | 6 +- .../selftests/bpf/progs/test_global_func10.c | 1 + .../selftests/bpf/progs/test_global_func11.c | 4 +- .../selftests/bpf/progs/test_global_func12.c | 4 +- .../selftests/bpf/progs/test_global_func13.c | 4 +- .../selftests/bpf/progs/test_global_func14.c | 4 +- .../selftests/bpf/progs/test_global_func15.c | 4 +- .../selftests/bpf/progs/test_global_func16.c | 4 +- .../selftests/bpf/progs/test_global_func17.c | 5 +- .../selftests/bpf/progs/test_global_func2.c | 43 +++- .../selftests/bpf/progs/test_global_func3.c | 10 +- .../selftests/bpf/progs/test_global_func4.c | 55 ++++- .../selftests/bpf/progs/test_global_func5.c | 4 +- .../selftests/bpf/progs/test_global_func6.c | 4 +- .../selftests/bpf/progs/test_global_func7.c | 4 +- .../selftests/bpf/progs/test_global_func8.c | 4 +- .../selftests/bpf/progs/test_global_func9.c | 4 +- .../bpf/progs/test_libbpf_get_fd_by_id_opts.c | 37 ---- .../selftests/bpf/progs/test_ns_current_pid_tgid.c | 7 - tools/testing/selftests/bpf/test_loader.c | 233 +++++++++++++++++++++ tools/testing/selftests/bpf/test_progs.h | 33 +++ tools/testing/selftests/bpf/trace_helpers.c | 82 ++++++++ tools/testing/selftests/bpf/trace_helpers.h | 5 + tools/testing/selftests/bpf/verifier/int_ptr.c | 6 +- tools/testing/selftests/net/forwarding/lib.sh | 56 +++++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- tools/testing/selftests/ptp/testptp.c | 62 +----- tools/testing/selftests/vm/hmm-tests.c | 50 +++++ 543 files changed, 6595 insertions(+), 3687 deletions(-)

2 months, 3 weeks

[PATCH 5.15 000/410] 5.15.210-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.210 release. There are 410 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 19 Jun 2026 08:02:26 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.210-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.210-rc2 Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix backward compatibility with userspace Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: fix inverted error logic Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix context leak in nx842_crypto_free_ctx Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function Ben Hutchings <benh(a)debian.org> apparmor: validate default DFA states are in bounds Ben Hutchings <benh(a)debian.org> fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Christian Göttsche <cgzones(a)googlemail.com> selinux: enable genfscon labeling for securityfs Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Jeff Layton <jlayton(a)kernel.org> nfsd: fix heap overflow in NFSv4.0 LOCK replay cache Eric Biggers <ebiggers(a)kernel.org> ksmbd: Compare MACs in constant time Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Tejun Heo <tj(a)kernel.org> blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: align #define values Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: remove unused symbols Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Michael Kelley <mikelley(a)microsoft.com> drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7 Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() John Keeping <john(a)metanate.com> usb: gadget: f_hid: tidy error handling in hidg_alloc Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: use u32 for register interactions Thomas Gleixner <tglx(a)linutronix.de> serial: samsung_tty: Use port lock wrappers Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Fix per-pad high-speed termination calibration Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Disable trk clk when not in use Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Johan Hovold <johan(a)kernel.org> spi: qup: fix error pointer deref after DMA setup failure Yang Yingliang <yangyingliang(a)huawei.com> spi: qup: switch to use modern name Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Sam Daly <sam(a)samdaly.ie> octeontx2-af: CGX: add bounds check to cgx_speed_mbps index Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Al Viro <viro(a)zeniv.linux.org.uk> use less confusing names for iov_iter direction initializers Justin Iurman <justin.iurman(a)gmail.com> ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Eric Dumazet <edumazet(a)google.com> ipv6/addrconf: annotate data-races around devconf fields (II) Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Jiexun Wang <wangjiexun2025(a)gmail.com> Bluetooth: serialize accept_q access Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Init sk_peer_* on bt_sock_alloc Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Consolidate code around sk_alloc into a helper function Dawei Feng <dawei.feng(a)seu.edu.cn> qed: fix double free in qed_cxt_tables_alloc() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> qed: Use the bitmap API to simplify some functions Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: MGMT: validate Add Extended Advertising Data length Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2 Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Safa Karakuş <safa.karakus(a)secunnix.com> Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require net admin for CIFS SWN netlink Ido Schimmel <idosch(a)nvidia.com> genetlink: Use internal flags for multicast groups Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Piyush Sachdeva <s.piyush1024(a)gmail.com> smb: client: Use FullSessionKey for AES-256 encryption key derivation Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: topcliff-pch: Convert to platform remove callback returning void Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: spi-ti-qspi: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Eric Biggers <ebiggers(a)google.com> net: ipv6: stop checking crypto_ahash_alignmask Eric Biggers <ebiggers(a)google.com> net: ipv4: stop checking crypto_ahash_alignmask Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Avoid -Wflex-array-member-not-at-end warning Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Julia Lawall <Julia.Lawall(a)inria.fr> can: ucan: fix typos in comments Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Vignesh Viswanathan <quic_viswanat(a)quicinc.com> net: qrtr: ns: Change servers radix tree to xarray Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Gao Xiang <hsiangkao(a)linux.alibaba.com> erofs: fix the out-of-bounds nameoff handling for trailing dirents Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Jimmy Hon <honyuenkwun(a)gmail.com> rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Eric Biggers <ebiggers(a)kernel.org> net/tcp-md5: Fix MAC comparison to be constant-time Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Lorenzo Bianconi <lorenzo(a)kernel.org> net: mvpp2: Add metadata support for xdp mode Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VPIPT I-cache handling Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Jeff Layton <jlayton(a)kernel.org> nfsd: don't ignore the return code of svc_proc_register() Edward Lo <loyuantsung(a)gmail.com> fs/ntfs3: Return error for inconsistent extended attributes Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Nathan Chancellor <nathan(a)kernel.org> compiler-clang.h: Add __diag infrastructure for clang Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix SuperSpeed root hub wMaxPacketSize Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Stefan Metzmacher <metze(a)samba.org> smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Harini Katakam <harini.katakam(a)amd.com> phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table Jiasheng Jiang <jiashengjiangcool(a)gmail.com> RDMA/rxe: Fix double free in rxe_srq_from_init Ben Hutchings <benh(a)debian.org> Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Duoming Zhou <duoming(a)zju.edu.cn> wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Petr Machata <petrm(a)nvidia.com> selftests: forwarding: lib: Add helpers for checksum handling Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix not releasing workqueue on .release() Carlos Eduardo Gallo Filho <gcarlos(a)disroot.org> drm: Remove plane hsub/vsub alignment requirement for core helpers Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/arm64/silicon-errata.rst | 46 ++++++ Makefile | 4 +- arch/arm/include/asm/io.h | 15 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 ++++++ arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 55 +++++-- arch/arm64/kernel/cpu_errata.c | 34 +++- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +---- arch/arm64/kvm/hyp/vhe/tlb.c | 19 +-- arch/arm64/mm/mmu.c | 36 +++-- arch/x86/kernel/cpu/amd.c | 18 ++- arch/x86/kernel/cpu/microcode/intel.c | 4 +- block/blk-cgroup.c | 32 ++-- crypto/testmgr.c | 4 +- drivers/base/power/domain.c | 10 +- drivers/block/drbd/drbd_main.c | 2 +- drivers/block/drbd/drbd_receiver.c | 2 +- drivers/block/loop.c | 14 +- drivers/block/nbd.c | 10 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 33 ++-- drivers/char/random.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 47 +++--- drivers/crypto/nx/nx-842.h | 24 +-- drivers/crypto/nx/nx-common-powernv.c | 31 ++-- drivers/crypto/nx/nx-common-pseries.c | 33 ++-- drivers/dma/idxd/init.c | 1 - drivers/dma/idxd/sysfs.c | 1 + drivers/fsi/fsi-sbefifo.c | 6 +- drivers/gpio/gpio-rockchip.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 ++++--- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 136 ++++++++++++---- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 34 +++- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 ++- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/hid/hid-core.c | 29 +++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi.c | 2 +- drivers/hid/wacom_sys.c | 19 ++- drivers/hid/wacom_wac.h | 1 + drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +++--- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 ++++---- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 8 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++++ drivers/infiniband/core/verbs.c | 38 ----- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 1 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_srq.c | 3 - drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 30 +++- drivers/input/keyboard/atkbd.c | 15 ++ drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 ++- drivers/isdn/mISDN/l1oip_core.c | 2 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/media/rc/igorplugusb.c | 19 ++- drivers/media/rc/ttusbir.c | 13 +- drivers/misc/fastrpc.c | 77 ++++++--- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci-of-dwcmshc.c | 17 +- drivers/mmc/host/sdhci.c | 1 + drivers/mtd/spi-nor/sst.c | 13 ++ drivers/net/bonding/bond_main.c | 10 +- drivers/net/can/usb/ucan.c | 6 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 +++++---- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/microchip/lan743x_main.c | 32 ++++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 26 +-- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/hyperv/netvsc.c | 19 ++- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 9 +- drivers/net/phy/mscc/mscc_main.c | 38 +---- drivers/net/ppp/ppp_generic.c | 2 +- drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +-- .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 + drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nfc/nxp-nci/i2c.c | 21 ++- drivers/nvme/host/tcp.c | 4 +- drivers/nvme/target/io-cmd-file.c | 4 +- drivers/nvme/target/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/phy/tegra/xusb-tegra186.c | 38 +++-- drivers/phy/tegra/xusb.h | 1 + drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_transport_fc.c | 77 ++++----- drivers/scsi/sg.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 3 - drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-qup.c | 165 +++++++++---------- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 9 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 15 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-uniphier.c | 8 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/staging/greybus/hid.c | 2 +- drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/target/iscsi/iscsi_target_util.c | 4 +- drivers/target/target_core_file.c | 2 +- drivers/tee/optee/supp.c | 107 ++++++++---- drivers/thermal/thermal_core.c | 7 +- drivers/thunderbolt/property.c | 38 +++-- drivers/thunderbolt/xdomain.c | 6 +- drivers/tty/serial/altera_jtaguart.c | 18 ++- drivers/tty/serial/dz.c | 58 ++++--- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 ++- drivers/tty/serial/qcom_geni_serial.c | 75 ++++----- drivers/tty/serial/samsung_tty.c | 88 +++++----- drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 40 ++--- drivers/tty/serial/zs.h | 2 +- drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/dwc3/dwc3-xilinx.c | 20 +-- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_hid.c | 20 +-- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 76 +++++---- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 ++- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/io_ti.c | 11 ++ drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 +-- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 7 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/usbip_common.c | 2 +- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/vhost/net.c | 6 +- drivers/vhost/scsi.c | 10 +- drivers/vhost/vhost.c | 6 +- drivers/vhost/vringh.c | 4 +- drivers/vhost/vsock.c | 4 +- drivers/video/fbdev/core/fb_defio.c | 152 +++++++++++++++-- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/vt8500lcdfb.c | 2 +- drivers/xen/pvcalls-back.c | 8 +- fs/9p/vfs_addr.c | 4 +- fs/9p/vfs_dir.c | 2 +- fs/9p/xattr.c | 4 +- fs/afs/cmservice.c | 2 +- fs/afs/dir.c | 2 +- fs/afs/file.c | 4 +- fs/afs/internal.h | 4 +- fs/afs/rxrpc.c | 10 +- fs/afs/write.c | 4 +- fs/aio.c | 4 +- fs/btrfs/inode.c | 2 + fs/btrfs/ioctl.c | 5 +- fs/ceph/addr.c | 2 +- fs/ceph/dir.c | 6 +- fs/ceph/file.c | 4 +- fs/cifs/cifsacl.c | 129 +++++++++++++-- fs/cifs/connect.c | 6 +- fs/cifs/file.c | 4 +- fs/cifs/ioctl.c | 2 +- fs/cifs/netlink.c | 6 +- fs/cifs/smb2ops.c | 10 +- fs/cifs/smb2transport.c | 36 +++-- fs/cifs/smbdirect.c | 4 +- fs/cifs/transport.c | 6 +- fs/erofs/decompressor.c | 1 + fs/erofs/dir.c | 30 ++-- fs/ext4/extents.c | 15 ++ fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 5 +- fs/f2fs/inline.c | 13 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 20 ++- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/fuse/ioctl.c | 4 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/hpfs/alloc.c | 2 +- fs/ksmbd/auth.c | 4 +- fs/ksmbd/smb2pdu.c | 5 +- fs/ksmbd/smbacl.c | 17 +- fs/ksmbd/transport_tcp.c | 4 +- fs/nfsd/nfs4xdr.c | 9 +- fs/nfsd/nfsctl.c | 9 +- fs/nfsd/state.h | 17 +- fs/nfsd/stats.c | 4 +- fs/nfsd/stats.h | 2 +- fs/nfsd/vfs.c | 4 +- fs/ntfs3/xattr.c | 1 + fs/ocfs2/cluster/tcp.c | 2 +- fs/orangefs/inode.c | 8 +- fs/read_write.c | 12 +- fs/seq_file.c | 2 +- fs/splice.c | 10 +- fs/udf/super.c | 4 +- include/drm/drm_dp_helper.h | 1 + include/drm/drm_fourcc.h | 5 +- include/linux/compat.h | 4 + include/linux/compiler-clang.h | 28 ++++ include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/fb.h | 4 +- include/linux/hid.h | 15 +- include/linux/parport.h | 1 + include/linux/printk.h | 13 ++ include/linux/randomize_kstack.h | 44 ++++- include/linux/sched.h | 4 + include/linux/syscalls.h | 4 + include/linux/uio.h | 3 + include/net/act_api.h | 1 + include/net/bluetooth/bluetooth.h | 3 + include/net/bluetooth/l2cap.h | 1 + include/net/genetlink.h | 9 +- include/net/ip_vs.h | 3 +- include/net/mctp.h | 3 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 36 +---- include/rdma/ib_verbs.h | 48 ------ include/rdma/iter.h | 88 ++++++++++ init/main.c | 1 - io_uring/io_uring.c | 2 +- ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/fork.c | 2 + kernel/pid.c | 8 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/debugobjects.c | 2 +- lib/mpi/mpicoder.c | 2 +- mm/damon/vaddr.c | 4 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 1 + mm/madvise.c | 2 +- mm/page_io.c | 2 +- mm/process_vm_access.c | 2 +- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 ++ net/9p/client.c | 2 +- net/batman-adv/bat_iv_ogm.c | 82 ++++++++-- net/batman-adv/bat_v_ogm.c | 59 ++++--- net/batman-adv/bridge_loop_avoidance.c | 57 ++++--- net/batman-adv/main.c | 1 + net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 118 ++++++++++---- net/batman-adv/tp_meter.h | 1 + net/batman-adv/translation-table.c | 35 +++- net/batman-adv/tvlv.c | 28 +++- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 49 +++++- net/bluetooth/6lowpan.c | 4 +- net/bluetooth/a2mp.c | 2 +- net/bluetooth/af_bluetooth.c | 144 ++++++++++++++--- net/bluetooth/bnep/core.c | 50 ++++-- net/bluetooth/bnep/sock.c | 10 +- net/bluetooth/hci_event.c | 18 ++- net/bluetooth/hci_sock.c | 10 +- net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/hidp/sock.c | 10 +- net/bluetooth/l2cap_core.c | 87 +++++++++- net/bluetooth/l2cap_sock.c | 86 +++++----- net/bluetooth/mgmt.c | 21 ++- net/bluetooth/rfcomm/core.c | 69 +++++--- net/bluetooth/rfcomm/sock.c | 48 ++++-- net/bluetooth/sco.c | 19 ++- net/bluetooth/smp.c | 2 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 ++-- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 ++++ net/ceph/messenger_v1.c | 4 +- net/ceph/messenger_v2.c | 14 +- net/compat.c | 2 +- net/core/drop_monitor.c | 2 +- net/core/filter.c | 17 +- net/core/skbuff.c | 10 +- net/ethtool/eeprom.c | 5 +- net/hsr/hsr_framereg.c | 6 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/ah4.c | 31 ++-- net/ipv4/esp4.c | 4 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_ipv4.c | 5 +- net/ipv6/addrconf.c | 47 +++--- net/ipv6/ah6.c | 29 ++-- net/ipv6/datagram.c | 54 ++++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 28 +++- net/ipv6/ioam6.c | 12 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6_vti.c | 25 ++- net/ipv6/mcast.c | 22 +-- net/ipv6/ndisc.c | 12 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/seg6_hmac.c | 8 +- net/ipv6/sit.c | 1 + net/ipv6/tcp_ipv6.c | 5 +- net/iucv/af_iucv.c | 20 ++- net/key/af_key.c | 6 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 9 +- net/mptcp/options.c | 29 ++-- net/mptcp/pm.c | 34 +++- net/mptcp/pm_netlink.c | 31 +++- net/mptcp/protocol.c | 26 ++- net/mptcp/sockopt.c | 8 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +-- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +-- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/ipvs/ip_vs_sync.c | 2 +- net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_synproxy_core.c | 26 ++- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 ++-- net/netlink/af_netlink.c | 11 +- net/netlink/genetlink.c | 4 +- net/nfc/hci/core.c | 10 ++ net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 ++ net/openvswitch/datapath.c | 1 + net/packet/af_packet.c | 25 +-- net/psample/psample.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/qrtr/ns.c | 180 ++++++++------------- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/sched/act_api.c | 7 +- net/sched/cls_fw.c | 6 +- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 4 +- net/smc/smc_clc.c | 6 +- net/socket.c | 23 +-- net/sunrpc/socklib.c | 6 +- net/sunrpc/svcsock.c | 4 +- net/sunrpc/xprtsock.c | 6 +- net/tipc/topsrv.c | 2 +- net/tls/tls_device.c | 4 +- net/vmw_vsock/vmci_transport.c | 4 +- net/xfrm/espintcp.c | 6 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 35 ++-- net/xfrm/xfrm_user.c | 5 +- security/apparmor/policy_unpack.c | 27 ++-- security/keys/keyctl.c | 4 +- security/selinux/hooks.c | 3 +- sound/aoa/codecs/onyx.c | 104 ++++-------- sound/aoa/codecs/tas.c | 113 +++++-------- sound/aoa/core/gpio-feature.c | 20 +-- sound/aoa/core/gpio-pmf.c | 26 ++- sound/aoa/soundbus/i2sbus/core.c | 3 + sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++++++-------- sound/core/misc.c | 14 +- sound/core/timer.c | 1 + sound/drivers/aloop.c | 40 +++-- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 +++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++--- tools/testing/selftests/net/forwarding/lib.sh | 56 +++++++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- 480 files changed, 4805 insertions(+), 2544 deletions(-)

2 months, 3 weeks

[PATCH 5.10 000/342] 5.10.259-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.259 release. There are 342 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.259-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.259-rc1 Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function Ben Hutchings <benh(a)debian.org> apparmor: validate default DFA states are in bounds Ben Hutchings <benh(a)debian.org> fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Easwar Hariharan <eahariha(a)linux.microsoft.com> arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() John Keeping <john(a)metanate.com> usb: gadget: f_hid: tidy error handling in hidg_alloc Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: use u32 for register interactions Thomas Gleixner <tglx(a)linutronix.de> serial: samsung_tty: Use port lock wrappers Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: align #define values Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: remove unused symbols Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Fix per-pad high-speed termination calibration Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Disable trk clk when not in use Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Johan Hovold <johan(a)kernel.org> spi: qup: fix error pointer deref after DMA setup failure Yang Yingliang <yangyingliang(a)huawei.com> spi: qup: switch to use modern name Sam Daly <sam(a)samdaly.ie> octeontx2-af: CGX: add bounds check to cgx_speed_mbps index Justin Stitt <justinstitt(a)google.com> octeontx2-af: replace deprecated strncpy with strscpy Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: Add validation for lmac type Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Al Viro <viro(a)zeniv.linux.org.uk> use less confusing names for iov_iter direction initializers Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Jiexun Wang <wangjiexun2025(a)gmail.com> Bluetooth: serialize accept_q access Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Init sk_peer_* on bt_sock_alloc Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Consolidate code around sk_alloc into a helper function Haoze Xie <royenheart(a)gmail.com> netfilter: nf_queue: hold bridge skb->dev while queued Yajun Deng <yajun.deng(a)linux.dev> net: Remove redundant if statements Dawei Feng <dawei.feng(a)seu.edu.cn> qed: fix double free in qed_cxt_tables_alloc() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> qed: Use the bitmap API to simplify some functions Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Safa Karakuş <safa.karakus(a)secunnix.com> Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Piyush Sachdeva <s.piyush1024(a)gmail.com> smb: client: Use FullSessionKey for AES-256 encryption key derivation Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Joe Thornber <ejt(a)redhat.com> dm btree: improve btree residency Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory John 'Warthog9' Hawley (VMware) <warthog9(a)eaglescrag.net> ktest: Fixing indentation to match expected pattern Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Julia Lawall <Julia.Lawall(a)inria.fr> can: ucan: fix typos in comments Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Vignesh Viswanathan <quic_viswanat(a)quicinc.com> net: qrtr: ns: Change servers radix tree to xarray Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Gao Xiang <hsiangkao(a)linux.alibaba.com> erofs: fix the out-of-bounds nameoff handling for trailing dirents Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VPIPT I-cache handling Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Pavel Begunkov <asml.silence(a)gmail.com> io_uring: prevent opcode speculation Felix Gu <ustc.gu(a)gmail.com> spi: meson-spicc: Fix double-put in remove path Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Jeff Layton <jlayton(a)kernel.org> nfsd: don't ignore the return code of svc_proc_register() Zqiang <qiang.zhang(a)linux.dev> usbnet: Fix using smp_processor_id() in preemptible code warnings Eric Dumazet <edumazet(a)google.com> bonding: limit BOND_MODE_8023AD to Ethernet devices Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Nathan Chancellor <nathan(a)kernel.org> compiler-clang.h: Add __diag infrastructure for clang Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix SuperSpeed root hub wMaxPacketSize Nikola Z. Ivanov <zlatistiv(a)gmail.com> team: Move team device type change at the end of team_port_add Dong Chenchen <dongchenchen2(a)huawei.com> page_pool: Fix use-after-free in page_pool_recycle_in_ring Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> Bluetooth: hci_core: Fix use-after-free in vhci_flush() Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Stefan Metzmacher <metze(a)samba.org> smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path Jiasheng Jiang <jiashengjiangcool(a)gmail.com> RDMA/rxe: Fix double free in rxe_srq_from_init Ben Hutchings <benh(a)debian.org> Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Petr Machata <petrm(a)nvidia.com> selftests: forwarding: lib: Add helpers for checksum handling Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid role confusion in tp_list Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix race condition in send error reporting Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> nfc: llcp: protect nfc_llcp_sock_unlink() calls Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Nobuhiro Iwamatsu <iwamatsu(a)nigauri.org> phy: renesas: rcar-gen3-usb2: Fix the use of msleep during spinlock Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Chengfeng Ye <cyeaa(a)connect.ust.hk> ALSA: usb-audio: fix null pointer dereference on pointer cs_desc Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/arm64/silicon-errata.rst | 48 +++ Makefile | 4 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 +++ arch/arm64/include/asm/cputype.h | 10 + arch/arm64/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 55 ++- arch/arm64/kernel/cpu_errata.c | 34 +- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +- arch/arm64/kvm/hyp/vhe/tlb.c | 19 +- arch/arm64/mm/mmu.c | 36 +- arch/x86/kernel/cpu/amd.c | 18 +- arch/x86/kernel/cpu/microcode/intel.c | 2 +- crypto/testmgr.c | 4 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/base/power/domain.c | 10 +- drivers/block/drbd/drbd_main.c | 2 +- drivers/block/drbd/drbd_receiver.c | 2 +- drivers/block/loop.c | 14 +- drivers/block/nbd.c | 10 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 33 +- drivers/char/random.c | 4 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/fsi/fsi-sbefifo.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 6 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 +- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/hid/hid-core.c | 29 +- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi.c | 2 +- drivers/hid/wacom_sys.c | 19 +- drivers/hid/wacom_wac.h | 1 + drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-tegra.c | 53 +-- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/npcm_adc.c | 26 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 ++- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 8 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 ++ drivers/infiniband/core/verbs.c | 37 -- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/i40iw/i40iw_verbs.c | 1 + drivers/infiniband/hw/mlx4/mr.c | 1 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_srq.c | 3 - drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 30 +- drivers/input/keyboard/atkbd.c | 15 + drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/isdn/mISDN/l1oip_core.c | 2 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/persistent-data/dm-btree.c | 451 +++++++++++++++++++-- .../md/persistent-data/dm-transaction-manager.c | 9 + .../md/persistent-data/dm-transaction-manager.h | 10 +- drivers/media/rc/igorplugusb.c | 17 +- drivers/media/rc/ttusbir.c | 13 +- drivers/misc/fastrpc.c | 75 ++-- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/sdhci.c | 1 + drivers/mtd/spi-nor/sst.c | 13 + drivers/net/bonding/bond_main.c | 11 +- drivers/net/can/usb/ucan.c | 6 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 7 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 20 +- drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 1 + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/microchip/lan743x_main.c | 32 ++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 26 +- drivers/net/hyperv/netvsc.c | 19 +- drivers/net/macsec.c | 3 +- drivers/net/ppp/ppp_generic.c | 2 +- drivers/net/tap.c | 2 + drivers/net/team/team.c | 23 +- drivers/net/tun.c | 5 +- drivers/net/usb/usbnet.c | 2 + drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 + drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvme/host/tcp.c | 4 +- drivers/nvme/target/io-cmd-file.c | 4 +- drivers/nvme/target/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 2 +- drivers/phy/tegra/xusb-tegra186.c | 38 +- drivers/phy/tegra/xusb.h | 1 + drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/sg.c | 2 +- drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 2 - drivers/spi/spi-qup.c | 165 ++++---- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 10 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 11 +- drivers/spi/spi-topcliff-pch.c | 7 +- drivers/spi/spi-uniphier.c | 8 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/staging/comedi/drivers/comedi_test.c | 5 +- drivers/staging/greybus/hid.c | 2 +- drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 ++- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/target/iscsi/iscsi_target_util.c | 4 +- drivers/target/target_core_file.c | 2 +- drivers/tee/optee/supp.c | 107 +++-- drivers/thermal/thermal_core.c | 7 +- drivers/thunderbolt/property.c | 38 +- drivers/thunderbolt/xdomain.c | 6 +- drivers/tty/serial/altera_jtaguart.c | 18 +- drivers/tty/serial/dz.c | 58 +-- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 75 ++-- drivers/tty/serial/samsung_tty.c | 103 +++-- drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 40 +- drivers/tty/serial/zs.h | 2 +- drivers/usb/cdns3/gadget.c | 12 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/usbtmc.c | 14 + drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/function/f_hid.c | 20 +- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 76 ++-- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 +- drivers/usb/serial/io_ti.c | 11 + drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 +- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 13 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/usbip_common.c | 2 +- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/vhost/net.c | 6 +- drivers/vhost/scsi.c | 10 +- drivers/vhost/vhost.c | 6 +- drivers/vhost/vringh.c | 4 +- drivers/vhost/vsock.c | 4 +- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/vt8500lcdfb.c | 2 +- drivers/xen/pvcalls-back.c | 8 +- fs/9p/vfs_addr.c | 4 +- fs/9p/vfs_dir.c | 2 +- fs/9p/xattr.c | 4 +- fs/afs/cmservice.c | 2 +- fs/afs/internal.h | 4 +- fs/afs/rxrpc.c | 12 +- fs/aio.c | 4 +- fs/btrfs/inode.c | 2 + fs/btrfs/ioctl.c | 5 +- fs/ceph/dir.c | 6 +- fs/ceph/file.c | 4 +- fs/cifs/cifsacl.c | 1 + fs/cifs/connect.c | 6 +- fs/cifs/file.c | 4 +- fs/cifs/smb2ops.c | 10 +- fs/cifs/smb2transport.c | 36 +- fs/cifs/smbdirect.c | 4 +- fs/cifs/transport.c | 6 +- fs/erofs/dir.c | 30 +- fs/ext4/extents.c | 15 + fs/f2fs/data.c | 4 +- fs/f2fs/inline.c | 13 +- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/hfsplus/bfind.c | 51 +++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/hpfs/alloc.c | 2 +- fs/nfsd/nfsctl.c | 9 +- fs/nfsd/stats.c | 4 +- fs/nfsd/stats.h | 2 +- fs/nfsd/vfs.c | 4 +- fs/ocfs2/cluster/tcp.c | 2 +- fs/orangefs/inode.c | 6 +- fs/read_write.c | 12 +- fs/seq_file.c | 2 +- fs/splice.c | 10 +- fs/udf/super.c | 4 +- include/linux/compat.h | 4 + include/linux/compiler-clang.h | 28 ++ include/linux/compiler_attributes.h | 11 + include/linux/compiler_types.h | 4 + include/linux/hid.h | 15 +- include/linux/parport.h | 1 + include/linux/printk.h | 13 + include/linux/syscalls.h | 4 + include/linux/uio.h | 3 + include/net/act_api.h | 1 + include/net/bluetooth/bluetooth.h | 3 + include/net/bluetooth/hci_core.h | 2 + include/net/bluetooth/l2cap.h | 1 + include/net/ip_vs.h | 3 +- include/net/netfilter/nf_queue.h | 1 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 23 -- include/rdma/ib_verbs.h | 47 --- include/rdma/iter.h | 80 ++++ io_uring/io_uring.c | 4 +- ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/pid.c | 8 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 5 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/debugobjects.c | 2 +- lib/mpi/mpicoder.c | 2 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 1 + mm/madvise.c | 2 +- mm/page_io.c | 2 +- mm/process_vm_access.c | 2 +- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 + net/9p/client.c | 2 +- net/batman-adv/bat_iv_ogm.c | 82 +++- net/batman-adv/bat_v_ogm.c | 59 +-- net/batman-adv/bridge_loop_avoidance.c | 63 ++- net/batman-adv/distributed-arp-table.c | 3 +- net/batman-adv/gateway_client.c | 3 +- net/batman-adv/main.c | 1 + net/batman-adv/multicast.c | 9 +- net/batman-adv/originator.c | 12 +- net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 198 ++++++--- net/batman-adv/tp_meter.h | 1 + net/batman-adv/translation-table.c | 44 +- net/batman-adv/tvlv.c | 28 +- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 56 ++- net/bluetooth/6lowpan.c | 4 +- net/bluetooth/a2mp.c | 2 +- net/bluetooth/af_bluetooth.c | 144 +++++-- net/bluetooth/bnep/sock.c | 10 +- net/bluetooth/hci_core.c | 34 +- net/bluetooth/hci_event.c | 18 +- net/bluetooth/hci_sock.c | 10 +- net/bluetooth/hidp/sock.c | 10 +- net/bluetooth/l2cap_core.c | 87 +++- net/bluetooth/l2cap_sock.c | 86 ++-- net/bluetooth/mgmt.c | 12 +- net/bluetooth/rfcomm/sock.c | 48 ++- net/bluetooth/sco.c | 19 +- net/bluetooth/smp.c | 2 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 ++ net/can/raw.c | 8 +- net/core/dev.c | 6 +- net/core/drop_monitor.c | 6 +- net/core/dst.c | 6 +- net/core/filter.c | 17 +- net/core/neighbour.c | 15 +- net/core/page_pool.c | 41 +- net/core/skbuff.c | 10 +- net/ethtool/netlink.c | 6 +- net/hsr/hsr_framereg.c | 6 +- net/ieee802154/6lowpan/tx.c | 5 + net/ieee802154/nl-phy.c | 3 +- net/ieee802154/nl802154.c | 3 +- net/ieee802154/socket.c | 3 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 4 +- net/ipv4/fib_semantics.c | 4 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 +- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/route.c | 3 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/tcp.c | 2 +- net/ipv6/addrconf.c | 6 +- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 4 +- net/ipv6/ip6_vti.c | 25 +- net/ipv6/ip6mr.c | 3 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/route.c | 3 +- net/ipv6/sit.c | 1 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/mac80211/tdls.c | 2 +- net/mptcp/pm_netlink.c | 8 + net/mptcp/protocol.c | 22 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/ipvs/ip_vs_sync.c | 2 +- net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_queue.c | 28 +- net/netfilter/nf_synproxy_core.c | 26 +- net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 36 +- net/netlink/af_netlink.c | 11 +- net/netrom/nr_loopback.c | 3 +- net/netrom/nr_route.c | 3 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 + net/nfc/llcp_sock.c | 12 +- net/nfc/nci/hci.c | 10 + net/openvswitch/datapath.c | 1 + net/packet/af_packet.c | 40 +- net/phonet/af_phonet.c | 3 +- net/phonet/pn_dev.c | 6 +- net/phonet/socket.c | 3 +- net/qrtr/af_qrtr.c | 4 +- net/qrtr/ns.c | 180 ++++---- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/sched/act_api.c | 7 +- net/sched/act_mirred.c | 6 +- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 -- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 4 +- net/smc/smc_clc.c | 6 +- net/smc/smc_pnet.c | 3 +- net/socket.c | 23 +- net/sunrpc/socklib.c | 6 +- net/sunrpc/svcsock.c | 4 +- net/sunrpc/xprtsock.c | 6 +- net/tipc/topsrv.c | 2 +- net/tls/tls_device.c | 4 +- net/vmw_vsock/vmci_transport.c | 4 +- net/wireless/nl80211.c | 16 +- net/wireless/scan.c | 3 +- net/xfrm/espintcp.c | 6 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 23 +- net/xfrm/xfrm_user.c | 5 +- security/apparmor/policy_unpack.c | 27 +- security/keys/keyctl.c | 4 +- sound/aoa/codecs/onyx.c | 104 ++--- sound/aoa/codecs/tas.c | 113 ++---- sound/aoa/core/gpio-feature.c | 20 +- sound/aoa/core/gpio-pmf.c | 26 +- sound/aoa/soundbus/i2sbus/core.c | 3 + sound/aoa/soundbus/i2sbus/pcm.c | 143 +++---- sound/core/misc.c | 14 +- sound/core/pcm_native.c | 7 +- sound/core/timer.c | 1 + sound/drivers/aloop.c | 40 +- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/intel/boards/bytcht_es8316.c | 29 +- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 +- sound/usb/clock.c | 6 + tools/testing/ktest/ktest.pl | 196 +++++---- tools/testing/selftests/net/forwarding/lib.sh | 56 +++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- 442 files changed, 4423 insertions(+), 2404 deletions(-)

2 months, 3 weeks

[PATCH 5.15 000/411] 5.15.210-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.210 release. There are 411 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.210-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.210-rc1 Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function Ben Hutchings <benh(a)debian.org> apparmor: validate default DFA states are in bounds Ben Hutchings <benh(a)debian.org> fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Christian Göttsche <cgzones(a)googlemail.com> selinux: enable genfscon labeling for securityfs Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Jeff Layton <jlayton(a)kernel.org> nfsd: fix heap overflow in NFSv4.0 LOCK replay cache Eric Biggers <ebiggers(a)kernel.org> ksmbd: Compare MACs in constant time Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Tejun Heo <tj(a)kernel.org> blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: align #define values Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: remove unused symbols Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Michael Kelley <mikelley(a)microsoft.com> drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7 Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() John Keeping <john(a)metanate.com> usb: gadget: f_hid: tidy error handling in hidg_alloc Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: use u32 for register interactions Thomas Gleixner <tglx(a)linutronix.de> serial: samsung_tty: Use port lock wrappers Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Fix per-pad high-speed termination calibration Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Disable trk clk when not in use Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Johan Hovold <johan(a)kernel.org> spi: qup: fix error pointer deref after DMA setup failure Yang Yingliang <yangyingliang(a)huawei.com> spi: qup: switch to use modern name Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Sam Daly <sam(a)samdaly.ie> octeontx2-af: CGX: add bounds check to cgx_speed_mbps index Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Al Viro <viro(a)zeniv.linux.org.uk> use less confusing names for iov_iter direction initializers Justin Iurman <justin.iurman(a)gmail.com> ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Eric Dumazet <edumazet(a)google.com> ipv6/addrconf: annotate data-races around devconf fields (II) Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Jiexun Wang <wangjiexun2025(a)gmail.com> Bluetooth: serialize accept_q access Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Init sk_peer_* on bt_sock_alloc Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Consolidate code around sk_alloc into a helper function Dawei Feng <dawei.feng(a)seu.edu.cn> qed: fix double free in qed_cxt_tables_alloc() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> qed: Use the bitmap API to simplify some functions Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: MGMT: validate Add Extended Advertising Data length Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2 Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Safa Karakuş <safa.karakus(a)secunnix.com> Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require net admin for CIFS SWN netlink Ido Schimmel <idosch(a)nvidia.com> genetlink: Use internal flags for multicast groups Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Piyush Sachdeva <s.piyush1024(a)gmail.com> smb: client: Use FullSessionKey for AES-256 encryption key derivation Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: topcliff-pch: Convert to platform remove callback returning void Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: spi-ti-qspi: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Eric Biggers <ebiggers(a)google.com> net: ipv6: stop checking crypto_ahash_alignmask Eric Biggers <ebiggers(a)google.com> net: ipv4: stop checking crypto_ahash_alignmask Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Christoph Hellwig <hch(a)lst.de> sd: rename the scsi_disk.dev field Luis Chamberlain <mcgrof(a)kernel.org> scsi: sd: Add error handling support for add_disk() Bart Van Assche <bvanassche(a)acm.org> scsi: core: pm: Rely on the device driver core for async power management Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Avoid -Wflex-array-member-not-at-end warning Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Julia Lawall <Julia.Lawall(a)inria.fr> can: ucan: fix typos in comments Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Vignesh Viswanathan <quic_viswanat(a)quicinc.com> net: qrtr: ns: Change servers radix tree to xarray Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Tom Yan <tom.ty89(a)gmail.com> nvme: fix interpretation of DMRSL Gao Xiang <hsiangkao(a)linux.alibaba.com> erofs: fix the out-of-bounds nameoff handling for trailing dirents Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Jimmy Hon <honyuenkwun(a)gmail.com> rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Eric Biggers <ebiggers(a)kernel.org> net/tcp-md5: Fix MAC comparison to be constant-time Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Lorenzo Bianconi <lorenzo(a)kernel.org> net: mvpp2: Add metadata support for xdp mode Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VPIPT I-cache handling Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Jeff Layton <jlayton(a)kernel.org> nfsd: don't ignore the return code of svc_proc_register() Edward Lo <loyuantsung(a)gmail.com> fs/ntfs3: Return error for inconsistent extended attributes Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Nathan Chancellor <nathan(a)kernel.org> compiler-clang.h: Add __diag infrastructure for clang Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix SuperSpeed root hub wMaxPacketSize Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Stefan Metzmacher <metze(a)samba.org> smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Harini Katakam <harini.katakam(a)amd.com> phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table Jiasheng Jiang <jiashengjiangcool(a)gmail.com> RDMA/rxe: Fix double free in rxe_srq_from_init Ben Hutchings <benh(a)debian.org> Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Duoming Zhou <duoming(a)zju.edu.cn> wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Petr Machata <petrm(a)nvidia.com> selftests: forwarding: lib: Add helpers for checksum handling Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix not releasing workqueue on .release() Carlos Eduardo Gallo Filho <gcarlos(a)disroot.org> drm: Remove plane hsub/vsub alignment requirement for core helpers Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/arm64/silicon-errata.rst | 46 ++++++ Makefile | 4 +- arch/arm/include/asm/io.h | 15 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 ++++++ arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 55 +++++-- arch/arm64/kernel/cpu_errata.c | 34 +++- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +---- arch/arm64/kvm/hyp/vhe/tlb.c | 19 +-- arch/arm64/mm/mmu.c | 36 +++-- arch/x86/kernel/cpu/amd.c | 18 ++- arch/x86/kernel/cpu/microcode/intel.c | 4 +- block/blk-cgroup.c | 32 ++-- crypto/testmgr.c | 4 +- drivers/base/power/domain.c | 10 +- drivers/block/drbd/drbd_main.c | 2 +- drivers/block/drbd/drbd_receiver.c | 2 +- drivers/block/loop.c | 14 +- drivers/block/nbd.c | 10 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 33 ++-- drivers/char/random.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 47 +++--- drivers/crypto/nx/nx-842.h | 24 +-- drivers/crypto/nx/nx-common-powernv.c | 31 ++-- drivers/crypto/nx/nx-common-pseries.c | 33 ++-- drivers/dma/idxd/init.c | 1 - drivers/dma/idxd/sysfs.c | 1 + drivers/fsi/fsi-sbefifo.c | 6 +- drivers/gpio/gpio-rockchip.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 ++++--- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 136 ++++++++++++---- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 34 +++- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 ++- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/hid/hid-core.c | 29 +++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi.c | 2 +- drivers/hid/wacom_sys.c | 19 ++- drivers/hid/wacom_wac.h | 1 + drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +++--- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 ++++---- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 8 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++++ drivers/infiniband/core/verbs.c | 38 ----- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 1 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_srq.c | 3 - drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 30 +++- drivers/input/keyboard/atkbd.c | 15 ++ drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 ++- drivers/isdn/mISDN/l1oip_core.c | 2 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/media/rc/igorplugusb.c | 17 +- drivers/media/rc/ttusbir.c | 13 +- drivers/misc/fastrpc.c | 77 ++++++--- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci-of-dwcmshc.c | 17 +- drivers/mmc/host/sdhci.c | 1 + drivers/mtd/spi-nor/sst.c | 13 ++ drivers/net/bonding/bond_main.c | 10 +- drivers/net/can/usb/ucan.c | 6 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 +++++---- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/microchip/lan743x_main.c | 32 ++++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 26 +-- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/hyperv/netvsc.c | 19 ++- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 9 +- drivers/net/phy/mscc/mscc_main.c | 38 +---- drivers/net/ppp/ppp_generic.c | 2 +- drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +-- .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 + drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nfc/nxp-nci/i2c.c | 21 ++- drivers/nvme/host/core.c | 8 +- drivers/nvme/host/nvme.h | 1 + drivers/nvme/host/tcp.c | 4 +- drivers/nvme/target/io-cmd-file.c | 4 +- drivers/nvme/target/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/phy/tegra/xusb-tegra186.c | 38 +++-- drivers/phy/tegra/xusb.h | 1 + drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/hosts.c | 1 + drivers/scsi/scsi.c | 8 - drivers/scsi/scsi_pm.c | 44 +---- drivers/scsi/scsi_priv.h | 4 +- drivers/scsi/scsi_scan.c | 17 ++ drivers/scsi/scsi_sysfs.c | 1 + drivers/scsi/scsi_transport_fc.c | 77 ++++----- drivers/scsi/sd.c | 30 ++-- drivers/scsi/sd.h | 9 +- drivers/scsi/sg.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 3 - drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-qup.c | 165 +++++++++---------- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 9 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 15 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-uniphier.c | 8 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/staging/greybus/hid.c | 2 +- drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/target/iscsi/iscsi_target_util.c | 4 +- drivers/target/target_core_file.c | 2 +- drivers/tee/optee/supp.c | 107 ++++++++---- drivers/thermal/thermal_core.c | 7 +- drivers/thunderbolt/property.c | 38 +++-- drivers/thunderbolt/xdomain.c | 6 +- drivers/tty/serial/altera_jtaguart.c | 18 ++- drivers/tty/serial/dz.c | 58 ++++--- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 ++- drivers/tty/serial/qcom_geni_serial.c | 75 ++++----- drivers/tty/serial/samsung_tty.c | 88 +++++----- drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 40 ++--- drivers/tty/serial/zs.h | 2 +- drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/dwc3/dwc3-xilinx.c | 20 +-- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_hid.c | 20 +-- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 76 +++++---- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 ++- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/io_ti.c | 11 ++ drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 +-- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 7 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/usbip_common.c | 2 +- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/vhost/net.c | 6 +- drivers/vhost/scsi.c | 10 +- drivers/vhost/vhost.c | 6 +- drivers/vhost/vringh.c | 4 +- drivers/vhost/vsock.c | 4 +- drivers/video/fbdev/core/fb_defio.c | 152 +++++++++++++++-- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/vt8500lcdfb.c | 2 +- drivers/xen/pvcalls-back.c | 8 +- fs/9p/vfs_addr.c | 4 +- fs/9p/vfs_dir.c | 2 +- fs/9p/xattr.c | 4 +- fs/afs/cmservice.c | 2 +- fs/afs/dir.c | 2 +- fs/afs/file.c | 4 +- fs/afs/internal.h | 4 +- fs/afs/rxrpc.c | 10 +- fs/afs/write.c | 4 +- fs/aio.c | 4 +- fs/btrfs/inode.c | 2 + fs/btrfs/ioctl.c | 5 +- fs/ceph/addr.c | 2 +- fs/ceph/dir.c | 6 +- fs/ceph/file.c | 4 +- fs/cifs/cifsacl.c | 129 +++++++++++++-- fs/cifs/connect.c | 6 +- fs/cifs/file.c | 4 +- fs/cifs/ioctl.c | 2 +- fs/cifs/netlink.c | 6 +- fs/cifs/smb2ops.c | 10 +- fs/cifs/smb2transport.c | 36 +++-- fs/cifs/smbdirect.c | 4 +- fs/cifs/transport.c | 6 +- fs/erofs/decompressor.c | 1 + fs/erofs/dir.c | 30 ++-- fs/ext4/extents.c | 15 ++ fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 5 +- fs/f2fs/inline.c | 13 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 20 ++- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/fuse/ioctl.c | 4 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/hpfs/alloc.c | 2 +- fs/ksmbd/auth.c | 4 +- fs/ksmbd/smb2pdu.c | 5 +- fs/ksmbd/smbacl.c | 17 +- fs/ksmbd/transport_tcp.c | 4 +- fs/nfsd/nfs4xdr.c | 9 +- fs/nfsd/nfsctl.c | 9 +- fs/nfsd/state.h | 17 +- fs/nfsd/stats.c | 4 +- fs/nfsd/stats.h | 2 +- fs/nfsd/vfs.c | 4 +- fs/ntfs3/xattr.c | 1 + fs/ocfs2/cluster/tcp.c | 2 +- fs/orangefs/inode.c | 8 +- fs/read_write.c | 12 +- fs/seq_file.c | 2 +- fs/splice.c | 10 +- fs/udf/super.c | 4 +- include/drm/drm_dp_helper.h | 1 + include/drm/drm_fourcc.h | 5 +- include/linux/compat.h | 4 + include/linux/compiler-clang.h | 28 ++++ include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/fb.h | 4 +- include/linux/hid.h | 15 +- include/linux/parport.h | 1 + include/linux/printk.h | 13 ++ include/linux/randomize_kstack.h | 44 ++++- include/linux/sched.h | 4 + include/linux/syscalls.h | 4 + include/linux/uio.h | 3 + include/net/act_api.h | 1 + include/net/bluetooth/bluetooth.h | 3 + include/net/bluetooth/l2cap.h | 1 + include/net/genetlink.h | 9 +- include/net/ip_vs.h | 3 +- include/net/mctp.h | 3 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 36 +---- include/rdma/ib_verbs.h | 48 ------ include/rdma/iter.h | 88 ++++++++++ init/main.c | 1 - io_uring/io_uring.c | 2 +- ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/fork.c | 2 + kernel/pid.c | 8 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/debugobjects.c | 2 +- lib/mpi/mpicoder.c | 2 +- mm/damon/vaddr.c | 4 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 1 + mm/madvise.c | 2 +- mm/page_io.c | 2 +- mm/process_vm_access.c | 2 +- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 ++ net/9p/client.c | 2 +- net/batman-adv/bat_iv_ogm.c | 82 ++++++++-- net/batman-adv/bat_v_ogm.c | 59 ++++--- net/batman-adv/bridge_loop_avoidance.c | 57 ++++--- net/batman-adv/main.c | 1 + net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 109 +++++++++---- net/batman-adv/tp_meter.h | 1 + net/batman-adv/translation-table.c | 35 +++- net/batman-adv/tvlv.c | 28 +++- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 46 +++++- net/bluetooth/6lowpan.c | 4 +- net/bluetooth/a2mp.c | 2 +- net/bluetooth/af_bluetooth.c | 144 ++++++++++++++--- net/bluetooth/bnep/core.c | 50 ++++-- net/bluetooth/bnep/sock.c | 10 +- net/bluetooth/hci_event.c | 18 ++- net/bluetooth/hci_sock.c | 10 +- net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/hidp/sock.c | 10 +- net/bluetooth/l2cap_core.c | 87 +++++++++- net/bluetooth/l2cap_sock.c | 86 +++++----- net/bluetooth/mgmt.c | 20 ++- net/bluetooth/rfcomm/core.c | 69 +++++--- net/bluetooth/rfcomm/sock.c | 48 ++++-- net/bluetooth/sco.c | 19 ++- net/bluetooth/smp.c | 2 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 ++-- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 ++++ net/ceph/messenger_v1.c | 4 +- net/ceph/messenger_v2.c | 14 +- net/compat.c | 2 +- net/core/drop_monitor.c | 2 +- net/core/filter.c | 17 +- net/core/skbuff.c | 10 +- net/ethtool/eeprom.c | 5 +- net/hsr/hsr_framereg.c | 6 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/ah4.c | 31 ++-- net/ipv4/esp4.c | 4 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_ipv4.c | 5 +- net/ipv6/addrconf.c | 47 +++--- net/ipv6/ah6.c | 29 ++-- net/ipv6/datagram.c | 54 ++++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 28 +++- net/ipv6/ioam6.c | 12 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6_vti.c | 25 ++- net/ipv6/mcast.c | 22 +-- net/ipv6/ndisc.c | 12 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/seg6_hmac.c | 8 +- net/ipv6/sit.c | 1 + net/ipv6/tcp_ipv6.c | 5 +- net/iucv/af_iucv.c | 20 ++- net/key/af_key.c | 6 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 9 +- net/mptcp/options.c | 29 ++-- net/mptcp/pm.c | 34 +++- net/mptcp/pm_netlink.c | 31 +++- net/mptcp/protocol.c | 26 ++- net/mptcp/sockopt.c | 8 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +-- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +-- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/ipvs/ip_vs_sync.c | 2 +- net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_synproxy_core.c | 26 ++- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 ++-- net/netlink/af_netlink.c | 11 +- net/netlink/genetlink.c | 4 +- net/nfc/hci/core.c | 10 ++ net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 ++ net/openvswitch/datapath.c | 1 + net/packet/af_packet.c | 25 +-- net/psample/psample.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/qrtr/ns.c | 180 ++++++++------------- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/sched/act_api.c | 7 +- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 ----- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 4 +- net/smc/smc_clc.c | 6 +- net/socket.c | 23 +-- net/sunrpc/socklib.c | 6 +- net/sunrpc/svcsock.c | 4 +- net/sunrpc/xprtsock.c | 6 +- net/tipc/topsrv.c | 2 +- net/tls/tls_device.c | 4 +- net/vmw_vsock/vmci_transport.c | 4 +- net/xfrm/espintcp.c | 6 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 35 ++-- net/xfrm/xfrm_user.c | 5 +- security/apparmor/policy_unpack.c | 27 ++-- security/keys/keyctl.c | 4 +- security/selinux/hooks.c | 3 +- sound/aoa/codecs/onyx.c | 104 ++++-------- sound/aoa/codecs/tas.c | 113 +++++-------- sound/aoa/core/gpio-feature.c | 20 +-- sound/aoa/core/gpio-pmf.c | 26 ++- sound/aoa/soundbus/i2sbus/core.c | 3 + sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++++++-------- sound/core/misc.c | 14 +- sound/core/timer.c | 1 + sound/drivers/aloop.c | 40 +++-- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 +++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++--- tools/testing/selftests/net/forwarding/lib.sh | 56 +++++++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- 491 files changed, 4845 insertions(+), 2652 deletions(-)

2 months, 3 weeks

Project Takeoffs

by Donald Marvin

Hi, It comes from City Estimating, LLC We specialize in full cost estimates and all related bidding services for all construction projects in all 50 states. We provide our services to both general and subcontractors, as well as owners/developers, architects and engineers. Feel free to contact me if you have any question or want to see our sample work. Regards, Donald Marvin Marketing Executive City Estimating, LLC

2 months, 3 weeks

地方で儲かる、焼肉ビジネス

by 小山｜ときわ亭セミナー窓口

新たな事業をお考えの経営者様へ　　　いつもお世話になります。　　TBSテレビ『坂上＆指原のつぶれない店』で取り上げられるなど、　今話題の、待ち時間0秒の飲み放題を提供する　焼肉酒場「ときわ亭」のフランチャイズ説明会をご案内いたします。　　　わずか2年半で全国80店舗展開した　「0秒レモンサワー　ときわ亭」の　　ビジネスモデル、収益性や最新の飲食市場実態を　オンラインによる説明会形式で分かりやすく、丁寧にお伝えします。　　※本セミナー参加、店舗オープンの場合　　研修費用50万円を本部支援！　　　このような方におススメ　・銀行融資を受けやすくなるコツをしりたい　・飲食店の経営に興味がある　・焼肉屋の経営実態がしりたい　こういった方は、ぜひお気軽にご視聴くださいませ。　　　▼　オンライン説明会のご視聴予約はこちら　▼ 　　　https://tokiwatei-fc.work/web/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━ 　■　ご説明するフランチャイズシステム　　0秒レモンサワー　仙台ホルモン焼肉酒場ときわ亭　■　開催日程　・6月25日（木）15:00〜16:30　残り2枠　＠オンライン開催　　■　定員　・先着10社　　■　参加費　・不要 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 本メールが不要の方には大変失礼しました。今後ご案内が不要な際は、下記URLにて配信解除を承っています。 https://tokiwatei-fc.work/mail/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 主催：GOSSO株式会社（ときわ亭フランチャイズ本部）東京都渋谷区宇田川町14-13 宇田川ビルディング6F 03-6316-8191　 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━

2 months, 3 weeks

[PATCH 6.12 000/307] 6.12.93-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.93 release. There are 307 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 09 Jun 2026 09:56:47 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.93-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.93-rc1 Pratyush Yadav (Google) <pratyush(a)kernel.org> memfd: deny writeable mappings when implying SEAL_WRITE Liu Ye <liuye(a)kylinos.cn> mm/memfd: fix spelling and grammatical issues Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: perform all memfd seal checks in a single place Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Alexis Lothoré (eBPF Foundation) <alexis.lothore(a)bootlin.com> x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines Ingo Molnar <mingo(a)kernel.org> x86/alternatives: Rename 'apply_relocation()' to 'text_poke_apply_relocation()' Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Paolo Abeni <pabeni(a)redhat.com> mptcp: handle first subflow closing consistently Paolo Abeni <pabeni(a)redhat.com> mptcp: introduce the mptcp_init_skb helper Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Paolo Abeni <pabeni(a)redhat.com> mptcp: reset rcv wnd on disconnect Paolo Abeni <pabeni(a)redhat.com> mptcp: cleanup fallback dummy mapping generation Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Flush and stop persistent ring buffer on panic Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery Alistair Popple <apopple(a)nvidia.com> mm/memory: fix spurious warning when unmapping device-private/exclusive pages Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: scarlett2: Allow flash writes ending at segment boundary Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> Bluetooth: hci_qca: Migrate to serdev specific shutdown function Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> serdev: Provide a bustype shutdown function David Howells <dhowells(a)redhat.com> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer David Howells <dhowells(a)redhat.com> rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg Aleksandr Nogikh <nogikh(a)google.com> x86/kexec: Disable KCOV instrumentation after load_segments() Brian Gerst <brgerst(a)gmail.com> x86/boot: Disable stack protector for early boot code Tushar Dave <tdave(a)nvidia.com> iommu: Skip PASID validation for devices without PASID capability Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: serialize DMABUF cancel against request completion Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Jeremy Erazo <mendozayt13(a)gmail.com> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Kai Aizen <kai.aizen.dev(a)gmail.com> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Sebastian Reichel <sebastian.reichel(a)collabora.com> usb: typec: tcpm: improve handling of DISCOVER_MODES failures Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Dmitriy Zharov <contact(a)zharov.dev> Input: xpad - add support for ASUS ROG RAIKIRI II Qbeliw Tanaka <q.tanaka(a)gmx.com> Input: xpad - add "Nova 2 Lite" from GameSir Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Michael Bommarito <michael.bommarito(a)gmail.com> l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Benoît Monin <benoit.monin(a)bootlin.com> iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Salah Triki <salah.triki(a)gmail.com> iio: adc: mt6359: fix unchecked return value in mt6358_read_imp Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Check PSC request indices against the actual size of the buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Compute the correct max length of the in-GHCB scratch area Sean Christopherson <seanjc(a)google.com> KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests Michael Roth <michael.roth(a)amd.com> KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use Sean Christopherson <seanjc(a)google.com> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Qiang Ma <maqianga(a)uniontech.com> KVM: arm64: PMU: Preserve AArch32 counter low bits Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: xpad - fix out-of-bounds access for Share button Doruk Tan Ozturk <doruk(a)0sec.ai> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Will Deacon <will(a)kernel.org> arm64: io: Extract user memory type in ioremap_prot() Will Deacon <will(a)kernel.org> arm64: io: Rename ioremap_prot() to __ioremap_prot() Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: core: introduce hid_safe_input_report() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Jakub Kicinski <kuba(a)kernel.org> inet: frags: flush pending skbs in fqdir_pre_exit() Jakub Kicinski <kuba(a)kernel.org> inet: frags: add inet_frag_queue_flush() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: fix inverted error logic Sean Young <sean(a)mess.org> media: rc: fix race between unregister and urb/irq callbacks Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> mm/page_alloc: clear page->private in free_pages_prepare() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Peter Oberparleiter <oberpar(a)linux.ibm.com> s390/cio: Restore GFP_DMA for CHSC allocation Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid role confusion in tp_list Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Dan Carpenter <error27(a)gmail.com> gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Drain pending requests at net namespace exit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Take a long-lived file reference at submit Al Viro <viro(a)zeniv.linux.org.uk> remove pointless includes of <linux/fdtable.h> Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Pass negative errno through handshake_complete() Chuck Lever <chuck.lever(a)oracle.com> nvme-tcp: store negative errno in queue->tls_err Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Use spin_lock_bh for hn_lock Victor Nogueira <victor(a)mojatatu.com> net/sched: act_mirred: Fix return code in early mirred redirect error paths Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop Jamal Hadi Salim <jhs(a)mojatatu.com> net: Introduce skb tc depth field to track packet loops Eric Dumazet <edumazet(a)google.com> net/sched: act_mirred: add loop detection Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> net/sched: act_mirred: Move the recursion counter struct netdev_xmit Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: fix packet loop on netem when duplicate is on Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: strset: fix header attribute index in ethnl_req_get_phydev() Jakub Kicinski <kuba(a)kernel.org> ethtool: pse-pd: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error Jakub Kicinski <kuba(a)kernel.org> ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Li Ming <ming.li(a)zohomail.com> cxl/test: Update mock dev array before calling platform_device_add() Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate fw->size against start_cmd_payload_size Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate start_cmd_payload_size from module Danielle Ratson <danieller(a)nvidia.com> net: ethtool: Add support for writing firmware blocks using EPL payload Danielle Ratson <danieller(a)nvidia.com> net: ethtool: Add new parameters and a function to support EPL Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: require exact CDB reply length Jakub Kicinski <kuba(a)kernel.org> ethtool: module: fix cleanup if socket used for flashing multiple devices Jakub Kicinski <kuba(a)kernel.org> ethtool: module: check fw_flash_in_progress under rtnl_lock Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid leaking a netdev ref on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix hkey leak when indir_size is 0 Björn Töpel <bjorn(a)kernel.org> net: Avoid checksumming unreadable skb tail on trim Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: mxc: fix irq_high handling Dan Carpenter <error27(a)gmail.com> accel/ivpu: prevent uninitialized data bug in debugfs Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcm: oss: Fix setup list UAF on proc write error Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() David Jeffery <djeffery(a)redhat.com> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Ziyu Zhang <ziyuzhang201(a)gmail.com> vsock: keep poll shutdown state consistent Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Deepanshu Kartikey <kartikey406(a)gmail.com> kernel/fork: validate exit_signal in kernel_clone() Florian Schmaus <florian.schmaus(a)codasip.com> kunit: fix use-after-free in debugfs when using kunit.filter Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: always unmask interrupts in el0_softstp() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: remove debug exception registration infrastructure Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split bkpt32 exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split brk64 exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split hardware watchpoint exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split single stepping exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: refactor reinstall_suspended_bps() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split hardware breakpoint exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: entry: Add entry and exit functions for debug exceptions Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: remove break/step handler registration infrastructure Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: call step handlers statically Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: call software breakpoint handlers statically Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: refactor aarch32_break_handler() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: clean up single_step_handler logic Mostafa Saleh <smostafa(a)google.com> arm64: Introduce esr_is_ubsan_brk() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Usama Arif <usama.arif(a)linux.dev> xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Maíra Canal <mcanal(a)igalia.com> drm/v3d: Release indirect CSD GEM reference on CPU job free Maíra Canal <mcanal(a)igalia.com> drm/v3d: Fix use-after-free of CPU job query arrays on error path Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/netlink/specs/handshake.yaml | 8 + Makefile | 4 +- arch/alpha/include/asm/Kbuild | 1 + arch/arc/include/asm/Kbuild | 1 + arch/arm/include/asm/Kbuild | 1 + arch/arm64/include/asm/debug-monitors.h | 34 +-- arch/arm64/include/asm/esr.h | 5 + arch/arm64/include/asm/exception.h | 14 +- arch/arm64/include/asm/io.h | 24 +- arch/arm64/include/asm/kgdb.h | 12 + arch/arm64/include/asm/kprobes.h | 8 + arch/arm64/include/asm/ring_buffer.h | 10 + arch/arm64/include/asm/system_misc.h | 4 - arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/traps.h | 6 + arch/arm64/include/asm/uprobes.h | 11 + arch/arm64/kernel/acpi.c | 2 +- arch/arm64/kernel/debug-monitors.c | 258 ++++++++------------- arch/arm64/kernel/entry-common.c | 148 +++++++++++- arch/arm64/kernel/hw_breakpoint.c | 60 ++--- arch/arm64/kernel/kgdb.c | 39 +--- arch/arm64/kernel/probes/kprobes.c | 31 +-- arch/arm64/kernel/probes/kprobes_trampoline.S | 2 +- arch/arm64/kernel/probes/uprobes.c | 24 +- arch/arm64/kernel/traps.c | 80 +------ arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/mm/fault.c | 75 ------ arch/arm64/mm/ioremap.c | 7 +- arch/csky/include/asm/Kbuild | 1 + arch/hexagon/include/asm/Kbuild | 1 + arch/loongarch/include/asm/Kbuild | 1 + arch/m68k/include/asm/Kbuild | 1 + arch/microblaze/include/asm/Kbuild | 1 + arch/mips/dec/platform.c | 109 ++++++++- arch/mips/include/asm/Kbuild | 1 + arch/nios2/include/asm/Kbuild | 1 + arch/openrisc/include/asm/Kbuild | 1 + arch/parisc/include/asm/Kbuild | 1 + arch/powerpc/include/asm/Kbuild | 1 + arch/riscv/include/asm/Kbuild | 1 + arch/riscv/include/asm/syscall_wrapper.h | 4 + arch/s390/include/asm/Kbuild | 1 + arch/sh/include/asm/Kbuild | 1 + arch/sparc/include/asm/Kbuild | 1 + arch/um/include/asm/Kbuild | 1 + arch/x86/include/asm/Kbuild | 1 + arch/x86/include/asm/text-patching.h | 2 +- arch/x86/kernel/Makefile | 16 ++ arch/x86/kernel/alternative.c | 6 +- arch/x86/kernel/callthunks.c | 6 +- arch/x86/kernel/ftrace.c | 7 + arch/x86/kvm/svm/avic.c | 35 ++- arch/x86/kvm/svm/sev.c | 68 ++++-- arch/x86/mm/Makefile | 2 + arch/xtensa/include/asm/Kbuild | 1 + drivers/accel/ivpu/ivpu_debugfs.c | 2 +- drivers/auxdisplay/line-display.c | 2 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 38 ++- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 6 +- drivers/gpio/gpio-virtuser.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/bridge/sil-sii8620.c | 1 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++-- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 34 ++- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 ++- drivers/gpu/drm/v3d/v3d_sched.c | 16 +- drivers/gpu/drm/v3d/v3d_submit.c | 22 +- drivers/hid/bpf/hid_bpf_dispatch.c | 6 +- drivers/hid/hid-core.c | 62 ++++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-picolcd_cir.c | 1 + drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/i2c-hid/i2c-hid-core.c | 7 +- drivers/hid/usbhid/hid-core.c | 11 +- drivers/hid/wacom_sys.c | 19 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 54 ++++- drivers/iio/adc/mt6359-auxadc.c | 1 + drivers/iio/adc/npcm_adc.c | 25 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 +++--- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 16 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/industrialio-buffer.c | 1 + drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/iommu/iommu.c | 25 +- drivers/md/bcache/super.c | 3 +- drivers/media/cec/core/cec-core.c | 2 +- drivers/media/common/siano/smsir.c | 1 + drivers/media/i2c/ir-kbd-i2c.c | 2 + drivers/media/pci/bt8xx/bttv-input.c | 3 +- drivers/media/pci/cx23885/cx23885-input.c | 1 + drivers/media/pci/cx88/cx88-input.c | 3 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/mantis/mantis_input.c | 1 + drivers/media/pci/saa7134/saa7134-input.c | 1 + drivers/media/pci/smipcie/smipcie-ir.c | 1 + drivers/media/pci/ttpci/budget-ci.c | 1 + drivers/media/rc/ati_remote.c | 6 +- drivers/media/rc/ene_ir.c | 2 +- drivers/media/rc/fintek-cir.c | 3 +- drivers/media/rc/igorplugusb.c | 3 +- drivers/media/rc/iguanair.c | 1 + drivers/media/rc/img-ir/img-ir-hw.c | 3 +- drivers/media/rc/img-ir/img-ir-raw.c | 3 +- drivers/media/rc/imon.c | 3 +- drivers/media/rc/ir-hix5hd2.c | 2 +- drivers/media/rc/ir_toy.c | 1 + drivers/media/rc/ite-cir.c | 2 +- drivers/media/rc/mceusb.c | 1 + drivers/media/rc/rc-ir-raw.c | 5 - drivers/media/rc/rc-loopback.c | 1 + drivers/media/rc/rc-main.c | 6 +- drivers/media/rc/redrat3.c | 4 +- drivers/media/rc/st_rc.c | 2 +- drivers/media/rc/streamzap.c | 7 +- drivers/media/rc/sunxi-cir.c | 1 + drivers/media/rc/ttusbir.c | 4 +- drivers/media/rc/winbond-cir.c | 2 +- drivers/media/rc/xbox_remote.c | 5 +- drivers/media/usb/au0828/au0828-input.c | 1 + drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1 + drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6 +- drivers/media/usb/em28xx/em28xx-input.c | 1 + drivers/net/bonding/bond_main.c | 6 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/microsoft/mana/mana_en.c | 72 +++--- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 8 +- drivers/net/phy/mscc/mscc_main.c | 23 +- drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvme/host/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 36 +-- drivers/s390/cio/chsc.c | 4 +- drivers/s390/cio/chsc_sch.c | 20 +- drivers/s390/cio/scm.c | 2 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_lib.c | 27 ++- drivers/scsi/scsi_transport_fc.c | 77 +++--- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/av7110/av7110_ir.c | 1 + drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/thunderbolt/property.c | 32 ++- drivers/tty/serdev/core.c | 21 ++ drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 +++++++------- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 16 +- drivers/tty/serial/samsung_tty.c | 8 - drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 +++++++---------- drivers/tty/serial/zs.h | 1 - drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 26 ++- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 26 ++- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_uvc.c | 28 ++- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 77 +++--- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 +- drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/mct_u232.c | 5 + drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 9 +- drivers/usb/serial/safe_serial.c | 11 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/tcpm.c | 117 ++++++---- drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- fs/fcntl.c | 1 - fs/file_table.c | 1 - fs/hpfs/alloc.c | 2 +- fs/hugetlbfs/inode.c | 5 - fs/notify/fanotify/fanotify.c | 1 - fs/notify/fanotify/fanotify_user.c | 1 - fs/overlayfs/copy_up.c | 1 - fs/proc/base.c | 1 - fs/smb/server/smbacl.c | 8 +- include/asm-generic/ring_buffer.h | 13 ++ include/drm/display/drm_dp.h | 1 + include/kunit/test.h | 1 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 + include/linux/compiler_types.h | 4 + include/linux/hid.h | 17 +- include/linux/hid_bpf.h | 14 +- include/linux/memfd.h | 23 +- include/linux/mm.h | 55 ----- include/linux/netdevice_xmit.h | 10 + include/linux/parport.h | 1 + include/linux/serdev.h | 1 + include/linux/skbuff.h | 2 + include/linux/syscalls.h | 4 + include/media/rc-core.h | 2 - include/net/inet_frag.h | 18 +- include/net/ipv6_frag.h | 9 +- include/net/xfrm.h | 3 +- io_uring/io_uring.c | 1 - ipc/util.c | 2 +- kernel/bpf/bpf_inode_storage.c | 1 - kernel/bpf/bpf_task_storage.c | 1 - kernel/bpf/token.c | 1 - kernel/events/core.c | 16 +- kernel/exit.c | 1 - kernel/fork.c | 11 +- kernel/module/dups.c | 1 - kernel/module/kmod.c | 1 - kernel/trace/ring_buffer.c | 22 ++ kernel/umh.c | 1 - lib/debugobjects.c | 2 +- lib/kunit/executor.c | 19 +- lib/kunit/test.c | 1 + mm/damon/sysfs-schemes.c | 8 +- mm/memfd.c | 56 ++++- mm/memory.c | 2 +- mm/mmap.c | 12 +- mm/page_alloc.c | 1 + mm/shmem.c | 6 - net/batman-adv/bat_iv_ogm.c | 82 +++++-- net/batman-adv/bat_v_ogm.c | 59 +++-- net/batman-adv/bridge_loop_avoidance.c | 57 +++-- net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 67 +++--- net/batman-adv/translation-table.c | 57 ++++- net/batman-adv/tvlv.c | 28 ++- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 42 +++- net/bluetooth/6lowpan.c | 2 + net/bluetooth/hci_sync.c | 12 +- net/bluetooth/hidp/core.c | 23 +- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 41 +++- net/bluetooth/l2cap_sock.c | 16 +- net/bridge/netfilter/ebtables.c | 30 +++ net/core/filter.c | 2 +- net/core/skbuff.c | 45 +++- net/ethtool/cmis.h | 20 +- net/ethtool/cmis_cdb.c | 103 ++++++-- net/ethtool/cmis_fw_update.c | 214 ++++++++++++----- net/ethtool/coalesce.c | 6 + net/ethtool/eeprom.c | 10 +- net/ethtool/linkstate.c | 6 +- net/ethtool/module.c | 26 +-- net/ethtool/netlink.c | 4 +- net/ethtool/netlink.h | 4 +- net/ethtool/pse-pd.c | 10 +- net/ethtool/rss.c | 3 +- net/ethtool/strset.c | 2 +- net/handshake/genl.c | 3 +- net/handshake/genl.h | 1 + net/handshake/handshake-test.c | 2 +- net/handshake/handshake.h | 6 +- net/handshake/netlink.c | 22 +- net/handshake/request.c | 64 +++-- net/handshake/tlshd.c | 6 +- net/hsr/hsr_forward.c | 4 +- net/hsr/hsr_framereg.c | 6 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 4 +- net/ipv4/inet_fragment.c | 51 +++- net/ipv4/ip_fragment.c | 18 +- net/ipv4/ip_tunnel_core.c | 22 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 6 +- net/ipv6/ip6_vti.c | 23 +- net/ipv6/route.c | 5 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/l2tp/l2tp_core.c | 11 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 1 + net/mptcp/pm.c | 40 +++- net/mptcp/pm_netlink.c | 16 +- net/mptcp/protocol.c | 92 +++++--- net/mptcp/protocol.h | 3 +- net/mptcp/subflow.c | 8 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_synproxy_core.c | 2 + net/netfilter/xt_cpu.c | 2 +- net/netlink/af_netlink.c | 11 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 + net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/rxrpc/ar-internal.h | 12 +- net/rxrpc/call_event.c | 27 +-- net/rxrpc/call_object.c | 2 + net/rxrpc/conn_event.c | 30 +-- net/rxrpc/insecure.c | 8 +- net/rxrpc/recvmsg.c | 68 ++++-- net/rxrpc/rxkad.c | 115 ++++----- net/sched/act_mirred.c | 77 ++++-- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 47 +--- net/sched/sch_sfb.c | 2 +- net/sctp/socket.c | 2 + net/smc/af_smc.c | 4 +- net/vmw_vsock/af_vsock.c | 49 ++-- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 14 +- net/vmw_vsock/vmci_transport.c | 8 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 17 +- net/xfrm/xfrm_state.c | 23 +- net/xfrm/xfrm_user.c | 5 +- security/apparmor/domain.c | 1 - sound/core/oss/pcm_oss.c | 18 +- .../motu/motu-register-dsp-message-parser.c | 14 +- sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 ++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++-- sound/usb/mixer_scarlett2.c | 38 ++- tools/testing/cxl/test/cxl.c | 105 ++++----- tools/testing/selftests/mm/hmm-tests.c | 50 ++++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 10 +- 382 files changed, 3974 insertions(+), 2279 deletions(-)

3 months

[PATCH 7.0 000/332] 7.0.12-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.12 release. There are 332 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 09 Jun 2026 09:56:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.12-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.12-rc1 Jassi Brar <jassisinghbrar(a)gmail.com> mailbox: Fix NULL message support in mbox_send_message() Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Robert Marko <robert.marko(a)sartura.hr> net: phy: micrel: fix LAN8814 QSGMII soft reset Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Add support for guarded PMBus lock Saurav Sachidanand <sauravsc(a)amazon.com> i2c: tegra: make tegra_i2c_mutex_unlock() return void Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X Fernando Antunez Antonio <fer.antunez24antonio(a)gmail.com> ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx David Howells <dhowells(a)redhat.com> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Make driver_data info const David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Refactor base_addr handling Lorenzo Stoakes <ljs(a)kernel.org> Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" Jacques Nilo <jnilo(a)free.fr> serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: 8250: dispatch SysRq character in serial8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Ziyi Guo <n7l8m4(a)u.northwestern.edu> drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix amdgpu_hmm_range_get_pages Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx Michael Bommarito <michael.bommarito(a)gmail.com> drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Block DC states on vblank enable when Panel Replay supported Pranay Samala <pranay.samala(a)intel.com> drm/i915/color: Fix HDR pre-CSC LUT programming loop Zhenghang Xiao <kipreyyy(a)gmail.com> drm/gem: fix race between change_handle and handle_delete Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: serialize DMABUF cancel against request completion Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Jeremy Erazo <mendozayt13(a)gmail.com> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Kai Aizen <kai.aizen.dev(a)gmail.com> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Sebastian Reichel <sebastian.reichel(a)collabora.com> usb: typec: tcpm: improve handling of DISCOVER_MODES failures Dan Carpenter <error27(a)gmail.com> usb: typec: tipd: Fix error code in tps6598x_probe() Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Guangshuo Li <lgs201920130244(a)gmail.com> uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Hang Cao <caohang(a)eswincomputing.com> dt-bindings: usb: Fix EIC7700 USB reset's issue Hongling Zeng <zenghongling(a)kylinos.cn> gpib: cb7210: Fix region leak when request_irq fails Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Xiaolei Wang <xiaolei.wang(a)windriver.com> misc: rp1: Send IACK on IRQ activate to fix kdump/kexec Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Dmitriy Zharov <contact(a)zharov.dev> Input: xpad - add support for ASUS ROG RAIKIRI II Qbeliw Tanaka <q.tanaka(a)gmx.com> Input: xpad - add "Nova 2 Lite" from GameSir David Carlier <devnexen(a)gmail.com> dma-buf: fix UAF in dma_buf_fd() tracepoint Shaomin Chen <eeesssooo020(a)gmail.com> xfrm: iptfs: reset runtime state when cloning SAs Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Herbert Xu <herbert(a)gondor.apana.org.au> xfrm: ipcomp: Free destination pages on acomp errors Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Santhosh Kumar K <s-k6(a)ti.com> spi: spi-mem: avoid mutating op template in spi_mem_supports_op() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Michael Bommarito <michael.bommarito(a)gmail.com> l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Michael Bommarito <michael.bommarito(a)gmail.com> octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Alexis Lothoré (eBPF Foundation) <alexis.lothore(a)bootlin.com> x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines Chaitanya Sabnis <chaitanya.msabnis(a)gmail.com> i2c: davinci: fix division by zero on missing clock-frequency Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Benoît Monin <benoit.monin(a)bootlin.com> iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: chemical: mhz19b: reject oversized serial replies Svyatoslav Ryhel <clamor95(a)gmail.com> iio: Fix iio_multiply_value use in iio_read_channel_processed_scale Felix Gu <ustc.gu(a)gmail.com> iio: light: veml6070: Fix resource leak in probe error path Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Shuvam Pandey <shuvampandey1(a)gmail.com> iio: adc: nxp-sar-adc: zero-initialize dma_slave_config Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: adc: nxp-sar-adc: Avoid division by zero Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: nxp-sar-adc: fix division by zero in write_raw Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad4695: Fix call ordering in offload buffer postenable Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Salah Triki <salah.triki(a)gmail.com> iio: adc: mt6359: fix unchecked return value in mt6358_read_imp Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix powerdown control on dual-channel devices Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Kim Seer Paller <kimseer.paller(a)analog.com> iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: fix lockdep false positive by removing unneeded lock Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: fix deadlock on shared proxy's parent removal Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: undo the vote of the proxy on GPIO free Sean Christopherson <seanjc(a)google.com> KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Check PSC request indices against the actual size of the buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Compute the correct max length of the in-GHCB scratch area Sean Christopherson <seanjc(a)google.com> KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore Port I/O requests of length '0' Michael Roth <michael.roth(a)amd.com> KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use Sean Christopherson <seanjc(a)google.com> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Qiang Ma <maqianga(a)uniontech.com> KVM: arm64: PMU: Preserve AArch32 counter low bits Mark Brown <broonie(a)kernel.org> KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Alice Ryhl <aliceryhl(a)google.com> rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN Matthew Maurer <mmaurer(a)google.com> rust_binder: Avoid holding lock when dropping delivered_death Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: xpad - fix out-of-bounds access for Share button Doruk Tan Ozturk <doruk(a)0sec.ai> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading Pavitra Jha <jhapavitra98(a)gmail.com> Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Steve French <stfrench(a)microsoft.com> smb: client: fix uninitialized variable in smb2_writev_callback Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Dev Jain <dev.jain(a)arm.com> mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Richard Chang <richardycc(a)google.com> zram: fix use-after-free in zram_writeback_endio Pratyush Yadav (Google) <pratyush(a)kernel.org> memfd: deny writeable mappings when implying SEAL_WRITE Sunny Patel <nueralspacetech(a)gmail.com> mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page Alexandre Ghiti <alex(a)ghiti.fr> mm: memcontrol: propagate NMI slab stats to memcg vmstats Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc: do not trigger BUG() on BH disabled context Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: pressure: bmp280: fix stack leak in bmp580 trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: adis16550: fix stack leak in trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Andrei Vagin <avagin(a)google.com> Revert "x86/fpu: Refine and simplify the magic number check during signal return" Fernando Fernandez Mancera <fmancera(a)suse.de> Revert "ipv6: preserve insertion order for same-scope addresses" Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Jingguo Tan <tanjingguo(a)huawei.com> vsock/virtio: bind uarg before filling zerocopy skb Frank Wunderlich <frank-w(a)public-files.de> net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Skip redundant detach on already-detached port Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: teardown bugs and resource leaks Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Dan Carpenter <error27(a)gmail.com> gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: adnp: fix flow control regression caused by scoped_guard() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Ivan Vecera <ivecera(a)redhat.com> dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work Ivan Vecera <ivecera(a)redhat.com> dpll: export __dpll_device_change_ntf() for use under dpll_lock Ivan Vecera <ivecera(a)redhat.com> dpll: zl3073x: add die temperature reporting for supported chips Ivan Vecera <ivecera(a)redhat.com> dpll: zl3073x: detect DPLL channel count from chip ID at runtime Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Drain pending requests at net namespace exit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Take a long-lived file reference at submit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: hand off the pinned file reference to accept_doit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Pass negative errno through handshake_complete() Chuck Lever <chuck.lever(a)oracle.com> nvme-tcp: store negative errno in queue->tls_err Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Use spin_lock_bh for hn_lock Jijie Shao <shaojijie(a)huawei.com> net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path Jijie Shao <shaojijie(a)huawei.com> net: hibmcge: disable Relaxed Ordering to fix RX packet corruption Victor Nogueira <victor(a)mojatatu.com> net/sched: act_mirred: Fix return code in early mirred redirect error paths Kito Xu (veritas501) <hxzene(a)gmail.com> net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop Jamal Hadi Salim <jhs(a)mojatatu.com> net: Introduce skb tc depth field to track packet loops Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: fix packet loop on netem when duplicate is on Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: strset: fix header attribute index in ethnl_req_get_phydev() Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: fix uninitialized stats on the by-PHC path Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: pse-pd: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix reply error handling Jakub Kicinski <kuba(a)kernel.org> ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in sysfs path Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in netlink path Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Balasubramani Vivekanandan <balasubramani.vivekanandan(a)intel.com> drm/xe: Restore IDLEDLY regiter on engine reset Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Sean Shen <grayhat(a)foxmail.com> ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Keith Busch <kbusch(a)kernel.org> blk-mq: reinsert cached request to the list Li Ming <ming.li(a)zohomail.com> cxl/test: Update mock dev array before calling platform_device_add() Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate fw->size against start_cmd_payload_size Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate start_cmd_payload_size from module Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: require exact CDB reply length Jakub Kicinski <kuba(a)kernel.org> ethtool: module: fix cleanup if socket used for flashing multiple devices Jakub Kicinski <kuba(a)kernel.org> ethtool: module: check fw_flash_in_progress under rtnl_lock Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid racy updates to dev->ethtool bitfield Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid leaking a netdev ref on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: module: call ethnl_ops_complete() on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid device context leak on reply-build failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix hkey leak when indir_size is 0 Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix indir_table and hkey leak on get_rxfh failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix falsely ignoring indir table updates Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: add missing errno on RSS context delete Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid modifying the RSS context response Björn Töpel <bjorn(a)kernel.org> net: Avoid checksumming unreadable skb tail on trim Michał Grzelak <michal.grzelak(a)intel.com> drm/i915/aux: use polling when irqs are unavailable Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: mxc: fix irq_high handling Dan Carpenter <error27(a)gmail.com> accel/ivpu: prevent uninitialized data bug in debugfs Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Prathamesh Deshpande <prathameshdeshpande7(a)gmail.com> net/mlx5: HWS: Reject unsupported remove-header action Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcm: oss: Fix setup list UAF on proc write error Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Fix system name string leaks Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Ewan D. Milne <emilne(a)redhat.com> scsi: scsi_debug: Add missing newline in scsi_debug_device_reset() David Jeffery <djeffery(a)redhat.com> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Ziyu Zhang <ziyuzhang201(a)gmail.com> vsock: keep poll shutdown state consistent Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nf_tables: fix dst corruption in same register operation Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable e521588 <alessandro.schino(a)sbb.ch> esp: fix page frag reference leak on skb_to_sgvec failure Deepanshu Kartikey <kartikey406(a)gmail.com> kernel/fork: validate exit_signal in kernel_clone() Dhabaleshwar Das <dhabal123(a)gmail.com> accel/rocket: fix UAF via dangling GEM handle in create_bo Florian Schmaus <florian.schmaus(a)codasip.com> kunit: fix use-after-free in debugfs when using kunit.filter Liu Kai <lukace97(a)outlook.com> HID: remove duplicate hid_warn_ratelimited definition Hongtao Lee <lihongtao(a)kylinos.cn> tools/bootconfig: Fix buf leaks in apply_xbc Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Usama Arif <usama.arif(a)linux.dev> xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: button: Fix ACPI GPE handler leak during removal Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: .../devicetree/bindings/usb/eswin,eic7700-usb.yaml | 7 +- Documentation/netlink/specs/handshake.yaml | 8 + Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/kvm/hyp/include/hyp/switch.h | 16 +- arch/arm64/kvm/nested.c | 5 + arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/kvm/sys_regs.c | 11 +- arch/mips/dec/platform.c | 109 ++++++++++- arch/riscv/include/asm/syscall_wrapper.h | 4 + arch/x86/kernel/fpu/signal.c | 11 +- arch/x86/kernel/ftrace.c | 7 + arch/x86/kvm/svm/avic.c | 35 +++- arch/x86/kvm/svm/sev.c | 76 ++++--- block/blk-mq.c | 2 +- drivers/accel/ivpu/ivpu_debugfs.c | 2 +- drivers/accel/rocket/rocket_gem.c | 17 +- drivers/acpi/acpica/evxfgpe.c | 50 ++++- drivers/acpi/button.c | 24 ++- drivers/android/binder/allocation.rs | 8 + drivers/android/binder/process.rs | 7 +- drivers/android/binder/transaction.rs | 11 +- drivers/auxdisplay/line-display.c | 2 +- drivers/block/zram/zram_drv.c | 6 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/dma-buf/dma-buf.c | 6 +- drivers/dpll/dpll_netlink.c | 13 +- drivers/dpll/zl3073x/core.c | 116 +++-------- drivers/dpll/zl3073x/core.h | 59 +++--- drivers/dpll/zl3073x/dpll.c | 52 +++-- drivers/dpll/zl3073x/dpll.h | 4 +- drivers/dpll/zl3073x/i2c.c | 37 ++-- drivers/dpll/zl3073x/regs.h | 2 + drivers/dpll/zl3073x/spi.c | 37 ++-- drivers/gpib/cb7210/cb7210.c | 10 +- drivers/gpio/gpio-adnp.c | 4 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 23 ++- drivers/gpio/gpio-shared-proxy.c | 9 + drivers/gpio/gpio-virtuser.c | 4 +- drivers/gpio/gpiolib-shared.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/drm_gem.c | 2 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++++-- drivers/gpu/drm/i915/display/intel_color.c | 2 +- drivers/gpu/drm/i915/display/intel_display_core.h | 1 + drivers/gpu/drm/i915/display/intel_display_irq.c | 8 +- drivers/gpu/drm/i915/display/intel_display_types.h | 3 + drivers/gpu/drm/i915/display/intel_dp_aux.c | 20 +- drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 69 +++++-- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +-- drivers/gpu/drm/xe/xe_guc_ads.c | 5 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + drivers/hid/wacom_sys.c | 13 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 7 + drivers/hwmon/pmbus/pmbus.h | 5 + drivers/hwmon/pmbus/pmbus_core.c | 8 + drivers/i2c/busses/i2c-davinci.c | 2 +- drivers/i2c/busses/i2c-tegra.c | 15 +- drivers/iio/adc/ad4695.c | 23 +-- drivers/iio/adc/mt6359-auxadc.c | 1 + drivers/iio/adc/npcm_adc.c | 25 +-- drivers/iio/adc/nxp-sar-adc.c | 24 ++- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/mhz19b.c | 17 ++ drivers/iio/chemical/scd30_core.c | 2 +- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad3530r.c | 54 +++-- drivers/iio/dac/ad5686.c | 56 ++++-- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/adis16550.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/industrialio-buffer.c | 1 + drivers/iio/inkern.c | 6 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/light/veml6070.c | 14 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/mailbox/mailbox.c | 15 +- drivers/mailbox/tegra-hsp.c | 2 +- drivers/md/bcache/super.c | 3 +- drivers/media/rc/igorplugusb.c | 2 +- drivers/misc/rp1/rp1_pci.c | 1 + drivers/net/bonding/bond_main.c | 6 + drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 3 + drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c | 6 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_rep.c | 8 + .../mellanox/mlx5/core/steering/hws/fs_hws.c | 4 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 78 +++++--- drivers/net/macsec.c | 3 +- drivers/net/pcs/pcs-mtk-lynxi.c | 3 + drivers/net/phy/micrel.c | 15 +- drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvme/host/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 91 ++++----- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_debug.c | 2 +- drivers/scsi/scsi_lib.c | 27 ++- drivers/scsi/scsi_transport_fc.c | 77 ++++---- drivers/spi/spi-mem.c | 15 +- drivers/target/iscsi/iscsi_target.c | 5 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 ++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/thunderbolt/property.c | 32 ++- drivers/tty/serial/8250/8250_dw.c | 2 +- drivers/tty/serial/8250/8250_port.c | 7 +- drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 ++++++++-------- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 16 +- drivers/tty/serial/samsung_tty.c | 8 - drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 ++++++++------------- drivers/tty/serial/zs.h | 1 - drivers/uio/uio_pci_generic_sva.c | 7 +- drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 27 +-- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 26 ++- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_uvc.c | 28 ++- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 75 ++++--- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/mct_u232.c | 26 ++- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 9 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/tcpm.c | 117 ++++++----- drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/tipd/core.c | 1 + drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 ++- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- fs/hpfs/alloc.c | 2 +- fs/hugetlbfs/inode.c | 46 ++--- fs/smb/client/smb2pdu.c | 2 +- fs/smb/server/smb2pdu.c | 11 ++ fs/smb/server/smbacl.c | 8 +- include/acpi/acpixf.h | 5 + include/kunit/test.h | 1 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/dpll.h | 1 + include/linux/hid.h | 2 - include/linux/hugetlb.h | 8 +- include/linux/hugetlb_inline.h | 12 +- include/linux/intel_vsec.h | 4 +- include/linux/mailbox_controller.h | 3 + include/linux/parport.h | 1 + include/linux/serial_core.h | 12 ++ include/linux/skbuff.h | 2 + include/linux/syscalls.h | 4 + include/net/netfilter/nf_tables.h | 7 + include/net/xfrm.h | 3 +- ipc/util.c | 2 +- kernel/fork.c | 11 +- lib/debugobjects.c | 2 +- lib/kunit/executor.c | 19 +- lib/kunit/test.c | 1 + mm/damon/sysfs-schemes.c | 8 +- mm/hugetlb.c | 75 +++---- mm/memcontrol.c | 6 + mm/memfd.c | 12 +- mm/migrate_device.c | 4 +- mm/rmap.c | 2 + mm/vmalloc.c | 2 +- net/bluetooth/6lowpan.c | 2 + net/bluetooth/hci_conn.c | 4 +- net/bluetooth/hci_sync.c | 16 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 41 +++- net/bluetooth/l2cap_sock.c | 16 +- net/bridge/br_netlink.c | 17 +- net/bridge/br_switchdev.c | 1 - net/bridge/br_sysfs_if.c | 30 ++- net/bridge/netfilter/ebtables.c | 30 +++ net/core/filter.c | 2 +- net/core/skbuff.c | 45 ++++- net/ethtool/cmis.h | 4 +- net/ethtool/cmis_cdb.c | 9 +- net/ethtool/cmis_fw_update.c | 44 +++-- net/ethtool/coalesce.c | 6 + net/ethtool/eeprom.c | 10 +- net/ethtool/linkstate.c | 6 +- net/ethtool/module.c | 41 ++-- net/ethtool/netlink.c | 4 +- net/ethtool/netlink.h | 4 +- net/ethtool/pse-pd.c | 10 +- net/ethtool/rss.c | 37 ++-- net/ethtool/strset.c | 2 +- net/ethtool/tsconfig.c | 15 +- net/ethtool/tsinfo.c | 19 +- net/handshake/genl.c | 3 +- net/handshake/genl.h | 1 + net/handshake/handshake-test.c | 10 +- net/handshake/handshake.h | 6 +- net/handshake/netlink.c | 29 ++- net/handshake/request.c | 81 ++++++-- net/handshake/tlshd.c | 6 +- net/hsr/hsr_forward.c | 4 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 16 +- net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv6/addrconf.c | 2 +- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++++- net/ipv6/esp6.c | 16 +- net/ipv6/exthdrs.c | 6 +- net/ipv6/ip6_vti.c | 23 ++- net/ipv6/route.c | 5 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/l2tp/l2tp_core.c | 11 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_synproxy_core.c | 2 + net/netfilter/nft_bitwise.c | 18 +- net/netfilter/nft_byteorder.c | 13 +- net/netfilter/xt_cpu.c | 2 +- net/netlink/af_netlink.c | 11 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/rxrpc/ar-internal.h | 7 +- net/rxrpc/conn_event.c | 30 ++- net/rxrpc/insecure.c | 5 +- net/rxrpc/rxgk.c | 98 +++------ net/rxrpc/rxgk_app.c | 46 ++--- net/rxrpc/rxgk_common.h | 92 +-------- net/rxrpc/rxkad.c | 29 +-- net/sched/act_mirred.c | 77 +++++--- net/sched/sch_netem.c | 47 +---- net/sched/sch_sfb.c | 2 +- net/sctp/socket.c | 2 + net/smc/af_smc.c | 4 +- net/vmw_vsock/af_vsock.c | 49 +++-- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 26 ++- net/vmw_vsock/vmci_transport.c | 8 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_ipcomp.c | 12 +- net/xfrm/xfrm_iptfs.c | 28 ++- net/xfrm/xfrm_policy.c | 17 +- net/xfrm/xfrm_state.c | 23 ++- net/xfrm/xfrm_user.c | 5 +- sound/core/oss/pcm_oss.c | 18 +- .../motu/motu-register-dsp-message-parser.c | 11 +- sound/hda/codecs/realtek/alc269.c | 12 +- sound/hda/codecs/side-codecs/cs35l56_hda.c | 17 +- sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 ++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++-- sound/usb/mixer_scarlett2.c | 33 +++- tools/bootconfig/main.c | 4 +- tools/testing/cxl/test/cxl.c | 105 ++++------ tools/testing/selftests/net/ioam6.sh | 2 +- 316 files changed, 3289 insertions(+), 1907 deletions(-)

3 months

[PATCH 6.18 000/315] 6.18.35-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.35 release. There are 315 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 09 Jun 2026 09:56:45 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.35-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.35-rc1 Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable Jassi Brar <jassisinghbrar(a)gmail.com> mailbox: Fix NULL message support in mbox_send_message() Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Robert Marko <robert.marko(a)sartura.hr> net: phy: micrel: fix LAN8814 QSGMII soft reset Qing Wang <wangqing7171(a)gmail.com> mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Add support for guarded PMBus lock Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Shaomin Chen <eeesssooo020(a)gmail.com> xfrm: iptfs: reset runtime state when cloning SAs Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: intel_pstate: Add and use hybrid_get_cpu_type() Paolo Abeni <pabeni(a)redhat.com> mptcp: reset rcv wnd on disconnect Paolo Abeni <pabeni(a)redhat.com> mptcp: cleanup fallback dummy mapping generation Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Paolo Abeni <pabeni(a)redhat.com> mptcp: borrow forward memory from subflow Paolo Abeni <pabeni(a)redhat.com> mptcp: handle first subflow closing consistently David Carlier <devnexen(a)gmail.com> net: devmem: reject dma-buf bind with non-page-aligned size or SG length Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> Bluetooth: hci_qca: Migrate to serdev specific shutdown function Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> serdev: Provide a bustype shutdown function David Howells <dhowells(a)redhat.com> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer David Howells <dhowells(a)redhat.com> rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg Tom Lendacky <thomas.lendacky(a)amd.com> x86/mm: Disable broadcast TLB flush when PCID is disabled Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Make driver_data info const David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Refactor base_addr handling Jacques Nilo <jnilo(a)free.fr> serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: 8250: dispatch SysRq character in serial8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Ziyi Guo <n7l8m4(a)u.northwestern.edu> drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx Michael Bommarito <michael.bommarito(a)gmail.com> drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Block DC states on vblank enable when Panel Replay supported Zhenghang Xiao <kipreyyy(a)gmail.com> drm/gem: fix race between change_handle and handle_delete Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: serialize DMABUF cancel against request completion Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Jeremy Erazo <mendozayt13(a)gmail.com> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Kai Aizen <kai.aizen.dev(a)gmail.com> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Sebastian Reichel <sebastian.reichel(a)collabora.com> usb: typec: tcpm: improve handling of DISCOVER_MODES failures Dan Carpenter <error27(a)gmail.com> usb: typec: tipd: Fix error code in tps6598x_probe() Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Hongling Zeng <zenghongling(a)kylinos.cn> gpib: cb7210: Fix region leak when request_irq fails Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Xiaolei Wang <xiaolei.wang(a)windriver.com> misc: rp1: Send IACK on IRQ activate to fix kdump/kexec Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Dmitriy Zharov <contact(a)zharov.dev> Input: xpad - add support for ASUS ROG RAIKIRI II Qbeliw Tanaka <q.tanaka(a)gmx.com> Input: xpad - add "Nova 2 Lite" from GameSir Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Herbert Xu <herbert(a)gondor.apana.org.au> xfrm: ipcomp: Free destination pages on acomp errors Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Santhosh Kumar K <s-k6(a)ti.com> spi: spi-mem: avoid mutating op template in spi_mem_supports_op() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Michael Bommarito <michael.bommarito(a)gmail.com> l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Alexis Lothoré (eBPF Foundation) <alexis.lothore(a)bootlin.com> x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines Chaitanya Sabnis <chaitanya.msabnis(a)gmail.com> i2c: davinci: fix division by zero on missing clock-frequency Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Benoît Monin <benoit.monin(a)bootlin.com> iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: chemical: mhz19b: reject oversized serial replies Svyatoslav Ryhel <clamor95(a)gmail.com> iio: Fix iio_multiply_value use in iio_read_channel_processed_scale Felix Gu <ustc.gu(a)gmail.com> iio: light: veml6070: Fix resource leak in probe error path Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad4695: Fix call ordering in offload buffer postenable Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Salah Triki <salah.triki(a)gmail.com> iio: adc: mt6359: fix unchecked return value in mt6358_read_imp Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix powerdown control on dual-channel devices Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Kim Seer Paller <kimseer.paller(a)analog.com> iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Check PSC request indices against the actual size of the buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Compute the correct max length of the in-GHCB scratch area Sean Christopherson <seanjc(a)google.com> KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore Port I/O requests of length '0' Michael Roth <michael.roth(a)amd.com> KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use Sean Christopherson <seanjc(a)google.com> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Qiang Ma <maqianga(a)uniontech.com> KVM: arm64: PMU: Preserve AArch32 counter low bits Mark Brown <broonie(a)kernel.org> KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Alice Ryhl <aliceryhl(a)google.com> rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN Matthew Maurer <mmaurer(a)google.com> rust_binder: Avoid holding lock when dropping delivered_death Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: xpad - fix out-of-bounds access for Share button Doruk Tan Ozturk <doruk(a)0sec.ai> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading Pavitra Jha <jhapavitra98(a)gmail.com> Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Steve French <stfrench(a)microsoft.com> smb: client: fix uninitialized variable in smb2_writev_callback Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Dev Jain <dev.jain(a)arm.com> mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Pratyush Yadav (Google) <pratyush(a)kernel.org> memfd: deny writeable mappings when implying SEAL_WRITE Alexandre Ghiti <alex(a)ghiti.fr> mm: memcontrol: propagate NMI slab stats to memcg vmstats Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: pressure: bmp280: fix stack leak in bmp580 trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: adis16550: fix stack leak in trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Peter Oberparleiter <oberpar(a)linux.ibm.com> s390/cio: Restore GFP_DMA for CHSC allocation Andrei Vagin <avagin(a)google.com> Revert "x86/fpu: Refine and simplify the magic number check during signal return" Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: fix inverted error logic Sean Young <sean(a)mess.org> media: rc: fix race between unregister and urb/irq callbacks Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Jingguo Tan <tanjingguo(a)huawei.com> vsock/virtio: bind uarg before filling zerocopy skb Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Skip redundant detach on already-detached port Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: teardown bugs and resource leaks Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Dan Carpenter <error27(a)gmail.com> gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: adnp: fix flow control regression caused by scoped_guard() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Pass negative errno through handshake_complete() Chuck Lever <chuck.lever(a)oracle.com> nvme-tcp: store negative errno in queue->tls_err Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Use spin_lock_bh for hn_lock Jijie Shao <shaojijie(a)huawei.com> net: hibmcge: disable Relaxed Ordering to fix RX packet corruption Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: strset: fix header attribute index in ethnl_req_get_phydev() Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: fix uninitialized stats on the by-PHC path Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: pse-pd: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix reply error handling Jakub Kicinski <kuba(a)kernel.org> ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in sysfs path Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in netlink path Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Balasubramani Vivekanandan <balasubramani.vivekanandan(a)intel.com> drm/xe: Restore IDLEDLY regiter on engine reset Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Sean Shen <grayhat(a)foxmail.com> ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Li Ming <ming.li(a)zohomail.com> cxl/test: Update mock dev array before calling platform_device_add() Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate fw->size against start_cmd_payload_size Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate start_cmd_payload_size from module Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: require exact CDB reply length Jakub Kicinski <kuba(a)kernel.org> ethtool: module: fix cleanup if socket used for flashing multiple devices Jakub Kicinski <kuba(a)kernel.org> ethtool: module: check fw_flash_in_progress under rtnl_lock Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid racy updates to dev->ethtool bitfield Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid leaking a netdev ref on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: module: call ethnl_ops_complete() on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid device context leak on reply-build failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix hkey leak when indir_size is 0 Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix indir_table and hkey leak on get_rxfh failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix falsely ignoring indir table updates Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: add missing errno on RSS context delete Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid modifying the RSS context response Björn Töpel <bjorn(a)kernel.org> net: Avoid checksumming unreadable skb tail on trim Weiming Shi <bestswngs(a)gmail.com> net: team: fix NULL pointer dereference in team_xmit during mode change Marc Harvey <marcharvey(a)google.com> net: team: Rename port_disabled team mode op to port_tx_disabled Marc Harvey <marcharvey(a)google.com> net: team: Remove unused team_mode_op, port_enabled Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: mxc: fix irq_high handling Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Prathamesh Deshpande <prathameshdeshpande7(a)gmail.com> net/mlx5: HWS: Reject unsupported remove-header action Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcm: oss: Fix setup list UAF on proc write error Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() David Jeffery <djeffery(a)redhat.com> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Ziyu Zhang <ziyuzhang201(a)gmail.com> vsock: keep poll shutdown state consistent Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nf_tables: fix dst corruption in same register operation Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Deepanshu Kartikey <kartikey406(a)gmail.com> kernel/fork: validate exit_signal in kernel_clone() Dhabaleshwar Das <dhabal123(a)gmail.com> accel/rocket: fix UAF via dangling GEM handle in create_bo Florian Schmaus <florian.schmaus(a)codasip.com> kunit: fix use-after-free in debugfs when using kunit.filter Liu Kai <lukace97(a)outlook.com> HID: remove duplicate hid_warn_ratelimited definition Hongtao Lee <lihongtao(a)kylinos.cn> tools/bootconfig: Fix buf leaks in apply_xbc Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Usama Arif <usama.arif(a)linux.dev> xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/netlink/specs/handshake.yaml | 8 + Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/kvm/hyp/include/hyp/switch.h | 16 +- arch/arm64/kvm/nested.c | 5 + arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/kvm/sys_regs.c | 11 +- arch/mips/dec/platform.c | 109 ++++++++++- arch/riscv/include/asm/syscall_wrapper.h | 4 + arch/x86/kernel/cpu/cpuid-deps.c | 1 + arch/x86/kernel/fpu/signal.c | 11 +- arch/x86/kernel/ftrace.c | 7 + arch/x86/kvm/svm/avic.c | 35 +++- arch/x86/kvm/svm/sev.c | 76 ++++--- drivers/accel/rocket/rocket_gem.c | 17 +- drivers/android/binder/allocation.rs | 8 + drivers/android/binder/process.rs | 7 +- drivers/android/binder/transaction.rs | 11 +- drivers/auxdisplay/line-display.c | 2 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 42 ++-- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/cpufreq/intel_pstate.c | 13 +- drivers/gpio/gpio-adnp.c | 4 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 23 ++- drivers/gpio/gpio-virtuser.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/bridge/sil-sii8620.c | 1 + drivers/gpu/drm/drm_gem.c | 2 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++++-- drivers/gpu/drm/i915/display/intel_display_core.h | 1 + drivers/gpu/drm/i915/display/intel_display_irq.c | 8 +- drivers/gpu/drm/i915/display/intel_display_types.h | 3 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 60 ++++-- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +-- drivers/gpu/drm/xe/xe_guc_ads.c | 5 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-picolcd_cir.c | 1 + drivers/hid/hid-quirks.c | 1 + drivers/hid/wacom_sys.c | 13 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 7 + drivers/hwmon/pmbus/pmbus.h | 5 + drivers/hwmon/pmbus/pmbus_core.c | 8 + drivers/i2c/busses/i2c-davinci.c | 2 +- drivers/iio/adc/ad4695.c | 23 +-- drivers/iio/adc/mt6359-auxadc.c | 1 + drivers/iio/adc/npcm_adc.c | 25 +-- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/mhz19b.c | 17 ++ drivers/iio/chemical/scd30_core.c | 2 +- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad3530r.c | 54 +++-- drivers/iio/dac/ad5686.c | 56 ++++-- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/adis16550.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/industrialio-buffer.c | 1 + drivers/iio/inkern.c | 6 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/light/veml6070.c | 14 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/mailbox/mailbox.c | 15 +- drivers/mailbox/tegra-hsp.c | 2 +- drivers/md/bcache/super.c | 3 +- drivers/media/cec/core/cec-core.c | 2 +- drivers/media/common/siano/smsir.c | 1 + drivers/media/i2c/ir-kbd-i2c.c | 2 + drivers/media/pci/bt8xx/bttv-input.c | 3 +- drivers/media/pci/cx23885/cx23885-input.c | 1 + drivers/media/pci/cx88/cx88-input.c | 3 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/mantis/mantis_input.c | 1 + drivers/media/pci/saa7134/saa7134-input.c | 1 + drivers/media/pci/smipcie/smipcie-ir.c | 1 + drivers/media/pci/ttpci/budget-ci.c | 1 + drivers/media/rc/ati_remote.c | 6 +- drivers/media/rc/ene_ir.c | 2 +- drivers/media/rc/fintek-cir.c | 3 +- drivers/media/rc/igorplugusb.c | 3 +- drivers/media/rc/iguanair.c | 1 + drivers/media/rc/img-ir/img-ir-hw.c | 3 +- drivers/media/rc/img-ir/img-ir-raw.c | 3 +- drivers/media/rc/imon.c | 3 +- drivers/media/rc/ir-hix5hd2.c | 2 +- drivers/media/rc/ir_toy.c | 1 + drivers/media/rc/ite-cir.c | 2 +- drivers/media/rc/mceusb.c | 1 + drivers/media/rc/rc-ir-raw.c | 5 - drivers/media/rc/rc-loopback.c | 1 + drivers/media/rc/rc-main.c | 6 +- drivers/media/rc/redrat3.c | 4 +- drivers/media/rc/st_rc.c | 2 +- drivers/media/rc/streamzap.c | 7 +- drivers/media/rc/sunxi-cir.c | 1 + drivers/media/rc/ttusbir.c | 4 +- drivers/media/rc/winbond-cir.c | 2 +- drivers/media/rc/xbox_remote.c | 5 +- drivers/media/usb/au0828/au0828-input.c | 1 + drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1 + drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6 +- drivers/media/usb/em28xx/em28xx-input.c | 1 + drivers/misc/rp1/rp1_pci.c | 1 + drivers/net/bonding/bond_main.c | 6 + drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 3 + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + .../mellanox/mlx5/core/steering/hws/fs_hws.c | 4 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 78 +++++--- drivers/net/macsec.c | 3 +- drivers/net/phy/micrel.c | 15 +- drivers/net/phy/mscc/mscc.h | 8 +- drivers/net/phy/mscc/mscc_main.c | 23 +-- drivers/net/team/team_core.c | 51 +++-- drivers/net/team/team_mode_loadbalance.c | 4 +- drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvme/host/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 91 ++++----- drivers/s390/cio/chsc.c | 4 +- drivers/s390/cio/chsc_sch.c | 20 +- drivers/s390/cio/scm.c | 2 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_lib.c | 27 ++- drivers/scsi/scsi_transport_fc.c | 77 ++++---- drivers/spi/spi-mem.c | 15 +- drivers/staging/gpib/cb7210/cb7210.c | 10 +- drivers/staging/media/av7110/av7110_ir.c | 1 + drivers/target/iscsi/iscsi_target.c | 5 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 ++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/thunderbolt/property.c | 32 ++- drivers/tty/serdev/core.c | 21 ++ drivers/tty/serial/8250/8250_dw.c | 2 +- drivers/tty/serial/8250/8250_port.c | 7 +- drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 ++++++++-------- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 16 +- drivers/tty/serial/samsung_tty.c | 8 - drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 ++++++++------------- drivers/tty/serial/zs.h | 1 - drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 27 +-- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 26 ++- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_uvc.c | 28 ++- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 77 ++++---- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/mct_u232.c | 26 ++- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 9 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/tcpm.c | 117 ++++++----- drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/tipd/core.c | 1 + drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 ++- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- fs/hpfs/alloc.c | 2 +- fs/smb/client/cifsacl.c | 116 ++++++++--- fs/smb/client/smb2pdu.c | 2 +- fs/smb/server/smb2pdu.c | 11 ++ fs/smb/server/smbacl.c | 8 +- include/kunit/test.h | 1 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/hid.h | 2 - include/linux/if_team.h | 3 +- include/linux/intel_vsec.h | 4 +- include/linux/mailbox_controller.h | 3 + include/linux/parport.h | 1 + include/linux/serdev.h | 1 + include/linux/serial_core.h | 12 ++ include/linux/syscalls.h | 4 + include/media/rc-core.h | 2 - include/net/netfilter/nf_tables.h | 7 + include/net/xfrm.h | 3 +- ipc/util.c | 2 +- kernel/fork.c | 11 +- lib/debugobjects.c | 2 +- lib/kunit/executor.c | 19 +- lib/kunit/test.c | 1 + mm/damon/sysfs-schemes.c | 8 +- mm/memcontrol.c | 6 + mm/memfd.c | 12 +- mm/rmap.c | 2 + mm/slab_common.c | 2 + mm/slub.c | 1 + net/bluetooth/6lowpan.c | 2 + net/bluetooth/hci_conn.c | 4 +- net/bluetooth/hci_sync.c | 16 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 41 +++- net/bluetooth/l2cap_sock.c | 16 +- net/bridge/br_netlink.c | 17 +- net/bridge/br_switchdev.c | 1 - net/bridge/br_sysfs_if.c | 30 ++- net/bridge/netfilter/ebtables.c | 30 +++ net/core/devmem.c | 11 ++ net/core/filter.c | 2 +- net/core/skbuff.c | 45 ++++- net/ethtool/cmis.h | 4 +- net/ethtool/cmis_cdb.c | 9 +- net/ethtool/cmis_fw_update.c | 44 +++-- net/ethtool/coalesce.c | 6 + net/ethtool/eeprom.c | 10 +- net/ethtool/linkstate.c | 6 +- net/ethtool/module.c | 41 ++-- net/ethtool/netlink.c | 4 +- net/ethtool/netlink.h | 4 +- net/ethtool/pse-pd.c | 10 +- net/ethtool/rss.c | 37 ++-- net/ethtool/strset.c | 2 +- net/ethtool/tsconfig.c | 15 +- net/ethtool/tsinfo.c | 19 +- net/handshake/genl.c | 3 +- net/handshake/genl.h | 1 + net/handshake/handshake-test.c | 2 +- net/handshake/handshake.h | 4 +- net/handshake/netlink.c | 6 +- net/handshake/request.c | 16 +- net/handshake/tlshd.c | 6 +- net/hsr/hsr_forward.c | 4 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 4 +- net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 6 +- net/ipv6/ip6_vti.c | 23 ++- net/ipv6/route.c | 5 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/l2tp/l2tp_core.c | 11 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 1 + net/mptcp/fastopen.c | 4 +- net/mptcp/mib.c | 1 - net/mptcp/mib.h | 1 - net/mptcp/protocol.c | 65 ++++-- net/mptcp/protocol.h | 31 ++- net/mptcp/subflow.c | 8 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_synproxy_core.c | 2 + net/netfilter/nft_bitwise.c | 18 +- net/netfilter/nft_byteorder.c | 13 +- net/netfilter/xt_cpu.c | 2 +- net/netlink/af_netlink.c | 11 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/rxrpc/ar-internal.h | 14 +- net/rxrpc/call_event.c | 22 +-- net/rxrpc/call_object.c | 2 + net/rxrpc/conn_event.c | 30 ++- net/rxrpc/insecure.c | 8 +- net/rxrpc/recvmsg.c | 68 +++++-- net/rxrpc/rxgk.c | 147 ++++++-------- net/rxrpc/rxgk_app.c | 46 ++--- net/rxrpc/rxgk_common.h | 66 +++---- net/rxrpc/rxkad.c | 115 ++++------- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 ---- net/sched/sch_sfb.c | 2 +- net/sctp/socket.c | 2 + net/smc/af_smc.c | 4 +- net/vmw_vsock/af_vsock.c | 49 +++-- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 26 ++- net/vmw_vsock/vmci_transport.c | 8 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_ipcomp.c | 12 +- net/xfrm/xfrm_iptfs.c | 29 ++- net/xfrm/xfrm_policy.c | 17 +- net/xfrm/xfrm_state.c | 23 ++- net/xfrm/xfrm_user.c | 5 +- sound/core/oss/pcm_oss.c | 18 +- .../motu/motu-register-dsp-message-parser.c | 11 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 ++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++-- sound/usb/mixer_scarlett2.c | 33 +++- tools/bootconfig/main.c | 4 +- tools/testing/cxl/test/cxl.c | 105 ++++------ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 10 +- 346 files changed, 3284 insertions(+), 1733 deletions(-)

3 months

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage