This is the start of the stable review cycle for the 5.15.210 release. There are 410 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 19 Jun 2026 08:02:26 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.210-rc... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below.

thanks,

greg k-h

------------- Pseudo-Shortlog of commits:

Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 5.15.210-rc2

Ali Ganiyev ali.qaniyev@gmail.com ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

Luiz Augusto von Dentz luiz.von.dentz@intel.com Bluetooth: MGMT: Fix backward compatibility with userspace

Henri A contact@henrialfonso.com media: rc: igorplugusb: fix control request setup packet

Sven Eckelmann sven@narfation.org batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown

Oliver Neukum oneukum@suse.com media: rc: ttusbir: fix inverted error logic

Thorsten Blum thorsten.blum@linux.dev crypto: nx - fix context leak in nx842_crypto_free_ctx

Borislav Petkov (AMD) bp@alien8.de x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function

Ben Hutchings benh@debian.org apparmor: validate default DFA states are in bounds

Ben Hutchings benh@debian.org fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter

Paolo Abeni pabeni@redhat.com mptcp: close TOCTOU race while computing rcv_wnd

Will Deacon will@kernel.org arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU

Shanker Donthineni sdonthineni@nvidia.com arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU

Mark Rutland mark.rutland@arm.com arm64: errata: Mitigate TLBI errata on various Arm CPUs

Mark Rutland mark.rutland@arm.com arm64: cputype: Add C1-Premium definitions

Mark Rutland mark.rutland@arm.com arm64: cputype: Add C1-Ultra definitions

Shanker Donthineni sdonthineni@nvidia.com arm64: cputype: Add NVIDIA Olympus definitions

Christian Göttsche cgzones@googlemail.com selinux: enable genfscon labeling for securityfs

Aaron Erhardt aer@tuxedocomputers.com ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6

Jeff Layton jlayton@kernel.org nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

Eric Biggers ebiggers@kernel.org ksmbd: Compare MACs in constant time

Pengpeng Hou pengpeng@iscas.ac.cn net/ipv6: ioam6: prevent schema length wraparound in trace fill

Sven Eckelmann sven@narfation.org batman-adv: tp_meter: fix tp_num leak on kmalloc failure

Jiexun Wang wangjiexun2025@gmail.com batman-adv: stop tp_meter sessions during mesh teardown

Tejun Heo tj@kernel.org blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init

Julian Anastasov ja@ssi.bg ipvs: skip ipv6 extension headers for csum checks

Yin Tirui yintirui@huawei.com mm/huge_memory: update file PMD counter before folio_put()

Jason Gunthorpe jgg@ziepe.ca RDMA/umem: Fix truncation for block sizes >= 4G

Leon Romanovsky leon@kernel.org RDMA: Move DMA block iterator logic into dedicated files

Randy Dunlap rdunlap@infradead.org RDMA/umem: fix kernel-doc warnings

Anton Leontev leontyevantony@gmail.com hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf

Davide Ornaghi d.ornaghi97@gmail.com netfilter: nft_fib: fix stale stack leak via the OIFNAME register

Michael Bommarito michael.bommarito@gmail.com scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

Prasanna S prasanna.s@oss.qualcomm.com serial: qcom-geni: fix UART_RX_PAR_EN bit position

Bartosz Golaszewski bartosz.golaszewski@linaro.org tty: serial: qcom-geni-serial: align #define values

Bartosz Golaszewski bartosz.golaszewski@linaro.org tty: serial: qcom-geni-serial: remove unused symbols

Myeonghun Pak mhun512@gmail.com serial: altera_jtaguart: handle uart_add_one_port() failures

Lad Prabhakar prabhakar.mahadev-lad.rj@bp.renesas.com serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt

Berkant Koc me@berkoc.com drm/hyperv: validate resolution_count and fix WIN8 fallback

Michael Kelley mikelley@microsoft.com drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7

Myrrh Periwinkle myrrhperiwinkle@qtmlabs.xyz usb: typec: ucsi: Check if power role change actually happened before handling

Michael Bommarito michael.bommarito@gmail.com scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

Michael Bommarito michael.bommarito@gmail.com thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()

Guangshuo Li lgs201920130244@gmail.com usb: gadget: f_hid: fix device reference leak in hidg_alloc()

John Keeping john@metanate.com usb: gadget: f_hid: tidy error handling in hidg_alloc

Radhey Shyam Pandey radhey.shyam.pandey@amd.com usb: dwc3: xilinx: fix error handling in zynqmp init error paths

Tudor Ambarus tudor.ambarus@linaro.org tty: serial: samsung: Remove redundant port lock acquisition in rx helpers

Tudor Ambarus tudor.ambarus@linaro.org tty: serial: samsung: use u32 for register interactions

Thomas Gleixner tglx@linutronix.de serial: samsung_tty: Use port lock wrappers

Minh Nguyen minhnguyen.080505@gmail.com net: skbuff: fix missing zerocopy reference in pskb_carve helpers

Peter Chen peter.chen@cixtech.com usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure

Rodrigo Alencar rodrigo.alencar@analog.com iio: dac: ad5686: fix ref bit initialization for single-channel parts

Antoniu Miclaus antoniu.miclaus@analog.com iio: chemical: scd30: fix division by zero in write_raw

Jonathan Cameron Jonathan.Cameron@huawei.com iio: chemical: scd30: Use guard(mutex) to allow early returns

Antoniu Miclaus antoniu.miclaus@analog.com iio: gyro: adis16260: fix division by zero in write_raw

Siwei Zhang oss@fourdim.xyz Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()

Wayne Chang waynec@nvidia.com phy: tegra: xusb: Fix per-pad high-speed termination calibration

Wayne Chang waynec@nvidia.com phy: tegra: xusb: Disable trk clk when not in use

Zeng Heng zengheng4@huawei.com arm64: tlb: Flush walk cache when unsharing PMD tables

Johan Hovold johan@kernel.org spi: qup: fix error pointer deref after DMA setup failure

Yang Yingliang yangyingliang@huawei.com spi: qup: switch to use modern name

Dawei Feng dawei.feng@seu.edu.cn octeontx2-pf: avoid double free of pool->stack on AQ init failure

Sam Daly sam@samdaly.ie octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

Shardul Bankar shardul.b@mpiricsoftware.com mptcp: do not drop partial packets

Matthieu Baerts (NGI0) matttbe@kernel.org selftests: mptcp: drop nanoseconds width specifier

Li Xiasong lixiasong1@huawei.com mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient

Al Viro viro@zeniv.linux.org.uk use less confusing names for iov_iter direction initializers

Justin Iurman justin.iurman@gmail.com ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()

Eric Dumazet edumazet@google.com ipv6/addrconf: annotate data-races around devconf fields (II)

Jose Ignacio Tornos Martinez jtornosm@redhat.com ice: fix VF queue configuration with low MTU values

Michael Bommarito michael.bommarito@gmail.com net: hsr: defer node table free until after RCU readers

Jiexun Wang wangjiexun2025@gmail.com Bluetooth: serialize accept_q access

Luiz Augusto von Dentz luiz.von.dentz@intel.com Bluetooth: Init sk_peer_* on bt_sock_alloc

Luiz Augusto von Dentz luiz.von.dentz@intel.com Bluetooth: Consolidate code around sk_alloc into a helper function

Dawei Feng dawei.feng@seu.edu.cn qed: fix double free in qed_cxt_tables_alloc()

Christophe JAILLET christophe.jaillet@wanadoo.fr qed: Use the bitmap API to simplify some functions

Michael Bommarito michael.bommarito@gmail.com Bluetooth: MGMT: validate Add Extended Advertising Data length

Luiz Augusto von Dentz luiz.von.dentz@intel.com Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2

Shuai Zhang shuai.zhang@oss.qualcomm.com Bluetooth: hci_qca: Convert timeout from jiffies to ms

Safa Karakuş safa.karakus@secunnix.com Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()

Michael Bommarito michael.bommarito@gmail.com smb: client: require net admin for CIFS SWN netlink

Ido Schimmel idosch@nvidia.com genetlink: Use internal flags for multicast groups

Johan Hovold johan@kernel.org spi: lantiq-ssc: fix controller deregistration

Johan Hovold johan@kernel.org spi: st-ssc4: fix controller deregistration

Chao Yu chao@kernel.org f2fs: fix false alarm of lockdep on cp_global_sem lock

Yongpeng Yang yangyongpeng@xiaomi.com f2fs: fix incorrect file address mapping when inline inode is unwritten

Matthieu Baerts (NGI0) matttbe@kernel.org mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker

Matthieu Baerts (NGI0) matttbe@kernel.org mptcp: pm: ADD_ADDR rtx: fix potential data-race

Matthieu Baerts (NGI0) matttbe@kernel.org mptcp: pm: prio: skip closed subflows

Piyush Sachdeva s.piyush1024@gmail.com smb: client: Use FullSessionKey for AES-256 encryption key derivation

Filipe Manana fdmanana@suse.com btrfs: fix missing last_unlink_trans update when removing a directory

Michael Bommarito michael.bommarito@gmail.com smb: client: validate dacloffset before building DACL pointers

Ulf Hansson ulf.hansson@linaro.org pmdomain: core: Fix detach procedure for virtual devices in genpd

Steven Rostedt rostedt@goodmis.org tracing/probes: Limit size of event probe to 3K

Yochai Eisenrich yochaie@sweet.security btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak

Johan Hovold johan@kernel.org spi: topcliff-pch: fix controller deregistration

Uwe Kleine-König u.kleine-koenig@pengutronix.de spi: topcliff-pch: Convert to platform remove callback returning void

Thomas Zimmermann tzimmermann@suse.de fbcon: Avoid OOB font access if console rotation fails

Sang-Heon Jeon ekffu200098@gmail.com mm/hugetlb_cma: round up per_node before logging it

Johan Hovold johan@kernel.org spi: uniphier: fix controller deregistration

Johan Hovold johan@kernel.org spi: tegra20-sflash: fix controller deregistration

Johan Hovold johan@kernel.org spi: tegra114: fix controller deregistration

Johan Hovold johan@kernel.org spi: sun6i: fix controller deregistration

Johan Hovold johan@kernel.org spi: zynq-qspi: fix controller deregistration

Johan Hovold johan@kernel.org spi: ti-qspi: fix controller deregistration

Uwe Kleine-König u.kleine-koenig@pengutronix.de spi: spi-ti-qspi: Convert to platform remove callback returning void

Johan Hovold johan@kernel.org spi: sun4i: fix controller deregistration

Johan Hovold johan@kernel.org spi: syncuacer: fix controller deregistration

Michal Kosiorek mkosiorek121@gmail.com xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

Michael Bommarito michael.bommarito@gmail.com xfrm: ah: account for ESN high bits in async callbacks

Eric Biggers ebiggers@google.com net: ipv6: stop checking crypto_ahash_alignmask

Eric Biggers ebiggers@google.com net: ipv4: stop checking crypto_ahash_alignmask

Selvarasu Ganesan selvarasu.g@samsung.com usb: dwc3: Move GUID programming after PHY initialization

Marek Szyprowski m.szyprowski@samsung.com wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task

Amit Sunil Dhamne amitsd@google.com usb: typec: tcpm: reset internal port states on soft reset AMS

Michael Bommarito michael.bommarito@gmail.com smb: client: validate the whole DACL before rewriting it in cifsacl

David Carlier devnexen@gmail.com tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()

Thorsten Blum thorsten.blum@linux.dev crypto: caam - guard HMAC key hex dumps in hash_digest_key

Thorsten Blum thorsten.blum@linux.dev printk: add print_hex_dump_devel()

Cássio Gabriel cassiogabrielcontato@gmail.com ALSA: aloop: Fix peer runtime UAF during format-change stop

Max Kellermann max.kellermann@ionos.com ceph: only d_add() negative dentries when they are unhashed

Junrui Luo moonafterrain@outlook.com erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()

Thorsten Blum thorsten.blum@linux.dev crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx

Ard Biesheuvel ardb@kernel.org crypto: nx - Migrate to scomp API

Gustavo A. R. Silva gustavoars@kernel.org crypto: nx - Avoid -Wflex-array-member-not-at-end warning

Johan Hovold johan@kernel.org can: ucan: fix devres lifetime

Julia Lawall Julia.Lawall@inria.fr can: ucan: fix typos in comments

Shuvam Pandey shuvampandey1@gmail.com Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

Zilin Guan zilin@seu.edu.cn hfsplus: fix held lock freed on hfsplus_fill_super()

Deepanshu Kartikey kartikey406@gmail.com hfsplus: fix uninit-value by validating catalog record size

Seohyeon Maeng bioloidgp@gmail.com udf: fix partition descriptor append bookkeeping

Sanjaikumar V S sanjaikumar.vs@dicortech.com mtd: spi-nor: sst: Fix write enable before AAI sequence

Shawn Lin shawn.lin@rock-chips.com mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration

Ryan Roberts ryan.roberts@arm.com randomize_kstack: Maintain kstack_offset per task

Thomas Zimmermann tzimmermann@suse.de fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info

Zhengchuan Liang zcliangcn@gmail.com net: bridge: use a stable FDB dst snapshot in RCU readers

Manivannan Sadhasivam manivannan.sadhasivam@oss.qualcomm.com net: qrtr: ns: Limit the total number of nodes

Yuan Zhaoming yuanzm2@lenovo.com net: mctp: fix don't require received header reserved bits to be zero

Manivannan Sadhasivam manivannan.sadhasivam@oss.qualcomm.com net: qrtr: ns: Free the node during ctrl_cmd_bye()

Vignesh Viswanathan quic_viswanat@quicinc.com net: qrtr: ns: Change servers radix tree to xarray

Manivannan Sadhasivam manivannan.sadhasivam@oss.qualcomm.com net: qrtr: ns: Limit the maximum number of lookups

Takashi Iwai tiwai@suse.de ALSA: core: Fix potential data race at fasync handling

Joseph Salisbury joseph.salisbury@oracle.com sched: Use u64 for bandwidth ratio calculations

Oliver Neukum oneukum@suse.com media: rc: igorplugusb: heed coherency rules

Gao Xiang hsiangkao@linux.alibaba.com erofs: fix the out-of-bounds nameoff handling for trailing dirents

Thorsten Blum thorsten.blum@linux.dev ALSA: aoa: Skip devices with no codecs in i2sbus_resume()

Oliver Neukum oneukum@suse.com media: rc: ttusbir: respect DMA coherency rules

Cássio Gabriel cassiogabrielcontato@gmail.com ALSA: aoa: i2sbus: clear stale prepared state

Takashi Iwai tiwai@suse.de ALSA: aoa: Use guard() for mutex locks

Daniel Hodges git@danielhodges.dev wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

Rafael J. Wysocki rafael.j.wysocki@intel.com thermal: core: Fix thermal zone governor cleanup issues

Fedor Pchelkin pchelkin@ispras.ru wifi: rtw88: check for PCI upstream bridge existence

Jimmy Hon honyuenkwun@gmail.com rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID

Anshuman Khandual anshuman.khandual@arm.com arm64/mm: Enable batched TLB flush in unmap_hotplug_range()

Bingquan Chen patzilla007@gmail.com net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()

Michael Bommarito michael.bommarito@gmail.com ksmbd: require minimum ACE size in smb_check_perm_dacl()

Michael Bommarito michael.bommarito@gmail.com smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

Michael Bommarito michael.bommarito@gmail.com smb: client: require a full NFS mode SID before reading mode bits

DaeMyung Kang charsyam@gmail.com smb: server: fix max_connections off-by-one in tcp accept path

Michael Bommarito michael.bommarito@gmail.com smb: server: fix active_num_conn leak on transport allocation failure

Yongpeng Yang yangyongpeng@xiaomi.com f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()

Chao Yu chao@kernel.org f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally

Lukas Wunner lukas@wunner.de lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()

Eric Biggers ebiggers@kernel.org net/tcp-md5: Fix MAC comparison to be constant-time

Longxuan Yu ylong030@ucr.edu io_uring/poll: fix signed comparison in io_poll_get_ownership()

SeongJae Park sj@kernel.org mm/damon/ops-common: call folio_test_lru() after folio_get()

Mingyu Wang 25181214217@stu.xidian.edu.cn fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

Harry Wentland harry.wentland@amd.com drm/amd/display: Use krealloc_array() in dal_vector_reserve()

Harry Wentland harry.wentland@amd.com drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

Harry Wentland harry.wentland@amd.com drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

Harry Wentland harry.wentland@amd.com drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size

Bjorn Andersson bjorn.andersson@oss.qualcomm.com slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock

Michael Bommarito michael.bommarito@gmail.com thunderbolt: Limit XDomain response copy to actual frame size

Michael Bommarito michael.bommarito@gmail.com thunderbolt: Clamp XDomain response data copy to allocation size

Michael Bommarito michael.bommarito@gmail.com thunderbolt: Bound root directory content to block size

Michael Bommarito michael.bommarito@gmail.com thunderbolt: Reject zero-length property entries in validator

Wyatt Feng bronzed_45_vested@icloud.com sctp: stream: fully roll back denied add-stream state

Zhao Zhang zzhan461@ucr.edu sctp: diag: reject stale associations in dump_one path

Jisheng Zhang jszhang@kernel.org mmc: sdhci: add signal voltage switch in sdhci_resume_host

Lad Prabhakar prabhakar.mahadev-lad.rj@bp.renesas.com mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC

Kamal Dasu kamal.dasu@broadcom.com mmc: core: Fix host controller programming for fixed driver type

Yuqi Xu xuyq21@lenovo.com net: rds: clear i_sends on setup unwind

Bartosz Golaszewski bartosz.golaszewski@oss.qualcomm.com net: mv643xx: fix OF node refcount

ZhaoJinming zhaojinming@uniontech.com net: bonding: fix NULL pointer dereference in bond_do_ioctl()

Junrui Luo moonafterrain@outlook.com misc: fastrpc: fix DMA address corruption due to find_vma misuse

Anandu Krishnan E anandu.e@oss.qualcomm.com misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context

Yilin Zhu zylzyl2333@gmail.com ipc/shm: serialize orphan cleanup with shm_nattch updates

Cryolitia PukNgae cryolitia.pukngae@linux.dev Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard

Zeyu WANG zeyu.thomas.wang@gmail.com Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)

Akhil R akhilrajeev@nvidia.com i2c: tegra: Fix NOIRQ suspend/resume

Guillermo Rodríguez guille.rodriguez@gmail.com i2c: stm32f7: fix timing computation ignoring i2c-analog-filter

Vladimir Zapolskiy vladimir.zapolskiy@linaro.org i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()

Jann Horn jannh@google.com fuse: reject fuse_notify() pagecache ops on directories

Christian Brauner brauner@kernel.org pidfd: refuse access to tasks that have started exiting harder

Michael Bommarito michael.bommarito@gmail.com IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

Kyle Meyer kyle.meyer@hpe.com bnxt_en: Fix NULL pointer dereference

Raf Dickson rafdog35@gmail.com vsock/vmci: fix sk_ack_backlog leak on failed handshake

Matthieu Baerts (NGI0) matttbe@kernel.org mptcp: sockopt: check timestamping ret value

Paolo Abeni pabeni@redhat.com mptcp: fix retransmission loop when csum is enabled

Karl Mehltretter kmehltretter@gmail.com ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O

Yuho Choi dbgh9129@gmail.com ARM: socfpga: Fix OF node refcount leak in SMP setup

Michael Bommarito michael.bommarito@gmail.com RDMA/srp: bound SRP_RSP sense copy by the received length

Harry Wentland harry.wentland@amd.com drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()

Takashi Iwai tiwai@suse.de ALSA: timer: Fix UAF at snd_timer_user_params()

HyeongJun An sammiee5311@gmail.com USB: serial: kl5kusb105: fix bulk-out buffer overflow

Jack Wu jackbb_wu@compal.com USB: serial: option: add usb-id for Dell Wireless DW5826e-m

Adrian Korwel adriank20047@gmail.com USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()

Adrian Korwel adriank20047@gmail.com USB: serial: io_ti: fix heap overflow in get_manuf_info()

Wyatt Feng bronzed_45_vested@icloud.com xfrm: espintcp: do not reuse an in-progress partial send

Joonas Lahtinen joonas.lahtinen@linux.intel.com drm/i915/gem: Fix phys BO pread/pwrite with offset

Michael Bommarito michael.bommarito@gmail.com Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig

Tristan Madani tristan@talencesecurity.com netfilter: nft_tunnel: fix use-after-free on object destroy

Alexander A. Klimov grandmaster@al2klimov.de drm/vc4: fix krealloc() memory leak

Til Kaiser mail@tk154.de net: mvpp2: build skb from XDP-adjusted data on XDP_PASS

Til Kaiser mail@tk154.de net: mvpp2: refill RX buffers before XDP or skb use

Lorenzo Bianconi lorenzo@kernel.org net: mvpp2: Add metadata support for xdp mode

Til Kaiser mail@tk154.de net: mvpp2: limit XDP frame size to the RX buffer

Til Kaiser mail@tk154.de net: mvpp2: sync RX data at the hardware packet offset

Florian Westphal fw@strlen.de netfilter: nft_exthdr: fix register tracking for F_PRESENT flag

Xiang Mei xmei5@asu.edu netfilter: nf_log: validate MAC header was set before dumping it

Kyle Zeng kylebot@openai.com netfilter: x_tables: avoid leaking percpu counter pointers

Breno Leitao leitao@debian.org rds: mark snapshot pages dirty in rds_info_getsockopt()

Eric Dumazet edumazet@google.com ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

Weiming Shi bestswngs@gmail.com net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

Kyle Zeng kylebot@openai.com net: guard timestamp cmsgs to real error queue skbs

Michael Bommarito michael.bommarito@gmail.com sctp: fix uninit-value in __sctp_rcv_asconf_lookup()

Adrian Moreno amorenoz@redhat.com net: openvswitch: fix possible kfree_skb of ERR_PTR

Kyle Zeng kylebot@openai.com ipv6: sit: reload inner IPv6 header after GSO offloads

Mingyu Wang 25181214217@stu.xidian.edu.cn net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

Chenguang Zhao zhaochenguang@kylinos.cn netlabel: validate unlabeled address and mask attribute lengths

Sanghyun Park sanghyun.park.cnu@gmail.com xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

Mark Rutland mark.rutland@arm.com arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI

Mark Rutland mark.rutland@arm.com arm64: tlb: Allow XZR argument to TLBI ops

Marc Zyngier maz@kernel.org KVM: arm64: Remove VPIPT I-cache handling

Weiming Shi bestswngs@gmail.com tun: free page on build_skb failure in tun_xdp_one()

Weiming Shi bestswngs@gmail.com tap: free page on error paths in tap_get_user_xdp()

Jeff Layton jlayton@kernel.org nfsd: don't ignore the return code of svc_proc_register()

Edward Lo loyuantsung@gmail.com fs/ntfs3: Return error for inconsistent extended attributes

Tejas Bharambe tejas.bharambe@outlook.com ext4: validate p_idx bounds in ext4_ext_correct_indexes

Naveen Kumar Chaudhary naveen.osdev@gmail.com time: Fix off-by-one in settimeofday() usec validation

Aleksandr Nogikh nogikh@google.com signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()

Xin Long lucien.xin@gmail.com sctp: purge outqueue on stale COOKIE-ECHO handling

Yizhou Zhao zhaoyz24@mails.tsinghua.edu.cn net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr

Eric Dumazet edumazet@google.com ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

Eric Dumazet edumazet@google.com ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options

Bharath Reddy kbreddy.rpbc@gmail.com Bluetooth: fix memory leak in error path of hci_alloc_dev()

Zhang Cen rollkingzzc@gmail.com Bluetooth: bnep: reject short frames before parsing

Dudu Lu phx0fer@gmail.com Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling

SeungJu Cheon suunj1331@gmail.com Bluetooth: RFCOMM: validate skb length in MCC handlers

Zhang Cen rollkingzzc@gmail.com Bluetooth: MGMT: validate advertising TLV before type checks

Zhang Cen rollkingzzc@gmail.com Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

David Thompson davthompson@nvidia.com net: lan743x: permit VLAN-tagged packets up to configured MTU

Yizhou Zhao zhaoyz24@mails.tsinghua.edu.cn net: garp: fix unsigned integer underflow in garp_pdu_parse_attr

Oscar Maes oscmaes92@gmail.com pcnet32: stop holding device spin lock during napi_complete_done

Yicong Hui yiconghui@gmail.com drm/imx: Fix three kernel-doc warnings in dcss-scaler.c

Yizhou Zhao zhaoyz24@mails.tsinghua.edu.cn 6lowpan: fix off-by-one in multicast context address compression

Jamal Hadi Salim jhs@mojatatu.com net/sched: act_api: use RCU with deferred freeing for action lifecycle

Guangshuo Li lgs201920130244@gmail.com dm cache policy smq: check allocation under invalidate lock

Yiming Qian yimingqian591@gmail.com netfilter: bridge: make ebt_snat ARP rewrite writable

Florian Westphal fw@strlen.de netfilter: conntrack_irc: fix possible out-of-bounds read

Fernando Fernandez Mancera fmancera@suse.de netfilter: synproxy: add mutex to guard hook reference counting

Julian Anastasov ja@ssi.bg ipvs: clear the svc scheduler ptr early on edit

Fernando Fernandez Mancera fmancera@suse.de netfilter: xt_NFQUEUE: prefer raw_smp_processor_id

Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com tee: optee: prevent use-after-free when the client exits before the supplicant

Ido Schimmel idosch@nvidia.com ipv6: mcast: Fix use-after-free when processing MLD queries

Mingyu Wang 25181214217@stu.xidian.edu.cn i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl

Nathan Chancellor nathan@kernel.org Disable -Wattribute-alias for clang-23 and newer

Nathan Chancellor nathan@kernel.org compiler-clang.h: Add __diag infrastructure for clang

Johan Hovold johan@kernel.org USB: serial: mct_u232: fix memory corruption with small endpoint

Kuniyuki Iwashima kuniyu@google.com bpf: Free reuseport cBPF prog after RCU grace period.

Michal Pecio michal.pecio@gmail.com usb: core: Fix SuperSpeed root hub wMaxPacketSize

Maciej W. Rozycki macro@orcam.me.uk serial: dz: Fix bootconsole handover lockup

Wei-Cheng Chen weichengc@nvidia.com xhci: tegra: Fix ghost USB device on dual-role port unplug

Johan Hovold johan@kernel.org USB: serial: digi_acceleport: fix memory corruption with small endpoints

Nathan Chancellor nathan@kernel.org HID: core: Fix size_t specifier in hid_report_raw_event()

Benjamin Tissoires bentiss@kernel.org HID: pass the buffer size to hid_report_raw_event

Vicki Pfau vi@endrift.com HID: core: Add printk_ratelimited variants to hid_warn() etc

Johan Hovold johan@kernel.org USB: serial: cypress_m8: fix memory corruption with small endpoint

Maciej W. Rozycki macro@orcam.me.uk serial: zs: Switch to using channel reset

Maciej W. Rozycki macro@orcam.me.uk serial: zs: Fix bootconsole handover lockup

Maciej W. Rozycki macro@orcam.me.uk serial: dz: Fix bootconsole message clobbering at chip reset

Shitalkumar Gandhi shital.gandhi45@gmail.com serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma

Maciej W. Rozycki macro@orcam.me.uk serial: zs: Fix swapped RI/DSR modem line transition counting

Hongling Zeng zenghongling@kylinos.cn serial: sh-sci: fix memory region release in error path

Berkant Koc me@berkoc.com drm/hyperv: validate VMBus packet size in receive callback

Michael Bommarito michael.bommarito@gmail.com scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

Michael Bommarito michael.bommarito@gmail.com scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker

Michael Bommarito michael.bommarito@gmail.com thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow

Michael Bommarito michael.bommarito@gmail.com thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()

Michael Bommarito michael.bommarito@gmail.com usb: gadget: f_fs: copy only received bytes on short ep0 read

Seungjin Bae eeodqql09@gmail.com usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports

Guangshuo Li lgs201920130244@gmail.com usb: gadget: net2280: Fix double free in probe error path

Johan Hovold johan@kernel.org USB: serial: mct_u232: fix missing interrupt-in transfer sanity check

Johan Hovold johan@kernel.org USB: serial: mxuport: fix memory corruption with small endpoint

Johan Hovold johan@kernel.org USB: serial: keyspan: fix missing indat transfer sanity check

Zhang Cen rollkingzzc@gmail.com USB: serial: cypress_m8: validate interrupt packet headers

Zhang Cen rollkingzzc@gmail.com USB: serial: belkin_sa: validate interrupt status length

Wanquan Zhong wanquan.zhong@fibocom.com USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL

Jan Volckaert janvolck@gmail.com USB: serial: option: add MeiG SRM813Q

Heitor Alves de Siqueira halves@igalia.com usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize

Heitor Alves de Siqueira halves@igalia.com usb: usbtmc: check URB actual_length for interrupt-IN notifications

Michael Bommarito michael.bommarito@gmail.com usbip: vudc: Fix use after free bug in vudc_remove due to race condition

Sam Burkels sam@1a38.nl usb: storage: Add quirks for PNY Elite Portable SSD

Stephen J. Fuhry fuhrysteve@gmail.com USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers

Michal Pecio michal.pecio@gmail.com usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval

Xu Yang xu.yang_2@nxp.com usb: chipidea: core: convert ci_role_switch to local variable

Zhaoyang Yu 2426767509@qq.com tty: serial: pch_uart: add check for dma_alloc_coherent()

Ian Abbott abbotti@mev.co.uk comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()

Ian Abbott abbotti@mev.co.uk comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()

Nicolás Bazaes contacto@bazaes.cl Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490

Dmitry Torokhov dmitry.torokhov@gmail.com Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

Jingguo Tan tanjingguo@huawei.com xfrm: esp: restore combined single-frag length gate

Srinivas Kandagatla srinivas.kandagatla@oss.qualcomm.com ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks

Srinivas Kandagatla srinivas.kandagatla@oss.qualcomm.com ASoC: qcom: q6asm-dai: close stream only when running

Hamza Mahfooz hamzamahfooz@linux.microsoft.com netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

Michael Bommarito michael.bommarito@gmail.com xfrm: ah: use skb_to_full_sk in async output callbacks

Maoyi Xie maoyixie.tju@gmail.com xfrm: route MIGRATE notifications to caller's netns

Ashutosh Desai ashutoshdesai993@gmail.com nfc: hci: fix out-of-bounds read in HCP header parsing

Arnd Bergmann arnd@arndb.de iommu, debugobjects: avoid gcc-16.1 section mismatch warnings

Lee Jones lee@kernel.org HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

Kuniyuki Iwashima kuniyu@google.com ip6: vti: Use ip6_tnl.net in vti6_changelink().

Zhengchuan Liang zcliangcn@gmail.com xfrm: input: hold netns during deferred transport reinjection

Qi Tang tpluszz77@gmail.com ipv6: validate extension header length before copying to cmsg

Maoyi Xie maoyixie.tju@gmail.com ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

Zhengchuan Liang zcliangcn@gmail.com ipv6: exthdrs: refresh nh after handling HAO option

Srinivas Kandagatla srinivas.kandagatla@oss.qualcomm.com ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params

Justin Iurman justin.iurman@gmail.com ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

Junrui Luo moonafterrain@outlook.com macsec: fix replay protection at XPN lower-PN wrap

Yuqi Xu xuyq21@lenovo.com bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

Dmitry Torokhov dmitry.torokhov@gmail.com Input: elan_i2c - validate firmware size before use

Dan Carpenter error27@gmail.com usb: dwc2: Fix use after free in debug code

Peter Chen peter.chen@cixtech.com usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles

Yongchao Wu yongchao.wu@autochips.com usb: cdns3: gadget: fix request skipping after clearing halt

Johan Hovold johan@kernel.org USB: serial: omninet: fix memory corruption with small endpoint

Felix Gu ustc.gu@gmail.com iio: buffer: hw-consumer: fix use-after-free in error path

Aldo Conte aldocontelk@gmail.com iio: light: cm3323: fix reg_conf not being initialized correctly

Advait Dhamorikar advaitd@mechasystems.com iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL

Salah Triki salah.triki@gmail.com iio: temperature: tsys01: fix broken PROM checksum validation

Sanjay Chitroda sanjayembeddedse@gmail.com iio: ssp_sensors: cancel delayed work_refresh on remove

David Carlier devnexen@gmail.com iio: gyro: itg3200: fix i2c read into the wrong stack location

Salah Triki salah.triki@gmail.com iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw

Jason A. Donenfeld Jason@zx2c4.com wireguard: send: append trailer after expanding head

Rodrigo Alencar rodrigo.alencar@analog.com iio: dac: ad5686: fix input raw value check

Salah Triki salah.triki@gmail.com iio: dac: max5821: fix return value check in powerdown sync

Christofer Jonason christofer.jonason@guidelinegeo.com iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux

Ben Hutchings benh@debian.org parport: Fix race between port and client registration

Muhammad Bilal meatuni001@gmail.com Bluetooth: HIDP: fix missing length checks in hidp_input_report()

Siwei Zhang oss@fourdim.xyz Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

Linpu Yu linpu5433@gmail.com ipc: limit next_id allocation to the valid ID range

Mikulas Patocka mpatocka@redhat.com hpfs: fix a crash if hpfs_map_dnode_bitmap fails

Shuai Zhang shuai.zhang@oss.qualcomm.com Bluetooth: btusb: Allow firmware re-download when version matches

Thomas Fourier fourier.thomas@gmail.com Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()

Johan Hovold johan@kernel.org USB: serial: safe_serial: fix memory corruption with small endpoint

Greg Kroah-Hartman gregkh@linuxfoundation.org usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()

Greg Kroah-Hartman gregkh@linuxfoundation.org usb: typec: altmodes/displayport: validate count before reading Status Update VDO

Greg Kroah-Hartman gregkh@linuxfoundation.org usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO

Greg Kroah-Hartman gregkh@linuxfoundation.org usb: typec: ucsi: ccg: reject firmware images without a ':' record header

Greg Kroah-Hartman gregkh@linuxfoundation.org iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer

Stefan Metzmacher metze@samba.org smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path

Horatiu Vultur horatiu.vultur@microchip.com phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X

Harini Katakam harini.katakam@amd.com phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table

Jiasheng Jiang jiashengjiangcool@gmail.com RDMA/rxe: Fix double free in rxe_srq_from_init

Ben Hutchings benh@debian.org Revert "RDMA/rxe: Fix double free in rxe_srq_from_init"

Jouni Högander jouni.hogander@intel.com drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used

Suraj Kandpal suraj.kandpal@intel.com drm/dp: Add eDP 1.5 bit definition

Jouni Högander jouni.hogander@intel.com drm/i915/psr: Read Intel DPCD workaround register

Jouni Högander jouni.hogander@intel.com drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register

Duoming Zhou duoming@zju.edu.cn wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work

Sven Eckelmann sven@narfation.org batman-adv: bla: avoid double decrement of bla.num_requests

Sven Eckelmann sven@narfation.org batman-adv: tt: avoid empty VLAN responses

Sven Eckelmann sven@narfation.org batman-adv: tt: fix TOCTOU race for reported vlans

Sven Eckelmann sven@narfation.org batman-adv: tp_meter: directly shut down timer on cleanup

Petr Machata petrm@nvidia.com selftests: forwarding: lib: Add helpers for checksum handling

Sven Eckelmann sven@narfation.org batman-adv: iv: recover OGM scheduling after forward packet error

Sven Eckelmann sven@narfation.org batman-adv: tvlv: reject oversized TVLV packets

Sven Eckelmann sven@narfation.org batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface

Sven Eckelmann sven@narfation.org batman-adv: tvlv: abort OGM send on tvlv append failure

Sven Eckelmann sven@narfation.org batman-adv: v: stop OGMv2 on disabled interface

Zhenghang Xiao kipreyyy@gmail.com sctp: fix race between sctp_wait_for_connect and peeloff

Marco Scardovi scardracs@disroot.org gpio: rockchip: convert bank->clk to devm_clk_get_enabled()

Luiz Augusto von Dentz luiz.von.dentz@intel.com Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

Zhenghang Xiao kipreyyy@gmail.com Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

Rahul Chandelkar rc@rexion.ai ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

Jakub Kicinski kuba@kernel.org ethtool: eeprom: add more safeties to EEPROM Netlink fallback

Oliver Hartkopp socketcan@hartkopp.net bonding: refuse to enslave CAN devices

Zhao Dongdong zhaodongdong@kylinos.cn Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

Cássio Gabriel cassiogabrielcontato@gmail.com ASoC: codecs: simple-mux: Fix enum control bounds check

Eric Dumazet edumazet@google.com tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

Eric Dumazet edumazet@google.com vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

Eric Dumazet edumazet@google.com tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

Cássio Gabriel cassiogabrielcontato@gmail.com ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors

Eric Dumazet edumazet@google.com ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

Breno Leitao leitao@debian.org net/iucv: fix locking in .getsockopt

Alexandra Winter wintera@linux.ibm.com net/smc: Do not re-initialize smc hashtables

Ilya Maximets i.maximets@ovn.org net: netlink: don't set nsid on local notifications

Ilya Maximets i.maximets@ovn.org net: netlink: fix sending unassigned nsid after assigned one

Weiming Shi bestswngs@gmail.com tun: free page on short-frame rejection in tun_xdp_one()

Florian Westphal fw@strlen.de netfilter: ebtables: fix OOB read in compat_mtw_from_user

Florian Westphal fw@strlen.de netfilter: xt_cpu: prefer raw_smp_processor_id

Chris Mason clm@meta.com netfilter: synproxy: refresh tcphdr after skb_ensure_writable

Carl Lee carl.lee@amd.com nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems

David Ahern dahern@nvidia.com xfrm: Check for underflow in xfrm_state_mtu

Lee Jones lee@kernel.org nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()

Lee Jones lee@kernel.org nfc: llcp: Fix use-after-free in llcp_sock_release()

Kevin Hao haokexin@gmail.com net: cpsw_new: Fix potential unregister of netdev that has not been registered yet

Vinicius Costa Gomes vinicius.gomes@intel.com dmaengine: idxd: Fix not releasing workqueue on .release()

Carlos Eduardo Gallo Filho gcarlos@disroot.org drm: Remove plane hsub/vsub alignment requirement for core helpers

Victor Nogueria victor@mojatatu.com net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked

Jeremy Kerr jk@codeconstruct.com.au net: mctp: ensure our nlmsg responses are initialised

Davide Caratti dcaratti@redhat.com net/sched: cls_fw: fix NULL dereference of "old" filters before change()

Greg Kroah-Hartman gregkh@linuxfoundation.org Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

-------------

Diffstat:

Documentation/arm64/silicon-errata.rst | 46 ++++++ Makefile | 4 +- arch/arm/include/asm/io.h | 15 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 ++++++ arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 55 +++++-- arch/arm64/kernel/cpu_errata.c | 34 +++- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +---- arch/arm64/kvm/hyp/vhe/tlb.c | 19 +-- arch/arm64/mm/mmu.c | 36 +++-- arch/x86/kernel/cpu/amd.c | 18 ++- arch/x86/kernel/cpu/microcode/intel.c | 4 +- block/blk-cgroup.c | 32 ++-- crypto/testmgr.c | 4 +- drivers/base/power/domain.c | 10 +- drivers/block/drbd/drbd_main.c | 2 +- drivers/block/drbd/drbd_receiver.c | 2 +- drivers/block/loop.c | 14 +- drivers/block/nbd.c | 10 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 33 ++-- drivers/char/random.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 47 +++--- drivers/crypto/nx/nx-842.h | 24 +-- drivers/crypto/nx/nx-common-powernv.c | 31 ++-- drivers/crypto/nx/nx-common-pseries.c | 33 ++-- drivers/dma/idxd/init.c | 1 - drivers/dma/idxd/sysfs.c | 1 + drivers/fsi/fsi-sbefifo.c | 6 +- drivers/gpio/gpio-rockchip.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 ++++--- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 136 ++++++++++++---- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 34 +++- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 ++- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/hid/hid-core.c | 29 +++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi.c | 2 +- drivers/hid/wacom_sys.c | 19 ++- drivers/hid/wacom_wac.h | 1 + drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +++--- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 ++++---- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 8 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++++ drivers/infiniband/core/verbs.c | 38 ----- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 1 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_srq.c | 3 - drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 30 +++- drivers/input/keyboard/atkbd.c | 15 ++ drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 ++- drivers/isdn/mISDN/l1oip_core.c | 2 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/media/rc/igorplugusb.c | 19 ++- drivers/media/rc/ttusbir.c | 13 +- drivers/misc/fastrpc.c | 77 ++++++--- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci-of-dwcmshc.c | 17 +- drivers/mmc/host/sdhci.c | 1 + drivers/mtd/spi-nor/sst.c | 13 ++ drivers/net/bonding/bond_main.c | 10 +- drivers/net/can/usb/ucan.c | 6 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 +++++---- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/microchip/lan743x_main.c | 32 ++++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 26 +-- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/hyperv/netvsc.c | 19 ++- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 9 +- drivers/net/phy/mscc/mscc_main.c | 38 +---- drivers/net/ppp/ppp_generic.c | 2 +- drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +-- .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 + drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nfc/nxp-nci/i2c.c | 21 ++- drivers/nvme/host/tcp.c | 4 +- drivers/nvme/target/io-cmd-file.c | 4 +- drivers/nvme/target/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/phy/tegra/xusb-tegra186.c | 38 +++-- drivers/phy/tegra/xusb.h | 1 + drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_transport_fc.c | 77 ++++----- drivers/scsi/sg.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 3 - drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-qup.c | 165 +++++++++---------- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 9 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 15 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-uniphier.c | 8 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/staging/greybus/hid.c | 2 +- drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/target/iscsi/iscsi_target_util.c | 4 +- drivers/target/target_core_file.c | 2 +- drivers/tee/optee/supp.c | 107 ++++++++---- drivers/thermal/thermal_core.c | 7 +- drivers/thunderbolt/property.c | 38 +++-- drivers/thunderbolt/xdomain.c | 6 +- drivers/tty/serial/altera_jtaguart.c | 18 ++- drivers/tty/serial/dz.c | 58 ++++--- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 ++- drivers/tty/serial/qcom_geni_serial.c | 75 ++++----- drivers/tty/serial/samsung_tty.c | 88 +++++----- drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 40 ++--- drivers/tty/serial/zs.h | 2 +- drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/dwc3/dwc3-xilinx.c | 20 +-- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_hid.c | 20 +-- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 76 +++++---- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 ++- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/io_ti.c | 11 ++ drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 +-- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 7 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/usbip_common.c | 2 +- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/vhost/net.c | 6 +- drivers/vhost/scsi.c | 10 +- drivers/vhost/vhost.c | 6 +- drivers/vhost/vringh.c | 4 +- drivers/vhost/vsock.c | 4 +- drivers/video/fbdev/core/fb_defio.c | 152 +++++++++++++++-- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/vt8500lcdfb.c | 2 +- drivers/xen/pvcalls-back.c | 8 +- fs/9p/vfs_addr.c | 4 +- fs/9p/vfs_dir.c | 2 +- fs/9p/xattr.c | 4 +- fs/afs/cmservice.c | 2 +- fs/afs/dir.c | 2 +- fs/afs/file.c | 4 +- fs/afs/internal.h | 4 +- fs/afs/rxrpc.c | 10 +- fs/afs/write.c | 4 +- fs/aio.c | 4 +- fs/btrfs/inode.c | 2 + fs/btrfs/ioctl.c | 5 +- fs/ceph/addr.c | 2 +- fs/ceph/dir.c | 6 +- fs/ceph/file.c | 4 +- fs/cifs/cifsacl.c | 129 +++++++++++++-- fs/cifs/connect.c | 6 +- fs/cifs/file.c | 4 +- fs/cifs/ioctl.c | 2 +- fs/cifs/netlink.c | 6 +- fs/cifs/smb2ops.c | 10 +- fs/cifs/smb2transport.c | 36 +++-- fs/cifs/smbdirect.c | 4 +- fs/cifs/transport.c | 6 +- fs/erofs/decompressor.c | 1 + fs/erofs/dir.c | 30 ++-- fs/ext4/extents.c | 15 ++ fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 5 +- fs/f2fs/inline.c | 13 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 20 ++- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/fuse/ioctl.c | 4 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/hpfs/alloc.c | 2 +- fs/ksmbd/auth.c | 4 +- fs/ksmbd/smb2pdu.c | 5 +- fs/ksmbd/smbacl.c | 17 +- fs/ksmbd/transport_tcp.c | 4 +- fs/nfsd/nfs4xdr.c | 9 +- fs/nfsd/nfsctl.c | 9 +- fs/nfsd/state.h | 17 +- fs/nfsd/stats.c | 4 +- fs/nfsd/stats.h | 2 +- fs/nfsd/vfs.c | 4 +- fs/ntfs3/xattr.c | 1 + fs/ocfs2/cluster/tcp.c | 2 +- fs/orangefs/inode.c | 8 +- fs/read_write.c | 12 +- fs/seq_file.c | 2 +- fs/splice.c | 10 +- fs/udf/super.c | 4 +- include/drm/drm_dp_helper.h | 1 + include/drm/drm_fourcc.h | 5 +- include/linux/compat.h | 4 + include/linux/compiler-clang.h | 28 ++++ include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/fb.h | 4 +- include/linux/hid.h | 15 +- include/linux/parport.h | 1 + include/linux/printk.h | 13 ++ include/linux/randomize_kstack.h | 44 ++++- include/linux/sched.h | 4 + include/linux/syscalls.h | 4 + include/linux/uio.h | 3 + include/net/act_api.h | 1 + include/net/bluetooth/bluetooth.h | 3 + include/net/bluetooth/l2cap.h | 1 + include/net/genetlink.h | 9 +- include/net/ip_vs.h | 3 +- include/net/mctp.h | 3 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 36 +---- include/rdma/ib_verbs.h | 48 ------ include/rdma/iter.h | 88 ++++++++++ init/main.c | 1 - io_uring/io_uring.c | 2 +- ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/fork.c | 2 + kernel/pid.c | 8 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/debugobjects.c | 2 +- lib/mpi/mpicoder.c | 2 +- mm/damon/vaddr.c | 4 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 1 + mm/madvise.c | 2 +- mm/page_io.c | 2 +- mm/process_vm_access.c | 2 +- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 ++ net/9p/client.c | 2 +- net/batman-adv/bat_iv_ogm.c | 82 ++++++++-- net/batman-adv/bat_v_ogm.c | 59 ++++--- net/batman-adv/bridge_loop_avoidance.c | 57 ++++--- net/batman-adv/main.c | 1 + net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 118 ++++++++++---- net/batman-adv/tp_meter.h | 1 + net/batman-adv/translation-table.c | 35 +++- net/batman-adv/tvlv.c | 28 +++- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 49 +++++- net/bluetooth/6lowpan.c | 4 +- net/bluetooth/a2mp.c | 2 +- net/bluetooth/af_bluetooth.c | 144 ++++++++++++++--- net/bluetooth/bnep/core.c | 50 ++++-- net/bluetooth/bnep/sock.c | 10 +- net/bluetooth/hci_event.c | 18 ++- net/bluetooth/hci_sock.c | 10 +- net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/hidp/sock.c | 10 +- net/bluetooth/l2cap_core.c | 87 +++++++++- net/bluetooth/l2cap_sock.c | 86 +++++----- net/bluetooth/mgmt.c | 21 ++- net/bluetooth/rfcomm/core.c | 69 +++++--- net/bluetooth/rfcomm/sock.c | 48 ++++-- net/bluetooth/sco.c | 19 ++- net/bluetooth/smp.c | 2 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 ++-- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 ++++ net/ceph/messenger_v1.c | 4 +- net/ceph/messenger_v2.c | 14 +- net/compat.c | 2 +- net/core/drop_monitor.c | 2 +- net/core/filter.c | 17 +- net/core/skbuff.c | 10 +- net/ethtool/eeprom.c | 5 +- net/hsr/hsr_framereg.c | 6 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/ah4.c | 31 ++-- net/ipv4/esp4.c | 4 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_ipv4.c | 5 +- net/ipv6/addrconf.c | 47 +++--- net/ipv6/ah6.c | 29 ++-- net/ipv6/datagram.c | 54 ++++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 28 +++- net/ipv6/ioam6.c | 12 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6_vti.c | 25 ++- net/ipv6/mcast.c | 22 +-- net/ipv6/ndisc.c | 12 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/seg6_hmac.c | 8 +- net/ipv6/sit.c | 1 + net/ipv6/tcp_ipv6.c | 5 +- net/iucv/af_iucv.c | 20 ++- net/key/af_key.c | 6 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 9 +- net/mptcp/options.c | 29 ++-- net/mptcp/pm.c | 34 +++- net/mptcp/pm_netlink.c | 31 +++- net/mptcp/protocol.c | 26 ++- net/mptcp/sockopt.c | 8 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +-- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +-- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/ipvs/ip_vs_sync.c | 2 +- net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_synproxy_core.c | 26 ++- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 ++-- net/netlink/af_netlink.c | 11 +- net/netlink/genetlink.c | 4 +- net/nfc/hci/core.c | 10 ++ net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 ++ net/openvswitch/datapath.c | 1 + net/packet/af_packet.c | 25 +-- net/psample/psample.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/qrtr/ns.c | 180 ++++++++------------- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/sched/act_api.c | 7 +- net/sched/cls_fw.c | 6 +- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 4 +- net/smc/smc_clc.c | 6 +- net/socket.c | 23 +-- net/sunrpc/socklib.c | 6 +- net/sunrpc/svcsock.c | 4 +- net/sunrpc/xprtsock.c | 6 +- net/tipc/topsrv.c | 2 +- net/tls/tls_device.c | 4 +- net/vmw_vsock/vmci_transport.c | 4 +- net/xfrm/espintcp.c | 6 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 35 ++-- net/xfrm/xfrm_user.c | 5 +- security/apparmor/policy_unpack.c | 27 ++-- security/keys/keyctl.c | 4 +- security/selinux/hooks.c | 3 +- sound/aoa/codecs/onyx.c | 104 ++++-------- sound/aoa/codecs/tas.c | 113 +++++-------- sound/aoa/core/gpio-feature.c | 20 +-- sound/aoa/core/gpio-pmf.c | 26 ++- sound/aoa/soundbus/i2sbus/core.c | 3 + sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++++++-------- sound/core/misc.c | 14 +- sound/core/timer.c | 1 + sound/drivers/aloop.c | 40 +++-- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 +++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++--- tools/testing/selftests/net/forwarding/lib.sh | 56 +++++++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- 480 files changed, 4805 insertions(+), 2544 deletions(-)