[SRU][Noble][PULL] Noble upstream stable patchset 2026-10-05
Manuel Diewald
manuel.diewald at canonical.com
Wed Oct 7 20:50:17 UTC 2026
This pull request (1216 commits) includes the following Noble stable patchsets:
Noble update: upstream stable patchset 2026-10-05
Ported from the following upstream stable releases:
v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153, v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105, v6.12.106, v6.12.107, v6.12.108, v6.12.109
https://bugs.launchpad.net/bugs/2169770
Note also that the 'stable-next' branch head contains this and all
prior pending upstream stable releases. I recommend fetching and
applying just this reference ('stable-next') instead of each
tags/noble-stable-* reference:
git://git.launchpad.net/~ubuntu-kernel-stable/+git/noble stable-next
-Manuel
------------------------------------------------------------------------
The following changes since commit 64bf0047bf6125c420130dd68351ea321780348c:
UBUNTU: Upstream stable to v6.6.148, v6.12.101 (2026-10-03 16:56:34 +0200)
are available in the Git repository at:
git://git.launchpad.net/~ubuntu-kernel-stable/+git/noble tags/noble-stable-2026-10-05
for you to fetch changes up to 6e39869ac8c0e35fc02572c766638d54501be17a:
UBUNTU: Upstream stable to v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153, v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105, v6.12.106, v6.12.107, v6.12.108, v6.12.109 (2026-10-07 15:44:45 +0000)
----------------------------------------------------------------
Aaron Ma (1):
ice: wait for reset completion in ice_resume()
Abdun Nihaal (5):
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
mfd: sm501: Fix potential memory leaks during remove
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
Abdurrahman Hussain (1):
of: fix out-of-bounds read in of_alias_scan() stem parser
Aboorva Devarajan (1):
powerpc/hv-gpci: fix preempt count leak in sysfs show paths
Aditya Chillara (1):
perf/core: Fix group leader use-after-free after sibling detach
Adrian Hunter (1):
i3c: master: Fix info leak and UAF in device unregister path
Ahmad Byagowi (1):
ptp: ocp: Fix board ID over-read
Ahmad Fatoum (1):
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
Ajrat Makhmutov (1):
ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
Al Viro (1):
mount: honour SB_NOUSER in the new mount API
Aldo Ariel Panzardo (1):
net/sched: serialize qdisc_rtab_list against concurrent get/put
Aleksandr Khromov (1):
slip: fix use-after-free in sl_sync()
Aleksandr Nogikh (2):
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
usb: usbtest: disable dynamic ID support
Alexander Kaplan (1):
drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
Alexander Usyskin (1):
mei: pull kvfree out of spinlock
Alexandra Winter (1):
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
Alexey Velichayshiy (1):
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
Ali Ahmet Memis (4):
openrisc: signal: do not restore privileged SR bits on sigreturn
Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
Alison Schofield (1):
cxl/pmem: Format the nvdimm serial number as unsigned decimal
Amir Goldstein (1):
fs: don't block write during exec on pre-content watched files
Anand Jain (1):
btrfs: rename err to ret in btrfs_recover_relocation()
Anandu Krishnan E (1):
misc: fastrpc: fix channel ctx ref leak when session alloc fails
Andrei Fed (1):
HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
Andrei Kuchynski (2):
usb: typec: ucsi: Fix race condition and ordering in port unregistration
usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
Andy Shevchenko (1):
libceph: Amend checking to fix `make W=1` build breakage
Anirudh Prasad (1):
ACPI: pfr_update: fix stack buffer overflow in query_capability()
Anna Schumaker (1):
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Antheas Kapenekakis (1):
HID: asus: simplify RGB init sequence
Anton Danilov (1):
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
Anup Vishwakarma (1):
mailbox: qcom-ipcc: fix duplicate channel allocation across holes
Ard Biesheuvel (1):
efivarfs: Rate limit statfs() handler
Asad Kamal (2):
drm/amdgpu: fix aperture iounmap skipped on device removal
drm/amd/pm: Use same metric table for APU
Asbjørn Sloth Tønnesen (3):
net: sched: cls_api: add skip_sw counter
net: sched: cls_api: add filter counter
net: sched: make skip_sw actually skip software
Ashish Kalra (2):
crypto: ccp - Add new SEV/SNP platform shutdown API
KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
Asim Viladi Oglu Manizada (3):
sctp: prevent peer transport count overflow
xfrm: ah6: validate routing header segments_left
net: tun: bound receive headroom
Aswin Karuvally (1):
s390/qeth: Check CAP_NET_ADMIN for private ioctls
Avi Weiss (4):
can: ctucanfd: use self-test mode for PRESUME_ACK
can: ctucanfd: unmap BAR0 using base address
can: ctucanfd: handle bus error interrupts
can: ctucanfd: mark error-active controller status valid
Babanpreet Singh (1):
counter: microchip-tcb-capture: Fix DT channel validation
Baokun Li (3):
ext4: make some fast commit functions reuse extents path
fuse: fix invalidate lock leak on setattr writeback failure
fuse: fix invalidate lock leak on open O_TRUNC DAX failure
Bartosz Golaszewski (2):
crypto: qce - Remove unsafe/deprecated algorithms
powerpc/powermac: fix OF node refcount
Baul Lee (14):
ALSA: ump: fix double free of out_cvts on rawmidi error
ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
ALSA: usb-audio: fix OOB write on Type II inbound URBs
net: bridge: mrp: fix uninitialised bytes on the wire
ALSA: usx2y: bound the hwdep mmap fault offset
vxlan: do not arm the ageing timer on a device that is down
sctp: keep chunk->transport in step with the list it is queued on
net/x25: fix use-after-free of the socket by its timers
HID: core: fix OOB read of field->usage in hid_set_field()
HID: pidff: fix OOB write when hid->inputs is empty
ALSA: usb-audio: fix stack info leak in RME Digiface status
ALSA: 6fire: bound the MIDI event length from the device
ALSA: bcd2000: clear the URB pointers on disconnect
Benjamin Berg (2):
um: Set parent death signal for winch thread/process
um: Set parent death signal for userspace process
Benjamin Block (1):
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
Benjamin Boortz (2):
pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
pinctrl: bm1880: add missing select GENERIC_PINCONF
Benjamin Tissoires (1):
HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
Borislav Petkov (AMD) (1):
x86/bugs: Make Safe-RET robust against interrupt injection
Bradley Morgan (2):
signal: avoid shared siginfo namespace rewrites
taskstats: fix cpumask parsing cutting off the last character
Breno Leitao (6):
vxlan: Do not alloc tstats manually
x86/mce: Set up the polling timer before CMCI discovery
mm/kmemleak: avoid soft lockup when scanning task stacks
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
net: fix spurious TX timeout after dev_activate()
Brian Masney (1):
crypto: qcom-rng - rename *_of_data to *_match_data
Bryam Vargas (21):
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
selinux: require every boolean value to be defined
selinux: reject a class permission count below its inherited common
selinux: do not cancel a policy conversion that never started
selinux: reject an unclaimed class value in security_get_classes()
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
nfc: fdp: bound the device-reported read length and fix an skb leak
nvmet-auth: zero the AUTH_RECEIVE response buffer
nfc: nci: add data_len bound checks to activation parameter extractors
selinux: reject a permission value exceeding the class permission count
selinux: require a class's permission values to cover its permission count
misc: nsm: bound the device-reported response length
dm array: validate array block headers on read
dm array: reject an array block whose value size is not the caller's
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
ocfs2: bound namelen in dlm_migrate_request_handler
ocfs2: validate lengths in dlm_mig_lockres_handler
power: supply: cros_usbpd-charger: bound the EC-reported port count
platform/chrome: sensorhub: Bound the EC-reported sensor number
net/smc: do not dereference an unset send buffer on the SMC-D teardown path
net/smc: unregister the connection before draining the rx tasklet
Candice Li (3):
drm/amdgpu: restore UMD profile pstate after runtime resume
drm/amdgpu: validate GEM_CREATE domain combinations
drm/amdgpu: reject oversized IBs with per-ring packet limits
Cen Zhang (1):
usb: gadget: f_tcm: synchronize delayed set_alt with teardown
Cen Zhang (Microsoft) (2):
rhashtable: clear stale iter->p on table restart
net/openvswitch: check Ethernet header length in key_extract()
Chao Shi (1):
block: stop the timeout timer when releasing a never added disk
Chao Yu (4):
f2fs: fix UAF issue in f2fs_merge_page_bio()
f2fs: convert f2fs_compress_ctx_add_page() to use folio
f2fs: convert f2fs_handle_page_eio() to use folio
f2fs: fix potential deadloop in prepare_compress_overwrite()
Charles Vosburgh (1):
sctp: validate Adaptation Indication parameter length
ChenXiaoSong (2):
smb/server: rename include guard in smb_common.h
smb/server: fix minimum SMB2 PDU size
Cheng Ming Lin (1):
mtd: ubi: skip programming unused bits in ubi headers
Chengfeng Ye (9):
netfilter: ebt_nflog: pin the NFLOG backend
ipv4: fix use-after-free in fib_nhc_update_mtu()
bpf, sockmap: Fix sk_redir use-after-free in send verdict
net: pktgen: fix proc entry use-after-free
Bluetooth: hci_sync: Fix advertising data UAFs
Bluetooth: hci_event: fix LE list UAF on reset
Bluetooth: hci_sync: Fix accept list UAF during suspend
Bluetooth: RFCOMM: serialize security confirmation handling
vsock/virtio: flush works in dependency order
Chenguang Zhao (4):
forcedeth: fix UAF of txrx_stats in nv_remove
net: sxgbe: free TX rings on RX allocation failure
net: sxgbe: check descriptor ring allocation failures
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
Chris Gellermann (2):
selftests/mm: fix potential wild pointer access of getline due to missing init
selftests/clone3: fix wild pointer access of getline due to missing init
Chris Mason (15):
nfsd: release path refs on follow_down() error
nfsd: size fh_verify server sockaddr slot by xpt_locallen
nfsd: fix cpntf publish race in nfs4_init_cp_state
nfsd: gate nfs3 setacl by argp->mask
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
SUNRPC: svcauth_gss: enforce krb5 token minimum length
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
SUNRPC: harden gss_unwrap_resp_priv length checks
sunrpc: init gssp_lock before publishing proc entry
SUNRPC: reject duplicate CREDS_VALUE options
svcrdma: Fix offset arithmetic in read_chunk_range
svcrdma: Fix pcl_for_each_segment for empty chunks
svcrdma: Fix unmatched rn_unregister on failed accept
Christian Borntraeger (1):
KVM: s390: vsie: zero stale crypto bits
Christian Brauner (12):
binfmt_misc: reject a flag character as the field delimiter
ovl: don't warn when the mount is completed from another user namespace
super: fix emergency thaw deadlock on frozen block devices
binfmt_misc: restore write access when removing an entry
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
binfmt_misc: don't let an 'F' entry pin its own instance
binfmt_misc: don't warn when the mount is completed from another user namespace
super: remove pointless s_root checks
super: skip dying superblocks early
binfmt_misc: don't leak the user namespace when the mount fails
super: use a common iterator (Part 1)
super: use common iterator (Part 2)
Christian Göttsche (5):
selinux: use known type instead of void pointer
selinux: avoid unnecessary indirection in struct level_datum
selinux: make more use of str_read() when loading the policy
selinux: use u16 for security classes
selinux: more strict policy parsing
Christian Marangi (1):
net: phylink: put link_gpio if phylink_create fails
Christoph Hellwig (2):
xfs: check v5 superblock features early
xfs: don't use a xfs_log_iovec for ri_buf in log recovery
Christoph Zwerschke (2):
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
Christophe JAILLET (1):
dm: Constify struct dm_block_validator
Christophe Leroy (1):
mm: provide mm_struct and address to huge_ptep_get()
Christopher Kodama (1):
HID: magicmouse: re-enable multitouch after reset-resume
Christopher Tolang (1):
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
Chuck Lever (13):
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
NFSD: check truncate permission under inode lock
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
NFSD: Fix off-by-one in DRC bucket pruning limit
nfsd: Reset write verifier when async COPY writeback fails
nfsd: sample writeback error cursor before async COPY loop
nfsd: gate nfs2 setacl by argp->mask
NFSD: Prevent lock owner use-after-free during client teardown
SUNRPC: Check svc pool percpu counter allocation
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
svcrdma: Reject connection when transport allocation fails
svcrdma: Reject inline replies that overflow the pull-up buffer
svcrdma: Validate Read chunk positions before reconstruction
Chunkai Deng (1):
rpmsg: glink: smem: order FIFO read after availability check
Chunyan Zhang (1):
mm: userfaultfd: add pgtable_supports_uffd_wp()
Claudiu Beznea (1):
pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
Coly Li (1):
md: do overflow check for sb->bblog_shift in super_1_load()
Cong Nguyen (2):
hwmon: (max6621) fix negative temperature offset and crit readings
hwmon: (max6621) fix temperature clamp range
Cristian Ciocaltea (2):
ASoC: nau8821: Cancel delayed work on component remove
ASoC: nau8821: Cancel pending work before suspend
Cryolitia PukNgae (1):
Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
Cunhao Lu (1):
serial: 8250_dma: Clear stale RX state on shutdown
DaeMyung Kang (1):
ksmbd: harden file lifetime during session teardown
Daisuke Matsuda (1):
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
Damien Le Moal (3):
ahci: Introduce ahci_ignore_port() helper
ata: libahci_platform: Do not set mask_port_map when not needed
ata: libata-scsi: terminate deferred commands on time out
Daming Li (1):
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
Daniel Borkmann (1):
bpf: Disable preemption in __bpf_get_stack
Daniel Golle (3):
net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
net: ethernet: mtk_eth_soc: improve support for named interrupts
Daniel Hodges (1):
wifi: ath6kl: fix use-after-free in aggr_reset_state()
Darrick J. Wong (7):
xfs: only check mergeability of bnobt records
xfs: remove file_path tracepoint data
fs: unlock the superblock during iterate_supers_type
xfs: namespace the maximum length/refcount symbols
xfs: check AGI unlinked inode buckets
xfs: hoist per-bucket unlinked list check to helper
xfs: don't livelock in scrub on a circular unlinked list
Dave Airlie (1):
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
David Carlier (1):
igc: remove napi_synchronize() in igc_down()
David Corvaglia (1):
net: bridge: mrp: fix Option TLV length in MRP_Test frames
David Francis (1):
drm/amdkfd: Handle invalid event type in CRIU event restore
David Gow (1):
kunit: tool: Terminate kernel under test on SIGINT
David Howells (5):
rxrpc: Fix irq-disabled in local_bh_enable()
rxrpc: Generate rtt_min
rxrpc: Adjust the rxrpc_rtt_rx tracepoint
rxrpc: Fix the calculation and use of RTO
rxrpc: Manage RTT per-call rather than per-peer
David Lechner (2):
regulator: devres: add API for reference voltage supplies
regulator: devres: fix devm_regulator_get_enable_read_voltage() return
David Lee (2):
netfilter: ipset: do not update comments from kernel-side hash adds
udf: reject VAT indexes equal to the entry count
David Rosca (6):
drm/amdgpu: Reject UVD message with invalid number of h265 refs
drm/amdgpu: Reject UVD message with dimensions above 4096
drm/amdgpu: Implement insert_end for VCE 3
drm/amdgpu: Fix UVD min buffer sizes
drm/amdgpu: Fix UVD dpb min size calculation for H264
drm/amdgpu: Fix UVD decode image min size calculation
David Sterba (1):
btrfs: add debug build only WARN
Dawei Feng (3):
smb: client: fix buffer leaks in SMB1 read and write
e1000: fix memory leak in e1000_probe()
ice: fix memory leak in ice_lbtest_prepare_rings()
Dawid Osuchowski (1):
ice: fix VF interrupts cleanup
Dawid Wróbel (2):
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
Deepanshu Kartikey (2):
tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
eventfs: Initialize ei->children and ei->list in init_ei()
Denis V. Lunev (1):
qede: sync udp_tunnel ports outside qede_lock in the recovery path
Dev Jain (1):
mm/rmap: use huge_ptep_get() in try_to_unmap_one()
Devin Wittmayer (1):
wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
Diogo Ivo (1):
usb: typec: ucsi: Only enable supported notifications
Dmitry Antipov (2):
btrfs: fix memory leak in btrfs_do_encoded_write()
ocfs2: always run deallocs on copy-on-write completion
Dmitry Torokhov (8):
Input: evdev - sanitize event type index when fetching event masks
Input: evdev - fix information leak in evdev_pass_values()
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
Input: synaptics-rmi4 - zero report size on F54 work error
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Input: sur40 - fix input device registration ordering
Input: sur40 - fix V4L error path cleanup
Dongli Zhang (1):
net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
Donglin Lyu (1):
Input: atkbd - skip deactivate for HONOR ZQC-P
Doruk Tan Ozturk (7):
net/packet: reset the MAC header on the packet-socket transmit path
nfc: digital: clamp SENSF_RES length to the destination buffer
nfc: llcp: bound the connect_sn TLV walk to the skb
nfc: llcp: reject PDUs shorter than the LLCP header
nfc: st21nfca: validate ATR_REQ length against the received frame
net: usb: ipheth: fix carrier_work UAF on disconnect
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
Dylan Wolff (1):
jfs: Fix null-ptr-deref in jfs_ioc_trim
Eddie Lin (1):
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
Ekansh Gupta (1):
misc: fastrpc: Remove buffer from list prior to unmap operation
Eric Biggers (9):
ext4: don't enable DAX on new encrypted files
mm/swap: reject swapon() on filesystem-level encrypted files
fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
fsverity: Fix silent truncation in bpf_get_fsverity_digest()
crypto: qcom-rng - Enable clock in hwrng case
crypto: qcom-rng - Allow zero as a random number
crypto: qcom-rng - Remove crypto_rng interface
crypto: sun8i-ss - Remove crypto_rng interface
crypto: sun8i-ce - Remove crypto_rng interface
Eric Dumazet (21):
net: do not send ICMP/NDISC Redirects when peer allocation fails
vxlan: re-fetch eth header after route_shortcircuit()
vxlan: unclone skb head before modifying eth header in route_shortcircuit()
vxlan: use neigh_ha_snapshot() in route_shortcircuit()
vxlan: use pskb_network_may_pull() in route_shortcircuit()
net: remove WARN_ON_ONCE() from sk_mc_loop()
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
vxlan: use pskb_network_may_pull() for transmit path header pulls
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
af_packet: Don't send zero-byte data in tpacket_snd().
inet: frags: add inet_frag_putn() helper
ipv4: frags: remove ipq_put()
inet: frags: change inet_frag_kill() to defer refcount updates
inet: frags: save a pair of atomic operations in reassembly
ndisc: ndisc_send_redirect() cleanup
net: gro: properly validate BIG TCP aggregation criteria
net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
net: dst: add four helpers to annotate data-races around dst->dev
ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
ipv4: start using dst_dev_rcu()
Eric Farman (10):
s390/vfio_ccw: Limit the number of channel program segments
s390/vfio_ccw: Cancel existing workqueues
s390/vfio_ccw: Ensure index for read/write regions are within range
s390/vfio_ccw: Fix out of bounds check on CCW array
s390/vfio_ccw: Move cp cleanup out of not operational
s390/vfio_ccw: Selectively expand io_mutex
s390/vfio_ccw: Free all memory if cp_init() fails
s390/vfio_ccw: Ensure first IDAW remains constant
s390/vfio_ccw: Calculate idal length based on idaw type
s390/vfio_ccw: Implement a crw lock
Erni Sri Satya Vennela (1):
net: mana: Fix EQ leak in mana_remove on NULL port
Ethan Nelson-Moore (1):
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
Ewan D. Milne (1):
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
Fabio Estevam (2):
arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
Fabio Porcedda (1):
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
Fan Wu (13):
wifi: brcmfmac: drain bus_reset work on device removal
serial: amba-pl011: synchronize DMA teardown
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
RDMA/cxgb4: Cancel reg_work before freeing device on remove
power: supply: bq24257: fix use-after-free on remove
power: supply: bq256xx: drain usb_work before freeing the charger
power: supply: charger-manager: register regulators before exposing sysfs
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
power: supply: lp8788-charger: fix use-after-free on remove
power: supply: rt9455: quiesce delayed work before teardown
power: supply: ucs1002: fix use-after-free on remove
mmc: via-sdmmc: stop card-detect handling on probe failure
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
Fan XinRan (1):
net: thunderbolt: Tear down DMA paths before stopping the rings
Fan Ye (3):
Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
net: thunderbolt: Release the Rx HopID that was handed out on mismatch
net: thunderbolt: Mark the connection down when bringing it up fails
Farhan Ali (7):
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
KVM: s390: pci: Fix missing error codes and memory unaccounting
KVM: s390: pci: Fix resource leak on IRQ registration failure
PCI/MSI: Enable memory decoding before restoring MSI-X messages
Felix Yan (1):
clocksource/drivers/timer-sun4i: Advertise a real minimum delta
Filipe Manana (1):
btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
Florian Fuchs (1):
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
Florian Westphal (2):
netfilter: ipset: fix list type element drift bug
netfilter: ipset: let destroy callbacks adjust ext mem size
Fourie Zhang (1):
netfilter: nf_tables: don't queue packet path object notifications
Francesco Lavra (1):
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
Francois Dugast (1):
drm/xe/sched_job: Promote xe_sched_job_add_deps()
Frank Sorenson (2):
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
smb: client: fix ALIGN() overflow in symlink_data() error context loop
Frank Wunderlich (3):
net: ethernet: mtk_eth_soc: support named IRQs
net: ethernet: mtk_eth_soc: add consts for irq index
net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name
Fredric Cover (2):
smb: client: clear ce->tgthint in free_tgts()
smb: client: harden DFS cache against invalid target hints
Gang Ba (1):
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
Gang Yan (1):
selftests: mptcp: join: mark tests with data corruption as failed
Gao Shiyuan (1):
iommu/amd: remove return value of amd_iommu_detect
Gao Xiang (1):
erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
Gaurav Batra (1):
powerpc/pseries/iommu: switch to Default DMA window during kdump
Geliang Tang (4):
mptcp: pm: avoid code duplication to lookup endp
mptcp: add mptcp_userspace_pm_lookup_addr helper
mptcp: pm: use addr entry for get_local_id
mptcp: pm: userspace: fix use-after-free in get_local_id
Geoffrey D. Bennett (1):
ALSA: scarlett2: Use a private URB for the notification endpoint
George Wilson (2):
powerpc/pseries: pci - logic bug
powerpc/pseries: lparcfg - fix kbuf[] underflow
Gokul Sivakumar (1):
wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
Gongwei Li (1):
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
Greg Kroah-Hartman (3):
Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
Gregory Price (1):
mm/vmstat: fold stranded per-cpu node stats when a node comes online
Griffin Kroah-Hartman (4):
rndis_host: add overflow check in rndis_rx_fixup()
fpga: dfl: fme: add error handling
usb: core: Add lock to usb_wakeup_notification()
usb: core: Strengthen error handling in hub_hub_status()
Guanghui Yang (4):
btrfs: zoned: fix missing chunk metadata reservation
ext4: clear error before retrying inode xattr space fallback
ext4: propagate errors from fast commit range replay
btrfs: drop recovered reloc root refs on recovery failure
Guangshuo Li (6):
scsi: ufs: core: Cancel RTC work in active-active suspend
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
drm/radeon: fix autosuspend cleanup during teardown
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
Guenter Roeck (10):
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
hwmon: (lm90) Only report alarms if driver is ready
hwmon: (nzxt-smart2) DMA-align output buffer
hwmon: (nct6775-core) Prevent access to unsupported weight registers
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
hwmon: (ina2xx) Add support for has_alerts configuration flag
hwmon: (ina2xx) Add support for INA260
hwmon: (ina2xx) Fix various overflow issues
hwmon: (sht3x) Fix unaligned accesses
Guidong Han (1):
eventpoll: pin files while checking reverse paths
Guillaume Nault (2):
vrf: Make pcpu_dstats update functions available to other modules.
vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.
Guopeng Zhang (1):
mm: memcg: stop reclaim when a limit update is superseded
H. Nikolaus Schaller (1):
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
Haibo Chen (1):
mmc: sdhci: make tuning_err a signed int
Haidar Lee (2):
ASoC: tas2562: fix DVC coefficient write order
ASoC: tas2562: fix broken entries in the volume lookup table
HanQuan (1):
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
Hang Nan (1):
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
Hans Verkuil (1):
Revert "media: v4l2-dev: fix error handling in __video_register_device()"
Hao Jia (1):
mm/zswap: fix global shrinker when memory cgroup is disabled
Hao-Qun Huang (3):
staging: greybus: hid: fix SET_REPORT return value
staging: media: tegra-video: fix of_node_put() on VIP parse errors
staging: media: tegra-video: vi: fix probe failure on skipped last port
Haotian Zhang (1):
dm-switch: use WRITE_ONCE() in switch_region_table_write()
Haoxiang Li (3):
HID: sensor: custom: Fix use-after-free in enable_sensor
accessibility: speakup: unregister tty ldisc on later init failures
HID: sensor: custom: Fix field sysfs group cleanup on failure
Harald Freudenberger (2):
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
Harkirat Gill (1):
drm/amdgpu: cap GTT size to physical RAM on APUs
Harshal Dev (1):
dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
Harshit Varu (1):
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
Helge Deller (1):
sticon/parisc: Detect default STI graphics card for console output
Henry Martin (1):
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
Herbert Xu (1):
crypto: ccm - Set rfc4309 maxauthsize from child
Hidayath Khan (3):
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
net/smc: fix socket refcount leak in smc_switch_conns()
net/smc: fix use-after-free in smc_rx_pipe_buf_release()
Holger Dengler (2):
s390/zcrypt: Validate length for CCA AES cipher key requests
s390/zcrypt: Validate length for CCA ECC private key requests
Hongling Zeng (2):
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
xfs: validate attr entry pointer before field access
Hongyan Xu (3):
hwmon: (npcm750-pwm-fan): stop fan timer on device detach
ata: pata_sl82c105: fix bridge revision use-after-free
auxdisplay: charlcd: cancel backlight work on registration failure
Huang Wei (1):
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
Hugo Villeneuve (2):
serial: sc16is7xx: rename EFR mutex with generic name
serial: sc16is7xx: use guards for simple mutex locks
Hui Su (6):
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
tracing: Fix crash passing ERR_PTR to kthread_stop()
tracing: Fix use-after-free with same-name named triggers
fbdev: ssd1307fb: defer I2C transfers from damage callbacks
cpufreq: schedutil: Fix rate limit overflow
kasan: fix cache shrink race with CPU hotplug
HyeongJun An (9):
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
HID: logitech-dj: Fix maxfield check in DJ short report validation
Bluetooth: eir: Fix OOB read in eir_get_service_data()
ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
power: supply: qcom_battmgr: terminate the strings from firmware
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
platform/x86: ISST: Validate level in perf mask ioctls
platform/x86: ISST: Validate socket ID in clos_assoc ioctl
Hyunjung Ko (2):
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
net/sched: act_gact, act_police: range check the fallback control action
Hyunwoo Kim (4):
net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
apparmor: fix out-of-bounds write when null terminating a label vec
sctp: stop processing a packet once its association is deleted
sctp: drop a chunk if its transport was removed
Ian Bridges (1):
ocfs2: fix missing metadata reservation for large xattrs
Ian Ray (2):
hwmon: (ina2xx) Make it easier to add more devices
hwmon: (ina2xx) Add support for INA234
Ibrahim Abdelkader (1):
Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
Ibrahim Hashimov (9):
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
xfs: bounds-check buffer log item's dirty bitmap
HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
nvmet-tcp: bound SGL data length before allocating command buffers
HID: uclogic: fix use-after-free of inrange_timer on remove
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
ubifs: fix out-of-bounds read in signature length check
HID: picolcd: clamp eeprom debugfs read to bytes actually received
ocfs2: validate rl_used against rl_count in refcount block validator
Ilia Gavrilov (1):
rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
Ilpo Järvinen (2):
tcp: Pass flags to __tcp_send_ack
tcp: fast path functions later
Ilya Krutskih (1):
dm raid1: reserve space for NUL-terminator in build_constructor_string()
Ilya Maximets (4):
net: openvswitch: fix potential UAF on meter attach failure
net: openvswitch: fix skb leak on flow key update failure during recirculation
net: openvswitch: fix skb leak on flow key update failure during ct
net: openvswitch: fix flow mask use-after-free on flow deletion
Ivaylo Dimitrov (1):
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
Jackson Lee (1):
media: chips-media: wave5: Support CBP profile
Jai Luthra (1):
media: i2c: imx219: Rename VTS to FRM_LENGTH
Jamal Hadi Salim (4):
net/sched: cls_route: fix fastmap use-after-free on filter
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
net/sched: cls_bpf: reject dev-bound programs bound to a different device
James Chapman (1):
l2tp: improve tunnel/session refcount helpers
James Gao (1):
can: peak_usb: add bounds check for USB channel index
James Kim (1):
rapidio: mport_cdev: fix use-after-free in dma_req_free()
Jameson Thies (1):
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
Jan Höppner (1):
s390/dasd: Fix potential NULL pointer dereference
Jan Sebastian Götte (1):
serial: qcom-geni: fix TX DMA buffer flush
Jani Nikula (4):
drm/i915/vrr: require valid min/max vfreq for VRR
drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind
drm/i915/hdcp: require monotonically increasing seq_num_v
drm/i915/hdcp: check streams[] bounds before overflow
Jann Horn (4):
HID: core: fix number/pointer type confusion on long items
HID: asus: fix missing hid_is_usb() check
apparmor: fix cred UAF caused by begin_current_label_crit_section()
smack: fix cred UAF in smack_file_send_sigiotask()
Jeff Layton (20):
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
nfsd: validate symlink target length in NFSv4 CREATE
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
nfsd: add filehandle match check to nfsd4_delegreturn()
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
nfsd: check client ownership when cancelling a copy-notify stateid
nfsd: clear opcnt on compound arg release to prevent OOB read
nfsd: defer vfree of compound ops to fix rpc_status UAF
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
nfsd: fix nfsd_file leak on inter-server COPY setup failure
nfsd: fix version mismatch loops in nfsd_acl_init_request()
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
nfsd: initialize copy-notify stateid before publishing it
nfsd: initialize DRC hash table before registering shrinker
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
nfsd: revoke copy-notify stateids before dropping their reference
SUNRPC: always drain cache_cleaner before destroying a cache_detail
sunrpc: route to a populated pool in svc_pool_for_cpu()
Jeffin Philip (1):
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
Jeremy Kerr (1):
net: core,vrf: Change pcpu_dstat fields to u64_stats_t
Jiacheng Yu (1):
params: fix charp corruption on allocation failure
Jiale Yao (2):
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
USB: serial: option: fix slab OOB read in interrupt URB callback
Jianbo Liu (1):
net: sched: cls_api: fix slab-use-after-free in fl_dump_key
Jiang HongHui (1):
nvmet-fc: fix invalid free in LS IOD error path
Jiangshan Yi (5):
HID: nintendo: stop device IO before hid_hw_stop on probe failure
HID: nintendo: register input device after capabilities are set
HID: mcp2221: stop device IO before hid_hw_stop
HID: mcp2221: validate report size in mcp2221_raw_event()
bnx2x: fix double free in bnx2x_init_firmware() error path
Jianing Li (5):
Input: hynitron_cstxxx - validate touch count and finger IDs
power: supply: max17040: handle missing status supplier
power: supply: max17040: propagate register read errors
power: supply: max17040: drop incorrect I2C functionality check
power: supply: max17040: synchronize work cancellation on suspend
Jiawen Liu (1):
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
Jiayuan Chen (4):
tcp: fix TFO max_qlen accounting across reuseport migration
bpf: Fix use-after-free in offloaded map/prog info fill
tls: device: fix out-of-bounds write in tls_append_frag()
tcp: fix icsk_ack.ato bitfield overflow
Jijie Shao (1):
net: hns3: fix speed configuration residue after driver reload
Jinu Kim (1):
KVM: x86/mmu: Check write tracking in all address spaces
Jiri Slaby (SUSE) (1):
drm/amd/display: use proper context for logging
Johan Hovold (3):
USB: serial: spcp8x5: drop broken carrier detect support
USB: phy: fsl-usb: fix missing static keywords
remoteproc: scp: Fix device reference leak on failed lookup
Johannes Thumshirn (1):
btrfs: zoned: fix deadlock between metadata writeback and transaction commit
Johannes Weiner (1):
mm: mempolicy: fix automatic numa balancing for shmem
Jon Hunter (1):
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
Jonas Gorski (1):
i2c: iproc: reset bus after timeout if START_BUSY is stuck
Jonas Rebmann (1):
hwmon: (ina2xx) Shift INA234 shunt and current registers
Jordan R Abrahams-Whitehead (1):
include/linux/list.h: mark list_add and __list_add as __always_inline
Jordan Rife (5):
bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
bpf: tcp: Get rid of st_bucket_done
bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
bpf: tcp: Avoid socket skips and repeats during iteration
Jorijn van der Graaf (1):
net: ipa: fix stalled modem TX queue after runtime resume
Jose Fernandez (Anthropic) (1):
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Jose Maria Casanova Crespo (1):
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
Jose Villaseñor Montfort (2):
HID: magicmouse: do not keep a stale msc->input if no input is claimed
HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
Joseph Qi (3):
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
Josh Poimboeuf (1):
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
Joshua Crofts (1):
usb: gadget: midi2: remove default configfs groups on teardown
Joshua Rogers (2):
vt: add permission check for KDSKBMETA ioctl
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
Josua Mayer (1):
ata: libahci_platform: support non-consecutive port numbers
Joy H.J. Lee (1):
tools/compiler: match glibc 2.42 definition of __attribute_const__
Jozsef Kadlecsik (1):
netfilter: ipset: switch ext_size to atomic64_t
Julian Anastasov (7):
ipvs: fix the checksum validations
ipvs: fix places with wrong packet offsets
ipvs: do not mangle ICMP replies for non-first fragments
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
ipvs: return the csum validation for forward hook
ipvs: add totalconns for dest
ipvs: properly update the overload flag on dest edit
Jun Guo (2):
spi: spi-cadence: supports transmission with bits_per_word of 16 and 32
spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
Jun Yang (4):
vhost: reset the vring metadata cache on vring reconfiguration
tipc: read le->link under the node lock in tipc_node_link_down()
sctp: distinguish sequence zero from wildcard in reconf lookup
sctp: fix stream->outcnt underflow on duplicate RECONF responses
Junjie Cao (2):
gpio: pch: use raw_spinlock_t for the register lock
gpio: ml-ioh: use raw_spinlock_t for the register lock
Junrui Luo (4):
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
drm/amdgpu: disallow multiple FENCE chunks in one submit
media: vicodec: fix out-of-bounds write in FWHT encoder
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
Jérémy Jean (8):
netfilter: flowtable: publish GC-visible tuple last
timers/itimer: Zero-init old itimerval before copy to userspace
tracing/user_events: Clear copied tracing state before fork duplication
libceph: reject buckets with mismatched CRUSH ids
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
audit: avoid dropping live tree ref on fsnotify rule autoremove
bpf: Harden bloom filter sizing and indexing on 32-bit kernels
SUNRPC: wait for in-flight client TLS handshake callback
Kai Vehmanen (1):
ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
Kalle Valo (1):
wifi: rtl8xxxu: remove rtl8xxxu_ prefix from filenames
Karl Mehltretter (3):
pinctrl: devicetree: don't free uninitialized dev_name on error path
serial: imx: serialize imx_uart_ports[] lifetime
arm64: compat: Fix decrementing LDM/STM alignment emulation
Kathiravan Thirumoorthy (1):
regulator: qcom-refgen: correct the regulator type to CURRENT
Keegan Freyhof (1):
bnxt_en: Fix PTP PPS setting bug
Kefeng Wang (1):
mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
Kefu Chai (1):
libceph: tolerate addrvecs with multiple entries of the same type
Keith Busch (2):
blk-mq: pop cached request if it is usable
blk-mq: reinsert cached request to the list
Keno Fischer (1):
futex: Prevent robust futex exit race some more
Kevin Tian (2):
iommu/vt-d: Fix no_iommu to disable platform opt-in
iommu/vt-d: Force requesting ACS when tboot is enabled
Kiryl Shutsemau (Meta) (7):
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
x86/tdx: Fix off-by-one in port I/O handling
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
x86/tdx: Fix zero-extension for 32-bit port I/O
Koichiro Den (6):
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
NTB: ntb_transport: Recycle TX entries before client callbacks
NTB: ntb_transport: Fail TX enqueue when the QP link is down
NTB: ntb_transport: Reject oversized TX buffers
net: ntb_netdev: Avoid double-accounting netif_rx() drops
net: ntb_netdev: Count packets dropped on RX refill failure
Konrad Dybcio (1):
pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
Konstantin Komarov (1):
fs/ntfs3: bound page_lcns[] index by the log record
Krzysztof Wilczyński (5):
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
PCI/proc: Use file_ns_capable() when checking config space read access
PCI/proc: Warn on writes to kernel-exclusive config space regions
Kuan-Wei Chiu (2):
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
Kuninori Morimoto (1):
ASoC: sof: pcm: use snd_pcm_direction_name()
Kuniyuki Iwashima (4):
smc: Fix use-after-free in __pnet_find_base_ndev().
smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
Kyle Zeng (5):
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
ipv6: seg6: clear IPv4 control block on IPIP decapsulation
batman-adv: reject unrepresentable multicast TVLV offsets
vxlan: keep the last remote linked during FDB flush
Kyohei Kadota (1):
Input: xpad - add support for ZENAIM LEVERLESS
Lance Yang (1):
mm/khugepaged: guard is_zero_pfn() calls with pte_present()
Larisa Grigore (1):
spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
Laxman Acharya Padhya (1):
Bluetooth: hci_event: validate LE Set CIG Parameters response
Lech Perczak (2):
serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants
serial: sc16is7xx: convert bitmask definitions to use BIT() macro
Lee Jones (3):
HID: logitech-dj: Standardise hid_report_enum variable nomenclature
HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
Leon Hwang (1):
ftrace: Protect direct_functions in ftrace_find_rec_direct
Leon Romanovsky (1):
scsi: target: Clear cmd_cnt when initial counter enrollment fails
LiangCheng Wang (1):
wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
Liem (2):
i2c: imx: Fix slave registration race and error handling
i2c: imx: Cancel hrtimer before clearing slave pointer
Lijo Lazar (1):
drm/amd/pm: Use macro to initialize metrics table
Lincoln Wallace (1):
ima: fix out-of-bounds read in xattr_verify()
Link Lin (1):
mm/page_reporting: use system_freezable_wq to fix UAF during suspend
Linmao Li (3):
Input: psxpad-spi - set driver data before use
nfc: nci: free destination parameters when closing a connection
Input: byd - synchronize timer deletion before freeing private data
Liyuan Pang (1):
ubi: fastmap: fix ubi->fm memory leak
Long Li (2):
xfs: fix ilock leak on error in xfs_dq_get_next_id
xfs: don't swallow dquot recovery verification errors
Longlong Xia (1):
zsmalloc: account for handle size in class lookup
Lorenzo Bianconi (1):
netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
Lorenzo Stoakes (2):
mm/pagewalk: split walk_page_range_novma() into kernel/user parts
mm: avoid unnecessary use of is_swap_pmd()
Lorenzo Stoakes (ARM) (4):
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
mm/ptdump: always stabilise against page table freeing using init_mm
mm/huge_memory: fix huge_zero_pfn race
Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
Luca Fresi (1):
serial: sc16is7xx: enable THRI before filling TX FIFO
Lucas De Marchi (3):
xhci: dbgtty: Fix unregister on tty_register_driver() failure
xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
drm/xe: Normalize bo flags macros
Lucas Martins Alves (1):
can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
Luiz Angelo Daros de Luca (8):
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
hwmon: (adt7470) Fix cache updated before hardware write on I2C error
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
hwmon: (adt7470) Use cached PWM frequency value
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
hwmon: (adt7470) Fix PWM auto temp state array and bounds check
Luxiao Xu (2):
audit: fix potential use-after-free in audit_del_rule()
ipv6: fix use-after-free in ip6_finish_output2()
Ma Ke (2):
power: supply: bq25890: Fix power_supply reference leak
platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
Mahanta Jambigi (1):
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
Maoyi Xie (4):
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
power: supply: twl4030_charger: cancel workers via devm
i3c: master: svc: bound IBI payload to the requested max_payload_len
w1: ds28e17: reject an oversize length on an I2C block read
Marc Kleine-Budde (1):
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
Marek Czernohous (1):
forcedeth: fix off-by-one when saving/restoring non-PCI config space
Mariano Baragiola (1):
staging: rtl8723bs: validate monitor transmit frame lengths
Mario Limonciello (2):
pinctrl-amd: Don't clear S4 wake bits at probe
drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
Mark Brown (1):
ASoC: tas2562: Validate values for volume writes
Marouane El Moufid (1):
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
Martin Kaiser (1):
selftests/ftrace: refactor eprobes test to fix argument checks
Masahiro Yamada (1):
fortify: refactor test_fortify Makefile to fix some build problems
Masami Hiramatsu (Google) (4):
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
tracing: Check return value of __register_event() in trace_module_add_events()
tracing/filters: Fix false positive match in regex_match_full()
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
Mathieu Dubois-Briand (1):
nvmem: layouts: Add fixed-layout driver
Matt Fleming (1):
veth: convert frag_list skbs before running XDP
Matt Turner (4):
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
alpha: don't leak hardware-fabricated FP exception bits to user space
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
alpha: marvel: Fix lock ordering in init_io7_irqs()
Matt Vollrath (2):
ata: libata-eh: Increase STANDBY IMMEDIATE timeout
igbvf: Fix leak in TX DMA error cleanup
Matthew Brost (2):
drm/xe: Wait on external BO kernel fences in exec IOCTL
drm/xe: Order ring writes before ring tail updates
Matthew Rosato (1):
KVM: s390: pci: Fix aisb calculation
Matthew Wilcox (Oracle) (4):
ceph: Remove ceph_writepage()
ceph: Use a folio in ceph_page_mkwrite()
ceph: Convert ceph_find_incompatible() to take a folio
ceph: Convert writepage_nounlock() to write_folio_nounlock()
Matthias Goergens (1):
ext4: stop retrying saturated xattr cache entries
Matthieu Baerts (NGI0) (2):
mptcp: avoid combining some incoming suboptions
mptcp: options: reset DSS fields in case of unexpected size
Max Kellermann (5):
ceph: avoid fs reclaim while using current->journal_info
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
ceph: do not repeat ceph_trim_dentries() if no progress possible
jbd2: bound shrinker scans by examined checkpoint buffers
jbd2: check need_resched() when skipping busy checkpoint buffers
Maximilian Immanuel Brandtner (1):
tls: don't abort the connection on signal-interrupted sends
Maíra Canal (1):
drm/vc4: Zero the tile state data array before each BIN job
Md Sadre Alam (2):
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
crypto: qce - fix CCM AAD buffer underallocation
Mehmet Fide (1):
net: fec: do not release NULL pages when RX buffer allocation fails
Michael Bommarito (14):
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
keys: fix out-of-bounds read in keyring_get_key_chunk()
keys: make keyring key-chunk byte order agree with keyring_diff_objects()
assoc_array: trim the final shortcut word using the current chunk end
erofs: cap LZMA stream pool size
um: vector: fix use-after-free in vector_mmsg_rx()
HID: hyperv: validate initial device info bounds
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
libceph: validate OSD extent maps before cursor advance
ceph: bound copied dentry name length in NFS export get_name
ceph: bound num_export_targets array for mds info v2/v3
ceph: bound xattr value length in __build_xattrs()
lockd: pin next file across nlm_inspect_file lock-drop
l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
Michael Chan (3):
bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
bnxt_en: Mask the bd_cnt field in the TX BD properly
Michael Guralnik (1):
net/mlx5: fw_tracer, return NULL on create error
Michael Neuling (1):
riscv: Fix register corruption from uninitialized cregs on error
Michael Wu (1):
tracing: Fix race between update_event_fields and, event_define_fields
Michael Zaidman (1):
HID: ft260: validate i2c input report length
Michal Luczaj (3):
selftests/bpf: Fail unbound UDP on sockmap update
selftests/bpf: Adapt sockmap update error handling
selftests/bpf: Ensure UDP sockets are bound
Miguel Peñaranda (1):
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
Mike Looijmans (1):
phy-zynqmp: Postpone getting clock rate until actually needed
Mike Rapoport (Microsoft) (2):
userfaultfd: move vma_can_userfault out of line
userfaultfd: prevent registration of special VMAs
Mike Snitzer (1):
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
Mikulas Patocka (1):
dm-stats: fix a crash if allocation of per-cpu data fails
Mimi Zohar (1):
ima: Instantiate file_truncate and path_truncate hooks
Ming Lei (2):
ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
block: mark GFP_NOIO around sysfs ->store()
Mingyu Wang (1):
fbdev: core: Fix pointer desynchronization in fb_io_read()
Minhong He (1):
can: isotp: check register_netdevice_notifier() error in module init
Mohamad Raizudeen (1):
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
Muhammad Bilal (14):
accel/qaic: use sizeof(*trans_hdr) for transaction length check
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
staging: rtl8723bs: fix OOB read in WMM_param_handler()
nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
platform/x86: hp-bioscfg: advance elem past consumed array elements
platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
platform/x86: hp-bioscfg: fix heap OOB read on empty password write
platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
platform/x86: hp-bioscfg: pass validated element count to package parsers
platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
Myeonghun Pak (7):
i2c: amd-mp2: Unregister callback on adapter add failure
drm/mediatek: ovl_adaptor: balance component registrations
mmc: sdhci: unmap the bounce buffer before device release
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
fbdev: uvesafb: unregister connector callback on init failure
nvme-pci: disable controller on admin queue IRQ setup failure
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
Naman Jain (1):
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
Namjae Jeon (7):
ksmbd: return success for deferred final close
ksmbd: fix use-after-free in __close_file_table_ids()
ksmbd: rename smb2_get_msg to smb_get_msg
ksmbd: validate minimum PDU size for transform requests
ksmbd: conn lock to serialize smb2 negotiate
ksmbd: reject repeated SMB2 NEGOTIATE requests
exfat: fix double free in delayed_free
Naohiro Aota (1):
btrfs: add space_info argument to btrfs_chunk_alloc()
Nathan Chancellor (2):
fortify: Disable -Wstringop-overread in tests
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
Nathan Gao (1):
tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
Nathan Lucas (2):
drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
Nava kishore Manne (3):
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
phy: zynqmp: use read-modify-write for SERDES scrambler bypass
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
Necromancer (4):
UBUNTU: SAUCE: Revert "UBUNTU: SAUCE: usb: typec: ucsi: Fix workqueue destruction race during connector cleanup"
UBUNTU: [Config] Remove CRYPTO_DEV_SUN8I_SS_PRNG
UBUNTU: [Config] Remove CRYPTO_DEV_SUN8I_CE_PRNG
UBUNTU: Upstream stable to v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153, v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105, v6.12.106, v6.12.107, v6.12.108, v6.12.109
Neill Kapron (1):
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
Nick Child (1):
ibmvnic: Use kernel helpers for hex dumps
Nikhil P. Rao (1):
pds_core: keep the health thread stopped during reset
Niklas Cassel (3):
ata: ahci: Make ahci_ignore_port() handle empty mask_port_map
ata: libata-sata: fix ata_scsi_lpm_supported() iteration
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
Niklas Schnelle (1):
s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
Nirmoy Das (1):
ACPI: APEI: Fix ERST timeout unit conversion
Nitin Gote (1):
drm/xe: Hold a dma-buf reference for imported BOs
Nobuhiro Iwamatsu (1):
hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS()
Norbert Szetei (7):
ALSA: pcm: wake linked drain waiters on unlink
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
ALSA: seq: Fix division by zero in initialize_timer()
ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
RDMA/ucma: Lock the handler in ucma_set_ib_path()
openvswitch: only skb_tx_error() a packet we are about to drop
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
Oleksij Rempel (1):
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
Oliver Hartkopp (2):
can: use skb hash instead of private variable in headroom
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
Oliver Upton (1):
KVM: arm64: Prevent access to vCPU events before init
Or Har-Toov (1):
devlink: fix net namespace reference leak in reload
Pablo Neira Ayuso (4):
netfilter: nf_conntrack_expect: restore helper propagation via expectation
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
netfilter: nf_tables: clone set on flush only
netfilter: nf_tables: make nft_object rhltable per table
Panagiotis Petrakopoulos (1):
staging: rtl8723bs: fix missing shared-key auth challenge length check
Paolo Bonzini (1):
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
Paul Moore (4):
selinux: fix style issues in security/selinux/ss/avtab.h
selinux: fix style issues in security/selinux/ss/policydb.c
selinux: fix style issues in security/selinux/ss/policydb.h
selinux: fix style issues in security/selinux/ss/constraint.h
Pauli Virtanen (9):
Bluetooth: ISO: clear iso_data always when detaching conn from hcon
Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
Bluetooth: ISO: fix leaking sk after socket release
Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
Pavitra Jha (3):
libceph: fix multiple unsafe decodes in decode_locker()
libceph: fix two unsafe bare decodes in decode_lockers()
libceph: fix OOB read in decode_watchers() via missing bounds check
Pawel Laszczak (1):
usb: cdnsp: fix incorrect endian conversions for APB timeout register
Pei Xiao (1):
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
Peixin Xie (1):
riscv: acpi: Handle LPI architectural context loss flags
Peiyang He (1):
RDMA/rxe: Fix OOB in free_rd_atomic_resources()
Pengpeng Hou (10):
can: ems_usb: validate CPC message lengths
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
can: softing: fw_parse(): validate firmware record spans
can: peak_usb: validate uCAN receive record lengths
can: ctucanfd: add missing MODULE_DEVICE_TABLE()
drm/bridge: ps8640: propagate AUX transfer register errors
net: prestera: validate firmware header length
Input: iforce - validate input packet lengths
nfc: microread: validate target discovery payload lengths
eCryptfs: bound the packet-length peek to the user buffer
Peter Seiderer (1):
net: pktgen: fix code style (WARNING: Block comments)
Peter Ujfalusi (8):
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
ASoC: cs4265: sort the register default table
ASoC: cs35l45: sort the register default table
ASoC: cs35l41: sort the register default table
ASoC: SOF: Relocate and rework functionality for PCM stream freeing
ASoC: SOF: pcm: Move period/buffer configuration print after platform open
ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err()
ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
Peter Zijlstra (1):
perf: Unify perf_event_free_task() / perf_event_exit_task_context()
Petr Vaganov (1):
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
Pierre-Eric Pelloux-Prayer (1):
drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
Prasanna Kumar T S M (1):
cdx: Fix double free when sysfs file creation fails
Pratik Vishwakarma (1):
x86/CPU/AMD: Carve out a Zen5 models range
Praveen Talari (1):
pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0
Qiang Ma (1):
xfs: clear zapped attr fork state when bmap repair finds no attr fork
Qihang Tang (3):
packet: use consistent hard_header_len in non-ring send paths
packet: use consistent hard_header_len in TX_RING send path
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
Qing Luo (2):
sctp: fix addip_serial increment on ASCONF_ACK allocation failure
mptcp: pm: fix data race in add_addr timer callback
Qing Ming (4):
sctp: clear new_transport when removing a peer
gtp: serialize PDP context updates
tcp: fix AO info use-after-free in tcp_ao_connect_init()
mpls: reload header after pskb_may_pull()
Qingshuang Fu (2):
hwmon: (nzxt-smart2) Check return value of init_device() in probe
hwmon: (ads7828) Fix external VREF regulator handling
Qu Wenruo (1):
btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
Quentin Schulz (1):
arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
Radhey Shyam Pandey (3):
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
phy: zynqmp: fix runtime PM leak on probe allocation failure
Rafael J. Wysocki (1):
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
Raman Varabets (1):
HID: ft260: fix stack-use-after-return write in I2C read race
Raphael Zimmer (1):
libceph: Avoid using invalid osd indices from primary_temp
Rastislav Szabo (1):
net/tcp: fix TCP-AO key deletion in VRFs
Raushan Patel (1):
tracing/probes: Reject $arg0 in meta argument expansion
Ray Wu (3):
drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
drm/amd/display: Add AV mute wait frames to dce110_set_avmute
drm/amd/display: Check for tg ops in dce110_set_avmute
Richard Davies (1):
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Rik van Riel (2):
fbdev: bitblit: bound-check glyph index in bit_cursor()
null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
Robbie Ko (2):
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
Ronald Claveau (1):
PCI: meson: Fix GPIO state while requesting PERST#
Rosen Penev (3):
ata: sata_mv: accept 1 or 2 resources in platform probe
ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
Runyu Xiao (3):
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
Ruoyu Wang (2):
drm/mediatek: Check CRTC state before freeing
net: openvswitch: fix nf_connlabels leak in ovs_ct_init
Ryan Wilbur (1):
serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
Ryusuke Konishi (3):
nilfs2: correct return value kernel-doc descriptions for ioctl functions
nilfs2: reject invalid block index in GC ioctl
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
Sabrina Dubroca (1):
xfrm: espintcp: fix UAF during close
Sakari Ailus (1):
media: imx219: Fix maximum frame length in lines
Samuel Page (3):
nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
Sangho Lee (2):
Bluetooth: HIDP: reject frames without a transaction header
Bluetooth: HIDP: validate numbered report payloads
Sanman Pradhan (1):
hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
Sean Christopherson (4):
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
crypto: ccp: Add external API interface for PSP module initialization
KVM: SVM: Ensure PSP module is initialized if KVM module is built-in
Sebastian Andrzej Siewior (1):
Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
Seiji Nishikawa (1):
ipmi: si: Fix NULL pointer dereference after failed registration
Semih Baskan (1):
usb: xhci: Handle USB3 port events when there is one roothub
Sergey Senozhatsky (2):
usb: typec: ucsi: split connector lock classes
zsmalloc: rename class stat mutators
Sergey V. Frolov (1):
net: octeontx2-pf: Fix UB in shift operation
Shameer Kolothum (1):
iommu/arm-smmu-v3: Manage teardown with devm
Shardul Bankar (1):
mptcp: pm: fix memory leak from alloc-during-teardown race
Shay Drory (1):
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
Shuai Xue (1):
iommu/sva: Set handle->dev before the SVA handle is visible
Shuangpeng Bai (5):
smb: client: Fix use-after-free in cifs_try_adding_channels()
eventfs: Fix use-after-free in eventfs_remove_rec()
usb: gadget: f_tcm: keep port count until LUN teardown completes
USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
lockd: fix NULL dereference on lockowner allocation failure
Shuvam Pandey (1):
kunit: tool: skip stty when stdin is not a tty
Siddharth Vadapalli (1):
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
Sidraya Jayagond (1):
net/smc: fix TOCTOU race between smc_listen_out() and listener close
Sneh Mankad (1):
pinctrl: qcom: Unconditionally mark gpio as wakeup enable
Sonali Pradhan (4):
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
usb: gadget: f_ncm: Use unsigned int for ndp_index
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
Srikanth Boyapally (1):
spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
Srinivas Pandruvada (7):
platform/x86: ISST: Just allow 2 bits for SST feature enable
platform/x86: ISST: Validate logical CPU id and clos id
platform/x86: ISST: Validate parameter for core power state
platform/x86: ISST: Validate parameter for frequency and priority
platform/x86: ISST: Add a NULL check for sst_inst[]
platform/x86: ISST: Use PP level enable mask
platform/x86: ISST: Return error during profile addition
Srinivasan Shanmugam (1):
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
Stanislav Fomichev (1):
xsk: require at least 16 bytes of TX metadata
Stanislaw Gruszka (1):
wifi: rtl818x: initialize eeprom_93cx6 struct to zero
Stefan Haberland (4):
s390/dasd: Fix undersized format-check buffer
s390/dasd: Do not complete a failed ESE read as successful
s390/dasd: Guard sysfs discipline callbacks against unallocated private data
s390/dasd: Propagate partial completion length across ERP recovery
Steffen Persvold (1):
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
Stephen Smalley (1):
selinux: switch two allocations to use kzalloc_objs()
Steven Rostedt (3):
ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
tracing/mmiotrace: Remove reference to unused per CPU data pointer
ring-buffer: Simplify functions with __free(kfree) to free allocations
Suman Ghosh (1):
octeontx2-pf: Set correct sequence for carrier off and tx queue stop
Sun Jian (1):
veth: fix skb length accounting after XDP frag adjustment
Suraj Kandpal (1):
drm/i915/hdcp: Move to using intel_display in intel_hdcp
Takashi Iwai (9):
ALSA: 6fire: Fix UAF at error handling during probe
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
ALSA: dummy: Check card index validity at probe
ALSA: aloop: Check card index validity at probe
ALSA: mpu401: Check card index validity at probe
ALSA: mts64: Check card index validity at probe
ALSA: portman2x4: Check card index validity at probe
ALSA: serial-u16550: Check card index validity at probe
ALSA: virmidi: Check card index validity at probe
TanZheng (2):
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
ACPI: APEI: GHES: fix ARM section length accounting after header
Tejun Heo (1):
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
Tengda Wu (1):
ring-buffer: Use current_context for safe per-CPU buffer swap
Tetsuo Handa (5):
can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
kcov: fix data corruption and race conditions on PREEMPT_RT
can: j1939: implement NETDEV_UNREGISTER notification handler
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
can: j1939: make j1939_sk_bind() fail if device is no longer registered
Thomas Gleixner (1):
timer: Keep debugobjects state consistent in migrate_timer_list()
Thomas Hellström (2):
drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
drm/xe: Rename ___xe_bo_create_locked()
Thomas Richter (1):
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
Thomas Zimmermann (3):
drm/fb-helper: Allocate and release fb_info in single place
drm/tegra: fbdev: Remove offset into framebuffer memory
drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
Thorsten Blum (7):
powerpc/boot: Fix simpleboot CPU node lookup check
powerpc/boot: Fix treeboot-currituck CPU node lookup check
powerpc/boot: Fix treeboot-akebono CPU node lookup check
powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
crypto: qce - fix error path in devm_qce_register_algs
crypto: atmel-tdes - use scatterlist length before DMA mapping
crypto: mxs-dcp - fix source scatterlist length access
Tien Sung Ang (1):
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
Tim Harvey (1):
PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
Timur Kristóf (1):
drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
Tiwei Bie (5):
um: Add os_set_pdeathsig helper function
um: Use os_set_pdeathsig helper in winch thread/process
um: Set parent-death signal for ubd io thread/process
um: Set parent-death signal for write_sigio thread/process
um: Preserve errno within signal handler
Toke Høiland-Jørgensen (1):
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
Tomasz Pakuła (3):
HID: pidff: clang-format pass
HID: pidff: Rework pidff_set_time() to fix warnings
HID: pidff: Use ARRAY_SIZE macro instead of sizeof
Tristan Madani (1):
bpf: Reset register bounds before narrowing retval range in check_mem_access()
Tu Nguyen (1):
can: rcar_canfd: change the initializing flow for clocks and resets
Tvrtko Ursulin (1):
drm/amdgpu: Fix context pstate override handling
Tzung-Bi Shih (1):
platform/chrome: sensorhub: Fix dropped timestamp events and log spam
Uday Khare (2):
ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
Uwe Kleine-König (1):
m68k: Define NR_CPUS to 1
Vaibhav Nagare (1):
qede: Fix NULL pointer dereference in TPA fragment processing
Valentin Kindschi (2):
Bluetooth: hci_conn: re-enable advertising only for peripheral role
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
Vasiliy Kovalev (2):
jfs: add check read-only before truncation in jfs_truncate_nolock()
jfs: add check read-only before txBeginAnon() call
Vijaya Krishna Nivarthi (1):
spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
Ville Syrjälä (2):
drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
drm/i915/fbc: Extract intel_fbc_has_fences()
Vincent Donnefort (6):
ring-buffer: Prevent subbuf order change when resizing is disabled
ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
tracing: Fix logged instance name on creation failure
ring-buffer: Free cpu_buffer::free_page with subbuf_order
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
ring-buffer: Fix subbuf resize race with ring buffer readers
Vincent Jardin (1):
hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
Vincent Mailhol (1):
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
Vishnu Razdan (1):
io_uring/io-wq: fix worker accounting when canceling creation callbacks
Vladimir Marioukhine (1):
drm/amdkfd: fix QID bit leak in pqm_create_queue()
Vladimir Riabchun (1):
mISDN: hfcpci: Fix warning when deleting uninitialized timer
Wei Fang (1):
net: packet: fix wrong transport_header when sending VLAN-tagged frame
Weigang He (1):
media: cec: stm32: prevent out-of-bounds write on RX overflow
Weiming Shi (5):
vsock/virtio: read virtqueues under worker locks
vsock/virtio: avoid refilling the RX queue after teardown
KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
sctp: fix NULL deref on untransmitted RECONF completion
xdp: fix zero-copy frame layout
WenTao Liang (2):
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
Wenliang Yan (1):
hwmon: (ina226) Add support for SY24655
Wentao Liang (2):
media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
ceph: fix writeback_count leak in write_folio_nounlock()
Wilken Gottwalt (1):
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
Will Porter (1):
ALSA: usb-audio: Complete cleanup after system-resume errors
William Palacek (1):
drm/amdkfd: hold event_mutex while checkpointing CRIU events
Wolfram Sang (1):
i2c: bcm-iproc: remove printout on handled timeouts
Wyatt Feng (1):
mptcp: fastopen: only mark MPTFO subflows with SYN data
Xiang Mei (4):
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
fs/ntfs3: validate dirty page table on log replay
Xiang Mei (Microsoft) (5):
netfilter: nft_payload: fix mask build for partial field offload
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
bpf: tcp: fix double sock release on batch realloc
netfilter: ipset: fix refcount race between list:set GC and swap
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
Xiangfeng Cai (1):
mm/hugetlb: fix list corruption in allocate_file_region_entries()
Xin Chen (1):
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
Xin Long (2):
net: sched: refine software bypass handling in tc_run
sctp: clear control chunk transport if it is being removed
Xingrui Li (1):
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
Xingui Yang (1):
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
Xinyang Ge (1):
inet: frags: strip GSO state from fragments before reassembly
Xiubo Li (1):
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
Xu Rao (6):
ALSA: lx6464es: fix period byte count for 16-bit streams
power: supply: bq25890: fix the -10 C NTC lookup entry
thunderbolt: icm: Preserve USB4 proxy data-valid bit
scsi: scsi_debug: Negate wrapped memcmp() result
nfc: pn533: purge fragmented skbs during cleanup
HID: roccat: free buffered reports when destroying device
Xu Yang (1):
device property: fix infinite loop in fwnode_for_each_child_node()
Xuanqiang Luo (5):
bpf: lwt: Fix dst reference leak on reroute failure
net/smc: fix socket use-after-free during link group termination
udp: fix potential use-after-free in tunnel segmentation
net: ravb: avoid dereferencing an invalid PTP clock
net: ravb: serialize PTP clock teardown
Yang Erkun (1):
md: make rdev_addable usable for rcu mode
Yang Wang (4):
drm/amd/pm: fix torn gpu metrics reads
drm/amd/pm: fix pptable use-after-free
drm/amdgpu: check ASPM on the dGPU host link
drm/amd/pm: adjust the visibility of pp_table sysfs node
Yangyu Chen (2):
net: atlantic: free stranded TX buffers on ring deinit
net: atlantic: free RX pages of consumed but not refilled buffers
Yazen Ghannam (2):
x86/mce: Remove __mcheck_cpu_init_early()
x86/mce: Set CR4.MCE last during init
Ye Bin (1):
jbd2: add prefix 'jbd2' for 'shrink_type'
Yehyeong Lee (5):
net: mpls: initialize rtm_tos in mpls_getroute()
nvme: zero the discard fallback page
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
nvme-tcp: fix host memory disclosure on R2T for a read command
nvme-tcp: reject a read that transferred too few bytes
Yemu Lu (1):
fat: restore original value when fat_ent_write failed
Yi Cong (1):
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
Yichong Chen (6):
ecryptfs: fix tag 11 packet exact-fit size check
ecryptfs: hold msg ctx list lock when cleaning daemon queue
ecryptfs: pass packet set buffer size to parser
ecryptfs: reject too-small tag 70 packets
ecryptfs: release message context on send failure
ecryptfs: show filename encryption options
Yifei Gao (1):
orangefs: fix double-free of trailer_buf on readdir copy failure
Yiming Zhu (1):
ceph: fix MDS random selection readiness predicate
Yiyang Chen (1):
bpf: Preserve pointer state for commuted arithmetic
Yizhou Zhao (1):
ipvs: separate destination availability state
Yong Wang (1):
ipv4: reject undersized MTUs in ip_do_fragment()
Yousef Alhouseen (2):
vhost/vdpa: reject overflowing PA map page counts on 32-bit
ipmi: ipmb: validate write message length
Yuejie Shi (1):
ipv6: fix Route Information option length validation
Yuho Choi (3):
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
ARM: npcm: Fix OF node refcount leaks in SMP setup
idpf: Fix mailbox IRQ name leak on request failure
Yun Zhou (1):
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
Yunxiang Li (1):
drm/amdgpu: remove unused function parameter
Yuxiang Yang (3):
sctp: reject stale cookies with mismatched verification tags
sctp: fix use-after-free of cached ASCONF chunk
tcp: challenge ACK for non-exact RST in SYN-RECEIVED
Yuyang Huang (1):
ipv6: use RCU iterator to dump route exceptions
Zack Rusin (8):
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
drm/vmwgfx: reject DX_BIND_QUERY without a DX context
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
drm/vmwgfx: bound DMA command body size against suffix pointer
drm/vmwgfx: use check_add_overflow for shader size+offset bound
drm/vmwgfx: validate external BO copy bounds for both stride paths
drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
Zhan Xusheng (5):
audit: fix potential integer overflow in audit_log_n_string()
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
ocfs2: fix readdir position truncation on 32-bit kernels
udf: Fix i_lenExtents truncation on 32-bit kernels
Zhang Changzhong (1):
net/sched: cls_u32: skip hash tables in u32_bind_class()
ZhangGuoDong (2):
smb: move smb_version_values to common/smbglob.h
smb: move get_rfc1002_len() to common/smbglob.h
Zhao Li (2):
wifi: mac80211: validate individual TWT params before driver setup
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
Zhefu Zhang (1):
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Zheng Yejian (1):
tracing: Remove TRACE_EVENT_FL_FILTERED logic
Zhiling Zou (15):
ipvs: do not propagate one-packet flag to synced conns
net: bridge: stop fast-leave after deleting a port group
net: ipv6: clear suppressed fib6 rule result
ipvs: stop estimator after disabled calc phase
net: openvswitch: reallocate update replies for mismatched IDs
netfilter: bridge: release template ct on non-IP path
xdp: reject clones that overrun skb_shared_info tailroom
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
inet: frags: publish queues before arming timer
xfrm: drop ESP-in-TCP packets with no ingress device
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
ip6_gre: fix hardware header length for NBMA tunnels
orangefs: skip leading spaces before parsing client debug masks
net: cap advertised IP tunnel headroom
seg6: reset IP6CB after IPv6 decapsulation
Zhongqiu Han (1):
cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
Zi Yan (2):
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
Zide Chen (1):
perf/x86/intel/uncore: Fix die ID init and look up bugs
Zihan Xi (9):
Bluetooth: mgmt: fix pending command UAF in EIR updates
Bluetooth: mgmt: fix UAF in pair command cancellation
tipc: avoid use-after-free in poll trace queue dumps
packet: synchronize pressure clearing with ring reconfiguration
mac802154: fix netdev use-after-free in beacon worker
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
netfilter: nf_conntrack: defer invalid log until after unlock
xfrm: fix xfrm_state_construct() auth-trunc leak
net: l2tp: do not propagate multicast notification errors
Zijie Huang (1):
net/sched: reject overly deep qdisc hierarchies
Zijun Hu (2):
Bluetooth: btintel: Validate length before parsing diagnostics TLV
Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync()
Zilin Guan (2):
wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
wifi: ath11k: fix memory leaks in beacon template setup
bui duc phuc (1):
gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
chanyoung (1):
tls: don't leave a full plaintext sk_msg ring unpushed
liyouhong (1):
dm-era: fix shadowed superblock leak on take-snap failure
胡连勤 (1):
block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +-
.../bindings/crypto/qcom,inline-crypto-engine.yaml | 16 +-
Documentation/driver-api/driver-model/devres.rst | 1 +
Documentation/filesystems/fscrypt.rst | 4 +
Documentation/hwmon/ina2xx.rst | 62 +-
MAINTAINERS | 5 +
arch/alpha/include/uapi/asm/fpu.h | 8 +-
arch/alpha/kernel/pci-sysfs.c | 6 +-
arch/alpha/kernel/sys_marvel.c | 25 +-
arch/alpha/kernel/traps.c | 6 +-
arch/alpha/math-emu/math.c | 88 ++-
arch/arm/Kconfig | 2 +-
arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +-
arch/arm/include/asm/hugetlb-3level.h | 4 +-
arch/arm/mach-npcm/platsmp.c | 2 +
arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 +
arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +-
.../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 +
arch/arm64/include/asm/hugetlb.h | 2 +-
arch/arm64/kernel/compat_alignment.c | 4 +-
arch/arm64/kvm/arm.c | 6 +
arch/arm64/mm/hugetlbpage.c | 2 +-
arch/m68k/Kconfig.cpu | 4 +
arch/openrisc/include/asm/processor.h | 2 +
arch/openrisc/kernel/dma.c | 4 +-
arch/openrisc/kernel/entry.S | 43 +-
arch/openrisc/kernel/signal.c | 5 +-
arch/powerpc/boot/simpleboot.c | 2 +-
arch/powerpc/boot/treeboot-akebono.c | 2 +-
arch/powerpc/boot/treeboot-currituck.c | 2 +-
arch/powerpc/perf/hv-gpci.c | 24 +-
arch/powerpc/platforms/powermac/low_i2c.c | 2 +-
arch/powerpc/platforms/ps3/mm.c | 1 +
arch/powerpc/platforms/pseries/iommu.c | 23 +-
arch/powerpc/platforms/pseries/lparcfg.c | 2 +-
arch/powerpc/platforms/pseries/pci.c | 2 +-
arch/riscv/include/asm/acpi.h | 19 +
arch/riscv/include/asm/hugetlb.h | 2 +-
arch/riscv/kernel/compat_signal.c | 2 +
arch/riscv/kernel/ptrace.c | 4 +-
arch/riscv/mm/hugetlbpage.c | 2 +-
arch/riscv/mm/pageattr.c | 8 +-
arch/s390/include/asm/hugetlb.h | 4 +-
arch/s390/kernel/perf_cpum_cf.c | 215 ++++--
arch/s390/kvm/pci.c | 114 ++-
arch/s390/kvm/pci.h | 2 +
arch/s390/kvm/vsie.c | 1 +
arch/s390/mm/hugetlbpage.c | 4 +-
arch/s390/pci/pci_mmio.c | 1 +
arch/um/drivers/chan_user.c | 2 +
arch/um/drivers/ubd_kern.c | 1 +
arch/um/drivers/vector_kern.c | 3 +
arch/um/include/shared/os.h | 2 +
arch/um/os-Linux/process.c | 6 +
arch/um/os-Linux/sigio.c | 1 +
arch/um/os-Linux/signal.c | 3 +
arch/um/os-Linux/skas/process.c | 3 +
arch/x86/coco/tdx/tdx.c | 10 +-
arch/x86/entry/entry_64.S | 8 +-
arch/x86/events/intel/uncore.c | 1 +
arch/x86/events/intel/uncore_snbep.c | 13 +-
arch/x86/include/asm/insn-eval.h | 36 +
arch/x86/include/asm/nospec-branch.h | 59 ++
arch/x86/kernel/cpu/amd.c | 1 +
arch/x86/kernel/cpu/bugs.c | 39 +
arch/x86/kernel/cpu/mce/amd.c | 4 +
arch/x86/kernel/cpu/mce/core.c | 21 +-
arch/x86/kvm/emulate.c | 26 +-
arch/x86/kvm/mmu/mmu.c | 3 +
arch/x86/kvm/mmu/page_track.c | 32 +-
arch/x86/kvm/svm/avic.c | 8 -
arch/x86/kvm/svm/sev.c | 50 +-
arch/x86/kvm/svm/svm.h | 1 +
arch/x86/kvm/x86.c | 13 +
arch/x86/lib/retpoline.S | 20 +
block/blk-mq.c | 102 ++-
block/blk-sysfs.c | 3 +
block/genhd.c | 13 +-
crypto/ccm.c | 2 +-
debian.master/config/annotations | 2 -
debian.master/upstream-stable | 4 +-
drivers/accel/qaic/qaic_control.c | 2 +-
drivers/accessibility/speakup/main.c | 1 +
drivers/acpi/apei/erst.c | 2 +-
drivers/acpi/apei/ghes.c | 2 +-
drivers/acpi/pfr_update.c | 45 +-
drivers/ata/ahci.h | 17 +-
drivers/ata/ahci_brcm.c | 3 +
drivers/ata/ahci_ceva.c | 24 +-
drivers/ata/libahci.c | 1 +
drivers/ata/libahci_platform.c | 38 +-
drivers/ata/libata-eh.c | 37 +-
drivers/ata/libata-sata.c | 2 +-
drivers/ata/libata-scsi.c | 145 +++-
drivers/ata/libata.h | 3 +-
drivers/ata/pata_sl82c105.c | 4 +-
drivers/ata/sata_mv.c | 2 +-
drivers/auxdisplay/charlcd.c | 21 +-
drivers/base/arch_numa.c | 12 +
drivers/base/property.c | 19 +-
drivers/block/null_blk/zoned.c | 10 +-
drivers/block/ublk_drv.c | 9 +
drivers/bluetooth/btintel.c | 3 +
drivers/bluetooth/btmtk.c | 50 +-
drivers/bluetooth/btusb.c | 36 +-
drivers/bluetooth/hci_bcm.c | 1 +
drivers/bluetooth/hci_bcm4377.c | 1 +
drivers/bluetooth/hci_h5.c | 4 +-
drivers/bluetooth/hci_intel.c | 1 +
drivers/bluetooth/hci_ldisc.c | 2 +-
drivers/bluetooth/hci_serdev.c | 2 +-
drivers/cdx/cdx.c | 7 +-
drivers/char/ipmi/ipmb_dev_int.c | 5 +-
drivers/char/ipmi/ipmi_msghandler.c | 1 +
drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +-
drivers/clocksource/timer-sun4i.c | 2 +-
drivers/counter/microchip-tcb-capture.c | 4 +-
drivers/cpufreq/powernow-k8.c | 1 +
drivers/crypto/Kconfig | 1 -
drivers/crypto/allwinner/Kconfig | 16 -
drivers/crypto/allwinner/sun8i-ce/Makefile | 1 -
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 55 --
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 -----
drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 -
drivers/crypto/allwinner/sun8i-ss/Makefile | 1 -
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 -
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 -----
drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 -
drivers/crypto/atmel-tdes.c | 5 +-
drivers/crypto/ccp/sev-dev.c | 13 +-
drivers/crypto/ccp/sp-dev.c | 14 +
drivers/crypto/mxs-dcp.c | 2 +-
drivers/crypto/qce/aead.c | 58 +-
drivers/crypto/qce/common.c | 55 +-
drivers/crypto/qce/common.h | 16 +-
drivers/crypto/qce/core.c | 2 +-
drivers/crypto/qce/regs-v5.h | 4 -
drivers/crypto/qce/sha.c | 30 +-
drivers/crypto/qce/sha.h | 1 -
drivers/crypto/qce/skcipher.c | 97 +--
drivers/crypto/qcom-rng.c | 172 +----
drivers/cxl/core/pmem.c | 10 +-
drivers/cxl/cxl.h | 3 +-
drivers/cxl/pmem.c | 2 +-
drivers/dma/idxd/cdev.c | 4 +-
drivers/dma/sun6i-dma.c | 11 +-
drivers/fpga/altera-cvp.c | 10 +-
drivers/fpga/dfl-fme-perf.c | 2 +
drivers/fpga/stratix10-soc.c | 21 +-
drivers/gpio/gpio-ml-ioh.c | 36 +-
drivers/gpio/gpio-pca953x.c | 15 +-
drivers/gpio/gpio-pch.c | 28 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 72 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 71 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 +
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 24 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 22 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 85 +--
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 3 +-
drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +-
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +-
.../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +-
.../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 31 +-
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +-
.../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 +-
drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 7 +-
.../drm/amd/display/dc/dce110/dce110_opp_csc_v.c | 7 +-
.../amd/display/dc/dml2/dml2_translation_helper.c | 2 +-
.../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 +-
.../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +-
drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 36 +-
drivers/gpu/drm/amd/pm/amdgpu_pm.c | 26 +-
drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +-
drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 5 +-
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +-
.../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 102 +--
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 58 --
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h | 14 +-
drivers/gpu/drm/armada/armada_fbdev.c | 12 +-
drivers/gpu/drm/bridge/parade-ps8640.c | 27 +-
drivers/gpu/drm/display/drm_dp_helper.c | 12 +
drivers/gpu/drm/drm_exec.c | 6 +-
drivers/gpu/drm/drm_fb_helper.c | 41 +-
drivers/gpu/drm/drm_fbdev_dma.c | 12 +-
drivers/gpu/drm/drm_fbdev_generic.c | 12 +-
drivers/gpu/drm/drm_gpuvm.c | 3 +-
drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 9 +-
drivers/gpu/drm/gma500/fbdev.c | 13 +-
drivers/gpu/drm/i915/display/intel_display_types.h | 5 +-
drivers/gpu/drm/i915/display/intel_fbc.c | 9 +-
drivers/gpu/drm/i915/display/intel_fbdev.c | 9 +-
drivers/gpu/drm/i915/display/intel_hdcp.c | 266 +++----
drivers/gpu/drm/i915/display/intel_vrr.c | 10 +-
drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +-
drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 6 +-
drivers/gpu/drm/msm/msm_fbdev.c | 9 +-
drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +-
drivers/gpu/drm/omapdrm/omap_fbdev.c | 9 +-
drivers/gpu/drm/radeon/radeon_fbdev.c | 13 +-
drivers/gpu/drm/radeon/radeon_kms.c | 1 +
drivers/gpu/drm/tegra/fbdev.c | 18 +-
drivers/gpu/drm/vc4/vc4_irq.c | 2 +-
drivers/gpu/drm/vc4/vc4_validate.c | 29 +-
drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +-
drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 +-
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +-
drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 10 +-
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +-
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +-
.../drm/xe/compat-i915-headers/i915_gem_stolen.h | 2 +-
drivers/gpu/drm/xe/display/intel_fb_bo.c | 8 +-
drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 16 +-
drivers/gpu/drm/xe/display/xe_dsb_buffer.c | 4 +-
drivers/gpu/drm/xe/display/xe_fb_pin.c | 16 +-
drivers/gpu/drm/xe/display/xe_plane_initial.c | 6 +-
drivers/gpu/drm/xe/tests/xe_bo.c | 4 +-
drivers/gpu/drm/xe/tests/xe_dma_buf.c | 54 +-
drivers/gpu/drm/xe/tests/xe_migrate.c | 20 +-
drivers/gpu/drm/xe/xe_bo.c | 133 ++--
drivers/gpu/drm/xe/xe_bo.h | 51 +-
drivers/gpu/drm/xe/xe_bo_evict.c | 2 +-
drivers/gpu/drm/xe/xe_bo_types.h | 2 +
drivers/gpu/drm/xe/xe_dma_buf.c | 6 +-
drivers/gpu/drm/xe/xe_exec.c | 22 +-
drivers/gpu/drm/xe/xe_ggtt.c | 6 +-
drivers/gpu/drm/xe/xe_gsc.c | 8 +-
drivers/gpu/drm/xe/xe_guc_ads.c | 4 +-
drivers/gpu/drm/xe/xe_guc_ct.c | 4 +-
drivers/gpu/drm/xe/xe_guc_hwconfig.c | 4 +-
drivers/gpu/drm/xe/xe_guc_log.c | 4 +-
drivers/gpu/drm/xe/xe_guc_pc.c | 4 +-
drivers/gpu/drm/xe/xe_huc.c | 4 +-
drivers/gpu/drm/xe/xe_hw_engine.c | 4 +-
drivers/gpu/drm/xe/xe_lmtt.c | 4 +-
drivers/gpu/drm/xe/xe_lrc.c | 11 +-
drivers/gpu/drm/xe/xe_migrate.c | 32 +-
drivers/gpu/drm/xe/xe_pt.c | 10 +-
drivers/gpu/drm/xe/xe_sa.c | 4 +-
drivers/gpu/drm/xe/xe_sched_job.c | 6 +
drivers/gpu/drm/xe/xe_sched_job.h | 3 +
drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c | 2 +-
drivers/gpu/drm/xe/xe_uc_fw.c | 2 +-
drivers/gpu/drm/xe/xe_vm.c | 2 +-
drivers/hid/hid-asus.c | 39 +-
drivers/hid/hid-core.c | 11 +-
drivers/hid/hid-ft260.c | 41 +-
drivers/hid/hid-hyperv.c | 27 +-
drivers/hid/hid-input.c | 3 +
drivers/hid/hid-logitech-dj.c | 28 +-
drivers/hid/hid-magicmouse.c | 89 ++-
drivers/hid/hid-mcp2221.c | 9 +
drivers/hid/hid-nintendo.c | 26 +-
drivers/hid/hid-picolcd_debugfs.c | 9 +
drivers/hid/hid-roccat.c | 13 +-
drivers/hid/hid-sensor-custom.c | 26 +-
drivers/hid/hid-sensor-hub.c | 42 +-
drivers/hid/hid-uclogic-core.c | 12 +-
drivers/hid/usbhid/hid-pidff.c | 63 +-
drivers/hsi/controllers/omap_ssi_core.c | 6 +
drivers/hv/vmbus_drv.c | 13 +-
drivers/hwmon/Kconfig | 5 +-
drivers/hwmon/ads7828.c | 11 +-
drivers/hwmon/adt7470.c | 129 +++-
drivers/hwmon/corsair-psu.c | 4 +-
drivers/hwmon/ina2xx.c | 242 ++++++-
drivers/hwmon/lm90.c | 4 +-
drivers/hwmon/max6621.c | 8 +-
drivers/hwmon/nct6775-core.c | 20 +-
drivers/hwmon/npcm750-pwm-fan.c | 11 +
drivers/hwmon/nzxt-smart2.c | 8 +-
drivers/hwmon/pmbus/lm25066.c | 5 +-
drivers/hwmon/pmbus/ltc4286.c | 2 +-
drivers/hwmon/pmbus/pmbus_core.c | 7 +-
drivers/hwmon/sht3x.c | 9 +-
.../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +-
drivers/hwtracing/ptt/hisi_ptt.c | 20 +-
drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +-
drivers/i2c/busses/i2c-bcm-iproc.c | 11 +-
drivers/i2c/busses/i2c-imx.c | 9 +-
drivers/i2c/busses/i2c-jz4780.c | 5 +-
drivers/i3c/master.c | 9 +-
drivers/i3c/master/svc-i3c-master.c | 10 +-
drivers/infiniband/core/ucma.c | 5 +-
drivers/infiniband/hw/cxgb4/device.c | 6 +
drivers/infiniband/sw/rxe/rxe_qp.c | 17 +-
drivers/input/evdev.c | 27 +-
drivers/input/joystick/iforce/iforce-packets.c | 11 +-
drivers/input/joystick/iforce/iforce-usb.c | 3 +
drivers/input/joystick/psxpad-spi.c | 1 +
drivers/input/joystick/xpad.c | 2 +
drivers/input/keyboard/atkbd.c | 27 +-
drivers/input/mouse/byd.c | 2 +-
drivers/input/mouse/focaltech.c | 2 +-
drivers/input/rmi4/rmi_f54.c | 43 +-
drivers/input/rmi4/rmi_f55.c | 4 +-
drivers/input/touchscreen/hynitron_cstxxx.c | 13 +-
drivers/input/touchscreen/sur40.c | 23 +-
drivers/interconnect/core.c | 7 +-
drivers/iommu/amd/init.c | 10 +-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 +-
drivers/iommu/intel/dmar.c | 15 +-
drivers/iommu/intel/iommu.c | 8 +-
drivers/iommu/intel/iommu.h | 2 +
drivers/iommu/iommu-sva.c | 4 +-
drivers/isdn/hardware/mISDN/hfcpci.c | 12 +-
drivers/mailbox/qcom-ipcc.c | 17 +-
drivers/md/dm-cache-metadata.c | 6 +-
drivers/md/dm-clone-metadata.c | 6 +-
drivers/md/dm-era-target.c | 11 +-
drivers/md/dm-log-userspace-base.c | 1 +
drivers/md/dm-stats.c | 6 +-
drivers/md/dm-switch.c | 2 +-
drivers/md/dm-thin-metadata.c | 6 +-
drivers/md/md.c | 15 +-
drivers/md/persistent-data/dm-array.c | 59 +-
drivers/md/persistent-data/dm-block-manager.c | 12 +-
drivers/md/persistent-data/dm-block-manager.h | 14 +-
drivers/md/persistent-data/dm-btree-internal.h | 2 +-
drivers/md/persistent-data/dm-btree-spine.c | 6 +-
drivers/md/persistent-data/dm-space-map-common.c | 12 +-
.../md/persistent-data/dm-transaction-manager.c | 8 +-
.../md/persistent-data/dm-transaction-manager.h | 6 +-
drivers/media/cec/platform/stm32/stm32-cec.c | 3 +-
drivers/media/i2c/imx219.c | 31 +-
.../media/platform/chips-media/wave5/wave5-hw.c | 3 +
.../platform/chips-media/wave5/wave5-vpu-enc.c | 5 +-
.../platform/chips-media/wave5/wave5-vpuapi.h | 1 +
.../platform/samsung/exynos4-is/fimc-is-regs.c | 1 +
drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +-
drivers/media/v4l2-core/v4l2-dev.c | 14 +-
drivers/mfd/sm501.c | 2 +
drivers/misc/fastrpc.c | 19 +-
drivers/misc/mei/client.c | 25 +-
drivers/misc/nsm.c | 2 +-
drivers/mmc/host/atmel-mci.c | 2 +
drivers/mmc/host/omap_hsmmc.c | 2 +-
drivers/mmc/host/sdhci.c | 16 +
drivers/mmc/host/sdhci.h | 2 +-
drivers/mmc/host/via-sdmmc.c | 8 +-
drivers/mtd/ubi/attach.c | 4 +-
drivers/mtd/ubi/fastmap-wl.c | 8 +-
drivers/mtd/ubi/io.c | 10 +
drivers/mtd/ubi/ubi.h | 12 +
drivers/net/bonding/bond_alb.c | 10 +-
drivers/net/can/c_can/c_can_main.c | 8 +-
drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +-
drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +-
drivers/net/can/dev/skb.c | 2 -
drivers/net/can/rcar/rcar_canfd.c | 28 +-
drivers/net/can/softing/softing_fw.c | 46 +-
drivers/net/can/usb/ems_usb.c | 43 ++
drivers/net/can/usb/etas_es58x/es58x_core.c | 1 -
drivers/net/can/usb/gs_usb.c | 4 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 +
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +-
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 -
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +-
drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +-
drivers/net/dsa/mt7530-mdio.c | 11 +-
drivers/net/dsa/mt7530.c | 58 +-
drivers/net/dsa/realtek/realtek-mdio.c | 4 +-
drivers/net/dsa/realtek/realtek-smi.c | 4 +-
drivers/net/ethernet/amd/pds_core/core.c | 4 +
drivers/net/ethernet/amd/pds_core/core.h | 1 +
drivers/net/ethernet/amd/pds_core/main.c | 6 +-
drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 +-
drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 +
drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 +
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 16 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 +
drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 3 +-
drivers/net/ethernet/freescale/fec_main.c | 11 +-
drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 -
.../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +-
drivers/net/ethernet/ibm/ibmvnic.c | 30 +-
drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +-
drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +-
drivers/net/ethernet/intel/ice/ice_main.c | 10 +
drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 +
.../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 +
drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 +
drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +-
drivers/net/ethernet/intel/igbvf/netdev.c | 2 -
drivers/net/ethernet/intel/igc/igc_main.c | 1 -
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +-
.../net/ethernet/marvell/prestera/prestera_pci.c | 3 +
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 70 +-
drivers/net/ethernet/mediatek/mtk_eth_soc.h | 7 +-
.../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +-
.../net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 +
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +-
drivers/net/ethernet/microsoft/mana/mana_en.c | 4 +-
drivers/net/ethernet/nvidia/forcedeth.c | 8 +-
drivers/net/ethernet/qlogic/qede/qede.h | 8 +-
drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 +
drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +-
drivers/net/ethernet/renesas/ravb.h | 1 +
drivers/net/ethernet/renesas/ravb_main.c | 3 +-
drivers/net/ethernet/renesas/ravb_ptp.c | 44 +-
drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +-
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +
drivers/net/gtp.c | 18 +-
drivers/net/ipa/ipa_modem.c | 18 +-
drivers/net/ipvlan/ipvlan_main.c | 4 +
drivers/net/macvlan.c | 4 +
drivers/net/ntb_netdev.c | 26 +-
drivers/net/phy/phylink.c | 29 +-
drivers/net/slip/slip.c | 11 +-
drivers/net/tap.c | 24 +-
drivers/net/thunderbolt/main.c | 45 +-
drivers/net/tun.c | 21 +-
drivers/net/usb/ax88179_178a.c | 4 +-
drivers/net/usb/ipheth.c | 31 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/net/usb/rndis_host.c | 6 +-
drivers/net/veth.c | 26 +-
drivers/net/vrf.c | 49 +-
drivers/net/vxlan/vxlan_core.c | 73 +-
drivers/net/vxlan/vxlan_mdb.c | 4 +-
drivers/net/wireless/ath/ath11k/mac.c | 19 +-
drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 +
drivers/net/wireless/ath/ath6kl/txrx.c | 2 +-
.../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 +
.../wireless/broadcom/brcm80211/brcmfmac/chip.c | 4 +-
.../wireless/broadcom/brcm80211/brcmfmac/core.c | 46 +-
.../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 +
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 17 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 +
.../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 +
.../broadcom/brcm80211/include/brcm_hw_ids.h | 2 +-
.../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +-
drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 +
drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +-
.../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +-
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 +-
drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 4 +
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +-
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +-
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +-
.../realtek/rtl8xxxu/{rtl8xxxu_8188e.c => 8188e.c} | 2 +-
.../realtek/rtl8xxxu/{rtl8xxxu_8188f.c => 8188f.c} | 2 +-
.../realtek/rtl8xxxu/{rtl8xxxu_8192c.c => 8192c.c} | 2 +-
.../realtek/rtl8xxxu/{rtl8xxxu_8192e.c => 8192e.c} | 2 +-
.../realtek/rtl8xxxu/{rtl8xxxu_8192f.c => 8192f.c} | 2 +-
.../realtek/rtl8xxxu/{rtl8xxxu_8710b.c => 8710b.c} | 2 +-
.../realtek/rtl8xxxu/{rtl8xxxu_8723a.c => 8723a.c} | 2 +-
.../realtek/rtl8xxxu/{rtl8xxxu_8723b.c => 8723b.c} | 2 +-
drivers/net/wireless/realtek/rtl8xxxu/Makefile | 6 +-
.../realtek/rtl8xxxu/{rtl8xxxu_core.c => core.c} | 21 +-
.../realtek/rtl8xxxu/{rtl8xxxu_regs.h => regs.h} | 0
drivers/net/wireless/realtek/rtw88/tx.c | 1 +
drivers/nfc/fdp/i2c.c | 27 +
drivers/nfc/microread/microread.c | 31 +-
drivers/nfc/pn533/pn533.c | 1 +
drivers/nfc/st21nfca/dep.c | 3 +
drivers/ntb/ntb_transport.c | 38 +-
drivers/nvdimm/label.c | 2 +-
drivers/nvme/host/core.c | 2 +-
drivers/nvme/host/fc.c | 2 +-
drivers/nvme/host/pci.c | 1 +
drivers/nvme/host/tcp.c | 45 +-
drivers/nvme/target/fabrics-cmd-auth.c | 2 +-
drivers/nvme/target/fc.c | 2 +-
drivers/nvme/target/tcp.c | 18 +-
drivers/nvmem/core.c | 24 +-
drivers/nvmem/internals.h | 2 +
drivers/nvmem/layouts.c | 11 -
drivers/nvmem/layouts/Makefile | 1 +
drivers/nvmem/layouts/fixed-layout.c | 58 ++
drivers/of/base.c | 2 +-
drivers/pci/controller/dwc/pci-meson.c | 2 +-
drivers/pci/controller/pci-host-generic.c | 11 +-
drivers/pci/controller/pci-hyperv.c | 1 +
drivers/pci/ecam.c | 13 +
drivers/pci/msi/msi.c | 10 +
drivers/pci/pci-sysfs.c | 4 +-
drivers/pci/proc.c | 16 +-
drivers/pci/quirks.c | 6 +-
drivers/phy/xilinx/phy-zynqmp.c | 130 ++--
drivers/pinctrl/Kconfig | 2 +
drivers/pinctrl/devicetree.c | 4 +
drivers/pinctrl/pinctrl-amd.c | 3 +-
drivers/pinctrl/qcom/pinctrl-msm.c | 8 +-
drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +-
drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 +-
drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +-
.../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 -
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +-
drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 +
.../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +-
.../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +-
.../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +-
.../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +-
.../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +-
.../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +-
drivers/platform/x86/intel/ishtp_eclite.c | 5 +-
.../x86/intel/speed_select_if/isst_tpmi_core.c | 96 ++-
drivers/pmdomain/arm/scmi_perf_domain.c | 2 +-
drivers/power/supply/bq24257_charger.c | 16 +-
drivers/power/supply/bq256xx_charger.c | 29 +-
drivers/power/supply/bq25890_charger.c | 14 +-
drivers/power/supply/charger-manager.c | 54 +-
drivers/power/supply/cros_usbpd-charger.c | 17 +-
drivers/power/supply/lp8727_charger.c | 4 +-
drivers/power/supply/lp8788-charger.c | 2 +-
drivers/power/supply/max17040_battery.c | 38 +-
drivers/power/supply/qcom_battmgr.c | 2 +-
drivers/power/supply/rt9455_charger.c | 21 +-
drivers/power/supply/twl4030_charger.c | 12 +-
drivers/power/supply/ucs1002_power.c | 6 +-
drivers/ptp/ptp_ocp.c | 4 +-
drivers/rapidio/devices/rio_mport_cdev.c | 10 +-
drivers/regulator/as3722-regulator.c | 1 -
drivers/regulator/devres.c | 59 ++
drivers/regulator/max8998.c | 1 -
drivers/regulator/qcom-refgen-regulator.c | 4 +-
drivers/remoteproc/mtk_scp.c | 9 +-
drivers/rpmsg/qcom_glink_smem.c | 7 +
drivers/s390/block/dasd.c | 6 +-
drivers/s390/block/dasd_eckd.c | 51 +-
drivers/s390/block/dasd_erp.c | 3 +
drivers/s390/block/dasd_ioctl.c | 2 +-
drivers/s390/cio/vfio_ccw_async.c | 16 +
drivers/s390/cio/vfio_ccw_chp.c | 31 +-
drivers/s390/cio/vfio_ccw_cp.c | 74 +-
drivers/s390/cio/vfio_ccw_cp.h | 10 +
drivers/s390/cio/vfio_ccw_drv.c | 21 +-
drivers/s390/cio/vfio_ccw_fsm.c | 8 +-
drivers/s390/cio/vfio_ccw_ops.c | 39 +-
drivers/s390/cio/vfio_ccw_private.h | 10 +-
drivers/s390/crypto/zcrypt_api.c | 2 +-
drivers/s390/crypto/zcrypt_ccamisc.c | 26 +-
drivers/s390/net/qeth_core_main.c | 6 +
drivers/s390/net/qeth_l3_main.c | 5 +
drivers/s390/scsi/zfcp_aux.c | 1 +
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +-
drivers/scsi/libiscsi.c | 2 +-
drivers/scsi/libiscsi_tcp.c | 8 +-
drivers/scsi/libsas/sas_init.c | 37 +-
drivers/scsi/scsi_debug.c | 12 +-
drivers/scsi/scsi_lib.c | 2 +
drivers/spi/spi-cadence.c | 129 +++-
drivers/spi/spi-fsl-dspi.c | 13 +-
drivers/spi/spi-qcom-qspi.c | 3 +-
drivers/staging/greybus/hid.c | 2 +-
drivers/staging/media/tegra-video/vi.c | 9 +-
drivers/staging/media/tegra-video/vip.c | 10 +-
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 +
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +-
drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 +
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 +
drivers/target/target_core_fabric_configfs.c | 8 +
drivers/target/target_core_iblock.c | 6 +-
drivers/target/target_core_transport.c | 12 +-
drivers/thermal/thermal_hwmon.c | 3 +-
drivers/thunderbolt/eeprom.c | 9 +-
drivers/thunderbolt/icm.c | 2 +-
drivers/thunderbolt/xdomain.c | 40 +-
drivers/tty/serial/8250/8250_dma.c | 12 +-
drivers/tty/serial/8250/8250_of.c | 41 ++
drivers/tty/serial/amba-pl011.c | 8 +-
drivers/tty/serial/imx.c | 20 +-
drivers/tty/serial/qcom_geni_serial.c | 51 +-
drivers/tty/serial/sc16is7xx.c | 222 +++---
drivers/tty/vt/keyboard.c | 5 +-
drivers/tty/vt/vt_ioctl.c | 2 +
drivers/ufs/core/ufshcd.c | 6 +-
drivers/usb/atm/cxacru.c | 2 +
drivers/usb/c67x00/c67x00-sched.c | 4 +-
drivers/usb/cdns3/cdnsp-gadget.c | 4 +-
drivers/usb/core/devio.c | 2 +-
drivers/usb/core/hub.c | 7 +-
drivers/usb/dwc2/gadget.c | 11 +-
drivers/usb/gadget/function/f_fs.c | 14 +-
drivers/usb/gadget/function/f_midi2.c | 2 +
drivers/usb/gadget/function/f_ncm.c | 2 +-
drivers/usb/gadget/function/f_tcm.c | 217 ++++--
drivers/usb/gadget/function/f_uvc.c | 7 +-
drivers/usb/gadget/function/tcm.h | 13 +
drivers/usb/gadget/function/u_audio.c | 24 +-
drivers/usb/gadget/udc/at91_udc.c | 20 +-
drivers/usb/gadget/udc/snps_udc_plat.c | 5 +-
drivers/usb/host/xhci-dbgtty.c | 15 +-
drivers/usb/host/xhci-ring.c | 2 +-
drivers/usb/misc/usbtest.c | 1 +
drivers/usb/phy/phy-fsl-usb.c | 52 +-
drivers/usb/phy/phy-fsl-usb.h | 6 +-
drivers/usb/serial/option.c | 20 +-
drivers/usb/serial/spcp8x5.c | 13 -
drivers/usb/typec/ucsi/ucsi.c | 166 ++---
drivers/usb/typec/ucsi/ucsi.h | 11 +
drivers/usb/typec/ucsi/ucsi_acpi.c | 3 +-
drivers/usb/typec/ucsi/ucsi_ccg.c | 3 +-
drivers/usb/typec/ucsi/ucsi_glink.c | 3 +-
drivers/usb/typec/ucsi/ucsi_stm32g0.c | 3 +-
drivers/vhost/vdpa.c | 9 +-
drivers/vhost/vhost.c | 8 +
drivers/video/fbdev/core/bitblit.c | 9 +-
drivers/video/fbdev/core/fb_io_fops.c | 8 +
.../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +-
drivers/video/fbdev/pvr2fb.c | 4 +-
drivers/video/fbdev/ssd1307fb.c | 72 +-
drivers/video/fbdev/uvesafb.c | 2 +
drivers/video/sticore.c | 22 +-
drivers/w1/slaves/w1_ds28e17.c | 8 +
fs/binfmt_elf.c | 4 +-
fs/binfmt_elf_fdpic.c | 4 +-
fs/binfmt_misc.c | 57 +-
fs/btrfs/block-group.c | 61 +-
fs/btrfs/block-group.h | 3 +-
fs/btrfs/extent-tree.c | 6 +-
fs/btrfs/inode.c | 1 +
fs/btrfs/messages.h | 7 +
fs/btrfs/relocation.c | 87 ++-
fs/btrfs/space-info.c | 2 +-
fs/btrfs/super.c | 8 +-
fs/btrfs/transaction.c | 5 +-
fs/btrfs/zoned.c | 11 +-
fs/btrfs/zoned.h | 6 +-
fs/ceph/addr.c | 164 ++---
fs/ceph/caps.c | 28 +-
fs/ceph/dir.c | 10 +-
fs/ceph/export.c | 26 +-
fs/ceph/file.c | 9 +-
fs/ceph/mds_client.c | 11 +
fs/ceph/mds_client.h | 2 +
fs/ceph/mdsmap.c | 13 +-
fs/ceph/xattr.c | 1 +
fs/crypto/policy.c | 2 +-
fs/ecryptfs/crypto.c | 2 +-
fs/ecryptfs/ecryptfs_kernel.h | 3 +-
fs/ecryptfs/keystore.c | 45 +-
fs/ecryptfs/messaging.c | 11 +-
fs/ecryptfs/miscdev.c | 5 +-
fs/ecryptfs/super.c | 7 +
fs/efivarfs/super.c | 30 +-
fs/erofs/Kconfig | 15 +
fs/erofs/decompressor_lzma.c | 3 +-
fs/eventpoll.c | 17 +-
fs/exec.c | 6 +-
fs/exfat/nls.c | 1 +
fs/ext4/crypto.c | 40 +-
fs/ext4/extents.c | 51 +-
fs/ext4/fast_commit.c | 27 +-
fs/ext4/ialloc.c | 4 +
fs/ext4/xattr.c | 7 +-
fs/f2fs/checkpoint.c | 2 +-
fs/f2fs/compress.c | 15 +-
fs/f2fs/data.c | 16 +-
fs/f2fs/f2fs.h | 8 +-
fs/f2fs/node.c | 2 +-
fs/fat/misc.c | 4 +
fs/fuse/dir.c | 9 +-
fs/fuse/file.c | 4 +-
fs/hugetlbfs/inode.c | 2 +-
fs/jbd2/checkpoint.c | 50 +-
fs/jbd2/commit.c | 2 +-
fs/jfs/inode.c | 2 +-
fs/jfs/jfs_discard.c | 3 +-
fs/jfs/jfs_extent.c | 10 +
fs/lockd/clntproc.c | 3 +
fs/lockd/svcsubs.c | 55 +-
fs/namespace.c | 5 +
fs/nfs/nfs4proc.c | 5 +
fs/nfs/pnfs.c | 1 +
fs/nfsd/flexfilelayoutxdr.c | 20 +-
fs/nfsd/nfs2acl.c | 52 +-
fs/nfsd/nfs3acl.c | 17 +-
fs/nfsd/nfs3proc.c | 38 +
fs/nfsd/nfs4layouts.c | 21 +-
fs/nfsd/nfs4proc.c | 49 +-
fs/nfsd/nfs4state.c | 202 ++++--
fs/nfsd/nfs4xdr.c | 22 +-
fs/nfsd/nfscache.c | 6 +-
fs/nfsd/nfsctl.c | 11 +-
fs/nfsd/nfsfh.c | 4 +-
fs/nfsd/nfsproc.c | 7 +
fs/nfsd/nfssvc.c | 4 +-
fs/nfsd/nfsxdr.c | 32 +-
fs/nfsd/trace.h | 4 +-
fs/nfsd/vfs.c | 33 +-
fs/nilfs2/bmap.c | 2 +-
fs/nilfs2/bmap.h | 2 +-
fs/nilfs2/btree.c | 39 +-
fs/nilfs2/direct.c | 4 +-
fs/nilfs2/ioctl.c | 261 +++----
fs/ntfs3/frecord.c | 9 +
fs/ntfs3/fslog.c | 34 +
fs/ocfs2/cluster/heartbeat.c | 148 +++-
fs/ocfs2/cluster/nodemanager.c | 6 +
fs/ocfs2/cluster/nodemanager.h | 1 +
fs/ocfs2/dir.c | 2 +-
fs/ocfs2/dlm/dlmmaster.c | 6 +
fs/ocfs2/dlm/dlmrecovery.c | 9 +
fs/ocfs2/refcounttree.c | 47 +-
fs/ocfs2/xattr.c | 23 +-
fs/orangefs/devorangefs-req.c | 1 +
fs/orangefs/orangefs-debugfs.c | 1 +
fs/overlayfs/super.c | 3 +-
fs/proc/task_mmu.c | 58 +-
fs/smb/client/cifsfs.c | 15 +-
fs/smb/client/cifsglob.h | 27 -
fs/smb/client/cifssmb.c | 18 +-
fs/smb/client/connect.c | 2 +-
fs/smb/client/dfs_cache.c | 33 +-
fs/smb/client/sess.c | 2 +-
fs/smb/client/smb2file.c | 5 +-
fs/smb/client/transport.c | 8 +-
fs/smb/common/cifsglob.h | 36 +
fs/smb/server/auth.c | 4 +-
fs/smb/server/connection.c | 23 +-
fs/smb/server/connection.h | 5 +
fs/smb/server/oplock.c | 8 +-
fs/smb/server/smb2misc.c | 2 +-
fs/smb/server/smb2ops.c | 28 +-
fs/smb/server/smb2pdu.c | 94 ++-
fs/smb/server/smb2pdu.h | 9 -
fs/smb/server/smb_common.c | 43 +-
fs/smb/server/smb_common.h | 43 +-
fs/smb/server/vfs_cache.c | 87 ++-
fs/smb/server/vfs_cache.h | 4 +-
fs/super.c | 128 ++--
fs/tracefs/event_inode.c | 11 +-
fs/ubifs/auth.c | 2 +-
fs/udf/inode.c | 2 +-
fs/udf/partition.c | 2 +-
fs/userfaultfd.c | 24 +-
fs/verity/measure.c | 15 +-
fs/xfs/libxfs/xfs_attr_leaf.c | 14 +
fs/xfs/libxfs/xfs_format.h | 4 +-
fs/xfs/libxfs/xfs_log_recover.h | 4 +-
fs/xfs/libxfs/xfs_refcount.c | 18 +-
fs/xfs/libxfs/xfs_sb.c | 4 +-
fs/xfs/scrub/agheader.c | 87 +++
fs/xfs/scrub/alloc.c | 5 +-
fs/xfs/scrub/bmap.c | 5 +
fs/xfs/scrub/refcount.c | 2 +-
fs/xfs/scrub/refcount_repair.c | 4 +-
fs/xfs/scrub/trace.h | 12 +-
fs/xfs/xfs_attr_item.c | 24 +-
fs/xfs/xfs_bmap_item.c | 18 +-
fs/xfs/xfs_buf_item.c | 8 +-
fs/xfs/xfs_buf_item.h | 2 +-
fs/xfs/xfs_buf_item_recover.c | 95 ++-
fs/xfs/xfs_dquot.c | 3 +-
fs/xfs/xfs_dquot_item_recover.c | 22 +-
fs/xfs/xfs_extfree_item.c | 43 +-
fs/xfs/xfs_icreate_item.c | 2 +-
fs/xfs/xfs_inode.c | 2 +-
fs/xfs/xfs_inode.h | 2 +
fs/xfs/xfs_inode_item.c | 6 +-
fs/xfs/xfs_inode_item.h | 4 +-
fs/xfs/xfs_inode_item_recover.c | 26 +-
fs/xfs/xfs_log_recover.c | 16 +-
fs/xfs/xfs_refcount_item.c | 16 +-
fs/xfs/xfs_rmap_item.c | 16 +-
fs/xfs/xfs_trans.h | 1 -
include/asm-generic/hugetlb.h | 2 +-
include/asm-generic/pgtable_uffd.h | 17 +
include/drm/drm_exec.h | 20 +-
include/drm/drm_fb_helper.h | 12 -
include/linux/amd-iommu.h | 4 +-
include/linux/can/core.h | 1 +
include/linux/can/skb.h | 2 -
include/linux/dma/qcom_bam_dma.h | 21 +-
include/linux/fs.h | 14 +-
include/linux/hugetlb.h | 2 +
include/linux/ima.h | 12 +
include/linux/jbd2.h | 4 +-
include/linux/libata.h | 4 +-
include/linux/list.h | 15 +-
include/linux/mm_inline.h | 7 +-
include/linux/mm_types.h | 3 +
include/linux/mmap_lock.h | 4 +
include/linux/mmc/sdio_ids.h | 2 +-
include/linux/netdevice.h | 63 +-
include/linux/netfilter/ipset/ip_set.h | 2 +-
include/linux/netfilter/nf_conntrack_sip.h | 2 +-
include/linux/nvmem-provider.h | 6 +
include/linux/pagewalk.h | 7 +-
include/linux/pci-ecam.h | 3 +
include/linux/psp-sev.h | 12 +
include/linux/regulator/consumer.h | 7 +
include/linux/sched.h | 8 +
include/linux/skbuff.h | 24 +
include/linux/sunrpc/svc_rdma_pcl.h | 2 +-
include/linux/swapops.h | 16 +-
include/linux/thunderbolt.h | 3 +
include/linux/trace_events.h | 4 -
include/linux/userfaultfd_k.h | 33 +-
include/net/act_api.h | 19 +
include/net/addrconf.h | 4 +-
include/net/dst.h | 20 +
include/net/inet_frag.h | 6 +-
include/net/inet_hashtables.h | 2 +-
include/net/ip.h | 11 +-
include/net/ip_tunnels.h | 11 +-
include/net/ip_vs.h | 63 +-
include/net/ipv6_frag.h | 5 +-
include/net/neighbour.h | 8 +-
include/net/netfilter/nf_conntrack_expect.h | 5 +-
include/net/netfilter/nf_tables.h | 6 +-
include/net/pkt_cls.h | 18 +
include/net/route.h | 4 +-
include/net/sch_generic.h | 4 +
include/net/sctp/structs.h | 2 +-
include/net/tcp.h | 58 +-
include/scsi/libsas.h | 1 -
include/target/target_core_fabric.h | 2 +
include/trace/events/rxrpc.h | 14 +-
include/uapi/linux/ip_vs.h | 6 -
io_uring/io-wq.c | 9 +-
kernel/audit.c | 11 +-
kernel/auditfilter.c | 12 +-
kernel/bpf/bloom_filter.c | 19 +-
kernel/bpf/offload.c | 10 +-
kernel/bpf/stackmap.c | 9 +-
kernel/bpf/verifier.c | 16 +-
kernel/events/core.c | 161 ++---
kernel/fork.c | 12 +-
kernel/futex/core.c | 85 ++-
kernel/kcov.c | 90 +--
kernel/params.c | 14 +-
kernel/sched/cpufreq_schedutil.c | 26 +-
kernel/sched/psi.c | 6 +
kernel/signal.c | 4 +
kernel/taskstats.c | 3 +-
kernel/time/itimer.c | 2 +-
kernel/time/timer.c | 1 +
kernel/trace/ftrace.c | 9 +-
kernel/trace/ring_buffer.c | 196 +++--
kernel/trace/trace.c | 49 +-
kernel/trace/trace.h | 4 -
kernel/trace/trace_branch.c | 4 +-
kernel/trace/trace_events.c | 10 +-
kernel/trace/trace_events_filter.c | 3 +
kernel/trace/trace_events_hist.c | 4 +-
kernel/trace/trace_events_user.c | 3 +
kernel/trace/trace_functions_graph.c | 8 +-
kernel/trace/trace_hwlat.c | 4 +-
kernel/trace/trace_mmiotrace.c | 33 +-
kernel/trace/trace_osnoise.c | 12 +-
kernel/trace/trace_probe.c | 6 +-
kernel/trace/trace_sched_wakeup.c | 8 +-
lib/.gitignore | 2 -
lib/Kconfig.debug | 5 +-
lib/Makefile | 34 +-
lib/assoc_array.c | 3 +-
lib/rhashtable.c | 1 +
lib/test_fortify/.gitignore | 2 +
lib/test_fortify/Makefile | 29 +
lib/ucs2_string.c | 2 +-
lib/win_minmax.c | 1 +
lib/xarray.c | 3 +
mm/damon/vaddr.c | 6 +-
mm/gup.c | 3 +-
mm/hmm.c | 2 +-
mm/huge_memory.c | 59 +-
mm/hugetlb.c | 59 +-
mm/hugetlb_vmemmap.c | 2 +-
mm/internal.h | 6 +
mm/kasan/quarantine.c | 7 +-
mm/khugepaged.c | 35 +-
mm/kmemleak.c | 51 +-
mm/memcontrol.c | 6 +
mm/memory-failure.c | 2 +-
mm/memory.c | 49 +-
mm/mempolicy.c | 23 +-
mm/migrate.c | 6 +-
mm/migrate_device.c | 5 +-
mm/mincore.c | 2 +-
mm/mm_init.c | 15 +-
mm/page_reporting.c | 6 +-
mm/page_table_check.c | 12 +-
mm/pagewalk.c | 89 ++-
mm/percpu-km.c | 2 +-
mm/ptdump.c | 10 +-
mm/rmap.c | 60 +-
mm/swapfile.c | 7 +
mm/userfaultfd.c | 38 +-
mm/vmalloc.c | 49 +-
mm/vmscan.c | 2 +-
mm/zsmalloc.c | 47 +-
mm/zswap.c | 18 +-
net/atm/common.c | 14 +-
net/batman-adv/tvlv.c | 5 +-
net/bluetooth/eir.c | 3 +-
net/bluetooth/hci_conn.c | 17 +-
net/bluetooth/hci_core.c | 2 +-
net/bluetooth/hci_event.c | 15 +-
net/bluetooth/hci_sync.c | 187 +++--
net/bluetooth/hidp/core.c | 30 +-
net/bluetooth/iso.c | 151 ++--
net/bluetooth/l2cap_core.c | 5 +
net/bluetooth/mgmt.c | 84 ++-
net/bluetooth/rfcomm/core.c | 32 +-
net/bridge/br_mrp.c | 8 +-
net/bridge/br_multicast.c | 5 +-
net/bridge/br_netfilter_hooks.c | 6 +-
net/bridge/netfilter/ebt_nflog.c | 17 +-
net/bridge/netfilter/nf_conntrack_bridge.c | 1 +
net/can/af_can.c | 14 +-
net/can/bcm.c | 2 -
net/can/isotp.c | 333 ++++++---
net/can/j1939/bus.c | 2 +
net/can/j1939/j1939-priv.h | 4 +
net/can/j1939/main.c | 13 +-
net/can/j1939/socket.c | 56 +-
net/can/j1939/transport.c | 6 +-
net/can/raw.c | 7 +-
net/ceph/cls_lock_client.c | 21 +-
net/ceph/decode.c | 18 +-
net/ceph/osd_client.c | 35 +-
net/ceph/osdmap.c | 11 +-
net/core/dev.c | 13 +
net/core/dst.c | 4 +-
net/core/gro.c | 7 +-
net/core/lwt_bpf.c | 4 +-
net/core/pktgen.c | 43 +-
net/core/skbuff.c | 5 +-
net/core/sock.c | 9 +-
net/core/xdp.c | 6 +-
net/devlink/dev.c | 1 +
net/ieee802154/6lowpan/reassembly.c | 27 +-
net/ipv4/bpf_tcp_ca.c | 2 +-
net/ipv4/fib_semantics.c | 101 +--
net/ipv4/icmp.c | 28 +-
net/ipv4/igmp.c | 2 +-
net/ipv4/inet_connection_sock.c | 20 +-
net/ipv4/inet_fragment.c | 40 +-
net/ipv4/ip_fragment.c | 54 +-
net/ipv4/ip_output.c | 8 +-
net/ipv4/ip_tunnel.c | 2 +-
net/ipv4/ip_vti.c | 4 +-
net/ipv4/ipip.c | 2 +-
net/ipv4/ipmr.c | 2 +-
net/ipv4/netfilter.c | 4 +-
net/ipv4/route.c | 41 +-
net/ipv4/tcp_ao.c | 19 +-
net/ipv4/tcp_bpf.c | 2 +
net/ipv4/tcp_dctcp.h | 2 +-
net/ipv4/tcp_fastopen.c | 4 +-
net/ipv4/tcp_input.c | 64 +-
net/ipv4/tcp_ipv4.c | 289 ++++++--
net/ipv4/tcp_metrics.c | 8 +-
net/ipv4/tcp_minisocks.c | 12 +-
net/ipv4/tcp_output.c | 6 +-
net/ipv4/tcp_timer.c | 4 +-
net/ipv4/udp_offload.c | 4 +-
net/ipv4/udp_tunnel_nic.c | 32 +-
net/ipv4/xfrm4_output.c | 2 +-
net/ipv6/ah6.c | 29 +-
net/ipv6/fib6_rules.c | 1 +
net/ipv6/ip6_gre.c | 14 +-
net/ipv6/ip6_output.c | 4 +-
net/ipv6/ip6_tunnel.c | 25 +-
net/ipv6/ndisc.c | 10 +-
net/ipv6/netfilter/nf_conntrack_reasm.c | 27 +-
net/ipv6/reassembly.c | 29 +-
net/ipv6/route.c | 10 +-
net/ipv6/seg6_local.c | 16 +
net/ipv6/sit.c | 2 +-
net/iucv/af_iucv.c | 2 +
net/l2tp/l2tp_core.c | 57 +-
net/l2tp/l2tp_core.h | 6 +-
net/l2tp/l2tp_debugfs.c | 8 +-
net/l2tp/l2tp_eth.c | 8 +-
net/l2tp/l2tp_ip.c | 4 +-
net/l2tp/l2tp_ip6.c | 4 +-
net/l2tp/l2tp_netlink.c | 54 +-
net/l2tp/l2tp_ppp.c | 30 +-
net/mac80211/s1g.c | 4 +
net/mac802154/scan.c | 4 +
net/mpls/af_mpls.c | 3 +
net/mptcp/fastopen.c | 7 +-
net/mptcp/options.c | 67 +-
net/mptcp/pm.c | 9 +-
net/mptcp/pm_netlink.c | 38 +-
net/mptcp/pm_userspace.c | 94 +--
net/mptcp/protocol.c | 9 +
net/mptcp/protocol.h | 14 +-
net/mptcp/syncookies.c | 1 +
net/ncsi/ncsi-netlink.c | 4 +
net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +-
net/netfilter/ipset/ip_set_core.c | 25 +-
net/netfilter/ipset/ip_set_hash_gen.h | 4 +-
net/netfilter/ipset/ip_set_list_set.c | 12 +-
net/netfilter/ipvs/ip_vs_app.c | 4 +-
net/netfilter/ipvs/ip_vs_conn.c | 48 +-
net/netfilter/ipvs/ip_vs_core.c | 236 +++---
net/netfilter/ipvs/ip_vs_ctl.c | 83 ++-
net/netfilter/ipvs/ip_vs_dh.c | 4 +-
net/netfilter/ipvs/ip_vs_est.c | 10 +-
net/netfilter/ipvs/ip_vs_lblc.c | 2 +-
net/netfilter/ipvs/ip_vs_lblcr.c | 8 +-
net/netfilter/ipvs/ip_vs_lc.c | 4 +-
net/netfilter/ipvs/ip_vs_proto_sctp.c | 21 +-
net/netfilter/ipvs/ip_vs_proto_tcp.c | 50 +-
net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +-
net/netfilter/ipvs/ip_vs_sync.c | 7 +-
net/netfilter/ipvs/ip_vs_xmit.c | 42 +-
net/netfilter/nf_conntrack_broadcast.c | 1 +
net/netfilter/nf_conntrack_core.c | 7 +-
net/netfilter/nf_conntrack_expect.c | 1 +
net/netfilter/nf_conntrack_h323_main.c | 12 +-
net/netfilter/nf_conntrack_helper.c | 5 +
net/netfilter/nf_conntrack_netlink.c | 18 +-
net/netfilter/nf_conntrack_proto.c | 6 +
net/netfilter/nf_conntrack_proto_sctp.c | 12 +-
net/netfilter/nf_conntrack_proto_tcp.c | 132 ++--
net/netfilter/nf_conntrack_sip.c | 4 +-
net/netfilter/nf_flow_table_core.c | 7 +-
net/netfilter/nf_nat_sip.c | 2 +-
net/netfilter/nf_tables_api.c | 80 ++-
net/netfilter/nf_tables_offload.c | 2 +-
net/netfilter/nft_payload.c | 12 +-
net/netfilter/nft_set_pipapo.c | 11 +-
net/netfilter/xt_hashlimit.c | 16 +-
net/nfc/digital_technology.c | 2 +
net/nfc/llcp_commands.c | 18 +-
net/nfc/llcp_core.c | 15 +-
net/nfc/nci/ntf.c | 36 +-
net/nfc/nci/rsp.c | 1 +
net/openvswitch/actions.c | 12 +-
net/openvswitch/conntrack.c | 8 +-
net/openvswitch/datapath.c | 77 +-
net/openvswitch/flow.c | 11 +-
net/openvswitch/meter.c | 33 +-
net/packet/af_packet.c | 79 +-
net/rds/ib.c | 4 +
net/rds/ib_cm.c | 4 +
net/rds/tcp.c | 14 +-
net/rxrpc/ar-internal.h | 34 +-
net/rxrpc/call_accept.c | 1 +
net/rxrpc/call_event.c | 19 +-
net/rxrpc/call_object.c | 2 +
net/rxrpc/input.c | 12 +-
net/rxrpc/output.c | 14 +-
net/rxrpc/peer_object.c | 21 +-
net/rxrpc/proc.c | 6 +-
net/rxrpc/rtt.c | 102 +--
net/rxrpc/sendmsg.c | 2 +-
net/sched/act_api.c | 10 +-
net/sched/act_ct.c | 29 +-
net/sched/act_gact.c | 5 +
net/sched/act_police.c | 6 +
net/sched/cls_api.c | 47 +-
net/sched/cls_bpf.c | 20 +-
net/sched/cls_flower.c | 2 +
net/sched/cls_matchall.c | 2 +
net/sched/cls_route.c | 35 +-
net/sched/cls_u32.c | 7 +
net/sched/sch_api.c | 33 +-
net/sched/sch_cake.c | 1 -
net/sched/sch_generic.c | 2 +-
net/sctp/associola.c | 14 +-
net/sctp/inqueue.c | 7 +-
net/sctp/outqueue.c | 1 +
net/sctp/sm_make_chunk.c | 20 +-
net/sctp/sm_sideeffect.c | 4 +
net/sctp/sm_statefuns.c | 6 +-
net/sctp/stream.c | 48 +-
net/smc/af_smc.c | 6 +-
net/smc/smc_clc.c | 67 +-
net/smc/smc_core.c | 56 +-
net/smc/smc_llc.c | 3 +-
net/smc/smc_pnet.c | 43 +-
net/smc/smc_rx.c | 30 +-
net/smc/smc_tx.h | 6 +-
net/sunrpc/auth_gss/auth_gss.c | 6 +-
net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +-
net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 -
net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 -
net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 +
net/sunrpc/auth_gss/svcauth_gss.c | 8 +-
net/sunrpc/cache.c | 7 +-
net/sunrpc/sunrpc_syms.c | 1 +
net/sunrpc/svc.c | 74 +-
net/sunrpc/xdr.c | 2 +-
net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 +-
net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 +-
net/sunrpc/xprtrdma/svc_rdma_transport.c | 42 +-
net/sunrpc/xprtsock.c | 12 +-
net/tipc/node.c | 15 +-
net/tipc/socket.c | 2 +-
net/tls/tls_device.c | 3 +-
net/tls/tls_sw.c | 21 +-
net/vmw_vsock/virtio_transport.c | 16 +-
net/x25/af_x25.c | 4 +-
net/x25/x25_timer.c | 25 +-
net/xdp/xdp_umem.c | 2 +
net/xfrm/espintcp.c | 9 +-
net/xfrm/xfrm_state.c | 4 +-
net/xfrm/xfrm_user.c | 2 +-
scripts/remove-stale-files | 2 +
security/apparmor/include/cred.h | 6 +-
security/apparmor/include/label.h | 6 +-
security/apparmor/include/task.h | 15 +-
security/apparmor/task.c | 27 +
security/integrity/ima/ima_appraise.c | 9 +-
security/integrity/ima/ima_main.c | 36 +
security/keys/keyring.c | 14 +-
security/security.c | 17 +-
security/selinux/include/security.h | 1 +
security/selinux/ss/avtab.c | 43 +-
security/selinux/ss/avtab.h | 93 +--
security/selinux/ss/conditional.c | 52 +-
security/selinux/ss/conditional.h | 6 +-
security/selinux/ss/constraint.h | 68 +-
security/selinux/ss/ebitmap.c | 4 +-
security/selinux/ss/ebitmap.h | 5 +-
security/selinux/ss/mls.c | 6 +-
security/selinux/ss/policydb.c | 791 +++++++++++++--------
security/selinux/ss/policydb.h | 227 +++---
security/selinux/ss/services.c | 36 +-
security/smack/smack_lsm.c | 2 +-
sound/core/pcm_native.c | 7 +
sound/core/seq/seq_timer.c | 9 +-
sound/core/timer.c | 2 +
sound/core/ump.c | 1 +
sound/core/ump_convert.c | 1 +
sound/drivers/aloop.c | 6 +
sound/drivers/dummy.c | 6 +
sound/drivers/mpu401/mpu401.c | 6 +
sound/drivers/mts64.c | 6 +
sound/drivers/portman2x4.c | 6 +
sound/drivers/serial-u16550.c | 6 +
sound/drivers/virmidi.c | 6 +
sound/pci/hda/patch_hdmi.c | 48 +-
sound/pci/hda/patch_realtek.c | 1 +
sound/pci/lx6464es/lx6464es.c | 5 +-
sound/pci/lx6464es/lx_core.c | 5 +-
sound/pci/pcxhr/pcxhr.c | 14 +-
sound/soc/amd/yc/acp6x-mach.c | 7 +
sound/soc/codecs/cs35l41-lib.c | 2 +-
sound/soc/codecs/cs35l45-tables.c | 32 +-
sound/soc/codecs/cs4265.c | 4 +-
sound/soc/codecs/lpass-tx-macro.c | 4 +-
sound/soc/codecs/lpass-wsa-macro.c | 8 +-
sound/soc/codecs/max98090.c | 5 +-
sound/soc/codecs/max98095.c | 5 +-
sound/soc/codecs/nau8821.c | 13 +
sound/soc/codecs/tas2562.c | 39 +-
sound/soc/sof/ipc3-pcm.c | 13 +-
sound/soc/sof/ipc3-topology.c | 20 +-
sound/soc/sof/ipc4-pcm.c | 35 +-
sound/soc/sof/ipc4-topology.c | 18 +-
sound/soc/sof/pcm.c | 157 ++--
sound/soc/sof/sof-audio.c | 45 +-
sound/soc/sof/sof-audio.h | 17 +-
sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +-
sound/usb/6fire/chip.c | 4 +
sound/usb/6fire/comm.c | 9 +-
sound/usb/bcd2000/bcd2000.c | 11 +-
sound/usb/card.c | 14 +-
sound/usb/endpoint.c | 20 +-
sound/usb/midi.c | 4 +
sound/usb/midi2.c | 13 +-
sound/usb/mixer.c | 6 +
sound/usb/mixer.h | 2 +
sound/usb/mixer_quirks.c | 2 +-
sound/usb/mixer_scarlett2.c | 98 ++-
sound/usb/usx2y/usX2Yhwdep.c | 2 +
sound/usb/usx2y/usx2yhwdeppcm.c | 2 +
tools/include/linux/compiler.h | 2 +-
tools/testing/kunit/kunit_kernel.py | 39 +-
tools/testing/kunit/kunit_tool_test.py | 42 ++
.../selftests/bpf/prog_tests/sockmap_basic.c | 6 +-
.../selftests/bpf/prog_tests/sockmap_listen.c | 21 +-
tools/testing/selftests/bpf/test_maps.c | 13 +-
tools/testing/selftests/clone3/clone3_set_tid.c | 2 +-
.../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +-
tools/testing/selftests/mm/mlock-random-test.c | 2 +-
tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +-
1183 files changed, 15033 insertions(+), 8469 deletions(-)
delete mode 100644 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c
delete mode 100644 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c
rename drivers/net/wireless/realtek/rtl8xxxu/{rtl8xxxu_8188e.c => 8188e.c} (99%)
rename drivers/net/wireless/realtek/rtl8xxxu/{rtl8xxxu_8188f.c => 8188f.c} (99%)
rename drivers/net/wireless/realtek/rtl8xxxu/{rtl8xxxu_8192c.c => 8192c.c} (99%)
rename drivers/net/wireless/realtek/rtl8xxxu/{rtl8xxxu_8192e.c => 8192e.c} (99%)
rename drivers/net/wireless/realtek/rtl8xxxu/{rtl8xxxu_8192f.c => 8192f.c} (99%)
rename drivers/net/wireless/realtek/rtl8xxxu/{rtl8xxxu_8710b.c => 8710b.c} (99%)
rename drivers/net/wireless/realtek/rtl8xxxu/{rtl8xxxu_8723a.c => 8723a.c} (99%)
rename drivers/net/wireless/realtek/rtl8xxxu/{rtl8xxxu_8723b.c => 8723b.c} (99%)
rename drivers/net/wireless/realtek/rtl8xxxu/{rtl8xxxu_core.c => core.c} (99%)
rename drivers/net/wireless/realtek/rtl8xxxu/{rtl8xxxu_regs.h => regs.h} (100%)
create mode 100644 drivers/nvmem/layouts/fixed-layout.c
create mode 100644 lib/test_fortify/.gitignore
create mode 100644 lib/test_fortify/Makefile
More information about the kernel-team
mailing list