6.12.2-rc1 review

This is the start of the stable review cycle for the 6.12.2 release. There are 826 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 05 Dec 2024 14:45:11 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.2-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.12.2-rc1

Ming Lei <[email protected]>
block: don't verify IO lock for freeze/unfreeze in elevator_init_mq()

Ming Lei <[email protected]>
block: always verify unfreeze lock on the owner task

Patryk Wlazlyn <[email protected]>
tools/power turbostat: Fix child's argument forwarding

Zhang Rui <[email protected]>
tools/power turbostat: Fix trailing '\n' parsing

Dan Carpenter <[email protected]>
sh: intc: Fix use-after-free bug in register_intc_controller()

Zhang Xianwei <[email protected]>
brd: decrease the number of allocated pages which discarded

Yu Kuai <[email protected]>
block, bfq: fix bfqq uaf in bfq_limit_depth()

Benjamin Coddington <[email protected]>
nfs/blocklayout: Limit repeat device registration on failure

Benjamin Coddington <[email protected]>
nfs/blocklayout: Don't attempt unregister for invalid block device

Liu Jian <[email protected]>
sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket

Benjamin Coddington <[email protected]>
SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT

Liu Jian <[email protected]>
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport

Li Lingfeng <[email protected]>
nfs: ignore SB_RDONLY when mounting nfs

Dan Carpenter <[email protected]>
cifs: unlock on error in smb3_reconfigure()

Shyam Prasad N <[email protected]>
cifs: during remount, make sure passwords are in sync

Masahiro Yamada <[email protected]>
modpost: remove incorrect code in do_eisa_entry()

John Garry <[email protected]>
block: Don't allow an atomic write be truncated in blkdev_write_iter()

Paul Aurich <[email protected]>

    smb: Initialize cfid->tcon before performing network ops

Matt Fleming <[email protected]>
kbuild: deb-pkg: Don't fail if modules.order is missing

Masahiro Yamada <[email protected]>
Rename .data.once to .data..once to fix resetting WARN*_ONCE

Masahiro Yamada <[email protected]>
Rename .data.unlikely to .data..unlikely

Maxime Chevallier <[email protected]>
rtc: ab-eoz9: don't fail temperature reads on undervoltage notification

Pali Rohár <[email protected]>
cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE session

Pali Rohár <[email protected]>
cifs: Fix parsing native symlinks relative to the export

Andy Shevchenko <[email protected]>
x86/Documentation: Update algo in init_size description of boot protocol

Henrique Carvalho <[email protected]>
smb: client: disable directory caching when dir_cache_timeout is zero

Namhyung Kim <[email protected]>
perf/arm-cmn: Ensure port and device id bits are set properly

Chun-Tse Shao <[email protected]>

    perf/arm-smmuv3: Fix lockdep assert in ->event_init()

Alex Zenla <[email protected]>
9p/xen: fix release of IRQ

Alex Zenla <[email protected]>
9p/xen: fix init sequence

Nilay Shroff <[email protected]>
nvme-fabrics: fix kernel crash while shutting down controller

Christoph Hellwig <[email protected]>
block: return unsigned int from bdev_io_min

Yu Kuai <[email protected]>
block: fix uaf for flush rq while iterating tags

Ming Lei <[email protected]>
block: model freeze & enter queue as lock for supporting lockdep

Ming Lei <[email protected]>
blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs

Breno Leitao <[email protected]>
nvme/multipath: Fix RCU list traversal to use SRCU primitive

Trond Myklebust <[email protected]>
Revert "nfs: don't reuse partially completed requests in nfs_lock_and_join_requests"

Wolfram Sang <[email protected]>
rtc: rzn1: fix BCD to rtc_time conversion errors

Mirsad Todorovac <[email protected]>
net/9p/usbg: fix handling of the failed kzalloc() memory allocation

ZhangPeng <[email protected]>
hostfs: Fix the NULL vs IS_ERR() bug for __filemap_get_folio()

Qingfang Deng <[email protected]>
jffs2: fix use of uninitialized variable

Waqar Hameed <[email protected]>
ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit

Zhihao Cheng <[email protected]>
ubi: fastmap: Fix duplicate slab cache names while attaching

Zhihao Cheng <[email protected]>
ubifs: Correct the total block count by deducting journal reservation

Zhihao Cheng <[email protected]>
ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty

Yongliang Gao <[email protected]>
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()

Nobuhiro Iwamatsu <[email protected]>

    rtc: abx80x: Fix WDT bit position of the status register

Jinjie Ruan <[email protected]>
rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()

NeilBrown <[email protected]>
nfs/localio: must clear res.replen in nfs_local_read_done

Trond Myklebust <[email protected]>
NFSv4.0: Fix a use-after-free problem in the asynchronous open()

Tiwei Bie <[email protected]>
um: Always dump trace for specified task in show_stack

Tiwei Bie <[email protected]>
um: ubd: Initialize ubd's disk pointer in ubd_add

Christoph Hellwig <[email protected]>
kfifo: don't include dma-mapping.h in kfifo.h

Tiwei Bie <[email protected]>
um: Fix the return value of elf_core_copy_task_fpregs

Tiwei Bie <[email protected]>
um: Fix potential integer overflow during physmem setup

Yang Erkun <[email protected]>
SUNRPC: make sure cache entry active before cache_show

Chuck Lever <[email protected]>
NFSD: Prevent a potential integer overflow

Yuan Can <[email protected]>
Input: cs40l50 - fix wrong usage of INIT_WORK()

Ma Wupeng <[email protected]>
ipc: fix memleak if msg_init_ns failed in create_ipc_ns

Chao Yu <[email protected]>
f2fs: fix to do sanity check on node blkaddr in truncate_node()

Bartosz Golaszewski <[email protected]>
lib: string_helpers: silence snprintf() output truncation warning

Ming Lei <[email protected]>
ublk: fix error code for unsupported command

Javier Carrasco <[email protected]>
counter: stm32-timer-cnt: fix device_node handling in probe_encoder()

Javier Carrasco <[email protected]>
staging: vchiq_arm: Fix missing refcount decrement in error path for fw_node

Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix looping of queued SG entries

Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix checking for number of TRBs left

Selvarasu Ganesan <[email protected]>
usb: dwc3: gadget: Add missing check for single port RAM in TxFIFO resizing logic

Hubert Wiśniewski <[email protected]>
usb: musb: Fix hardware lockup on first Rx endpoint request

Thinh Nguyen <[email protected]>
usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED

Stanislaw Gruszka <[email protected]>
usb: misc: ljca: move usb_autopm_put_interface() after wait for response

Stanislaw Gruszka <[email protected]>
usb: misc: ljca: set small runtime autosuspend delay

Paul Aurich <[email protected]>
smb: During unmount, ensure all cached dir instances drop their dentry

Paul Aurich <[email protected]>
smb: prevent use-after-free due to open_cached_dir error paths

Paul Aurich <[email protected]>
smb: Don't leak cfid when reconnect races with open_cached_dir

Paulo Alcantara <[email protected]>
smb: client: handle max length for SMB symlinks

Steve French <[email protected]>
smb3: request handle caching when caching directories

Paulo Alcantara <[email protected]>
smb: client: fix use-after-free of signing key

Ralph Boehme <[email protected]>
fs/smb/client: implement chmod() for SMB3 POSIX Extensions

Takashi Iwai <[email protected]>
ALSA: hda/realtek: Apply quirk for Medion E15433

Dirk Su <[email protected]>
ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook X G1i

Dinesh Kumar <[email protected]>
ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max

Kailang Yang <[email protected]>
ALSA: hda/realtek: Set PCBeep to default value for ALC274

Kailang Yang <[email protected]>
ALSA: hda/realtek: Enable speaker pins for Medion E15443 platform

Kailang Yang <[email protected]>
ALSA: hda/realtek: Update ALC225 depop procedure

Takashi Iwai <[email protected]>
ALSA: pcm: Add sanity NULL check for the default mmap fault handler

Takashi Iwai <[email protected]>
ALSA: ump: Fix evaluation of MIDI 1.0 FB info

Takashi Iwai <[email protected]>
ALSA: rawmidi: Fix kvfree() call in spinlock

Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Flush patch buffer mapping after application

Borislav Petkov (AMD) <[email protected]>
x86/mm: Carve out INVLPG inline asm for use by others

Hans Verkuil <[email protected]>
media: v4l2-core: v4l2-dv-timings: check cvt/gtf result

Javier Carrasco <[email protected]>
soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting()

Herve Codina <[email protected]>
soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure

Joe Damato <[email protected]>
netdev-genl: Hold rcu_read_lock in napi_get

Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8186-corsola-voltorb: Merge speaker codec nodes

Stanislaw Gruszka <[email protected]>
media: intel/ipu6: do not handle interrupts when device is disabled

Qiu-ji Chen <[email protected]>
media: wl128x: Fix atomicity violation in fmc_send_cmd()

Peter Große <[email protected]>
i40e: Fix handling changed priv flags

Jason Gerecke <[email protected]>
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values

Ziwei Xiao <[email protected]>
gve: Flow steering trigger reset only for timeout error

Bart Van Assche <[email protected]>
blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long

Muchun Song <[email protected]>
block: fix ordering between checking BLK_MQ_S_STOPPED request adding

Muchun Song <[email protected]>
block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding

Muchun Song <[email protected]>
block: fix missing dispatching request when queue is started or unquiesced

Will Deacon <[email protected]>
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled

Ming Lei <[email protected]>
ublk: fix ublk_ch_mmap() for 64K page size

Zicheng Qu <[email protected]>
iio: gts: Fix uninitialized symbol 'ret'

Huacai Chen <[email protected]>
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK

Tiwei Bie <[email protected]>
um: vector: Do not use drvdata in release

Damien Le Moal <[email protected]>
block: Prevent potential deadlock in blk_revalidate_disk_zones()

Javier Carrasco <[email protected]>
mtd: ubi: fix unreleased fwnode_handle in find_volume_fwnode()

Zach Wade <[email protected]>
Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()"

Arnd Bergmann <[email protected]>
serial: amba-pl011: fix build regression

Kartik Rajput <[email protected]>
serial: amba-pl011: Fix RX stall when DMA is used

Bin Liu <[email protected]>
serial: 8250: omap: Move pm_runtime_get_sync

Filip Brozovic <[email protected]>

    serial: 8250_fintek: Add support for F81216E

Michal Simek <[email protected]>
dt-bindings: serial: rs485: Fix rs485-rts-delay property

Tiwei Bie <[email protected]>
um: net: Do not use drvdata in release

Tiwei Bie <[email protected]>
um: ubd: Do not use drvdata in release

Zhihao Cheng <[email protected]>
ubi: wl: Put source PEB into correct list if trying locking LEB failed

Sebastian Andrzej Siewior <[email protected]>
x86/CPU/AMD: Terminate the erratum_1386_microcode array

Russell King (Oracle) <[email protected]>
irqchip/irq-mvebu-sei: Move misplaced select() callback to SEI CP domain

Javier Carrasco <[email protected]>
platform/chrome: cros_ec_typec: fix missing fwnode reference decrement

Paulo Alcantara <[email protected]>
smb: client: fix NULL ptr deref in crypto_aead_setkey()

Yunseong Kim <[email protected]>
ksmbd: fix use-after-free in SMB request handling

Jesse Taube <[email protected]>
RISC-V: Check scalar unaligned access on all CPUs

Jesse Taube <[email protected]>
RISC-V: Scalar unaligned access emulated on hotplug CPUs

Josh Poimboeuf <[email protected]>
parisc/ftrace: Fix function graph tracing disablement

Meetakshi Setiya <[email protected]>
cifs: support mounting with alternate password to allow password rotation

Jinjie Ruan <[email protected]>
cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power()

Cheng Ming Lin <[email protected]>
mtd: spi-nor: core: replace dummy buswidth from addr to data

Stanislaw Gruszka <[email protected]>
spi: Fix acpi deferred irq probe

Jeongjun Park <[email protected]>
netfilter: ipset: add missing range check in bitmap_ip_uadt

Sai Kumar Cholleti <[email protected]>
gpio: exar: set value when external pull-up or pull-down is present

Mikulas Patocka <[email protected]>
blk-settings: round down io_opt to physical_block_size

Pavel Begunkov <[email protected]>
io_uring: check for overflows in io_pin_pages

Pavel Begunkov <[email protected]>
io_uring: fix corner case forgetting to vunmap

Greg Kroah-Hartman <[email protected]>
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"

Claudiu Beznea <[email protected]>
serial: sh-sci: Clean sci_ports[0] after at earlycon exit

Michal Vrastil <[email protected]>
Revert "usb: gadget: composite: fix OS descriptors w_value logic"

Jaegeuk Kim <[email protected]>
Revert "f2fs: remove unreachable lazytime mount option parsing"

Christian Brauner <[email protected]>
Revert "fs: don't block i_writecount during exec"

Javier Carrasco <[email protected]>
wifi: brcmfmac: release 'root' node in all execution paths

Jose Ignacio Tornos Martinez <[email protected]>
wifi: ath12k: fix crash when unbinding

Aleksei Vetrov <[email protected]>
wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan

Guilherme G. Piccoli <[email protected]>
wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures

Jose Ignacio Tornos Martinez <[email protected]>
wifi: ath12k: fix warning when unbinding

Andreas Kemnade <[email protected]>
ARM: dts: omap36xx: declare 1GHz OPP as turbo again

Michal Pecio <[email protected]>
usb: xhci: Avoid queuing redundant Stop Endpoint commands

Michal Pecio <[email protected]>
usb: xhci: Fix TD invalidation under pending Set TR Dequeue

Michal Pecio <[email protected]>
usb: xhci: Limit Stop Endpoint retries

Andrej Shadura <[email protected]>
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()

Kuangyi Chiang <[email protected]>
xhci: Don't issue Reset Device command to Etron xHCI host

Kuangyi Chiang <[email protected]>
xhci: Don't perform Soft Retry for Etron xHCI host

Kuangyi Chiang <[email protected]>
xhci: Combine two if statements for Etron xHCI host

Kuangyi Chiang <[email protected]>
xhci: Fix control transfer error on Etron xHCI host

Yuezhang Mo <[email protected]>
exfat: fix out-of-bounds access of directory entries

Namjae Jeon <[email protected]>
exfat: fix uninit-value in __exfat_get_dentry_set

Angelo Dureghello <[email protected]>
dt-bindings: iio: dac: ad3552r: fix maximum spi speed

Krzysztof Kozlowski <[email protected]>
dt-bindings: pinctrl: samsung: Fix interrupt constraint for variants with fallbacks

Johan Hovold <[email protected]>
pinctrl: qcom: spmi: fix debugfs drive strength

Christian Brauner <[email protected]>
fcntl: make F_DUPFD_QUERY associative

Thomas Weißschuh <[email protected]>
tools/nolibc: s390: include std.h

Ahmed Ehab <[email protected]>
locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass()

Nicolas Bouchinet <[email protected]>
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler

Angelo Dureghello <[email protected]>
iio: dac: adi-axi-dac: fix wrong register bitfield

Jinjie Ruan <[email protected]>
apparmor: test: Fix memory leak for aa_unpack_strdup()

Jann Horn <[email protected]>
comedi: Flush partial mappings in error case

Jann Horn <[email protected]>
fsnotify: Fix ordering of iput() and watched_objects decrement

Amir Goldstein <[email protected]>
fsnotify: fix sending inotify event with unexpected filename

Gustavo A. R. Silva <[email protected]>
clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access

Gustavo A. R. Silva <[email protected]>
clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider

Huacai Chen <[email protected]>
LoongArch: Explicitly specify code model in Makefile

Lukas Wunner <[email protected]>

    PCI: Fix use-after-free of slot->bus on hot remove

Jan Hendrik Farr <[email protected]>
Compiler Attributes: disable __counted_by for clang < 19.1.3

Kunkun Jiang <[email protected]>
KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device

Jing Zhang <[email protected]>
KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*

Raghavendra Rao Ananta <[email protected]>
KVM: arm64: Get rid of userspace_irqchip_in_use

Kunkun Jiang <[email protected]>
KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE

Oliver Upton <[email protected]>
KVM: arm64: Don't retire aborted MMIO instruction

Sean Christopherson <[email protected]>
Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()"

Raghavendra Rao Ananta <[email protected]>
KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status

Marc Zyngier <[email protected]>
KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR

Gautam Menghani <[email protected]>
powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector

Sean Christopherson <[email protected]>

    KVM: x86: Break CONFIG_KVM_X86's direct dependency on KVM_INTEL || KVM_AMD

Arnd Bergmann <[email protected]>
KVM: x86: add back X86_LOCAL_APIC dependency

Sean Christopherson <[email protected]>
KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE

Paolo Bonzini <[email protected]>
KVM: x86: switch hugepage recovery thread to vhost_task

Eric Biggers <[email protected]>
crypto: x86/aegis128 - access 32-bit arguments as 32-bit

Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix buffer full but size is 0 case

Claudiu Beznea <[email protected]>
ASoC: da7213: Populate max_register to regmap_config

Qiu-ji Chen <[email protected]>
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()

Ilya Zverev <[email protected]>
ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00

Artem Sadovnikov <[email protected]>
jfs: xattr: check invalid xattr size more strictly

Mauro Carvalho Chehab <[email protected]>
docs: media: update location of the media patches

Mauro Carvalho Chehab <[email protected]>
MAINTAINERS: update location of media main tree

Theodore Ts'o <[email protected]>
ext4: fix FS_IOC_GETFSMAP handling

Jeongjun Park <[email protected]>
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()

Darrick J. Wong <[email protected]>
xfs: fix simplify extent lookup in xfs_can_free_eofblocks

Dmitry Baryshkov <[email protected]>
usb: typec: ucsi: glink: fix off-by-one in connector_status

Vitalii Mordan <[email protected]>
usb: ehci-spear: fix call balance of sehci clk handling routines

Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix out of bounds reads when finding clock sources

Benoît Sevens <[email protected]>
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

Qiu-ji Chen <[email protected]>
xen: Fix the issue of resource not being properly released in xenbus_dev_probe()

Jakub Kicinski <[email protected]>
net_sched: sch_fq: don't follow the fast path if Tx is behind now

Xiuhong Wang <[email protected]>
f2fs: fix fiemap failure issue when page size is 16KB

Niklas Schnelle <[email protected]>
s390/pci: Fix potential double remove of hotplug slot

Nícolas F. R. A. Prado <[email protected]>
ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe

Venkata Prasad Potturu <[email protected]>
ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry

Zichen Xie <[email protected]>
ALSA: core: Fix possible NULL dereference caused by kunit_kzalloc()

chao liu <[email protected]>
apparmor: fix 'Do simple duplicate message elimination'

Nirmoy Das <[email protected]>

    drm/xe/ufence: Wake up waiters after setting ufence->signalled

Charles Han <[email protected]>
ASoC: imx-audmix: Add NULL check in imx_audmix_probe

Zicheng Qu <[email protected]>

    drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp

Zicheng Qu <[email protected]>

    drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe

Steven 'Steve' Kendall <[email protected]>
drm/radeon: Fix spurious unplug event on radeon HDMI

Kailang Yang <[email protected]>
ALSA: hda/realtek: Update ALC256 depop procedure

Gaosheng Cui <[email protected]>
firmware_loader: Fix possible resource leak in fw_log_firmware_info()

Dan Carpenter <[email protected]>
usb: typec: fix potential array underflow in ucsi_ccg_sync_control()

Carl Vanderlip <[email protected]>
bus: mhi: host: Switch trace_mhi_gen_tre fields to native endian

Jiasheng Jiang <[email protected]>
counter: ti-ecap-capture: Add check for clk_enable()

Jiasheng Jiang <[email protected]>
counter: stm32-timer-cnt: Add check for clk_enable()

Charles Han <[email protected]>
phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe

Charles Han <[email protected]>
phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe

Antoniu Miclaus <[email protected]>
iio: accel: adxl380: fix raw sample read

Andy Shevchenko <[email protected]>
iio: adc: pac1921: Check for error code from devm_mutex_init() call

Andy Shevchenko <[email protected]>
iio: adc: ad4000: Check for error code from devm_mutex_init() call

David Lechner <[email protected]>
iio: adc: ad4000: fix reading unsigned data

Yang Yingliang <[email protected]>
iio: backend: fix wrong pointer passed to IS_ERR()

Raviteja Laggyshetty <[email protected]>
interconnect: qcom: icc-rpmh: probe defer incase of missing QoS clock dependency

Michael Grzeschik <[email protected]>
usb: gadget: uvc: wake pump everytime we update the free list

Keita Morisaki <[email protected]>
devres: Fix page faults when tracing devres from unloaded modules

Jinjie Ruan <[email protected]>

    misc: apds990x: Fix missing pm_runtime_disable()

Edward Adam Davis <[email protected]>
USB: chaoskey: Fix possible deadlock chaoskey_list_lock

Oliver Neukum <[email protected]>
USB: chaoskey: fail open after removal

Oliver Neukum <[email protected]>
usb: yurex: make waiting on yurex_write interruptible

Jeongjun Park <[email protected]>
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()

Christophe JAILLET <[email protected]>
iio: light: al3010: Fix an error handling path in al3010_probe()

Paolo Abeni <[email protected]>
ipmr: fix tables suspicious RCU usage

Paolo Abeni <[email protected]>
ip6mr: fix tables suspicious RCU usage

Kuniyuki Iwashima <[email protected]>
tcp: Fix use-after-free of nreq in reqsk_timer_handler().

Michal Luczaj <[email protected]>
rxrpc: Improve setsockopt() handling of malformed user input

Michal Luczaj <[email protected]>
llc: Improve setsockopt() handling of malformed user input

Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix possible deadlocks

Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync

Michael Chan <[email protected]>
bnxt_en: Unregister PTP during PCI shutdown and suspend

Michael Chan <[email protected]>
bnxt_en: Refactor bnxt_ptp_init()

Shravya KN <[email protected]>
bnxt_en: Fix receive ring space parameters when XDP is active

Somnath Kotur <[email protected]>
bnxt_en: Fix queue start to update vnic RSS table

Shravya KN <[email protected]>
bnxt_en: Set backplane link modes correctly for ethtool

Saravanan Vajravel <[email protected]>
bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down

Eric Dumazet <[email protected]>
net: hsr: fix hsr_init_sk() vs network/transport headers.

Csókás, Bence <[email protected]>
spi: atmel-quadspi: Fix register name in verbose logging function

Hariprasad Kelam <[email protected]>
octeontx2-af: Quiesce traffic before NIX block reset

Hariprasad Kelam <[email protected]>
octeontx2-af: RPM: fix stale FCFEC counters

Hariprasad Kelam <[email protected]>
octeontx2-af: RPM: fix stale RSFEC counters

Hariprasad Kelam <[email protected]>
octeontx2-af: RPM: Fix low network performance

Hariprasad Kelam <[email protected]>
octeontx2-af: RPM: Fix mismatch in lmac type

Maxime Chevallier <[email protected]>
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken

Vitalii Mordan <[email protected]>

    marvell: pxa168_eth: fix call balance of pep->clk handling routines

Rosen Penev <[email protected]>
net: mdio-ipq4019: add missing error check

Hangbin Liu <[email protected]>
net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged

Justin Lai <[email protected]>
rtase: Corrects error handling of the rtase_check_mac_version_valid()

Justin Lai <[email protected]>
rtase: Correct the speed for RTL907XD-V1

Justin Lai <[email protected]>
rtase: Refactor the rtase_check_mac_version_valid() function

Sidraya Jayagond <[email protected]>
s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()

James Chapman <[email protected]>
net/l2tp: fix warning in l2tp_exit_net found by syzbot

Yuezhang Mo <[email protected]>
exfat: fix file being changed by unaligned direct write

Jakub Kicinski <[email protected]>
netlink: fix false positive warning in extack during dumps

Guenter Roeck <[email protected]>
net: microchip: vcap: Add typegroup table terminators in kunit tests

Oleksij Rempel <[email protected]>
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration

Pavan Chebbi <[email protected]>
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets

Oleksij Rempel <[email protected]>
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device

Oleksij Rempel <[email protected]>
net: usb: lan78xx: Fix double free issue with interrupt buffer allocation

Arnd Bergmann <[email protected]>
power: reset: ep93xx: add AUXILIARY_BUS dependency

Konstantin Komarov <[email protected]>
fs/ntfs3: Equivalent transition from page to folio

ChiYuan Huang <[email protected]>
power: supply: rt9471: Use IC status regfield to report real charger status

ChiYuan Huang <[email protected]>
power: supply: rt9471: Fix wrong WDT function regfield declaration

Barnabás Czémán <[email protected]>
power: supply: bq27xxx: Fix registers of bq27426

Bart Van Assche <[email protected]>
power: supply: core: Remove might_sleep() from power_supply_put()

Tiezhu Yang <[email protected]>
LoongArch: BPF: Sign-extend return values

Tiezhu Yang <[email protected]>
LoongArch: Fix build failure with GCC 15 (-std=gnu23)

Randy Dunlap <[email protected]>
fs_parser: update mount_api doc to match function signature

Avihai Horon <[email protected]>
vfio/pci: Properly hide first-in-list PCIe extended capability

Andy Shevchenko <[email protected]>
gpio: zevio: Add missed label initialisation

Michael Ellerman <[email protected]>
selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels

Yishai Hadas <[email protected]>
vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data()

Yishai Hadas <[email protected]>
vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()

Si-Wei Liu <[email protected]>
vdpa/mlx5: Fix suboptimal range on iotlb iteration

Lorenzo Bianconi <[email protected]>
phy: airoha: Fix REG_CSR_2L_RX{0,1}_REV0 definitions

Lorenzo Bianconi <[email protected]>
phy: airoha: Fix REG_CSR_2L_JCPLL_SDM_HREN config in airoha_pcie_phy_init_ssc_jcpll()

Lorenzo Bianconi <[email protected]>
phy: airoha: Fix REG_PCIE_PMA_TX_RESET config in airoha_pcie_phy_init_csr_2l()

Lorenzo Bianconi <[email protected]>
phy: airoha: Fix REG_CSR_2L_PLL_CMN_RESERVE0 config in airoha_pcie_phy_init_clk_out()

Aleksa Savic <[email protected]>
hwmon: (aquacomputer_d5next) Fix length of speed_input array

Murad Masimov <[email protected]>
hwmon: (tps23861) Fix reporting of negative temperatures

Hao Ge <[email protected]>
perf bpf-filter: Return -ENOMEM directly when pfi allocation fails

Chao Yu <[email protected]>
f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow

Mike Snitzer <[email protected]>
nfs_common: must not hold RCU while calling nfsd_file_put_local

Chuck Lever <[email protected]>
NFSD: Fix nfsd4_shutdown_copy()

Ye Bin <[email protected]>
svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()

Yang Erkun <[email protected]>
nfsd: release svc_expkey/svc_export with rcu_work

Chuck Lever <[email protected]>
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()

Chuck Lever <[email protected]>
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()

Zhongqiu Han <[email protected]>
PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio'

Sibi Sankar <[email protected]>
remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region

Jonathan Marek <[email protected]>
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length

Dmitry Baryshkov <[email protected]>
remoteproc: qcom: pas: add minidump_id to SM8350 resources

Joe Hattori <[email protected]>
remoteproc: qcom: adsp: Remove subdevs on the error path of adsp_probe()

Joe Hattori <[email protected]>
remoteproc: qcom: pas: Remove subdevs on the error path of adsp_probe()

Benjamin Peterson <[email protected]>
perf trace: Avoid garbage when not printing a syscall's arguments

Benjamin Peterson <[email protected]>
perf trace: Do not lose last events in a race

Howard Chu <[email protected]>
perf trace: Fix tracing itself, creating feedback loops

Jean-Philippe Romain <[email protected]>
perf list: Fix topic and pmu_name argument order

Jeff Layton <[email protected]>
nfsd: drop inode parameter from nfsd4_change_attribute()

Chuck Lever <[email protected]>
svcrdma: Address an integer overflow

Antonio Quartulli <[email protected]>
m68k: coldfire/device.c: only build FEC when HW macros are defined

Jean-Michel Hautbois <[email protected]>
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x

Benjamin Peterson <[email protected]>
perf trace: avoid garbage when not printing a trace event's arguments

Chao Yu <[email protected]>
f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode

Chao Yu <[email protected]>
f2fs: fix to map blocks correctly for direct write

Long Li <[email protected]>
f2fs: fix race in concurrent f2fs_stop_gc_thread

Yicong Yang <[email protected]>
perf build: Add missing cflags when building with custom libtraceevent

Siddharth Vadapalli <[email protected]>
PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds

Manivannan Sadhasivam <[email protected]>
PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert()

Manivannan Sadhasivam <[email protected]>
PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()

Manivannan Sadhasivam <[email protected]>
PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported

Zhiguo Niu <[email protected]>
f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID

Chao Yu <[email protected]>
f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()

Zeng Heng <[email protected]>
f2fs: Fix not used variable 'index'

Yongpeng Yang <[email protected]>

    f2fs: check curseg->inited before write_sum_page in change_curseg

LongPing Wei <[email protected]>
f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block

Frank Li <[email protected]>
i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin

Arnaldo Carvalho de Melo <[email protected]>
perf ftrace latency: Fix unit on histogram first entry when using --use-nsec

Hou Tao <[email protected]>
virtiofs: use pages instead of pointer for kernel direct IO

Li Huafei <[email protected]>
perf disasm: Fix not cleaning up disasm_line in symbol__disassemble_raw()

Li Huafei <[email protected]>
perf disasm: Use disasm_line__free() to properly free disasm_line

Francesco Zardi <[email protected]>
rust: block: fix formatting of kernel::block::mq::request module

Ilpo Järvinen <[email protected]>
PCI: cpqphp: Fix PCIBIOS_* return value confusion

Paolo Bonzini <[email protected]>
rust: macros: fix documentation of the paste! macro

Yutaro Ohno <[email protected]>
rust: kernel: fix THIS_MODULE header path in ThisModule doc comment

Leo Yan <[email protected]>
perf probe: Correct demangled symbols in C++ program

Ian Rogers <[email protected]>
perf probe: Fix libdw memory leak

Ian Rogers <[email protected]>
perf disasm: Fix capstone memory leak

Veronika Molnarova <[email protected]>
perf dso: Fix symtab_type for kmod compression

Chao Yu <[email protected]>
f2fs: fix to account dirty data in __get_secs_required()

Arnd Bergmann <[email protected]>
mailbox, remoteproc: k3-m4+: fix compile testing

Ye Bin <[email protected]>
f2fs: fix null-ptr-deref in f2fs_submit_page_bio()

Qi Han <[email protected]>
f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks

Miguel Ojeda <[email protected]>
rust: rbtree: fix SAFETY comments that should be # Safety sections

Veronika Molnarova <[email protected]>
perf test attr: Add back missing topdown events

Michael Petlan <[email protected]>
perf trace: Keep exited threads for summary

Ian Rogers <[email protected]>
perf stat: Fix affinity memory leaks on error path

Levi Yun <[email protected]>
perf stat: Close cork_fd when create_perf_stat_counter() failed

Kan Liang <[email protected]>
perf jevents: Don't stop at the first matched pmu when searching a events table

Todd Kjos <[email protected]>
PCI: Fix reset_method_store() memory leak

Fei Shao <[email protected]>
dt-bindings: PCI: mediatek-gen3: Allow exact number of clocks only

Thomas Falcon <[email protected]>

    perf mem: Fix printing PERF_MEM_LVLNUM_{L2_MHB|MSC}

Ian Rogers <[email protected]>
perf stat: Uniquify event name improvements

Andreas Gruenbacher <[email protected]>
gfs2: Fix unlinked inode cleanup

Andreas Gruenbacher <[email protected]>
gfs2: Allow immediate GLF_VERIFY_DELETE work

Andreas Gruenbacher <[email protected]>
gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE

James Clark <[email protected]>
perf cs-etm: Don't flush when packet_queue fills up

David Laight <[email protected]>
x86: fix off-by-one in access_ok()

Dan Carpenter <[email protected]>
mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb()

Yang Yingliang <[email protected]>
mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks()

Paul Aurich <[email protected]>
smb: cached directories can be more than root file handle

Tomas Glozar <[email protected]>

    rtla/timerlat: Do not set params->user_workload with -U

zhang jiao <[email protected]>

    pinctrl: k210: Undef K210_PC_DEFAULT

Konrad Dybcio <[email protected]>

    arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw

Kalesh AP <[email protected]>
RDMA/bnxt_re: Correct the sequence of device suspend

Liu Shixin <[email protected]>
zram: fix NULL pointer in comp_algorithm_show()

Sergey Senozhatsky <[email protected]>
zram: permit only one post-processing operation at a time

Nuno Sa <[email protected]>
clk: clk-axi-clkgen: make sure to enable the AXI bus clock

Nuno Sa <[email protected]>
dt-bindings: clock: axi-clkgen: include AXI clk

Lorenzo Bianconi <[email protected]>
clk: en7523: fix estimation of fixed rate for EN7581

Lorenzo Bianconi <[email protected]>
clk: en7523: introduce chip_scu regmap

Lorenzo Bianconi <[email protected]>
clk: en7523: move clock_register in hw_init callback

Lorenzo Bianconi <[email protected]>
clk: en7523: remove REG_PCIE*_{MEM,MEM_MASK} configuration

Sergio Paracuellos <[email protected]>
clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs

Sergio Paracuellos <[email protected]>
clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883

Charles Han <[email protected]>
clk: clk-apple-nco: Add NULL check in applnco_probe

Patrisious Haddad <[email protected]>
RDMA/mlx5: Move events notifier registration to be after device registration

Zhen Lei <[email protected]>
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()

Zhang Zekun <[email protected]>
powerpc/kexec: Fix return of uninitialized variable

Kajol Jain <[email protected]>

    KVM: PPC: Book3S HV: Fix kmv -> kvm typo

Feng Fang <[email protected]>
RDMA/hns: Fix different dgids mapping to the same dip_idx

Michal Suchanek <[email protected]>
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static

Gautam Menghani <[email protected]>
KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells

Gautam Menghani <[email protected]>

    KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests

Harshit Mogalapalli <[email protected]>
dax: delete a stale directory pmem

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift

Geert Uytterhoeven <[email protected]>
zram: ZRAM_DEF_COMP should depend on ZRAM

Dmitry Antipov <[email protected]>
ocfs2: fix uninitialized value in ocfs2_file_read_iter()

Dan Carpenter <[email protected]>
kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL

Sabyrzhan Tasbolatov <[email protected]>
kasan: move checks to do_strncpy_from_user

Jinjie Ruan <[email protected]>
cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power()

Jinjie Ruan <[email protected]>
cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost()

Andy Shevchenko <[email protected]>
cpufreq: loongson3: Check for error code from devm_mutex_init() call

Junxian Huang <[email protected]>
RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()

Junxian Huang <[email protected]>
RDMA/hns: Fix out-of-order issue of requester when setting FENCE

Sourabh Jain <[email protected]>
fadump: reserve param area if below boot_mem_top

Hari Bathini <[email protected]>
powerpc/fadump: allocate memory for additional parameters early

Kirill A. Shutemov <[email protected]>
x86/tdx: Dynamically disable SEPT violations from causing #VEs

Kirill A. Shutemov <[email protected]>
x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup()

Kirill A. Shutemov <[email protected]>
x86/tdx: Introduce wrappers to read and write TD metadata

Bart Van Assche <[email protected]>
scsi: sg: Enable runtime power management

Zhen Lei <[email protected]>
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()

Zhen Lei <[email protected]>
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()

Zeng Heng <[email protected]>
scsi: fusion: Remove unused variable 'rc'

Ye Bin <[email protected]>
scsi: bfa: Fix use-after-free in bfad_im_module_exit()

Baolin Liu <[email protected]>
scsi: target: Fix incorrect function name in pscsi_create_type_disk()

Mirsad Todorovac <[email protected]>
fs/proc/kcore.c: fix coccinelle reported ERROR instances

Raymond Hackley <[email protected]>
leds: ktd2692: Set missing timing properties

Javier Carrasco <[email protected]>
leds: max5970: Fix unreleased fwnode_handle in probe function

Zhang Changzhong <[email protected]>
mfd: rt5033: Fix missing regmap_del_irq_chip()

Tamir Duberstein <[email protected]>
checkpatch: always parse orig_commit in fixes tag

Zhenzhong Duan <[email protected]>
iommu/vt-d: Fix checks and print in pgtable_walk()

Zhenzhong Duan <[email protected]>
iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes()

Yang Yingliang <[email protected]>
clk: imx: imx8-acm: Fix return value check in clk_imx_acm_attach_pm_domains()

Dong Aisheng <[email protected]>
clk: imx: clk-scu: fix clk enable state save and restore

Peng Fan <[email protected]>
clk: imx: fracn-gppll: fix pll power up

Peng Fan <[email protected]>
clk: imx: fracn-gppll: correct PLL initialization flow

Peng Fan <[email protected]>
clk: imx: lpcg-scu: SW workaround for errata (e10858)

Björn Töpel <[email protected]>
riscv: kvm: Fix out-of-bounds array access

Yong-Xuan Wang <[email protected]>
RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation

Chiara Meiohas <[email protected]>
RDMA/mlx5: Ensure active slave attachment to the bond IB device

Chiara Meiohas <[email protected]>
RDMA/core: Implement RoCE GID port rescan and export delete function

Chiara Meiohas <[email protected]>
RDMA/mlx5: Call dev_put() after the blocking notifier

Liu Jian <[email protected]>
RDMA/rxe: Set queue pair cur_qp_state when being queried

Biju Das <[email protected]>
clk: renesas: rzg2l: Fix FOUTPOSTDIV clk

Andre Przywara <[email protected]>
clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset

Kashyap Desai <[email protected]>
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey

Zhu Yanjun <[email protected]>
RDMA/rxe: Fix the qp flush warnings in req

wenglianfa <[email protected]>
RDMA/hns: Fix cpu stuck caused by printings during reset

Junxian Huang <[email protected]>
RDMA/hns: Use dev_* printings in hem code instead of ibdev_*

Yuyu Li <[email protected]>
RDMA/hns: Modify debugfs name

wenglianfa <[email protected]>
RDMA/hns: Fix flush cqe error when racing with destroy qp

wenglianfa <[email protected]>
RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci

Vasant Hegde <[email protected]>
iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB

Jinjie Ruan <[email protected]>
cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()

Jinjie Ruan <[email protected]>
cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()

Michael Ellerman <[email protected]>
powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore

Takahiro Kuwano <[email protected]>

    mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in RD_ANY_REG_OP

Zichen Xie <[email protected]>
clk: sophgo: avoid integer overflow in sg2042_pll_recalc_rate()

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Staticize cmdqv_debugfs_dir

Ritesh Harjani (IBM) <[email protected]>
powerpc/mm/fault: Fix kfence page fault reporting

Stephen Boyd <[email protected]>
clk: Allow kunit tests to run without OF_OVERLAY enabled

Miquel Raynal <[email protected]>
mtd: rawnand: atmel: Fix possible memory leak

Biju Das <[email protected]>
mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE

Ritesh Harjani (IBM) <[email protected]>
powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()

Ritesh Harjani (IBM) <[email protected]>
powerpc/fadump: Refactor and prepare fadump_cma_init for late init

Yuan Can <[email protected]>
cpufreq: loongson2: Unregister platform_driver on failure

Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Fix IRQ domain names duplication

Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices

Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device

Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device

Marcus Folkesson <[email protected]>
mfd: da9052-spi: Change read-mask to write-mask

Jinjie Ruan <[email protected]>
mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race

Christophe Leroy <[email protected]>
powerpc/vdso: Flag VDSO64 entry points as functions

Yihang Li <[email protected]>
scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset

Matthew Rosato <[email protected]>
iommu/s390: Implement blocking domain

Jonathan Marek <[email protected]>

    clk: qcom: videocc-sm8550: depend on either gcc-sm8550 or gcc-sm8650

Lad Prabhakar <[email protected]>
pinctrl: renesas: Select PINCTRL_RZG2L for RZ/V2H(P) SoC

Bartosz Golaszewski <[email protected]>
pinctrl: zynqmp: drop excess struct member description

Levi Yun <[email protected]>
trace/trace_event_perf: remove duplicate samples on the first tracepoint event

Lukas Bulwahn <[email protected]>
clk: mediatek: drop two dead config options

Biju Das <[email protected]>
pinctrl: renesas: rzg2l: Fix missing return in rzg2l_pinctrl_register()

Chengchang Tang <[email protected]>
RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset

Chengchang Tang <[email protected]>
RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages

Jie Zhan <[email protected]>
cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged

André Almeida <[email protected]>
unicode: Fix utf8_load() error path

Jiayuan Chen <[email protected]>
bpf: fix recursive lock when verdict program return SK_PASS

Hangbin Liu <[email protected]>
wireguard: selftests: load nf_conntrack if not present

Breno Leitao <[email protected]>
netpoll: Use rcu_access_pointer() in netpoll_poll_lock

Jiawen Wu <[email protected]>
net: txgbe: fix null pointer to pcs

Jiawen Wu <[email protected]>
net: txgbe: remove GPIO interrupt controller

Jakub Kicinski <[email protected]>
eth: fbnic: don't disable the PCI device twice

Alexander Aring <[email protected]>
dlm: fix dlm_recover_members refcount on error

Gao Xiang <[email protected]>
erofs: handle NONHEAD !delta[1] lclusters gracefully

Hongzhen Luo <[email protected]>
erofs: fix blksize < PAGE_SIZE for file-backed mounts

Gao Xiang <[email protected]>
erofs: fix file-backed mounts over FUSE

Felix Maurer <[email protected]>
xsk: Free skb when TX metadata options are invalid

Dmitry Antipov <[email protected]>
Bluetooth: fix use-after-free in device_for_each_child()

Iulia Tanasescu <[email protected]>
Bluetooth: ISO: Send BIG Create Sync via hci_sync

Iulia Tanasescu <[email protected]>
Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending

Iulia Tanasescu <[email protected]>
Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending

Luiz Augusto von Dentz <[email protected]>
Bluetooth: ISO: Use kref to track lifetime of iso_conn

Javier Carrasco <[email protected]>
Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name()

Chris Lu <[email protected]>
Bluetooth: btmtk: adjust the position to init iso data anchor

Kiran K <[email protected]>
Bluetooth: btintel: Do no pass vendor events to stack

Kiran K <[email protected]>
Bluetooth: btintel_pcie: Add handshake between driver and firmware

guanjing <[email protected]>
selftests: netfilter: Fix missing return values in conntrack_dump_flush

Igor Pylypiv <[email protected]>
i2c: dev: Fix memory leak when underlying adapter does not support I2C

Takashi Iwai <[email protected]>
ALSA: 6fire: Release resources at card release

Takashi Iwai <[email protected]>
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection

Takashi Iwai <[email protected]>
ALSA: us122l: Use snd_card_free_when_closed() at disconnection

Takashi Iwai <[email protected]>
ALSA: usx2y: Use snd_card_free_when_closed() at disconnection

Xu Kuohai <[email protected]>
bpf: Add kernel symbol for struct_ops trampoline

Xu Kuohai <[email protected]>
bpf: Use function pointers count as struct_ops links count

Kalle Valo <[email protected]>
Revert "wifi: iwlegacy: do not skip frames with bad FCS"

Mingwei Zheng <[email protected]>
net: rfkill: gpio: Add check for clk_enable()

Omid Ehtemam-Haghighi <[email protected]>
ipv6: Fix soft lockups in fib6_select_path under high next hop churn

Viktor Malik <[email protected]>
selftests/bpf: skip the timer_lockup test for single-CPU nodes

Jiri Olsa <[email protected]>
bpf: Force uprobe bpf program to always return 0

Jiri Olsa <[email protected]>
bpf: Allow return values 0 and 1 for kprobe session

Yuan Can <[email protected]>
drm/amdkfd: Fix wrong usage of INIT_WORK()

Lijo Lazar <[email protected]>
drm/amdgpu: Fix map/unmap queue logic

Yang Wang <[email protected]>
drm/amdgpu: fix ACA bank count boundary check error

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: tell iwlmei when we finished suspending

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: allow fast resume on ax200

Lingbo Kong <[email protected]>
wifi: cfg80211: Remove the Medium Synchronization Delay validity check

Paolo Abeni <[email protected]>
selftests: net: really check for bg process completion

Paolo Abeni <[email protected]>
ipv6: release nexthop on device removal

Zijian Zhang <[email protected]>
bpf, sockmap: Fix sk_msg_reset_curr

Zijian Zhang <[email protected]>
bpf, sockmap: Several fixes to bpf_msg_pop_data

Zijian Zhang <[email protected]>
bpf, sockmap: Several fixes to bpf_msg_push_data

Zijian Zhang <[email protected]>
selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap

Zijian Zhang <[email protected]>
selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap

Zijian Zhang <[email protected]>
selftests/bpf: Fix SENDPAGE data logic in test_sockmap

Zijian Zhang <[email protected]>
selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap

Hao Ge <[email protected]>
isofs: avoid memory leak in iocharset

Adrián Larumbe <[email protected]>
drm/panthor: Fix OPP refcnt leaks in devfreq initialisation

Adrián Larumbe <[email protected]>
drm/panthor: record current and maximum device clock frequencies

Adrián Larumbe <[email protected]>
drm/panthor: introduce job cycle and timestamp accounting

Adrián Larumbe <[email protected]>
drm/panfrost: Add missing OPP table refcnt decremental

Pei Xiao <[email protected]>
wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()

Maurice Lambert <[email protected]>
netlink: typographical error in nlmsg_type constants definition

Florian Westphal <[email protected]>
netfilter: nf_tables: must hold rcu read lock while iterating object type list

Florian Westphal <[email protected]>
netfilter: nf_tables: must hold rcu read lock while iterating expression type list

Florian Westphal <[email protected]>
netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion

Jonathan Gray <[email protected]>
drm: use ATOMIC64_INIT() for atomic64_t

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Mark raw_tp arguments with PTR_MAYBE_NULL

Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Use dynamic allocation for CU occupancy array in 'kfd_get_cu_occupancy()'

Li Huafei <[email protected]>
drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info()

José Expósito <[email protected]>
drm/vkms: Drop unnecessary call to drm_crtc_cleanup()

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable

Leon Hwang <[email protected]>
bpf, bpftool: Fix incorrect disasm pc

Zichen Xie <[email protected]>
drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()

Linus Walleij <[email protected]>
wifi: cw1200: Fix potential NULL dereference

Yuan Can <[email protected]>
wifi: wfx: Fix error handling in wfx_core_init()

Steffen Dirkwinkel <[email protected]>
drm: xlnx: zynqmp_disp: layer may be null while releasing

Sean Anderson <[email protected]>
drm: zynqmp_kms: Unplug DRM device before removal

Li Huafei <[email protected]>
drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()

Fangzhi Zuo <[email protected]>
drm/amd/display: Reduce HPD Detection Interval for IPS

Roman Li <[email protected]>
drm/amd/display: Increase idle worker HPD detection time

Lucas Stach <[email protected]>
drm/etnaviv: hold GPU lock across perfmon sampling

Xiaolei Wang <[email protected]>
drm/etnaviv: Request pages from DMA32 zone on addressing_limited

Suraj Kandpal <[email protected]>
drm/xe/hdcp: Fix gsc structure check in fw check status

Lukasz Luba <[email protected]>
drm/msm/gpu: Check the status of registration to PM QoS

Jinjie Ruan <[email protected]>
drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()

Xu Kuohai <[email protected]>
bpf, arm64: Remove garbage frame for struct_ops trampoline

Steven Price <[email protected]>
drm/panfrost: Remove unused id_mask from struct panfrost_model

Dan Carpenter <[email protected]>
wifi: rtw89: unlock on error path in rtw89_ops_unassign_vif_chanctx()

Po-Hao Huang <[email protected]>
wifi: rtw89: Fix TX fail with A2DP after scanning

Zong-Zhe Yang <[email protected]>
wifi: rtw89: tweak driver architecture for impending MLO support

Zong-Zhe Yang <[email protected]>
wifi: rtw89: refactor STA related func ahead for MLO

Zong-Zhe Yang <[email protected]>
wifi: rtw89: refactor VIF related func ahead for MLO

Zong-Zhe Yang <[email protected]>
wifi: rtw89: read link_sta corresponding to the link

Zong-Zhe Yang <[email protected]>
wifi: rtw89: read bss_conf corresponding to the link

Zong-Zhe Yang <[email protected]>
wifi: rtw89: rename rtw89_sta to rtw89_sta_link ahead for MLO

Zong-Zhe Yang <[email protected]>
wifi: rtw89: rename rtw89_vif to rtw89_vif_link ahead for MLO

Andrii Nakryiko <[email protected]>
libbpf: move global data mmap()'ing into bpf_object__load()

Andrii Nakryiko <[email protected]>
selftests/bpf: fix test_spin_lock_fail.c's global vars usage

Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c

Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c

Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c

Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c

Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c

Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c

Dmitry Baryshkov <[email protected]>

    drm/msm/dpu: drop LM_3 / LM_4 on MSM8998

Dmitry Baryshkov <[email protected]>

    drm/msm/dpu: drop LM_3 / LM_4 on SDM845

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block

Ryan Walklin <[email protected]>
drm: panel: nv3052c: correct spi_device_id for RG35XX panel

Matthias Schiffer <[email protected]>
drm: fsl-dcu: enable PIXCLK on LS1021A

Alper Nebi Yasak <[email protected]>
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()

Marek Vasut <[email protected]>
wifi: wilc1000: Set MAC after operation mode

Sascha Hauer <[email protected]>
wifi: mwifiex: add missing locking for cfg80211 calls

Zijian Zhang <[email protected]>
selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap

Zijian Zhang <[email protected]>
selftests/bpf: Fix msg_verify_data in test_sockmap

Miguel Ojeda <[email protected]>
drm/panic: Select ZLIB_DEFLATE for DRM_PANIC_SCREEN_QR_CODE

Tomi Valkeinen <[email protected]>
drm/bridge: tc358767: Fix link properties discovery

Hangbin Liu <[email protected]>
netdevsim: copy addresses for both in and out paths

Andrii Nakryiko <[email protected]>
libbpf: never interpret subprogs in .text as entry programs

Everest K.C <[email protected]>
ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c

Karol Wachowski <[email protected]>
accel/ivpu: Prevent recovery invocation during probe and resume

Andrii Nakryiko <[email protected]>
libbpf: fix sym_is_subprog() logic for weak global subprogs

Dave Stevenson <[email protected]>
drm/vc4: Correct generation check in vc4_hvs_lut_load

Dave Stevenson <[email protected]>
drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush

Dave Stevenson <[email protected]>
drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load

Maxime Ripard <[email protected]>
drm/vc4: Introduce generation number enum

Dom Cobley <[email protected]>
drm/vc4: hdmi: Increase audio MAI fifo dreq threshold

Jacob Keller <[email protected]>
ice: consistently use q_idx in ice_vc_cfg_qs_msg()

Karthikeyan Periyasamy <[email protected]>
wifi: cfg80211: check radio iface combination for multi radio per wiphy

Alexis Lothoré (eBPF Foundation) <[email protected]>
selftests/bpf: add missing header include for htons

Balaji Pothunoori <[email protected]>
wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR

Eduard Zingerman <[email protected]>
selftests/bpf: Fix backtrace printing for selftests crashes

Yuan Chen <[email protected]>
bpf: Fix the xdp_adjust_tail sample prog issue

Björn Töpel <[email protected]>
selftests: bpf: Add missing per-arch include path

Björn Töpel <[email protected]>
libbpf: Add missing per-arch include path

Arnd Bergmann <[email protected]>
wifi: ath12k: fix one more memcpy size error

Rameshkumar Sundaram <[email protected]>
wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup()

Aurabindo Pillai <[email protected]>
drm/amd/display: fix a memleak issue when driver is removed

Vijendar Mukunda <[email protected]>
ASoC: amd: acp: fix for cpu dai index logic

Vijendar Mukunda <[email protected]>
ASoC: amd: acp: fix for inconsistent indenting

Martin Kaistra <[email protected]>
wifi: rtl8xxxu: Perform update_beacon_work when beaconing is enabled

Alexander Aring <[email protected]>
dlm: fix swapped args sb_flags vs sb_status

Alan Maguire <[email protected]>
selftests/bpf: Fix uprobe_multi compilation error

Tony Ambardar <[email protected]>
libbpf: Fix output .symtab byte-order during linking

Tao Chen <[email protected]>
libbpf: Fix expected_attach_type set handling in program load callback

Pin-yen Lin <[email protected]>
drm/bridge: it6505: Drop EDID cache on bridge power off

Pin-yen Lin <[email protected]>
drm/bridge: anx7625: Drop EDID cache on bridge power off

Geert Uytterhoeven <[email protected]>
ASoC: fsl-asoc-card: Add missing handling of {hp,mic}-dt-gpios

Srinivasan Shanmugam <[email protected]>
drm/amdgpu/gfx9: Add Cleaner Shader Deinitialization in gfx_v9_0 Module

Macpaul Lin <[email protected]>
ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: fix regmap_write_bits usage

Igor Prusov <[email protected]>
dt-bindings: vendor-prefixes: Add NeoFidelity, Inc

Ramya Gnanasekar <[email protected]>
wifi: ath12k: Skip Rx TID cleanup for self peer

Baochen Qiang <[email protected]>
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2

Baochen Qiang <[email protected]>
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1

Lijo Lazar <[email protected]>
drm/amdgpu: Fix JPEG v4.0.3 register write

Maíra Canal <[email protected]>
drm/v3d: Flush the MMU before we supply more memory to the binner

Maíra Canal <[email protected]>
drm/v3d: Address race-condition in MMU flush

Linus Walleij <[email protected]>
drm/panel: nt35510: Make new commands optional

Alexander Stein <[email protected]>
drm/imx: Add missing DRM_BRIDGE_CONNECTOR dependency

Dmitry Baryshkov <[email protected]>
drm/imx: parallel-display: switch to drm_panel_bridge

Dmitry Baryshkov <[email protected]>
drm/imx: ldb: switch to drm_panel_bridge

Dmitry Baryshkov <[email protected]>
drm/imx: ldb: drop custom DDC bus support

Dmitry Baryshkov <[email protected]>
drm/imx: ldb: drop custom EDID support

Dmitry Baryshkov <[email protected]>
drm/imx: parallel-display: drop edid override support

Jinjie Ruan <[email protected]>
drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()

Jinjie Ruan <[email protected]>
drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()

Huan Yang <[email protected]>
udmabuf: fix vmap_udmabuf error page set

Huan Yang <[email protected]>
udmabuf: change folios array from kmalloc to kvmalloc

Jinjie Ruan <[email protected]>
wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()

Jinjie Ruan <[email protected]>
wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()

Tvrtko Ursulin <[email protected]>
drm/v3d: Appease lockdep while updating GPU stats

Tomi Valkeinen <[email protected]>
drm/omap: Fix locking in omap_gem_new_dmabuf()

Tomi Valkeinen <[email protected]>
drm/omap: Fix possible NULL dereference

Jeongjun Park <[email protected]>
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()

Dave Stevenson <[email protected]>
drm/vc4: hvs: Correct logic on stopping an HVS channel

Dave Stevenson <[email protected]>
drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function

Dave Stevenson <[email protected]>
drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer

Dom Cobley <[email protected]>
drm/vc4: hdmi: Avoid hang with debug registers when suspended

Dave Stevenson <[email protected]>
drm/vc4: hvs: Don't write gamma luts on 2711

Andy Shevchenko <[email protected]>
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused

Matt Coster <[email protected]>
drm/imagination: Use pvr_vm_context_get()

Chen Yufan <[email protected]>
drm/imagination: Convert to use time_before macro

Yao Zi <[email protected]>
platform/x86: panasonic-laptop: Return errno correctly in show callback

Michael J. Ruhl <[email protected]>
platform/x86/intel/pmt: allow user offset for PMT callbacks

Armin Wolf <[email protected]>
platform/x86: asus-wmi: Fix inconsistent use of thermal policies

Vitaly Kuznetsov <[email protected]>
HID: hyperv: streamline driver probe to avoid devres issues

Tejun Heo <[email protected]>
sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context

Chris Morgan <[email protected]>
arm64: dts: rockchip: correct analog audio name on Indiedroid Nova

Li Huafei <[email protected]>
media: atomisp: Add check for rgby_data memory allocation failure

Uwe Kleine-König <[email protected]>
pwm: Assume a disabled PWM to emit a constant inactive output

Sergey Senozhatsky <[email protected]>
media: venus: sync with threaded IRQ during inst destruction

Sergey Senozhatsky <[email protected]>
media: venus: fix enc/dec destruction order

Bingbu Cao <[email protected]>
media: ipu6: remove architecture DMA ops dependency in Kconfig

Bingbu Cao <[email protected]>
media: ipu6: not override the dma_ops of device in driver

Sakari Ailus <[email protected]>
media: ipu6: Fix DMA and physical address debugging messages for 32-bit

Luo Qiu <[email protected]>
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware

Reinette Chatre <[email protected]>
selftests/resctrl: Protect against array overrun during iMC config parsing

Reinette Chatre <[email protected]>
selftests/resctrl: Fix memory overflow due to unhandled wraparound

Reinette Chatre <[email protected]>
selftests/resctrl: Print accurate buffer size as part of MBM results

Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators

Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names

Macpaul Lin <[email protected]>
arm64: dts: mediatek: mt6358: fix dtbs_check error

Frank Li <[email protected]>
arm64: dts: imx8mn-tqma8mqnl-mba8mx-usbot: fix coexistence of output-low and output-high in GPIO

Lad Prabhakar <[email protected]>
arm64: dts: renesas: hihope: Drop #sound-dai-cells

Andy Shevchenko <[email protected]>
regmap: irq: Set lockdep class for hierarchical IRQ domains

Jinjie Ruan <[email protected]>
spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time​

Breno Leitao <[email protected]>
spi: tegra210-quad: Avoid shift-out-of-bounds

Zhang Zekun <[email protected]>
pmdomain: ti-sci: Add missing of_node_put() for args.np

Usama Arif <[email protected]>
of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify

Abel Vesa <[email protected]>
dt-bindings: cache: qcom,llcc: Fix X1E80100 reg entries

Konrad Dybcio <[email protected]>

    arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers

Niklas Schnelle <[email protected]>
watchdog: Add HAS_IOPORT dependency for SBC8360 and SBC7240

Anurag Dutta <[email protected]>
arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances

Anurag Dutta <[email protected]>
arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances

Anurag Dutta <[email protected]>
arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances

Jared McArthur <[email protected]>
arm64: dts: ti: k3-j7200: Fix register map for main domain pmx

Andre Przywara <[email protected]>
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints

Clark Wang <[email protected]>
pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle

Daolong Zhu <[email protected]>

    arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns

Daolong Zhu <[email protected]>

    arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns

Daolong Zhu <[email protected]>

    arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns

Daolong Zhu <[email protected]>

    arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns

Heiko Stuebner <[email protected]>
arm64: dts: rockchip: Remove 'enable-active-low' from two boards

Tomasz Maciej Nowak <[email protected]>
arm64: tegra: p2180: Add mandatory compatible for WiFi node

Bartosz Golaszewski <[email protected]>
power: sequencing: make the QCom PMU pwrseq driver depend on CONFIG_OF

Dragan Simic <[email protected]>
regulator: rk808: Restrict DVS GPIOs to the RK808 variant only

Chen Ridong <[email protected]>
cgroup/bpf: only cgroup v2 can be attached by bpf programs

Chen Ridong <[email protected]>
Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"

Fei Shao <[email protected]>
arm64: dts: mediatek: mt8195-cherry: Use correct audio codec DAI

Fei Shao <[email protected]>
arm64: dts: mediatek: mt8188: Fix USB3 PHY port default status

Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad

Srikar Dronamraju <[email protected]>
gpio: sloppy-logic-analyzer remove reference to rcu_momentary_dyntick_idle()

Nathan Morrisson <[email protected]>
arm64: dts: ti: k3-am62x-phyboard-lyra: Drop unnecessary McASP AFIFOs

Randy Dunlap <[email protected]>
kernel-doc: allow object-like macros in ReST output

Sibi Sankar <[email protected]>
arm64: dts: qcom: x1e80100: Resize GIC Redistributor register region

Hsin-Te Yuan <[email protected]>
arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4

Hsin-Te Yuan <[email protected]>
arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4

Colin Ian King <[email protected]>
media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call

Christophe JAILLET <[email protected]>
media: i2c: vgxy61: Fix an error handling path in vgxy61_detect()

Dan Carpenter <[email protected]>

    media: i2c: max96717: clean up on error in max96717_subdev_init()

Gregory Price <[email protected]>
tpm: fix signed/unsigned bug when checking event logs

Jonathan Marek <[email protected]>
efi/libstub: fix efi_parse_options() ignoring the default command line

Stafford Horne <[email protected]>
openrisc: Implement fixmap to fix earlycon

Abel Vesa <[email protected]>
arm64: dts: qcom: x1e80100-vivobook-s15: Drop orientation-switch from USB SS[0-1] QMP PHYs

Abel Vesa <[email protected]>
arm64: dts: qcom: x1e80100-slim7x: Drop orientation-switch from USB SS[0-1] QMP PHYs

Chen-Yu Tsai <[email protected]>
scripts/kernel-doc: Do not track section counter across processed files

Bartosz Golaszewski <[email protected]>
mmc: mmc_spi: drop buggy snprintf()

Andrei Simion <[email protected]>
ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode

Dmitry Baryshkov <[email protected]>

    arm64: dts: qcom: sda660-ifc6560: fix l10a voltage ranges

Luca Weiss <[email protected]>
arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins

Dan Carpenter <[email protected]>
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()

Jinjie Ruan <[email protected]>
soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()

Pin-yen Lin <[email protected]>
arm64: dts: mt8183: Add port node to dpi node

Alper Nebi Yasak <[email protected]>
arm64: dts: mediatek: mt8183-kukui: Disable DPI display interface

Macpaul Lin <[email protected]>
arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node

Macpaul Lin <[email protected]>
arm64: dts: mt8195: Fix dtbs_check error for mutex node

Macpaul Lin <[email protected]>
arm64: dts: mediatek: mt8395-genio-1200-evk: Fix dtbs_check error for phy

Pablo Sun <[email protected]>
arm64: dts: mediatek: mt8188: Fix wrong clock provider in MFG1 power domain

Michal Simek <[email protected]>
microblaze: Export xmb_manager functions

Gaosheng Cui <[email protected]>
drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()

Wolfram Sang <[email protected]>
ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: qcs6390-rb3gen2: use modem.mbn for modem DSP

Jinjie Ruan <[email protected]>
spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()

Min-Hua Chen <[email protected]>
regulator: qcom-smd: make smd_vreg_rpm static

Samuel Holland <[email protected]>
irqchip/riscv-aplic: Prevent crash when MSI domain is missing

Javier Carrasco <[email protected]>
clocksource/drivers/timer-ti-dm: Fix child node refcount handling

Mark Brown <[email protected]>
clocksource/drivers:sp804: Make user selectable

Eder Zulian <[email protected]>
rust: helpers: Avoid raw_spin_lock initialization for PREEMPT_RT

Sebastian Andrzej Siewior <[email protected]>
locking/rt: Add sparse annotation PREEMPT_RT's sleeping locks.

Thomas Gleixner <[email protected]>
sched/ext: Remove sched_fork() hack

Marco Elver <[email protected]>
kcsan, seqlock: Fix incorrect assumption in read_seqbegin()

Marco Elver <[email protected]>
kcsan, seqlock: Support seqcount_latch_t

Uros Bizjak <[email protected]>

    locking/atomic/x86: Use ALT_OUTPUT_SP() for __arch_{,try_}cmpxchg64_emu()

Uros Bizjak <[email protected]>
locking/atomic/x86: Use ALT_OUTPUT_SP() for __alternative_atomic64()

Thomas Gleixner <[email protected]>
timers: Add missing READ_ONCE() in __run_timer_base()

Miguel Ojeda <[email protected]>
time: Fix references to _msecs_to_jiffies() handling of values

Miguel Ojeda <[email protected]>
time: Partially revert cleanup on msecs_to_jiffies() documentation

Uros Bizjak <[email protected]>
cleanup: Remove address space of returned pointer

Carlos Llamas <[email protected]>
Revert "scripts/faddr2line: Check only two symbols when calculating symbol size"

Zheng Yejian <[email protected]>
x86/unwind/orc: Fix unwind for newly forked tasks

Daniel Lezcano <[email protected]>
thermal/lib: Fix memory leak on error in thermal_genl_auto()

Daniel Lezcano <[email protected]>
tools/lib/thermal: Make more generic the command encoding function

Uladzislau Rezki (Sony) <[email protected]>
rcuscale: Do a proper cleanup if kfree_scale_init() fails

Christophe JAILLET <[email protected]>
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()

Michal Suchanek <[email protected]>
crypto: aes-gcm-p10 - Use the correct bit to test for P10

Chen Ridong <[email protected]>
crypto: bcm - add error check in the ahash_hmac_init function

Chen Ridong <[email protected]>
crypto: caam - add error check to caam_rsa_set_priv_key_form

Rafael J. Wysocki <[email protected]>
thermal: testing: Initialize some variables annoteded with _free()

Rafael J. Wysocki <[email protected]>
thermal: testing: Use DEFINE_FREE() and __free() to simplify code

Lifeng Zheng <[email protected]>
ACPI: CPPC: Fix _CPC register setting issue

Pei Xiao <[email protected]>
hwmon: (nct6775-core) Fix overflows seen when writing limit attributes

Jerome Brunet <[email protected]>
hwmon: (pmbus/core) clear faults after setting smbalert mask

Zqiang <[email protected]>
rcu/nocb: Fix missed RCU barrier on deoffloading

Uladzislau Rezki (Sony) <[email protected]>
rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu

Michal Schmidt <[email protected]>
rcu/srcutiny: don't return before reenabling preemption

Baruch Siach <[email protected]>
doc: rcu: update printed dynticks counter bits

Christian Loehle <[email protected]>
sched/cpufreq: Ensure sd is rebuilt for EAS check

Li Huafei <[email protected]>
crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init()

Wang Hai <[email protected]>
crypto: qat - Fix missing destroy_workqueue in adf_init_aer()

Orange Kao <[email protected]>
EDAC/igen6: Avoid segmentation fault on module unload

Weili Qian <[email protected]>
crypto: hisilicon/qm - disable same error report before resetting

Gautham R. Shenoy <[email protected]>
amd-pstate: Set min_perf to nominal_perf for active mode performance gov

Mario Limonciello <[email protected]>
cpufreq/amd-pstate: Don't update CPPC request in amd_pstate_cpu_boost_update()

Everest K.C <[email protected]>
crypto: cavium - Fix the if condition to exit loop after timeout

Yi Yang <[email protected]>
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY

Qiuxu Zhuo <[email protected]>
EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator

Qiuxu Zhuo <[email protected]>
EDAC/skx_common: Differentiate memory error sources

Priyanka Singh <[email protected]>
EDAC/fsl_ddr: Fix bad bit shift operations

Rafael J. Wysocki <[email protected]>
thermal: core: Fix race between zone registration and system suspend

Rafael J. Wysocki <[email protected]>
thermal: core: Mark thermal zones as initializing to start with

Rafael J. Wysocki <[email protected]>
thermal: core: Represent suspend-related thermal zone flags as bits

Rafael J. Wysocki <[email protected]>
thermal: core: Rearrange PM notification code

Rafael J. Wysocki <[email protected]>
thermal: core: Initialize thermal zones before registering them

Ahsan Atta <[email protected]>
crypto: qat - remove faulty arbiter config reset

David Thompson <[email protected]>
EDAC/bluefield: Fix potential integer overflow

Yuan Can <[email protected]>
firmware: google: Unregister driver_info on failure

Dan Carpenter <[email protected]>
crypto: qat/qat_4xxx - fix off by one in uof_get_name()

Dan Carpenter <[email protected]>

    crypto: qat/qat_420xx - fix off by one in uof_get_name()

Danny Tsen <[email protected]>
crypto: powerpc/p10-aes-gcm - Add dependency on CRYPTO_SIMDand re-enable CRYPTO_AES_GCM_P10

Danny Tsen <[email protected]>
crypto: powerpc/p10-aes-gcm - Register modules as SIMD

Cabiddu, Giovanni <[email protected]>
crypto: qat - remove check after debugfs_create_dir()

Christophe JAILLET <[email protected]>
crypto: caam - Fix the pointer passed to caam_qi_shutdown()

Tomas Paukrt <[email protected]>
crypto: mxs-dcp - Fix AES-CBC with hardware-bound keys

Christoph Hellwig <[email protected]>
virtio_blk: reverse request order in virtio_queue_rqs

Christoph Hellwig <[email protected]>
nvme-pci: reverse request order in nvme_queue_rqs

Long Li <[email protected]>
ext4: fix race in buffer_head read fault injection

Thadeu Lima de Souza Cascardo <[email protected]>
hfsplus: don't query the device logical block size multiple times

Masahiro Yamada <[email protected]>
s390/syscalls: Avoid creation of arch/arch/ directory

Christoph Hellwig <[email protected]>
block: fix bio_split_rw_at to take zone_write_granularity into account

Christoph Hellwig <[email protected]>
block: take chunk_sectors into account in bio_split_write_zeroes

Zizhi Wo <[email protected]>
netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING

Zizhi Wo <[email protected]>

    cachefiles: Fix NULL pointer dereference in object->file

Zizhi Wo <[email protected]>
cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter()

Zizhi Wo <[email protected]>
cachefiles: Fix incorrect length return value in cachefiles_ondemand_fd_write_iter()

Li Wang <[email protected]>
loop: fix type of block size

Aleksandr Mishin <[email protected]>
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()

Masahiro Yamada <[email protected]>
arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG

Daniel Palmer <[email protected]>
m68k: mvme147: Reinstate early console

Daniel Palmer <[email protected]>
m68k: mvme147: Fix SCSI controller IRQ numbers

Christoph Hellwig <[email protected]>
nvme-pci: fix freeing of the HMB descriptor table

Mark Brown <[email protected]>
kselftest/arm64: Fix encoding for SVE B16B16 test

Marc Zyngier <[email protected]>
arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers

David Disseldorp <[email protected]>
initramfs: avoid filename buffer overrun

Thomas Richter <[email protected]>
s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex

Jonas Gorski <[email protected]>
mips: asm: fix warning when disabling MIPS_FP_SUPPORT

Jan Kara <[email protected]>
ext4: avoid remount errors with 'abort' mount option

Yang Erkun <[email protected]>
brd: defer automatic disk creation until module initialization succeeds

Ard Biesheuvel <[email protected]>
x86/pvh: Call C code via the kernel virtual mapping

Heiko Carstens <[email protected]>
s390/pageattr: Implement missing kernel_page_present()

Vineeth Vijayan <[email protected]>
s390/cio: Do not unregister the subchannel based on DNV

John Garry <[email protected]>
fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid()

John Garry <[email protected]>
block/fs: Pass an iocb to generic_atomic_write_valid()

Andre Przywara <[email protected]>
kselftest/arm64: mte: fix printf type warnings about longs

Andre Przywara <[email protected]>
kselftest/arm64: mte: fix printf type warnings about __u64

Andre Przywara <[email protected]>
kselftest/arm64: hwcap: fix f8dp2 cpuinfo name

Kristina Martsenko <[email protected]>
arm64: probes: Disable kprobes/uprobes on MOPS instructions

Bill O'Donnell <[email protected]>
efs: fix the efs new mount api implementation

Halil Pasic <[email protected]>
s390/virtio_ccw: Fix dma_parm pointer not set up

Gerd Bayer <[email protected]>
s390/facilities: Fix warning about shadow of global variable

Fangzhi Zuo <[email protected]>
drm/amd/display: Fix incorrect DSC recompute trigger

Fangzhi Zuo <[email protected]>
drm/amd/display: Skip Invalid Streams from DSC Policy

Darrick J. Wong <[email protected]>
MAINTAINERS: appoint myself the XFS maintainer for 6.12 LTS

-------------

Diffstat:

 Documentation/ABI/testing/sysfs-fs-f2fs            |   7 +-
 Documentation/RCU/stallwarn.rst                    |   2 +-
 Documentation/admin-guide/blockdev/zram.rst        |   2 +
 Documentation/admin-guide/media/building.rst       |   2 +-
 Documentation/admin-guide/media/saa7134.rst        |   2 +-
 Documentation/arch/x86/boot.rst                    |  17 +-
 .../devicetree/bindings/cache/qcom,llcc.yaml       |  38 +-
 .../devicetree/bindings/clock/adi,axi-clkgen.yaml  |  22 +-
 .../devicetree/bindings/iio/dac/adi,ad3552r.yaml   |   2 +-
 .../bindings/pci/mediatek-pcie-gen3.yaml           |   5 +-
 .../pinctrl/samsung,pinctrl-wakeup-interrupt.yaml  |  19 +-
 .../devicetree/bindings/serial/rs485.yaml          |  19 +-
 .../devicetree/bindings/sound/mt6359.yaml          |  10 +-
 .../devicetree/bindings/vendor-prefixes.yaml       |   2 +
 Documentation/filesystems/mount_api.rst            |   3 +-
 Documentation/locking/seqlock.rst                  |   2 +-
 MAINTAINERS                                        | 335 ++++----
 Makefile                                           |   4 +-
 arch/arc/kernel/devtree.c                          |   2 +-
 .../boot/dts/allwinner/sun9i-a80-cubieboard4.dts   |   4 +-
 arch/arm/boot/dts/microchip/sam9x60.dtsi           |  12 +
 arch/arm/boot/dts/renesas/r7s72100-genmai.dts      |   2 +-
 arch/arm/boot/dts/ti/omap/omap36xx.dtsi            |   1 +
 arch/arm/kernel/devtree.c                          |   2 +-
 .../freescale/imx8mn-tqma8mqnl-mba8mx-usbotg.dtso  |  29 +-
 arch/arm64/boot/dts/mediatek/mt6358.dtsi           |   4 +-
 arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi  |   8 +
 .../dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts   |   3 +
 .../dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts    |   2 +
 .../dts/mediatek/mt8183-kukui-jacuzzi-damu.dts     |   3 +
 .../dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi  |   3 +
 .../boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi    |  30 +-
 .../boot/dts/mediatek/mt8183-kukui-kakadu.dtsi     |   4 +-
 .../boot/dts/mediatek/mt8183-kukui-kodama.dtsi     |   4 +-
 .../boot/dts/mediatek/mt8183-kukui-krane.dtsi      |   4 +-
 arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi     |   5 +
 arch/arm64/boot/dts/mediatek/mt8183.dtsi           |   4 +
 .../boot/dts/mediatek/mt8186-corsola-voltorb.dtsi  |  21 +-
 arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi   |   8 +-
 arch/arm64/boot/dts/mediatek/mt8188.dtsi           |   5 +-
 arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi    |   6 +-
 arch/arm64/boot/dts/mediatek/mt8195.dtsi           |   4 +-
 .../boot/dts/mediatek/mt8395-genio-1200-evk.dts    |   2 +-
 arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi     |   2 +-
 arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts       |   2 +-
 arch/arm64/boot/dts/qcom/sc8180x.dtsi              |   2 +-
 .../arm64/boot/dts/qcom/sda660-inforce-ifc6560.dts |   2 +-
 arch/arm64/boot/dts/qcom/sm6350.dtsi               |  14 +-
 .../boot/dts/qcom/x1e80100-asus-vivobook-s15.dts   |   4 -
 .../boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts  |   4 -
 arch/arm64/boot/dts/qcom/x1e80100.dtsi             |   8 +-
 arch/arm64/boot/dts/renesas/hihope-rev2.dtsi       |   3 -
 arch/arm64/boot/dts/renesas/hihope-rev4.dtsi       |   3 -
 .../rk3568-wolfvision-pf5-io-expander.dtso         |   1 -
 .../boot/dts/rockchip/rk3588s-indiedroid-nova.dts  |   2 +-
 .../arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts |   1 -
 arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi |   2 -
 .../boot/dts/ti/k3-j7200-common-proc-board.dts     |   2 +-
 arch/arm64/boot/dts/ti/k3-j7200-main.dtsi          |  38 +-
 arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi    |   6 +-
 arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi    |   6 +-
 arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi         |  16 +-
 arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi   |   6 +-
 arch/arm64/include/asm/insn.h                      |   1 +
 arch/arm64/include/asm/kvm_host.h                  |   2 -
 arch/arm64/kernel/cpufeature.c                     |   1 +
 arch/arm64/kernel/probes/decode-insn.c             |   7 +-
 arch/arm64/kernel/process.c                        |   2 +-
 arch/arm64/kernel/setup.c                          |   6 +-
 arch/arm64/kernel/vmlinux.lds.S                    |   6 +-
 arch/arm64/kvm/arch_timer.c                        |   3 +-
 arch/arm64/kvm/arm.c                               |  18 +-
 arch/arm64/kvm/mmio.c                              |  32 +-
 arch/arm64/kvm/pmu-emul.c                          |   1 -
 arch/arm64/kvm/vgic/vgic-its.c                     |  32 +-
 arch/arm64/kvm/vgic/vgic-mmio-v3.c                 |   7 +-
 arch/arm64/kvm/vgic/vgic.h                         |  23 +
 arch/arm64/net/bpf_jit_comp.c                      |  47 +-
 arch/csky/kernel/setup.c                           |   4 +-
 arch/loongarch/Makefile                            |   4 +-
 arch/loongarch/kernel/setup.c                      |   2 +-
 arch/loongarch/net/bpf_jit.c                       |   2 +-
 arch/loongarch/vdso/Makefile                       |   2 +-
 arch/m68k/coldfire/device.c                        |   8 +-
 arch/m68k/include/asm/mcfgpio.h                    |   2 +-
 arch/m68k/include/asm/mvme147hw.h                  |   4 +-
 arch/m68k/kernel/early_printk.c                    |   5 +-
 arch/m68k/mvme147/config.c                         |  30 +
 arch/m68k/mvme147/mvme147.h                        |   6 +
 arch/microblaze/kernel/microblaze_ksyms.c          |  10 +
 arch/microblaze/kernel/prom.c                      |   2 +-
 arch/mips/include/asm/switch_to.h                  |   2 +-
 arch/mips/kernel/prom.c                            |   2 +-
 arch/mips/kernel/relocate.c                        |   2 +-
 arch/nios2/kernel/prom.c                           |   4 +-
 arch/openrisc/Kconfig                              |   3 +
 arch/openrisc/include/asm/fixmap.h                 |  21 +-
 arch/openrisc/kernel/prom.c                        |   2 +-
 arch/openrisc/mm/init.c                            |  37 +
 arch/parisc/kernel/ftrace.c                        |   2 +-
 arch/powerpc/crypto/Kconfig                        |   2 +-
 arch/powerpc/crypto/aes-gcm-p10-glue.c             | 141 +++-
 arch/powerpc/include/asm/dtl.h                     |   4 +-
 arch/powerpc/include/asm/fadump.h                  |   9 +
 arch/powerpc/include/asm/kvm_book3s_64.h           |   4 +-
 arch/powerpc/include/asm/sstep.h                   |   5 -
 arch/powerpc/include/asm/vdso.h                    |   1 +
 arch/powerpc/kernel/dt_cpu_ftrs.c                  |   2 +-
 arch/powerpc/kernel/fadump.c                       |  40 +-
 arch/powerpc/kernel/prom.c                         |   5 +-
 arch/powerpc/kernel/setup-common.c                 |   6 +-
 arch/powerpc/kernel/setup_64.c                     |   1 +
 arch/powerpc/kexec/file_load_64.c                  |   9 +-
 arch/powerpc/kvm/book3s_hv.c                       |  14 +-
 arch/powerpc/kvm/book3s_hv_nested.c                |  14 +-
 arch/powerpc/kvm/trace_hv.h                        |   2 +-
 arch/powerpc/lib/sstep.c                           |  12 +-
 arch/powerpc/mm/fault.c                            |  10 +-
 arch/powerpc/platforms/pseries/dtl.c               |   8 +-
 arch/powerpc/platforms/pseries/lpar.c              |   8 +-
 arch/powerpc/platforms/pseries/plpks.c             |   2 +-
 arch/riscv/include/asm/cpufeature.h                |   2 +
 arch/riscv/kernel/setup.c                          |   2 +-
 arch/riscv/kernel/traps_misaligned.c               |  14 +-
 arch/riscv/kernel/unaligned_access_speed.c         |   1 +
 arch/riscv/kvm/aia_aplic.c                         |   3 +-
 arch/riscv/kvm/vcpu_sbi.c                          |  11 +-
 arch/s390/include/asm/facility.h                   |  18 +-
 arch/s390/include/asm/pci.h                        |   4 +-
 arch/s390/include/asm/set_memory.h                 |   1 +
 arch/s390/kernel/perf_cpum_sf.c                    |   2 +-
 arch/s390/kernel/syscalls/Makefile                 |   2 +-
 arch/s390/mm/pageattr.c                            |  15 +
 arch/s390/pci/pci.c                                |  37 +-
 arch/s390/pci/pci_debug.c                          |  10 +-
 arch/sh/kernel/cpu/proc.c                          |   2 +-
 arch/sh/kernel/setup.c                             |   2 +-
 arch/um/drivers/net_kern.c                         |   2 +-
 arch/um/drivers/ubd_kern.c                         |   4 +-
 arch/um/drivers/vector_kern.c                      |   3 +-
 arch/um/kernel/dtb.c                               |   2 +-
 arch/um/kernel/physmem.c                           |   6 +-
 arch/um/kernel/process.c                           |   2 +-
 arch/um/kernel/sysrq.c                             |   2 +-
 arch/x86/coco/tdx/tdx.c                            | 111 ++-
 arch/x86/crypto/aegis128-aesni-asm.S               |  29 +-
 arch/x86/events/intel/pt.c                         |  11 +-
 arch/x86/events/intel/pt.h                         |   2 +
 arch/x86/include/asm/atomic64_32.h                 |   3 +-
 arch/x86/include/asm/cmpxchg_32.h                  |   6 +-
 arch/x86/include/asm/kvm_host.h                    |   4 +-
 arch/x86/include/asm/shared/tdx.h                  |  11 +-
 arch/x86/include/asm/tlb.h                         |   4 +
 arch/x86/kernel/cpu/amd.c                          |   1 +
 arch/x86/kernel/cpu/common.c                       |   4 +-
 arch/x86/kernel/cpu/microcode/amd.c                |  25 +-
 arch/x86/kernel/devicetree.c                       |   2 +-
 arch/x86/kernel/unwind_orc.c                       |   2 +-
 arch/x86/kvm/Kconfig                               |   5 +-
 arch/x86/kvm/mmu/mmu.c                             |  68 +-
 arch/x86/kvm/mmu/spte.c                            |  18 +-
 arch/x86/kvm/vmx/vmx.c                             |  54 +-
 arch/x86/mm/tlb.c                                  |   3 +-
 arch/x86/platform/pvh/head.S                       |   9 +-
 arch/xtensa/kernel/setup.c                         |   2 +-
 block/bfq-cgroup.c                                 |   1 +
 block/bfq-iosched.c                                |  43 +-
 block/blk-core.c                                   |  18 +-
 block/blk-merge.c                                  |  45 +-
 block/blk-mq.c                                     | 148 +++-
 block/blk-mq.h                                     |  13 +
 block/blk-settings.c                               |   7 +
 block/blk-sysfs.c                                  |   6 +-
 block/blk-zoned.c                                  |  14 +-
 block/blk.h                                        |  30 +-
 block/elevator.c                                   |  10 +-
 block/fops.c                                       |  25 +-
 block/genhd.c                                      |  24 +-
 crypto/pcrypt.c                                    |  12 +-
 drivers/accel/ivpu/ivpu_ipc.c                      |  35 +-
 drivers/accel/ivpu/ivpu_ipc.h                      |   7 +-
 drivers/accel/ivpu/ivpu_jsm_msg.c                  |  19 +-
 drivers/acpi/arm64/gtdt.c                          |   2 +-
 drivers/acpi/cppc_acpi.c                           |   1 -
 drivers/base/firmware_loader/main.c                |   5 +-
 drivers/base/regmap/regmap-irq.c                   |   4 +
 drivers/base/trace.h                               |   6 +-
 drivers/block/brd.c                                |  70 +-
 drivers/block/loop.c                               |   6 +-
 drivers/block/ublk_drv.c                           |  17 +-
 drivers/block/virtio_blk.c                         |  46 +-
 drivers/block/zram/Kconfig                         |   1 +
 drivers/block/zram/zram_drv.c                      |  21 +-
 drivers/block/zram/zram_drv.h                      |   1 +
 drivers/bluetooth/btbcm.c                          |   4 +-
 drivers/bluetooth/btintel.c                        |  62 +-
 drivers/bluetooth/btintel.h                        |   7 +
 drivers/bluetooth/btintel_pcie.c                   | 265 +++++-
 drivers/bluetooth/btintel_pcie.h                   |  16 +-
 drivers/bluetooth/btmtk.c                          |   1 -
 drivers/bluetooth/btusb.c                          |   1 +
 drivers/bus/mhi/host/trace.h                       |  25 +-
 drivers/clk/.kunitconfig                           |   1 +
 drivers/clk/Kconfig                                |   2 -
 drivers/clk/clk-apple-nco.c                        |   3 +
 drivers/clk/clk-axi-clkgen.c                       |  22 +-
 drivers/clk/clk-en7523.c                           | 270 +++++--
 drivers/clk/clk-loongson2.c                        |   6 +-
 drivers/clk/imx/clk-fracn-gppll.c                  |  10 +-
 drivers/clk/imx/clk-imx8-acm.c                     |   4 +-
 drivers/clk/imx/clk-lpcg-scu.c                     |  37 +-
 drivers/clk/imx/clk-scu.c                          |   2 +-
 drivers/clk/mediatek/Kconfig                       |  15 -
 drivers/clk/qcom/Kconfig                           |   4 +-
 drivers/clk/ralink/clk-mtmips.c                    |  26 +-
 drivers/clk/renesas/rzg2l-cpg.c                    |  11 +-
 drivers/clk/sophgo/clk-sg2042-pll.c                |   2 +-
 drivers/clk/sunxi-ng/ccu-sun20i-d1.c               |   2 +-
 drivers/clocksource/Kconfig                        |   3 +-
 drivers/clocksource/timer-ti-dm-systimer.c         |   4 +-
 drivers/comedi/comedi_fops.c                       |  12 +
 drivers/counter/stm32-timer-cnt.c                  |  17 +-
 drivers/counter/ti-ecap-capture.c                  |   7 +-
 drivers/cpufreq/amd-pstate.c                       |  26 +-
 drivers/cpufreq/cppc_cpufreq.c                     |  63 +-
 drivers/cpufreq/loongson2_cpufreq.c                |   4 +-
 drivers/cpufreq/loongson3_cpufreq.c                |   7 +-
 drivers/cpufreq/mediatek-cpufreq-hw.c              |   2 +-
 drivers/crypto/bcm/cipher.c                        |   5 +-
 drivers/crypto/caam/caampkc.c                      |  11 +-
 drivers/crypto/caam/qi.c                           |   2 +-
 drivers/crypto/cavium/cpt/cptpf_main.c             |   6 +-
 drivers/crypto/hisilicon/hpre/hpre_main.c          |  35 +-
 drivers/crypto/hisilicon/qm.c                      |  47 +-
 drivers/crypto/hisilicon/sec2/sec_main.c           |  35 +-
 drivers/crypto/hisilicon/zip/zip_main.c            |  35 +-
 drivers/crypto/inside-secure/safexcel_hash.c       |   2 +-
 .../crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c |   2 +-
 .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c   |   2 +-
 drivers/crypto/intel/qat/qat_common/adf_aer.c      |   5 +-
 drivers/crypto/intel/qat/qat_common/adf_dbgfs.c    |  13 +-
 .../crypto/intel/qat/qat_common/adf_hw_arbiter.c   |   4 -
 drivers/crypto/mxs-dcp.c                           |  20 +-
 drivers/dax/pmem/Makefile                          |   7 -
 drivers/dax/pmem/pmem.c                            |  10 -
 drivers/dma-buf/Kconfig                            |   1 +
 drivers/dma-buf/udmabuf.c                          |  44 +-
 drivers/edac/bluefield_edac.c                      |   2 +-
 drivers/edac/fsl_ddr_edac.c                        |  22 +-
 drivers/edac/i10nm_base.c                          |   1 +
 drivers/edac/igen6_edac.c                          |   2 +
 drivers/edac/skx_common.c                          |  57 +-
 drivers/edac/skx_common.h                          |   8 +
 drivers/firmware/arm_scpi.c                        |   3 +
 drivers/firmware/efi/libstub/efi-stub.c            |   2 +-
 drivers/firmware/efi/tpm.c                         |  17 +-
 drivers/firmware/google/gsmi.c                     |   6 +-
 drivers/gpio/gpio-exar.c                           |  10 +-
 drivers/gpio/gpio-zevio.c                          |   6 +
 drivers/gpu/drm/Kconfig                            |   1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c         |  13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c      |   8 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c            |  63 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c              |   7 +
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |   2 +
 drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c           |  18 +-
 drivers/gpu/drm/amd/amdkfd/kfd_process.c           |  14 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  32 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h  |   3 +
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c |   4 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c  |  11 +-
 .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c    |  15 +-
 .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c  |   3 +
 .../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c    |   6 +-
 drivers/gpu/drm/bridge/analogix/anx7625.c          |   2 +
 drivers/gpu/drm/bridge/ite-it6505.c                |   2 +
 drivers/gpu/drm/bridge/tc358767.c                  |   7 +
 drivers/gpu/drm/drm_file.c                         |   2 +-
 drivers/gpu/drm/drm_mm.c                           |   2 +-
 drivers/gpu/drm/etnaviv/etnaviv_drv.c              |  10 +
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c              |  28 +-
 drivers/gpu/drm/fsl-dcu/Kconfig                    |   1 +
 drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c          |  15 +
 drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h          |   3 +
 drivers/gpu/drm/imagination/pvr_ccb.c              |   2 +-
 drivers/gpu/drm/imagination/pvr_vm.c               |   4 +-
 drivers/gpu/drm/imx/dcss/dcss-crtc.c               |   6 +-
 drivers/gpu/drm/imx/ipuv3/Kconfig                  |  11 +-
 drivers/gpu/drm/imx/ipuv3/imx-ldb.c                | 122 +--
 drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c             |   6 +-
 drivers/gpu/drm/imx/ipuv3/parallel-display.c       |  51 +-
 drivers/gpu/drm/msm/adreno/a6xx_gmu.c              |   4 +-
 .../drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h    |  12 -
 .../gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h |  14 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c      |   2 +-
 drivers/gpu/drm/msm/msm_gpu_devfreq.c              |   9 +-
 drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c     |   1 +
 drivers/gpu/drm/omapdrm/dss/base.c                 |  25 +-
 drivers/gpu/drm/omapdrm/dss/omapdss.h              |   3 +-
 drivers/gpu/drm/omapdrm/omap_drv.c                 |   4 +-
 drivers/gpu/drm/omapdrm/omap_gem.c                 |  10 +-
 drivers/gpu/drm/panel/panel-newvision-nv3052c.c    |   2 +-
 drivers/gpu/drm/panel/panel-novatek-nt35510.c      |  15 +-
 drivers/gpu/drm/panfrost/panfrost_devfreq.c        |   3 +-
 drivers/gpu/drm/panfrost/panfrost_gpu.c            |   1 -
 drivers/gpu/drm/panthor/panthor_devfreq.c          |  29 +-
 drivers/gpu/drm/panthor/panthor_device.h           |  28 +
 drivers/gpu/drm/panthor/panthor_sched.c            | 351 ++++++--
 drivers/gpu/drm/radeon/radeon_audio.c              |  12 +-
 drivers/gpu/drm/v3d/v3d_drv.h                      |   1 +
 drivers/gpu/drm/v3d/v3d_irq.c                      |   2 +
 drivers/gpu/drm/v3d/v3d_mmu.c                      |  31 +-
 drivers/gpu/drm/v3d/v3d_sched.c                    |  44 +-
 drivers/gpu/drm/vc4/tests/vc4_mock.c               |  12 +-
 drivers/gpu/drm/vc4/vc4_bo.c                       |  28 +-
 drivers/gpu/drm/vc4/vc4_crtc.c                     |  13 +-
 drivers/gpu/drm/vc4/vc4_drv.c                      |  22 +-
 drivers/gpu/drm/vc4/vc4_drv.h                      |   8 +-
 drivers/gpu/drm/vc4/vc4_gem.c                      |  24 +-
 drivers/gpu/drm/vc4/vc4_hdmi.c                     |  22 +-
 drivers/gpu/drm/vc4/vc4_hvs.c                      |  64 +-
 drivers/gpu/drm/vc4/vc4_irq.c                      |  10 +-
 drivers/gpu/drm/vc4/vc4_kms.c                      |  14 +-
 drivers/gpu/drm/vc4/vc4_perfmon.c                  |  20 +-
 drivers/gpu/drm/vc4/vc4_plane.c                    |  12 +-
 drivers/gpu/drm/vc4/vc4_render_cl.c                |   2 +-
 drivers/gpu/drm/vc4/vc4_v3d.c                      |  10 +-
 drivers/gpu/drm/vc4/vc4_validate.c                 |   8 +-
 drivers/gpu/drm/vc4/vc4_validate_shaders.c         |   2 +-
 drivers/gpu/drm/vkms/vkms_output.c                 |   5 +-
 drivers/gpu/drm/xe/display/xe_hdcp_gsc.c           |   2 +-
 drivers/gpu/drm/xe/xe_sync.c                       |   6 +-
 drivers/gpu/drm/xlnx/zynqmp_disp.c                 |   3 +
 drivers/gpu/drm/xlnx/zynqmp_kms.c                  |   2 +-
 drivers/hid/hid-hyperv.c                           |  58 +-
 drivers/hid/wacom_wac.c                            |   4 +-
 drivers/hwmon/aquacomputer_d5next.c                |   2 +-
 drivers/hwmon/nct6775-core.c                       |   7 +-
 drivers/hwmon/pmbus/pmbus_core.c                   |  12 +-
 drivers/hwmon/tps23861.c                           |   2 +-
 drivers/i2c/i2c-dev.c                              |  17 +-
 drivers/i3c/master.c                               |  13 +-
 drivers/iio/accel/adxl380.c                        |   2 +-
 drivers/iio/adc/ad4000.c                           |   6 +-
 drivers/iio/adc/pac1921.c                          |   4 +-
 drivers/iio/dac/adi-axi-dac.c                      |   2 +-
 drivers/iio/industrialio-backend.c                 |   4 +-
 drivers/iio/industrialio-gts-helper.c              |   2 +-
 drivers/iio/light/al3010.c                         |  11 +-
 drivers/infiniband/core/roce_gid_mgmt.c            |  30 +-
 drivers/infiniband/core/uverbs.h                   |   2 +
 drivers/infiniband/core/uverbs_main.c              |  43 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   7 +-
 drivers/infiniband/hw/bnxt_re/main.c               |  28 +-
 drivers/infiniband/hw/bnxt_re/qplib_fp.h           |   2 +-
 drivers/infiniband/hw/hns/hns_roce_cq.c            |   4 +-
 drivers/infiniband/hw/hns/hns_roce_debugfs.c       |   3 +-
 drivers/infiniband/hw/hns/hns_roce_device.h        |  14 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |  48 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         | 257 +++---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.h         |   8 +-
 drivers/infiniband/hw/hns/hns_roce_main.c          |   7 +-
 drivers/infiniband/hw/hns/hns_roce_mr.c            |  11 +-
 drivers/infiniband/hw/hns/hns_roce_qp.c            |  79 +-
 drivers/infiniband/hw/hns/hns_roce_srq.c           |   4 +-
 drivers/infiniband/hw/mlx5/main.c                  |  69 +-
 drivers/infiniband/hw/mlx5/mlx5_ib.h               |   2 +-
 drivers/infiniband/sw/rxe/rxe_qp.c                 |   1 +
 drivers/infiniband/sw/rxe/rxe_req.c                |   6 +-
 drivers/input/misc/cs40l50-vibra.c                 |   6 +-
 drivers/interconnect/qcom/icc-rpmh.c               |   3 +
 drivers/iommu/amd/io_pgtable_v2.c                  |   3 +
 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c     |   5 +-
 drivers/iommu/intel/iommu.c                        |  40 +-
 drivers/iommu/s390-iommu.c                         |  75 +-
 drivers/irqchip/irq-mvebu-sei.c                    |   2 +-
 drivers/irqchip/irq-riscv-aplic-main.c             |   3 +-
 drivers/irqchip/irq-riscv-aplic-msi.c              |   3 +
 drivers/leds/flash/leds-ktd2692.c                  |   1 +
 drivers/leds/leds-max5970.c                        |   5 +-
 drivers/mailbox/arm_mhuv2.c                        |   8 +-
 drivers/mailbox/mtk-cmdq-mailbox.c                 |   2 +-
 drivers/mailbox/omap-mailbox.c                     |   1 +
 drivers/media/i2c/adv7604.c                        |   5 +-
 drivers/media/i2c/adv7842.c                        |  13 +-
 drivers/media/i2c/ds90ub960.c                      |   2 +-
 drivers/media/i2c/max96717.c                       |   6 +-
 drivers/media/i2c/vgxy61.c                         |   2 +-
 drivers/media/pci/intel/ipu6/Kconfig               |   6 -
 drivers/media/pci/intel/ipu6/ipu6-bus.c            |   6 -
 drivers/media/pci/intel/ipu6/ipu6-buttress.c       |  34 +-
 drivers/media/pci/intel/ipu6/ipu6-cpd.c            |  18 +-
 drivers/media/pci/intel/ipu6/ipu6-dma.c            | 202 +++--
 drivers/media/pci/intel/ipu6/ipu6-dma.h            |  34 +-
 drivers/media/pci/intel/ipu6/ipu6-fw-com.c         |  14 +-
 drivers/media/pci/intel/ipu6/ipu6-mmu.c            |  28 +-
 drivers/media/pci/intel/ipu6/ipu6.c                |   3 +
 drivers/media/platform/qcom/venus/vdec.c           |  19 +-
 drivers/media/platform/qcom/venus/venc.c           |  18 +-
 drivers/media/radio/wl128x/fmdrv_common.c          |   3 +-
 drivers/media/test-drivers/vivid/vivid-vid-cap.c   |  15 +-
 drivers/media/v4l2-core/v4l2-dv-timings.c          | 132 +--
 drivers/message/fusion/mptsas.c                    |   4 +-
 drivers/mfd/da9052-spi.c                           |   2 +-
 drivers/mfd/intel_soc_pmic_bxtwc.c                 | 144 ++--
 drivers/mfd/rt5033.c                               |   4 +-
 drivers/mfd/tps65010.c                             |   8 +-
 drivers/misc/apds990x.c                            |  12 +-
 drivers/misc/lkdtm/bugs.c                          |   2 +-
 drivers/mmc/host/mmc_spi.c                         |   9 +-
 drivers/mtd/hyperbus/rpc-if.c                      |   7 +
 drivers/mtd/nand/raw/atmel/pmecc.c                 |   8 +-
 drivers/mtd/nand/raw/atmel/pmecc.h                 |   2 -
 drivers/mtd/spi-nor/core.c                         |   2 +-
 drivers/mtd/spi-nor/spansion.c                     |   1 +
 drivers/mtd/ubi/attach.c                           |  12 +-
 drivers/mtd/ubi/fastmap-wl.c                       |  19 +-
 drivers/mtd/ubi/vmt.c                              |   2 +
 drivers/mtd/ubi/wl.c                               |  11 +-
 drivers/mtd/ubi/wl.h                               |   3 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |  37 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c  |   9 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c      |   4 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h      |   3 +-
 drivers/net/ethernet/broadcom/tg3.c                |   3 +
 drivers/net/ethernet/google/gve/gve_adminq.c       |   4 +-
 drivers/net/ethernet/intel/i40e/i40e_ethtool.c     |   2 +-
 drivers/net/ethernet/intel/ice/ice_virtchnl.c      |  21 +-
 drivers/net/ethernet/marvell/octeontx2/af/cgx.c    |  70 +-
 drivers/net/ethernet/marvell/octeontx2/af/cgx.h    |   5 +
 .../ethernet/marvell/octeontx2/af/lmac_common.h    |   7 +-
 drivers/net/ethernet/marvell/octeontx2/af/rpm.c    |  87 +-
 drivers/net/ethernet/marvell/octeontx2/af/rpm.h    |  18 +-
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c    |   1 +
 drivers/net/ethernet/marvell/octeontx2/af/rvu.h    |   1 +
 .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c    |  45 +-
 drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c |   5 +
 .../ethernet/marvell/octeontx2/nic/otx2_common.c   |   4 +
 .../ethernet/marvell/octeontx2/nic/otx2_dcbnl.c    |   5 +
 .../ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c |   9 +
 .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c  |  10 +
 .../ethernet/marvell/octeontx2/nic/otx2_flows.c    |  10 +
 drivers/net/ethernet/marvell/pxa168_eth.c          |  14 +-
 drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c  |  12 +
 drivers/net/ethernet/meta/fbnic/fbnic_pci.c        |   2 -
 .../net/ethernet/microchip/vcap/vcap_api_kunit.c   |  17 +-
 drivers/net/ethernet/realtek/rtase/rtase.h         |   7 +-
 drivers/net/ethernet/realtek/rtase/rtase_main.c    |  43 +-
 .../net/ethernet/stmicro/stmmac/dwmac-socfpga.c    |   2 +
 drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c     |  24 +-
 drivers/net/ethernet/wangxun/txgbe/txgbe_main.c    |   1 -
 drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c     | 168 +---
 drivers/net/ethernet/wangxun/txgbe/txgbe_phy.h     |   2 -
 drivers/net/ethernet/wangxun/txgbe/txgbe_type.h    |   7 +-
 drivers/net/mdio/mdio-ipq4019.c                    |   5 +-
 drivers/net/netdevsim/ipsec.c                      |  11 +-
 drivers/net/usb/lan78xx.c                          |  42 +-
 drivers/net/wireless/ath/ath10k/mac.c              |   4 +-
 drivers/net/wireless/ath/ath11k/qmi.c              |   3 +
 drivers/net/wireless/ath/ath12k/dp.c               |  19 +-
 drivers/net/wireless/ath/ath12k/mac.c              |   5 +-
 drivers/net/wireless/ath/ath12k/wow.c              |   2 +-
 drivers/net/wireless/ath/ath9k/htc_hst.c           |   3 +
 .../net/wireless/broadcom/brcm80211/brcmfmac/of.c  |   3 +-
 drivers/net/wireless/intel/iwlegacy/3945.c         |   2 +-
 drivers/net/wireless/intel/iwlegacy/4965-mac.c     |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |   8 +-
 drivers/net/wireless/intersil/p54/p54spi.c         |   4 +-
 drivers/net/wireless/marvell/mwifiex/cmdevt.c      |   2 +
 drivers/net/wireless/marvell/mwifiex/fw.h          |   2 +-
 drivers/net/wireless/marvell/mwifiex/main.c        |   4 +-
 drivers/net/wireless/marvell/mwifiex/util.c        |   2 +
 drivers/net/wireless/microchip/wilc1000/netdev.c   |   6 +-
 drivers/net/wireless/realtek/rtl8xxxu/core.c       |   6 +-
 drivers/net/wireless/realtek/rtlwifi/efuse.c       |  11 +-
 drivers/net/wireless/realtek/rtw89/cam.c           | 259 ++++--
 drivers/net/wireless/realtek/rtw89/cam.h           |  24 +-
 drivers/net/wireless/realtek/rtw89/chan.c          | 219 +++--
 drivers/net/wireless/realtek/rtw89/chan.h          |   4 +-
 drivers/net/wireless/realtek/rtw89/coex.c          | 157 ++--
 drivers/net/wireless/realtek/rtw89/coex.h          |   6 +-
 drivers/net/wireless/realtek/rtw89/core.c          | 887 ++++++++++++++-------
 drivers/net/wireless/realtek/rtw89/core.h          | 421 +++++++---
 drivers/net/wireless/realtek/rtw89/debug.c         | 127 ++-
 drivers/net/wireless/realtek/rtw89/fw.c            | 637 ++++++++-------
 drivers/net/wireless/realtek/rtw89/fw.h            | 192 +++--
 drivers/net/wireless/realtek/rtw89/mac.c           | 698 +++++++++-------
 drivers/net/wireless/realtek/rtw89/mac.h           |  98 ++-
 drivers/net/wireless/realtek/rtw89/mac80211.c      | 657 ++++++++++++---
 drivers/net/wireless/realtek/rtw89/mac_be.c        |  69 +-
 drivers/net/wireless/realtek/rtw89/phy.c           | 401 ++++++----
 drivers/net/wireless/realtek/rtw89/phy.h           |   7 +-
 drivers/net/wireless/realtek/rtw89/ps.c            | 109 ++-
 drivers/net/wireless/realtek/rtw89/ps.h            |  14 +-
 drivers/net/wireless/realtek/rtw89/regd.c          |  79 +-
 drivers/net/wireless/realtek/rtw89/rtw8851b.c      |  13 +-
 drivers/net/wireless/realtek/rtw89/rtw8852a.c      |  12 +-
 drivers/net/wireless/realtek/rtw89/rtw8852b.c      |  13 +-
 drivers/net/wireless/realtek/rtw89/rtw8852bt.c     |  13 +-
 drivers/net/wireless/realtek/rtw89/rtw8852c.c      |  12 +-
 drivers/net/wireless/realtek/rtw89/rtw8922a.c      |  10 +-
 drivers/net/wireless/realtek/rtw89/ser.c           |  37 +-
 drivers/net/wireless/realtek/rtw89/wow.c           | 217 ++---
 drivers/net/wireless/realtek/rtw89/wow.h           |  10 +-
 drivers/net/wireless/silabs/wfx/main.c             |  17 +-
 drivers/net/wireless/st/cw1200/cw1200_spi.c        |   2 +-
 drivers/nvme/host/core.c                           |   5 +
 drivers/nvme/host/multipath.c                      |  21 +-
 drivers/nvme/host/pci.c                            |  55 +-
 drivers/of/fdt.c                                   |  14 +-
 drivers/of/kexec.c                                 |   2 +-
 drivers/pci/controller/cadence/pci-j721e.c         |  26 +-
 drivers/pci/controller/dwc/pcie-qcom-ep.c          |   6 +-
 drivers/pci/controller/dwc/pcie-qcom.c             |   4 +-
 drivers/pci/controller/dwc/pcie-tegra194.c         |   7 +-
 drivers/pci/endpoint/functions/pci-epf-mhi.c       |   6 +
 drivers/pci/hotplug/cpqphp_pci.c                   |  15 +-
 drivers/pci/pci.c                                  |   5 +-
 drivers/pci/slot.c                                 |   4 +-
 drivers/perf/arm-cmn.c                             |   4 +-
 drivers/perf/arm_smmuv3_pmu.c                      |  19 +-
 drivers/phy/phy-airoha-pcie-regs.h                 |   6 +-
 drivers/phy/phy-airoha-pcie.c                      |   8 +-
 drivers/phy/realtek/phy-rtk-usb2.c                 |   2 +
 drivers/phy/realtek/phy-rtk-usb3.c                 |   2 +
 drivers/pinctrl/pinctrl-k210.c                     |   2 +-
 drivers/pinctrl/pinctrl-zynqmp.c                   |   1 -
 drivers/pinctrl/qcom/pinctrl-spmi-gpio.c           |   2 +-
 drivers/pinctrl/renesas/Kconfig                    |   1 +
 drivers/pinctrl/renesas/pinctrl-rzg2l.c            |   2 +-
 drivers/platform/chrome/cros_ec_typec.c            |   1 +
 drivers/platform/x86/asus-wmi.c                    |  64 +-
 drivers/platform/x86/intel/bxtwc_tmu.c             |  22 +-
 drivers/platform/x86/intel/pmt/class.c             |   8 +-
 drivers/platform/x86/intel/pmt/class.h             |   2 +-
 drivers/platform/x86/intel/pmt/telemetry.c         |   2 +-
 drivers/platform/x86/panasonic-laptop.c            |  10 +-
 drivers/pmdomain/ti/ti_sci_pm_domains.c            |   4 +
 drivers/power/reset/Kconfig                        |   1 +
 drivers/power/sequencing/Kconfig                   |   1 +
 drivers/power/supply/bq27xxx_battery.c             |  37 +-
 drivers/power/supply/power_supply_core.c           |   2 -
 drivers/power/supply/rt9471.c                      |  52 +-
 drivers/pwm/core.c                                 |  10 +-
 drivers/pwm/pwm-imx27.c                            |  98 ++-
 drivers/regulator/qcom_smd-regulator.c             |   2 +-
 drivers/regulator/rk808-regulator.c                |  15 +-
 drivers/remoteproc/Kconfig                         |   6 +-
 drivers/remoteproc/qcom_q6v5_adsp.c                |  11 +-
 drivers/remoteproc/qcom_q6v5_mss.c                 |   6 +-
 drivers/remoteproc/qcom_q6v5_pas.c                 |  22 +-
 drivers/rpmsg/qcom_glink_native.c                  |   3 +-
 drivers/rtc/interface.c                            |   7 +-
 drivers/rtc/rtc-ab-eoz9.c                          |   7 -
 drivers/rtc/rtc-abx80x.c                           |   2 +-
 drivers/rtc/rtc-rzn1.c                             |   8 +-
 drivers/rtc/rtc-st-lpc.c                           |   5 +-
 drivers/s390/cio/cio.c                             |   6 +-
 drivers/s390/cio/device.c                          |  18 +-
 drivers/s390/virtio/virtio_ccw.c                   |   4 +
 drivers/scsi/bfa/bfad.c                            |   3 +-
 drivers/scsi/hisi_sas/hisi_sas_main.c              |   8 +-
 drivers/scsi/qedf/qedf_main.c                      |   1 +
 drivers/scsi/qedi/qedi_main.c                      |   1 +
 drivers/scsi/sg.c                                  |   9 +-
 drivers/sh/intc/core.c                             |   2 +-
 drivers/soc/fsl/qe/qmc.c                           |   4 +-
 drivers/soc/fsl/rcpm.c                             |   1 +
 drivers/soc/qcom/qcom-geni-se.c                    |   3 +-
 drivers/soc/ti/smartreflex.c                       |   4 +-
 drivers/soc/xilinx/xlnx_event_manager.c            |   4 +-
 drivers/spi/atmel-quadspi.c                        |   2 +-
 drivers/spi/spi-fsl-lpspi.c                        |  12 +-
 drivers/spi/spi-tegra210-quad.c                    |   2 +-
 drivers/spi/spi-zynqmp-gqspi.c                     |   2 +
 drivers/spi/spi.c                                  |  13 +-
 drivers/staging/media/atomisp/pci/sh_css_params.c  |   2 +
 .../vc04_services/interface/vchiq_arm/vchiq_arm.c  |   6 +-
 drivers/target/target_core_pscsi.c                 |   2 +-
 drivers/thermal/testing/zone.c                     |  32 +-
 drivers/thermal/thermal_core.c                     | 123 +--
 drivers/thermal/thermal_core.h                     |  12 +-
 drivers/tty/serial/8250/8250_fintek.c              |  14 +-
 drivers/tty/serial/8250/8250_omap.c                |   4 +-
 drivers/tty/serial/amba-pl011.c                    |   7 +
 drivers/tty/tty_io.c                               |   2 +-
 drivers/usb/dwc3/core.h                            |   4 +
 drivers/usb/dwc3/ep0.c                             |   2 +-
 drivers/usb/dwc3/gadget.c                          |  69 +-
 drivers/usb/gadget/composite.c                     |  18 +-
 drivers/usb/gadget/function/uvc_video.c            |   4 +
 drivers/usb/host/ehci-spear.c                      |   7 +-
 drivers/usb/host/xhci-pci.c                        |  10 +-
 drivers/usb/host/xhci-ring.c                       |  73 +-
 drivers/usb/host/xhci.c                            |  40 +-
 drivers/usb/host/xhci.h                            |   3 +
 drivers/usb/misc/chaoskey.c                        |  35 +-
 drivers/usb/misc/iowarrior.c                       |  50 +-
 drivers/usb/misc/usb-ljca.c                        |  20 +-
 drivers/usb/misc/yurex.c                           |   5 +-
 drivers/usb/musb/musb_gadget.c                     |  13 +-
 drivers/usb/typec/tcpm/wcove.c                     |   4 -
 drivers/usb/typec/ucsi/ucsi_ccg.c                  |   5 +
 drivers/usb/typec/ucsi/ucsi_glink.c                |   2 +-
 drivers/vdpa/mlx5/core/mr.c                        |   4 +-
 drivers/vfio/pci/mlx5/cmd.c                        |   6 +-
 drivers/vfio/pci/mlx5/main.c                       |  35 +-
 drivers/vfio/pci/vfio_pci_config.c                 |  16 +-
 drivers/video/fbdev/sh7760fb.c                     |   3 +-
 drivers/watchdog/Kconfig                           |   4 +-
 drivers/xen/xenbus/xenbus_probe.c                  |   8 +-
 fs/binfmt_elf.c                                    |   2 +
 fs/binfmt_elf_fdpic.c                              |   5 +-
 fs/binfmt_misc.c                                   |   7 +-
 fs/cachefiles/interface.c                          |  14 +-
 fs/cachefiles/ondemand.c                           |  38 +-
 fs/dlm/ast.c                                       |   2 +-
 fs/dlm/recoverd.c                                  |   2 +-
 fs/efs/super.c                                     |  43 +-
 fs/erofs/data.c                                    |  10 +-
 fs/erofs/internal.h                                |   1 +
 fs/erofs/super.c                                   |   6 +-
 fs/erofs/zmap.c                                    |  17 +-
 fs/exec.c                                          |  23 +-
 fs/exfat/file.c                                    |  10 +
 fs/exfat/namei.c                                   |  21 +-
 fs/ext4/balloc.c                                   |   4 +-
 fs/ext4/ext4.h                                     |  12 +-
 fs/ext4/extents.c                                  |   2 +-
 fs/ext4/fsmap.c                                    |  54 +-
 fs/ext4/ialloc.c                                   |   5 +-
 fs/ext4/indirect.c                                 |   2 +-
 fs/ext4/inode.c                                    |   4 +-
 fs/ext4/mballoc.c                                  |  18 +-
 fs/ext4/mballoc.h                                  |   1 +
 fs/ext4/mmp.c                                      |   2 +-
 fs/ext4/move_extent.c                              |   2 +-
 fs/ext4/resize.c                                   |   2 +-
 fs/ext4/super.c                                    |  42 +-
 fs/f2fs/checkpoint.c                               |   2 +-
 fs/f2fs/data.c                                     |  29 +-
 fs/f2fs/f2fs.h                                     |   3 +-
 fs/f2fs/file.c                                     |  17 +-
 fs/f2fs/gc.c                                       |   2 +
 fs/f2fs/node.c                                     |  10 +
 fs/f2fs/segment.c                                  |   5 +-
 fs/f2fs/segment.h                                  |  35 +-
 fs/f2fs/super.c                                    |  37 +-
 fs/fcntl.c                                         |   3 +
 fs/fuse/file.c                                     |  62 +-
 fs/fuse/fuse_i.h                                   |   6 +
 fs/fuse/virtio_fs.c                                |   1 +
 fs/gfs2/glock.c                                    |  19 +-
 fs/gfs2/glock.h                                    |   1 +
 fs/gfs2/incore.h                                   |   2 +-
 fs/gfs2/rgrp.c                                     |   2 +-
 fs/gfs2/super.c                                    |   2 +-
 fs/hfsplus/hfsplus_fs.h                            |   3 +-
 fs/hfsplus/wrapper.c                               |   2 +
 fs/hostfs/hostfs_kern.c                            |   4 +-
 fs/isofs/inode.c                                   |   8 +-
 fs/jffs2/erase.c                                   |   7 +-
 fs/jfs/xattr.c                                     |   2 +-
 fs/netfs/fscache_volume.c                          |   3 +-
 fs/nfs/blocklayout/blocklayout.c                   |  15 +-
 fs/nfs/blocklayout/dev.c                           |   6 +-
 fs/nfs/internal.h                                  |   2 +-
 fs/nfs/localio.c                                   |   6 +
 fs/nfs/nfs4proc.c                                  |   8 +-
 fs/nfs/write.c                                     |  49 +-
 fs/nfs_common/nfslocalio.c                         |   8 +-
 fs/nfsd/export.c                                   |  31 +-
 fs/nfsd/export.h                                   |   4 +-
 fs/nfsd/filecache.c                                |  14 +-
 fs/nfsd/filecache.h                                |   2 +-
 fs/nfsd/nfs4callback.c                             |  16 +-
 fs/nfsd/nfs4proc.c                                 |   7 +-
 fs/nfsd/nfs4recover.c                              |   3 +-
 fs/nfsd/nfs4state.c                                |   5 +-
 fs/nfsd/nfs4xdr.c                                  |   2 +-
 fs/nfsd/nfsfh.c                                    |  20 +-
 fs/nfsd/nfsfh.h                                    |   3 +-
 fs/notify/fsnotify.c                               |  23 +-
 fs/notify/mark.c                                   |  12 +-
 fs/ntfs3/file.c                                    |   2 +-
 fs/ocfs2/aops.h                                    |   2 +
 fs/ocfs2/file.c                                    |   4 +
 fs/proc/kcore.c                                    |  10 +-
 fs/read_write.c                                    |  15 +-
 fs/smb/client/cached_dir.c                         | 229 ++++--
 fs/smb/client/cached_dir.h                         |   6 +-
 fs/smb/client/cifsacl.c                            |  50 +-
 fs/smb/client/cifsfs.c                             |  12 +-
 fs/smb/client/cifsglob.h                           |   4 +-
 fs/smb/client/cifsproto.h                          |   5 +-
 fs/smb/client/connect.c                            |  59 +-
 fs/smb/client/fs_context.c                         |  85 +-
 fs/smb/client/fs_context.h                         |   1 +
 fs/smb/client/inode.c                              |   8 +-
 fs/smb/client/reparse.c                            |  95 ++-
 fs/smb/client/reparse.h                            |   6 +-
 fs/smb/client/smb1ops.c                            |   4 +-
 fs/smb/client/smb2file.c                           |  21 +-
 fs/smb/client/smb2inode.c                          |   6 +-
 fs/smb/client/smb2ops.c                            |   2 +-
 fs/smb/client/smb2pdu.c                            |   6 +-
 fs/smb/client/smb2proto.h                          |  11 +-
 fs/smb/client/smb2transport.c                      |  56 +-
 fs/smb/client/trace.h                              |   3 +
 fs/smb/server/server.c                             |   4 +
 fs/ubifs/super.c                                   |   6 +-
 fs/ubifs/tnc_commit.c                              |   2 +
 fs/unicode/utf8-core.c                             |   2 +-
 fs/xfs/xfs_bmap_util.c                             |   8 +-
 include/asm-generic/vmlinux.lds.h                  |   4 +-
 include/kunit/skbuff.h                             |   2 +-
 include/linux/blk-mq.h                             |   2 +
 include/linux/blkdev.h                             |  12 +-
 include/linux/bpf.h                                |   9 +-
 include/linux/cleanup.h                            |   4 +-
 include/linux/compiler_attributes.h                |  13 -
 include/linux/compiler_types.h                     |  19 +
 include/linux/f2fs_fs.h                            |   6 +-
 include/linux/fs.h                                 |   2 +-
 include/linux/hisi_acc_qm.h                        |   8 +-
 include/linux/intel_vsec.h                         |   3 +-
 include/linux/jiffies.h                            |   2 +-
 include/linux/kfifo.h                              |   1 -
 include/linux/kvm_host.h                           |   6 -
 include/linux/lockdep.h                            |   2 +-
 include/linux/mmdebug.h                            |   6 +-
 include/linux/netpoll.h                            |   2 +-
 include/linux/nfslocalio.h                         |  18 +-
 include/linux/of_fdt.h                             |   5 +-
 include/linux/once.h                               |   4 +-
 include/linux/once_lite.h                          |   2 +-
 include/linux/rcupdate.h                           |   2 +-
 include/linux/rwlock_rt.h                          |  10 +-
 include/linux/sched/ext.h                          |   1 -
 include/linux/seqlock.h                            |  98 ++-
 include/linux/spinlock_rt.h                        |  23 +-
 include/media/v4l2-dv-timings.h                    |  18 +-
 include/net/bluetooth/hci.h                        |   4 +-
 include/net/bluetooth/hci_core.h                   |  63 ++
 include/net/net_debug.h                            |   2 +-
 include/rdma/ib_verbs.h                            |  11 +
 include/uapi/linux/rtnetlink.h                     |   2 +-
 init/Kconfig                                       |   9 +
 init/initramfs.c                                   |  15 +
 io_uring/memmap.c                                  |  11 +-
 ipc/namespace.c                                    |   4 +-
 kernel/bpf/bpf_struct_ops.c                        | 114 ++-
 kernel/bpf/btf.c                                   |   5 +-
 kernel/bpf/dispatcher.c                            |   3 +-
 kernel/bpf/trampoline.c                            |   9 +-
 kernel/bpf/verifier.c                              | 103 ++-
 kernel/cgroup/cgroup.c                             |  21 +-
 kernel/fork.c                                      |  26 +-
 kernel/rcu/rcuscale.c                              |   6 +-
 kernel/rcu/srcutiny.c                              |   2 +-
 kernel/rcu/tree.c                                  |  14 +-
 kernel/rcu/tree_nocb.h                             |  13 +-
 kernel/sched/cpufreq_schedutil.c                   |   3 +-
 kernel/sched/ext.c                                 |   9 +-
 kernel/time/time.c                                 |   4 +-
 kernel/time/timer.c                                |   3 +-
 kernel/trace/bpf_trace.c                           |   5 +-
 kernel/trace/trace_event_perf.c                    |   6 +
 lib/overflow_kunit.c                               |   2 +-
 lib/string_helpers.c                               |   2 +-
 lib/strncpy_from_user.c                            |   5 +-
 mm/internal.h                                      |   2 +-
 net/9p/trans_usbg.c                                |   4 +-
 net/9p/trans_xen.c                                 |   9 +-
 net/bluetooth/hci_conn.c                           | 225 ++++--
 net/bluetooth/hci_event.c                          |  39 +-
 net/bluetooth/hci_sysfs.c                          |  15 +-
 net/bluetooth/iso.c                                | 101 ++-
 net/bluetooth/mgmt.c                               |  38 +-
 net/bluetooth/rfcomm/sock.c                        |  10 +-
 net/core/filter.c                                  |  88 +-
 net/core/netdev-genl.c                             |   2 +
 net/core/skmsg.c                                   |   4 +-
 net/hsr/hsr_device.c                               |   4 +-
 net/ipv4/inet_connection_sock.c                    |   2 +-
 net/ipv4/ipmr.c                                    |  44 +-
 net/ipv6/addrconf.c                                |  41 +-
 net/ipv6/ip6_fib.c                                 |   8 +-
 net/ipv6/ip6mr.c                                   |  40 +-
 net/ipv6/route.c                                   |  51 +-
 net/iucv/af_iucv.c                                 |  26 +-
 net/l2tp/l2tp_core.c                               |  22 +-
 net/llc/af_llc.c                                   |   2 +-
 net/netfilter/ipset/ip_set_bitmap_ip.c             |   7 +-
 net/netfilter/nf_tables_api.c                      |  62 +-
 net/netlink/af_netlink.c                           |  21 +-
 net/rfkill/rfkill-gpio.c                           |   8 +-
 net/rxrpc/af_rxrpc.c                               |   7 +-
 net/sched/sch_fq.c                                 |   6 +
 net/sunrpc/cache.c                                 |   4 +-
 net/sunrpc/svcsock.c                               |   4 +
 net/sunrpc/xprtrdma/svc_rdma.c                     |  19 +-
 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c            |   8 +-
 net/sunrpc/xprtsock.c                              |  17 +-
 net/wireless/core.c                                |  64 +-
 net/wireless/mlme.c                                |   6 -
 net/wireless/nl80211.c                             |   1 +
 net/xdp/xsk.c                                      |  11 +-
 rust/helpers/spinlock.c                            |   8 +-
 rust/kernel/block/mq/request.rs                    |  67 +-
 rust/kernel/lib.rs                                 |   2 +-
 rust/kernel/rbtree.rs                              |   9 +-
 rust/macros/lib.rs                                 |   2 +-
 samples/bpf/xdp_adjust_tail_kern.c                 |   1 +
 samples/kfifo/dma-example.c                        |   1 +
 scripts/checkpatch.pl                              |  37 +-
 scripts/faddr2line                                 |   2 +-
 scripts/kernel-doc                                 |  47 +-
 scripts/mod/file2alias.c                           |   5 +-
 scripts/package/builddeb                           |  20 +-
 security/apparmor/capability.c                     |   2 +
 security/apparmor/policy_unpack_test.c             |   6 +
 sound/core/pcm_native.c                            |   6 +-
 sound/core/rawmidi.c                               |   4 +-
 sound/core/sound_kunit.c                           |  11 +
 sound/core/ump.c                                   |   5 +-
 sound/pci/hda/patch_realtek.c                      | 153 ++--
 sound/soc/amd/acp/acp-sdw-sof-mach.c               |  16 +-
 sound/soc/amd/yc/acp6x-mach.c                      |  25 +-
 sound/soc/codecs/da7213.c                          |   1 +
 sound/soc/codecs/da7219.c                          |   9 +-
 sound/soc/codecs/rt722-sdca.c                      |   8 +-
 sound/soc/fsl/fsl-asoc-card.c                      |   8 +-
 sound/soc/fsl/fsl_micfil.c                         |   4 +-
 sound/soc/fsl/imx-audmix.c                         |   3 +
 sound/soc/mediatek/mt8188/mt8188-mt6359.c          |   9 +-
 .../mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c  |   4 +-
 sound/soc/mediatek/mt8195/mt8195-mt6359.c          |   9 +-
 sound/usb/6fire/chip.c                             |  10 +-
 sound/usb/caiaq/audio.c                            |  10 +-
 sound/usb/caiaq/audio.h                            |   1 +
 sound/usb/caiaq/device.c                           |  19 +-
 sound/usb/caiaq/input.c                            |  12 +-
 sound/usb/caiaq/input.h                            |   1 +
 sound/usb/clock.c                                  |  24 +-
 sound/usb/quirks.c                                 |  27 +-
 sound/usb/usx2y/us122l.c                           |   5 +-
 sound/usb/usx2y/usbusx2y.c                         |   2 +-
 tools/bpf/bpftool/jit_disasm.c                     |  40 +-
 tools/gpio/gpio-sloppy-logic-analyzer.sh           |   2 +-
 tools/include/nolibc/arch-s390.h                   |   1 +
 tools/lib/bpf/Makefile                             |   3 +-
 tools/lib/bpf/libbpf.c                             |  99 +--
 tools/lib/bpf/linker.c                             |   2 +
 tools/lib/thermal/commands.c                       |  52 +-
 tools/perf/Makefile.config                         |   2 +-
 tools/perf/builtin-ftrace.c                        |   2 +-
 tools/perf/builtin-list.c                          |   4 +-
 tools/perf/builtin-stat.c                          |  52 +-
 tools/perf/builtin-trace.c                         |  23 +-
 tools/perf/pmu-events/empty-pmu-events.c           |   2 +-
 tools/perf/pmu-events/jevents.py                   |   2 +-
 tools/perf/tests/attr/test-stat-default            |  94 ++-
 tools/perf/tests/attr/test-stat-detailed-1         | 110 ++-
 tools/perf/tests/attr/test-stat-detailed-2         | 134 ++--
 tools/perf/tests/attr/test-stat-detailed-3         | 142 ++--
 tools/perf/tests/shell/test_stat_intel_tpebs.sh    |  11 +-
 tools/perf/util/bpf-filter.c                       |   2 +-
 tools/perf/util/cs-etm.c                           |  25 +-
 tools/perf/util/disasm.c                           |  15 +-
 tools/perf/util/evlist.c                           |  19 +-
 tools/perf/util/evlist.h                           |   1 +
 tools/perf/util/machine.c                          |   2 +-
 tools/perf/util/mem-events.c                       |   8 +-
 tools/perf/util/pfm.c                              |   4 +-
 tools/perf/util/pmus.c                             |   2 +-
 tools/perf/util/probe-finder.c                     |  21 +-
 tools/perf/util/probe-finder.h                     |   4 +-
 tools/perf/util/stat-display.c                     | 101 ++-
 tools/power/x86/turbostat/turbostat.c              |   5 +-
 tools/testing/selftests/arm64/abi/hwcap.c          |   6 +-
 .../selftests/arm64/mte/check_tags_inclusion.c     |   4 +-
 .../testing/selftests/arm64/mte/mte_common_util.c  |   4 +-
 tools/testing/selftests/bpf/Makefile               |   3 +-
 tools/testing/selftests/bpf/network_helpers.h      |   1 +
 .../selftests/bpf/prog_tests/timer_lockup.c        |   6 +
 .../selftests/bpf/progs/test_spin_lock_fail.c      |   4 +-
 .../selftests/bpf/progs/test_tp_btf_nullable.c     |   6 +-
 tools/testing/selftests/bpf/test_progs.c           |   9 +-
 tools/testing/selftests/bpf/test_sockmap.c         | 165 +++-
 tools/testing/selftests/bpf/uprobe_multi.c         |   4 +
 .../selftests/mount_setattr/mount_setattr_test.c   |   2 +-
 tools/testing/selftests/net/Makefile               |   1 +
 .../selftests/net/ipv6_route_update_soft_lockup.sh | 262 ++++++
 .../selftests/net/netfilter/conntrack_dump_flush.c |   6 +
 tools/testing/selftests/net/pmtu.sh                |   2 +-
 tools/testing/selftests/resctrl/fill_buf.c         |   2 +-
 tools/testing/selftests/resctrl/mbm_test.c         |  16 +-
 tools/testing/selftests/resctrl/resctrl_val.c      |   3 +-
 tools/testing/selftests/vDSO/parse_vdso.c          |   3 +-
 tools/testing/selftests/wireguard/netns.sh         |   1 +
 tools/tracing/rtla/src/timerlat_hist.c             |   2 +-
 tools/tracing/rtla/src/timerlat_top.c              |   2 +-
 virt/kvm/kvm_main.c                                | 103 ---
 905 files changed, 13449 insertions(+), 6768 deletions(-)

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Darrick J. Wong <[email protected]>

I'm appointing myself to be responsible for getting after people to submit their upstream bug fixes with the appropriate Fixes tags and to cc stable; to find whatever slips through the cracks; and to keep an eye on the automatic QA of all that stuff.

---
 MAINTAINERS | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index b878ddc99f94e..23d89f2a3008e 100644
@@ -25358,8 +25358,7 @@ F:	include/xen/arm/swiotlb-xen.h
 F:	include/xen/swiotlb-xen.h
 
 XFS FILESYSTEM
-M:	Carlos Maiolino <[email protected]>
-R:	Darrick J. Wong <[email protected]>
+M:	Darrick J. Wong <[email protected]>
 L:	[email protected]
 S:	Supported
 W:	http://xfs.org/

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fangzhi Zuo <[email protected]>

[ Upstream commit 9afeda04964281e9f708b92c2a9c4f8a1387b46e ]

Streams with invalid new connector state should be elimiated from dsc policy.

---
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

index a08e8a0b696c6..f756640048fee 100644
@@ -1120,6 +1120,7 @@ static int compute_mst_dsc_configs_for_link(struct drm_atomic_state *state,
 	int i, k, ret;
 	bool debugfs_overwrite = false;
 	uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link);
+	struct drm_connector_state *new_conn_state;
 
 	memset(params, 0, sizeof(params));
 

@@ -1127,7 +1128,7 @@ static int compute_mst_dsc_configs_for_link(struct drm_atomic_state *state,
 		return PTR_ERR(mst_state);
 
 	/* Set up params */
-	DRM_DEBUG_DRIVER("%s: MST_DSC Set up params for %d streams\n", __func__, dc_state->stream_count);
+	DRM_DEBUG_DRIVER("%s: MST_DSC Try to set up params from %d streams\n", __func__, dc_state->stream_count);
 	for (i = 0; i < dc_state->stream_count; i++) {
 		struct dc_dsc_policy dsc_policy = {0};
 

@@ -1143,6 +1144,14 @@ static int compute_mst_dsc_configs_for_link(struct drm_atomic_state *state,
 		if (!aconnector->mst_output_port)
 			continue;
 
+		new_conn_state = drm_atomic_get_new_connector_state(state, &aconnector->base);
+
+		if (!new_conn_state) {
+			DRM_DEBUG_DRIVER("%s:%d MST_DSC Skip the stream 0x%p with invalid new_conn_state\n",
+					__func__, __LINE__, stream);
+			continue;
+		}
+
 		stream->timing.flags.DSC = 0;
 
 		params[count].timing = &stream->timing;

@@ -1175,6 +1184,8 @@ static int compute_mst_dsc_configs_for_link(struct drm_atomic_state *state,
 		count++;
 	}
 
+	DRM_DEBUG_DRIVER("%s: MST_DSC Params set up for %d streams\n", __func__, count);
+
 	if (count == 0) {
 		ASSERT(0);
 		return 0;

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fangzhi Zuo <[email protected]>

[ Upstream commit 4641169a8c95d9efc35d2d3c55c3948f3b375ff9 ]

A stream without dsc_aux should not be eliminated from
the dsc determination. Whether it needs a dsc recompute depends on whether its mode has changed or not. Eliminating such a no-dsc stream from the dsc determination policy will end up with inconsistencies in the new dc_state when compared to the current dc_state, triggering a dsc recompute that should not have happened.

---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index f756640048fee..32b025c92c63c 100644
@@ -1313,7 +1313,7 @@ static bool is_dsc_need_re_compute(
 			continue;
 
 		aconnector = (struct amdgpu_dm_connector *) stream->dm_stream_context;
-		if (!aconnector || !aconnector->dsc_aux)
+		if (!aconnector)
 			continue;
 
 		stream_on_link[new_stream_on_link_num] = aconnector;

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gerd Bayer <[email protected]>

[ Upstream commit 61997c1e947dbf8bc625ef86ceee00fdf2a5dba1 ]

Compiling the kernel with clang W=2 produces a warning that the parameter declarations in some routines would shadow the definition of the global variable stfle_fac_list. Address this warning by renaming the parameters to fac_list.

---
 arch/s390/include/asm/facility.h | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

index 715bcf8fb69a5..5f5b1aa6c2331 100644
@@ -88,7 +88,7 @@ static __always_inline bool test_facility(unsigned long nr)
 	return __test_facility(nr, &stfle_fac_list);
 }
 
-static inline unsigned long __stfle_asm(u64 *stfle_fac_list, int size)
+static inline unsigned long __stfle_asm(u64 *fac_list, int size)
 {
 	unsigned long reg0 = size - 1;
 

@@ -96,7 +96,7 @@ static inline unsigned long __stfle_asm(u64 *stfle_fac_list, int size)
 		"	lgr	0,%[reg0]\n"
 		"	.insn	s,0xb2b00000,%[list]\n" /* stfle */
 		"	lgr	%[reg0],0\n"
-		: [reg0] "+&d" (reg0), [list] "+Q" (*stfle_fac_list)
+		: [reg0] "+&d" (reg0), [list] "+Q" (*fac_list)
 		:
 		: "memory", "cc", "0");
 	return reg0;

@@ -104,10 +104,10 @@ static inline unsigned long __stfle_asm(u64 *stfle_fac_list, int size)
 
 /**
  * stfle - Store facility list extended
- * @stfle_fac_list: array where facility list can be stored
+ * @fac_list: array where facility list can be stored
  * @size: size of passed in array in double words
  */
-static inline void __stfle(u64 *stfle_fac_list, int size)
+static inline void __stfle(u64 *fac_list, int size)
 {
 	unsigned long nr;
 	u32 stfl_fac_list;

@@ -116,20 +116,20 @@ static inline void __stfle(u64 *stfle_fac_list, int size)
 		"	stfl	0(0)\n"
 		: "=m" (get_lowcore()->stfl_fac_list));
 	stfl_fac_list = get_lowcore()->stfl_fac_list;
-	memcpy(stfle_fac_list, &stfl_fac_list, 4);
+	memcpy(fac_list, &stfl_fac_list, 4);
 	nr = 4; /* bytes stored by stfl */
 	if (stfl_fac_list & 0x01000000) {
 		/* More facility bits available with stfle */
-		nr = __stfle_asm(stfle_fac_list, size);
+		nr = __stfle_asm(fac_list, size);
 		nr = min_t(unsigned long, (nr + 1) * 8, size * 8);
 	}
-	memset((char *) stfle_fac_list + nr, 0, size * 8 - nr);
+	memset((char *)fac_list + nr, 0, size * 8 - nr);
 }
 
-static inline void stfle(u64 *stfle_fac_list, int size)
+static inline void stfle(u64 *fac_list, int size)
 {
 	preempt_disable();
-	__stfle(stfle_fac_list, size);
+	__stfle(fac_list, size);
 	preempt_enable();
 }
 

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Halil Pasic <[email protected]>

[ Upstream commit 14c7579376279e507e52bf022192b46097a55377 ]

At least since commit 334304ac2bac ("dma-mapping: don't return errors from dma_set_max_seg_size") setting up device.dma_parms is basically mandated by the DMA API. As of now Channel (CCW) I/O in general does not utilize the DMA API, except for virtio. For virtio-ccw however the common virtio DMA infrastructure is such that most of the DMA stuff hinges on the virtio parent device, which is a CCW device.

So lets set up the dma_parms pointer for the CCW parent device and hope for the best!

---
 drivers/s390/virtio/virtio_ccw.c | 4 ++++
 1 file changed, 4 insertions(+)

index 62eca9419ad76..21fa7ac849e5c 100644
@@ -58,6 +58,8 @@ struct virtio_ccw_device {
 	struct virtio_device vdev;
 	__u8 config[VIRTIO_CCW_CONFIG_SIZE];
 	struct ccw_device *cdev;
+	/* we make cdev->dev.dma_parms point to this */
+	struct device_dma_parameters dma_parms;
 	__u32 curr_io;
 	int err;
 	unsigned int revision; /* Transport revision */

@@ -1303,6 +1305,7 @@ static int virtio_ccw_offline(struct ccw_device *cdev)
 	unregister_virtio_device(&vcdev->vdev);
 	spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
 	dev_set_drvdata(&cdev->dev, NULL);
+	cdev->dev.dma_parms = NULL;
 	spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
 	return 0;
 }

@@ -1366,6 +1369,7 @@ static int virtio_ccw_online(struct ccw_device *cdev)
 	}
 	vcdev->vdev.dev.parent = &cdev->dev;
 	vcdev->cdev = cdev;
+	cdev->dev.dma_parms = &vcdev->dma_parms;
 	vcdev->dma_area = ccw_device_dma_zalloc(vcdev->cdev,
 						sizeof(*vcdev->dma_area),
 						&vcdev->dma_area_addr);

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bill O'Donnell <[email protected]>

[ Upstream commit 51ceeb1a8142537b9f65aeaac6c301560a948197 ]

Commit 39a6c668e4 (efs: convert efs to use the new mount api) did not include anything from v2 and v3 that were also submitted. Fix this by bringing in those changes that were proposed in v2 and v3.

---
 fs/efs/super.c | 43 +++----------------------------------------
 1 file changed, 3 insertions(+), 40 deletions(-)

index e4421c10caebe..c59086b7eabfe 100644
@@ -15,7 +15,6 @@
 #include <linux/vfs.h>
 #include <linux/blkdev.h>
 #include <linux/fs_context.h>
-#include <linux/fs_parser.h>
 #include "efs.h"
 #include <linux/efs_vh.h>
 #include <linux/efs_fs_sb.h>

@@ -49,15 +48,6 @@ static struct pt_types sgi_pt_types[] = {
 	{0,		NULL}
 };
 
-enum {
-	Opt_explicit_open,
-};
-
-static const struct fs_parameter_spec efs_param_spec[] = {
-	fsparam_flag    ("explicit-open",       Opt_explicit_open),
-	{}
-};
-
 /*
  * File system definition and registration.
  */

@@ -67,7 +57,6 @@ static struct file_system_type efs_fs_type = {
 	.kill_sb		= efs_kill_sb,
 	.fs_flags		= FS_REQUIRES_DEV,
 	.init_fs_context	= efs_init_fs_context,
-	.parameters		= efs_param_spec,
 };
 MODULE_ALIAS_FS("efs");
 

@@ -265,7 +254,8 @@ static int efs_fill_super(struct super_block *s, struct fs_context *fc)
 	if (!sb_set_blocksize(s, EFS_BLOCKSIZE)) {
 		pr_err("device does not support %d byte blocks\n",
 			EFS_BLOCKSIZE);
-		return -EINVAL;
+		return invalf(fc, "device does not support %d byte blocks\n",
+			      EFS_BLOCKSIZE);
 	}
 
 	/* read the vh (volume header) block */

@@ -327,43 +317,22 @@ static int efs_fill_super(struct super_block *s, struct fs_context *fc)
 	return 0;
 }
 
-static void efs_free_fc(struct fs_context *fc)
-{
-	kfree(fc->fs_private);
-}
-
 static int efs_get_tree(struct fs_context *fc)
 {
 	return get_tree_bdev(fc, efs_fill_super);
 }
 
-static int efs_parse_param(struct fs_context *fc, struct fs_parameter *param)
-{
-	int token;
-	struct fs_parse_result result;
-
-	token = fs_parse(fc, efs_param_spec, param, &result);
-	if (token < 0)
-		return token;
-	return 0;
-}
-
 static int efs_reconfigure(struct fs_context *fc)
 {
 	sync_filesystem(fc->root->d_sb);
+	fc->sb_flags |= SB_RDONLY;
 
 	return 0;
 }
 
-struct efs_context {
-	unsigned long s_mount_opts;
-};
-
 static const struct fs_context_operations efs_context_opts = {
-	.parse_param	= efs_parse_param,
 	.get_tree	= efs_get_tree,
 	.reconfigure	= efs_reconfigure,
-	.free		= efs_free_fc,
 };
 
 /*

@@ -371,12 +340,6 @@ static const struct fs_context_operations efs_context_opts = {
  */
 static int efs_init_fs_context(struct fs_context *fc)
 {
-	struct efs_context *ctx;
-
-	ctx = kzalloc(sizeof(struct efs_context), GFP_KERNEL);
-	if (!ctx)
-		return -ENOMEM;
-	fc->fs_private = ctx;
 	fc->ops = &efs_context_opts;
 
 	return 0;

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kristina Martsenko <[email protected]>

[ Upstream commit c56c599d9002d44f559be3852b371db46adac87c ]

FEAT_MOPS instructions require that all three instructions (prologue, main and epilogue) appear consecutively in memory. Placing a kprobe/uprobe on one of them doesn't work as only a single instruction gets executed out-of-line or simulated. So don't allow placing a probe on a MOPS instruction.

---
 arch/arm64/include/asm/insn.h          | 1 +
 arch/arm64/kernel/probes/decode-insn.c | 7 +++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

index 8c0a36f72d6fc..bc77869dbd43b 100644
@@ -353,6 +353,7 @@ __AARCH64_INSN_FUNCS(ldrsw_lit,	0xFF000000, 0x98000000)
 __AARCH64_INSN_FUNCS(exclusive,	0x3F800000, 0x08000000)
 __AARCH64_INSN_FUNCS(load_ex,	0x3F400000, 0x08400000)
 __AARCH64_INSN_FUNCS(store_ex,	0x3F400000, 0x08000000)
+__AARCH64_INSN_FUNCS(mops,	0x3B200C00, 0x19000400)
 __AARCH64_INSN_FUNCS(stp,	0x7FC00000, 0x29000000)
 __AARCH64_INSN_FUNCS(ldp,	0x7FC00000, 0x29400000)
 __AARCH64_INSN_FUNCS(stp_post,	0x7FC00000, 0x28800000)

index 3496d6169e59b..42b69936cee34 100644
@@ -58,10 +58,13 @@ static bool __kprobes aarch64_insn_is_steppable(u32 insn)
 	 * Instructions which load PC relative literals are not going to work
 	 * when executed from an XOL slot. Instructions doing an exclusive
 	 * load/store are not going to complete successfully when single-step
-	 * exception handling happens in the middle of the sequence.
+	 * exception handling happens in the middle of the sequence. Memory
+	 * copy/set instructions require that all three instructions be placed
+	 * consecutively in memory.
 	 */
 	if (aarch64_insn_uses_literal(insn) ||
-	    aarch64_insn_is_exclusive(insn))
+	    aarch64_insn_is_exclusive(insn) ||
+	    aarch64_insn_is_mops(insn))
 		return false;
 
 	return true;

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andre Przywara <[email protected]>

[ Upstream commit b0d80dbc378d52155c9ecf9579986edccceed3aa ]

The F8DP2 DPISA extension has a separate cpuinfo field, named accordingly.
Change the erroneously placed name of "f8dp4" to "f8dp2".

---
 tools/testing/selftests/arm64/abi/hwcap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index f2d6007a2b983..7e95ba5fd4962 100644
@@ -490,7 +490,7 @@ static const struct hwcap_data {
 		.name = "F8DP2",
 		.at_hwcap = AT_HWCAP2,
 		.hwcap_bit = HWCAP2_F8DP2,
-		.cpuinfo = "f8dp4",
+		.cpuinfo = "f8dp2",
 		.sigill_fn = f8dp2_sigill,
 	},
 	{

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andre Przywara <[email protected]>

[ Upstream commit 7e893dc81de3e342156389ea0b83ec7d07f25281 ]

When printing the signal context's PC, we use a "%lx" format specifier, which matches the common userland (glibc's) definition of uint64_t as an "unsigned long". However the structure in question is defined in a kernel uapi header, which uses a self defined __u64 type, and the arm64 kernel headers define this using "int-ll64.h", so it becomes an "unsigned long long". This mismatch leads to the usual compiler warning.

The common fix would be to use "PRIx64", but because this is defined by the userland's toolchain libc headers, it wouldn't match as well. Since we know the exact type of __u64, just use "%llx" here instead, to silence this warning.

This also fixes a more severe typo: "$lx" is not a valid format specifier.

---
 tools/testing/selftests/arm64/mte/mte_common_util.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 00ffd34c66d30..1120f5aa76550 100644
@@ -38,7 +38,7 @@ void mte_default_handler(int signum, siginfo_t *si, void *uc)
 			if (cur_mte_cxt.trig_si_code == si->si_code)
 				cur_mte_cxt.fault_valid = true;
 			else
-				ksft_print_msg("Got unexpected SEGV_MTEAERR at pc=$lx, fault addr=%lx\n",
+				ksft_print_msg("Got unexpected SEGV_MTEAERR at pc=%llx, fault addr=%lx\n",
 					       ((ucontext_t *)uc)->uc_mcontext.pc,
 					       addr);
 			return;

@@ -64,7 +64,7 @@ void mte_default_handler(int signum, siginfo_t *si, void *uc)
 			exit(1);
 		}
 	} else if (signum == SIGBUS) {
-		ksft_print_msg("INFO: SIGBUS signal at pc=%lx, fault addr=%lx, si_code=%lx\n",
+		ksft_print_msg("INFO: SIGBUS signal at pc=%llx, fault addr=%lx, si_code=%x\n",
 				((ucontext_t *)uc)->uc_mcontext.pc, addr, si->si_code);
 		if ((cur_mte_cxt.trig_range >= 0 &&
 		     addr >= MT_CLEAR_TAG(cur_mte_cxt.trig_addr) &&

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andre Przywara <[email protected]>

[ Upstream commit 96dddb7b9406259baace9a1831e8da155311be6f ]

When checking MTE tags, we print some diagnostic messages when the tests fail. Some variables uses there are "longs", however we only use "%x" for the format specifier.

Update the format specifiers to "%lx", to match the variable types they are supposed to print.

---
 tools/testing/selftests/arm64/mte/check_tags_inclusion.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 2b1425b92b699..a3d1e23fe02af 100644
@@ -65,7 +65,7 @@ static int check_single_included_tags(int mem_type, int mode)
 			ptr = mte_insert_tags(ptr, BUFFER_SIZE);
 			/* Check tag value */
 			if (MT_FETCH_TAG((uintptr_t)ptr) == tag) {
-				ksft_print_msg("FAIL: wrong tag = 0x%x with include mask=0x%x\n",
+				ksft_print_msg("FAIL: wrong tag = 0x%lx with include mask=0x%x\n",
 					       MT_FETCH_TAG((uintptr_t)ptr),
 					       MT_INCLUDE_VALID_TAG(tag));
 				result = KSFT_FAIL;

@@ -97,7 +97,7 @@ static int check_multiple_included_tags(int mem_type, int mode)
 			ptr = mte_insert_tags(ptr, BUFFER_SIZE);
 			/* Check tag value */
 			if (MT_FETCH_TAG((uintptr_t)ptr) < tag) {
-				ksft_print_msg("FAIL: wrong tag = 0x%x with include mask=0x%x\n",
+				ksft_print_msg("FAIL: wrong tag = 0x%lx with include mask=0x%lx\n",
 					       MT_FETCH_TAG((uintptr_t)ptr),
 					       MT_INCLUDE_VALID_TAGS(excl_mask));
 				result = KSFT_FAIL;

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: John Garry <[email protected]>

[ Upstream commit 9a8dbdadae509e5717ff6e5aa572ca0974d2101d ]

Darrick and Hannes both thought it better that generic_atomic_write_valid() should be passed a struct iocb, and not just the member of that struct which is referenced; see [0] and [1].

I think that makes a more generic and clean API, so make that change.

[0] https://lore.kernel.org/linux-block/[email protected]/
[1] https://lore.kernel.org/linux-xfs/20240620212401.GA3058325@frogsfrogsfrogs/

---
 block/fops.c       | 8 ++++----
 fs/read_write.c    | 4 ++--
 include/linux/fs.h | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

index e696ae53bf1e0..968b47b615c4b 100644
@@ -35,13 +35,13 @@ static blk_opf_t dio_bio_write_op(struct kiocb *iocb)
 	return opf;
 }
 
-static bool blkdev_dio_invalid(struct block_device *bdev, loff_t pos,
+static bool blkdev_dio_invalid(struct block_device *bdev, struct kiocb *iocb,
 				struct iov_iter *iter, bool is_atomic)
 {
-	if (is_atomic && !generic_atomic_write_valid(iter, pos))
+	if (is_atomic && !generic_atomic_write_valid(iocb, iter))
 		return true;
 
-	return pos & (bdev_logical_block_size(bdev) - 1) ||
+	return iocb->ki_pos & (bdev_logical_block_size(bdev) - 1) ||
 		!bdev_iter_is_aligned(bdev, iter);
 }
 

@@ -374,7 +374,7 @@ static ssize_t blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
 	if (!iov_iter_count(iter))
 		return 0;
 
-	if (blkdev_dio_invalid(bdev, iocb->ki_pos, iter, is_atomic))
+	if (blkdev_dio_invalid(bdev, iocb, iter, is_atomic))
 		return -EINVAL;
 
 	nr_pages = bio_iov_vecs_to_alloc(iter, BIO_MAX_VECS + 1);

index 64dc24afdb3a7..2c32635308281 100644
@@ -1830,7 +1830,7 @@ int generic_file_rw_checks(struct file *file_in, struct file *file_out)
 	return 0;
 }
 
-bool generic_atomic_write_valid(struct iov_iter *iter, loff_t pos)
+bool generic_atomic_write_valid(struct kiocb *iocb, struct iov_iter *iter)
 {
 	size_t len = iov_iter_count(iter);
 

@@ -1840,7 +1840,7 @@ bool generic_atomic_write_valid(struct iov_iter *iter, loff_t pos)
 	if (!is_power_of_2(len))
 		return false;
 
-	if (!IS_ALIGNED(pos, len))
+	if (!IS_ALIGNED(iocb->ki_pos, len))
 		return false;
 
 	return true;

index 3559446279c15..faf7596ace971 100644
@@ -3726,6 +3726,6 @@ static inline bool vfs_empty_path(int dfd, const char __user *path)
 	return !c;
 }
 
-bool generic_atomic_write_valid(struct iov_iter *iter, loff_t pos);
+bool generic_atomic_write_valid(struct kiocb *iocb, struct iov_iter *iter);
 
 #endif /* _LINUX_FS_H */

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: John Garry <[email protected]>

[ Upstream commit c3be7ebbbce5201e151f17e28a6c807602f369c9 ]

Currently FMODE_CAN_ATOMIC_WRITE is set if the bdev can atomic write and the file is open for direct IO. This does not work if the file is not opened for direct IO, yet fcntl(O_DIRECT) is used on the fd later.

Change to check for direct IO on a per-IO basis in generic_atomic_write_valid(). Since we want to report -EOPNOTSUPP for non-direct IO for an atomic write, change to return an error code.

Relocate the block fops atomic write checks to the common write path, as to catch non-direct IO.

---
 block/fops.c       | 18 ++++++++++--------
 fs/read_write.c    | 13 ++++++++-----
 include/linux/fs.h |  2 +-
 3 files changed, 19 insertions(+), 14 deletions(-)

index 968b47b615c4b..2d01c90076813 100644
@@ -36,11 +36,8 @@ static blk_opf_t dio_bio_write_op(struct kiocb *iocb)
 }
 
 static bool blkdev_dio_invalid(struct block_device *bdev, struct kiocb *iocb,
-				struct iov_iter *iter, bool is_atomic)
+				struct iov_iter *iter)
 {
-	if (is_atomic && !generic_atomic_write_valid(iocb, iter))
-		return true;
-
 	return iocb->ki_pos & (bdev_logical_block_size(bdev) - 1) ||
 		!bdev_iter_is_aligned(bdev, iter);
 }

@@ -368,13 +365,12 @@ static ssize_t __blkdev_direct_IO_async(struct kiocb *iocb,
 static ssize_t blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
 {
 	struct block_device *bdev = I_BDEV(iocb->ki_filp->f_mapping->host);
-	bool is_atomic = iocb->ki_flags & IOCB_ATOMIC;
 	unsigned int nr_pages;
 
 	if (!iov_iter_count(iter))
 		return 0;
 
-	if (blkdev_dio_invalid(bdev, iocb, iter, is_atomic))
+	if (blkdev_dio_invalid(bdev, iocb, iter))
 		return -EINVAL;
 
 	nr_pages = bio_iov_vecs_to_alloc(iter, BIO_MAX_VECS + 1);

@@ -383,7 +379,7 @@ static ssize_t blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
 			return __blkdev_direct_IO_simple(iocb, iter, bdev,
 							nr_pages);
 		return __blkdev_direct_IO_async(iocb, iter, bdev, nr_pages);
-	} else if (is_atomic) {
+	} else if (iocb->ki_flags & IOCB_ATOMIC) {
 		return -EINVAL;
 	}
 	return __blkdev_direct_IO(iocb, iter, bdev, bio_max_segs(nr_pages));

@@ -625,7 +621,7 @@ static int blkdev_open(struct inode *inode, struct file *filp)
 	if (!bdev)
 		return -ENXIO;
 
-	if (bdev_can_atomic_write(bdev) && filp->f_flags & O_DIRECT)
+	if (bdev_can_atomic_write(bdev))
 		filp->f_mode |= FMODE_CAN_ATOMIC_WRITE;
 
 	ret = bdev_open(bdev, mode, filp->private_data, NULL, filp);

@@ -700,6 +696,12 @@ static ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)
 	if ((iocb->ki_flags & (IOCB_NOWAIT | IOCB_DIRECT)) == IOCB_NOWAIT)
 		return -EOPNOTSUPP;
 
+	if (iocb->ki_flags & IOCB_ATOMIC) {
+		ret = generic_atomic_write_valid(iocb, from);
+		if (ret)
+			return ret;
+	}
+
 	size -= iocb->ki_pos;
 	if (iov_iter_count(from) > size) {
 		shorted = iov_iter_count(from) - size;

index 2c32635308281..befec0b5c537a 100644
@@ -1830,18 +1830,21 @@ int generic_file_rw_checks(struct file *file_in, struct file *file_out)
 	return 0;
 }
 
-bool generic_atomic_write_valid(struct kiocb *iocb, struct iov_iter *iter)
+int generic_atomic_write_valid(struct kiocb *iocb, struct iov_iter *iter)
 {
 	size_t len = iov_iter_count(iter);
 
 	if (!iter_is_ubuf(iter))
-		return false;
+		return -EINVAL;
 
 	if (!is_power_of_2(len))
-		return false;
+		return -EINVAL;
 
 	if (!IS_ALIGNED(iocb->ki_pos, len))
-		return false;
+		return -EINVAL;
 
-	return true;
+	if (!(iocb->ki_flags & IOCB_DIRECT))
+		return -EOPNOTSUPP;
+
+	return 0;
 }

index faf7596ace971..4b5cad44a1268 100644
@@ -3726,6 +3726,6 @@ static inline bool vfs_empty_path(int dfd, const char __user *path)
 	return !c;
 }
 
-bool generic_atomic_write_valid(struct kiocb *iocb, struct iov_iter *iter);
+int generic_atomic_write_valid(struct kiocb *iocb, struct iov_iter *iter);
 
 #endif /* _LINUX_FS_H */

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vineeth Vijayan <[email protected]>

[ Upstream commit 8c58a229688ce3a097b3b1a2efe1b4f5508c2123 ]

Starting with commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers"), CIO does not unregister subchannels when the attached device is invalid or unavailable. Instead, it allows subchannels to exist without a connected device. However, if the DNV value is 0, such as, when all the CHPIDs of a subchannel are configured in standby state, the subchannel is unregistered, which contradicts the current subchannel specification.

Update the logic so that subchannels are not unregistered based on the DNV value. Also update the SCHIB information even if the DNV bit is zero.

---
 drivers/s390/cio/cio.c    |  6 +++++-
 drivers/s390/cio/device.c | 18 +++++++++++++++++-
 2 files changed, 22 insertions(+), 2 deletions(-)

index c32e818f06dba..ad17ab0a93149 100644
@@ -459,10 +459,14 @@ int cio_update_schib(struct subchannel *sch)
 {
 	struct schib schib;
 
-	if (stsch(sch->schid, &schib) || !css_sch_is_valid(&schib))
+	if (stsch(sch->schid, &schib))
 		return -ENODEV;
 
 	memcpy(&sch->schib, &schib, sizeof(schib));
+
+	if (!css_sch_is_valid(&schib))
+		return -EACCES;
+
 	return 0;
 }
 EXPORT_SYMBOL_GPL(cio_update_schib);

index b0f23242e1714..9498825d9c7a5 100644
@@ -1387,14 +1387,18 @@ enum io_sch_action {
 	IO_SCH_VERIFY,
 	IO_SCH_DISC,
 	IO_SCH_NOP,
+	IO_SCH_ORPH_CDEV,
 };
 
 static enum io_sch_action sch_get_action(struct subchannel *sch)
 {
 	struct ccw_device *cdev;
+	int rc;
 
 	cdev = sch_get_cdev(sch);
-	if (cio_update_schib(sch)) {
+	rc = cio_update_schib(sch);
+
+	if (rc == -ENODEV) {
 		/* Not operational. */
 		if (!cdev)
 			return IO_SCH_UNREG;

@@ -1402,6 +1406,16 @@ static enum io_sch_action sch_get_action(struct subchannel *sch)
 			return IO_SCH_UNREG;
 		return IO_SCH_ORPH_UNREG;
 	}
+
+	/* Avoid unregistering subchannels without working device. */
+	if (rc == -EACCES) {
+		if (!cdev)
+			return IO_SCH_NOP;
+		if (ccw_device_notify(cdev, CIO_GONE) != NOTIFY_OK)
+			return IO_SCH_UNREG_CDEV;
+		return IO_SCH_ORPH_CDEV;
+	}
+
 	/* Operational. */
 	if (!cdev)
 		return IO_SCH_ATTACH;

@@ -1471,6 +1485,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
 		rc = 0;
 		goto out_unlock;
 	case IO_SCH_ORPH_UNREG:
+	case IO_SCH_ORPH_CDEV:
 	case IO_SCH_ORPH_ATTACH:
 		ccw_device_set_disconnected(cdev);
 		break;

@@ -1502,6 +1517,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
 	/* Handle attached ccw device. */
 	switch (action) {
 	case IO_SCH_ORPH_UNREG:
+	case IO_SCH_ORPH_CDEV:
 	case IO_SCH_ORPH_ATTACH:
 		/* Move ccw device to orphanage. */
 		rc = ccw_device_move_to_orph(cdev);

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heiko Carstens <[email protected]>

[ Upstream commit 2835f8bf5530750c3381166005934f996a83ad05 ]

kernel_page_present() was intentionally not implemented when adding ARCH_HAS_SET_DIRECT_MAP support, since it was only used for suspend/resume which is not supported anymore on s390.

A new bpf use case led to a compile error specific to s390. Even though this specific use case went away implement kernel_page_present(), so that the API is complete and potential future users won't run into this problem.

---
 arch/s390/include/asm/set_memory.h |  1 +
 arch/s390/mm/pageattr.c            | 15 +++++++++++++++
 2 files changed, 16 insertions(+)

index 06fbabe2f66c9..cb4cc0f59012f 100644
@@ -62,5 +62,6 @@ __SET_MEMORY_FUNC(set_memory_4k, SET_MEMORY_4K)
 
 int set_direct_map_invalid_noflush(struct page *page);
 int set_direct_map_default_noflush(struct page *page);
+bool kernel_page_present(struct page *page);
 
 #endif

index 5f805ad42d4c3..aec9eb16b6f7b 100644
@@ -406,6 +406,21 @@ int set_direct_map_default_noflush(struct page *page)
 	return __set_memory((unsigned long)page_to_virt(page), 1, SET_MEMORY_DEF);
 }
 
+bool kernel_page_present(struct page *page)
+{
+	unsigned long addr;
+	unsigned int cc;
+
+	addr = (unsigned long)page_address(page);
+	asm volatile(
+		"	lra	%[addr],0(%[addr])\n"
+		"	ipm	%[cc]\n"
+		: [cc] "=d" (cc), [addr] "+a" (addr)
+		:
+		: "cc");
+	return (cc >> 28) == 0;
+}
+
 #if defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE)
 
 static void ipte_range(pte_t *pte, unsigned long address, int nr)

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ard Biesheuvel <[email protected]>

[ Upstream commit e8fbc0d9cab6c1ee6403f42c0991b0c1d5dbc092 ]

Calling C code via a different mapping than it was linked at is problematic, because the compiler assumes that RIP-relative and absolute symbol references are interchangeable. GCC in particular may use RIP-relative per-CPU variable references even when not using -fpic.

So call xen_prepare_pvh() via its kernel virtual mapping on x86_64, so that those RIP-relative references produce the correct values. This matches the pre-existing behavior for i386, which also invokes xen_prepare_pvh() via the kernel virtual mapping before invoking startup_32 with paging disabled again.

Message-ID: <[email protected]>

---
 arch/x86/platform/pvh/head.S | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

index 64fca49cd88ff..ce4fd8d33da46 100644
@@ -172,7 +172,14 @@ SYM_CODE_START_LOCAL(pvh_start_xen)
 	movq %rbp, %rbx
 	subq $_pa(pvh_start_xen), %rbx
 	movq %rbx, phys_base(%rip)
-	call xen_prepare_pvh
+
+	/* Call xen_prepare_pvh() via the kernel virtual mapping */
+	leaq xen_prepare_pvh(%rip), %rax
+	subq phys_base(%rip), %rax
+	addq $__START_KERNEL_map, %rax
+	ANNOTATE_RETPOLINE_SAFE
+	call *%rax
+
 	/*
 	 * Clear phys_base.  __startup_64 will *add* to its value,
 	 * so reset to 0.

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yang Erkun <[email protected]>

[ Upstream commit 826cc42adf44930a633d11a5993676d85ddb0842 ]

My colleague Wupeng found the following problems during fault injection:

BUG: unable to handle page fault for address: fffffbfff809d073
PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.1-2.fc37 04/01/2014
RIP: 0010:__asan_load8+0x4c/0xa0
...
Call Trace:
 <TASK>
 blkdev_put_whole+0x41/0x70
 bdev_release+0x1a3/0x250
 blkdev_release+0x11/0x20
 __fput+0x1d7/0x4a0
 task_work_run+0xfc/0x180
 syscall_exit_to_user_mode+0x1de/0x1f0
 do_syscall_64+0x6b/0x170
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

loop_init() is calling loop_add() after __register_blkdev() succeeds and is ignoring disk_add() failure from loop_add(), for loop_add() failure is not fatal and successfully created disks are already visible to bdev_open().

brd_init() is currently calling brd_alloc() before __register_blkdev() succeeds and is releasing successfully created disks when brd_init() returns an error. This can cause UAF for the latter two case:

case 1:

    T1:

modprobe brd
brd_init
brd_alloc(0) // success
add_disk
disk_scan_partitions
bdev_file_open_by_dev // alloc file fput // won't free until back to userspace
brd_alloc(1) // failed since mem alloc error inject
// error path for modprobe will release code segment // back to userspace
__fput

    blkdev_release
      bdev_release
        blkdev_put_whole
          bdev->bd_disk->fops->release // fops is freed now, UAF!

case 2:
T1: T2:
modprobe brd
brd_init

    brd_alloc(0) // success
                                   open(/dev/ram0)
    brd_alloc(1) // fail

// error path for modprobe

                                   close(/dev/ram0)
                                   ...
                                   /* UAF! */
                                   bdev->bd_disk->fops->release

Fix this problem by following what loop_init() does. Besides, reintroduce brd_devices_mutex to help serialize modifications to brd_list.

---
 drivers/block/brd.c | 66 ++++++++++++++++++++++++++++++---------------
 1 file changed, 44 insertions(+), 22 deletions(-)

index 2fd1ed1017481..5a95671d81515 100644
@@ -316,8 +316,40 @@ __setup("ramdisk_size=", ramdisk_size);
  * (should share code eventually).
  */
 static LIST_HEAD(brd_devices);
+static DEFINE_MUTEX(brd_devices_mutex);
 static struct dentry *brd_debugfs_dir;
 
+static struct brd_device *brd_find_or_alloc_device(int i)
+{
+	struct brd_device *brd;
+
+	mutex_lock(&brd_devices_mutex);
+	list_for_each_entry(brd, &brd_devices, brd_list) {
+		if (brd->brd_number == i) {
+			mutex_unlock(&brd_devices_mutex);
+			return ERR_PTR(-EEXIST);
+		}
+	}
+
+	brd = kzalloc(sizeof(*brd), GFP_KERNEL);
+	if (!brd) {
+		mutex_unlock(&brd_devices_mutex);
+		return ERR_PTR(-ENOMEM);
+	}
+	brd->brd_number	= i;
+	list_add_tail(&brd->brd_list, &brd_devices);
+	mutex_unlock(&brd_devices_mutex);
+	return brd;
+}
+
+static void brd_free_device(struct brd_device *brd)
+{
+	mutex_lock(&brd_devices_mutex);
+	list_del(&brd->brd_list);
+	mutex_unlock(&brd_devices_mutex);
+	kfree(brd);
+}
+
 static int brd_alloc(int i)
 {
 	struct brd_device *brd;

@@ -340,14 +372,9 @@ static int brd_alloc(int i)
 					  BLK_FEAT_NOWAIT,
 	};
 
-	list_for_each_entry(brd, &brd_devices, brd_list)
-		if (brd->brd_number == i)
-			return -EEXIST;
-	brd = kzalloc(sizeof(*brd), GFP_KERNEL);
-	if (!brd)
-		return -ENOMEM;
-	brd->brd_number		= i;
-	list_add_tail(&brd->brd_list, &brd_devices);
+	brd = brd_find_or_alloc_device(i);
+	if (IS_ERR(brd))
+		return PTR_ERR(brd);
 
 	xa_init(&brd->brd_pages);
 

@@ -378,8 +405,7 @@ static int brd_alloc(int i)
 out_cleanup_disk:
 	put_disk(disk);
 out_free_dev:
-	list_del(&brd->brd_list);
-	kfree(brd);
+	brd_free_device(brd);
 	return err;
 }
 

@@ -398,8 +424,7 @@ static void brd_cleanup(void)
 		del_gendisk(brd->brd_disk);
 		put_disk(brd->brd_disk);
 		brd_free_pages(brd);
-		list_del(&brd->brd_list);
-		kfree(brd);
+		brd_free_device(brd);
 	}
 }
 

@@ -426,16 +451,6 @@ static int __init brd_init(void)
 {
 	int err, i;
 
-	brd_check_and_reset_par();
-
-	brd_debugfs_dir = debugfs_create_dir("ramdisk_pages", NULL);
-
-	for (i = 0; i < rd_nr; i++) {
-		err = brd_alloc(i);
-		if (err)
-			goto out_free;
-	}
-
 	/*
 	 * brd module now has a feature to instantiate underlying device
 	 * structure on-demand, provided that there is an access dev node.

@@ -451,11 +466,18 @@ static int __init brd_init(void)
 	 *	dynamically.
 	 */
 
+	brd_check_and_reset_par();
+
+	brd_debugfs_dir = debugfs_create_dir("ramdisk_pages", NULL);
+
 	if (__register_blkdev(RAMDISK_MAJOR, "ramdisk", brd_probe)) {
 		err = -EIO;
 		goto out_free;
 	}
 
+	for (i = 0; i < rd_nr; i++)
+		brd_alloc(i);
+
 	pr_info("brd: module loaded\n");
 	return 0;
 

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jan Kara <[email protected]>

[ Upstream commit 76486b104168ae59703190566e372badf433314b ]

When we remount filesystem with 'abort' mount option while changing other mount options as well (as is LTP test doing), we can return error from the system call after commit d3476f3dad4a ("ext4: don't set SB_RDONLY after filesystem errors") because the application of mount option changes detects shutdown filesystem and refuses to do anything. The behavior of application of other mount options in presence of 'abort' mount option is currently rather arbitary as some mount option changes are handled before 'abort' and some after it.

Move aborting of the filesystem to the end of remount handling so all requested changes are properly applied before the filesystem is shutdown to have a reasonably consistent behavior.

---
 fs/ext4/super.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

index 16a4ce704460e..4645f16296732 100644
@@ -6518,9 +6518,6 @@ static int __ext4_remount(struct fs_context *fc, struct super_block *sb)
 		goto restore_opts;
 	}
 
-	if (test_opt2(sb, ABORT))
-		ext4_abort(sb, ESHUTDOWN, "Abort forced by user");
-
 	sb->s_flags = (sb->s_flags & ~SB_POSIXACL) |
 		(test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0);
 

@@ -6689,6 +6686,14 @@ static int __ext4_remount(struct fs_context *fc, struct super_block *sb)
 	if (!ext4_has_feature_mmp(sb) || sb_rdonly(sb))
 		ext4_stop_mmpd(sbi);
 
+	/*
+	 * Handle aborting the filesystem as the last thing during remount to
+	 * avoid obsure errors during remount when some option changes fail to
+	 * apply due to shutdown filesystem.
+	 */
+	if (test_opt2(sb, ABORT))
+		ext4_abort(sb, ESHUTDOWN, "Abort forced by user");
+
 	return 0;
 
 restore_opts:

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jonas Gorski <[email protected]>

[ Upstream commit da09935975c8f8c90d6f57be2422dee5557206cd ]

When MIPS_FP_SUPPORT is disabled, __sanitize_fcr31() is defined as nothing, which triggers a gcc warning:

In file included from kernel/sched/core.c:79:
kernel/sched/core.c: In function 'context_switch':
./arch/mips/include/asm/switch_to.h:114:39: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
114 | __sanitize_fcr31(next); \
| ^
kernel/sched/core.c:5316:9: note: in expansion of macro 'switch_to'
5316 | switch_to(prev, next, prev);
| ^~~~~~~~~

Fix this by providing an empty body for __sanitize_fcr31() like one is defined for __mips_mt_fpaff_switch_to().

---
 arch/mips/include/asm/switch_to.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index a4374b4cb88fd..d6ccd53440213 100644
@@ -97,7 +97,7 @@ do {									\
 	}								\
 } while (0)
 #else
-# define __sanitize_fcr31(next)
+# define __sanitize_fcr31(next) do { (void) (next); } while (0)
 #endif
 
 /*

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Richter <[email protected]>

[ Upstream commit f55bd479d8663a4a4e403b3d308d3d1aa33d92df ]

Reservation of the PMU hardware is done at first event creation and is protected by a pair of mutex_lock() and mutex_unlock(). After reservation of the PMU hardware the memory required for the PMUs the event is to be installed on is allocated by allocate_buffers() and alloc_sampling_buffer(). This done outside of the mutex protection.
Without mutex protection two or more concurrent invocations of perf_event_init() may run in parallel.
This can lead to allocation of Sample Data Blocks (SDBs) multiple times for the same PMU.
Prevent this and protect memory allocation of SDBs by mutex.

---
 arch/s390/kernel/perf_cpum_sf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 5b765e3ccf0ca..3317f4878eaa7 100644
@@ -759,7 +759,6 @@ static int __hw_perf_event_init(struct perf_event *event)
 		reserve_pmc_hardware();
 		refcount_set(&num_events, 1);
 	}
-	mutex_unlock(&pmc_reserve_mutex);
 	event->destroy = hw_perf_event_destroy;
 
 	/* Access per-CPU sampling information (query sampling info) */

@@ -848,6 +847,7 @@ static int __hw_perf_event_init(struct perf_event *event)
 		if (is_default_overflow_handler(event))
 			event->overflow_handler = cpumsf_output_event_pid;
 out:
+	mutex_unlock(&pmc_reserve_mutex);
 	return err;
 }
 

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Disseldorp <[email protected]>

[ Upstream commit e017671f534dd3f568db9e47b0583e853d2da9b5 ]

The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as:

37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data
...
55 ============= ================== =========================
56 Field name Field size Meaning
57 ============= ================== =========================
...
70 c_namesize 8 bytes Length of filename, including final \0

When extracting an initramfs cpio archive, the kernel's do_name() path handler assumes a zero-terminated path at @collected, passing it directly to filp_open() / init_mkdir() / init_mknod().

If a specially crafted cpio entry carries a non-zero-terminated filename and is followed by uninitialized memory, then a file may be created with trailing characters that represent the uninitialized memory. The ability to create an initramfs entry would imply already having full control of the system, so the buffer overrun shouldn't be considered a security vulnerability.

Append the output of the following bash script to an existing initramfs and observe any created /initramfs_test_fname_overrunAA* path. E.g.
./reproducer.sh | gzip >> /myinitramfs

It's easiest to observe non-zero uninitialized memory when the output is gzipped, as it'll overflow the heap allocated @out_buf in __gunzip(), rather than the initrd_start+initrd_size block.

---- reproducer.sh ----
nilchar="A" # change to "\0" to properly zero terminate / pad
magic="070701"
ino=1
mode=$(( 0100777 ))
uid=0
gid=0
nlink=1
mtime=1
filesize=0
devmajor=0
devminor=1
rdevmajor=0
rdevminor=0
csum=0
fname="initramfs_test_fname_overrun"
namelen=$(( ${#fname} + 1 )) # plus one to account for terminator

printf "%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s" \
	$magic $ino $mode $uid $gid $nlink $mtime $filesize \
	$devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname

termpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) )) printf "%.s${nilchar}" $(seq 1 $termpadlen) ---- reproducer.sh ----

Symlink filename fields handled in do_symlink() won't overrun past the data segment, due to the explicit zero-termination of the symlink target.

Fix filename buffer overrun by aborting the initramfs FSM if any cpio entry doesn't carry a zero-terminator at the expected (name_len - 1) offset.

---
 init/initramfs.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

index bc911e466d5bb..b2f7583bb1f5c 100644
@@ -360,6 +360,15 @@ static int __init do_name(void)
 {
 	state = SkipIt;
 	next_state = Reset;
+
+	/* name_len > 0 && name_len <= PATH_MAX checked in do_header */
+	if (collected[name_len - 1] != '\0') {
+		pr_err("initramfs name without nulterm: %.*s\n",
+		       (int)name_len, collected);
+		error("malformed archive");
+		return 1;
+	}
+
 	if (strcmp(collected, "TRAILER!!!") == 0) {
 		free_hash();
 		return 0;

@@ -424,6 +433,12 @@ static int __init do_copy(void)
 
 static int __init do_symlink(void)
 {
+	if (collected[name_len - 1] != '\0') {
+		pr_err("initramfs symlink without nulterm: %.*s\n",
+		       (int)name_len, collected);
+		error("malformed archive");
+		return 1;
+	}
 	collected[N_ALIGN(name_len) + body_len] = '\0';
 	clean_path(collected, 0);
 	init_symlink(collected + N_ALIGN(name_len), collected);

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <[email protected]>

[ Upstream commit 2287a4c1e11822d05a70d22f28b26bd810dd204e ]

Despite KVM now being able to deal with XS-tagged TLBIs, we still don't expose these feature bits to KVM.

Plumb in the feature in ID_AA64ISAR1_EL1.

---
 arch/arm64/kernel/cpufeature.c | 1 +
 1 file changed, 1 insertion(+)

index 718728a85430f..db994d1fd97e7 100644
@@ -228,6 +228,7 @@ static const struct arm64_ftr_bits ftr_id_aa64isar0[] = {
 };
 
 static const struct arm64_ftr_bits ftr_id_aa64isar1[] = {
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_EL1_XS_SHIFT, 4, 0),
 	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_EL1_I8MM_SHIFT, 4, 0),
 	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_EL1_DGH_SHIFT, 4, 0),
 	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_EL1_BF16_SHIFT, 4, 0),

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mark Brown <[email protected]>

[ Upstream commit 69c0d824779843b51ca2339b2163db4d3b40c54c ]

The test for SVE_B16B16 had a cut'n'paste of a SME instruction, fix it with a relevant SVE instruction.

---
 tools/testing/selftests/arm64/abi/hwcap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 7e95ba5fd4962..265654ec48b9f 100644
@@ -361,8 +361,8 @@ static void sveaes_sigill(void)
 
 static void sveb16b16_sigill(void)
 {
-	/* BFADD ZA.H[W0, 0], {Z0.H-Z1.H} */
-	asm volatile(".inst 0xC1E41C00" : : : );
+	/* BFADD Z0.H, Z0.H, Z0.H */
+	asm volatile(".inst 0x65000000" : : : );
 }
 
 static void svepmull_sigill(void)

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <[email protected]>

[ Upstream commit 3c2fb1ca8086eb139b2a551358137525ae8e0d7a ]

The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent.

In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page.

---
 drivers/nvme/host/pci.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

index 4b9fda0b1d9a3..34daf6d8db07b 100644
@@ -153,6 +153,7 @@ struct nvme_dev {
 	/* host memory buffer support: */
 	u64 host_mem_size;
 	u32 nr_host_mem_descs;
+	u32 host_mem_descs_size;
 	dma_addr_t host_mem_descs_dma;
 	struct nvme_host_mem_buf_desc *host_mem_descs;
 	void **host_mem_desc_bufs;

@@ -1966,10 +1967,10 @@ static void nvme_free_host_mem(struct nvme_dev *dev)
 
 	kfree(dev->host_mem_desc_bufs);
 	dev->host_mem_desc_bufs = NULL;
-	dma_free_coherent(dev->dev,
-			dev->nr_host_mem_descs * sizeof(*dev->host_mem_descs),
+	dma_free_coherent(dev->dev, dev->host_mem_descs_size,
 			dev->host_mem_descs, dev->host_mem_descs_dma);
 	dev->host_mem_descs = NULL;
+	dev->host_mem_descs_size = 0;
 	dev->nr_host_mem_descs = 0;
 }
 

@@ -1977,7 +1978,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,
 		u32 chunk_size)
 {
 	struct nvme_host_mem_buf_desc *descs;
-	u32 max_entries, len;
+	u32 max_entries, len, descs_size;
 	dma_addr_t descs_dma;
 	int i = 0;
 	void **bufs;

@@ -1990,8 +1991,9 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,
 	if (dev->ctrl.hmmaxd && dev->ctrl.hmmaxd < max_entries)
 		max_entries = dev->ctrl.hmmaxd;
 
-	descs = dma_alloc_coherent(dev->dev, max_entries * sizeof(*descs),
-				   &descs_dma, GFP_KERNEL);
+	descs_size = max_entries * sizeof(*descs);
+	descs = dma_alloc_coherent(dev->dev, descs_size, &descs_dma,
+			GFP_KERNEL);
 	if (!descs)
 		goto out;
 

@@ -2020,6 +2022,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,
 	dev->host_mem_size = size;
 	dev->host_mem_descs = descs;
 	dev->host_mem_descs_dma = descs_dma;
+	dev->host_mem_descs_size = descs_size;
 	dev->host_mem_desc_bufs = bufs;
 	return 0;
 

@@ -2034,8 +2037,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,
 
 	kfree(bufs);
 out_free_descs:
-	dma_free_coherent(dev->dev, max_entries * sizeof(*descs), descs,
-			descs_dma);
+	dma_free_coherent(dev->dev, descs_size, descs, descs_dma);
 out:
 	dev->host_mem_descs = NULL;
 	return -ENOMEM;

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Palmer <[email protected]>

[ Upstream commit 47bc874427382018fa2e3e982480e156271eee70 ]

Sometime long ago the m68k IRQ code was refactored and the interrupt numbers for SCSI controller on this board ended up wrong, and it hasn't worked since.

The PCC adds 0x40 to the vector for its interrupts so they end up in the user interrupt range. Hence, the kernel number should be the kernel offset for user interrupt range + the PCC interrupt number.

---
 arch/m68k/include/asm/mvme147hw.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index e28eb1c0e0bfb..dbf88059e47a4 100644
@@ -93,8 +93,8 @@ struct pcc_regs {
 #define M147_SCC_B_ADDR		0xfffe3000
 #define M147_SCC_PCLK		5000000
 
-#define MVME147_IRQ_SCSI_PORT	(IRQ_USER+0x45)
-#define MVME147_IRQ_SCSI_DMA	(IRQ_USER+0x46)
+#define MVME147_IRQ_SCSI_PORT	(IRQ_USER + 5)
+#define MVME147_IRQ_SCSI_DMA	(IRQ_USER + 6)
 
 /* SCC interrupts, for MVME147 */
 

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Palmer <[email protected]>

[ Upstream commit 077b33b9e2833ff25050d986178a2c4c4036cbac ]

Commit a38eaa07a0ce ("m68k/mvme147: config.c - Remove unused functions"), removed the console functionality for the mvme147 instead of wiring it up to an early console. Put the console write function back and wire it up like mvme16x does so it's possible to see Linux boot on this fine hardware once more.

---
 arch/m68k/kernel/early_printk.c |  5 ++++-
 arch/m68k/mvme147/config.c      | 30 ++++++++++++++++++++++++++++++
 arch/m68k/mvme147/mvme147.h     |  6 ++++++
 3 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 arch/m68k/mvme147/mvme147.h

index 3cc944df04f65..f11ef9f1f56fc 100644
@@ -13,6 +13,7 @@
 #include <asm/setup.h>
 
 
+#include "../mvme147/mvme147.h"
 #include "../mvme16x/mvme16x.h"
 
 asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);

@@ -22,7 +23,9 @@ static void __ref debug_cons_write(struct console *c,
 {
 #if !(defined(CONFIG_SUN3) || defined(CONFIG_M68000) || \
       defined(CONFIG_COLDFIRE))
-	if (MACH_IS_MVME16x)
+	if (MACH_IS_MVME147)
+		mvme147_scc_write(c, s, n);
+	else if (MACH_IS_MVME16x)
 		mvme16x_cons_write(c, s, n);
 	else
 		debug_cons_nputs(s, n);

index 8b5dc07f0811f..cc2fb0a83cf0b 100644
@@ -32,6 +32,7 @@
 #include <asm/mvme147hw.h>
 #include <asm/config.h>
 
+#include "mvme147.h"
 
 static void mvme147_get_model(char *model);
 extern void mvme147_sched_init(void);

@@ -185,3 +186,32 @@ int mvme147_hwclk(int op, struct rtc_time *t)
 	}
 	return 0;
 }
+
+static void scc_delay(void)
+{
+	__asm__ __volatile__ ("nop; nop;");
+}
+
+static void scc_write(char ch)
+{
+	do {
+		scc_delay();
+	} while (!(in_8(M147_SCC_A_ADDR) & BIT(2)));
+	scc_delay();
+	out_8(M147_SCC_A_ADDR, 8);
+	scc_delay();
+	out_8(M147_SCC_A_ADDR, ch);
+}
+
+void mvme147_scc_write(struct console *co, const char *str, unsigned int count)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	while (count--)	{
+		if (*str == '\n')
+			scc_write('\r');
+		scc_write(*str++);
+	}
+	local_irq_restore(flags);
+}

new file mode 100644
index 0000000000000..140bc98b0102a
@@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+struct console;
+
+/* config.c */
+void mvme147_scc_write(struct console *co, const char *str, unsigned int count);

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Masahiro Yamada <[email protected]>

[ Upstream commit 340fd66c856651d8c1d29f392dd26ad674d2db0e ]

Commit be2881824ae9 ("arm64/build: Assert for unwanted sections") introduced an assertion to ensure that the .data.rel.ro section does not exist.

However, this check does not work when CONFIG_LTO_CLANG is enabled, because .data.rel.ro matches the .data.[0-9a-zA-Z_]* pattern in the DATA_MAIN macro.

Move the ASSERT() above the RW_DATA() line.

---
 arch/arm64/kernel/vmlinux.lds.S | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index 58d89d997d050..f84c71f04d9ea 100644
@@ -287,6 +287,9 @@ SECTIONS
 	__initdata_end = .;
 	__init_end = .;
 
+	.data.rel.ro : { *(.data.rel.ro) }
+	ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!")
+
 	_data = .;
 	_sdata = .;
 	RW_DATA(L1_CACHE_BYTES, PAGE_SIZE, THREAD_ALIGN)

@@ -343,9 +346,6 @@ SECTIONS
 		*(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt)
 	}
 	ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!")
-
-	.data.rel.ro : { *(.data.rel.ro) }
-	ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!")
 }
 
 #include "image-vars.h"

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Aleksandr Mishin <[email protected]>

[ Upstream commit 1a9de2f6fda69d5f105dd8af776856a66abdaa64 ]

In case of error in gtdt_parse_timer_block() invalid 'gtdt_frame' will be used in 'do {} while (i-- >= 0 && gtdt_frame--);' statement block because do{} block will be executed even if 'i == 0'.

Adjust error handling procedure by replacing 'i-- >= 0' with 'i-- > 0'.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

---
 drivers/acpi/arm64/gtdt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index c0e77c1c8e09d..eb6c2d3603874 100644
@@ -283,7 +283,7 @@ static int __init gtdt_parse_timer_block(struct acpi_gtdt_timer_block *block,
 		if (frame->virt_irq > 0)
 			acpi_unregister_gsi(gtdt_frame->virtual_timer_interrupt);
 		frame->virt_irq = 0;
-	} while (i-- >= 0 && gtdt_frame--);
+	} while (i-- > 0 && gtdt_frame--);
 
 	return -EINVAL;
 }

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Li Wang <[email protected]>

[ Upstream commit 8e604cac499248c75ad3a26695a743ff879ded5c ]

PAGE_SIZE may be 64K, and the max block size can be PAGE_SIZE, so any variable for holding block size can't be defined as 'unsigned short'.

Unfortunately commit 473516b36193 ("loop: use the atomic queue limits update API") passes 'bsize' with type of 'unsigned short' to loop_reconfigure_limits(), and causes LTP/ioctl_loop06 test failure:

12 ioctl_loop06.c:76: TINFO: Using LOOP_SET_BLOCK_SIZE with arg > PAGE_SIZE 13 ioctl_loop06.c:59: TFAIL: Set block size succeed unexpectedly
...
18 ioctl_loop06.c:76: TINFO: Using LOOP_CONFIGURE with block_size > PAGE_SIZE 19 ioctl_loop06.c:59: TFAIL: Set block size succeed unexpectedly

Fixes the issue by defining 'block size' variable with 'unsigned int', which is aligned with block layer's definition.

(improve commit log & add fixes tag)

---
 drivers/block/loop.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index 78a7bb28defe4..86cc3b19faae8 100644
@@ -173,7 +173,7 @@ static loff_t get_loop_size(struct loop_device *lo, struct file *file)
 static bool lo_bdev_can_use_dio(struct loop_device *lo,
 		struct block_device *backing_bdev)
 {
-	unsigned short sb_bsize = bdev_logical_block_size(backing_bdev);
+	unsigned int sb_bsize = bdev_logical_block_size(backing_bdev);
 
 	if (queue_logical_block_size(lo->lo_queue) < sb_bsize)
 		return false;

@@ -977,7 +977,7 @@ loop_set_status_from_info(struct loop_device *lo,
 	return 0;
 }
 
-static unsigned short loop_default_blocksize(struct loop_device *lo,
+static unsigned int loop_default_blocksize(struct loop_device *lo,
 		struct block_device *backing_bdev)
 {
 	/* In case of direct I/O, match underlying block size */

@@ -986,7 +986,7 @@ static unsigned short loop_default_blocksize(struct loop_device *lo,
 	return SECTOR_SIZE;
 }
 
-static int loop_reconfigure_limits(struct loop_device *lo, unsigned short bsize)
+static int loop_reconfigure_limits(struct loop_device *lo, unsigned int bsize)
 {
 	struct file *file = lo->lo_backing_file;
 	struct inode *inode = file->f_mapping->host;

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zizhi Wo <[email protected]>

[ Upstream commit 10c35abd35aa62c9aac56898ae0c63b4d7d115e5 ]

cachefiles_ondemand_fd_write_iter() function first aligns "pos" and "len" to block boundaries. When calling __cachefiles_write(), the aligned "pos" is passed in, but "len" is the original unaligned value(iter->count). Additionally, the returned length of the write operation is the modified "len" aligned by block size, which is unreasonable.

The alignment of "pos" and "len" is intended only to check whether the cache has enough space. But the modified len should not be used as the return value of cachefiles_ondemand_fd_write_iter() because the length we passed to __cachefiles_write() is the previous "len". Doing so would result in a mismatch in the data written on-demand. For example, if the length of the user state passed in is not aligned to the block size (the preread scene/DIO writes only need 512 alignment/Fault injection), the length of the write will differ from the actual length of the return.

To solve this issue, since the __cachefiles_prepare_write() modifies the size of "len", we pass "aligned_len" to __cachefiles_prepare_write() to calculate the free blocks and use the original "len" as the return value of cachefiles_ondemand_fd_write_iter().

---
 fs/cachefiles/ondemand.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 470c966583850..bdd321017f1c4 100644
@@ -61,7 +61,7 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb,
 	struct cachefiles_object *object = kiocb->ki_filp->private_data;
 	struct cachefiles_cache *cache = object->volume->cache;
 	struct file *file = object->file;
-	size_t len = iter->count;
+	size_t len = iter->count, aligned_len = len;
 	loff_t pos = kiocb->ki_pos;
 	const struct cred *saved_cred;
 	int ret;

@@ -70,7 +70,7 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb,
 		return -ENOBUFS;
 
 	cachefiles_begin_secure(cache, &saved_cred);
-	ret = __cachefiles_prepare_write(object, file, &pos, &len, len, true);
+	ret = __cachefiles_prepare_write(object, file, &pos, &aligned_len, len, true);
 	cachefiles_end_secure(cache, saved_cred);
 	if (ret < 0)
 		return ret;

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zizhi Wo <[email protected]>

[ Upstream commit 56f4856b425a30e1d8b3e41e6cde8bfba90ba5f8 ]

In the erofs on-demand loading scenario, read and write operations are usually delivered through "off" and "len" contained in read req in user mode. Naturally, pwrite is used to specify a specific offset to complete write operations.

However, if the write(not pwrite) syscall is called multiple times in the read-ahead scenario, we need to manually update ki_pos after each write operation to update file->f_pos.

This step is currently missing from the cachefiles_ondemand_fd_write_iter function, added to address this issue.

---
 fs/cachefiles/ondemand.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

index bdd321017f1c4..38ca6dce8ef29 100644
@@ -77,8 +77,10 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb,
 
 	trace_cachefiles_ondemand_fd_write(object, file_inode(file), pos, len);
 	ret = __cachefiles_write(object, file, pos, iter, NULL, NULL);
-	if (!ret)
+	if (!ret) {
 		ret = len;
+		kiocb->ki_pos += ret;
+	}
 
 	return ret;
 }

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zizhi Wo <[email protected]>

[ Upstream commit 31ad74b20227ce6b40910ff78b1c604e42975cf1 ]

At present, the object->file has the NULL pointer dereference problem in ondemand-mode. The root cause is that the allocated fd and object->file lifetime are inconsistent, and the user-space invocation to anon_fd uses object->file. Following is the process that triggers the issue:

	  [write fd]				[umount]

cachefiles_ondemand_fd_write_iter
fscache_cookie_state_machine
cachefiles_withdraw_cookie
if (!file) return -ENOBUFS

					   cachefiles_clean_up_object
					     cachefiles_unmark_inode_in_use
					     fput(object->file)
					     object->file = NULL

// file NULL pointer dereference!
__cachefiles_write(..., file, ...)

Fix this issue by add an additional reference count to the object->file before write/llseek, and decrement after it finished.

---
 fs/cachefiles/interface.c | 14 ++++++++++----
 fs/cachefiles/ondemand.c  | 30 ++++++++++++++++++++++++------
 2 files changed, 34 insertions(+), 10 deletions(-)

index 35ba2117a6f65..3e63cfe158747 100644
@@ -327,6 +327,8 @@ static void cachefiles_commit_object(struct cachefiles_object *object,
 static void cachefiles_clean_up_object(struct cachefiles_object *object,
 				       struct cachefiles_cache *cache)
 {
+	struct file *file;
+
 	if (test_bit(FSCACHE_COOKIE_RETIRED, &object->cookie->flags)) {
 		if (!test_bit(CACHEFILES_OBJECT_USING_TMPFILE, &object->flags)) {
 			cachefiles_see_object(object, cachefiles_obj_see_clean_delete);

@@ -342,10 +344,14 @@ static void cachefiles_clean_up_object(struct cachefiles_object *object,
 	}
 
 	cachefiles_unmark_inode_in_use(object, object->file);
-	if (object->file) {
-		fput(object->file);
-		object->file = NULL;
-	}
+
+	spin_lock(&object->lock);
+	file = object->file;
+	object->file = NULL;
+	spin_unlock(&object->lock);
+
+	if (file)
+		fput(file);
 }
 
 /*

index 38ca6dce8ef29..fe3de9ad57bf6 100644
@@ -60,20 +60,26 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb,
 {
 	struct cachefiles_object *object = kiocb->ki_filp->private_data;
 	struct cachefiles_cache *cache = object->volume->cache;
-	struct file *file = object->file;
+	struct file *file;
 	size_t len = iter->count, aligned_len = len;
 	loff_t pos = kiocb->ki_pos;
 	const struct cred *saved_cred;
 	int ret;
 
-	if (!file)
+	spin_lock(&object->lock);
+	file = object->file;
+	if (!file) {
+		spin_unlock(&object->lock);
 		return -ENOBUFS;
+	}
+	get_file(file);
+	spin_unlock(&object->lock);
 
 	cachefiles_begin_secure(cache, &saved_cred);
 	ret = __cachefiles_prepare_write(object, file, &pos, &aligned_len, len, true);
 	cachefiles_end_secure(cache, saved_cred);
 	if (ret < 0)
-		return ret;
+		goto out;
 
 	trace_cachefiles_ondemand_fd_write(object, file_inode(file), pos, len);
 	ret = __cachefiles_write(object, file, pos, iter, NULL, NULL);

@@ -82,6 +88,8 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb,
 		kiocb->ki_pos += ret;
 	}
 
+out:
+	fput(file);
 	return ret;
 }
 

@@ -89,12 +97,22 @@ static loff_t cachefiles_ondemand_fd_llseek(struct file *filp, loff_t pos,
 					    int whence)
 {
 	struct cachefiles_object *object = filp->private_data;
-	struct file *file = object->file;
+	struct file *file;
+	loff_t ret;
 
-	if (!file)
+	spin_lock(&object->lock);
+	file = object->file;
+	if (!file) {
+		spin_unlock(&object->lock);
 		return -ENOBUFS;
+	}
+	get_file(file);
+	spin_unlock(&object->lock);
 
-	return vfs_llseek(file, pos, whence);
+	ret = vfs_llseek(file, pos, whence);
+	fput(file);
+
+	return ret;
 }
 
 static long cachefiles_ondemand_fd_ioctl(struct file *filp, unsigned int ioctl,

2.43.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zizhi Wo <[email protected]>

[ Upstream commit 22f9400a6f3560629478e0a64247b8fcc811a24d ]

In fscache_create_volume(), there is a missing memory barrier between the bit-clearing operation and the wake-up operation. This may cause a situation where, after a wake-up, the bit-clearing operation hasn't been detected yet, leading to an indefinite wait. The triggering process is as follows:

[cookie1] [cookie2] [volume_work]
fscache_perform_lookup
fscache_create_volume
fscache_perform_lookup
fscache_create_volume
fscache_create_volume_work
cachefiles_acquire_volume clear_and_wake_up_bit
test_and_set_bit
test_and_set_bit
goto maybe_wait
goto no_wait

In the above process, cookie1 and cookie2 has the same volume. When cookie1 enters the -no_wait- process, it will clear the bit and wake up the waiting process. If a barrier is missing, it may cause cookie2 to remain in the -wait- process indefinitely.

In commit 3288666c7256 ("fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work()"), barriers were added to similar operations in fscache_create_volume_work(), but fscache_create_volume() was missed.

By combining the clear and wake operations into clear_and_wake_up_bit() to fix this issue.