6.17.8-rc1 review

This is the start of the stable review cycle for the 6.17.8 release. There are 849 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 13 Nov 2025 00:43:57 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.8-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.17.8-rc1

Amery Hung <[email protected]>
selftests: drv-net: Reload pkt pointer after calling filter_udphdr

Alex Hung <[email protected]>
drm/amd/display: Fix black screen with HDMI outputs

Aurabindo Pillai <[email protected]>
drm/amd/display: use GFP_NOWAIT for allocation in interrupt handler

Timur Kristóf <[email protected]>
drm/amd/display: Reject modes with too high pixel clock on DCE6-10

Jessica Zhang <[email protected]>
drm/msm/dpu: Fix adjusted mode clock check for 3d merge

Prike Liang <[email protected]>
drm/amdgpu/userq: assign an error code for invalid userq va

Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix function header names in amdgpu_connectors.c

Aurabindo Pillai <[email protected]>
drm/amd/display: Fix vupdate_offload_work doc

Sathishkumar S <[email protected]>
drm/amdgpu: Fix unintended error log in VCN5_0_0

Nathan Chancellor <[email protected]>
kbuild: Strip trailing padding bytes from modules.builtin.modinfo

Punit Agrawal <[email protected]>
ACPI: SPCR: Check for table version when using precise baudrate

Shenghao Ding <[email protected]>
ALSA: hda/tas2781: Enable init_profile_id for device initialization

Thomas Weißschuh <[email protected]>
kunit: Extend kconfig help text for KUNIT_UML_PCI

Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Cleanup wakeup source only if it was enabled

Melissa Wen <[email protected]>
drm/amd/display: update color on atomic commit time

Adrian Hunter <[email protected]>
scsi: ufs: core: Fix invalid probe error return value

Adrian Hunter <[email protected]>
scsi: ufs: core: Add a quirk to suppress link_startup_again

Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL

Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers

Nathan Chancellor <[email protected]>
lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC

Michael S. Tsirkin <[email protected]>
virtio_net: fix alignment for virtio_net_hdr_v1_hash

Bui Quang Minh <[email protected]>
virtio-net: fix received length check in big packets

Philip Yang <[email protected]>
drm/amdkfd: Don't clear PT after process killed

Rong Zhang <[email protected]>
drm/amd/display: Fix NULL deref in debugfs odm_combine_segments

Alex Deucher <[email protected]>
drm/amdgpu/smu: Handle S0ix for vangogh

James Jones <[email protected]>

    drm/nouveau: Advertise correct modifiers on GB20x

James Jones <[email protected]>

    drm: define NVIDIA DRM format modifiers for GB20x

Mario Limonciello <[email protected]>
x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode

Darrick J. Wong <[email protected]>
xfs: fix various problems in xfs_atomic_write_cow_iomap_begin

Darrick J. Wong <[email protected]>
xfs: fix delalloc write failures in software-provided atomic writes

Yazen Ghannam <[email protected]>
x86/amd_node: Fix AMD root device caching

Dapeng Mi <[email protected]>
perf/core: Fix system hang caused by cpu-clock usage

Henrique Carvalho <[email protected]>
smb: client: fix potential UAF in smb2_close_cached_fid()

Pavel Begunkov <[email protected]>
io_uring: fix regbuf vector size truncation

Joshua Rogers <[email protected]>
smb: client: validate change notify buffer before copy

Mario Limonciello (AMD) <[email protected]>
x86/microcode/AMD: Add more known models to entry sign checking

Yuta Hayama <[email protected]>
rtc: rx8025: fix incorrect register reference

Helge Deller <[email protected]>
parisc: Avoid crash due to unaligned access in unwinder

Miaoqian Lin <[email protected]>
riscv: Fix memory leak in module_frob_arch_sections()

Jason Gunthorpe <[email protected]>
iommufd: Don't overflow during division for dirty tracking

Ilia Gavrilov <[email protected]>
Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

Pierre-Eric Pelloux-Prayer <[email protected]>
drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb

Yongpeng Yang <[email protected]>

    fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT

Benjamin Berg <[email protected]>
wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work

Benjamin Berg <[email protected]>
wifi: mac80211: use wiphy_hrtimer_work for ttlm_work

Qiu Wenbo <[email protected]>
platform/x86: int3472: Fix double free of GPIO device during unregister

Benjamin Berg <[email protected]>
wifi: mac80211: use wiphy_hrtimer_work for ml_reconf_work

Benjamin Berg <[email protected]>
wifi: cfg80211: add an hrtimer based delayed work item

Wayne Lin <[email protected]>
drm/amd/display: Enable mst when it's detected but yet to be initialized

Zilin Guan <[email protected]>
tracing: Fix memory leaks in create_field_var()

Bobby Eshleman <[email protected]>
selftests/vsock: avoid false-positives when checking dmesg

Nikolay Aleksandrov <[email protected]>
net: bridge: fix MST static key usage

Nikolay Aleksandrov <[email protected]>
net: bridge: fix use-after-free due to MST port state bypass

Horatiu Vultur <[email protected]>
lan966x: Fix sleeping in atomic context

Tristram Ha <[email protected]>
net: dsa: microchip: Fix reserved multicast address table programming

Haotian Zhang <[email protected]>
net: wan: framer: pef2256: Switch to devm_mfd_add_devices()

Dragos Tatulea <[email protected]>
net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages

Dragos Tatulea <[email protected]>
net/mlx5e: SHAMPO, Fix skb size check for 64K pages

Dragos Tatulea <[email protected]>
net/mlx5e: SHAMPO, Fix header mapping for 64K pages

Meghana Malladi <[email protected]>
net: ti: icssg-prueth: Fix fdb hash size configuration

Gal Pressman <[email protected]>
net/mlx5e: Fix return value in case of module EEPROM read error

Pavel Begunkov <[email protected]>
io_uring: fix types for region size calulation

Martin Willi <[email protected]>
wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup

Breno Leitao <[email protected]>
netpoll: Fix deadlock in memory allocation under spinlock

Shantiprasad Shettar <[email protected]>
bnxt_en: Fix warning in bnxt_dl_reload_down()

Kashyap Desai <[email protected]>
bnxt_en: Always provide max entry and entry size in coredump segments

Gautam R A <[email protected]>
bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap()

Kalesh AP <[email protected]>
bnxt_en: Fix a possible memory leak in bnxt_ptp_init

Michael Chan <[email protected]>
bnxt_en: Shutdown FW DMA in bnxt_shutdown()

Qendrim Maxhuni <[email protected]>
net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup

Dan Carpenter <[email protected]>
octeontx2-pf: Fix devm_kcalloc() error checking

Mohammad Heib <[email protected]>
net: ionic: map SKB after pseudo-header checksum prep

Mohammad Heib <[email protected]>
net: ionic: add dma_wmb() before ringing TX doorbell

Stefan Wiehler <[email protected]>
sctp: Hold sock lock while iterating over address list

Stefan Wiehler <[email protected]>
sctp: Prevent TOCTOU out-of-bounds write

Stefan Wiehler <[email protected]>
sctp: Hold RCU read lock while iterating over address list

Jonas Gorski <[email protected]>
net: dsa: b53: properly bound ARL searches for < 4 ARL bin chips

Jonas Gorski <[email protected]>
net: dsa: b53: stop reading ARL entries if search is done

Jonas Gorski <[email protected]>
net: dsa: b53: fix enabling ip multicast

Jonas Gorski <[email protected]>
net: dsa: b53: fix bcm63xx RGMII port link adjustment

Jonas Gorski <[email protected]>
net: dsa: b53: fix resetting speed and pause on forced link

Alok Tiwari <[email protected]>
net: mdio: Check regmap pointer returned by device_node_to_regmap()

Bartosz Golaszewski <[email protected]>
gpiolib: fix invalid pointer access in debugfs

Bartosz Golaszewski <[email protected]>
gpio: swnode: don't use the swnode's name as the key for GPIO lookup

Gustavo Luiz Duarte <[email protected]>
netconsole: Acquire su_mutex before navigating configs hierarchy

Hangbin Liu <[email protected]>
net: vlan: sync VLAN features with lower device

Wang Liang <[email protected]>
selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh

Anubhav Singh <[email protected]>
selftests/net: use destination options instead of hop-by-hop

Anubhav Singh <[email protected]>
selftests/net: fix out-of-order delivery of FIN in gro:tcp test

Jonas Gorski <[email protected]>
net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx

Tim Hostetler <[email protected]>
gve: Implement settime64 with -EOPNOTSUPP

Tim Hostetler <[email protected]>
gve: Implement gettimex64 with -EOPNOTSUPP

Abdun Nihaal <[email protected]>
Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()

Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: hci_event: validate skb length for unknown CC opcode

Bart Van Assche <[email protected]>
scsi: ufs: core: Revert "Make HID attributes visible"

Miaoqing Pan <[email protected]>
Revert "wifi: ath12k: Fix missing station power save configuration"

Josephine Pfeiffer <[email protected]>
riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro

Chunyan Zhang <[email protected]>
riscv: stacktrace: Disable KASAN checks for non-current tasks

Bart Van Assche <[email protected]>
scsi: ufs: core: Fix a race condition related to the "hid" attribute group

Jiawen Wu <[email protected]>
net: libwx: fix device bus LAN ID

Steven Rostedt <[email protected]>
ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up

Masami Hiramatsu (Google) <[email protected]>
tracing: tprobe-events: Fix to put tracepoint_user when disable the tprobe

Masami Hiramatsu (Google) <[email protected]>
tracing: tprobe-events: Fix to register tracepoint correctly

Baochen Qiang <[email protected]>
Revert "wifi: ath10k: avoid unnecessary wait for service ready message"

Ariel D'Alessandro <[email protected]>
drm/mediatek: Disable AFBC support on Mediatek DRM driver

Marek Szyprowski <[email protected]>
media: videobuf2: forbid remove_bufs when legacy fileio is active

Ricardo Ribalda <[email protected]>
media: uvcvideo: Use heuristic to find stream entity

Qu Wenruo <[email protected]>
btrfs: ensure no dirty metadata is written back for an fs with errors

Miguel Ojeda <[email protected]>
rust: kbuild: treat build_error and rustdoc as kernel objects

Miguel Ojeda <[email protected]>
rust: kbuild: workaround rustdoc doctests modifier bug

Miguel Ojeda <[email protected]>
rust: devres: fix private intra-doc link

Miguel Ojeda <[email protected]>
rust: condvar: fix broken intra-doc link

Linus Torvalds <[email protected]>
x86: uaccess: don't use runtime-const rewriting in modules

Kotresh HR <[email protected]>
ceph: fix multifs mds auth caps issue

Viacheslav Dubeyko <[email protected]>
ceph: refactor wake_up_bit() pattern of calling

Viacheslav Dubeyko <[email protected]>
ceph: fix potential race condition in ceph_ioctl_lazyio()

Viacheslav Dubeyko <[email protected]>
ceph: add checking of wait_for_completion_killable() return value

Lijo Lazar <[email protected]>
drm/amdgpu: Report individual reset error

Philip Yang <[email protected]>
drm/amdkfd: Fix mmap write lock not release

Shuming Fan <[email protected]>
ASoC: rt722: add settings for rt722VB

Valerio Setti <[email protected]>
ASoC: meson: aiu-encoder-i2s: fix bit clock polarity

Geert Uytterhoeven <[email protected]>
kbuild: uapi: Strip comments before size type check

Sammy Hsu <[email protected]>
net: wwan: t7xx: add support for HP DRMR-H01

Bruno Thomsen <[email protected]>
rtc: pcf2127: fix watchdog interrupt mask on pcf2131

Harini T <[email protected]>
rtc: zynqmp: Restore alarm functionality after kexec transition

Adam Holliday <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG Zephyrus Duo

Albin Babu Varghese <[email protected]>
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

Sascha Hauer <[email protected]>
tools: lib: thermal: use pkg-config to locate libnl3

Emil Dahl Juhl <[email protected]>
tools: lib: thermal: don't preserve owner in install

Ian Rogers <[email protected]>
tools bitmap: Add missing asm-generic/bitsperlong.h include

Tiezhu Yang <[email protected]>
LoongArch: Handle new atomic instructions for probes

Sakari Ailus <[email protected]>
ACPI: property: Return present device nodes only on fwnode interface

Zsolt Kajtar <[email protected]>
fbdev: core: Fix ubsan warning in pixel_to_pat

Hoyoung Seo <[email protected]>
scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS

Randall P. Embry <[email protected]>
9p: sysfs_init: don't hardcode error to ENOMEM

Aaron Kling <[email protected]>
cpufreq: tegra186: Initialize all cores to max frequencies

Randall P. Embry <[email protected]>
9p: fix /sys/fs/9p/caches overwriting itself

Jerome Brunet <[email protected]>
NTB: epf: Allow arbitrary BAR mapping

Shubhrajyoti Datta <[email protected]>
clk: clocking-wizard: Fix output clock register offset for Versal platforms

Jacky Bai <[email protected]>
clk: scmi: Add duty cycle ops only when duty cycle is supported

Matthias Schiffer <[email protected]>
clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled

Oleg Nesterov <[email protected]>
9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN

Nicolas Ferre <[email protected]>
clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register

Ryan Wanner <[email protected]>
clk: at91: clk-master: Add check for divide by 3

Balamanikandan Gunasundar <[email protected]>
clk: at91: sam9x7: Add peripheral clock id for pmecc

Cristian Birsan <[email protected]>
clk: at91: add ACR in all PLL settings

Nicolas Ferre <[email protected]>
ARM: at91: pm: save and restore ACR during PLL disable/enable

Josua Mayer <[email protected]>
rtc: pcf2127: clear minute/second interrupt

Chen-Yu Tsai <[email protected]>
clk: sunxi-ng: sun6i-rtc: Add A523 specifics

Tiwei Bie <[email protected]>
um: Fix help message for ssl-non-raw

Nuno Das Neves <[email protected]>
hyperv: Add missing field to hv_output_map_device_interrupt

Wei Liu <[email protected]>
clocksource: hyper-v: Skip unnecessary checks for the root partition

Yikang Yue <[email protected]>
fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink

Denzeel Oliva <[email protected]>
clk: samsung: exynos990: Add missing USB clock registers to HSI0

Tommaso Merciai <[email protected]>
clk: renesas: rzv2h: Re-assert reset on deassert timeout

Icenowy Zheng <[email protected]>
clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL

Marko Mäkelä <[email protected]>
clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf

austinchang <[email protected]>
btrfs: mark dirty extent range for out of bound prealloc extents

Shardul Bankar <[email protected]>
btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation

Junxian Huang <[email protected]>
RDMA/hns: Fix wrong WQE data when QP wraps around

wenglianfa <[email protected]>
RDMA/hns: Fix the modification of max_send_sge

Chengchang Tang <[email protected]>
RDMA/hns: Fix recv CQ and QP cache affinity

Shuhao Fu <[email protected]>
RDMA/uverbs: Fix umem release in UVERBS_METHOD_CQ_CREATE

Jacob Moroni <[email protected]>
RDMA/irdma: Set irdma_cq cq_num field during CQ create

Jacob Moroni <[email protected]>
RDMA/irdma: Remove unused struct irdma_cq fields

Jacob Moroni <[email protected]>
RDMA/irdma: Fix SD index calculation

YanLong Dai <[email protected]>
RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp

Saket Dumbre <[email protected]>
ACPICA: Update dsmethod.c to get rid of unused variable warning

Mario Limonciello <[email protected]>
drm/amd/display: Add fallback path for YCBCR422

Michal Pecio <[email protected]>
usb: xhci-pci: Fix USB2-only root hub registration

Coiby Xu <[email protected]>
ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

Fiona Ebner <[email protected]>
smb: client: transport: avoid reconnects triggered by pending task work

Henrique Carvalho <[email protected]>

    smb: client: update cfid->last_access_time in open_cached_dir_by_dentry()

Namjae Jeon <[email protected]>
ksmbd: use sock_create_kern interface to create kernel socket

Jianbo Liu <[email protected]>
net/mlx5e: Prevent entering switchdev mode with inconsistent netns

Vladimir Riabchun <[email protected]>
ftrace: Fix softlockup in ftrace_module_enable

Mike Marshall <[email protected]>
orangefs: fix xattr related buffer overflow...

Dragos Tatulea <[email protected]>
page_pool: Clamp pool size to max 16K pages

Qingfang Deng <[email protected]>
6pack: drop redundant locking and refcounting

Namjae Jeon <[email protected]>
exfat: validate cluster allocation bits of the allocation bitmap

Chi Zhiling <[email protected]>
exfat: limit log print for IO error

Rohan G Thomas <[email protected]>
net: stmmac: est: Drop frames causing HLBS error

Ivan Pravdin <[email protected]>
Bluetooth: bcsp: receive data only if registered

Chris Lu <[email protected]>

    Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922

Luiz Augusto von Dentz <[email protected]>
Bluetooth: SCO: Fix UAF on sco_conn_free

Luiz Augusto von Dentz <[email protected]>
Bluetooth: ISO: Use sk_sndtimeo as conn_timeout

Arkadiusz Bokowy <[email protected]>
Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames

Luiz Augusto von Dentz <[email protected]>
Bluetooth: ISO: Don't initiate CIS connections if there are no buffers

Chandrashekar Devegowda <[email protected]>

    Bluetooth: btintel_pcie: Define hdev->wakeup() callback

Chris Lu <[email protected]>

    Bluetooth: btusb: Add new VID/PID 13d3/3627 for MT7925

Théo Lebrun <[email protected]>
net: macb: avoid dealing with endianness in macb_set_hwaddr()

Kiran K <[email protected]>
Bluetooth: btintel: Add support for BlazarIW core

Carolina Jubran <[email protected]>
net/mlx5e: Don't query FEC statistics when FEC is disabled

Alessandro Zanni <[email protected]>
selftest: net: Fix error message if empty variable

Tushar Dave <[email protected]>
vfio/nvgrace-gpu: Add GB300 SKU to the devid table

Timothy Pearson <[email protected]>
vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices

Hans de Goede <[email protected]>
platform/x86: x86-android-tablets: Stop using EPROBE_DEFER

Sunil V L <[email protected]>
ACPI: scan: Update honor list for RPMI System MSI

Primoz Fiser <[email protected]>
ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007

Yifan Zhang <[email protected]>
amd/amdkfd: enhance kfd process check in switch partition

Olivier Moysan <[email protected]>
ASoC: stm32: sai: manage context in set_sysclk callback

Jesse.Zhang <[email protected]>
drm/amdgpu: Fix fence signaling race condition in userqueue

Jesse.Zhang <[email protected]>
drm/amdgpu: Add fallback to pipe reset if KCQ ring reset fails

Yifan Zhang <[email protected]>
amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw

Julian Sun <[email protected]>
ext4: increase IO priority of fastcommit

chuguangqing <[email protected]>
fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock

Kuninori Morimoto <[email protected]>
ASoC: renesas: msiof: set SIFCTR register

Kuninori Morimoto <[email protected]>
ASoC: renesas: msiof: tidyup DMAC stop timing

Kuninori Morimoto <[email protected]>
ASoC: renesas: msiof: use reset controller

Kuninori Morimoto <[email protected]>
ASoC: renesas: msiof: add .symmetric_xxx on snd_soc_dai_driver

Moti Haimovski <[email protected]>
accel/habanalabs: support mapping cb with vmalloc-backed coherent memory

Konstantin Sinyuk <[email protected]>
accel/habanalabs/gaudi2: read preboot status after recovering from dirty state

Tomer Tayar <[email protected]>
accel/habanalabs: return ENOMEM if less than requested pages were pinned

Ranjan Kumar <[email protected]>
scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate

Vered Yavniely <[email protected]>
accel/habanalabs/gaudi2: fix BMON disable configuration

Alok Tiwari <[email protected]>
scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()

Peter Wang <[email protected]>
scsi: ufs: core: Change MCQ interrupt enable flow

Heiner Kallweit <[email protected]>
net: phy: dp83640: improve phydev and driver removal handling

Petr Machata <[email protected]>
net: bridge: Install FDB for bridge MAC on VLAN 0

Al Viro <[email protected]>

    nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing

Anthony Iliopoulos <[email protected]>
NFSv4.1: fix mount hang after CREATE_SESSION failure

Olga Kornievskaia <[email protected]>
NFSv4: handle ERR_GRACE on delegation recalls

Melissa Wen <[email protected]>
drm/amd/display: change dc stream color settings only in atomic commit

Sridevi Arvindekar <[email protected]>
drm/amd/display: Fix for test crash due to power gating

Lo-an Chen <[email protected]>
drm/amd/display: Init dispclk from bootup clock for DCN314

Allen Li <[email protected]>
drm/amd/display: Add fast sync field in ultra sleep more for DMUB

Karthi Kandasamy <[email protected]>
drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream

Dillon Varone <[email protected]>
drm/amd/display: Add missing post flip calls

Amir Goldstein <[email protected]>
ovl: make sure that ovl_create_real() returns a hashed dentry

Jakub Sitnicki <[email protected]>
tcp: Update bind bucket state on port release

Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: don't apply interface quirk to Presonus S1824c

Bhargava Marreddy <[email protected]>
bng_en: make bnge_alloc_ring() self-unwind on failure

Bastien Curutchet <[email protected]>
net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463

Nithyanantham Paramasivam <[email protected]>
wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256

Stephan Gerhold <[email protected]>
remoteproc: qcom: q6v5: Avoid handling handover twice

David Yang <[email protected]>
selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt

Mario Limonciello <[email protected]>
PCI/PM: Skip resuming to D0 if device is disconnected

Niranjan H Y <[email protected]>
ASoC: ops: improve snd_soc_get_volsw

Weili Qian <[email protected]>
crypto: hisilicon/qm - clear all VF configurations in the hardware

Weili Qian <[email protected]>
crypto: hisilicon/qm - invalidate queues in use

Vadim Fedorenko <[email protected]>
ptp_ocp: make ptp_ocp driver compatible with PTP_EXTTS_REQUEST2

Alex Mastro <[email protected]>
vfio: return -ENOTTY for unsupported device feature

Al Viro <[email protected]>
sparc64: fix prototypes of reads[bwl]()

Koakuma <[email protected]>
sparc/module: Add R_SPARC_UA64 relocation handling

Chen Wang <[email protected]>
PCI: cadence: Check for the existence of cdns_pcie::ops before using it

ChunHao Lin <[email protected]>
r8169: set EEE speed down ratio to 1

Brahmajit Das <[email protected]>
net: intel: fm10k: Fix parameter idx set but not used

Ilan Peer <[email protected]>
wifi: mac80211: Track NAN interface start/stop

Ilan Peer <[email protected]>
wifi: mac80211: Get the correct interface for non-netdev skb status

Lu Baolu <[email protected]>
iommu/vt-d: Remove LPIG from page group response descriptor

Loic Poulain <[email protected]>
wifi: ath10k: Fix connection after GTK rekeying

Seyediman Seyedarab <[email protected]>
iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()

Vivek Pernamitta <[email protected]>
bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state

Robert Marko <[email protected]>
net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X

Oleksij Rempel <[email protected]>
net: phy: clear link parameters on admin link down

Alexey Klimov <[email protected]>

    ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup()

Guangshuo Li <[email protected]>
drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()

Alexander Usyskin <[email protected]>
mei: make a local copy of client uuid in connect

Shaurya Rane <[email protected]>
jfs: fix uninitialized waitqueue in transaction manager

Tetsuo Handa <[email protected]>
jfs: Verify inode mode when loading from disk

Shruti Parab <[email protected]>
bnxt_en: Add fw log trace support for 5731X/5741X chips

Vlad Dumitrescu <[email protected]>
IB/ipoib: Ignore L3 master device

Tatyana Nikolova <[email protected]>
RDMA/irdma: Update Kconfig

Eric Dumazet <[email protected]>

    ipv6: np->rxpmtu race annotation

Niklas Neronin <[email protected]>
usb: xhci-pci: add support for hosts with zero USB3 ports

Zong-Zhe Yang <[email protected]>
wifi: rtw89: renew a completion for each H2C command waiting C2H event

Chih-Kang Chang <[email protected]>
wifi: rtw89: obtain RX path from ppdu status IE00

Chih-Kang Chang <[email protected]>
wifi: rtw89: disable RTW89_PHYSTS_IE09_FTR_0 for ppdu status

wangzijie <[email protected]>
f2fs: fix infinite loop in __insert_extent_tree()

Krishna Kurapati <[email protected]>
usb: xhci: plat: Facilitate using autosuspend for xhci plat devices

Forest Crossman <[email protected]>
usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs

Al Viro <[email protected]>

    allow finish_no_open(file, ERR_PTR(-E...))

Justin Tee <[email protected]>
scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology

Justin Tee <[email protected]>
scsi: lpfc: Define size of debugfs entry for xri rebalancing

Justin Tee <[email protected]>
scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup

Justin Tee <[email protected]>
scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET

Justin Tee <[email protected]>
scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted

Justin Tee <[email protected]>
scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail

Bart Van Assche <[email protected]>
scsi: ufs: core: Disable timestamp functionality if not supported

Nai-Chen Cheng <[email protected]>

    selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency

Christian König <[email protected]>
drm/amdgpu: reject gang submissions under SRIOV

John Harrison <[email protected]>
drm/xe/guc: Return an error code if the GuC load fails

Asbjørn Sloth Tønnesen <[email protected]>
tools: ynl-gen: validate nested arrays

Fan Gong <[email protected]>

    hinic3: Fix missing napi->dev in netif_queue_set_napi

Fan Gong <[email protected]>
hinic3: Queue pair endianness improvements

Mario Limonciello (AMD) <[email protected]>
HID: i2c-hid: Resolve touchpad issues on Dell systems during S4

Palash Kambar <[email protected]>
scsi: ufs: ufs-qcom: Disable lane clocks during phy hibern8

Stefan Wahren <[email protected]>
ethernet: Extend device_get_mac_address() to use NVMEM

Jakub Kicinski <[email protected]>
page_pool: always add GFP_NOWARN for ATOMIC allocations

Oleksij Rempel <[email protected]>
net: phy: clear EEE runtime state in PHY_HALTED/PHY_ERROR

Xi Ruoyao <[email protected]>
drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START

Timur Kristóf <[email protected]>
drm/amd/display: Disable VRR on DCE 6

Timur Kristóf <[email protected]>
drm/amd/display: Fix DVI-D/HDMI adapters

Timur Kristóf <[email protected]>
drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4

Timur Kristóf <[email protected]>
drm/amd/display: Don't use non-registered VUPDATE on DCE 6

Mario Limonciello (AMD) <[email protected]>
drm/amd: Avoid evicting resources at S5

Ausef Yousof <[email protected]>
drm/amd/display: fix dml ms order of operations

Mario Limonciello <[email protected]>
drm/amd/display: Set up pixel encoding for YCBCR422

Nicholas Kazlauskas <[email protected]>
drm/amd/display: Fix DMCUB loading sequence for DCN3.2

Lijo Lazar <[email protected]>
drm/amdgpu: Release hive reference properly

Prike Liang <[email protected]>
drm/amdgpu: validate userq buffer virtual address and size

Tvrtko Ursulin <[email protected]>
drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl

Felix Fietkau <[email protected]>
wifi: mt76: improve phy reset on hw restart

Felix Fietkau <[email protected]>
wifi: mt76: use altx queue for offchannel tx on connac+

Peter Chiu <[email protected]>
wifi: mt76: mt7996: disable promiscuous mode by default

Felix Fietkau <[email protected]>

    wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error

John Keeping <[email protected]>
ALSA: serial-generic: remove shared static buffer

Rosen Penev <[email protected]>
wifi: mt76: mt76_eeprom_override to int

Howard Hsu <[email protected]>
wifi: mt76: mt7996: support writing MAC TXD for AddBA Request

Benjamin Lin <[email protected]>
wifi: mt76: mt7996: Temporarily disable EPCS

Lorenzo Bianconi <[email protected]>

    wifi: mt76: mt7996: Set def_wcid pointer in mt7996_mac_sta_init_link()

Shayne Chen <[email protected]>

    wifi: mt76: mt7996: Fix mt7996_reverse_frag0_hdr_trans for MLO

Jack Kao <[email protected]>
wifi: mt76: mt7925: add pci restore for hibernate

Quan Zhou <[email protected]>
wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device

Yafang Shao <[email protected]>
net/cls_cgroup: Fix task_get_classid() during qdisc run

Alok Tiwari <[email protected]>
ionic: use int type for err in ionic_get_module_eeprom_by_page

Haiyang Zhang <[email protected]>
net: mana: Reduce waiting time if HWC not responding

Biju Das <[email protected]>
can: rcar_canfd: Update bit rate constants for RZ/G3E and R-Car Gen4

Gaurav Jain <[email protected]>
crypto: caam - double the entropy delay interval for retry

Yunseong Kim <[email protected]>
crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti()

Niklas Cassel <[email protected]>
PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()

Ovidiu Panait <[email protected]>
crypto: sun8i-ce - remove channel timeout field

Sangwook Shin <[email protected]>
watchdog: s3c2410_wdt: Fix max_timeout being calculated larger

Antheas Kapenekakis <[email protected]>
HID: asus: add Z13 folio to generic group for multitouch to work

Alok Tiwari <[email protected]>
udp_tunnel: use netdev_warn() instead of netdev_WARN()

Petr Machata <[email protected]>
selftests: net: lib.sh: Don't defer failed commands

Stanislav Fomichev <[email protected]>
net: devmem: expose tcp_recvmsg_locked errors

David Ahern <[email protected]>
selftests: Replace sleep with slowwait

Vernon Yang <[email protected]>
PCI/AER: Fix NULL pointer access by aer_info

Daniel Palmer <[email protected]>

    eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP

David Ahern <[email protected]>
selftests: Disable dad for ipv6 in fcnal-test.sh

Kai Huang <[email protected]>
x86/virt/tdx: Use precalculated TDVPR page physical address

Li RongQing <[email protected]>
x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT

Florian Westphal <[email protected]>
netfilter: nf_reject: don't reply to icmp error messages

chenmiao <[email protected]>
openrisc: Add R_OR1K_32_PCREL relocation type module support

Ido Schimmel <[email protected]>
selftests: traceroute: Return correct value on failure

Ido Schimmel <[email protected]>
selftests: traceroute: Use require_command()

Shyam Sundar S K <[email protected]>
platform/x86/amd/pmf: Fix the custom bios input handling mechanism

Qianfeng Rong <[email protected]>
media: redrat3: use int type to store negative error codes

Jakub Kicinski <[email protected]>
selftests: net: replace sleeps in fcnal-test with waits

Niklas Söderlund <[email protected]>
net: sh_eth: Disable WoL if system can not suspend

Rob Clark <[email protected]>
drm/msm/registers: Generate _HI/LO builders for reg64

Michael Riesch <[email protected]>
phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0

Michael Dege <[email protected]>
phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet

Mario Limonciello (AMD) <[email protected]>
Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO

Harikrishna Shenoy <[email protected]>
phy: cadence: cdns-dphy: Enable lower resolutions in dphy

Mario Limonciello (AMD) <[email protected]>
fbcon: Use screen info to find primary device

Ilan Peer <[email protected]>
wifi: mac80211: Fix HE capabilities element check

Miri Korenblit <[email protected]>
wifi: cfg80211: update the time stamps in hidden ssid

Tetsuo Handa <[email protected]>
ntfs3: pretend $Extend records as regular files

Alice Chao <[email protected]>
scsi: ufs: host: mediatek: Fix adapt issue after PA_Init

Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes

Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Correct system PM flow

Rohan G Thomas <[email protected]>
net: phy: marvell: Fix 88e1510 downshift counter errata

Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure

Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue

Palash Kambar <[email protected]>
scsi: ufs: ufs-qcom: Align programming sequence of Shared ICE for UFS controller v5

Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Enhance recovery on resume failure

Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: allow more time to send ADD_ADDR

Prike Liang <[email protected]>
drm/amdgpu: validate userq input args

Jaegeuk Kim <[email protected]>
f2fs: fix wrong layout information on 16KB page

Michal Wajdeczko <[email protected]>
drm/xe/guc: Always add CT disable action during second init step

Dmitry Baryshkov <[email protected]>
drm/bridge: write full Audio InfoFrame

Loic Poulain <[email protected]>
media: qcom: camss: csiphy-3ph: Add CSIPHY 2ph DPHY v2.0.1 init sequence

Vladimir Zapolskiy <[email protected]>
media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer

Hao Yao <[email protected]>
media: ov08x40: Fix the horizontal flip control

Raag Jadav <[email protected]>
drm/xe/i2c: Enable bus mastering

Nidhish A N <[email protected]>
wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list

Zenm Chen <[email protected]>

    wifi: rtw89: Add USB ID 2001:3327 for D-Link AX18U rev. A1

Zenm Chen <[email protected]>

    wifi: rtw89: Add USB ID 2001:332a for D-Link AX9U rev. A1

Marek Vasut <[email protected]>
PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs

Jakub Kicinski <[email protected]>
selftests: net: make the dump test less sensitive to mem accounting

Alexander Lobakin <[email protected]>
idpf: link NAPIs to queues

Akhil P Oommen <[email protected]>
drm/msm/a6xx: Switch to GMU AO counter

Akhil P Oommen <[email protected]>
drm/msm/adreno: Add fenced regwrite support

Akhil P Oommen <[email protected]>
drm/msm/adreno: Add speedbin data for A623 GPU

Xion Wang <[email protected]>
char: Use list_del_init() in misc_deregister() to reinitialize list pointer

Antonino Maniscalco <[email protected]>
drm/msm: make sure to not queue up recovery more than once

Jie Zhang <[email protected]>
dt-bindings: display/msm/gmu: Update Adreno 623 bindings

Rob Clark <[email protected]>
drm/msm: Fix 32b size truncation

Akhil P Oommen <[email protected]>
drm/msm/adreno: Add speedbins for A663 GPU

Markus Heidelberg <[email protected]>
eeprom: at25: support Cypress FRAMs without device ID

Zizhi Wo <[email protected]>
tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()

Claudiu Beznea <[email protected]>
serdev: Drop dev_pm_domain_detach() call

Viken Dadhaniya <[email protected]>
serial: qcom-geni: Add DFS clock mode support to GENI UART driver

Chen Yufeng <[email protected]>
usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget

William Wu <[email protected]>
usb: gadget: f_hid: Fix zero length packet transfer

Vladimir Oltean <[email protected]>
net: dsa: felix: support phy-mode = "10g-qxgmii"

Stanislav Fomichev <[email protected]>
selftests: ncdevmem: don't retry EFAULT

Mario Limonciello <[email protected]>
drm/amd/display: Indicate when custom brightness curves are in use

Yang Wang <[email protected]>
drm/amd/pm: refine amdgpu pm sysfs node error code

Ausef Yousof <[email protected]>
drm/amd/display: dont wait for pipe update during medupdate/highirq

Fangzhi Zuo <[email protected]>
drm/amd/display: Fix pbn_div Calculation Error

Alex Deucher <[email protected]>
drm/amdgpu: add support for cyan skillfish gpu_info

Alex Deucher <[email protected]>
drm/amdgpu: don't enable SMU on cyan skillfish

Alex Deucher <[email protected]>
drm/amd: add more cyan skillfish PCI ids

Xiang Liu <[email protected]>
drm/amdgpu: Correct info field of bad page threshold exceed CPER

Slark Xiao <[email protected]>
bus: mhi: host: pci_generic: Add support for all Foxconn T99W696 SKU variants

Hector Martin <[email protected]>
iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs

Ashish Kalra <[email protected]>
crypto: ccp: Skip SEV and SNP INIT for kdump boot

Ashish Kalra <[email protected]>
iommu/amd: Reuse device table for kdump

Ashish Kalra <[email protected]>
iommu/amd: Skip enabling command/event buffers for kdump

Ashish Kalra <[email protected]>
iommu/amd: Add support to remap/unmap IOMMU buffers for kdump

Matthew Auld <[email protected]>
drm/xe: improve dma-resv handling for backup object

Matthew Auld <[email protected]>
drm/gpusvm: fix hmm_pfn_to_map_order() usage

Colin Foster <[email protected]>
smsc911x: add second read of EEPROM mac when possible corruption seen

Eric Dumazet <[email protected]>
net: call cond_resched() less often in __release_sock()

Michal Wajdeczko <[email protected]>
drm/xe/guc: Set upper limit of H2G retries over CTB

Richard Zhu <[email protected]>
PCI: imx6: Enable the Vaux supply if available

Cryolitia PukNgae <[email protected]>
ALSA: usb-audio: apply quirk for MOONDROP Quark2

Srinivas Pandruvada <[email protected]>
platform/x86/intel-uncore-freq: Present unique domain ID per package

Mark Pearson <[email protected]>
platform/x86: think-lmi: Add extra TC BIOS error messages

Ramya Gnanasekar <[email protected]>
wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands

Paul Kocialkowski <[email protected]>
media: verisilicon: Explicitly disable selection api ioctls for decoders

Niklas Söderlund <[email protected]>
media: adv7180: Only validate format in querystd

Niklas Söderlund <[email protected]>
media: adv7180: Do not write format to device in set_fmt

Niklas Söderlund <[email protected]>
media: adv7180: Add missing lock in suspend callback

Juraj Šarinay <[email protected]>
net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms

Asbjørn Sloth Tønnesen <[email protected]>
netlink: specs: fou: change local-v6/peer-v6 check

Jedrzej Jagielski <[email protected]>
ixgbe: reduce number of reads when getting OROM data

Antheas Kapenekakis <[email protected]>
drm: panel-backlight-quirks: Make EDID match optional

Chia-I Wu <[email protected]>
drm/panthor: check bo offset alignment in vm bind

Miri Korenblit <[email protected]>
wifi: mac80211: count reg connection element in the size

Tangudu Tilak Tirumalesh <[email protected]>

    drm/xe: Extend Wa_22021007897 to Xe3 platforms

Yue Haibing <[email protected]>
ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled

Jakub Kicinski <[email protected]>
selftests: drv-net: rss_ctx: make the test pass with few queues

Al Viro <[email protected]>
move_mount(2): take sanity checks in 'beneath' case into do_lock_mount()

Timur Kristóf <[email protected]>
drm/amd/pm: Increase SMC timeout on SI and warn (v3)

Zhanjun Dong <[email protected]>
drm/xe/guc: Increase GuC crash dump buffer size

David Francis <[email protected]>
drm/amdgpu: Allow kfd CRIU with no buffer objects

Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/phy_7nm: Fix missing initial VCO rate

Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL

Florian Westphal <[email protected]>
netfilter: nf_tables: all transaction allocations can now sleep

Devendra K Verma <[email protected]>
dmaengine: dw-edma: Set status for callback_result

Rosen Penev <[email protected]>
dmaengine: mv_xor: match alloc_wc and free_wc

Thomas Andreatta <[email protected]>
dmaengine: sh: setup_xref error handling

Satyanarayana K V P <[email protected]>
drm/xe/guc: Add devm release action to safely tear down CT

Miroslav Lichvar <[email protected]>
ptp: Limit time setting of PTP clocks

Marcus Folkesson <[email protected]>
drm/st7571-i2c: add support for inverted pixel format

Miri Korenblit <[email protected]>
wifi: iwlwifi: pcie: remember when interrupts are disabled

Richard Leitner <[email protected]>
media: nxp: imx8-isi: Fix streaming cleanup on release

Laurent Pinchart <[email protected]>
media: imx-mipi-csis: Only set clock rate when specified in DT

Bharat Uppal <[email protected]>
scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend

David Lechner <[email protected]>
iio: adc: ad7124: do not require mclk

Qianfeng Rong <[email protected]>
scsi: pm8001: Use int instead of u32 to store error codes

Qianfeng Rong <[email protected]>
crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()

Eric Dumazet <[email protected]>
tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()

Parthiban Veerasooran <[email protected]>
microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support

Eric Dumazet <[email protected]>
inet_diag: annotate data-races in inet_diag_bc_sk()

Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: rename stp node on EASY50712 reference board

Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: xway: sysctrl: rename stp clock

Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing device_type in pci node

Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add model to EASY50712 dts

Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing properties to cpu node

Timur Kristóf <[email protected]>
drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)

Mangesh Gadre <[email protected]>
drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest

Clay King <[email protected]>
drm/amd/display: incorrect conditions for failing dto calculations

Mangesh Gadre <[email protected]>
drm/amdgpu: Avoid jpeg v5.0.1 poison irq call trace on sriov guest

Relja Vojvodic <[email protected]>
drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting

Xiang Liu <[email protected]>
drm/amdgpu: Notify pmfw bad page threshold exceeded

Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-pcm: Add fixup for channels

Martin Tůma <[email protected]>
media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS

Chelsy Ratnawat <[email protected]>
media: fix uninitialized symbol warnings

Jakub Kicinski <[email protected]>
selftests: drv-net: rss_ctx: fix the queue count check

Rob Herring (Arm) <[email protected]>
drm/msm: Use of_reserved_mem_region_to_resource() for "memory-region"

Jessica Zhang <[email protected]>
drm/msm/dpu: Filter modes based on adjusted mode clock

Srinivas Pandruvada <[email protected]>
platform/x86/intel-uncore-freq: Fix warning in partitioned system

Somashekhar Puttagangaiah <[email protected]>
wifi: iwlwifi: mld: trigger mlo scan only when not in EMLSR

Mohsin Bashir <[email protected]>
eth: fbnic: Reset hw stats upon PCI error

Krishna Kumar <[email protected]>
net: Prevent RPS table overwrite of active flows

Stuart Summers <[email protected]>
drm/xe: Cancel pending TLB inval workers on teardown

Alex Deucher <[email protected]>
drm/amdgpu/vpe: cancel delayed work in hw_fini

Dillon Varone <[email protected]>
drm/amd/display: Consider sink max slice width limitation for dsc

Yihan Zhu <[email protected]>
drm/amd/display: wait for otg update pending latch before clock optimization

Amber Lin <[email protected]>
drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption

Ivan Lipski <[email protected]>
drm/amd/display: Support HW cursor 180 rot for any number of pipe splits

Eric Huang <[email protected]>
drm/amdkfd: fix vram allocation failure for a special case

Ce Sun <[email protected]>
drm/amdgpu: Correct the counts of nr_banks and nr_errors

Ce Sun <[email protected]>
drm/amdgpu: Correct the loss of aca bank reg info

Christian Bruel <[email protected]>
misc: pci_endpoint_test: Skip IRQ tests if irq is out of range

Xin Wang <[email protected]>
drm/xe: Ensure GT is in C0 during resumes

Christian Bruel <[email protected]>
selftests: pci_endpoint: Skip IRQ test if IRQ is out of range.

Li RongQing <[email protected]>
virtio_fs: fix the hash table using in virtio_fs_enqueue_req()

Miklos Szeredi <[email protected]>
fuse: zero initialize inode private data

Jakub Kicinski <[email protected]>
selftests: drv-net: hds: restore hds settings

Heiner Kallweit <[email protected]>
net: phy: fixed_phy: let fixed_phy_unregister free the phy_device

Chaitanya Kumar Borah <[email protected]>
drm/xe/wcl: Extend L3bank mask workaround

Andrew Davis <[email protected]>
remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper

Riana Tauro <[email protected]>
drm/xe: Set GT as wedged before sending wedged uevent

Krzysztof Kozlowski <[email protected]>
extcon: axp288: Fix wakeup source leaks on device unbind

Krzysztof Kozlowski <[email protected]>
extcon: fsa9480: Fix wakeup source leaks on device unbind

Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Fix wakeup source leaks on device unbind

Francisco Gutierrez <[email protected]>

    scsi: pm80xx: Fix race condition caused by static variables

Chandrakanth Patil <[email protected]>
scsi: mpi3mr: Fix controller init failure on fault during queue creation

Chandrakanth Patil <[email protected]>
scsi: mpi3mr: Fix I/O failures during controller reset

Ching-Te Ku <[email protected]>
wifi: rtw89: coex: Limit Wi-Fi scan slot cost to avoid A2DP glitch

Chandrakanth Patil <[email protected]>
scsi: mpi3mr: Fix device loss during enclosure reboot due to zero link speed

Oscar Maes <[email protected]>
net: ipv4: allow directed broadcast routes to use dst hint

Andrew Davis <[email protected]>
rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table

Sakari Ailus <[email protected]>
media: ipu6: isys: Set embedded data type correctly for metadata formats

Cryolitia PukNgae <[email protected]>
iio: imu: bmi270: Match PNP ID found on newer GPD firmware

Jiawen Wu <[email protected]>
net: wangxun: limit tx_max_coalesced_frames_irq

Ujwal Kundur <[email protected]>
rds: Fix endianness annotation for RDS_MPATH_HASH

Heiko Stuebner <[email protected]>
drm/panel: ilitek-ili9881c: move display_on/_off dcs calls to (un-)prepare

Heiko Stuebner <[email protected]>
drm/panel: ilitek-ili9881c: turn off power-supply when init fails

Stuart Summers <[email protected]>
drm/xe/pcode: Initialize data0 for pcode read routine

Eric Dumazet <[email protected]>
idpf: do not linearize big TSO packets

Hariprasad Kelam <[email protected]>
Octeontx2-af: Broadcast XON on all channels

Takashi Iwai <[email protected]>
ALSA: usb-audio: Add validation of UAC2/UAC3 effect units

Xichao Zhao <[email protected]>
tty: serial: Modify the use of dev_err_probe()

Pavan Chebbi <[email protected]>
bnxt_en: Add Hyper-V VF ID

Sungho Kim <[email protected]>
PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call

Chao Yu <[email protected]>
f2fs: fix to detect potential corrupted nid in free_nid_list

Anil S Keshavamurthy <[email protected]>
dmaengine: idxd: Add a new IAA device ID for Wildcat Lake family platforms

Kuniyuki Iwashima <[email protected]>
net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.

Oleksij Rempel <[email protected]>
net: stmmac: Correctly handle Rx checksum offload errors

Christoph Paasch <[email protected]>
net: When removing nexthops, don't call synchronize_net if it is not necessary

Zijun Hu <[email protected]>
char: misc: Does not request module for miscdevice with dynamic minor

Zijun Hu <[email protected]>
char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor

Christoph Hellwig <[email protected]>
dm error: mark as DM_TARGET_PASSES_INTEGRITY

Kuan-Chung Chen <[email protected]>
wifi: rtw89: 8851b: rfk: update IQK TIA setting

Kuan-Chung Chen <[email protected]>
wifi: rtw89: fix BSSID comparison for non-transmitted BSSID

Kuan-Chung Chen <[email protected]>
wifi: rtw89: wow: remove notify during WoWLAN net-detect

Simon Richter <[email protected]>
drm/xe: Make page size consistent in loop

Mohammad Rafi Shaik <[email protected]>
ASoC: codecs: wsa883x: Handle shared reset GPIO for WSA883x speakers

Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Do not share the name pointer between components

Shimrra Shai <[email protected]>
ASoC: es8323: add proper left/right mixer controls via DAPM

Shimrra Shai <[email protected]>
ASoC: es8323: remove DAC enablement write from es8323_probe

raub camaioni <[email protected]>
usb: gadget: f_ncm: Fix MAC assignment NCM ethernet

Haibo Chen <[email protected]>
iio: adc: imx93_adc: load calibrated values even calibration failed

Rodrigo Gobbi <[email protected]>
iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register

Xichao Zhao <[email protected]>
hwrng: timeriomem - Use us_to_ktime() where appropriate

Chenglei Xie <[email protected]>
drm/amdgpu: refactor bad_page_work for corner case handling

Kent Russell <[email protected]>
drm/amdkfd: Handle lack of READ permissions in SVM mapping

Heng Zhou <[email protected]>
drm/amdgpu: fix nullptr err of vm_handle_moved

Dmitry Baryshkov <[email protected]>
drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts

Tomasz Pakuła <[email protected]>
HID: pidff: PERMISSIVE_CONTROL quirk autodetection

Tomasz Pakuła <[email protected]>
HID: pidff: Use direction fix only for conditional effects

Karunika Choo <[email protected]>
drm/panthor: Serialize GPU cache flush operations

Tetsuo Handa <[email protected]>
media: imon: make send_packet() more robust

Charalampos Mitrodimas <[email protected]>
net: ipv6: fix field-spanning memcpy warning in AH output

Alexandre Courbot <[email protected]>
gpu: nova-core: register: allow fields named offset

Alice Chao <[email protected]>
scsi: ufs: host: mediatek: Fix invalid access in vccqx handling

Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Change reset sequence for improved stability

Alice Chao <[email protected]>
scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change

Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Fix PWM mode switch issue

Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration

Vladimir Oltean <[email protected]>
net: phy: mscc: report and configure in-band auto-negotiation for SGMII/QSGMII

Jakub Kicinski <[email protected]>
selftests: drv-net: wait for carrier

Ido Schimmel <[email protected]>
bridge: Redirect to backup port when port is administratively down

Niklas Schnelle <[email protected]>
s390/pci: Use pci_uevent_ers() in PCI recovery

Niklas Schnelle <[email protected]>
powerpc/eeh: Use result of error_detected() in uevent

Shimrra Shai <[email protected]>
ASoC: es8323: enable DAPM power widgets for playback DAC and output

Thomas Bogendoerfer <[email protected]>
tty: serial: ip22zilog: Use platform device for probing

Lukas Wunner <[email protected]>
thunderbolt: Use is_pciehp instead of is_hotplug_bridge

Thomas Weißschuh <[email protected]>
ice: Don't use %pK through printk or tracepoints

Tiezhu Yang <[email protected]>
net: stmmac: Check stmmac_hw_setup() in stmmac_resume()

Kirill A. Shutemov <[email protected]>
x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall

Lukas Wunner <[email protected]>
PCI/ERR: Update device error_state already after reset

Mehdi Djait <[email protected]>
media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR

Konstantin Taranov <[email protected]>
RDMA/mana_ib: Drain send wrs of GSI QP

Tomi Valkeinen <[email protected]>
drm/tidss: Remove early fb

Jayesh Choudhary <[email protected]>
drm/tidss: Set crtc modesetting parameters with adjusted mode

Tomi Valkeinen <[email protected]>
drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST

Tomi Valkeinen <[email protected]>
drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value

Tomi Valkeinen <[email protected]>
drm/tidss: Use the crtc_* timings when programming the HW

Laurent Pinchart <[email protected]>
media: amphion: Delete v4l2_fh synchronously in .release()

Laurent Pinchart <[email protected]>
media: pci: ivtv: Don't create fake v4l2_fh

Jakub Kicinski <[email protected]>
selftests: drv-net: devmem: flip the direction of Tx tests

Jakub Kicinski <[email protected]>
selftests: drv-net: devmem: add / correct the IPv6 support

Geoffrey McRae <[email protected]>
drm/amdkfd: return -ENOTTY for unsupported IOCTLs

Ping-Ke Shih <[email protected]>
wifi: rtw89: add dummy C2H handlers for BCN resend and update done

Ping-Ke Shih <[email protected]>
wifi: rtw88: sdio: use indirect IO for device registers before power-on

Ping-Ke Shih <[email protected]>
wifi: rtw89: print just once for unknown C2H events

Wake Liu <[email protected]>
selftests/net: Ensure assert() triggers in psock_tpacket.c

Wake Liu <[email protected]>
selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8

Christopher Orr <[email protected]>
drm/panel-edp: Add SHP LQ134Z1 panel for Dell XPS 9345

Timur Tabi <[email protected]>
drm/nouveau: always set RMDevidCheckIgnore for GSP-RM

Marcos Del Sol Vives <[email protected]>
PCI: Disable MSI on RDC PCI to PCIe bridges

Thomas Zimmermann <[email protected]>
drm/sharp-memory: Do not access GEM-DMA vaddr directly

Mauro Carvalho Chehab <[email protected]>
docs: kernel-doc: avoid script crash on ancient Python

Matthew Auld <[email protected]>
drm/xe: rework PDE PAT index selection

TungYu Lu <[email protected]>
drm/amd/display: Wait until OTG enable state is cleared

Vitaly Prosyak <[email protected]>
drm/amdgpu: add to custom amdgpu_drm_release drm_dev_enter/exit

Danny Wang <[email protected]>
drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off

Terry Cheong <[email protected]>
ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks

Shenghao Ding <[email protected]>
ASoC: tas2781: Add keyword "init" in profile section

Seyediman Seyedarab <[email protected]>
drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()

Piotr Piórkowski <[email protected]>
drm/xe/pf: Program LMTT directory pointer on all GTs within a tile

Sathishkumar S <[email protected]>
drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff

Lizhi Hou <[email protected]>
accel/amdxdna: Unify pm and rpm suspend and resume callbacks

Lijo Lazar <[email protected]>
drm/amd/pm: Use cached metrics data on arcturus

Lijo Lazar <[email protected]>
drm/amd/pm: Use cached metrics data on aldebaran

Paul Hsieh <[email protected]>
drm/amd/display: update dpp/disp clock from smu clock table

Aurabindo Pillai <[email protected]>
drm/amd/display: fix dmub access race condition

Yunxiang Li <[email protected]>
drm/amdgpu: skip mgpu fan boost for multi-vf

Mangesh Gadre <[email protected]>
drm/amdgpu: Initialize jpeg v5_0_1 ras function

Alex Deucher <[email protected]>
drm/amd/display: add more cyan skillfish devices

Xiang Liu <[email protected]>
drm/amdgpu: Skip poison aca bank from UE channel

Tangudu Tilak Tirumalesh <[email protected]>
drm/xe: Extend wa_13012615864 to additional Xe2 and Xe3 platforms

Stanley.Yang <[email protected]>
drm/amdgpu: Fix vcn v5.0.1 poison irq call trace

Meng Li <[email protected]>
drm/amd/amdgpu: Release xcp drm memory after unplug

Ce Sun <[email protected]>
drm/amdgpu: Effective health check before reset

Ce Sun <[email protected]>
drm/amdgpu: Avoid rma causes GPU duplicate reset

Xiang Liu <[email protected]>
drm/amdgpu: Update IPID value for bad page threshold CPER

Perry Yuan <[email protected]>
drm/amdgpu: Fix build error when CONFIG_SUSPEND is disabled

Michal Wajdeczko <[email protected]>
drm/xe/pf: Don't resume device from restart worker

Maarten Lankhorst <[email protected]>
drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.

John Harrison <[email protected]>
drm/xe/guc: Add more GuC load error status codes

Michael Strauss <[email protected]>
drm/amd/display: Cache streams targeting link when performing LT automation

Ovidiu Bunea <[email protected]>
drm/amd/display: Fix dmub_cmd header alignment

Michael Strauss <[email protected]>
drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration

Michael Strauss <[email protected]>
drm/amd/display: Move setup_stream_attribute

Cruise Hung <[email protected]>
drm/amd/display: Remove check DPIA HPD status for BW Allocation

Sathishkumar S <[email protected]>
drm/amdgpu: Check vcn sram load return value

Tao Zhou <[email protected]>
drm/amdgpu: add range check for RAS bad page address

Clay King <[email protected]>
drm/amd/display: ensure committing streams is seamless

Aurabindo Pillai <[email protected]>
drm/amd/display: fix condition for setting timing_adjust_pending

Ostrowski Rafal <[email protected]>
drm/amd/display: Update tiled to tiled copy command

Michal Wajdeczko <[email protected]>
drm/xe/configfs: Enforce canonical device names

Sk Anirban <[email protected]>

    drm/xe/ptl: Apply Wa_16026007364

Ilpo Järvinen <[email protected]>
mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs

Charles Keepax <[email protected]>
mfd: cs42l43: Move IRQ enable/disable to encompass force suspend

Bastien Curutchet <[email protected]>
mfd: core: Increment of_node's refcount before linking it to the platform device

Janne Grunau <[email protected]>
mfd: macsmc: Add "apple,t8103-smc" compatible

Jens Kehne <[email protected]>
mfd: da9063: Split chip variant reading in two bus transactions

Arnd Bergmann <[email protected]>
mfd: madera: Work around false-positive -Wininitialized warning

Heiko Stuebner <[email protected]>
mfd: qnap-mcu: Include linux/types.h in qnap-mcu.h shared header

Heiko Stuebner <[email protected]>
mfd: qnap-mcu: Handle errors returned from qnap_mcu_write

Alexander Stein <[email protected]>
mfd: stmpe-i2c: Add missing MODULE_LICENSE

Alexander Stein <[email protected]>
mfd: stmpe: Remove IRQ domain upon removal

Ioana Ciornei <[email protected]>
mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA

Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Prefer driver HWP limits

Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Enhance HWP enable

Kaushlendra Kumar <[email protected]>
tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage

Kaushlendra Kumar <[email protected]>
tools/power turbostat: Fix incorrect sorting of PMT telemetry

Mykyta Yatsenko <[email protected]>
selftests/bpf: Fix flaky bpf_cookie selftest

Kaushlendra Kumar <[email protected]>
tools/cpupower: Fix incorrect size in cpuidle_state_disable()

Armin Wolf <[email protected]>
hwmon: (dell-smm) Add support for Dell OptiPlex 7040

Armin Wolf <[email protected]>
hwmon: (dell-smm) Remove Dell Precision 490 custom config data

Ben Copeland <[email protected]>
hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex

Jiri Olsa <[email protected]>
uprobe: Do not emulate/sstep original instruction when ip is changed

Alistair Francis <[email protected]>
nvme: Use non zero KATO for persistent discovery connections

Amery Hung <[email protected]>
selftests: drv-net: Pull data before parsing headers

Amery Hung <[email protected]>
bpf: Clear pfmemalloc flag when freeing all fragments

Chenghao Duan <[email protected]>
riscv: bpf: Fix uninitialized symbol 'retval_off'

Yu Kuai <[email protected]>
blk-cgroup: fix possible deadlock while configuring policy

Markus Stockhausen <[email protected]>
clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts

Markus Stockhausen <[email protected]>
clocksource/drivers/timer-rtl-otto: Work around dying timers

Daniel Lezcano <[email protected]>
clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel

Chen Pei <[email protected]>
ACPI: SPCR: Support Precise Baud Rate field

Biju Das <[email protected]>
spi: rpc-if: Add resume support for RZ/G3E

Uday Shankar <[email protected]>
selftests: ublk: fix behavior when fio is not installed

Yonghong Song <[email protected]>
selftests/bpf: Fix selftest verifier_arena_large failure

Pranav Tyagi <[email protected]>
futex: Don't leak robust_list pointer on exec race

Rafael J. Wysocki <[email protected]>
cpuidle: Fail cpuidle device registration if there is one already

Tom Stellard <[email protected]>
bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21

Fenglin Wu <[email protected]>
power: supply: qcom_battmgr: handle charging state change notifications

Janne Grunau <[email protected]>
pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"

Pavel Begunkov <[email protected]>
io_uring/zcrx: account niov arrays to cgroup

Kaushlendra Kumar <[email protected]>
tools/cpupower: fix error return value in cpupower_write_sysfs()

Pavel Begunkov <[email protected]>
io_uring/zcrx: check all niovs filled with dma addresses

Manikanta Guntupalli <[email protected]>
i3c: dw: Add shutdown support to dw_i3c_master driver

Svyatoslav Ryhel <[email protected]>
video: backlight: lp855x_bl: Set correct EPROM start for LP8556

Kaibo Ma <[email protected]>
rust: kunit: allow cfg on tests

Jarkko Nikula <[email protected]>
i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Do not limit bpf_cgroup_from_id to current's namespace

Saket Kumar Bhaskar <[email protected]>
selftests/bpf: Fix arena_spin_lock selftest failure

Thomas Weißschuh <[email protected]>
kunit: Enable PCI on UML without triggering WARN()

Daniel Wagner <[email protected]>
nvme-fc: use lock accessing port_state and rport state

Daniel Wagner <[email protected]>
nvmet-fc: avoid scheduling association deletion twice

Amirreza Zarrabi <[email protected]>
tee: allow a driver to allocate a tee_device without a pool

Hans de Goede <[email protected]>
ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()

Uwe Kleine-König <[email protected]>
pwm: pca9685: Use bulk write to atomicially update registers

Sarthak Garg <[email protected]>
mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card

Bryan Brattlof <[email protected]>
soc: ti: k3-socinfo: Add information for AM62L SR1.1

Nikita Travkin <[email protected]>
firmware: qcom: tzmem: disable sc7180 platform

Svyatoslav Ryhel <[email protected]>
ARM: tegra: transformer-20: fix audio-codec interrupt

Svyatoslav Ryhel <[email protected]>
ARM: tegra: transformer-20: add missing magnetometer interrupt

Jonas Schwöbel <[email protected]>
ARM: tegra: p880: set correct touchscreen clipping

Svyatoslav Ryhel <[email protected]>
soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups

Radhey Shyam Pandey <[email protected]>
arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106

Quanyang Wang <[email protected]>
arm64: zynqmp: Disable coresight by default

Sohil Mehta <[email protected]>
cpufreq: ondemand: Update the efficient idle check for Intel extended Families

Ming Wang <[email protected]>
irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller

Keith Busch <[email protected]>
block: check for valid bio while splitting

Jiayuan Chen <[email protected]>
selftests/bpf: Fix incorrect array size calculation

Andreas Kemnade <[email protected]>
hwmon: sy7636a: add alias

Caleb Sander Mateos <[email protected]>
io_uring/rsrc: respect submitter_task in io_register_clone_buffers()

Fabien Proriol <[email protected]>
power: supply: sbs-charger: Support multiple devices

Bartosz Golaszewski <[email protected]>
pinctrl: keembay: release allocated memory in detach path

Biju Das <[email protected]>
pinctrl: renesas: rzg2l: Add suspend/resume support for Schmitt control registers

Chuande Chen <[email protected]>
hwmon: (sbtsi_temp) AMD CPU extended temperature range support

David Ober <[email protected]>
hwmon: (lenovo-ec-sensors) Update P8 supprt

Rong Zhang <[email protected]>
hwmon: (k10temp) Add device ID for Strix Halo

Avadhut Naik <[email protected]>
hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models

Christopher Ruehl <[email protected]>
power: supply: qcom_battmgr: add OOI chemistry

Srinivas Pandruvada <[email protected]>
thermal: intel: selftests: workload_hint: Mask unsupported types

Rafael J. Wysocki <[email protected]>
thermal: gov_step_wise: Allow cooling level to be reduced earlier

Hans de Goede <[email protected]>

    ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]

Sam van Kampen <[email protected]>
ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU

Shang song (Lenovo) <[email protected]>
ACPI: PRM: Skip handlers with NULL handler_address or NULL VA

Christian Bruel <[email protected]>
irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment

Ricardo B. Marlière <[email protected]>
selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh

Yuan Chen <[email protected]>
bpftool: Add CET-aware symbol matching for x86_64 architectures

Kees Cook <[email protected]>
arc: Fix __fls() const-foldability via __builtin_clzl()

Thomas Weißschuh <[email protected]>
kselftest/arm64: tpidr2: Switch to waitpid() over wait4()

Val Packett <[email protected]>
firmware: qcom: scm: Allow QSEECOM on Dell Inspiron 7441 / Latitude 7455

Dennis Beier <[email protected]>
cpufreq/longhaul: handle NULL policy in longhaul_exit

Harini T <[email protected]>
arm64: versal-net: Update rtc calibration value

Ricardo B. Marlière <[email protected]>
selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2

Jiawei Zhao <[email protected]>
libbpf: Fix USDT SIB argument handling causing unrecognized register error

Mario Limonciello (AMD) <[email protected]>
ACPI: video: force native for Lenovo 82K8

Kaushlendra Kumar <[email protected]>
ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object

Pavel Begunkov <[email protected]>
io_uring/zctx: check chained notif contexts

Bibo Mao <[email protected]>
irqchip/loongson-eiointc: Route interrupt parsed from bios table

Inochi Amaoto <[email protected]>
irqchip/sifive-plic: Respect mask state when setting affinity

Takashi Sakamoto <[email protected]>
firewire: ohci: move self_id_complete tracepoint after validating register

Kendall Willis <[email protected]>
firmware: ti_sci: Enable abort handling of entry to LPM

Paul Chaignon <[email protected]>
bpf: Use tnums for JEQ/JNE is_branch_taken logic

Paresh Bhagat <[email protected]>
cpufreq: ti: Add support for AM62D2

Jiayi Li <[email protected]>
memstick: Add timeout to prevent indefinite waiting

Biju Das <[email protected]>
mmc: host: renesas_sdhi: Fix the actual clock

Chi Zhang <[email protected]>
pinctrl: single: fix bias pull up/down handling in pin_config_set

Erick Shepherd <[email protected]>
mmc: sdhci: Disable SD card clock before changing parameters

Thomas Weißschuh <[email protected]>
bpf: Don't use %pK through printk

Thomas Weißschuh <[email protected]>
soc: ti: pruss: don't use %pK through printk

Gabor Juhos <[email protected]>
spi: spi-qpic-snand: handle 'use_ecc' parameter of qcom_spi_config_cw_read()

Thomas Weißschuh <[email protected]>
spi: loopback-test: Don't use %pK through printk

Jens Reidel <[email protected]>
soc: qcom: smem: Fix endian-unaware access of num_entries

Mukesh Ojha <[email protected]>
firmware: qcom: scm: preserve assign_mem() error return value

Ryan Chen <[email protected]>
soc: aspeed: socinfo: Add AST27xx silicon IDs

Owen Gu <[email protected]>
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.

Heijligen, Thomas <[email protected]>

    mfd: kempld: Switch back to earlier ->init() behavior

Rafael J. Wysocki <[email protected]>
PM: sleep: Allow pm_restrict_gfp_mask() stacking

Rafael J. Wysocki <[email protected]>
PM: hibernate: Combine return paths in power_down()

Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Select polling state in some more cases

Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Rearrange main loop in menu_select()

Paolo Abeni <[email protected]>
mptcp: fix MSG_PEEK stream corruption

Paolo Abeni <[email protected]>
mptcp: leverage skb deferral free

Alex Hung <[email protected]>
drm/amd/display: Add HDR workaround for a specific eDP

Matthew Schwartz <[email protected]>
drm/amd/display: Don't program BLNDGAM_MEM_PWR_FORCE when CM low-power is disabled on DCN30

Ivan Lipski <[email protected]>
drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc

Mario Limonciello <[email protected]>
drm/amd: Check that VPE has reached DPM0 in idle handler

Thomas Zimmermann <[email protected]>
drm/ast: Clear preserved bits from register output value

Ville Syrjälä <[email protected]>
drm/i915/dmc: Clear HRR EVT_CTL/HTP to zero on ADL-S

Johan Hovold <[email protected]>
drm/mediatek: Fix device use-after-free on unbind

Philipp Stanner <[email protected]>
drm/nouveau: Fix race in nouveau_sched_fini()

Philipp Stanner <[email protected]>
drm/sched: Fix race in drm_sched_entity_select_rq()

David Rosca <[email protected]>
drm/sched: avoid killing parent entity on child SIGKILL

Thomas Zimmermann <[email protected]>
drm/sysfb: Do not dereference NULL pointer in plane reset

Matthew Brost <[email protected]>
drm/xe: Do not wake device during a GT reset

Miaoqian Lin <[email protected]>
s390/mm: Fix memory leak in add_marker() when kvrealloc() fails

Heiko Carstens <[email protected]>
s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP

Gerd Bayer <[email protected]>
s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump

Shawn Guo <[email protected]>
regmap: irq: Correct documentation of wake_invert flag

Alexey Klimov <[email protected]>
regmap: slimbus: fix bus_context pointer in regmap init calls

Dapeng Mi <[email protected]>
perf/x86/intel: Fix KASAN global-out-of-bounds warning

Dimitri John Ledkov <[email protected]>
kbuild: align modinfo section for Secureboot Authenticode EDK2 compat

Akash Goel <[email protected]>
dma-fence: Fix safe access wrapper to call timeline name method

Damien Le Moal <[email protected]>
block: make REQ_OP_ZONE_OPEN a write operation

Damien Le Moal <[email protected]>
block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL

Armin Wolf <[email protected]>
ACPI: fan: Use ACPI handle when retrieving _FST

Alex Deucher <[email protected]>
drm/amdgpu: fix SPDX header on irqsrcs_vcn_5_0.h

Alex Deucher <[email protected]>
drm/amdgpu: fix SPDX header on amd_cper.h

Alex Deucher <[email protected]>
drm/amdgpu: fix SPDX headers on amdgpu_cper.c/h

John Smith <[email protected]>
drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland

John Smith <[email protected]>
drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji

Yang Wang <[email protected]>
drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()

Daniel Palmer <[email protected]>
drm/radeon: Remove calls to drm_put_dev()

Daniel Palmer <[email protected]>
drm/radeon: Do not kfree() devres managed rdev

Bard Liao <[email protected]>
ASoC: soc_sdw_utils: remove cs42l43 component_name

Maarten Zanders <[email protected]>
ASoC: fsl_sai: Fix sync error in consumer mode

Petr Oros <[email protected]>
dpll: spec: add missing module-name and clock-id to pin-get reply

Hangbin Liu <[email protected]>
tools: ynl: avoid print_field when there is no reply

Abdun Nihaal <[email protected]>
sfc: fix potential memory leak in efx_mae_process_mport()

Jijie Shao <[email protected]>
net: hns3: return error code when function fails

Petr Oros <[email protected]>
tools: ynl: fix string attribute length to include null terminator

Tomeu Vizoso <[email protected]>
drm/etnaviv: fix flush sequence logic

Tony Luck <[email protected]>
ACPI: MRRM: Check revision of MRRM table

Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c

Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: add mono main switch to Presonus S1824c

Rob Clark <[email protected]>
drm/msm: Ensure vm is created in VM_BIND ioctl

Malin Jonsson <[email protected]>
bpf: Conditionally include dynptr copy kfuncs

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix tracking of periodic advertisement

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_conn: Fix connection cleanup with BIG with 2 or more BIS

Kiran K <[email protected]>
Bluetooth: btintel_pcie: Fix event packet loss issue

Luiz Augusto von Dentz <[email protected]>
Bluetooth: ISO: Fix another instance of dst_type handling

Pauli Virtanen <[email protected]>
Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete

Luiz Augusto von Dentz <[email protected]>

    Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00

Chris Lu <[email protected]>
Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset

Luiz Augusto von Dentz <[email protected]>
Bluetooth: ISO: Fix BIS connection dst_type handling

Cen Zhang <[email protected]>
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once

Lizhi Xu <[email protected]>
usbnet: Prevents free active kevent

Haotian Zhang <[email protected]>
ASoC: mediatek: Fix double pm_runtime_disable in remove functions

Andrii Nakryiko <[email protected]>
libbpf: Fix powerpc's stack register definition in bpf_tracing.h

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: correct the endian format for DSD

Shengjiu Wang <[email protected]>
ASoC: fsl_sai: fix bit order for DSD format

Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Disable periods-elapsed work when closing PCM

Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Unprepare a stream when XRUN occurs

Haotian Zhang <[email protected]>
crypto: aspeed - fix double free caused by devm

Harald Freudenberger <[email protected]>

    crypto: s390/phmac - Do not modify the req->nbytes value

Hannes Reinecke <[email protected]>
nvmet-auth: update sc_c in host response

Ondrej Mosnacek <[email protected]>
bpf: Do not audit capability check in do_jit()

Bart Van Assche <[email protected]>
scsi: core: Fix the unit attention counter implementation

Wonkon Kim <[email protected]>
scsi: ufs: core: Initialize value of an attribute returned by uic cmd

Noorain Eqbal <[email protected]>
bpf: Sync pending IRQ work before freeing ring buffer

Florian Schmaus <[email protected]>
kunit: test_dev_action: Correctly cast 'priv' pointer to long*

Emmanuel Grumbach <[email protected]>
wifi: nl80211: call kfree without a NULL check

Johannes Berg <[email protected]>
wifi: mac80211: fix key tailroom accounting leak

Aloka Dixit <[email protected]>
wifi: mac80211: reset FILS discovery and unsol probe resp intervals

Richard Fitzgerald <[email protected]>
ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h

Dan Carpenter <[email protected]>
wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()

Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: fix control pipe direction

Anna Maniscalco <[email protected]>
drm/msm: make sure last_fence is always updated

Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix GMU firmware parser

Rob Clark <[email protected]>
drm/msm: Fix GEM free for imported dma-bufs

Rameshkumar Sundaram <[email protected]>
wifi: ath11k: avoid bit operation on key flags

Karthik M <[email protected]>
wifi: ath12k: free skb during idr cleanup callback

Mark Pearson <[email protected]>
wifi: ath11k: Add missing platform IDs for quirk table

Loic Poulain <[email protected]>
wifi: ath10k: Fix memory leak on unsupported WMI command

Chang S. Bae <[email protected]>
x86/fpu: Ensure XFD state on signal delivery

Gregory Price <[email protected]>
x86/CPU/AMD: Add RDSEED fix for Zen5

Peter Zijlstra <[email protected]>
x86/build: Disable SSE4a

Henrique Carvalho <[email protected]>
smb: client: fix potential cfid UAF in smb2_query_info_compound

Farhan Ali <[email protected]>
s390/pci: Restore IRQ unconditionally for the zPCI device

Claudiu Beznea <[email protected]>
ASoC: renesas: rz-ssi: Use proper dma_buffer_pos after resume

Srinivas Kandagatla <[email protected]>
ASoC: qdsp6: q6asm: do not sleep while atomic

Paolo Abeni <[email protected]>
mptcp: restore window probe

Paolo Abeni <[email protected]>
mptcp: drop bogus optimization in __mptcp_check_push()

Miaoqian Lin <[email protected]>
fbdev: valkyriefb: Fix reference count leak in valkyriefb_init

Florian Fuchs <[email protected]>
fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS

Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode

Emanuele Ghidoli <[email protected]>
net: phy: dp83867: Disable EEE support as not implemented

Johan Hovold <[email protected]>
Bluetooth: rfcomm: fix modem control handling

Junjie Cao <[email protected]>
fbdev: bitblit: bound-check glyph index in bit_putcs*

Sven Eckelmann <[email protected]>
batman-adv: Release references to inactive interfaces

Bui Quang Minh <[email protected]>
virtio-net: drop the multi-buffer XDP packet in zerocopy

Armin Wolf <[email protected]>
ACPI: fan: Use platform device for devres-related actions

Kaushlendra Kumar <[email protected]>
ACPI: button: Call input_free_device() on failing input device registration

Yuhao Jiang <[email protected]>
ACPI: video: Fix use-after-free in acpi_video_switch_brightness()

Daniel Palmer <[email protected]>

    fbdev: atyfb: Check if pll_ops->init_pll failed

Quanmin Yan <[email protected]>

    fbcon: Set fb_display[i]->mode to NULL when the mode is released

Miaoqian Lin <[email protected]>
net: usb: asix_devices: Check return value of usbnet_get_endpoints

Chuck Lever <[email protected]>
Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"

Chuck Lever <[email protected]>
NFSD: Fix crash in nfsd4_read_release()

Chuck Lever <[email protected]>
NFSD: Define actions for the new time_deleg FATTR4 attributes

Tejun Heo <[email protected]>
sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU

Frédéric Danis <[email protected]>
Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()"

-------------

Diffstat:

 .../devicetree/bindings/display/msm/gmu.yaml       |  34 ++
 Documentation/netlink/specs/dpll.yaml              |   2 +
 Documentation/netlink/specs/fou.yaml               |   4 +-
 Makefile                                           |   4 +-
 arch/arc/include/asm/bitops.h                      |   2 +
 arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts    |   5 +-
 arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts       |   4 +-
 arch/arm/mach-at91/pm_suspend.S                    |   8 +-
 arch/arm64/boot/dts/xilinx/versal-net.dtsi         |   2 +-
 arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts  |   4 +-
 arch/arm64/boot/dts/xilinx/zynqmp.dtsi             |   4 +
 arch/loongarch/include/asm/inst.h                  |   5 +
 arch/loongarch/kernel/inst.c                       |  12 +
 arch/mips/boot/dts/lantiq/danube.dtsi              |   6 +
 arch/mips/boot/dts/lantiq/danube_easy50712.dts     |   4 +-
 arch/mips/lantiq/xway/sysctrl.c                    |   2 +-
 arch/mips/sgi-ip22/ip22-platform.c                 |  32 ++
 arch/openrisc/kernel/module.c                      |   4 +
 arch/parisc/include/asm/video.h                    |   2 +-
 arch/parisc/kernel/unwind.c                        |  13 +-
 arch/powerpc/kernel/eeh_driver.c                   |   2 +-
 arch/riscv/kernel/module-sections.c                |   8 +-
 arch/riscv/kernel/stacktrace.c                     |  21 +-
 arch/riscv/mm/ptdump.c                             |   2 +-
 arch/riscv/net/bpf_jit_comp64.c                    |   5 +-
 arch/s390/Kconfig                                  |   1 -
 arch/s390/crypto/phmac_s390.c                      |  52 ++-
 arch/s390/include/asm/pci.h                        |   1 -
 arch/s390/mm/dump_pagetables.c                     |  19 +-
 arch/s390/pci/pci_event.c                          |   7 +-
 arch/s390/pci/pci_irq.c                            |   9 +-
 arch/sparc/include/asm/elf_64.h                    |   1 +
 arch/sparc/include/asm/io_64.h                     |   6 +-
 arch/sparc/include/asm/video.h                     |   2 +
 arch/sparc/kernel/module.c                         |   1 +
 arch/um/drivers/ssl.c                              |   5 +-
 arch/x86/Makefile                                  |   2 +-
 arch/x86/entry/vsyscall/vsyscall_64.c              |  17 +-
 arch/x86/events/intel/ds.c                         |   3 +-
 arch/x86/include/asm/amd/node.h                    |   1 -
 arch/x86/include/asm/runtime-const.h               |   4 +
 arch/x86/include/asm/tdx.h                         |   2 +
 arch/x86/include/asm/uaccess_64.h                  |  10 +-
 arch/x86/include/asm/video.h                       |   2 +
 arch/x86/kernel/amd_node.c                         | 150 +++----
 arch/x86/kernel/cpu/amd.c                          |  11 +
 arch/x86/kernel/cpu/common.c                       |   6 +-
 arch/x86/kernel/cpu/microcode/amd.c                |   2 +
 arch/x86/kernel/cpu/mshyperv.c                     |  11 +-
 arch/x86/kernel/fpu/core.c                         |   3 +
 arch/x86/kernel/kvm.c                              |  20 +-
 arch/x86/kvm/vmx/tdx.c                             |   9 +
 arch/x86/net/bpf_jit_comp.c                        |   2 +-
 arch/x86/video/video-common.c                      |  25 +-
 arch/x86/virt/vmx/tdx/tdx.c                        |  21 +-
 block/blk-cgroup.c                                 |  23 +-
 block/blk-map.c                                    |   2 +-
 block/blk-merge.c                                  |  21 +-
 drivers/accel/amdxdna/aie2_ctx.c                   |  59 +--
 drivers/accel/amdxdna/aie2_pci.c                   |  37 +-
 drivers/accel/amdxdna/aie2_pci.h                   |   5 +-
 drivers/accel/amdxdna/amdxdna_ctx.c                |  26 --
 drivers/accel/amdxdna/amdxdna_ctx.h                |   2 -
 drivers/accel/amdxdna/amdxdna_pci_drv.c            |  74 +---
 drivers/accel/amdxdna/amdxdna_pci_drv.h            |   4 +-
 drivers/accel/habanalabs/common/memory.c           |   2 +-
 drivers/accel/habanalabs/gaudi/gaudi.c             |  19 +
 drivers/accel/habanalabs/gaudi2/gaudi2.c           |  15 +-
 drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c |   2 +-
 drivers/acpi/acpi_mrrm.c                           |   3 +
 drivers/acpi/acpi_video.c                          |   4 +-
 drivers/acpi/acpica/dsmethod.c                     |  10 +-
 drivers/acpi/button.c                              |   4 +-
 drivers/acpi/device_sysfs.c                        |   2 +-
 drivers/acpi/fan.h                                 |   7 +-
 drivers/acpi/fan_attr.c                            |   2 +-
 drivers/acpi/fan_core.c                            |  36 +-
 drivers/acpi/fan_hwmon.c                           |  11 +-
 drivers/acpi/prmt.c                                |  19 +-
 drivers/acpi/property.c                            |  24 +-
 drivers/acpi/resource.c                            |   7 +
 drivers/acpi/scan.c                                |   4 +
 drivers/acpi/spcr.c                                |  10 +-
 drivers/acpi/video_detect.c                        |   8 +
 drivers/base/regmap/regmap-slimbus.c               |   6 +-
 drivers/bluetooth/btintel.c                        |   3 +
 drivers/bluetooth/btintel_pcie.c                   |  20 +-
 drivers/bluetooth/btmtksdio.c                      |  12 +
 drivers/bluetooth/btrtl.c                          |   4 +-
 drivers/bluetooth/btusb.c                          |  21 +
 drivers/bluetooth/hci_bcsp.c                       |   3 +
 drivers/bus/mhi/host/internal.h                    |   2 +
 drivers/bus/mhi/host/pci_generic.c                 |  16 +-
 drivers/bus/mhi/host/pm.c                          |   2 +-
 drivers/char/hw_random/timeriomem-rng.c            |   2 +-
 drivers/char/misc.c                                |  12 +-
 drivers/clk/at91/clk-master.c                      |   3 +
 drivers/clk/at91/clk-sam9x60-pll.c                 |  75 ++--
 drivers/clk/at91/pmc.h                             |   1 +
 drivers/clk/at91/sam9x60.c                         |   2 +
 drivers/clk/at91/sam9x7.c                          |   6 +
 drivers/clk/at91/sama7d65.c                        |   4 +
 drivers/clk/at91/sama7g5.c                         |   2 +
 drivers/clk/clk-scmi.c                             |  11 +-
 drivers/clk/qcom/gcc-ipq6018.c                     |  60 +--
 drivers/clk/renesas/rzv2h-cpg.c                    |  13 +-
 drivers/clk/samsung/clk-exynos990.c                |   2 +
 drivers/clk/sunxi-ng/ccu-sun6i-rtc.c               |  11 +
 drivers/clk/thead/clk-th1520-ap.c                  |  44 +--
 drivers/clk/ti/clk-33xx.c                          |   2 +
 drivers/clk/xilinx/clk-xlnx-clock-wizard.c         |   2 +-
 drivers/clocksource/hyperv_timer.c                 |  10 +-
 drivers/clocksource/timer-rtl-otto.c               |  26 +-
 drivers/clocksource/timer-vf-pit.c                 |  22 +-
 drivers/cpufreq/cpufreq_ondemand.c                 |  25 +-
 drivers/cpufreq/cpufreq_ondemand.h                 |  23 ++
 drivers/cpufreq/longhaul.c                         |   3 +
 drivers/cpufreq/tegra186-cpufreq.c                 |  27 +-
 drivers/cpufreq/ti-cpufreq.c                       |   2 +
 drivers/cpuidle/cpuidle.c                          |   8 +-
 drivers/cpuidle/governors/menu.c                   |  79 ++--
 .../crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c    |   1 -
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c  |   5 +-
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c  |   2 -
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c  |   1 -
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c  |   1 -
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h       |   2 +-
 drivers/crypto/aspeed/aspeed-acry.c                |   2 -
 drivers/crypto/caam/ctrl.c                         |   4 +-
 drivers/crypto/ccp/hsti.c                          |   2 +-
 drivers/crypto/ccp/sev-dev.c                       |  10 +
 drivers/crypto/hisilicon/qm.c                      |  78 ++--
 drivers/crypto/intel/qat/qat_common/qat_uclo.c     |   2 +-
 drivers/dma-buf/dma-fence.c                        |   2 +-
 drivers/dma/dw-edma/dw-edma-core.c                 |  22 ++
 drivers/dma/idxd/init.c                            |   2 +
 drivers/dma/idxd/registers.h                       |   1 +
 drivers/dma/mv_xor.c                               |   4 +-
 drivers/dma/sh/shdma-base.c                        |  25 +-
 drivers/dma/sh/shdmac.c                            |  17 +-
 drivers/extcon/extcon-adc-jack.c                   |   2 +
 drivers/extcon/extcon-axp288.c                     |   2 +-
 drivers/extcon/extcon-fsa9480.c                    |   2 +-
 drivers/firewire/ohci.c                            |  12 +-
 drivers/firmware/qcom/qcom_scm.c                   |   4 +-
 drivers/firmware/qcom/qcom_tzmem.c                 |   1 +
 drivers/firmware/ti_sci.c                          |  57 ++-
 drivers/firmware/ti_sci.h                          |   3 +
 drivers/gpio/gpiolib-swnode.c                      |   2 +-
 drivers/gpio/gpiolib.c                             |   8 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c            |  53 ++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c   |  19 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c     |  66 +++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c           |  14 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cper.h           |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |  21 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |  68 ++--
 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c      |   5 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |  14 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c           |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c            | 127 +++---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h            |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c     |   5 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c            |   1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c          | 123 ++++--
 drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h          |   2 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c    |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h           |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vpe.c            |  40 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c            |   1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h           |   4 +
 drivers/gpu/drm/amd/amdgpu/atom.c                  |   4 +
 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c            |  12 +
 drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c           |  20 +-
 drivers/gpu/drm/amd/amdgpu/mes_userqueue.c         |  23 +-
 drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c              |  32 +-
 drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c              |  35 +-
 drivers/gpu/drm/amd/amdgpu/soc15.c                 |   1 -
 drivers/gpu/drm/amd/amdgpu/umc_v12_0.c             |   5 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c              |  10 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c              |  10 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c              |  10 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c              |  10 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c            |  11 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c            |  10 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c            |  10 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c            |  20 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |  19 +-
 drivers/gpu/drm/amd/amdkfd/kfd_device.c            |  20 +-
 drivers/gpu/drm/amd/amdkfd/kfd_priv.h              |  11 +-
 drivers/gpu/drm/amd/amdkfd/kfd_process.c           |   4 +
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c               |  25 ++
 drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c        |  56 ++-
 drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h        |   1 +
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  | 183 +++++++--
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h  |  17 +
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c    |  86 ++--
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c |  34 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  |   3 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c  |   1 +
 .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c    |  13 +-
 .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.h    |   2 +-
 .../amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c    |   3 +
 .../amd/display/dc/clk_mgr/dce60/dce60_clk_mgr.c   |   5 +
 .../drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c |  16 +
 .../amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c | 142 ++++++-
 .../amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h |   5 +
 drivers/gpu/drm/amd/display/dc/core/dc.c           |  27 +-
 .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c  |   2 +
 drivers/gpu/drm/amd/display/dc/core/dc_resource.c  |  14 +-
 drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c       |   4 +-
 drivers/gpu/drm/amd/display/dc/dc_helper.c         |   5 +
 drivers/gpu/drm/amd/display/dc/dc_stream.h         |   3 +
 .../drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c   |   2 +-
 drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c   |   1 +
 drivers/gpu/drm/amd/display/dc/dm_services.h       |   2 +
 .../gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c |  20 +-
 .../drm/amd/display/dc/dml2/display_mode_core.c    |   2 +-
 .../drm/amd/display/dc/dml2/dml21/dml21_wrapper.c  |   4 +
 .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c     |  28 +-
 .../gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c   |   3 -
 drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c        |   5 +
 .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c  |   1 +
 .../drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c    |  73 ++--
 .../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c    |   5 +-
 .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c  |   2 +
 .../drm/amd/display/dc/inc/hw/timing_generator.h   |   1 +
 .../amd/display/dc/link/accessories/link_dp_cts.c  |  18 +-
 .../gpu/drm/amd/display/dc/link/link_detection.c   |   5 +
 drivers/gpu/drm/amd/display/dc/link/link_dpms.c    |   3 -
 .../gpu/drm/amd/display/dc/link/link_validation.c  |   6 +-
 .../display/dc/link/protocols/link_dp_dpia_bw.c    |  58 ++-
 .../display/dc/link/protocols/link_dp_training.c   |   9 +-
 .../gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.h |   1 +
 .../gpu/drm/amd/display/dc/optc/dcn35/dcn35_optc.c |  18 +
 .../drm/amd/display/dc/optc/dcn401/dcn401_optc.c   |   5 +
 .../display/dc/resource/dce100/dce100_resource.c   |  10 +-
 .../amd/display/dc/resource/dce60/dce60_resource.c |  21 +-
 .../amd/display/dc/resource/dce80/dce80_resource.c |  10 +-
 .../display/dc/resource/dcn314/dcn314_resource.c   |   1 +
 .../display/dc/virtual/virtual_stream_encoder.c    |   7 +
 drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h    |  18 +-
 drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c  |  53 +--
 drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.h  |   8 +-
 drivers/gpu/drm/amd/display/include/dal_asic_id.h  |   5 +
 drivers/gpu/drm/amd/include/amd_cper.h             |   2 +-
 .../drm/amd/include/ivsrcid/vcn/irqsrcs_vcn_5_0.h  |   2 +-
 drivers/gpu/drm/amd/pm/amdgpu_pm.c                 |   5 +-
 drivers/gpu/drm/amd/pm/legacy-dpm/si_smc.c         |  26 +-
 .../gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c  |   2 +-
 .../drm/amd/pm/powerplay/smumgr/iceland_smumgr.c   |   2 +-
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c          |   6 +
 drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c  |   2 +-
 drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c   |   3 +
 drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c |   2 +-
 drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c             |   2 +-
 drivers/gpu/drm/ast/ast_drv.h                      |   8 +-
 drivers/gpu/drm/bridge/adv7511/adv7511_audio.c     |  23 +-
 drivers/gpu/drm/bridge/adv7511/adv7511_drv.c       |  18 +
 drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c     |  12 +-
 drivers/gpu/drm/bridge/display-connector.c         |   3 +-
 drivers/gpu/drm/drm_gem_atomic_helper.c            |   8 +-
 drivers/gpu/drm/drm_gpusvm.c                       |  33 +-
 drivers/gpu/drm/drm_panel_backlight_quirks.c       |   2 +-
 drivers/gpu/drm/etnaviv/etnaviv_buffer.c           |   2 +-
 drivers/gpu/drm/i915/display/intel_dmc.c           |  55 ++-
 drivers/gpu/drm/mediatek/mtk_drm_drv.c             |  10 -
 drivers/gpu/drm/mediatek/mtk_plane.c               |  24 +-
 drivers/gpu/drm/msm/adreno/a6xx_catalog.c          |  10 +
 drivers/gpu/drm/msm/adreno/a6xx_gmu.c              |   5 +-
 drivers/gpu/drm/msm/adreno/a6xx_gpu.c              | 113 +++++-
 drivers/gpu/drm/msm/adreno/a6xx_gpu.h              |   1 +
 drivers/gpu/drm/msm/adreno/a6xx_preempt.c          |  20 +-
 drivers/gpu/drm/msm/adreno/adreno_gpu.c            |  17 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c      |  35 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h      |   3 +
 drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c           |  15 +
 drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c          |  10 +
 drivers/gpu/drm/msm/msm_gem.c                      |  31 +-
 drivers/gpu/drm/msm/msm_gem.h                      |   6 +-
 drivers/gpu/drm/msm/msm_gem_prime.c                |   2 +-
 drivers/gpu/drm/msm/msm_gem_submit.c               |   9 +-
 drivers/gpu/drm/msm/msm_gem_vma.c                  |   2 +-
 drivers/gpu/drm/msm/registers/gen_header.py        |   7 +
 drivers/gpu/drm/nouveau/dispnv50/disp.c            |   4 +-
 drivers/gpu/drm/nouveau/dispnv50/disp.h            |   1 +
 drivers/gpu/drm/nouveau/dispnv50/wndw.c            |  24 +-
 drivers/gpu/drm/nouveau/dispnv50/wndwca7e.c        |  33 ++
 drivers/gpu/drm/nouveau/nouveau_sched.c            |  14 +-
 drivers/gpu/drm/nouveau/nvkm/core/enum.c           |   2 +-
 .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c  |   3 +
 drivers/gpu/drm/panel/panel-edp.c                  |   1 +
 drivers/gpu/drm/panel/panel-ilitek-ili9881c.c      |  31 +-
 drivers/gpu/drm/panthor/panthor_gpu.c              |   7 +
 drivers/gpu/drm/panthor/panthor_mmu.c              |   4 +-
 drivers/gpu/drm/radeon/radeon_drv.c                |  25 +-
 drivers/gpu/drm/radeon/radeon_kms.c                |   1 -
 drivers/gpu/drm/scheduler/sched_entity.c           |  40 +-
 drivers/gpu/drm/sitronix/st7571-i2c.c              |   7 +-
 drivers/gpu/drm/tidss/tidss_crtc.c                 |   7 +-
 drivers/gpu/drm/tidss/tidss_dispc.c                |  16 +-
 drivers/gpu/drm/tidss/tidss_drv.c                  |   9 +
 drivers/gpu/drm/tiny/sharp-memory.c                |  27 +-
 drivers/gpu/drm/xe/abi/guc_errors_abi.h            |   3 +
 drivers/gpu/drm/xe/abi/guc_klvs_abi.h              |   1 +
 drivers/gpu/drm/xe/xe_bo.c                         |  41 +-
 drivers/gpu/drm/xe/xe_configfs.c                   |   9 +-
 drivers/gpu/drm/xe/xe_device.c                     |  12 +-
 drivers/gpu/drm/xe/xe_device_sysfs.c               |   8 +-
 drivers/gpu/drm/xe/xe_gt.c                         |  21 +-
 drivers/gpu/drm/xe/xe_gt_sriov_pf.c                |  24 +-
 drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c        |  12 +
 drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h        |   1 +
 drivers/gpu/drm/xe/xe_guc.c                        |  40 +-
 drivers/gpu/drm/xe/xe_guc_ads.c                    |  35 ++
 drivers/gpu/drm/xe/xe_guc_ct.c                     |  50 ++-
 drivers/gpu/drm/xe/xe_guc_ct.h                     |   1 +
 drivers/gpu/drm/xe/xe_guc_log.h                    |   2 +-
 drivers/gpu/drm/xe/xe_hwmon.c                      |   8 +-
 drivers/gpu/drm/xe/xe_i2c.c                        |   2 +-
 drivers/gpu/drm/xe/xe_lmtt.c                       |   9 +-
 drivers/gpu/drm/xe/xe_migrate.c                    |  14 +-
 drivers/gpu/drm/xe/xe_pm.c                         |   8 +-
 drivers/gpu/drm/xe/xe_pt.c                         |   4 +-
 drivers/gpu/drm/xe/xe_pt_types.h                   |   3 +-
 drivers/gpu/drm/xe/xe_vm.c                         |  34 +-
 drivers/gpu/drm/xe/xe_vram_freq.c                  |   4 +-
 drivers/gpu/drm/xe/xe_wa.c                         |  17 +-
 drivers/gpu/drm/xe/xe_wa_oob.rules                 |   3 +-
 drivers/gpu/nova-core/regs.rs                      |   5 +-
 drivers/gpu/nova-core/regs/macros.rs               |   2 +-
 drivers/hid/hid-asus.c                             |   6 +-
 drivers/hid/hid-ids.h                              |   2 +-
 drivers/hid/hid-universal-pidff.c                  |  20 +-
 drivers/hid/i2c-hid/i2c-hid-acpi.c                 |   8 +
 drivers/hid/i2c-hid/i2c-hid-core.c                 |  28 +-
 drivers/hid/i2c-hid/i2c-hid.h                      |   2 +
 drivers/hid/usbhid/hid-pidff.c                     |  42 +-
 drivers/hid/usbhid/hid-pidff.h                     |   2 +-
 drivers/hwmon/asus-ec-sensors.c                    |   2 +-
 drivers/hwmon/dell-smm-hwmon.c                     |  21 +-
 drivers/hwmon/k10temp.c                            |  10 +
 drivers/hwmon/lenovo-ec-sensors.c                  |  34 +-
 drivers/hwmon/sbtsi_temp.c                         |  46 ++-
 drivers/hwmon/sy7636a-hwmon.c                      |   1 +
 drivers/i3c/master/dw-i3c-master.c                 |  23 ++
 drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c |   3 +
 drivers/iio/adc/ad7124.c                           |  62 ++-
 drivers/iio/adc/imx93_adc.c                        |  18 +-
 drivers/iio/adc/spear_adc.c                        |   9 +-
 drivers/iio/imu/bmi270/bmi270_i2c.c                |   2 +
 drivers/infiniband/core/uverbs_std_types_cq.c      |   1 +
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |  11 +-
 drivers/infiniband/hw/efa/efa_verbs.c              |  16 +-
 drivers/infiniband/hw/hns/hns_roce_cq.c            |  58 ++-
 drivers/infiniband/hw/hns/hns_roce_device.h        |   4 +
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |  11 +-
 drivers/infiniband/hw/hns/hns_roce_main.c          |   4 +
 drivers/infiniband/hw/hns/hns_roce_qp.c            |   2 -
 drivers/infiniband/hw/irdma/Kconfig                |   7 +-
 drivers/infiniband/hw/irdma/pble.c                 |   2 +-
 drivers/infiniband/hw/irdma/verbs.c                |   4 +-
 drivers/infiniband/hw/irdma/verbs.h                |   8 +-
 drivers/infiniband/hw/mana/cq.c                    |  26 ++
 drivers/infiniband/hw/mana/device.c                |   3 +
 drivers/infiniband/hw/mana/mana_ib.h               |   3 +
 drivers/infiniband/ulp/ipoib/ipoib_main.c          |  21 +-
 drivers/iommu/amd/amd_iommu_types.h                |   5 +
 drivers/iommu/amd/init.c                           | 284 +++++++++-----
 drivers/iommu/amd/iommu.c                          |   2 +-
 drivers/iommu/apple-dart.c                         |   5 +
 drivers/iommu/intel/debugfs.c                      |  10 +-
 drivers/iommu/intel/iommu.h                        |   1 -
 drivers/iommu/intel/perf.c                         |  10 +-
 drivers/iommu/intel/perf.h                         |   5 +-
 drivers/iommu/intel/prq.c                          |   7 +-
 drivers/iommu/iommufd/iova_bitmap.c                |   5 +-
 drivers/irqchip/irq-gic-v2m.c                      |  13 +-
 drivers/irqchip/irq-loongson-eiointc.c             |  21 +-
 drivers/irqchip/irq-loongson-pch-lpc.c             |   9 +-
 drivers/irqchip/irq-sifive-plic.c                  |   6 +-
 drivers/md/dm-target.c                             |   3 +-
 drivers/media/common/videobuf2/videobuf2-v4l2.c    |   5 +
 drivers/media/i2c/Kconfig                          |   2 +-
 drivers/media/i2c/adv7180.c                        |  48 +--
 drivers/media/i2c/ir-kbd-i2c.c                     |   6 +-
 drivers/media/i2c/og01a1b.c                        |   6 +-
 drivers/media/i2c/ov08x40.c                        |   2 +-
 drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c    |   6 +
 drivers/media/pci/ivtv/ivtv-alsa-pcm.c             |   2 -
 drivers/media/pci/ivtv/ivtv-driver.h               |   3 +-
 drivers/media/pci/ivtv/ivtv-fileops.c              |  18 +-
 drivers/media/pci/ivtv/ivtv-irq.c                  |   4 +-
 drivers/media/pci/mgb4/mgb4_vin.c                  |   3 +-
 drivers/media/platform/amphion/vpu_v4l2.c          |   7 +-
 drivers/media/platform/nxp/imx-mipi-csis.c         |  23 +-
 .../media/platform/nxp/imx8-isi/imx8-isi-video.c   | 156 +++-----
 .../platform/qcom/camss/camss-csiphy-3ph-1-0.c     |  89 +++++
 drivers/media/platform/qcom/camss/camss.h          |   1 +
 drivers/media/platform/verisilicon/hantro_drv.c    |   2 +
 drivers/media/platform/verisilicon/hantro_v4l2.c   |   6 +-
 drivers/media/rc/imon.c                            |  61 +--
 drivers/media/rc/redrat3.c                         |   2 +-
 drivers/media/tuners/xc4000.c                      |   8 +-
 drivers/media/tuners/xc5000.c                      |  12 +-
 drivers/media/usb/uvc/uvc_driver.c                 |  15 +-
 drivers/memstick/core/memstick.c                   |   8 +-
 drivers/mfd/cs42l43.c                              |   8 +-
 drivers/mfd/da9063-i2c.c                           |  27 +-
 drivers/mfd/intel-lpss-pci.c                       |  13 +
 drivers/mfd/kempld-core.c                          |  32 +-
 drivers/mfd/macsmc.c                               |   1 +
 drivers/mfd/madera-core.c                          |   4 +-
 drivers/mfd/mfd-core.c                             |   1 +
 drivers/mfd/qnap-mcu.c                             |   6 +-
 drivers/mfd/simple-mfd-i2c.c                       |   2 +
 drivers/mfd/stmpe-i2c.c                            |   1 +
 drivers/mfd/stmpe.c                                |   3 +
 drivers/misc/eeprom/at25.c                         |  67 ++--
 drivers/misc/mei/main.c                            |  18 +-
 drivers/misc/pci_endpoint_test.c                   |  12 +-
 drivers/mmc/host/renesas_sdhi_core.c               |   6 +-
 drivers/mmc/host/sdhci-msm.c                       |  15 +
 drivers/mmc/host/sdhci-pci-core.c                  |  15 +-
 drivers/net/can/rcar/rcar_canfd.c                  |   5 +-
 drivers/net/dsa/b53/b53_common.c                   |  36 +-
 drivers/net/dsa/b53/b53_regs.h                     |   3 +-
 drivers/net/dsa/dsa_loop.c                         |   9 +-
 drivers/net/dsa/microchip/ksz9477.c                |  98 ++++-
 drivers/net/dsa/microchip/ksz9477_reg.h            |   3 +-
 drivers/net/dsa/microchip/ksz_common.c             |  49 +++
 drivers/net/dsa/microchip/ksz_common.h             |   2 +
 drivers/net/dsa/ocelot/felix.c                     |   4 +
 drivers/net/dsa/ocelot/felix.h                     |   3 +-
 drivers/net/dsa/ocelot/felix_vsc9959.c             |   3 +-
 drivers/net/ethernet/broadcom/bnge/bnge_rmem.c     |   9 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |  20 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.h          |   7 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c |   8 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.h |   1 +
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c  |   2 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c      |   4 +-
 drivers/net/ethernet/cadence/macb_main.c           |   4 +-
 drivers/net/ethernet/google/gve/gve_ptp.c          |  15 +
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    |   3 +-
 .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c    |   9 +-
 .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h    |   2 +-
 drivers/net/ethernet/huawei/hinic3/hinic3_irq.c    |   2 +-
 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h |  15 +-
 drivers/net/ethernet/huawei/hinic3/hinic3_rx.c     |  10 +-
 drivers/net/ethernet/huawei/hinic3/hinic3_rx.h     |  24 +-
 drivers/net/ethernet/huawei/hinic3/hinic3_tx.c     |  81 ++--
 drivers/net/ethernet/huawei/hinic3/hinic3_tx.h     |  18 +-
 drivers/net/ethernet/intel/fm10k/fm10k_common.c    |   5 +-
 drivers/net/ethernet/intel/fm10k/fm10k_common.h    |   2 +-
 drivers/net/ethernet/intel/fm10k/fm10k_pf.c        |   2 +-
 drivers/net/ethernet/intel/fm10k/fm10k_vf.c        |   2 +-
 drivers/net/ethernet/intel/ice/ice_main.c          |   2 +-
 drivers/net/ethernet/intel/ice/ice_trace.h         |  10 +-
 drivers/net/ethernet/intel/idpf/idpf.h             |   2 +
 drivers/net/ethernet/intel/idpf/idpf_lib.c         | 140 ++++++-
 drivers/net/ethernet/intel/idpf/idpf_txrx.c        | 146 ++-----
 drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c      |  59 ++-
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c    |   3 +
 drivers/net/ethernet/marvell/octeontx2/af/rvu.h    |   1 +
 .../net/ethernet/marvell/octeontx2/af/rvu_nix.c    |  16 +
 .../ethernet/marvell/octeontx2/nic/otx2_common.c   |   6 +-
 drivers/net/ethernet/mellanox/mlx5/core/en.h       |   3 +
 .../net/ethernet/mellanox/mlx5/core/en_ethtool.c   |   4 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |  24 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c    |  72 ++--
 drivers/net/ethernet/mellanox/mlx5/core/en_stats.c |  12 +-
 .../ethernet/mellanox/mlx5/core/eswitch_offloads.c |  33 ++
 drivers/net/ethernet/meta/fbnic/fbnic_pci.c        |   2 +
 drivers/net/ethernet/microchip/lan865x/lan865x.c   |   1 +
 .../ethernet/microchip/lan966x/lan966x_ethtool.c   |  18 +-
 .../net/ethernet/microchip/lan966x/lan966x_main.c  |   2 -
 .../net/ethernet/microchip/lan966x/lan966x_main.h  |   4 +-
 .../ethernet/microchip/lan966x/lan966x_vcap_impl.c |   8 +-
 drivers/net/ethernet/microchip/sparx5/Kconfig      |   2 +-
 drivers/net/ethernet/microsoft/mana/hw_channel.c   |   7 +-
 .../net/ethernet/pensando/ionic/ionic_ethtool.c    |   2 +-
 drivers/net/ethernet/pensando/ionic/ionic_txrx.c   |  34 +-
 .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c    |   1 -
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c   |   2 -
 drivers/net/ethernet/realtek/Kconfig               |   2 +-
 drivers/net/ethernet/realtek/r8169_main.c          |   6 +-
 drivers/net/ethernet/renesas/sh_eth.c              |   4 +
 drivers/net/ethernet/sfc/mae.c                     |   4 +
 drivers/net/ethernet/smsc/smsc911x.c               |  14 +-
 drivers/net/ethernet/stmicro/stmmac/common.h       |   1 +
 drivers/net/ethernet/stmicro/stmmac/stmmac_est.c   |   9 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_est.h   |   1 +
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |  12 +-
 drivers/net/ethernet/ti/icssg/icssg_config.c       |   7 +
 drivers/net/ethernet/wangxun/libwx/wx_ethtool.c    |   7 +-
 drivers/net/ethernet/wangxun/libwx/wx_hw.c         |   3 +-
 drivers/net/ethernet/wangxun/libwx/wx_type.h       |   4 +-
 drivers/net/hamradio/6pack.c                       |  57 +--
 drivers/net/mdio/mdio-airoha.c                     |   2 +
 drivers/net/mdio/of_mdio.c                         |   1 -
 drivers/net/netconsole.c                           |  10 +
 drivers/net/phy/dp83640.c                          |  58 +--
 drivers/net/phy/dp83867.c                          |   6 +
 drivers/net/phy/fixed_phy.c                        |   1 +
 drivers/net/phy/marvell.c                          |  39 +-
 drivers/net/phy/mscc/mscc.h                        |   3 +
 drivers/net/phy/mscc/mscc_main.c                   |  40 ++
 drivers/net/phy/phy.c                              |  15 +
 drivers/net/usb/asix_devices.c                     |  12 +-
 drivers/net/usb/qmi_wwan.c                         |   6 +
 drivers/net/usb/usbnet.c                           |   2 +
 drivers/net/virtio_net.c                           |  51 ++-
 drivers/net/wan/framer/pef2256/pef2256.c           |   7 +-
 drivers/net/wireless/ath/ath10k/mac.c              |  12 +-
 drivers/net/wireless/ath/ath10k/wmi.c              |  40 +-
 drivers/net/wireless/ath/ath11k/core.c             |  54 ++-
 drivers/net/wireless/ath/ath11k/mac.c              |  10 +-
 drivers/net/wireless/ath/ath12k/dp.h               |   2 +-
 drivers/net/wireless/ath/ath12k/mac.c              | 156 ++++----
 .../broadcom/brcm80211/brcmfmac/cfg80211.c         |   3 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c |  28 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.h |   3 +-
 drivers/net/wireless/intel/iwlwifi/fw/regulatory.c |  14 +-
 drivers/net/wireless/intel/iwlwifi/mld/link.c      |  12 +-
 drivers/net/wireless/intel/iwlwifi/mld/stats.c     |  11 +-
 .../wireless/intel/iwlwifi/pcie/gen1_2/internal.h  |   3 +
 drivers/net/wireless/mediatek/mt76/eeprom.c        |   9 +-
 drivers/net/wireless/mediatek/mt76/mac80211.c      |   2 +
 drivers/net/wireless/mediatek/mt76/mt76.h          |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c |   3 +-
 drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7615/init.c   |   5 +-
 .../net/wireless/mediatek/mt76/mt76_connac3_mac.h  |   7 +
 drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c |   6 +-
 drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7915/init.c   |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7921/init.c   |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7921/main.c   |   2 +
 drivers/net/wireless/mediatek/mt76/mt7925/init.c   |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7925/pci.c    |  26 +-
 drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c |   3 +-
 drivers/net/wireless/mediatek/mt76/mt7996/init.c   |   6 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mac.c    | 116 ++++--
 drivers/net/wireless/mediatek/mt76/mt7996/main.c   |   1 +
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c    |   4 +-
 drivers/net/wireless/mediatek/mt76/tx.c            |   3 +-
 drivers/net/wireless/realtek/rtw88/sdio.c          |   4 +
 drivers/net/wireless/realtek/rtw89/coex.c          |   5 +-
 drivers/net/wireless/realtek/rtw89/core.c          |  61 ++-
 drivers/net/wireless/realtek/rtw89/core.h          |  12 +-
 drivers/net/wireless/realtek/rtw89/debug.h         |   1 +
 drivers/net/wireless/realtek/rtw89/fw.c            |   4 +-
 drivers/net/wireless/realtek/rtw89/mac.c           |  20 +-
 drivers/net/wireless/realtek/rtw89/mac.h           |   1 +
 drivers/net/wireless/realtek/rtw89/phy.c           |   9 +-
 drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c  |  85 ++--
 drivers/net/wireless/realtek/rtw89/rtw8851bu.c     |   3 +
 drivers/net/wireless/realtek/rtw89/rtw8852bu.c     |   2 +
 drivers/net/wireless/realtek/rtw89/txrx.h          |   1 +
 drivers/net/wireless/virtual/mac80211_hwsim.c      |   7 +-
 drivers/net/wwan/t7xx/t7xx_pci.c                   |   1 +
 drivers/ntb/hw/epf/ntb_hw_epf.c                    | 103 ++---
 drivers/nvme/host/core.c                           |   8 +-
 drivers/nvme/host/fc.c                             |  10 +-
 drivers/nvme/target/auth.c                         |   5 +-
 drivers/nvme/target/fc.c                           |  16 +-
 drivers/pci/controller/cadence/pcie-cadence-host.c |   2 +-
 drivers/pci/controller/cadence/pcie-cadence.c      |   4 +-
 drivers/pci/controller/cadence/pcie-cadence.h      |   6 +-
 drivers/pci/controller/dwc/pci-imx6.c              |   4 +
 drivers/pci/controller/dwc/pcie-designware.c       |   4 +-
 drivers/pci/endpoint/functions/pci-epf-test.c      |   7 +-
 drivers/pci/p2pdma.c                               |   2 +-
 drivers/pci/pci-driver.c                           |   2 +-
 drivers/pci/pci.c                                  |   5 +
 drivers/pci/pcie/aer.c                             |   4 +
 drivers/pci/pcie/err.c                             |   3 +-
 drivers/pci/quirks.c                               |   3 +-
 drivers/phy/cadence/cdns-dphy.c                    |   4 +-
 drivers/phy/renesas/r8a779f0-ether-serdes.c        |  28 ++
 drivers/phy/rockchip/phy-rockchip-inno-csidphy.c   |   5 +-
 drivers/pinctrl/pinctrl-keembay.c                  |   7 +-
 drivers/pinctrl/pinctrl-single.c                   |   4 +-
 drivers/pinctrl/renesas/pinctrl-rzg2l.c            |  12 +-
 drivers/platform/x86/amd/pmf/pmf.h                 |  15 +-
 drivers/platform/x86/amd/pmf/spc.c                 |  48 ++-
 .../platform/x86/intel/int3472/clk_and_regulator.c |   5 +-
 .../intel/uncore-frequency/uncore-frequency-tpmi.c |  76 +++-
 drivers/platform/x86/lenovo/think-lmi.c            |  11 +
 drivers/platform/x86/x86-android-tablets/core.c    |   6 +-
 drivers/platform/x86/x86-android-tablets/other.c   |   6 +-
 drivers/pmdomain/apple/pmgr-pwrstate.c             |   1 +
 drivers/power/supply/qcom_battmgr.c                |   8 +-
 drivers/power/supply/sbs-charger.c                 |  16 +-
 drivers/ptp/ptp_clock.c                            |  13 +-
 drivers/ptp/ptp_ocp.c                              |   6 +-
 drivers/pwm/pwm-pca9685.c                          |  46 ++-
 drivers/remoteproc/qcom_q6v5.c                     |   5 +
 drivers/remoteproc/wkup_m3_rproc.c                 |   6 +-
 drivers/rpmsg/rpmsg_char.c                         |   3 +-
 drivers/rtc/rtc-pcf2127.c                          |  19 +-
 drivers/rtc/rtc-rx8025.c                           |   2 +-
 drivers/rtc/rtc-zynqmp.c                           |  19 +
 drivers/scsi/libfc/fc_encode.h                     |   2 +-
 drivers/scsi/lpfc/lpfc_debugfs.h                   |   3 +
 drivers/scsi/lpfc/lpfc_els.c                       |  21 +-
 drivers/scsi/lpfc/lpfc_init.c                      |   7 -
 drivers/scsi/lpfc/lpfc_nportdisc.c                 |  23 +-
 drivers/scsi/lpfc/lpfc_scsi.c                      |  14 +-
 drivers/scsi/lpfc/lpfc_sli.c                       |   3 +-
 drivers/scsi/mpi3mr/mpi3mr_fw.c                    |  13 +
 drivers/scsi/mpi3mr/mpi3mr_os.c                    |  10 +-
 drivers/scsi/mpi3mr/mpi3mr_transport.c             |  11 +-
 drivers/scsi/mpt3sas/mpt3sas_transport.c           |   3 +
 drivers/scsi/pm8001/pm8001_ctl.c                   |  24 +-
 drivers/scsi/pm8001/pm8001_init.c                  |   1 +
 drivers/scsi/pm8001/pm8001_sas.h                   |   4 +
 drivers/scsi/qla2xxx/qla_os.c                      |   5 -
 drivers/scsi/scsi_error.c                          |   4 +-
 drivers/soc/aspeed/aspeed-socinfo.c                |   4 +
 drivers/soc/qcom/smem.c                            |   2 +-
 drivers/soc/tegra/fuse/fuse-tegra30.c              | 122 ++++++
 drivers/soc/ti/k3-socinfo.c                        |  10 +
 drivers/soc/ti/pruss.c                             |   2 +-
 drivers/spi/spi-loopback-test.c                    |  12 +-
 drivers/spi/spi-qpic-snand.c                       |  11 +-
 drivers/spi/spi-rpc-if.c                           |   2 +
 drivers/tee/tee_core.c                             |   2 +-
 drivers/thermal/gov_step_wise.c                    |  15 +-
 drivers/thunderbolt/tb.c                           |   2 +-
 drivers/tty/serdev/core.c                          |  11 +-
 drivers/tty/serial/ip22zilog.c                     | 360 +++++++----------
 drivers/tty/serial/max3100.c                       |   2 +-
 drivers/tty/serial/max310x.c                       |   3 +-
 drivers/tty/serial/qcom_geni_serial.c              |  92 +----
 drivers/tty/vt/vt_ioctl.c                          |   4 +-
 drivers/ufs/core/ufs-mcq.c                         |  11 +
 drivers/ufs/core/ufs-sysfs.c                       |   2 +-
 drivers/ufs/core/ufs-sysfs.h                       |   1 -
 drivers/ufs/core/ufshcd.c                          |  36 +-
 drivers/ufs/host/ufs-exynos.c                      |   8 +
 drivers/ufs/host/ufs-mediatek.c                    | 231 ++++++++---
 drivers/ufs/host/ufs-qcom.c                        |  31 ++
 drivers/ufs/host/ufs-qcom.h                        |   2 +-
 drivers/ufs/host/ufshcd-pci.c                      |  70 +++-
 drivers/usb/cdns3/cdnsp-gadget.c                   |   8 +-
 drivers/usb/gadget/function/f_fs.c                 |   8 +-
 drivers/usb/gadget/function/f_hid.c                |   4 +-
 drivers/usb/gadget/function/f_ncm.c                |   3 +-
 drivers/usb/host/xhci-pci.c                        |  45 ++-
 drivers/usb/host/xhci-plat.c                       |   1 +
 drivers/usb/mon/mon_bin.c                          |  14 +-
 drivers/vfio/pci/nvgrace-gpu/main.c                |   2 +
 drivers/vfio/pci/vfio_pci_intrs.c                  |   7 +
 drivers/vfio/vfio_main.c                           |   2 +-
 drivers/video/backlight/lp855x_bl.c                |   2 +-
 drivers/video/fbdev/aty/atyfb_base.c               |   8 +-
 drivers/video/fbdev/core/bitblit.c                 |  33 +-
 drivers/video/fbdev/core/fb_fillrect.h             |   3 +-
 drivers/video/fbdev/core/fbcon.c                   |  19 +
 drivers/video/fbdev/core/fbmem.c                   |   1 +
 drivers/video/fbdev/pvr2fb.c                       |   2 +-
 drivers/video/fbdev/valkyriefb.c                   |   2 +
 drivers/watchdog/s3c2410_wdt.c                     |  10 +-
 fs/9p/v9fs.c                                       |   9 +-
 fs/btrfs/extent_io.c                               |   8 +
 fs/btrfs/file.c                                    |  10 +
 fs/btrfs/qgroup.c                                  |   4 +-
 fs/ceph/dir.c                                      |   3 +-
 fs/ceph/file.c                                     |   6 +-
 fs/ceph/ioctl.c                                    |  17 +-
 fs/ceph/locks.c                                    |   5 +-
 fs/ceph/mds_client.c                               |   8 +
 fs/ceph/mdsmap.c                                   |  14 +-
 fs/ceph/super.c                                    |  14 -
 fs/ceph/super.h                                    |  14 +
 fs/crypto/inline_crypt.c                           |   3 +-
 fs/exfat/balloc.c                                  |  72 +++-
 fs/exfat/fatent.c                                  |  11 +-
 fs/ext4/fast_commit.c                              |   2 +-
 fs/ext4/xattr.c                                    |   2 +-
 fs/f2fs/extent_cache.c                             |   6 +
 fs/f2fs/node.c                                     |  17 +-
 fs/f2fs/sysfs.c                                    |   9 +-
 fs/fuse/dev.c                                      |   1 +
 fs/fuse/inode.c                                    |  11 +-
 fs/fuse/virtio_fs.c                                |   6 +-
 fs/hpfs/namei.c                                    |  18 +-
 fs/jfs/inode.c                                     |   8 +-
 fs/jfs/jfs_txnmgr.c                                |   9 +-
 fs/namespace.c                                     |  15 +-
 fs/nfs/nfs4proc.c                                  |   6 +-
 fs/nfs/nfs4state.c                                 |   3 +
 fs/nfsd/nfs4proc.c                                 |  21 +-
 fs/nfsd/nfs4state.c                                |   1 +
 fs/nfsd/nfs4xdr.c                                  |  12 +-
 fs/nfsd/nfsd.h                                     |   3 +
 fs/nfsd/xdr4.h                                     |   1 +
 fs/ntfs3/inode.c                                   |   1 +
 fs/open.c                                          |  10 +-
 fs/orangefs/xattr.c                                |  12 +-
 fs/overlayfs/dir.c                                 |  22 +-
 fs/smb/client/cached_dir.c                         |  17 +-
 fs/smb/client/smb2ops.c                            |   3 +-
 fs/smb/client/smb2pdu.c                            |   7 +-
 fs/smb/client/transport.c                          |  10 +-
 fs/smb/server/transport_tcp.c                      |   7 +-
 fs/xfs/xfs_iomap.c                                 |  82 +++-
 include/asm-generic/vmlinux.lds.h                  |   2 +-
 include/hyperv/hvhdk_mini.h                        |   1 +
 include/linux/bio.h                                |   4 +-
 include/linux/blk_types.h                          |  11 +-
 include/linux/blkdev.h                             |   7 +
 include/linux/cgroup.h                             |   1 +
 include/linux/f2fs_fs.h                            |   1 +
 include/linux/fbcon.h                              |   2 +
 include/linux/filter.h                             |   2 +-
 include/linux/mfd/qnap-mcu.h                       |   2 +
 include/linux/pci.h                                |   2 +-
 include/linux/platform_data/x86/int3472.h          |   1 -
 include/linux/regmap.h                             |   2 +-
 include/linux/shdma-base.h                         |   2 +-
 include/linux/tnum.h                               |   3 +
 include/linux/virtio_net.h                         |   3 +-
 include/net/bluetooth/hci.h                        |   1 +
 include/net/bluetooth/hci_core.h                   |  11 +-
 include/net/bluetooth/l2cap.h                      |   4 +-
 include/net/bluetooth/mgmt.h                       |   4 +-
 include/net/cfg80211.h                             |  78 ++++
 include/net/cls_cgroup.h                           |   2 +-
 include/net/inet_connection_sock.h                 |   5 +-
 include/net/inet_hashtables.h                      |   2 +
 include/net/inet_timewait_sock.h                   |   3 +-
 include/net/nfc/nci_core.h                         |   2 +-
 include/net/rps.h                                  |   7 +-
 include/net/sock.h                                 |   4 +
 include/net/xdp.h                                  |   5 +
 include/scsi/scsi_device.h                         |  10 +-
 include/sound/tas2781-dsp.h                        |   8 +
 include/uapi/drm/drm_fourcc.h                      |  23 +-
 include/uapi/linux/virtio_net.h                    |   3 +-
 include/ufs/ufs_quirks.h                           |   3 +
 include/ufs/ufshcd.h                               |   9 +
 include/ufs/ufshci.h                               |   4 +-
 io_uring/memmap.c                                  |   2 +-
 io_uring/notif.c                                   |   5 +
 io_uring/rsrc.c                                    |  18 +-
 io_uring/zcrx.c                                    |   9 +-
 kernel/bpf/helpers.c                               |   4 +-
 kernel/bpf/ringbuf.c                               |   2 +
 kernel/bpf/tnum.c                                  |   8 +
 kernel/bpf/verifier.c                              |   4 +
 kernel/cgroup/cgroup.c                             |  24 +-
 kernel/events/core.c                               |  20 +-
 kernel/events/uprobes.c                            |   7 +
 kernel/futex/syscalls.c                            | 106 ++---
 kernel/power/hibernate.c                           |  30 +-
 kernel/power/main.c                                |  22 +-
 kernel/sched/ext.c                                 |   8 +-
 kernel/trace/ftrace.c                              |   2 +
 kernel/trace/ring_buffer.c                         |   4 +
 kernel/trace/trace_events_hist.c                   |   6 +-
 kernel/trace/trace_fprobe.c                        |   7 +-
 lib/crypto/Makefile                                |   2 +-
 lib/kunit/Kconfig                                  |  11 +
 lib/kunit/kunit-test.c                             |   2 +-
 net/8021q/vlan.c                                   |   2 +
 net/9p/trans_fd.c                                  |   9 +-
 net/batman-adv/originator.c                        |  14 +-
 net/bluetooth/hci_conn.c                           |  27 +-
 net/bluetooth/hci_event.c                          |  18 +-
 net/bluetooth/hci_sync.c                           |  23 +-
 net/bluetooth/iso.c                                |  33 +-
 net/bluetooth/l2cap_core.c                         |   4 +-
 net/bluetooth/mgmt.c                               |  32 +-
 net/bluetooth/rfcomm/tty.c                         |  26 +-
 net/bluetooth/sco.c                                |   7 +
 net/bridge/br.c                                    |   5 +
 net/bridge/br_forward.c                            |   5 +-
 net/bridge/br_if.c                                 |   1 +
 net/bridge/br_input.c                              |   4 +-
 net/bridge/br_mst.c                                |  10 +-
 net/bridge/br_private.h                            |  13 +-
 net/core/dev.c                                     |  64 ++-
 net/core/filter.c                                  |   1 +
 net/core/net-sysfs.c                               |   4 +-
 net/core/netpoll.c                                 |   7 +-
 net/core/page_pool.c                               |  12 +-
 net/core/sock.c                                    |  15 +-
 net/dsa/tag_brcm.c                                 |  10 +-
 net/ethernet/eth.c                                 |   5 +-
 net/ipv4/fou_nl.c                                  |   4 +-
 net/ipv4/inet_connection_sock.c                    |  12 +-
 net/ipv4/inet_diag.c                               |  14 +-
 net/ipv4/inet_hashtables.c                         |  44 ++-
 net/ipv4/inet_timewait_sock.c                      |   1 +
 net/ipv4/ip_input.c                                |  11 +-
 net/ipv4/netfilter/nf_reject_ipv4.c                |  25 ++
 net/ipv4/nexthop.c                                 |   6 +
 net/ipv4/route.c                                   |   2 +-
 net/ipv4/tcp.c                                     |   4 +-
 net/ipv4/tcp_fastopen.c                            |   7 +-
 net/ipv4/udp_tunnel_nic.c                          |   2 +-
 net/ipv6/addrconf.c                                |   4 +-
 net/ipv6/ah6.c                                     |  50 ++-
 net/ipv6/netfilter/nf_reject_ipv6.c                |  30 ++
 net/ipv6/raw.c                                     |   2 +-
 net/ipv6/udp.c                                     |   2 +-
 net/mac80211/cfg.c                                 |  23 +-
 net/mac80211/chan.c                                |   2 +-
 net/mac80211/ieee80211_i.h                         |  12 +-
 net/mac80211/iface.c                               |  25 +-
 net/mac80211/key.c                                 |  11 +-
 net/mac80211/link.c                                |   4 +-
 net/mac80211/mesh.c                                |   3 +
 net/mac80211/mlme.c                                |  62 +--
 net/mac80211/status.c                              |  21 +-
 net/mptcp/protocol.c                               |  61 +--
 net/mptcp/protocol.h                               |   2 +-
 net/netfilter/nf_tables_api.c                      |  47 +--
 net/rds/rds.h                                      |   2 +-
 net/sctp/diag.c                                    |  23 +-
 net/wireless/core.c                                |  56 +++
 net/wireless/nl80211.c                             |   3 +-
 net/wireless/scan.c                                |   9 +-
 net/wireless/trace.h                               |  21 +
 rust/Makefile                                      |  15 +-
 rust/kernel/devres.rs                              |   2 +-
 rust/kernel/kunit.rs                               |   7 +
 rust/kernel/sync/condvar.rs                        |   2 +-
 rust/macros/kunit.rs                               |  48 ++-
 scripts/Makefile.vmlinux_o                         |  15 +-
 scripts/kernel-doc.py                              |  34 +-
 security/integrity/ima/ima_appraise.c              |  23 +-
 sound/drivers/serial-generic.c                     |  12 +-
 sound/hda/codecs/realtek/alc269.c                  |  10 +
 sound/hda/codecs/side-codecs/tas2781_hda_i2c.c     |  12 +
 sound/soc/codecs/cs-amp-lib-test.c                 |   1 +
 sound/soc/codecs/es8323.c                          |  17 +-
 sound/soc/codecs/rt722-sdca-sdw.c                  |   2 +-
 sound/soc/codecs/rt722-sdca.c                      |  14 +
 sound/soc/codecs/rt722-sdca.h                      |   6 +
 sound/soc/codecs/tas2781-fmwlib.c                  |  12 +
 sound/soc/codecs/tas2781-i2c.c                     |   6 +
 sound/soc/codecs/tlv320aic3x.c                     |  32 +-
 sound/soc/codecs/wsa883x.c                         |  57 ++-
 sound/soc/fsl/fsl_micfil.c                         |   4 +-
 sound/soc/fsl/fsl_sai.c                            |  11 +-
 sound/soc/intel/avs/pcm.c                          |  15 +-
 sound/soc/mediatek/mt8173/mt8173-rt5650.c          |   2 +-
 sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c |   2 +-
 .../mt8183/mt8183-mt6358-ts3a227-max98357.c        |   2 +-
 sound/soc/mediatek/mt8186/mt8186-mt6366.c          |   2 +-
 sound/soc/mediatek/mt8188/mt8188-mt6359.c          |   8 +-
 .../mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c  |   2 +-
 sound/soc/mediatek/mt8195/mt8195-afe-pcm.c         |   1 -
 sound/soc/mediatek/mt8195/mt8195-mt6359.c          |   4 +-
 sound/soc/mediatek/mt8365/mt8365-afe-pcm.c         |   1 -
 sound/soc/meson/aiu-encoder-i2s.c                  |   9 +-
 sound/soc/qcom/qdsp6/q6asm.c                       |   2 +-
 sound/soc/qcom/sc8280xp.c                          |   3 +
 sound/soc/renesas/rcar/msiof.c                     |  54 ++-
 sound/soc/renesas/rz-ssi.c                         |  25 +-
 sound/soc/sdw_utils/soc_sdw_utils.c                |   1 -
 sound/soc/soc-ops.c                                |   1 +
 sound/soc/sof/ipc4-pcm.c                           |  56 +++
 sound/soc/stm/stm32_sai_sub.c                      |   8 +
 sound/usb/mixer.c                                  |   7 +
 sound/usb/mixer_s1810c.c                           |  49 ++-
 sound/usb/quirks.c                                 |   3 -
 sound/usb/validate.c                               |   9 +-
 tools/bpf/bpftool/btf_dumper.c                     |   2 +-
 tools/bpf/bpftool/link.c                           |  54 ++-
 tools/bpf/bpftool/prog.c                           |   2 +-
 tools/include/linux/bitmap.h                       |   1 +
 tools/lib/bpf/bpf_tracing.h                        |   2 +-
 tools/lib/bpf/usdt.bpf.h                           |  44 ++-
 tools/lib/bpf/usdt.c                               |  62 ++-
 tools/lib/thermal/Makefile                         |   9 +-
 tools/net/ynl/lib/ynl-priv.h                       |  14 +-
 tools/net/ynl/lib/ynl.c                            |   6 +-
 tools/net/ynl/pyynl/ethtool.py                     |   3 +
 tools/net/ynl/pyynl/ynl_gen_c.py                   |   2 +-
 tools/power/cpupower/lib/cpuidle.c                 |   5 +-
 tools/power/cpupower/lib/cpupower.c                |   2 +-
 tools/power/x86/turbostat/turbostat.c              |   2 +-
 .../x86_energy_perf_policy.c                       |  30 +-
 tools/testing/kunit/configs/arch_uml.config        |   5 +-
 tools/testing/selftests/Makefile                   |   2 +-
 tools/testing/selftests/arm64/abi/tpidr2.c         |   6 +-
 tools/testing/selftests/bpf/benchs/bench_sockmap.c |   5 +-
 .../selftests/bpf/prog_tests/arena_spin_lock.c     |  13 +
 .../testing/selftests/bpf/prog_tests/bpf_cookie.c  |   3 +-
 .../testing/selftests/bpf/progs/arena_spin_lock.c  |   5 +-
 .../selftests/bpf/progs/verifier_arena_large.c     |   1 +
 tools/testing/selftests/bpf/test_lirc_mode2_user.c |   2 +-
 tools/testing/selftests/bpf/test_xsk.sh            |   2 +
 tools/testing/selftests/drivers/net/hds.py         |  39 ++
 tools/testing/selftests/drivers/net/hw/devmem.py   |  14 +-
 tools/testing/selftests/drivers/net/hw/ncdevmem.c  |   4 +
 tools/testing/selftests/drivers/net/hw/rss_ctx.py  |  11 +-
 .../selftests/drivers/net/lib/py/__init__.py       |   2 +-
 tools/testing/selftests/drivers/net/lib/py/env.py  |  41 +-
 .../selftests/drivers/net/netdevsim/Makefile       |   4 +
 tools/testing/selftests/net/fcnal-test.sh          | 432 +++++++++++----------
 .../net/forwarding/custom_multipath_hash.sh        |   2 +-
 .../net/forwarding/gre_custom_multipath_hash.sh    |   2 +-
 .../net/forwarding/ip6_forward_instats_vrf.sh      |   6 +-
 .../net/forwarding/ip6gre_custom_multipath_hash.sh |   2 +-
 tools/testing/selftests/net/forwarding/lib.sh      |   8 +-
 .../net/forwarding/mirror_gre_bridge_1q_lag.sh     |   2 +-
 .../net/forwarding/mirror_gre_vlan_bridge_1q.sh    |   4 +-
 tools/testing/selftests/net/gro.c                  |  12 +-
 tools/testing/selftests/net/lib.sh                 |  32 +-
 tools/testing/selftests/net/lib/py/utils.py        |  18 +
 tools/testing/selftests/net/lib/xdp_native.bpf.c   |  98 ++++-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    |   6 +-
 tools/testing/selftests/net/netlink-dumps.c        |  43 +-
 tools/testing/selftests/net/psock_tpacket.c        |   4 +-
 tools/testing/selftests/net/tfo_passive.sh         |   2 +-
 tools/testing/selftests/net/traceroute.sh          |  51 +--
 .../selftests/pci_endpoint/pci_endpoint_test.c     |   4 +
 .../intel/workload_hint/workload_hint_test.c       |   2 +
 tools/testing/selftests/ublk/test_generic_01.sh    |   4 +
 tools/testing/selftests/ublk/test_generic_02.sh    |   4 +
 tools/testing/selftests/ublk/test_generic_12.sh    |   4 +
 tools/testing/selftests/ublk/test_null_01.sh       |   4 +
 tools/testing/selftests/ublk/test_null_02.sh       |   4 +
 tools/testing/selftests/ublk/test_stress_05.sh     |   4 +
 tools/testing/selftests/vsock/vmtest.sh            |   8 +-
 usr/include/headers_check.pl                       |   2 +
 933 files changed, 10037 insertions(+), 4513 deletions(-)

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Frédéric Danis <[email protected]>

commit 76e20da0bd00c556ed0a1e7250bdb6ac3e808ea8 upstream.

This reverts commit c9d84da18d1e0d28a7e16ca6df8e6d47570501d4. It replaces in L2CAP calls to msecs_to_jiffies() to secs_to_jiffies() and updates the constants accordingly. But the constants are also used in LCAP Configure Request and L2CAP Configure Response which expect values in milliseconds.
This may prevent correct usage of L2CAP channel.

To fix it, keep those constants in milliseconds and so revert this change.

---
 include/net/bluetooth/l2cap.h | 4 ++--
 net/bluetooth/l2cap_core.c    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

index 4bb0eaedda18..00e182a22720 100644
@@ -38,8 +38,8 @@
 #define L2CAP_DEFAULT_TX_WINDOW		63
 #define L2CAP_DEFAULT_EXT_WINDOW	0x3FFF
 #define L2CAP_DEFAULT_MAX_TX		3
-#define L2CAP_DEFAULT_RETRANS_TO	2    /* seconds */
-#define L2CAP_DEFAULT_MONITOR_TO	12   /* seconds */
+#define L2CAP_DEFAULT_RETRANS_TO	2000    /* 2 seconds */
+#define L2CAP_DEFAULT_MONITOR_TO	12000   /* 12 seconds */
 #define L2CAP_DEFAULT_MAX_PDU_SIZE	1492    /* Sized for AMP packet */
 #define L2CAP_DEFAULT_ACK_TO		200
 #define L2CAP_DEFAULT_MAX_SDU_SIZE	0xFFFF

index 805c752ac0a9..d08320380ad6 100644
@@ -282,7 +282,7 @@ static void __set_retrans_timer(struct l2cap_chan *chan)
 	if (!delayed_work_pending(&chan->monitor_timer) &&
 	    chan->retrans_timeout) {
 		l2cap_set_timer(chan, &chan->retrans_timer,
-				secs_to_jiffies(chan->retrans_timeout));
+				msecs_to_jiffies(chan->retrans_timeout));
 	}
 }
 

@@ -291,7 +291,7 @@ static void __set_monitor_timer(struct l2cap_chan *chan)
 	__clear_retrans_timer(chan);
 	if (chan->monitor_timeout) {
 		l2cap_set_timer(chan, &chan->monitor_timer,
-				secs_to_jiffies(chan->monitor_timeout));
+				msecs_to_jiffies(chan->monitor_timeout));
 	}
 }
 

2.51.2

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tejun Heo <[email protected]>

commit 54e96258a6930909b690fd7e8889749231ba8085 upstream.

scx_bpf_dsq_move_set_slice() and scx_bpf_dsq_move_set_vtime() take a DSQ iterator argument which has to be valid. Mark them with KF_RCU.

---
 kernel/sched/ext.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -5706,8 +5706,8 @@ BTF_KFUNCS_START(scx_kfunc_ids_dispatch)
 BTF_ID_FLAGS(func, scx_bpf_dispatch_nr_slots)
 BTF_ID_FLAGS(func, scx_bpf_dispatch_cancel)
 BTF_ID_FLAGS(func, scx_bpf_dsq_move_to_local)
-BTF_ID_FLAGS(func, scx_bpf_dsq_move_set_slice)
-BTF_ID_FLAGS(func, scx_bpf_dsq_move_set_vtime)
+BTF_ID_FLAGS(func, scx_bpf_dsq_move_set_slice, KF_RCU)
+BTF_ID_FLAGS(func, scx_bpf_dsq_move_set_vtime, KF_RCU)
 BTF_ID_FLAGS(func, scx_bpf_dsq_move, KF_RCU)
 BTF_ID_FLAGS(func, scx_bpf_dsq_move_vtime, KF_RCU)
 BTF_KFUNCS_END(scx_kfunc_ids_dispatch)

@@ -5832,8 +5832,8 @@ __bpf_kfunc_end_defs();
 
 BTF_KFUNCS_START(scx_kfunc_ids_unlocked)
 BTF_ID_FLAGS(func, scx_bpf_create_dsq, KF_SLEEPABLE)
-BTF_ID_FLAGS(func, scx_bpf_dsq_move_set_slice)
-BTF_ID_FLAGS(func, scx_bpf_dsq_move_set_vtime)
+BTF_ID_FLAGS(func, scx_bpf_dsq_move_set_slice, KF_RCU)
+BTF_ID_FLAGS(func, scx_bpf_dsq_move_set_vtime, KF_RCU)
 BTF_ID_FLAGS(func, scx_bpf_dsq_move, KF_RCU)
 BTF_ID_FLAGS(func, scx_bpf_dsq_move_vtime, KF_RCU)
 BTF_KFUNCS_END(scx_kfunc_ids_unlocked)

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chuck Lever <[email protected]>

commit 4f76435fd517981f01608678c06ad9718a86ee98 upstream.

NFSv4 clients won't send legitimate GETATTR requests for these new attributes because they are intended to be used only with CB_GETATTR and SETATTR. But NFSD has to do something besides crashing if it ever sees a GETATTR request that queries these attributes.

RFC 8881 Section 18.7.3 states:

Further, RFC 9754 Section 5 states:

Thus there does not appear to be a specific server response mandated by specification. Taking the guidance that querying these attributes via GETATTR is "invalid", NFSD will return nfserr_inval, failing the request entirely.

---
 fs/nfsd/nfs4xdr.c |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -2939,6 +2939,12 @@ struct nfsd4_fattr_args {
 typedef __be32(*nfsd4_enc_attr)(struct xdr_stream *xdr,
 				const struct nfsd4_fattr_args *args);
 
+static __be32 nfsd4_encode_fattr4__inval(struct xdr_stream *xdr,
+					 const struct nfsd4_fattr_args *args)
+{
+	return nfserr_inval;
+}
+
 static __be32 nfsd4_encode_fattr4__noop(struct xdr_stream *xdr,
 					const struct nfsd4_fattr_args *args)
 {

@@ -3560,6 +3566,8 @@ static const nfsd4_enc_attr nfsd4_enc_fa
 
 	[FATTR4_MODE_UMASK]		= nfsd4_encode_fattr4__noop,
 	[FATTR4_XATTR_SUPPORT]		= nfsd4_encode_fattr4_xattr_support,
+	[FATTR4_TIME_DELEG_ACCESS]	= nfsd4_encode_fattr4__inval,
+	[FATTR4_TIME_DELEG_MODIFY]	= nfsd4_encode_fattr4__inval,
 	[FATTR4_OPEN_ARGUMENTS]		= nfsd4_encode_fattr4_open_arguments,
 };
 

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chuck Lever <[email protected]>

commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream.

When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test.

---
 fs/nfsd/nfs4proc.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

@@ -988,10 +988,11 @@ nfsd4_read(struct svc_rqst *rqstp, struc
 static void
 nfsd4_read_release(union nfsd4_op_u *u)
 {
-	if (u->read.rd_nf)
+	if (u->read.rd_nf) {
+		trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp,
+				     u->read.rd_offset, u->read.rd_length);
 		nfsd_file_put(u->read.rd_nf);
-	trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp,
-			     u->read.rd_offset, u->read.rd_length);
+	}
 }
 
 static __be32

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chuck Lever <[email protected]>

commit 3e7f011c255582d7c914133785bbba1990441713 upstream.

I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND").

Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in:

[   51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total

pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO),
nodemask=(null),cpuset=/,mems_allowed=0

when NFSD attempts to allocate the COMPOUND op array.

Let's restore the operation-per-COMPOUND limit, but increased to 200 for now.

---
 fs/nfsd/nfs4proc.c  |   14 ++++++++++++--
 fs/nfsd/nfs4state.c |    1 +
 fs/nfsd/nfs4xdr.c   |    4 +++-
 fs/nfsd/nfsd.h      |    3 +++
 fs/nfsd/xdr4.h      |    1 +
 5 files changed, 20 insertions(+), 3 deletions(-)

@@ -2859,10 +2859,20 @@ nfsd4_proc_compound(struct svc_rqst *rqs
 
 	rqstp->rq_lease_breaker = (void **)&cstate->clp;
 
-	trace_nfsd_compound(rqstp, args->tag, args->taglen, args->opcnt);
+	trace_nfsd_compound(rqstp, args->tag, args->taglen, args->client_opcnt);
 	while (!status && resp->opcnt < args->opcnt) {
 		op = &args->ops[resp->opcnt++];
 
+		if (unlikely(resp->opcnt == NFSD_MAX_OPS_PER_COMPOUND)) {
+			/* If there are still more operations to process,
+			 * stop here and report NFS4ERR_RESOURCE. */
+			if (cstate->minorversion == 0 &&
+			    args->client_opcnt > resp->opcnt) {
+				op->status = nfserr_resource;
+				goto encode_op;
+			}
+		}
+
 		/*
 		 * The XDR decode routines may have pre-set op->status;
 		 * for example, if there is a miscellaneous XDR error

@@ -2939,7 +2949,7 @@ encode_op:
 			status = op->status;
 		}
 
-		trace_nfsd_compound_status(args->opcnt, resp->opcnt,
+		trace_nfsd_compound_status(args->client_opcnt, resp->opcnt,
 					   status, nfsd4_op_name(op->opnum));
 
 		nfsd4_cstate_clear_replay(cstate);

@@ -3865,6 +3865,7 @@ static __be32 check_forechannel_attrs(st
 	ca->headerpadsz = 0;
 	ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
 	ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
+	ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
 	ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
 			NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
 	ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);

@@ -2488,8 +2488,10 @@ nfsd4_decode_compound(struct nfsd4_compo
 
 	if (xdr_stream_decode_u32(argp->xdr, &argp->minorversion) < 0)
 		return false;
-	if (xdr_stream_decode_u32(argp->xdr, &argp->opcnt) < 0)
+	if (xdr_stream_decode_u32(argp->xdr, &argp->client_opcnt) < 0)
 		return false;
+	argp->opcnt = min_t(u32, argp->client_opcnt,
+			    NFSD_MAX_OPS_PER_COMPOUND);
 
 	if (argp->opcnt > ARRAY_SIZE(argp->iops)) {
 		argp->ops = vcalloc(argp->opcnt, sizeof(*argp->ops));

@@ -57,6 +57,9 @@ struct readdir_cd {
 	__be32			err;	/* 0, nfserr, or nfserr_eof */
 };
 
+/* Maximum number of operations per session compound */
+#define NFSD_MAX_OPS_PER_COMPOUND	200
+
 struct nfsd_genl_rqstp {
 	struct sockaddr		rq_daddr;
 	struct sockaddr		rq_saddr;

@@ -903,6 +903,7 @@ struct nfsd4_compoundargs {
 	char *				tag;
 	u32				taglen;
 	u32				minorversion;
+	u32				client_opcnt;
 	u32				opcnt;
 	bool				splice_ok;
 	struct nfsd4_op			*ops;

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Miaoqian Lin <[email protected]>

commit dc89548c6926d68dfdda11bebc1a5258bc41d887 upstream.

The code did not check the return value of usbnet_get_endpoints. Add checks and return the error if it fails to transfer the error.

Found via static anlaysis and this is similar to
commit 07161b2416f7 ("sr9800: Add check for usbnet_get_endpoints").

---
 drivers/net/usb/asix_devices.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

@@ -230,7 +230,9 @@ static int ax88172_bind(struct usbnet *d
 	int i;
 	unsigned long gpio_bits = dev->driver_info->data;
 
-	usbnet_get_endpoints(dev,intf);
+	ret = usbnet_get_endpoints(dev, intf);
+	if (ret)
+		goto out;
 
 	/* Toggle the GPIOs in a manufacturer/model specific way */
 	for (i = 2; i >= 0; i--) {

@@ -848,7 +850,9 @@ static int ax88772_bind(struct usbnet *d
 
 	dev->driver_priv = priv;
 
-	usbnet_get_endpoints(dev, intf);
+	ret = usbnet_get_endpoints(dev, intf);
+	if (ret)
+		return ret;
 
 	/* Maybe the boot loader passed the MAC address via device tree */
 	if (!eth_platform_get_mac_address(&dev->udev->dev, buf)) {

@@ -1281,7 +1285,9 @@ static int ax88178_bind(struct usbnet *d
 	int ret;
 	u8 buf[ETH_ALEN] = {0};
 
-	usbnet_get_endpoints(dev,intf);
+	ret = usbnet_get_endpoints(dev, intf);
+	if (ret)
+		return ret;
 
 	/* Get the MAC address */
 	ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Quanmin Yan <[email protected]>

commit a1f3058930745d2b938b6b4f5bd9630dc74b26b7 upstream.

Recently, we discovered the following issue through syzkaller:

BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0
Read of size 4 at addr ff11000001b3c69c by task syz.xxx
...
Call Trace:
 <TASK>
 dump_stack_lvl+0xab/0xe0
 print_address_description.constprop.0+0x2c/0x390
 print_report+0xb9/0x280
 kasan_report+0xb8/0xf0
 fb_mode_is_equal+0x285/0x2f0
 fbcon_mode_deleted+0x129/0x180
 fb_set_var+0xe7f/0x11d0
 do_fb_ioctl+0x6a0/0x750
 fb_ioctl+0xe0/0x140
 __x64_sys_ioctl+0x193/0x210
 do_syscall_64+0x5f/0x9c0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Based on experimentation and analysis, during framebuffer unregistration, only the memory of fb_info->modelist is freed, without setting the corresponding fb_display[i]->mode to NULL for the freed modes. This leads to UAF issues during subsequent accesses. Here's an example of reproduction steps:
1. With /dev/fb0 already registered in the system, load a kernel module to register a new device /dev/fb1;
2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);
3. Switch console from fb to VGA (to allow normal rmmod of the ko);
4. Unload the kernel module, at this point fb1's modelist is freed, leaving a wild pointer in fb_display[];
5. Trigger the bug via system calls through fb0 attempting to delete a mode from fb0.

Add a check in do_unregister_framebuffer(): if the mode to be freed exists in fb_display[], set the corresponding mode pointer to NULL.

---
 drivers/video/fbdev/core/fbcon.c |   19 +++++++++++++++++++
 drivers/video/fbdev/core/fbmem.c |    1 +
 include/linux/fbcon.h            |    2 ++
 3 files changed, 22 insertions(+)

@@ -2817,6 +2817,25 @@ int fbcon_mode_deleted(struct fb_info *i
 	return found;
 }
 
+static void fbcon_delete_mode(struct fb_videomode *m)
+{
+	struct fbcon_display *p;
+
+	for (int i = first_fb_vc; i <= last_fb_vc; i++) {
+		p = &fb_display[i];
+		if (p->mode == m)
+			p->mode = NULL;
+	}
+}
+
+void fbcon_delete_modelist(struct list_head *head)
+{
+	struct fb_modelist *modelist;
+
+	list_for_each_entry(modelist, head, list)
+		fbcon_delete_mode(&modelist->mode);
+}
+
 #ifdef CONFIG_VT_HW_CONSOLE_BINDING
 static void fbcon_unbind(void)
 {

@@ -544,6 +544,7 @@ static void do_unregister_framebuffer(st
 		fb_info->pixmap.addr = NULL;
 	}
 
+	fbcon_delete_modelist(&fb_info->modelist);
 	fb_destroy_modelist(&fb_info->modelist);
 	registered_fb[fb_info->node] = NULL;
 	num_registered_fb--;

@@ -11,6 +11,7 @@ void fbcon_suspended(struct fb_info *inf
 void fbcon_resumed(struct fb_info *info);
 int fbcon_mode_deleted(struct fb_info *info,
 		       struct fb_videomode *mode);
+void fbcon_delete_modelist(struct list_head *head);
 void fbcon_new_modelist(struct fb_info *info);
 void fbcon_get_requirement(struct fb_info *info,
 			   struct fb_blit_caps *caps);

@@ -31,6 +32,7 @@ static inline void fbcon_suspended(struc
 static inline void fbcon_resumed(struct fb_info *info) {}
 static inline int fbcon_mode_deleted(struct fb_info *info,
 				     struct fb_videomode *mode) { return 0; }
+static inline void fbcon_delete_modelist(struct list_head *head) {}
 static inline void fbcon_new_modelist(struct fb_info *info) {}
 static inline void fbcon_get_requirement(struct fb_info *info,
 					 struct fb_blit_caps *caps) {}

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Palmer <[email protected]>

commit 7073c7fc8d8ba47194e5fc58fcafc0efe7586e9b upstream.

Actually check the return value from pll_ops->init_pll() as it can return an error.

If the card's BIOS didn't run because it's not the primary VGA card the fact that the xclk source is unsupported is printed as shown below but the driver continues on regardless and on my machine causes a hard lock up.

[   61.470088] atyfb 0000:03:05.0: enabling device (0080 -> 0083)
[   61.476191] atyfb: using auxiliary register aperture
[   61.481239] atyfb: 3D RAGE XL (Mach64 GR, PCI-33) [0x4752 rev 0x27]
[   61.487569] atyfb: 512K SGRAM (1:1), 14.31818 MHz XTAL, 230 MHz PLL, 83 Mhz MCLK, 63 MHz XCLK
[   61.496112] atyfb: Unsupported xclk source:  5.

---
 drivers/video/fbdev/aty/atyfb_base.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

@@ -2614,8 +2614,12 @@ static int aty_init(struct fb_info *info
 		pr_cont("\n");
 	}
 #endif
-	if (par->pll_ops->init_pll)
-		par->pll_ops->init_pll(info, &par->pll);
+	if (par->pll_ops->init_pll) {
+		ret = par->pll_ops->init_pll(info, &par->pll);
+		if (ret)
+			return ret;
+	}
+
 	if (par->pll_ops->resume_pll)
 		par->pll_ops->resume_pll(info, &par->pll);
 

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yuhao Jiang <[email protected]>

commit 8f067aa59430266386b83c18b983ca583faa6a11 upstream.

The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal.

If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight.

Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.

---
 drivers/acpi/acpi_video.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -1959,8 +1959,10 @@ static void acpi_video_bus_remove_notify
 	struct acpi_video_device *dev;
 
 	mutex_lock(&video->device_list_lock);
-	list_for_each_entry(dev, &video->video_device_list, entry)
+	list_for_each_entry(dev, &video->video_device_list, entry) {
 		acpi_video_dev_remove_notify_handler(dev);
+		cancel_delayed_work_sync(&dev->switch_brightness_work);
+	}
 	mutex_unlock(&video->device_list_lock);
 
 	acpi_video_bus_stop_devices(video);

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kaushlendra Kumar <[email protected]>

commit 20594cd104abaaabb676c7a2915b150ae5ff093d upstream.

Make acpi_button_add() call input_free_device() when input_register_device() fails as required according to the documentation of the latter.

---
 drivers/acpi/button.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -619,8 +619,10 @@ static int acpi_button_add(struct acpi_d
 
 	input_set_drvdata(input, device);
 	error = input_register_device(input);
-	if (error)
+	if (error) {
+		input_free_device(input);
 		goto err_remove_fs;
+	}
 
 	switch (device->device_type) {
 	case ACPI_BUS_TYPE_POWER_BUTTON:

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Armin Wolf <[email protected]>

commit d91a1d129b63614fa4c2e45e60918409ce36db7e upstream.

Device-managed resources are cleaned up when the driver unbinds from the underlying device. In our case this is the platform device as this driver is a platform driver. Registering device-managed resources on the associated ACPI device will thus result in a resource leak when this driver unbinds.

Ensure that any device-managed resources are only registered on the platform device to ensure that they are cleaned up during removal.

---
 drivers/acpi/fan.h       |    4 ++--
 drivers/acpi/fan_core.c  |    2 +-
 drivers/acpi/fan_hwmon.c |    8 ++++----
 3 files changed, 7 insertions(+), 7 deletions(-)

@@ -64,9 +64,9 @@ int acpi_fan_create_attributes(struct ac
 void acpi_fan_delete_attributes(struct acpi_device *device);
 
 #if IS_REACHABLE(CONFIG_HWMON)
-int devm_acpi_fan_create_hwmon(struct acpi_device *device);
+int devm_acpi_fan_create_hwmon(struct device *dev);
 #else
-static inline int devm_acpi_fan_create_hwmon(struct acpi_device *device) { return 0; };
+static inline int devm_acpi_fan_create_hwmon(struct device *dev) { return 0; };
 #endif
 
 #endif

@@ -347,7 +347,7 @@ static int acpi_fan_probe(struct platfor
 	}
 
 	if (fan->has_fst) {
-		result = devm_acpi_fan_create_hwmon(device);
+		result = devm_acpi_fan_create_hwmon(&pdev->dev);
 		if (result)
 			return result;
 

@@ -167,12 +167,12 @@ static const struct hwmon_chip_info acpi
 	.info = acpi_fan_hwmon_info,
 };
 
-int devm_acpi_fan_create_hwmon(struct acpi_device *device)
+int devm_acpi_fan_create_hwmon(struct device *dev)
 {
-	struct acpi_fan *fan = acpi_driver_data(device);
+	struct acpi_fan *fan = dev_get_drvdata(dev);
 	struct device *hdev;
 
-	hdev = devm_hwmon_device_register_with_info(&device->dev, "acpi_fan", fan,
-						    &acpi_fan_hwmon_chip_info, NULL);
+	hdev = devm_hwmon_device_register_with_info(dev, "acpi_fan", fan, &acpi_fan_hwmon_chip_info,
+						    NULL);
 	return PTR_ERR_OR_ZERO(hdev);
 }

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bui Quang Minh <[email protected]>

commit 1ab665817448c31f4758dce43c455bd4c5e460aa upstream.

In virtio-net, we have not yet supported multi-buffer XDP packet in zerocopy mode when there is a binding XDP program. However, in that case, when receiving multi-buffer XDP packet, we skip the XDP program and return XDP_PASS. As a result, the packet is passed to normal network stack which is an incorrect behavior (e.g. a XDP program for packet count is installed, multi-buffer XDP packet arrives and does go through XDP program. As a result, the packet count does not increase but the packet is still received from network stack).This commit instead returns XDP_ABORTED in that case.

---
 drivers/net/virtio_net.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

@@ -1379,9 +1379,14 @@ static struct sk_buff *virtnet_receive_x
 	ret = XDP_PASS;
 	rcu_read_lock();
 	prog = rcu_dereference(rq->xdp_prog);
-	/* TODO: support multi buffer. */
-	if (prog && num_buf == 1)
-		ret = virtnet_xdp_handler(prog, xdp, dev, xdp_xmit, stats);
+	if (prog) {
+		/* TODO: support multi buffer. */
+		if (num_buf == 1)
+			ret = virtnet_xdp_handler(prog, xdp, dev, xdp_xmit,
+						  stats);
+		else
+			ret = XDP_ABORTED;
+	}
 	rcu_read_unlock();
 
 	switch (ret) {

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

commit f12b69d8f22824a07f17c1399c99757072de73e0 upstream.

Trying to dump the originators or the neighbors via netlink for a meshif with an inactive primary interface is not allowed. The dump functions were checking this correctly but they didn't handle non-existing primary interfaces and existing _inactive_ interfaces differently.

(Primary) batadv_hard_ifaces hold a references to a net_device. And accessing them is only allowed when either being in a RCU/spinlock protected section or when holding a valid reference to them. The netlink dump functions use the latter.

But because the missing specific error handling for inactive primary interfaces, the reference was never dropped. This reference counting error was only detected when the interface should have been removed from the system:

unregister_netdevice: waiting for batadv_slave_0 to become free. Usage count = 2

---
 net/batman-adv/originator.c |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

@@ -764,11 +764,16 @@ int batadv_hardif_neigh_dump(struct sk_b
 	bat_priv = netdev_priv(mesh_iface);
 
 	primary_if = batadv_primary_if_get_selected(bat_priv);
-	if (!primary_if || primary_if->if_status != BATADV_IF_ACTIVE) {
+	if (!primary_if) {
 		ret = -ENOENT;
 		goto out_put_mesh_iface;
 	}
 
+	if (primary_if->if_status != BATADV_IF_ACTIVE) {
+		ret = -ENOENT;
+		goto out_put_primary_if;
+	}
+
 	hard_iface = batadv_netlink_get_hardif(bat_priv, cb);
 	if (IS_ERR(hard_iface) && PTR_ERR(hard_iface) != -ENONET) {
 		ret = PTR_ERR(hard_iface);

@@ -1333,11 +1338,16 @@ int batadv_orig_dump(struct sk_buff *msg
 	bat_priv = netdev_priv(mesh_iface);
 
 	primary_if = batadv_primary_if_get_selected(bat_priv);
-	if (!primary_if || primary_if->if_status != BATADV_IF_ACTIVE) {
+	if (!primary_if) {
 		ret = -ENOENT;
 		goto out_put_mesh_iface;
 	}
 
+	if (primary_if->if_status != BATADV_IF_ACTIVE) {
+		ret = -ENOENT;
+		goto out_put_primary_if;
+	}
+
 	hard_iface = batadv_netlink_get_hardif(bat_priv, cb);
 	if (IS_ERR(hard_iface) && PTR_ERR(hard_iface) != -ENONET) {
 		ret = PTR_ERR(hard_iface);

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Junjie Cao <[email protected]>

commit 18c4ef4e765a798b47980555ed665d78b71aeadf upstream.

bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address.

This fixes a global out-of-bounds read reported by syzbot.

---
 drivers/video/fbdev/core/bitblit.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

@@ -79,12 +79,16 @@ static inline void bit_putcs_aligned(str
 				     struct fb_image *image, u8 *buf, u8 *dst)
 {
 	u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
+	unsigned int charcnt = vc->vc_font.charcount;
 	u32 idx = vc->vc_font.width >> 3;
 	u8 *src;
 
 	while (cnt--) {
-		src = vc->vc_font.data + (scr_readw(s++)&
-					  charmask)*cellsize;
+		u16 ch = scr_readw(s++) & charmask;
+
+		if (ch >= charcnt)
+			ch = 0;
+		src = vc->vc_font.data + (unsigned int)ch * cellsize;
 
 		if (attr) {
 			update_attr(buf, src, attr, vc);

@@ -112,14 +116,18 @@ static inline void bit_putcs_unaligned(s
 				       u8 *dst)
 {
 	u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
+	unsigned int charcnt = vc->vc_font.charcount;
 	u32 shift_low = 0, mod = vc->vc_font.width % 8;
 	u32 shift_high = 8;
 	u32 idx = vc->vc_font.width >> 3;
 	u8 *src;
 
 	while (cnt--) {
-		src = vc->vc_font.data + (scr_readw(s++)&
-					  charmask)*cellsize;
+		u16 ch = scr_readw(s++) & charmask;
+
+		if (ch >= charcnt)
+			ch = 0;
+		src = vc->vc_font.data + (unsigned int)ch * cellsize;
 
 		if (attr) {
 			update_attr(buf, src, attr, vc);

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit 91d35ec9b3956d6b3cf789c1593467e58855b03a upstream.

The RFCOMM driver confuses the local and remote modem control signals, which specifically means that the reported DTR and RTS state will instead reflect the remote end (i.e. DSR and CTS).

This issue dates back to the original driver (and a follow-on update) merged in 2002, which resulted in a non-standard implementation of TIOCMSET that allowed controlling also the TS07.10 IC and DV signals by mapping them to the RI and DCD input flags, while TIOCMGET failed to return the actual state of DTR and RTS.

Note that the bogus control of input signals in tiocmset() is just dead code as those flags will have been masked out by the tty layer since 2003.

---
 net/bluetooth/rfcomm/tty.c |   26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

@@ -643,8 +643,8 @@ static void rfcomm_dev_modem_status(stru
 		tty_port_tty_hangup(&dev->port, true);
 
 	dev->modem_status =
-		((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
-		((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
+		((v24_sig & RFCOMM_V24_RTC) ? TIOCM_DSR : 0) |
+		((v24_sig & RFCOMM_V24_RTR) ? TIOCM_CTS : 0) |
 		((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 		((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 }

@@ -1055,10 +1055,14 @@ static void rfcomm_tty_hangup(struct tty
 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
 {
 	struct rfcomm_dev *dev = tty->driver_data;
+	struct rfcomm_dlc *dlc = dev->dlc;
+	u8 v24_sig;
 
 	BT_DBG("tty %p dev %p", tty, dev);
 
-	return dev->modem_status;
+	rfcomm_dlc_get_modem_status(dlc, &v24_sig);
+
+	return (v24_sig & (TIOCM_DTR | TIOCM_RTS)) | dev->modem_status;
 }
 
 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)

@@ -1071,23 +1075,15 @@ static int rfcomm_tty_tiocmset(struct tt
 
 	rfcomm_dlc_get_modem_status(dlc, &v24_sig);
 
-	if (set & TIOCM_DSR || set & TIOCM_DTR)
+	if (set & TIOCM_DTR)
 		v24_sig |= RFCOMM_V24_RTC;
-	if (set & TIOCM_RTS || set & TIOCM_CTS)
+	if (set & TIOCM_RTS)
 		v24_sig |= RFCOMM_V24_RTR;
-	if (set & TIOCM_RI)
-		v24_sig |= RFCOMM_V24_IC;
-	if (set & TIOCM_CD)
-		v24_sig |= RFCOMM_V24_DV;
 
-	if (clear & TIOCM_DSR || clear & TIOCM_DTR)
+	if (clear & TIOCM_DTR)
 		v24_sig &= ~RFCOMM_V24_RTC;
-	if (clear & TIOCM_RTS || clear & TIOCM_CTS)
+	if (clear & TIOCM_RTS)
 		v24_sig &= ~RFCOMM_V24_RTR;
-	if (clear & TIOCM_RI)
-		v24_sig &= ~RFCOMM_V24_IC;
-	if (clear & TIOCM_CD)
-		v24_sig &= ~RFCOMM_V24_DV;
 
 	rfcomm_dlc_set_modem_status(dlc, v24_sig);
 

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Emanuele Ghidoli <[email protected]>

commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f upstream.

While the DP83867 PHYs report EEE capability through their feature registers, the actual hardware does not support EEE (see Links). When the connected MAC enables EEE, it causes link instability and communication failures.

The issue is reproducible with a iMX8MP and relevant stmmac ethernet port. Since the introduction of phylink-managed EEE support in the stmmac driver, EEE is now enabled by default, leading to issues on systems using the DP83867 PHY.

Call phy_disable_eee during phy initialization to prevent EEE from being enabled on DP83867 PHYs.

---
 drivers/net/phy/dp83867.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -738,6 +738,12 @@ static int dp83867_config_init(struct ph
 			return ret;
 	}
 
+	/* Although the DP83867 reports EEE capability through the
+	 * MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature
+	 * is not actually implemented in hardware.
+	 */
+	phy_disable_eee(phydev);
+
 	if (phy_interface_is_rgmii(phydev) ||
 	    phydev->interface == PHY_INTERFACE_MODE_SGMII) {
 		val = phy_read(phydev, MII_DP83867_PHYCTRL);

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gokul Sivakumar <[email protected]>

commit 3776c685ebe5f43e9060af06872661de55e80b9a upstream.

Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface.

However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash.

 [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual
 address 0000000000000000
 [...]
 [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
 [...]
 [ 1417.075653] Call trace:
 [ 1417.075662]  brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]
 [ 1417.075738]  brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac]
 [ 1417.075810]  cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211]
 [ 1417.076067]  nl80211_tx_mgmt+0x238/0x388 [cfg80211]
 [ 1417.076281]  genl_family_rcv_msg_doit+0xe0/0x158
 [ 1417.076302]  genl_rcv_msg+0x220/0x2a0
 [ 1417.076317]  netlink_rcv_skb+0x68/0x140
 [ 1417.076330]  genl_rcv+0x40/0x60
 [ 1417.076343]  netlink_unicast+0x330/0x3b8
 [ 1417.076357]  netlink_sendmsg+0x19c/0x3f8
 [ 1417.076370]  __sock_sendmsg+0x64/0xc0
 [ 1417.076391]  ____sys_sendmsg+0x268/0x2a0
 [ 1417.076408]  ___sys_sendmsg+0xb8/0x118
 [ 1417.076427]  __sys_sendmsg+0x90/0xf8
 [ 1417.076445]  __arm64_sys_sendmsg+0x2c/0x40
 [ 1417.076465]  invoke_syscall+0x50/0x120
 [ 1417.076486]  el0_svc_common.constprop.0+0x48/0xf0
 [ 1417.076506]  do_el0_svc+0x24/0x38
 [ 1417.076525]  el0_svc+0x30/0x100
 [ 1417.076548]  el0t_64_sync_handler+0x100/0x130
 [ 1417.076569]  el0t_64_sync+0x190/0x198
 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)

Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver.

Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion().

And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif.

---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c |    3 -
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c      |   28 ++++--------
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h      |    3 -
 3 files changed, 12 insertions(+), 22 deletions(-)

@@ -5627,8 +5627,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
 			  *cookie, le16_to_cpu(action_frame->len),
 			  le32_to_cpu(af_params->channel));
 
-		ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
-						  af_params);
+		ack = brcmf_p2p_send_action_frame(vif->ifp, af_params);
 
 		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
 					GFP_KERNEL);

@@ -1529,6 +1529,7 @@ int brcmf_p2p_notify_action_tx_complete(
 /**
  * brcmf_p2p_tx_action_frame() - send action frame over fil.
  *
+ * @ifp: interface to transmit on.
  * @p2p: p2p info struct for vif.
  * @af_params: action frame data/info.
  *

@@ -1538,12 +1539,11 @@ int brcmf_p2p_notify_action_tx_complete(
  * The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action
  * frame is transmitted.
  */
-static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p,
+static s32 brcmf_p2p_tx_action_frame(struct brcmf_if *ifp,
+				     struct brcmf_p2p_info *p2p,
 				     struct brcmf_fil_af_params_le *af_params)
 {
 	struct brcmf_pub *drvr = p2p->cfg->pub;
-	struct brcmf_cfg80211_vif *vif;
-	struct brcmf_p2p_action_frame *p2p_af;
 	s32 err = 0;
 
 	brcmf_dbg(TRACE, "Enter\n");

@@ -1552,14 +1552,7 @@ static s32 brcmf_p2p_tx_action_frame(str
 	clear_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status);
 	clear_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
 
-	/* check if it is a p2p_presence response */
-	p2p_af = (struct brcmf_p2p_action_frame *)af_params->action_frame.data;
-	if (p2p_af->subtype == P2P_AF_PRESENCE_RSP)
-		vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif;
-	else
-		vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
-
-	err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe", af_params,
+	err = brcmf_fil_bsscfg_data_set(ifp, "actframe", af_params,
 					sizeof(*af_params));
 	if (err) {
 		bphy_err(drvr, " sending action frame has failed\n");

@@ -1711,16 +1704,14 @@ static bool brcmf_p2p_check_dwell_overfl
 /**
  * brcmf_p2p_send_action_frame() - send action frame .
  *
- * @cfg: driver private data for cfg80211 interface.
- * @ndev: net device to transmit on.
+ * @ifp: interface to transmit on.
  * @af_params: configuration data for action frame.
  */
-bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
-				 struct net_device *ndev,
+bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp,
 				 struct brcmf_fil_af_params_le *af_params)
 {
+	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
 	struct brcmf_p2p_info *p2p = &cfg->p2p;
-	struct brcmf_if *ifp = netdev_priv(ndev);
 	struct brcmf_fil_action_frame_le *action_frame;
 	struct brcmf_config_af_params config_af_params;
 	struct afx_hdl *afx_hdl = &p2p->afx_hdl;

@@ -1857,7 +1848,7 @@ bool brcmf_p2p_send_action_frame(struct
 		if (af_params->channel)
 			msleep(P2P_AF_RETRY_DELAY_TIME);
 
-		ack = !brcmf_p2p_tx_action_frame(p2p, af_params);
+		ack = !brcmf_p2p_tx_action_frame(ifp, p2p, af_params);
 		tx_retry++;
 		dwell_overflow = brcmf_p2p_check_dwell_overflow(requested_dwell,
 								dwell_jiffies);

@@ -2217,7 +2208,6 @@ static struct wireless_dev *brcmf_p2p_cr
 
 	WARN_ON(p2p_ifp->bsscfgidx != bsscfgidx);
 
-	init_completion(&p2p->send_af_done);
 	INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);
 	init_completion(&p2p->afx_hdl.act_frm_scan);
 	init_completion(&p2p->wait_next_af);

@@ -2513,6 +2503,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802
 	pri_ifp = brcmf_get_ifp(cfg->pub, 0);
 	p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif = pri_ifp->vif;
 
+	init_completion(&p2p->send_af_done);
+
 	if (p2pdev_forced) {
 		err_ptr = brcmf_p2p_create_p2pdev(p2p, NULL, NULL);
 		if (IS_ERR(err_ptr)) {

@@ -168,8 +168,7 @@ int brcmf_p2p_notify_action_frame_rx(str
 int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,
 					const struct brcmf_event_msg *e,
 					void *data);
-bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
-				 struct net_device *ndev,
+bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp,
 				 struct brcmf_fil_af_params_le *af_params);
 bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg,
 					   struct brcmf_bss_info_le *bi);

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Fuchs <[email protected]>

commit 5f566c0ac51cd2474e47da68dbe719d3acf7d999 upstream.

Commit e24cca19babe ("sh: Kill off MAX_DMA_ADDRESS leftovers.") removed the define ONCHIP_NR_DMA_CHANNELS. So that the leftover reference needs to be replaced by CONFIG_NR_ONCHIP_DMA_CHANNELS to compile successfully with CONFIG_PVR2_DMA enabled.

---
 drivers/video/fbdev/pvr2fb.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -192,7 +192,7 @@ static unsigned long pvr2fb_map;
 
 #ifdef CONFIG_PVR2_DMA
 static unsigned int shdma = PVR2_CASCADE_CHAN;
-static unsigned int pvr2dma = ONCHIP_NR_DMA_CHANNELS;
+static unsigned int pvr2dma = CONFIG_NR_ONCHIP_DMA_CHANNELS;
 #endif
 
 static struct fb_videomode pvr2_modedb[] = {

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Miaoqian Lin <[email protected]>

commit eb53368f8d6e2dfba84c8a94d245719bcf9ae270 upstream.

The of_find_node_by_name() function returns a device tree node with its reference count incremented. The caller is responsible for calling of_node_put() to release this reference when done.

Found via static analysis.

---
 drivers/video/fbdev/valkyriefb.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -329,11 +329,13 @@ static int __init valkyriefb_init(void)
 
 		if (of_address_to_resource(dp, 0, &r)) {
 			printk(KERN_ERR "can't find address for valkyrie\n");
+			of_node_put(dp);
 			return 0;
 		}
 
 		frame_buffer_phys = r.start;
 		cmap_regs_phys = r.start + 0x304000;
+		of_node_put(dp);
 	}
 #endif /* ppc (!CONFIG_MAC) */
 

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paolo Abeni <[email protected]>

commit 27b0e701d3872ba59c5b579a9e8a02ea49ad3d3b upstream.

Accessing the transmit queue without owning the msk socket lock is inherently racy, hence __mptcp_check_push() could actually quit early even when there is pending data.

That in turn could cause unexpected tx lock and timeout.

Dropping the early check avoids the race, implicitly relaying on later tests under the relevant lock. With such change, all the other mptcp_send_head() call sites are now under the msk socket lock and we can additionally drop the now unneeded annotation on the transmit head pointer accesses.

---
 net/mptcp/protocol.c |   11 ++++-------
 net/mptcp/protocol.h |    2 +-
 2 files changed, 5 insertions(+), 8 deletions(-)

@@ -965,7 +965,7 @@ static void __mptcp_clean_una(struct soc
 			if (WARN_ON_ONCE(!msk->recovery))
 				break;
 
-			WRITE_ONCE(msk->first_pending, mptcp_send_next(sk));
+			msk->first_pending = mptcp_send_next(sk);
 		}
 
 		dfrag_clear(sk, dfrag);

@@ -1510,7 +1510,7 @@ static int __subflow_push_pending(struct
 
 			mptcp_update_post_push(msk, dfrag, ret);
 		}
-		WRITE_ONCE(msk->first_pending, mptcp_send_next(sk));
+		msk->first_pending = mptcp_send_next(sk);
 
 		if (msk->snd_burst <= 0 ||
 		    !sk_stream_memory_free(ssk) ||

@@ -1854,7 +1854,7 @@ static int mptcp_sendmsg(struct sock *sk
 			get_page(dfrag->page);
 			list_add_tail(&dfrag->list, &msk->rtx_queue);
 			if (!msk->first_pending)
-				WRITE_ONCE(msk->first_pending, dfrag);
+				msk->first_pending = dfrag;
 		}
 		pr_debug("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d\n", msk,
 			 dfrag->data_seq, dfrag->data_len, dfrag->already_sent,

@@ -2854,7 +2854,7 @@ static void __mptcp_clear_xmit(struct so
 	struct mptcp_sock *msk = mptcp_sk(sk);
 	struct mptcp_data_frag *dtmp, *dfrag;
 
-	WRITE_ONCE(msk->first_pending, NULL);
+	msk->first_pending = NULL;
 	list_for_each_entry_safe(dfrag, dtmp, &msk->rtx_queue, list)
 		dfrag_clear(sk, dfrag);
 }

@@ -3394,9 +3394,6 @@ void __mptcp_data_acked(struct sock *sk)
 
 void __mptcp_check_push(struct sock *sk, struct sock *ssk)
 {
-	if (!mptcp_send_head(sk))
-		return;
-
 	if (!sock_owned_by_user(sk))
 		__mptcp_subflow_push_pending(sk, ssk, false);
 	else

@@ -414,7 +414,7 @@ static inline struct mptcp_data_frag *mp
 {
 	const struct mptcp_sock *msk = mptcp_sk(sk);
 
-	return READ_ONCE(msk->first_pending);
+	return msk->first_pending;
 }
 
 static inline struct mptcp_data_frag *mptcp_send_next(struct sock *sk)

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paolo Abeni <[email protected]>

commit a824084b98d8a1dbd6e85d0842a8eb5e73467f59 upstream.

Since commit 72377ab2d671 ("mptcp: more conservative check for zero probes") the MPTCP-level zero window probe check is always disabled, as the TCP-level write queue always contains at least the newly allocated skb.

Refine the relevant check tacking in account that the above condition and that such skb can have zero length.

---
 net/mptcp/protocol.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

@@ -1257,7 +1257,12 @@ alloc_skb:
 	if (copy == 0) {
 		u64 snd_una = READ_ONCE(msk->snd_una);
 
-		if (snd_una != msk->snd_nxt || tcp_write_queue_tail(ssk)) {
+		/* No need for zero probe if there are any data pending
+		 * either at the msk or ssk level; skb is the current write
+		 * queue tail and can be empty at this point.
+		 */
+		if (snd_una != msk->snd_nxt || skb->len ||
+		    skb != tcp_send_head(ssk)) {
 			tcp_remove_empty_skb(ssk);
 			return 0;
 		}

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Srinivas Kandagatla <[email protected]>

commit fdbb53d318aa94a094434e5f226617f0eb1e8f22 upstream.

For some reason we ended up kfree between spinlock lock and unlock, which can sleep.

move the kfree out of spinlock section.

---
 sound/soc/qcom/qdsp6/q6asm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -377,9 +377,9 @@ static void q6asm_audio_client_free_buf(
 
 	spin_lock_irqsave(&ac->lock, flags);
 	port->num_periods = 0;
+	spin_unlock_irqrestore(&ac->lock, flags);
 	kfree(port->buf);
 	port->buf = NULL;
-	spin_unlock_irqrestore(&ac->lock, flags);
 }
 
 /**

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Claudiu Beznea <[email protected]>

commit 22897e568646de5907d4981eae6cc895be2978d1 upstream.

When the driver supports DMA, it enqueues four DMA descriptors per substream before the substream is started. New descriptors are enqueued in the DMA completion callback, and each time a new descriptor is queued, the dma_buffer_pos is incremented.

During suspend, the DMA transactions are terminated. There might be cases where the four extra enqueued DMA descriptors are not completed and are instead canceled on suspend. However, the cancel operation does not take into account that the dma_buffer_pos was already incremented.

Previously, the suspend code reinitialized dma_buffer_pos to zero, but this is not always correct.

To avoid losing any audio periods during suspend/resume and to prevent clip sound, save the completed DMA buffer position in the DMA callback and reinitialize dma_buffer_pos on resume.

---
 sound/soc/renesas/rz-ssi.c |   25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

@@ -85,6 +85,7 @@ struct rz_ssi_stream {
 	struct snd_pcm_substream *substream;
 	int fifo_sample_size;	/* sample capacity of SSI FIFO */
 	int dma_buffer_pos;	/* The address for the next DMA descriptor */
+	int completed_dma_buf_pos; /* The address of the last completed DMA descriptor. */
 	int period_counter;	/* for keeping track of periods transferred */
 	int sample_width;
 	int buffer_pos;		/* current frame position in the buffer */

@@ -221,6 +222,7 @@ static void rz_ssi_stream_init(struct rz
 	rz_ssi_set_substream(strm, substream);
 	strm->sample_width = samples_to_bytes(runtime, 1);
 	strm->dma_buffer_pos = 0;
+	strm->completed_dma_buf_pos = 0;
 	strm->period_counter = 0;
 	strm->buffer_pos = 0;
 

@@ -443,6 +445,10 @@ static void rz_ssi_pointer_update(struct
 		snd_pcm_period_elapsed(strm->substream);
 		strm->period_counter = current_period;
 	}
+
+	strm->completed_dma_buf_pos += runtime->period_size;
+	if (strm->completed_dma_buf_pos >= runtime->buffer_size)
+		strm->completed_dma_buf_pos = 0;
 }
 
 static int rz_ssi_pio_recv(struct rz_ssi_priv *ssi, struct rz_ssi_stream *strm)

@@ -784,10 +790,14 @@ no_dma:
 	return -ENODEV;
 }
 
-static int rz_ssi_trigger_resume(struct rz_ssi_priv *ssi)
+static int rz_ssi_trigger_resume(struct rz_ssi_priv *ssi, struct rz_ssi_stream *strm)
 {
+	struct snd_pcm_substream *substream = strm->substream;
+	struct snd_pcm_runtime *runtime = substream->runtime;
 	int ret;
 
+	strm->dma_buffer_pos = strm->completed_dma_buf_pos + runtime->period_size;
+
 	if (rz_ssi_is_stream_running(&ssi->playback) ||
 	    rz_ssi_is_stream_running(&ssi->capture))
 		return 0;

@@ -800,16 +810,6 @@ static int rz_ssi_trigger_resume(struct
 				ssi->hw_params_cache.channels);
 }
 
-static void rz_ssi_streams_suspend(struct rz_ssi_priv *ssi)
-{
-	if (rz_ssi_is_stream_running(&ssi->playback) ||
-	    rz_ssi_is_stream_running(&ssi->capture))
-		return;
-
-	ssi->playback.dma_buffer_pos = 0;
-	ssi->capture.dma_buffer_pos = 0;
-}
-
 static int rz_ssi_dai_trigger(struct snd_pcm_substream *substream, int cmd,
 			      struct snd_soc_dai *dai)
 {

@@ -819,7 +819,7 @@ static int rz_ssi_dai_trigger(struct snd
 
 	switch (cmd) {
 	case SNDRV_PCM_TRIGGER_RESUME:
-		ret = rz_ssi_trigger_resume(ssi);
+		ret = rz_ssi_trigger_resume(ssi, strm);
 		if (ret)
 			return ret;
 

@@ -858,7 +858,6 @@ static int rz_ssi_dai_trigger(struct snd
 
 	case SNDRV_PCM_TRIGGER_SUSPEND:
 		rz_ssi_stop(ssi, strm);
-		rz_ssi_streams_suspend(ssi);
 		break;
 
 	case SNDRV_PCM_TRIGGER_STOP:

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Farhan Ali <[email protected]>

commit b45873c3f09153d1ad9b3a7bf9e5c0b0387fd2ea upstream.

Commit c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()"), introduced the zpci_set_irq() and zpci_clear_irq(), to be used while resetting a zPCI device.

Commit da995d538d3a ("s390/pci: implement reset_slot for hotplug slot"), mentions zpci_clear_irq() being called in the path for zpci_hot_reset_device(). But that is not the case anymore and these functions are not called outside of this file. Instead zpci_hot_reset_device() relies on zpci_disable_device() also clearing the IRQs, but misses to reset the zdev->irqs_registered flag.

However after a CLP disable/enable reset, the device's IRQ are unregistered, but the flag zdev->irq_registered does not get cleared. It creates an inconsistent state and so arch_restore_msi_irqs() doesn't correctly restore the device's IRQ. This becomes a problem when a PCI driver tries to restore the state of the device through pci_restore_state(). Restore IRQ unconditionally for the device and remove the irq_registered flag as its redundant.

---
 arch/s390/include/asm/pci.h |    1 -
 arch/s390/pci/pci_irq.c     |    9 +--------
 2 files changed, 1 insertion(+), 9 deletions(-)

@@ -145,7 +145,6 @@ struct zpci_dev {
 	u8		has_resources	: 1;
 	u8		is_physfn	: 1;
 	u8		util_str_avail	: 1;
-	u8		irqs_registered	: 1;
 	u8		tid_avail	: 1;
 	u8		rtr_avail	: 1; /* Relaxed translation allowed */
 	unsigned int	devfn;		/* DEVFN part of the RID*/

@@ -107,9 +107,6 @@ static int zpci_set_irq(struct zpci_dev
 	else
 		rc = zpci_set_airq(zdev);
 
-	if (!rc)
-		zdev->irqs_registered = 1;
-
 	return rc;
 }
 

@@ -123,9 +120,6 @@ static int zpci_clear_irq(struct zpci_de
 	else
 		rc = zpci_clear_airq(zdev);
 
-	if (!rc)
-		zdev->irqs_registered = 0;
-
 	return rc;
 }
 

@@ -427,8 +421,7 @@ bool arch_restore_msi_irqs(struct pci_de
 {
 	struct zpci_dev *zdev = to_zpci(pdev);
 
-	if (!zdev->irqs_registered)
-		zpci_set_irq(zdev);
+	zpci_set_irq(zdev);
 	return true;
 }
 

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Henrique Carvalho <[email protected]>

commit 5c76f9961c170552c1d07c830b5e145475151600 upstream.

When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt.
Because cfid wasn't reset on replay, later cleanup could act on a stale pointer, leading to a potential use-after-free.

Reinitialize cfid to NULL under the replay label.

Example trace (trimmed):

refcount_t: underflow; use-after-free.

WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110
[...]
RIP: 0010:refcount_warn_saturate+0x9c/0x110
[...]
Call Trace:
 <TASK>
 smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 ? step_into+0x10d/0x690
 ? __legitimize_path+0x28/0x60
 smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 ? kmem_cache_alloc+0x18a/0x340
 ? getname_flags+0x46/0x1e0
 cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 statfs_by_dentry+0x67/0x90
 vfs_statfs+0x16/0xd0
 user_statfs+0x54/0xa0
 __do_sys_statfs+0x20/0x50
 do_syscall_64+0x58/0x80

---
 fs/smb/client/smb2ops.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -2716,11 +2716,12 @@ smb2_query_info_compound(const unsigned
 	struct cifs_fid fid;
 	int rc;
 	__le16 *utf16_path;
-	struct cached_fid *cfid = NULL;
+	struct cached_fid *cfid;
 	int retries = 0, cur_sleep = 1;
 
 replay_again:
 	/* reinitialize for possible replay */
+	cfid = NULL;
 	flags = CIFS_CP_CREATE_CLOSE_OP;
 	oplock = SMB2_OPLOCK_LEVEL_NONE;
 	server = cifs_pick_channel(ses);

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <[email protected]>

commit 0d6e9ec80cebf9b378a1d3a01144e576d731c397 upstream.

Leyvi Rose reported that his X86_NATIVE_CPU=y build is failing because our instruction decoder doesn't support SSE4a and the AMDGPU code seems to be generating those with his compiler of choice (CLANG+LTO).

Now, our normal build flags disable SSE MMX SSE2 3DNOW AVX, but then CC_FLAGS_FPU re-enable SSE SSE2.

Since nothing mentions SSE3 or SSE4, I'm assuming that -msse (or its negative) control all SSE variants -- but why then explicitly enumerate SSE2 ?

Anyway, until the instruction decoder gets fixed, explicitly disallow SSE4a (an AMD specific SSE4 extension).

---
 arch/x86/Makefile |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -74,7 +74,7 @@ export BITS
 #
 #    https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53383
 #
-KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx
+KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx -mno-sse4a
 KBUILD_RUSTFLAGS += --target=$(objtree)/scripts/target.json
 KBUILD_RUSTFLAGS += -Ctarget-feature=-sse,-sse2,-sse3,-ssse3,-sse4.1,-sse4.2,-avx,-avx2
 

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gregory Price <[email protected]>

commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream.

There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail.

Add a fix glue which checks microcode revisions.

[ bp: Add microcode revisions checking, rewrite. ]

---
 arch/x86/kernel/cpu/amd.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

@@ -1018,8 +1018,18 @@ static void init_amd_zen4(struct cpuinfo
 	}
 }
 
+static const struct x86_cpu_id zen5_rdseed_microcode[] = {
+	ZEN_MODEL_STEP_UCODE(0x1a, 0x02, 0x1, 0x0b00215a),
+	ZEN_MODEL_STEP_UCODE(0x1a, 0x11, 0x0, 0x0b101054),
+};
+
 static void init_amd_zen5(struct cpuinfo_x86 *c)
 {
+	if (!x86_match_min_microcode_rev(zen5_rdseed_microcode)) {
+		clear_cpu_cap(c, X86_FEATURE_RDSEED);
+		msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18);
+		pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n");
+	}
 }
 
 static void init_amd(struct cpuinfo_x86 *c)

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chang S. Bae <[email protected]>

commit 388eff894d6bc5f921e9bfff0e4b0ab2684a96e9 upstream.

Sean reported [1] the following splat when running KVM tests:

   WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70
   Call Trace:
    <TASK>
    fpu__clear_user_states+0x9c/0x100
    arch_do_signal_or_restart+0x142/0x210
    exit_to_user_mode_loop+0x55/0x100
    do_syscall_64+0x205/0x2c0
    entry_SYSCALL_64_after_hwframe+0x4b/0x53

Chao further identified [2] a reproducible scenario involving signal
delivery: a non-AMX task is preempted by an AMX-enabled task which modifies the XFD MSR.

When the non-AMX task resumes and reloads XSTATE with init values, a warning is triggered due to a mismatch between fpstate::xfd and the CPU's current XFD state. fpu__clear_user_states() does not currently re-synchronize the XFD state after such preemption.

Invoke xfd_update_state() which detects and corrects the mismatch if there is a dynamic feature.

This also benefits the sigreturn path, as fpu__restore_sig() may call fpu__clear_user_states() when the sigframe is inaccessible.

[ dhansen: minor changelog munging ]

---
 arch/x86/kernel/fpu/core.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -825,6 +825,9 @@ void fpu__clear_user_states(struct fpu *
 	    !fpregs_state_valid(fpu, smp_processor_id()))
 		os_xrstor_supervisor(fpu->fpstate);
 
+	/* Ensure XFD state is in sync before reloading XSTATE */
+	xfd_update_state(fpu->fpstate);
+
 	/* Reset user states in registers. */
 	restore_fpregs_from_init_fpstate(XFEATURE_MASK_USER_RESTORE);
 

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Loic Poulain <[email protected]>

[ Upstream commit 2e9c1da4ee9d0acfca2e0a3d78f3d8cb5802da1b ]

ath10k_wmi_cmd_send takes ownership of the passed buffer (skb) and has the responsibility to release it in case of error. This patch fixes missing free in case of early error due to unhandled WMI command ID.

Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1

---
 drivers/net/wireless/ath/ath10k/wmi.c | 1 +
 1 file changed, 1 insertion(+)

index e595b0979a56d..b3b00d324075b 100644
@@ -1937,6 +1937,7 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
 	if (cmd_id == WMI_CMD_UNSUPPORTED) {
 		ath10k_warn(ar, "wmi command %d is not supported by firmware\n",
 			    cmd_id);
+		dev_kfree_skb_any(skb);
 		return ret;
 	}
 

2.51.0

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mark Pearson <[email protected]>

[ Upstream commit 0eb002c93c3b47f88244cecb1e356eaeab61a6bf ]

Lenovo platforms can come with one of two different IDs. The pm_quirk table was missing the second ID for each platform.

Add missing ID and some extra platform identification comments. Reported on https://bugzilla.kernel.org/show_bug.cgi?id=219196

Tested-on: P14s G4 AMD.

---
 drivers/net/wireless/ath/ath11k/core.c | 54 +++++++++++++++++++++++---
 1 file changed, 48 insertions(+), 6 deletions(-)

index 2810752260f2f..812686173ac8a 100644
@@ -912,42 +912,84 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
 static const struct dmi_system_id ath11k_pm_quirk_table[] = {
 	{
 		.driver_data = (void *)ATH11K_PM_WOW,
-		.matches = {
+		.matches = { /* X13 G4 AMD #1 */
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21J3"),
+		},
+	},
+	{
+		.driver_data = (void *)ATH11K_PM_WOW,
+		.matches = { /* X13 G4 AMD #2 */
 			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "21J4"),
 		},
 	},
 	{
 		.driver_data = (void *)ATH11K_PM_WOW,
-		.matches = {
+		.matches = { /* T14 G4 AMD #1 */
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21K3"),
+		},
+	},
+	{
+		.driver_data = (void *)ATH11K_PM_WOW,
+		.matches = { /* T14 G4 AMD #2 */
 			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "21K4"),
 		},
 	},
 	{
 		.driver_data = (void *)ATH11K_PM_WOW,
-		.matches = {
+		.matches = { /* P14s G4 AMD #1 */
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21K5"),
+		},
+	},
+	{
+		.driver_data = (void *)ATH11K_PM_WOW,
+		.matches = { /* P14s G4 AMD #2 */
 			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "21K6"),
 		},
 	},
 	{
 		.driver_data = (void *)ATH11K_PM_WOW,
-		.matches = {
+		.matches = { /* T16 G2 AMD #1 */
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21K7"),
+		},
+	},
+	{
+		.driver_data = (void *)ATH11K_PM_WOW,
+		.matches = { /* T16 G2 AMD #2 */
 			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "21K8"),
 		},
 	},
 	{
 		.driver_data = (void *)ATH11K_PM_WOW,
-		.matches = {
+		.matches = { /* P16s G2 AMD #1 */
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21K9"),
+		},
+	},
+	{
+		.driver_data = (void *)ATH11K_PM_WOW,
+		.matches = { /* P16s G2 AMD #2 */
 			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "21KA"),
 		},
 	},
 	{
 		.driver_data = (void *)ATH11K_PM_WOW,
-		.matches = {
+		.matches = { /* T14s G4 AMD #1 */
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21F8"),
+		},
+	},
+	{
+		.driver_data = (void *)ATH11K_PM_WOW,
+		.matches = { /* T14s G4 AMD #2 */
 			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "21F9"),
 		},

2.51.0

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Karthik M <[email protected]>

[ Upstream commit 92282074e1d2e7b6da5c05fe38a7cc974187fe14 ]

ath12k just like ath11k [1] did not handle skb cleanup during idr cleanup callback. Both ath12k_mac_vif_txmgmt_idr_remove() and ath12k_mac_tx_mgmt_pending_free() performed idr cleanup and DMA unmapping for skb but only ath12k_mac_tx_mgmt_pending_free() freed skb. As a result, during vdev deletion a memory leak occurs.

Refactor all clean up steps into a new function. New function ath12k_mac_tx_mgmt_free() creates a centralized area where idr cleanup, DMA unmapping for skb and freeing skb is performed. Utilize skb pointer given by idr_remove(), instead of passed as a function argument because IDR will be protected by locking. This will prevent concurrent modification of the same IDR.

Now ath12k_mac_tx_mgmt_pending_free() and ath12k_mac_vif_txmgmt_idr_remove() call ath12k_mac_tx_mgmt_free().

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1

---
 drivers/net/wireless/ath/ath12k/mac.c | 34 ++++++++++++++-------------
 1 file changed, 18 insertions(+), 16 deletions(-)

index 2644b5d4b0bc8..d717e74b01c89 100644
@@ -8304,23 +8304,32 @@ static void ath12k_mgmt_over_wmi_tx_drop(struct ath12k *ar, struct sk_buff *skb)
 		wake_up(&ar->txmgmt_empty_waitq);
 }
 
-int ath12k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx)
+static void ath12k_mac_tx_mgmt_free(struct ath12k *ar, int buf_id)
 {
-	struct sk_buff *msdu = skb;
+	struct sk_buff *msdu;
 	struct ieee80211_tx_info *info;
-	struct ath12k *ar = ctx;
-	struct ath12k_base *ab = ar->ab;
 
 	spin_lock_bh(&ar->txmgmt_idr_lock);
-	idr_remove(&ar->txmgmt_idr, buf_id);
+	msdu = idr_remove(&ar->txmgmt_idr, buf_id);
 	spin_unlock_bh(&ar->txmgmt_idr_lock);
-	dma_unmap_single(ab->dev, ATH12K_SKB_CB(msdu)->paddr, msdu->len,
+
+	if (!msdu)
+		return;
+
+	dma_unmap_single(ar->ab->dev, ATH12K_SKB_CB(msdu)->paddr, msdu->len,
 			 DMA_TO_DEVICE);
 
 	info = IEEE80211_SKB_CB(msdu);
 	memset(&info->status, 0, sizeof(info->status));
 
-	ath12k_mgmt_over_wmi_tx_drop(ar, skb);
+	ath12k_mgmt_over_wmi_tx_drop(ar, msdu);
+}
+
+int ath12k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx)
+{
+	struct ath12k *ar = ctx;
+
+	ath12k_mac_tx_mgmt_free(ar, buf_id);
 
 	return 0;
 }

@@ -8329,17 +8338,10 @@ static int ath12k_mac_vif_txmgmt_idr_remove(int buf_id, void *skb, void *ctx)
 {
 	struct ieee80211_vif *vif = ctx;
 	struct ath12k_skb_cb *skb_cb = ATH12K_SKB_CB(skb);
-	struct sk_buff *msdu = skb;
 	struct ath12k *ar = skb_cb->ar;
-	struct ath12k_base *ab = ar->ab;
 
-	if (skb_cb->vif == vif) {
-		spin_lock_bh(&ar->txmgmt_idr_lock);
-		idr_remove(&ar->txmgmt_idr, buf_id);
-		spin_unlock_bh(&ar->txmgmt_idr_lock);
-		dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len,
-				 DMA_TO_DEVICE);
-	}
+	if (skb_cb->vif == vif)
+		ath12k_mac_tx_mgmt_free(ar, buf_id);
 
 	return 0;
 }

2.51.0

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rameshkumar Sundaram <[email protected]>

[ Upstream commit 9c78e747dd4fee6c36fcc926212e20032055cf9d ]

Bitwise operations with WMI_KEY_PAIRWISE (defined as 0) are ineffective and misleading. This results in pairwise key validations added in commit 97acb0259cc9 ("wifi: ath11k: fix group data packet drops during rekey") to always evaluate false and clear key commands for pairwise keys are not honored.

Since firmware supports overwriting the new key without explicitly clearing the previous one, there is no visible impact currently. However, to restore consistency with the previous behavior and improve clarity, replace bitwise operations with direct assignments and comparisons for key flags.

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41

---
 drivers/net/wireless/ath/ath11k/mac.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

index 106e2530b64e9..0e41b5a91d66d 100644
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
  */
 
 #include <net/mac80211.h>

@@ -4417,9 +4417,9 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 	}
 
 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
-		flags |= WMI_KEY_PAIRWISE;
+		flags = WMI_KEY_PAIRWISE;
 	else
-		flags |= WMI_KEY_GROUP;
+		flags = WMI_KEY_GROUP;
 
 	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
 		   "%s for peer %pM on vdev %d flags 0x%X, type = %d, num_sta %d\n",

@@ -4456,7 +4456,7 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
 	is_ap_with_no_sta = (vif->type == NL80211_IFTYPE_AP &&
 			     !arvif->num_stations);
-	if ((flags & WMI_KEY_PAIRWISE) || cmd == SET_KEY || is_ap_with_no_sta) {
+	if (flags == WMI_KEY_PAIRWISE || cmd == SET_KEY || is_ap_with_no_sta) {
 		ret = ath11k_install_key(arvif, key, cmd, peer_addr, flags);
 		if (ret) {
 			ath11k_warn(ab, "ath11k_install_key failed (%d)\n", ret);

@@ -4470,7 +4470,7 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 			goto exit;
 		}
 
-		if ((flags & WMI_KEY_GROUP) && cmd == SET_KEY && is_ap_with_no_sta)
+		if (flags == WMI_KEY_GROUP && cmd == SET_KEY && is_ap_with_no_sta)
 			arvif->reinstall_group_keys = true;
 	}
 

2.51.0

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rob Clark <[email protected]>

[ Upstream commit c34e08ba6c0037a72a7433741225b020c989e4ae ]

Imported dma-bufs also have obj->resv != &obj->_resv. So we should check both this condition in addition to flags for handling the _NO_SHARE case.

Fixes this splat that was reported with IRIS video playback:

    ------------[ cut here ]------------
    WARNING: CPU: 3 PID: 2040 at drivers/gpu/drm/msm/msm_gem.c:1127 msm_gem_free_object+0x1f8/0x264 [msm]
    CPU: 3 UID: 1000 PID: 2040 Comm: .gnome-shell-wr Not tainted 6.17.0-rc7 #1 PREEMPT
    pstate: 81400005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
    pc : msm_gem_free_object+0x1f8/0x264 [msm]
    lr : msm_gem_free_object+0x138/0x264 [msm]
    sp : ffff800092a1bb30
    x29: ffff800092a1bb80 x28: ffff800092a1bce8 x27: ffffbc702dbdbe08
    x26: 0000000000000008 x25: 0000000000000009 x24: 00000000000000a6
    x23: ffff00083c72f850 x22: ffff00083c72f868 x21: ffff00087e69f200
    x20: ffff00087e69f330 x19: ffff00084d157ae0 x18: 0000000000000000
    x17: 0000000000000000 x16: ffffbc704bd46b80 x15: 0000ffffd0959540
    x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
    x11: ffffbc702e6cdb48 x10: 0000000000000000 x9 : 000000000000003f
    x8 : ffff800092a1ba90 x7 : 0000000000000000 x6 : 0000000000000020
    x5 : ffffbc704bd46c40 x4 : fffffdffe102cf60 x3 : 0000000000400032
    x2 : 0000000000020000 x1 : ffff00087e6978e8 x0 : ffff00087e6977e8
    Call trace:
     msm_gem_free_object+0x1f8/0x264 [msm] (P)
     drm_gem_object_free+0x1c/0x30 [drm]
     drm_gem_object_handle_put_unlocked+0x138/0x150 [drm]
     drm_gem_object_release_handle+0x5c/0xcc [drm]
     drm_gem_handle_delete+0x68/0xbc [drm]
     drm_gem_close_ioctl+0x34/0x40 [drm]
     drm_ioctl_kernel+0xc0/0x130 [drm]
     drm_ioctl+0x360/0x4e0 [drm]
     __arm64_sys_ioctl+0xac/0x104
     invoke_syscall+0x48/0x104
     el0_svc_common.constprop.0+0x40/0xe0
     do_el0_svc+0x1c/0x28
     el0_svc+0x34/0xec
     el0t_64_sync_handler+0xa0/0xe4
     el0t_64_sync+0x198/0x19c
    ---[ end trace 0000000000000000 ]---
    ------------[ cut here ]------------

Patchwork: https://patchwork.freedesktop.org/patch/676273/
Message-ID: <[email protected]>

---
 drivers/gpu/drm/msm/msm_gem.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

index e7631f4ef5309..0745d958f3987 100644
@@ -1120,12 +1120,16 @@ static void msm_gem_free_object(struct drm_gem_object *obj)
 		put_pages(obj);
 	}
 
-	if (obj->resv != &obj->_resv) {
+	/*
+	 * In error paths, we could end up here before msm_gem_new_handle()
+	 * has changed obj->resv to point to the shared resv.  In this case,
+	 * we don't want to drop a ref to the shared r_obj that we haven't
+	 * taken yet.
+	 */
+	if ((msm_obj->flags & MSM_BO_NO_SHARE) && (obj->resv != &obj->_resv)) {
 		struct drm_gem_object *r_obj =
 			container_of(obj->resv, struct drm_gem_object, _resv);
 
-		WARN_ON(!(msm_obj->flags & MSM_BO_NO_SHARE));
-
 		/* Drop reference we hold to shared resv obj: */
 		drm_gem_object_put(r_obj);
 	}

2.51.0

6.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Akhil P Oommen <[email protected]>

[ Upstream commit b4789aac9d3441d9f830f0a4022d8dc122d6cab3 ]

Current parser logic for GMU firmware assumes a dword aligned payload size for every block. This is not true for all GMU firmwares. So, fix this by using correct 'size' value in the calculation for the offset for the next block's header.

Patchwork: https://patchwork.freedesktop.org/patch/674040/
Message-ID: <[email protected]>

---
 drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index 3369a03978d53..ee82489025c3c 100644
@@ -766,6 +766,9 @@ static bool fw_block_mem(struct a6xx_gmu_bo *bo, const struct block_header *blk)
 	return true;
 }
 
+#define NEXT_BLK(blk) \
+	((const struct block_header *)((const char *)(blk) + sizeof(*(blk)) + (blk)->size))
+
 static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu)
 {
 	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);

@@ -797,7 +800,7 @@ static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu)
 
 	for (blk = (const struct block_header *) fw_image->data;
 	     (const u8*) blk < fw_image->data + fw_image->size;
-	     blk = (const struct block_header *) &blk->data[blk->size >> 2]) {
+	     blk = NEXT_BLK(blk)) {
 		if (blk->size == 0)
 			continue;
 

2.51.0

6.17-stable review patch. If anyone has any objections, please let me know.

------------------