6.18.32-rc1 review

This is the start of the stable review cycle for the 6.18.32 release. There are 957 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 22 May 2026 16:20:16 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.32-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.18.32-rc1

Johan Hovold <[email protected]>
spi: sifive: fix controller deregistration

Pei Xiao <[email protected]>
spi: sifive: Simplify clock handling with devm_clk_get_enabled()

Chao Yu <[email protected]>
f2fs: fix false alarm of lockdep on cp_global_sem lock

Tejun Heo <[email protected]>
sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before

Tejun Heo <[email protected]>

    sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed iter_new

Dapeng Mi <[email protected]>
perf/x86/intel: Disable PMI for self-reloaded ACR events

Qu Wenruo <[email protected]>
btrfs: do not mark inode incompressible after inline attempt fails

Piyush Sachdeva <[email protected]>
smb: client: Use FullSessionKey for AES-256 encryption key derivation

David Carlier <[email protected]>
eventfs: Use list_add_tail_rcu() for SRCU-protected children list

Ashutosh Desai <[email protected]>
drm/v3d: Reject empty multisync extension to prevent infinite loop

Johan Hovold <[email protected]>
drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init

Johan Hovold <[email protected]>
drm/gma500/oaktrail_lvds: fix hang on init failure

Johan Hovold <[email protected]>
drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup

Thomas Hellström <[email protected]>
drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC

Matthew Auld <[email protected]>
drm/xe/dma-buf: fix UAF with retry loop

Matthew Auld <[email protected]>
drm/xe/dma-buf: handle empty bo and UAF races

Gyeyoung Baek <[email protected]>
drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()

Sebastian Brzezinka <[email protected]>
drm/i915: skip __i915_request_skip() for already signaled requests

Zhenzhong Duan <[email protected]>
iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

Zhenzhong Duan <[email protected]>
iommu/vt-d: Fix oops due to out of scope access

Naval Alcalá <[email protected]>
iommu/vt-d: Disable DMAR for Intel Q35 IGFX

Raphael Zimmer <[email protected]>
libceph: handle rbtree insertion error in decode_choose_args()

Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in crush_decode()

Raphael Zimmer <[email protected]>
libceph: Fix potential null-ptr-deref in decode_choose_args()

Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in osdmap_decode()

Sascha Bischoff <[email protected]>
irqchip/gic-v5: Allocate ITS parent LPIs as a range

Sascha Bischoff <[email protected]>
irqchip/gic-v5: Support range allocation for LPIs

Sascha Bischoff <[email protected]>
irqchip/gic-v5: Move LPI allocation into the LPI domain

Xianwei Zhao <[email protected]>
irqchip/meson-gpio: Use the correct register in meson_s4_gpio_irq_set_type()

Yong-Xuan Wang <[email protected]>
irqchip/riscv-imsic: Clear interrupt move state during CPU offlining

Scott Mayhew <[email protected]>
nfsd: fix file change detection in CB_GETATTR

Paulo Alcantara <[email protected]>
netfs: fix error handling in netfs_extract_user_iter()

Ma Ke <[email protected]>
powerpc/warp: Fix error handling in pika_dtm_thread

Vivian Wang <[email protected]>
riscv: misaligned: Make enabling delegation depend on NONPORTABLE

Carlos López <[email protected]>
virt: sev-guest: Do not use host-controlled page order in cleanup path

Wilfred Mallawa <[email protected]>
xfs: fix memory leak on error in xfs_alloc_zone_info()

David Woodhouse <[email protected]>
x86/kexec: Push kjump return address even for non-kjump kexec

Jose Fernandez (Anthropic) <[email protected]>
iommu/amd: Bounds-check devid in __rlookup_amd_iommu()

Nicholas Carlini <[email protected]>
io-wq: check that the predecessor is hashed in io_wq_remove_pending()

Viacheslav Dubeyko <[email protected]>
ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size

Viacheslav Dubeyko <[email protected]>
ceph: fix a buffer leak in __ceph_setxattr()

Qu Wenruo <[email protected]>
btrfs: only release the dirty pages io tree after successful writes

Cássio Gabriel <[email protected]>
ALSA: usb-audio: qcom: Check offload mapping failures

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Bound MIDI endpoint descriptor scans

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

Markus Kramer <[email protected]>
ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone

Adrien Burnett <[email protected]>

    ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx

Gyeyoung Baek <[email protected]>
accel/rocket: Fix prep_bo ioctl leaking positive return from dma_resv_wait_timeout()

Derek J. Clark <[email protected]>
platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members

Derek J. Clark <[email protected]>
platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers

Srinivas Pandruvada <[email protected]>
platform/x86: intel: Move debugfs register before creating devices

Chaitanya Kumar Borah <[email protected]>
drm/i915/dp: Fix VSC dynamic range signaling for RGB formats

Edward Adam Davis <[email protected]>
drm: Replace old pointer to new idr

Myeonghun Pak <[email protected]>
drm/loongson: Use managed KMS polling

Ye Bin <[email protected]>
smb/client: fix possible infinite loop and oob read in symlink_data()

Nick Chan <[email protected]>

    nvme-apple: Reset q->sq_tail during queue init

Pauli Virtanen <[email protected]>
Bluetooth: btmtk: accept too short WMT FUNC_CTRL events

Michael Tretter <[email protected]>
media: staging: imx: configure src_mux in csi_start

Igor Pylypiv <[email protected]>
ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands

Vlad Poenaru <[email protected]>

    fuse: avoid 0x10 fault in fuse_readahead when max_pages == 0

Nathan Chancellor <[email protected]>
HID: core: Fix size_t specifier in hid_report_raw_event()

Benjamin Tissoires <[email protected]>
HID: core: introduce hid_safe_input_report()

Benjamin Tissoires <[email protected]>
HID: pass the buffer size to hid_report_raw_event

Qiang Ma <[email protected]>
KVM: x86: Fix Xen hypercall tracepoint argument assignment

Junrui Luo <[email protected]>
KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

Aaron Sacks <[email protected]>
KVM: Reject wrapped offset in kvm_reset_dirty_gfn()

Sergio Correia <[email protected]>
audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV

Zoran Ilievski <[email protected]>
net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled

Li Xiasong <[email protected]>
netfilter: nft_ct: fix missing expect put in obj eval

Mario Limonciello <[email protected]>
Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn"

Greg Kroah-Hartman <[email protected]>
idpf: fix double free and use-after-free in aux device error paths

Guopeng Zhang <[email protected]>
cgroup/dmem: Return -ENOMEM on failed pool preallocation

Arthur Kiyanovski <[email protected]>
net: ena: PHC: Check return code before setting timestamp output

Sergio Correia <[email protected]>
audit: fix incorrect inheritable capability in CAPSET records

Li Xiasong <[email protected]>
netfilter: nf_conntrack_sip: get helper before allocating expectation

Arthur Kiyanovski <[email protected]>
net: ena: PHC: Fix potential use-after-free in get_timestamp

Breno Leitao <[email protected]>

    workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path

Matt Vollrath <[email protected]>
i40e: Cleanup PTP pins on probe failure

Herbert Xu <[email protected]>

    crypto: af_alg - Cap AEAD AD length to 0x80000000

Vincent Guittot <[email protected]>
sched/fair: Revert force wakeup preemption

Vincent Guittot <[email protected]>
sched/fair: Fix wakeup_preempt_fair() for not waking up task

Erni Sri Satya Vennela <[email protected]>
net: mana: Init gf_stats_work before potential error paths in probe

Dipayaan Roy <[email protected]>
net: mana: Fix use-after-free in reset service rescan path

Lorenzo Bianconi <[email protected]>
net: airoha: Fix VIP configuration for AN7583 SoC

Lorenzo Bianconi <[email protected]>
net: airoha: Use gdm port enum value whenever possible

Lorenzo Bianconi <[email protected]>
net: airoha: Remove code duplication in airoha_regs.h

Eric Dumazet <[email protected]>
net/sched: sch_pie: annotate more data-races in pie_dump_stats()

Lorenzo Bianconi <[email protected]>
net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()

Lorenzo Bianconi <[email protected]>
net: airoha: Move entries to queue head in case of DMA mapping failure in airoha_dev_xmit()

Costa Shulyupin <[email protected]>
rtla: Fix parse_cpu_set() bug introduced by strtoi()

Miklos Szeredi <[email protected]>
fuse: make sure dentry is evicted if stale

Miklos Szeredi <[email protected]>
fuse: fix race when disposing stale dentries

Dan Carpenter <[email protected]>
net: airoha: Fix a copy and paste bug in probe()

Daniel Borkmann <[email protected]>
bpf: Fix sync_linked_regs regarding BPF_ADD_CONST32 zext propagation

Gao Xiang <[email protected]>
erofs: fix offset truncation when shifting pgoff on 32-bit platforms

Samiullah Khawaja <[email protected]>
PCI: Initialize temporary device in new_id_store()

Sasha Levin <[email protected]>
Revert "papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()"

Sasha Levin <[email protected]>
Revert "pseries/papr-hvpipe: Fix race with interrupt handler"

Davidlohr Bueso <[email protected]>
futex: Drop CLONE_THREAD requirement for private default hash alloc

Zhaoyang Huang <[email protected]>
arm64: Reserve an extra page for early kernel mapping

Leo Yan <[email protected]>
kselftest/arm64: Include <asm/ptrace.h> for user_gcs definition

Paolo Abeni <[email protected]>
net/sched: cls_flower: revert unintended changes

Dan Carpenter <[email protected]>
sfc: fix error code in efx_devlink_info_running_versions()

Jakub Kicinski <[email protected]>
net: tls: fix strparser anchor skb leak on offload RX setup failure

Petr Oros <[email protected]>
ice: add dpll peer notification for paired SMA and U.FL pins

Ivan Vecera <[email protected]>
dpll: export __dpll_pin_change_ntf() for use under dpll_lock

Petr Oros <[email protected]>
dpll: Add notifier chain for dpll events

Ivan Vecera <[email protected]>
dpll: Allow associating dpll pin with a firmware node

Petr Oros <[email protected]>
ice: fix missing dpll notifications for SW pins

Petr Oros <[email protected]>
ice: fix SMA and U.FL pin state changes affecting paired pin

Petr Oros <[email protected]>
ice: fix missing SMA pin initialization in DPLL subsystem

Petr Oros <[email protected]>
ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw

Petr Oros <[email protected]>
ice: fix NULL pointer dereference in ice_reset_all_vfs()

Petr Oros <[email protected]>
iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler

Petr Oros <[email protected]>
iavf: wait for PF confirmation before removing VLAN filters

Petr Oros <[email protected]>
iavf: stop removing VLAN filters from PF on interface down

Petr Oros <[email protected]>
iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING

Hasan Basbunar <[email protected]>
page_pool: fix memory-provider leak in page_pool_create_percpu() error path

Eric Dumazet <[email protected]>

    bonding: 3ad: implement proper RCU rules for port->aggregator

Hangbin Liu <[email protected]>
bonding: print churn state via netlink

Lorenzo Bianconi <[email protected]>
net: airoha: Do not return err in ndo_stop() callback

Lorenzo Bianconi <[email protected]>
net: airoha: fix BQL imbalance in TX path

Shuicheng Lin <[email protected]>
drm/xe/gsc: Fix BO leak on error in query_compatibility_version()

Shuicheng Lin <[email protected]>
drm/xe/eustall: Fix drm_dev_put called before stream disable in close

Shuicheng Lin <[email protected]>
drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

Matt Roper <[email protected]>
drm/xe/debugfs: Correct printing of register whitelist ranges

Timur Kristóf <[email protected]>
drm/amd/display: Read EDID from VBIOS embedded panel info

Timur Kristóf <[email protected]>
drm/amd/display: Allow constructing DCE8 link encoder without DDC

Timur Kristóf <[email protected]>
drm/amd/display: Allow constructing DCE6 link encoder without DDC

Timur Kristóf <[email protected]>
drm/amd/display: Allow DCE link encoder without AUX registers

Sebastian Andrzej Siewior <[email protected]>
futex: Prevent lockup in requeue-PI during signal/ timeout wakeup

Shenghao Ding <[email protected]>
ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0 pages >1

Richard Fitzgerald <[email protected]>
ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()

wangdicheng <[email protected]>
ALSA: hda/conexant: Fix missing error check for jack detection

Breno Leitao <[email protected]>
netconsole: propagate device name truncation in dev_name_store()

Eric Dumazet <[email protected]>
net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)

Eric Dumazet <[email protected]>
net/sched: sch_cake: annotate data-races in cake_dump_stats() (III)

Weiming Shi <[email protected]>
bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

Xin Long <[email protected]>
sctp: discard stale INIT after handshake completion

Xin Long <[email protected]>
netfilter: skip recording stale or retransmitted INIT

Christian A. Ehrhardt <[email protected]>
ASoC: codecs: ab8500: Fix casting of private data

Jakub Kicinski <[email protected]>
net: psp: require admin permission for dev-set and key-rotate

Jakub Kicinski <[email protected]>
net: psp: check for device unregister when creating assoc

Jens Axboe <[email protected]>
io_uring/napi: cap busy_poll_to 10 msec

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings

Heiko Schocher <[email protected]>
net: phy: dp83869: fix setting CLK_O_SEL field.

Heiko Carstens <[email protected]>
s390/mm: Fix phys_to_folio() usage in do_secure_storage_access()

Yu Kuai <[email protected]>
md/md-bitmap: add a none backend for bitmap grow

Yu Kuai <[email protected]>
md/md-bitmap: split bitmap sysfs groups

Yu Kuai <[email protected]>
md: factor bitmap creation away from sysfs handling

Yu Kuai <[email protected]>
md: add fallback to correct bitmap_ops on version mismatch

Keith Busch <[email protected]>
md/raid1,raid10: don't fail devices for invalid IO errors

William A. Kennington III <[email protected]>
net: mctp i2c: check length before marking flow active

Zicheng Qu <[email protected]>
sched/fair: Clear rel_deadline when initializing forked entities

Vincent Guittot <[email protected]>
sched/fair: Fix wakeup_preempt_fair() vs delayed dequeue

Mel Gorman <[email protected]>
sched/fair: Reimplement NEXT_BUDDY to align with EEVDF goals

Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams

Breno Leitao <[email protected]>
netpoll: fix IPv6 local-address corruption

Altan Hacigumus <[email protected]>
tcp: make probe0 timer handle expired user timeout

Florian Westphal <[email protected]>
neigh: let neigh_xmit take skb ownership

Weiming Shi <[email protected]>
net/sched: taprio: fix NULL pointer dereference in class dump

Paul Geurts <[email protected]>
NFC: trf7970a: Ignore antenna noise when checking for RF field

Felix Gu <[email protected]>
spi: amlogic-spisg: initialize completion before requesting IRQ

Morduan Zang <[email protected]>
net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit

Zhan Jun <[email protected]>

    net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()

Ido Schimmel <[email protected]>
vrf: Fix a potential NPD when removing a port from a VRF

Eric Dumazet <[email protected]>
net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_choke: annotate data-races in choke_dump_stats()

Lorenzo Bianconi <[email protected]>
net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()

Lorenzo Bianconi <[email protected]>
net: airoha: Do not wake all netdev TX queues in airoha_qdma_wake_netdev_txqs()

Zhengping Zhang <[email protected]>
net: airoha: fix typo in function name

Lorenzo Bianconi <[email protected]>
net: airoha: stop net_device TX queue before updating CPU index

Stephen Hemminger <[email protected]>
net/sched: netem: check for negative latency and jitter

Stephen Hemminger <[email protected]>
net/sched: netem: fix slot delay calculation overflow

Stephen Hemminger <[email protected]>
net/sched: netem: validate slot configuration

Stephen Hemminger <[email protected]>
net/sched: netem: only reseed PRNG when seed is explicitly provided

Stephen Hemminger <[email protected]>
net/sched: netem: fix queue limit check to include reordered packets

Stephen Hemminger <[email protected]>
net/sched: netem: fix probability gaps in 4-state loss model

Nikola Z. Ivanov <[email protected]>
netdevsim: zero initialize struct iphdr in dummy sk_buff

Daan De Meyer <[email protected]>
cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()

Tony Luck <[email protected]>
ACPI: APEI: EINJ: Fix EINJV2 memory error injection

Tony Luck <[email protected]>
ACPICA: Provide #defines for EINJV2 error types

Wentao Guan <[email protected]>
arm64/scs: Fix potential sign extension issue of advance_loc4

Geert Uytterhoeven <[email protected]>

    drm/color-mgmt: Typo s/R332/RGB332/

Yuho Choi <[email protected]>
drm/sysfb: ofdrm: fix PCI device reference leaks

James Calligeros <[email protected]>
ASoC: tas2770: Fix order of operations for temperature calculation

James Calligeros <[email protected]>
ASoC: tas2764: Mark die temp register as volatile

John Madieu <[email protected]>
spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ

Guilherme G. Piccoli <[email protected]>
ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED

Florian Westphal <[email protected]>
netfilter: nf_conntrack_sip: don't use simple_strtoul

Jiexun Wang <[email protected]>
netfilter: xt_policy: fix strict mode inbound policy matching

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)

Timur Kristóf <[email protected]>
drm/amdgpu/uvd3.1: Don't validate the firmware when already validated

Christian König <[email protected]>
drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG

Timur Kristóf <[email protected]>
drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM

Keith Busch <[email protected]>
nvme-pci: fix missed admin queue sq doorbell write

Florian Westphal <[email protected]>
netfilter: nf_tables: use list_del_rcu for netlink hooks

Pablo Neira Ayuso <[email protected]>
netfilter: arp_tables: fix IEEE1394 ARP payload parsing

Maurizio Lombardi <[email protected]>
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

Breno Leitao <[email protected]>
tracing: branch: Fix inverted check on stat tracer registration

Petr Malat <[email protected]>
cgroup: Increment nr_dying_subsys_* from rmdir context

Mark Harmstone <[email protected]>
btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()

Amir Goldstein <[email protected]>
fsnotify: fix inode reference leak in fsnotify_recalc_mask()

Wolfram Sang <[email protected]>
mailbox: mailbox-test: make data_ready a per-instance variable

Wolfram Sang <[email protected]>
mailbox: mailbox-test: initialize struct earlier

Wolfram Sang <[email protected]>
mailbox: mailbox-test: don't free the reused channel

Wolfram Sang <[email protected]>
mailbox: add sanity check for channel array

cuitao <[email protected]>
cgroup/rdma: fix integer overflow in rdmacg_try_charge()

Edward Adam Davis <[email protected]>
sched/psi: fix race between file release and pressure write

Wolfram Sang <[email protected]>
mailbox: mailbox-test: free channels on probe error

Jason-JH Lin <[email protected]>
mailbox: mtk-cmdq: Fix CURR and END addr for task insert case

Thomas Weißschuh <[email protected]>
kbuild: Never respect CONFIG_WERROR / W=e to fixdep

David Arcari <[email protected]>
tools/power turbostat: Fix unrecognized option '-P'

Len Brown <[email protected]>

    tools/power turbostat: Fix and document --header_iterations

Kaushlendra Kumar <[email protected]>
tools/power turbostat: Use strtoul() for iteration parsing

Len Brown <[email protected]>
tools/power turbostat.8: Document the "--force" option

Yuho Choi <[email protected]>
fbdev: offb: fix PCI device reference leak on probe failure

Mathias Krause <[email protected]>
kbuild: builddeb - avoid recompiles for non-cross-compiles

Anthony Pighin (Nokia) <[email protected]>

    rtc: abx80x: Disable alarm feature if no interrupt attached

Bae Yeonju <[email protected]>
fs/adfs: validate nzones in adfs_validate_bblk()

Christian Brauner <[email protected]>
eventpoll: fix ep_remove struct eventpoll / struct file UAF

Christian Brauner <[email protected]>
eventpoll: move epi_fget() up

Christian Brauner <[email protected]>
eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()

Christian Brauner <[email protected]>
eventpoll: kill __ep_remove()

Christian Brauner <[email protected]>
eventpoll: split __ep_remove()

Christian Brauner <[email protected]>
eventpoll: use hlist_is_singular_node() in __ep_remove()

Randy Dunlap <[email protected]>
nstree: fix func. parameter kernel-doc warnings

Kohei Enju <[email protected]>
vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()

Lee Jones <[email protected]>
tipc: fix double-free in tipc_buf_append()

Jiayuan Chen <[email protected]>
tcp: send a challenge ACK on SEG.ACK > SND.NXT

Alexey Kodanev <[email protected]>
nfp: fix swapped arguments in nfp_encode_basic_qdr() calls

Brett Creeley <[email protected]>
virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via VQ_PAIRS_SET

Stefano Garzarella <[email protected]>
vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting

Erni Sri Satya Vennela <[email protected]>
net: mana: Fix EQ leak in mana_remove on NULL port

Dipayaan Roy <[email protected]>
net: mana: Implement ndo_tx_timeout and serialize queue resets per port.

Long Li <[email protected]>
net: mana: Handle hardware recovery events when probing the device

Aditya Garg <[email protected]>
net: mana: Handle SKB if TX SGEs exceed hardware limit

Erni Sri Satya Vennela <[email protected]>
net: mana: Don't overwrite port probe error with add_adev result

Erni Sri Satya Vennela <[email protected]>
net: mana: Add standard counter rx_missed_errors

Erni Sri Satya Vennela <[email protected]>
net: mana: Move hardware counter stats from per-port to per-VF context

Erni Sri Satya Vennela <[email protected]>
net: mana: Guard mana_remove against double invocation

Erni Sri Satya Vennela <[email protected]>
net: mana: Init link_change_work before potential error paths in probe

Lorenzo Bianconi <[email protected]>
net: airoha: Add size check for TX NAPIs in airoha_qdma_cleanup()

Lorenzo Bianconi <[email protected]>
net: airoha: Rework the code flow in airoha_remove() and in airoha_probe() error path

Lorenzo Bianconi <[email protected]>
net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()

Mieczyslaw Nalewaj <[email protected]>
net: dsa: realtek: rtl8365mb: fix mode mask calculation

Lorenzo Bianconi <[email protected]>
net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()

Lorenzo Bianconi <[email protected]>
net: airoha: Add the capability to consume out-of-order DMA tx descriptors

Lorenzo Bianconi <[email protected]>
net: airoha: Add AN7583 SoC support

Lorenzo Bianconi <[email protected]>
net: airoha: Refactor src port configuration in airhoha_set_gdm2_loopback

Lorenzo Bianconi <[email protected]>
net: airoha: ppe: Move PPE memory info in airoha_eth_soc_data struct

Lorenzo Bianconi <[email protected]>
net: airoha: ppe: Dynamically allocate foe_check_time array in airoha_ppe struct

Eric Dumazet <[email protected]>
net/sched: sch_sfb: annotate data-races in sfb_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_red: annotate data-races in red_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_pie: annotate data-races in pie_dump_stats()

Eric Dumazet <[email protected]>
net_sched: sch_hhf: annotate data-races in hhf_dump_stats()

Jacob Keller <[email protected]>
ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g

Jacob Keller <[email protected]>
ice: fix ready bitmap check for non-E822 devices

Grzegorz Nitka <[email protected]>
ice: perform PHY soft reset for E825C ports at initialization

Grzegorz Nitka <[email protected]>
ice: fix timestamp interrupt configuration for E825C

Michael Bommarito <[email protected]>
net/rds: zero per-item info buffer before handing it to visitors

Vikas Gupta <[email protected]>
bnge: remove unsupported backing store type

Vikas Gupta <[email protected]>
bnge: fix initial HWRM sequence

Kohei Enju <[email protected]>

    net: validate skb->napi_id in RX tracepoints

Hyunwoo Kim <[email protected]>

    ksmbd: scope conn->binding slowpath to bound sessions only

DaeMyung Kang <[email protected]>
ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open

DaeMyung Kang <[email protected]>
ksmbd: destroy async_ida in ksmbd_conn_free()

DaeMyung Kang <[email protected]>
ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()

Sangyun Kim <[email protected]>
pwm: atmel-tcb: Cache clock rates and mark chip as atomic

Jun Yan <[email protected]>
arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number

Anand Moon <[email protected]>
arm64: dts: amlogic: meson-axg: Add missing cache information to cpu0

Chia-Yu Chang <[email protected]>
net/sched: sch_dualpi2: drain both C-queue and L-queue in dualpi2_change()

Weiming Shi <[email protected]>
slip: bound decode() reads against the compressed packet length

Weiming Shi <[email protected]>
slip: reject VJ receive packets on instances with no rstate array

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

Yingnan Zhang <[email protected]>
ipvs: fix MTU check for GSO packets in tunnel mode

Pablo Neira Ayuso <[email protected]>
netfilter: nat: use kfree_rcu to release ops

Pablo Neira Ayuso <[email protected]>
netfilter: xtables: restrict several matches to inet family

Florian Westphal <[email protected]>
netfilter: conntrack: remove sprintf usage

Xiang Mei <[email protected]>
netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

Pablo Neira Ayuso <[email protected]>
netfilter: nft_osf: restrict it to ipv4

Lorenzo Bianconi <[email protected]>
net: airoha: Fix possible TX queue stall in airoha_qdma_tx_napi_poll()

Weiming Shi <[email protected]>
openvswitch: cap upcall PID array size and pre-size vport replies

Prathamesh Deshpande <[email protected]>
net/mlx5: Fix HCA caps leak on notifier init failure

Qingfang Deng <[email protected]>
pppoe: drop PFC frames

Michael Bommarito <[email protected]>
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks

Eric Dumazet <[email protected]>
ipv6: fix possible UAF in icmpv6_rcv()

Matt Vollrath <[email protected]>
e1000e: Unroll PTP in probe error handling

Petr Oros <[email protected]>
iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2

Kohei Enju <[email protected]>
i40e: don't advertise IFF_SUPP_NOFCS

Paul Greenwalt <[email protected]>
ice: fix ICE_AQ_LINK_SPEED_M for 200G

Michal Schmidt <[email protected]>
ice: fix double-free of tx_buf skb

Alice Mikityanska <[email protected]>
ice: Remove jumbo_remove step from TX path

Grzegorz Nitka <[email protected]>
ice: update PCS latency settings for E825 10G/25Gb modes

Grzegorz Nitka <[email protected]>
ice: fix 'adjust' timer programming for E830 devices

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->plb_rehash

Eric Dumazet <[email protected]>

    tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->timeout_rehash

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->srtt_us

Eric Dumazet <[email protected]>
tcp: better handle TCP_TX_DELAY on established flows

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->reord_seen

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->dsack_dups

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->bytes_retrans

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->bytes_sent

Eric Dumazet <[email protected]>
tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->delivered and tp->delivered_ce

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->snd_ssthresh

Eric Dumazet <[email protected]>

    tcp: add data-races annotations around tp->reordering, tp->snd_cwnd

Eric Dumazet <[email protected]>

    tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans

Eric Dumazet <[email protected]>
tcp: annotate data-races in tcp_get_info_chrono_stats()

Eric Dumazet <[email protected]>
tcp: inline tcp_chrono_start()

Eric Dumazet <[email protected]>

    tcp: move tp->chrono_type next tp->chrono_stat[]

Akif <[email protected]>
ksmbd: fix use-after-free in smb2_open during durable reconnect

ZhangGuoDong <[email protected]>
smb: move smb_version_values to common/smbglob.h

Wei Fang <[email protected]>
net: enetc: fix NTMP DMA use-after-free issue

Wei Fang <[email protected]>
net: enetc: correct the command BD ring consumer index

Stanislav Fomichev <[email protected]>
net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops

Vladimir Oltean <[email protected]>
net: dsa: append ethtool counters of all hidden ports to conduit

Vladimir Oltean <[email protected]>
net: dsa: use kernel data types for ethtool ops on conduit

Vladimir Oltean <[email protected]>

    net: dsa: cpu_dp->orig_ethtool_ops might be NULL

Vinicius Costa Gomes <[email protected]>
net/sched: taprio: fix use-after-free in advance_sched() on schedule switch

Lorenzo Bianconi <[email protected]>
net: airoha: Wait for NPU PPE configuration to complete in airoha_ppe_offload_setup()

Jiayuan Chen <[email protected]>
nexthop: fix IPv6 route referencing IPv4 nexthop

Dudu Lu <[email protected]>
net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys

Dudu Lu <[email protected]>
macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF

Dudu Lu <[email protected]>
net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir

Uwe Kleine-König <[email protected]>
pwm: stm32: Fix rounding issue for requests with inverted polarity

Gabor Juhos <[email protected]>
arm64: dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's phy-names

Peng Fan <[email protected]>
arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT

Ronald Claveau <[email protected]>
reset: amlogic: t7: Fix null reset ops

René Rebe <[email protected]>
PCMCIA: Fix garbled log messages for KERN_CONT

Peng Fan <[email protected]>
arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-ultra-mach-sbc: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-sr-som: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-nitrogen-som: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-aristainetos3a-som-v1: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-edm-g: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT

Gao Xiang <[email protected]>
erofs: unify lcn as u64 for 32-bit platforms

Paul Moses <[email protected]>
crypto: ccp - copy IV using skcipher ivsize

T Pratham <[email protected]>
crypto: sa2ul - Fix AEAD fallback algorithm names

Aleksander Jan Bajkowski <[email protected]>
crypto: eip93 - fix hmac setkey algo selection

Sami Mujawar <[email protected]>
virt: arm-cca-guest: fix error check for RSI_INCOMPLETE

Ville Syrjälä <[email protected]>
drm/i915/wm: Verify the correct plane DDB entry

Yongpeng Yang <[email protected]>
f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()

Jaegeuk Kim <[email protected]>
f2fs: allow empty mount string for Opt_usr|grp|projjquota

Brian Masney <[email protected]>
clk: visconti: pll: initialize clk_init_data to zero

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON

Zhiguo Niu <[email protected]>
f2fs: fix to preserve previous reserve_{blocks,node} value when remount

Chao Yu <[email protected]>
f2fs: expand scalability of f2fs mount option

Geert Uytterhoeven <[email protected]>
lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()

Vladimir Zapolskiy <[email protected]>
clk: qcom: gdsc: Fix error path on registration of multiple pm subdomains

Jianan Huang <[email protected]>
f2fs: avoid reading already updated pages during GC

Chao Yu <[email protected]>
f2fs: use f2fs_filemap_get_folio() instead of f2fs_pagecache_get_page()

Shuwei Wu <[email protected]>
clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc()

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-sc7180: Add missing MDSS resets

Konrad Dybcio <[email protected]>
dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets

Geert Uytterhoeven <[email protected]>
clk: xgene: Fix mapping leak in xgene_pllclk_init()

Arnd Bergmann <[email protected]>
clk: qoriq: avoid format string warning

Thomas Weißschuh <[email protected]>
x86/um: fix vDSO installation

Thomas Weißschuh <[email protected]>
x86/um/vdso: Drop VDSO64-y from Makefile

Sebastian Krzyszkowiak <[email protected]>
clk: imx8mq: Correct the CSI PHY sels

Felix Gu <[email protected]>
clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()

Felix Gu <[email protected]>
clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()

Val Packett <[email protected]>
clk: qcom: dispcc-sm8250: Enable parents for pixel clocks

Val Packett <[email protected]>
clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Use retention for PCIe power domains

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Use retention for USB power domains

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Add missing GDSCs

Val Packett <[email protected]>

    dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs

Shawn Lin <[email protected]>
scsi: ufs: rockchip,rk3576-ufshc: dt-bindings: Add new mphy reset item

Junrui Luo <[email protected]>
scsi: target: core: Fix integer overflow in UNMAP bounds check

Fabrizio Castro <[email protected]>

    clk: renesas: r9a09g057: Remove entries for WDT{0,2,3}

Ovidiu Panait <[email protected]>
clk: renesas: r9a09g057: Fix ordering of module clocks array

Lad Prabhakar <[email protected]>
clk: renesas: r9a09g057: Add entries for RSCIs

Ovidiu Panait <[email protected]>
clk: renesas: r9a09g057: Add clock and reset entries for RTC

Konrad Dybcio <[email protected]>
clk: qcom: dispcc[01]-sa8775p: Fix DSI byte clock rate setting

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-milos: Fix DSI byte clock rate setting

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-glymur: Fix DSI byte clock rate setting

White Lewis <[email protected]>

    clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers

Yang Erkun <[email protected]>
scsi: sg: Resolve soft lockup issue when opening /dev/sgX

Yang Erkun <[email protected]>
scsi: sg: Fix sysctl sg-big-buff register during sg_init()

Chen-Yu Tsai <[email protected]>
clk: sunxi-ng: sun55i-a523-r: Add missing r-spi module clock

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-glymur: use RCG2 ops for DPTX1 AUX clock source

Taniya Das <[email protected]>
clk: qcom: gcc-glymur: Add video axi clock resets for glymur

Taniya Das <[email protected]>
dt-bindings: clock: qcom: Add GCC video axi reset clock for Glymur

Florian Westphal <[email protected]>
RDMA/core: Prefer NLA_NUL_STRING

Pengpeng Hou <[email protected]>
platform/x86: dell-wmi-sysman: bound enumeration string aggregation

Fedor Pchelkin <[email protected]>
platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()

Pengpeng Hou <[email protected]>
fs/ntfs3: terminate the cached volume label after UTF-8 conversion

Thomas Bogendoerfer <[email protected]>
tty: serial: ip22zilog: Fix section mispatch warning

Denis Benato <[email protected]>
platform/x86: asus-wmi: fix screenpad brightness range

Denis Benato <[email protected]>
platform/x86: asus-wmi: adjust screenpad power/brightness handling

Dai Ngo <[email protected]>
NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg

Andy Shevchenko <[email protected]>
nfs/blocklayout: Fix compilation error (make W=1) in bl_write_pagelist()

Abdun Nihaal <[email protected]>
mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()

Dmitry Torokhov <[email protected]>
platform/x86: barco-p50-gpio: normalize return value of gpio_get

Rafael J. Wysocki <[email protected]>
platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup

Mostafa Saleh <[email protected]>
usb: typec: ps883x: Fix Oops at unbind

Randy Dunlap <[email protected]>
tty: hvc_iucv: fix off-by-one in number of supported devices

Ethan Tidmore <[email protected]>
usb: typec: Fix error pointer dereference

Chen Ni <[email protected]>

    leds: lgm-sso: Remove duplicate assignments for priv->mmap

Rafael J. Wysocki <[email protected]>
platform/surface: surfacepro3_button: Drop wakeup source on remove

Chen Ni <[email protected]>
backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()

Billy Tsai <[email protected]>
i3c: mipi-i3c-hci: fix IBI payload length calculation for final status

Jorge Marques <[email protected]>
i3c: master: adi: Fix error propagation for CCCs

Jorge Marques <[email protected]>
i3c: master: Fix error codes at send_ccc_cmd

Felix Gu <[email protected]>
i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()

Felix Gu <[email protected]>
i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers()

Felix Gu <[email protected]>
i3c: master: dw-i3c: Fix missing reset assertion in remove() callback

Arnaldo Carvalho de Melo <[email protected]>
perf util: Kill die() prototype, dead for a long time

Ian Rogers <[email protected]>
perf maps: Fix copy_from that can break sorted by name order

Ian Rogers <[email protected]>
perf maps: Fix fixup_overlap_and_insert that can break sorted by name order

Inochi Amaoto <[email protected]>
pinctrl: sophgo: pinctrl-sg2044: Fix wrong module description

Inochi Amaoto <[email protected]>
pinctrl: sophgo: pinctrl-sg2042: Fix wrong module description

Ian Rogers <[email protected]>
perf cgroup: Update metric leader in evlist__expand_cgroup

Jian Zhang <[email protected]>
ipmi: ssif_bmc: change log level to dbg in irq callback

Jian Zhang <[email protected]>
ipmi: ssif_bmc: fix message desynchronization after truncated response

Jian Zhang <[email protected]>
ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure

Leo Yan <[email protected]>
perf expr: Return -EINVAL for syntax error in expr__find_ids()

Chuck Lever <[email protected]>
perf tools: Fix module symbol resolution for non-zero .text sh_addr

Mike Rapoport (Microsoft) <[email protected]>
memblock: reserve_mem: fix end caclulation in reserve_mem_release_by_name()

Ian Rogers <[email protected]>

    perf stat: Fix opt->value type for parse_cache_level

Ian Rogers <[email protected]>
perf lock: Fix option value type in parse_max_stack

Biju Das <[email protected]>
pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers

Yu-Chun Lin <[email protected]>
pinctrl: abx500: Fix type of 'argument' variable

Yu-Chun Lin <[email protected]>
pinctrl: realtek: Fix function signature for config argument

Andy Shevchenko <[email protected]>
pinctrl: pinconf-generic: Fully validate 'pinmux' property

Mike Leach <[email protected]>
perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace

Ian Rogers <[email protected]>
perf branch: Avoid incrementing NULL

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Avoid returning positive values to user space

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: remove duplicate error message

Ian Rogers <[email protected]>
perf trace: Avoid an ERR_PTR in syscall_stats

Ethan Tidmore <[email protected]>
pinctrl: pinctrl-pic32: Fix resource leak

wangguangju <[email protected]>
perf trace: Fix IS_ERR() vs NULL check bug

Puranjay Mohan <[email protected]>
bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT

Puranjay Mohan <[email protected]>
bpf: Validate node_id in arena_alloc_pages()

Jiri Olsa <[email protected]>
libbpf: Prevent double close and leak of btf objects

Yihan Ding <[email protected]>
bpf: allow UTF-8 literals in bpf_bprintf_prepare()

Mykyta Yatsenko <[email protected]>
bpf: Fix NULL deref in map_kptr_match_type for scalar regs

Daniel Borkmann <[email protected]>
bpf: Fix precedence bug in convert_bpf_ld_abs alignment check

Michal Luczaj <[email protected]>
bpf, sockmap: Take state lock for af_unix iter

Michal Luczaj <[email protected]>
bpf, sockmap: Fix af_unix null-ptr-deref in proto update

Michal Luczaj <[email protected]>
bpf, sockmap: Fix af_unix iter deadlock

Puranjay Mohan <[email protected]>
bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator finalize

Puranjay Mohan <[email protected]>
bpf, arm64: Remove redundant bpf_flush_icache() after pack allocator finalize

Daniel Borkmann <[email protected]>
bpf, arm64: Fix off-by-one in check_imm signed range check

Ye Bin <[email protected]>
ext4: fix possible null-ptr-deref in mbt_kunit_exit()

Oliver Neukum <[email protected]>
HID: usbhid: fix deadlock in hid_post_reset()

Miquel Raynal <[email protected]>
mtd: spinand: winbond: Clarify when to enable the HS bit

Miquel Raynal <[email protected]>
mtd: spinand: Give the bus interface to the configuration helper

Miquel Raynal <[email protected]>
mtd: spinand: Add support for setting a bus interface

Miquel Raynal <[email protected]>
mtd: spinand: Gather all the bus interface steps in one single function

Miquel Raynal <[email protected]>
mtd: spinand: winbond: Configure the IO mode after the dummy cycles

Miquel Raynal <[email protected]>
mtd: spinand: winbond: Rename IO_MODE register macro

Miquel Raynal <[email protected]>
mtd: spinand: Create an array of operation templates

Miquel Raynal <[email protected]>
mtd: spinand: Decouple write enable and write disable operations

Miquel Raynal <[email protected]>
mtd: spinand: Add missing check

Richard Genoud <[email protected]>
mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob

Li Ming <[email protected]>
cxl/pci: Check memdev driver binding status in cxl_reset_done()

Cosmin Tanislav <[email protected]>
mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions

Cosmin Tanislav <[email protected]>
mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path

Shiji Yang <[email protected]>
mtd: spi-nor: swp: check SR_TB flag when getting tb_mask

Jonas Gorski <[email protected]>
mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation

Takahiro Kuwano <[email protected]>
mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook

Takahiro Kuwano <[email protected]>
mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook

Haibo Chen <[email protected]>
mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations

Geert Uytterhoeven <[email protected]>
dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range

Dmitry Safonov <[email protected]>
ima_fs: Correctly create securityfs files for unsupported hash algos

Chen Ni <[email protected]>
mtd: physmap_of_gemini: Fix disabled pinctrl state check

Denis Benato <[email protected]>
HID: asus: do not abort probe when not necessary

Denis Benato <[email protected]>
HID: asus: make asus_resume adhere to linux kernel coding standards

Daniel Hodges <[email protected]>
ima: check return value of crypto_shash_final() in boot aggregate

Chen Ni <[email protected]>
remoteproc: imx_rproc: Check return value of regmap_attach_dev() in imx_rproc_mmio_detect_mode()

Thomas Weißschuh <[email protected]>
stop_machine: Fix the documentation for a NULL cpus argument

Tim Michals <[email protected]>
remoteproc: xlnx: Fix sram property parsing

Francesco Lavra <[email protected]>
hte: tegra194: remove Kconfig dependency on Tegra194 SoC

Pengpeng Hou <[email protected]>
tracing: Rebuild full_name on each hist_field_name() call

Arnd Bergmann <[email protected]>
tracing: move __printf() attribute on __ftrace_vbprintk()

Yury Norov <[email protected]>
tracing: move tracing declarations from kernel.h to a dedicated header

Steven Rostedt <[email protected]>
tracing: remove size parameter in __trace_puts()

Richard Fitzgerald <[email protected]>
soundwire: cadence: Clear message complete before signaling waiting thread

Frank Li <[email protected]>
dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register()

Bard Liao <[email protected]>
soundwire: Intel: test bus.bpt_stream before assigning it

Cole Leavitt <[email protected]>
soundwire: bus: demote UNATTACHED state warnings to dev_dbg()

Khairul Anuar Romli <[email protected]>
dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function

ZhengYuan Huang <[email protected]>
ocfs2: validate group add input before caching

ZhengYuan Huang <[email protected]>
ocfs2: validate bg_bits during freefrag scan

ZhengYuan Huang <[email protected]>
ocfs2: fix listxattr handling when the buffer is full

Richard Cheng <[email protected]>
fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal

Sebastian Ene <[email protected]>
firmware: arm_ffa: Use the correct buffer size during RXTX_MAP

Frank Li <[email protected]>
ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended

Christian A. Ehrhardt <[email protected]>
lib: kunit_iov_iter: fix memory leaks

Kees Cook <[email protected]>
slab: Introduce kmalloc_obj() and family

Christoph Hellwig <[email protected]>
arm64/xor: fix conflicting attributes for xor_block_template

Aaro Koskinen <[email protected]>
ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX

Alexander Koskovich <[email protected]>

    arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP

Alok Tiwari <[email protected]>
soc: qcom: aoss: compare against normalized cooling state

Alok Tiwari <[email protected]>
soc: qcom: llcc: fix v1 SB syndrome register offset

Junrui Luo <[email protected]>
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison

Junrui Luo <[email protected]>
ocfs2/dlm: validate qr_numregions in dlm_match_regions()

Michal Grzedzicki <[email protected]>
unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure

Sumit Gupta <[email protected]>
soc/tegra: cbb: Fix cross-fabric target timeout lookup

Sumit Gupta <[email protected]>
soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables

Sumit Gupta <[email protected]>
soc/tegra: cbb: Set ERD on resume for err interrupt

Xu Yang <[email protected]>
arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual

Xu Yang <[email protected]>
arm64: dts: imx8qm-mek: switch Type-C connector power-role to dual

Josua Mayer <[email protected]>
arm64: dts: lx2160a: complete pinmux for rcwsr12 configuration word

Josua Mayer <[email protected]>
arm64: dts: lx2160a: change zeros to hexadecimal in pinmux nodes

Josua Mayer <[email protected]>
arm64: dts: lx2160a: add sda gpio references for i2c bus recovery

Josua Mayer <[email protected]>
arm64: dts: lx2160a: rename pinmux nodes for readability

Josua Mayer <[email protected]>
arm64: dts: lx2160a: remove duplicate pinmux nodes

Josua Mayer <[email protected]>
arm64: dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit

Shengjiu Wang <[email protected]>

    arm64: dts: imx8dxl-evk: Use audio-graph-card2 for wm8960-2 and wm8960-3

Annette Kobou <[email protected]>
arm64: dts: imx8mp-kontron: Fix boot order for PMIC and RTC

Nora Schiffer <[email protected]>
arm64: dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS muxing

Francesco Dolcini <[email protected]>
arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label

Judith Mendez <[email protected]>
arm64: dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins

Judith Mendez <[email protected]>
arm64: dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins

Barnabás Czémán <[email protected]>
arm64: dts: qcom: msm8917-xiaomi-riva: Fix board-id for all bootloader

David Heidelberg <[email protected]>
arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot

Luca Weiss <[email protected]>
arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: hamoa: Fix xo clock supply of platform SD host controller

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sm8650: Fix xo clock supply of SD host controller

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm8750: Fix GIC_ITS range length

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm8650: Fix GIC_ITS range length

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm8550: Fix GIC_ITS range length

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm8450: Fix GIC_ITS range length

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8650: correct Iris corners for the MXC rail

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8550: correct Iris corners for the MXC rail

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: monaco: correct Iris corners for the MXC rail

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: lemans: correct Iris corners for the MXC rail

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: hamoa: correct Iris corners for the MXC rail

Gatien Chevallier <[email protected]>
bus: rifsc: fix RIF configuration check for peripherals

Shawn Lin <[email protected]>
arm64: dts: rockchip: Add mphy reset to ufshc node

谢致邦 (XIE Zhibang) <[email protected]>
arm64: dts: rockchip: Fix RK3562 EVB2 model name

Dmitry Baryshkov <[email protected]>
soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available

Dmitry Baryshkov <[email protected]>
soc: qcom: ocmem: register reasons for probe deferrals

Dmitry Baryshkov <[email protected]>
soc: qcom: ocmem: make the core clock optional

Chris Morgan <[email protected]>
arm64: dts: rockchip: Correct Joystick Axes on Gameforce Ace

Chris Morgan <[email protected]>
arm64: dts: rockchip: Correct Fan Supply for Gameforce Ace

Robin Murphy <[email protected]>
Revert "arm64: dts: rockchip: add SPDIF audio to Beelink A1"

Ming Wang <[email protected]>
arm64: dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi

Barnabás Czémán <[email protected]>
arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight

Barnabás Czémán <[email protected]>
arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value

Josua Mayer <[email protected]>
arm64: dts: imx8mp-hummingboard-pulse: fix mini-hdmi dsi port reference

Frieder Schrempf <[email protected]>
arm64: dts: imx8mp-kontron: Drop vmmc-supply to fix SD card on SMARC eval carrier

Frieder Schrempf <[email protected]>
arm64: dts: imx8mp-kontron: Fix touch reset configuration on DL devices

Thorsten Blum <[email protected]>

    iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}

Akari Tsuyukusa <[email protected]>
arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count

Akari Tsuyukusa <[email protected]>
arm64: dts: mediatek: mt7981b: Fix gpio-ranges pin count

Akari Tsuyukusa <[email protected]>
arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count

Konrad Dybcio <[email protected]>
arm64: dts: qcom: talos: Add missing clock-names to GCC

Barnabás Czémán <[email protected]>
arm64: dts: qcom: sm6125-xiaomi-ginkgo: Fix reserved gpio ranges

Barnabás Czémán <[email protected]>
arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove extcon

Barnabás Czémán <[email protected]>
arm64: dts: qcom: sm6125-xiaomi-ginkgo: Correct reserved memory ranges

Barnabás Czémán <[email protected]>
arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove board-id

Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm6125-ginkgo: Fix missing msm-id subtype

Jacob Pan <[email protected]>
iommufd: vfio compatibility extension check for noiommu mode

Sherry Sun <[email protected]>
arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1)

Heiko Stuebner <[email protected]>
arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config

Luke Wang <[email protected]>
arm64: dts: imx91-11x11-evk: change usdhc tuning step for eMMC and SD

Francesco Dolcini <[email protected]>
arm64: dts: imx8-apalis: Fix LEDs name collision

Mikko Perttunen <[email protected]>
memory: tegra30-emc: Fix dll_change check

Mikko Perttunen <[email protected]>
memory: tegra124-emc: Fix dll_change check

Rafał Miłecki <[email protected]>
ARM: dts: mediatek: mt7623: fix efuse fallback compatible

Nícolas F. R. A. Prado <[email protected]>
arm64: dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon

Joshua Klinesmith <[email protected]>
ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine

Thomas Huth <[email protected]>
efi/capsule-loader: fix incorrect sizeof in phys array reallocation

Andreas Gruenbacher <[email protected]>
gfs2: prevent NULL pointer dereference during unmount

Andreas Gruenbacher <[email protected]>
gfs2: add some missing log locking

Arnd Bergmann <[email protected]>

    vfio: unhide vdev->debug_root

Jan Kara <[email protected]>
quota: Fix race of dquot_scan_active() with quota deactivation

Andreas Gruenbacher <[email protected]>
gfs2: less aggressive low-memory log flushing

Wander Lairson Costa <[email protected]>
rtla/utils: Fix resource leak in set_comm_sched_attr()

Wander Lairson Costa <[email protected]>
rtla: Replace atoi() with a robust strtoi()

Ivan Pravdin <[email protected]>
rtla: Fix -C/--cgroup interface

Ricardo B. Marlière <[email protected]>
ktest: Run POST_KTEST hooks on failure and cancellation

Ricardo B. Marlière <[email protected]>
ktest: Honor empty per-test option overrides

Ricardo B. Marlière <[email protected]>
ktest: Avoid undef warning when WARNINGS_FILE is unset

Luis Henriques <[email protected]>
fuse: fix uninit-value in fuse_dentry_revalidate()

Luis Henriques <[email protected]>
fuse: new work queue to periodically invalidate expired dentries

Luis Henriques <[email protected]>
dcache: export shrink_dentry_list() and add new helper d_dispose_if_unused()

Jingbo Xu <[email protected]>
fuse: fix premature writetrhough request for large folio

Ondrej Mosnacek <[email protected]>
fanotify: call fanotify_events_supported() before path_permission() and security_path_notify()

Ondrej Mosnacek <[email protected]>
fanotify: avoid/silence premature LSM capability checks

Andreas Gruenbacher <[email protected]>
gfs2: Call unlock_new_inode before d_instantiate

Kailang Yang <[email protected]>
ALSA: hda/realtek - fixed speaker no sound update

Geoffrey D. Bennett <[email protected]>
ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUP

Haixin Xu <[email protected]>
crypto: jitterentropy - replace long-held spinlock with mutex

Tejun Heo <[email protected]>
sched_ext: Fix ops.cgroup_move() invocation kf_mask and rq tracking

Tejun Heo <[email protected]>

    sched_ext: Track @p's rq lock across set_cpus_allowed_scx -> ops.set_cpumask

Ming-Hung Tsai <[email protected]>
dm cache: fix missing return in invalidate_committed's error path

Cássio Gabriel <[email protected]>
ALSA: sc6000: Keep the programmed board state in card-private data

Pei Xiao <[email protected]>
spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on

Vidya Sagar <[email protected]>
PCI: tegra194: Disable L1.2 capability of Tegra234 EP

Bjorn Helgaas <[email protected]>
PCI: tegra194: Remove unnecessary L1SS disable code

Manikanta Maddireddy <[email protected]>
PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Use DWC IP core version

Vidya Sagar <[email protected]>
PCI: tegra194: Free up Endpoint resources during remove()

Vidya Sagar <[email protected]>
PCI: tegra194: Allow system suspend when the Endpoint link is not up

Vidya Sagar <[email protected]>
PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode

Vidya Sagar <[email protected]>
PCI: tegra194: Disable direct speed change for Endpoint mode

Vidya Sagar <[email protected]>
PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Disable PERST# IRQ only in Endpoint mode

Vidya Sagar <[email protected]>
PCI: tegra194: Don't force the device into the D0 state before L2

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Increase LTSSM poll time on surprise link down

Vidya Sagar <[email protected]>
PCI: tegra194: Fix polling delay for L2 state

songxiebing <[email protected]>
ALSA: usb-audio: qcom: Fix incorrect type in enable_audio_stream

Richard Cheng <[email protected]>
PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports

Cássio Gabriel <[email protected]>
ASoC: SOF: compress: return the configured codec from get_params

Panagiotis Petrakopoulos <[email protected]>
ALSA: scarlett2: Add missing sentinel initializer field

Waiman Long <[email protected]>
selftest: memcg: skip memcg_sock test if address family not supported

Jane Chu <[email protected]>
Documentation: fix a hugetlbfs reservation statement

Pasha Tatashin <[email protected]>
kho: make debugfs interface optional

AnishMulay <[email protected]>
selftests/mm: skip migration tests if NUMA is unavailable

Eliot Courtney <[email protected]>
gpu: nova-core: bitfield: fix broken Default implementation

Joel Fernandes <[email protected]>
gpu: nova-core: bitfield: Move bitfield-specific code from register! into new macro

Alexandre Courbot <[email protected]>
gpu: nova-core: register: use field type for Into implementation

Chen-Yu Tsai <[email protected]>
PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found

Gerd Bayer <[email protected]>
PCI: Enable AtomicOps only if Root Port supports them

Denis Rastyogin <[email protected]>

    ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]

Giovanni Cabiddu <[email protected]>
crypto: qat - use swab32 macro

Giovanni Cabiddu <[email protected]>
crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table()

Giovanni Cabiddu <[email protected]>
crypto: qat - fix type mismatch in RAS sysfs show functions

Giovanni Cabiddu <[email protected]>
crypto: qat - fix compression instance leak

Ahsan Atta <[email protected]>

    crypto: qat - disable 420xx AE cluster when lead engine is fused off

Ahsan Atta <[email protected]>
crypto: qat - disable 4xxx AE cluster when lead engine is fused off

Hans Zhang <[email protected]>
PCI: dwc: Fix type mismatch for kstrtou32_from_user() return value

Srinivas Kandagatla <[email protected]>
ASoC: qcom: qdsp6: topology: check widget type before accessing data

Jason Gunthorpe <[email protected]>
iommu/riscv: Remove overflows on the invalidation path

Vasant Hegde <[email protected]>
iommu/amd: Fix clone_alias() to use the original device's devid

Shengjiu Wang <[email protected]>
ASoC: fsl_easrc: Change the type for iec958 channel status controls

Shengjiu Wang <[email protected]>
ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()

Shengjiu Wang <[email protected]>
ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()

Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()

Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Fix event generation in micfil_quality_set()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Add access property for "VAD Detected"

Dmitry Baryshkov <[email protected]>

    drm/msm/dpu: drop INTF_0 on MSM8953

Dmitry Baryshkov <[email protected]>
PM: domains: De-constify fields in struct dev_pm_domain_attach_data

Felix Gu <[email protected]>

    pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()

Felix Gu <[email protected]>
pmdomain: ti: omap_prm: Fix a reference leak on device node

wangdicheng <[email protected]>
ALSA: hda/cmedia: Remove duplicate pin configuration parsing

Akhil P Oommen <[email protected]>
drm/msm/a6xx: Use barriers while updating HFI Q headers

Connor Abbott <[email protected]>
drm/msm/a6xx: Fix dumping A650+ debugbus blocks

Rob Clark <[email protected]>
drm/msm/shrinker: Fix can_block() logic

Rob Clark <[email protected]>
drm/msm/a6xx: Fix HLSQ register dumping

Rob Clark <[email protected]>
drm/msm: Fix VM_BIND UNMAP locking

Rob Clark <[email protected]>
drm/msm: Reject fb creation from _NO_SHARE objs

Rob Clark <[email protected]>
drm/msm/vma: Avoid lock in VM_BIND fence signaling path

Ethan Tidmore <[email protected]>
ASoC: SOF: Intel: hda: Place check before dereference

Lei Huang <[email protected]>
ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}')

Billy Tsai <[email protected]>
hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback

Kuppuswamy Sathyanarayanan <[email protected]>
PCI/DPC: Log AER error info for DPC/EDR uncorrectable errors

Timur Kristóf <[email protected]>
drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled

Timur Kristóf <[email protected]>
drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Fill DW8 fields from SMC

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Clear EnabledForActivity field for memory levels

Timur Kristóf <[email protected]>

    drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0

Timur Kristóf <[email protected]>
drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled

Vijendar Mukunda <[email protected]>
ASoC: amd: acp: update dmic_num logic for acp pdm dmic

Cássio Gabriel <[email protected]>
ALSA: core: Validate compress device numbers without dynamic minors

Ethan Tidmore <[email protected]>
iommu/riscv: Fix signedness bug

Yaxing Guo <[email protected]>
iommu/riscv: Skip IRQ count check when using MSI interrupts

Ilpo Järvinen <[email protected]>
PCI: Fix alignment calculation for resource size larger than align

Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - prevent req used-after-free for sec

Ilpo Järvinen <[email protected]>
PCI: Fix premature removal from realloc_head list during resource assignment

Ilpo Järvinen <[email protected]>
PCI: Use res_to_dev_res() in reassign_resources_sorted()

Krishna Chaitanya Chundru <[email protected]>
PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support

Sebastian Reichel <[email protected]>
drm/panel: simple: Correct G190EAN01 prepare timing

Dmitry Baryshkov <[email protected]>
drm/panel: sharp-ls043t1le01: make use of prepare_prev_first

Alexey Charkov <[email protected]>
ASoC: rockchip: rockchip_sai: Set slot width for non-TDM mode

Alexander Koskovich <[email protected]>

    drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0

Pengyu Luo <[email protected]>
drm/msm/dsi: fix hdisplay calculation for CMD mode panel

Pengyu Luo <[email protected]>
drm/msm/dsi: fix bits_per_pclk

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: don't try using 2 LMs if only one DSC is available

Pengyu Luo <[email protected]>
drm/msm/dsi: add the missing parameter description

Yuanjie Yang <[email protected]>
drm/msm/dpu: fix mismatch between power and frequency

Dmitry Baryshkov <[email protected]>
drm/msm: add missing MODULE_DEVICE_ID definitions

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()

Alexandru Dadu <[email protected]>
drm/imagination: Switch reset_reason fields from enum to u32

Pei Xiao <[email protected]>
spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo

Alex Deucher <[email protected]>
drm/amdgpu/gfx11: look at the right prop for gfx queue priority

Alex Deucher <[email protected]>
drm/amdgpu/gfx10: look at the right prop for gfx queue priority

Koichiro Den <[email protected]>
PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation

Daniel Jordan <[email protected]>
padata: Put CPU offline callback in ONLINE section to allow failure

Chuyi Zhou <[email protected]>
padata: Remove cpu online check from cpu add and removal

Thorsten Blum <[email protected]>
crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs

Thorsten Blum <[email protected]>

    crypto: atmel - Use unregister_{aeads,ahashes,skciphers}

Herbert Xu <[email protected]>
crypto: tegra - Disable softirqs before finalizing request

Andy Shevchenko <[email protected]>
fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break

Guillaume Gonnet <[email protected]>
dm init: ensure device probing has finished in dm-mod.waitfor=

Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Add default case in DVI mode validation

Fangyu Yu <[email protected]>
iommu/riscv: Stop polling when CQCSR reports an error

Jason Gunthorpe <[email protected]>
iommu/riscv: Add missing GENERIC_MSI_IRQ

Fangyu Yu <[email protected]>
iommu/riscv: Add IOTINVAL after updating DDT/PDT entries

Aleksander Jan Bajkowski <[email protected]>
crypto: inside-secure/eip93 - register hash before authenc algorithms

Ethan Tidmore <[email protected]>
drm/sun4i: Fix resource leaks

Maíra Canal <[email protected]>
drm/v3d: Handle error from drm_sched_entity_init()

David Carlier <[email protected]>
selftests/sched_ext: Add missing error check for exit__load()

Lijo Lazar <[email protected]>
drm/amd/pm: Fix xgmi max speed reporting

Vladimir Zapolskiy <[email protected]>
media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe

Felix Gu <[email protected]>
spi: fsl-qspi: Use reinit_completion() for repeated operations

Felix Gu <[email protected]>
spi: nxp-fspi: Use reinit_completion() for repeated operations

Harikrishna Shenoy <[email protected]>
drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check

Jayesh Choudhary <[email protected]>
drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs

Jayesh Choudhary <[email protected]>
drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()

Randy Dunlap <[email protected]>
iopoll: fix function parameter names in read_poll_timeout_atomic()

Junrui Luo <[email protected]>
dm log: fix out-of-bounds write due to region_count overflow

Ming-Hung Tsai <[email protected]>
dm cache metadata: fix memory leak on metadata abort retry

Manivannan Sadhasivam <[email protected]>
PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq()

Richard Zhu <[email protected]>
PCI: dwc: Invoke post_init in dw_pcie_resume_noirq()

Aksh Garg <[email protected]>
PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix()

Rafael J. Wysocki <[email protected]>
platform/chrome: chromeos_tbmc: Drop wakeup source on remove

Benjamin Marzinski <[email protected]>
dm-mpath: don't stop probing paths at presuspend

Ming-Hung Tsai <[email protected]>
dm cache: fix dirty mapping checking in passthrough mode switching

Ming-Hung Tsai <[email protected]>
dm cache: fix concurrent write failure in passthrough mode

Ming-Hung Tsai <[email protected]>
dm cache policy smq: fix missing locks in invalidating cache blocks

Ming-Hung Tsai <[email protected]>
dm cache: fix write hang in passthrough mode

Ming-Hung Tsai <[email protected]>
dm cache: fix write path cache coherency in passthrough mode

Ming-Hung Tsai <[email protected]>
dm cache: fix null-deref with concurrent writes in passthrough mode

Sander Vanheule <[email protected]>
ASoC: sti: use managed regmap_field allocations

Sander Vanheule <[email protected]>
ASoC: sti: Return errors from regmap_field_alloc()

Aleksander Jan Bajkowski <[email protected]>
crypto: inside-secure/eip93 - fix register definition

Charles Keepax <[email protected]>
ASoC: SDCA: Update counting of SU/GE DAPM routes

Felix Gu <[email protected]>
PCI: imx6: Fix device node reference leak in imx_pcie_probe()

Ethan Tidmore <[email protected]>
drm/sun4i: backend: fix error pointer dereference

Koichiro Den <[email protected]>
PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc

Koichiro Den <[email protected]>
PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested

George Abraham P <[email protected]>
PCI/TPH: Allow TPH enable for RCiEPs

Kuninori Morimoto <[email protected]>
ASoC: soc-compress: use function to clear symmetric params

Val Packett <[email protected]>
drm/virtio: Allow importing prime buffers when 3D is enabled

Alexander Konyukhov <[email protected]>
drm/komeda: fix integer overflow in AFBC framebuffer size check

Yuwen Chen <[email protected]>
selftests/futex: Fix incorrect result reporting of futex_requeue test item

Lorenzo Bianconi <[email protected]>
net: airoha: Add missing PPE configurations in airoha_ppe_hw_init()

Jiayuan Chen <[email protected]>
net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master

Xin Long <[email protected]>
sctp: fix missing encap_port propagation for GSO fragments

Kuniyuki Iwashima <[email protected]>

    tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init().

Gabriel Krisman Bertazi <[email protected]>
udp: Force compute_score to always inline

Maxime Chevallier <[email protected]>
net: phy: qcom: at803x: Use the correct bit to disable extended next page

Stefan Metzmacher <[email protected]>

    Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec

Dudu Lu <[email protected]>
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

Pauli Virtanen <[email protected]>
Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER

Jonathan Rissanen <[email protected]>
Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU

Sun Jian <[email protected]>
bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb

Gal Pressman <[email protected]>
net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()

Gal Pressman <[email protected]>
net/mlx5e: Fix features not applied during netdev registration

Charles Perry <[email protected]>
net: phy: fix a return path in get_phy_c45_ids()

Josua Mayer <[email protected]>
dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110

Luca Weiss <[email protected]>
net: ipa: Fix decoding EV_PER_EE for IPA v5.0+

Luca Weiss <[email protected]>
net: ipa: Fix programming of QTIME_TIMESTAMP_CFG

Taegu Ha <[email protected]>
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

Lang Xu <[email protected]>
bpf: Fix OOB in pcpu_init_value

Greg Jumper <[email protected]>
net/rds: Restrict use of RDS/IB to the initial network namespace

Håkon Bugge <[email protected]>
net/rds: Optimize rds_ib_laddr_check

Paul Chaignon <[email protected]>
selftests/bpf: Fix reg_bounds to match new tnum-based refinement

Emil Tsalapatis <[email protected]>
bpf: Allow instructions with arena source and non-arena dest registers

Lorenzo Bianconi <[email protected]>
net: airoha: Add missing RX_CPU_IDX() configuration in airoha_qdma_cleanup_rx_queue()

Erni Sri Satya Vennela <[email protected]>
net: mana: Move current_speed debugfs file to mana_init_port()

Haiyang Zhang <[email protected]>
net: mana: Support HW link state events

Erni Sri Satya Vennela <[email protected]>
net: mana: Use pci_name() for debugfs directory naming

Florian Westphal <[email protected]>
selftests: netfilter: nft_tproxy.sh: adjust to socat changes

Jamal Hadi Salim <[email protected]>
net/sched: act_ct: Only release RCU read lock after ct_ft

Eduard Zingerman <[email protected]>
selftests/bpf: fix __jited_unpriv tag name

Daniel Borkmann <[email protected]>
bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars

Puranjay Mohan <[email protected]>
bpf: Relax scalar id equivalence for state pruning

Lorenzo Bianconi <[email protected]>
net: airoha: Fix FE_PSE_BUF_SET configuration if PPE2 is available

Lorenzo Bianconi <[email protected]>
net: airoha: Generalize airoha_ppe2_is_enabled routine

Lorenzo Bianconi <[email protected]>
net: airoha: Add airoha_eth_soc_data struct

Lorenzo Bianconi <[email protected]>
net: airoha: Add airoha_ppe_get_num_stats_entries() and airoha_ppe_get_num_total_stats_entries()

Mashiro Chen <[email protected]>
net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf

Sechang Lim <[email protected]>
bpf: Fix RCU stall in bpf_fd_array_map_clear()

Puranjay Mohan <[email protected]>
bpf: return VMA snapshot from task_vma iterator

Puranjay Mohan <[email protected]>
bpf: switch task_vma iterator from mmap_lock to per-VMA locks

Puranjay Mohan <[email protected]>
bpf: fix mm lifecycle in open-coded task_vma iterator

Florian Westphal <[email protected]>
netfilter: nft_fwd_netdev: check ttl/hl before forwarding

Florian Westphal <[email protected]>
netfilter: xt_socket: enable defrag after all other checks

Mohsin Bashir <[email protected]>
eth: fbnic: Use wake instead of start

Lorenzo Bianconi <[email protected]>
net: airoha: Add dma_rmb() and READ_ONCE() in airoha_qdma_rx_process()

Justin Chen <[email protected]>
net: bcmgenet: fix racing timeout handler

Justin Chen <[email protected]>
net: bcmgenet: fix leaking free_bds

Justin Chen <[email protected]>
net: bcmgenet: fix off-by-one in bcmgenet_put_txcb

Cosmin Ratiu <[email protected]>
macsec: Support VLAN-filtering lower devices

Wang Wensheng <[email protected]>
arm64: kexec: Remove duplicate allocation for trans_pgd

Haoyu Lu <[email protected]>
ACPI: AGDI: fix missing newline in error message

Mark Rutland <[email protected]>
arm64: entry: Don't preempt with SError or Debug masked

Daniel Borkmann <[email protected]>

    bpf: Fix linked reg delta tracking when src_reg == dst_reg

Puranjay Mohan <[email protected]>
bpf: Support negative offsets, BPF_SUB, and alu32 for linked register tracking

Baochen Qiang <[email protected]>
wifi: ath10k: fix station lookup failure during disconnect

Weiming Shi <[email protected]>
bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()

Jiayuan Chen <[email protected]>
bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks

Nicolas Escande <[email protected]>
wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode()

Ethan Tidmore <[email protected]>
wifi: brcmfmac: Fix error pointer dereference

Arnd Bergmann <[email protected]>
net: ethernet: ti-cpsw: fix linking built-in code to modules

Arnd Bergmann <[email protected]>
net: ethernet: ti-cpsw:: rename soft_reset() function

MingTao Huang <[email protected]>

    bpf: Fix stale offload->prog pointer after constant blinding

Weiming Shi <[email protected]>
bpf: fix end-of-list detection in cgroup_storage_get_next_key()

Eric Dumazet <[email protected]>

    macvlan: annotate data-races around port->bc_queue_len_used

Leon Hwang <[email protected]>
bpf: Fix abuse of kprobe_write_ctx via freplace

Amit Machhiwal <[email protected]>
selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15

Sourabh Jain <[email protected]>
powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug

Sourabh Jain <[email protected]>
powerpc/crash: fix backup region offset update to elfcorehdr

Chih Kai Hsu <[email protected]>
r8152: fix incorrect register write to USB_UPHY_XTAL

Ritesh Harjani (IBM) <[email protected]>
drivers/vfio_pci_core: Change PXD_ORDER check from switch case to if/else block

Ankit Agrawal <[email protected]>
vfio: refactor vfio_pci_mmap_huge_fault function

Alexey Velichayshiy <[email protected]>
wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap()

haoyu.lu <[email protected]>
bpf,arc_jit: Fix missing newline in pr_err messages

Alexei Starovoitov <[email protected]>
bpf: Fix variable length stack write over spilled pointers

David Carlier <[email protected]>
bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path

Keisuke Nishimura <[email protected]>
bpf: Fix refcount check in check_struct_ops_btf_id()

Peter Chiu <[email protected]>
wifi: mt76: mt7996: fix RRO EMU configuration

Chad Monroe <[email protected]>
wifi: mt76: support upgrading passive scans to active

Chad Monroe <[email protected]>
wifi: mt76: fix multi-radio on-channel scanning

Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: Decrement sta counter removing the link in mt7996_mac_reset_sta_iter()

Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: Switch to the secondary link if the default one is removed

Shayne Chen <[email protected]>
wifi: mt76: mt7996: use correct link_id when filling TXD and TXP

Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: Remove link pointer dependency in mt7996_mac_sta_remove_links()

Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: Add missing CHANCTX_STA_CSA property

Michael Lo <[email protected]>
wifi: mt76: mt7921: fix 6GHz regulatory update on connection

Duoming Zhou <[email protected]>

    wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()

Duoming Zhou <[email protected]>

    wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()

StanleyYP Wang <[email protected]>

    wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event

Shayne Chen <[email protected]>
wifi: mt76: mt7996: fix wrong DMAD length when using MAC TXP

James Clark <[email protected]>
arm64: cpufeature: Make PMUVer and PerfMon unsigned

Chad Monroe <[email protected]>
wifi: mt76: fix deadlock in remain-on-channel

Sean Wang <[email protected]>
wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync

Sean Wang <[email protected]>
wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync

Sean Wang <[email protected]>
wifi: mt76: mt7925: drop puncturing handling from BSS change path

Jack Kao <[email protected]>
wifi: mt76: mt7925: cqm rssi low/high event notify

Lorenzo Bianconi <[email protected]>
wifi: mt76: Fix memory leak destroying device

Rory Little <[email protected]>
wifi: mt76: mt7921: Place upper limit on station AID

Alok Tiwari <[email protected]>
wifi: mt76: mt7996: fix FCS error flag check in RX descriptor

Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi

Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr()

Ryder Lee <[email protected]>
wifi: mt76: mt7915: fix use_cts_prot support

Ryder Lee <[email protected]>
wifi: mt76: mt7615: fix use_cts_prot support

Leon Yen <[email protected]>
wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control

Sean Wang <[email protected]>
wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr()

Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: Reset ampdu_state state in case of failure in mt7996_tx_check_aggr()

Lorenzo Bianconi <[email protected]>

    wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()

Lorenzo Bianconi <[email protected]>

    wifi: mt76: mt7996: Reset mtxq->idx if primary link is removed in mt7996_vif_link_remove()

Lorenzo Bianconi <[email protected]>

    wifi: mt76: mt7996: Set mtxq->wcid just for primary link

Shayne Chen <[email protected]>
wifi: mt76: mt7996: fix iface combination for different chipsets

StanleyYP Wang <[email protected]>
wifi: mt76: mt7996: fix the behavior of radar detection

David Laight <[email protected]>
tools/nolibc/printf: Move snprintf length check to callback

David Laight <[email protected]>

    tools/nolibc/printf: Change variables 'c' to 'ch' and 'tmpbuf[]' to 'outbuf[]'

Benjamin Berg <[email protected]>
tools/nolibc: implement %m if errno is not defined

Heitor Alves de Siqueira <[email protected]>
wifi: libertas: don't kill URBs in interrupt context

Heitor Alves de Siqueira <[email protected]>
wifi: libertas: use USB anchors for tracking in-flight URBs

Petr Pavlu <[email protected]>
module: Fix freeing of charp module parameters when CONFIG_SYSFS=n

Petr Pavlu <[email protected]>
params: Replace __modinit with __init_or_module

Ritesh Harjani (IBM) <[email protected]>
powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy

Ilya Leoshkevich <[email protected]>
s390/bpf: Zero-extend bpf prog return values and kfunc arguments

Cai Xinchen <[email protected]>
dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n

Cai Xinchen <[email protected]>
dpaa2: add independent dependencies for FSL_DPAA2_SWITCH

Shayne Chen <[email protected]>
wifi: ieee80211: fix definition of EHT-MCS 15 in MRU

Johannes Berg <[email protected]>
wifi: ieee80211: split EHT definitions out

Johannes Berg <[email protected]>
wifi: ieee80211: split HE definitions out

Johannes Berg <[email protected]>
wifi: ieee80211: split VHT definitions out

Johannes Berg <[email protected]>
wifi: ieee80211: split HT definitions out

Johannes Berg <[email protected]>
wifi: ieee80211: split mesh definitions out

Feng Yang <[email protected]>
bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap

Duoming Zhou <[email protected]>
wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet

Zilin Guan <[email protected]>
wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()

Michal Koutný <[email protected]>
sched/rt: Skip group schedulable check with rt_group_sched=0

John Stultz <[email protected]>
sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr()

Mario Limonciello (AMD) <[email protected]>
firmware: dmi: Correct an indexing error in dmi.h

Thomas Weißschuh <[email protected]>
x86/vdso: Clean up remnants of VDSO32_NOTE_MASK

Ahmed S. Darwish <[email protected]>
ASoC: Intel: avs: Include CPUID header at file scope

Ahmed S. Darwish <[email protected]>
ASoC: Intel: avs: Check maximum valid CPUID leaf

Biju Das <[email protected]>
irqchip/renesas-rzg2l: Fix error path in rzg2l_irqc_common_probe()

Peter Zijlstra <[email protected]>
sched/topology: Fix sched_domain_span()

K Prateek Nayak <[email protected]>
sched/topology: Compute sd_weight considering cpuset partitions

Bart Van Assche <[email protected]>
locking: Fix rwlock support in <linux/spinlock_up.h>

Thomas Weißschuh (Schneider Electric) <[email protected]>
scripts/gdb: timerlist: Adapt to move of tk_core

Thomas Weißschuh <[email protected]>
sparc64: vdso: Link with -z noexecstack

Boqun Feng <[email protected]>
rust: sync: atomic: Remove bound T: Sync for Atomic::from_ptr()

Xiaoyao Li <[email protected]>
x86/tdx: Fix the typo in TDX_ATTR_MIGRTABLE

Ravi Bangoria <[email protected]>
perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler

Ravi Bangoria <[email protected]>
perf/amd/ibs: Preserve PhyAddrVal bit when clearing PhyAddr MSR

Thomas Gleixner <[email protected]>
hrtimer: Reduce trace noise in hrtimer_start()

Peter Zijlstra <[email protected]>
hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()

Brian Masney <[email protected]>
irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter

Danilo Krummrich <[email protected]>
bus: fsl-mc: use generic driver_override infrastructure

Danilo Krummrich <[email protected]>
s390/cio: use generic driver_override infrastructure

Danilo Krummrich <[email protected]>
vdpa: use generic driver_override infrastructure

Danilo Krummrich <[email protected]>
platform/wmi: use generic driver_override infrastructure

Danilo Krummrich <[email protected]>
PCI: use generic driver_override infrastructure

K Prateek Nayak <[email protected]>

    cpufreq: Pass the policy to cpufreq_driver->adjust_perf()

Gautham R. Shenoy <[email protected]>
amd-pstate: Update cppc_req_cached in fast_switch case

Gautham R. Shenoy <[email protected]>
amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init()

Gui-Dong Han <[email protected]>
soundwire: debugfs: initialize firmware_file to empty string

Gui-Dong Han <[email protected]>
debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()

Gui-Dong Han <[email protected]>
debugfs: check for NULL pointer in debugfs_create_str()

Gopi Krishna Menon <[email protected]>
thermal/drivers/spear: Fix error condition for reading st,thermal-flags

Danilo Krummrich <[email protected]>
devres: fix missing node debug info in devm_krealloc()

Rafael J. Wysocki <[email protected]>
ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver

Rafael J. Wysocki <[email protected]>
ACPI: x86: cmos_rtc: Clean up address space handler driver

Viresh Kumar <[email protected]>
OPP: Move break out of scoped_guard in dev_pm_opp_xlate_required_opp()

Manivannan Sadhasivam <[email protected]>
OPP: debugfs: Use performance level if available to distinguish between rates

Filipe Manana <[email protected]>
btrfs: fix deadlock between reflink and transaction commit when using flushoncommit

Yu Kuai <[email protected]>
md: wake raid456 reshape waiters before suspend

Abd-Alrhman Masalkhi <[email protected]>
md: remove unused static md_wq workqueue

Marco Crivellari <[email protected]>
dm: add WQ_PERCPU to alloc_workqueue users

Zhan Xusheng <[email protected]>
erofs: handle 48-bit blocks/uniaddr for extra devices

Yu Kuai <[email protected]>
md: fix array_state=clear sysfs deadlock

Zhan Xusheng <[email protected]>
erofs: include the trailing NUL in FS_IOC_GETFSLABEL

Gao Xiang <[email protected]>
erofs: verify metadata accesses for file-backed mounts

Cole Leavitt <[email protected]>
pstore/ram: fix resource leak when ioremap() fails

Jackie Liu <[email protected]>
blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()

Deepanshu Kartikey <[email protected]>
nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()

Daan De Meyer <[email protected]>
loop: fix partition scan race between udev and loop_reread_partitions()

Bart Van Assche <[email protected]>
drbd: Balance RCU calls in drbd_adm_dump_devices()

Xiao Ni <[email protected]>
md/raid1: fix the comparing region of interval tree

HyungJung Joo <[email protected]>
fs/mbcache: cancel shrink work before destroying the cache

HyungJung Joo <[email protected]>
fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START

Ming Lei <[email protected]>
blk-cgroup: wait for blkcg cleanup before initializing new disk

-------------

Diffstat:

 .../bindings/interrupt-controller/arm,gic-v3.yaml  |    2 +-
 .../devicetree/bindings/net/dsa/nxp,sja1105.yaml   |    2 -
 .../bindings/ufs/rockchip,rk3576-ufshc.yaml        |    7 +-
 Documentation/mm/hugetlbfs_reserv.rst              |    2 +-
 Documentation/netlink/specs/psp.yaml               |    2 +
 Documentation/process/deprecated.rst               |   24 +
 Documentation/tools/rtla/common_options.txt        |    2 +-
 MAINTAINERS                                        |    2 +-
 Makefile                                           |    4 +-
 arch/arc/net/bpf_jit_arcv2.c                       |    8 +-
 arch/arm/boot/dts/mediatek/mt7623.dtsi             |    2 +-
 .../boot/dts/nxp/imx/imx27-eukrea-cpuimx27.dtsi    |    8 +-
 .../nxp/imx/imx27-eukrea-mbimxsd27-baseboard.dts   |    2 +-
 arch/arm/mach-omap1/clock_data.c                   |    4 +-
 arch/arm/net/bpf_jit_32.c                          |    6 +
 arch/arm64/boot/dts/amlogic/meson-axg.dtsi         |    6 +
 .../boot/dts/amlogic/meson-gxl-s905d-p230.dts      |    3 +-
 arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi     |  161 +-
 .../boot/dts/freescale/imx8-apalis-ixora-v1.1.dtsi |    4 +
 .../boot/dts/freescale/imx8-apalis-ixora-v1.2.dtsi |    4 +
 arch/arm64/boot/dts/freescale/imx8dxl-evk.dts      |  114 +-
 .../arm64/boot/dts/freescale/imx8mm-emtop-som.dtsi |    4 +-
 .../arm64/boot/dts/freescale/imx8mm-tqma8mqml.dtsi |    2 +-
 .../arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi |    2 +-
 .../freescale/imx8mp-aristainetos3a-som-v1.dtsi    |    2 +-
 .../dts/freescale/imx8mp-data-modul-edm-sbc.dts    |    2 +-
 .../boot/dts/freescale/imx8mp-debix-model-a.dts    |    2 +-
 .../dts/freescale/imx8mp-debix-som-a-bmb-08.dts    |    2 +-
 .../boot/dts/freescale/imx8mp-debix-som-a.dtsi     |    2 +-
 .../arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi |    2 +-
 arch/arm64/boot/dts/freescale/imx8mp-edm-g.dtsi    |    2 +-
 arch/arm64/boot/dts/freescale/imx8mp-evk.dts       |    2 +-
 .../imx8mp-hummingboard-pulse-mini-hdmi.dtsi       |   11 +-
 .../boot/dts/freescale/imx8mp-icore-mx8mp.dtsi     |    2 +-
 .../boot/dts/freescale/imx8mp-kontron-dl.dtso      |   19 +
 .../boot/dts/freescale/imx8mp-kontron-osm-s.dtsi   |    6 +
 .../imx8mp-kontron-smarc-eval-carrier.dts          |    1 -
 arch/arm64/boot/dts/freescale/imx8mp-navqp.dts     |    2 +-
 .../boot/dts/freescale/imx8mp-nitrogen-som.dtsi    |    2 +-
 arch/arm64/boot/dts/freescale/imx8mp-sr-som.dtsi   |    4 +-
 .../freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts   |    4 +-
 .../boot/dts/freescale/imx8mp-ultra-mach-sbc.dts   |    4 +-
 arch/arm64/boot/dts/freescale/imx8qm-mek.dts       |   10 +-
 arch/arm64/boot/dts/freescale/imx8qxp-mek.dts      |   10 +-
 arch/arm64/boot/dts/freescale/imx91-11x11-evk.dts  |    2 +
 arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi  |    2 +-
 arch/arm64/boot/dts/marvell/armada-37xx.dtsi       |    2 +-
 arch/arm64/boot/dts/mediatek/mt6795.dtsi           |    2 +-
 arch/arm64/boot/dts/mediatek/mt7981b.dtsi          |    2 +-
 arch/arm64/boot/dts/mediatek/mt7986a.dtsi          |    2 +-
 arch/arm64/boot/dts/mediatek/mt8365.dtsi           |    5 +-
 arch/arm64/boot/dts/qcom/lemans.dtsi               |    6 +-
 arch/arm64/boot/dts/qcom/msm8917-xiaomi-riva.dts   |    2 +-
 arch/arm64/boot/dts/qcom/msm8953-xiaomi-daisy.dts  |    2 +-
 arch/arm64/boot/dts/qcom/msm8953-xiaomi-vince.dts  |    2 +-
 arch/arm64/boot/dts/qcom/qcs8300.dtsi              |    6 +-
 .../dts/qcom/sdm845-xiaomi-beryllium-common.dtsi   |    1 +
 arch/arm64/boot/dts/qcom/sm6125-xiaomi-ginkgo.dts  |   60 +-
 arch/arm64/boot/dts/qcom/sm6150.dtsi               |    3 +
 arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts  |    4 +
 arch/arm64/boot/dts/qcom/sm8250.dtsi               |    5 +
 arch/arm64/boot/dts/qcom/sm8450.dtsi               |    5 +-
 arch/arm64/boot/dts/qcom/sm8550.dtsi               |   13 +-
 arch/arm64/boot/dts/qcom/sm8650.dtsi               |   15 +-
 arch/arm64/boot/dts/qcom/sm8750.dtsi               |    2 +-
 arch/arm64/boot/dts/qcom/x1e80100.dtsi             |   10 +-
 arch/arm64/boot/dts/rockchip/rk3328-a1.dts         |   23 -
 arch/arm64/boot/dts/rockchip/rk3562-evb2-v10.dts   |    2 +-
 arch/arm64/boot/dts/rockchip/rk3566-lckfb-tspi.dts |    4 +-
 arch/arm64/boot/dts/rockchip/rk3576.dtsi           |    5 +-
 arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts     |    2 +-
 .../boot/dts/rockchip/rk3588s-gameforce-ace.dts    |   12 +-
 arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts           |   14 +-
 arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi         |    2 +-
 arch/arm64/boot/dts/ti/k3-am62p5-sk.dts            |    6 +-
 arch/arm64/include/asm/entry-common.h              |   21 +-
 arch/arm64/include/asm/kernel-pgtable.h            |    7 +-
 arch/arm64/include/asm/xor.h                       |    2 +-
 arch/arm64/kernel/cpufeature.c                     |    4 +-
 arch/arm64/kernel/machine_kexec.c                  |    3 -
 arch/arm64/kernel/pi/patch-scs.c                   |    4 +-
 arch/arm64/net/bpf_jit_comp.c                      |   16 +-
 arch/powerpc/include/asm/kexec.h                   |   14 +-
 arch/powerpc/kexec/crash.c                         |   64 +
 arch/powerpc/kexec/file_load_64.c                  |   29 +-
 arch/powerpc/mm/pgtable-frag.c                     |    1 +
 arch/powerpc/platforms/44x/warp.c                  |    2 +
 arch/powerpc/platforms/pseries/papr-hvpipe.c       |   59 +-
 arch/riscv/Kconfig                                 |   22 +
 arch/riscv/kernel/traps_misaligned.c               |    2 +-
 arch/riscv/net/bpf_jit.h                           |    6 -
 arch/riscv/net/bpf_jit_core.c                      |    7 -
 arch/s390/kvm/interrupt.c                          |    3 +-
 arch/s390/kvm/pci.c                                |    6 +-
 arch/s390/mm/fault.c                               |    2 +-
 arch/s390/net/bpf_jit_comp.c                       |   39 +-
 arch/sparc/vdso/Makefile                           |    2 +-
 arch/x86/Makefile.um                               |    2 +
 arch/x86/coco/tdx/debug.c                          |    2 +-
 arch/x86/entry/vdso/vdso2c.c                       |    1 -
 arch/x86/events/amd/ibs.c                          |    7 +-
 arch/x86/events/intel/core.c                       |   17 +-
 arch/x86/events/perf_event.h                       |   10 +
 arch/x86/events/perf_event_flags.h                 |    1 +
 arch/x86/include/asm/shared/tdx.h                  |    4 +-
 arch/x86/include/asm/vdso.h                        |    1 -
 arch/x86/kernel/acpi/cppc.c                        |    6 +-
 arch/x86/kernel/relocate_kernel_64.S               |    8 +
 arch/x86/kvm/trace.h                               |    2 +-
 arch/x86/um/vdso/Makefile                          |    7 +-
 block/blk-cgroup.c                                 |   16 +
 block/disk-events.c                                |    3 +-
 crypto/af_alg.c                                    |    2 +
 crypto/jitterentropy-kcapi.c                       |   14 +-
 drivers/accel/rocket/rocket_gem.c                  |    2 +
 drivers/acpi/apei/einj-core.c                      |   55 +-
 drivers/acpi/arm64/agdi.c                          |    2 +-
 drivers/acpi/x86/cmos_rtc.c                        |   79 +-
 drivers/ata/libata-scsi.c                          |    4 +-
 drivers/base/devres.c                              |    2 +
 drivers/block/drbd/drbd_nl.c                       |    8 +-
 drivers/bluetooth/btmtk.c                          |    4 +-
 drivers/bluetooth/hci_ldisc.c                      |    3 +
 drivers/bus/fsl-mc/fsl-mc-bus.c                    |   43 +-
 drivers/bus/stm32_rifsc.c                          |   52 +-
 drivers/cdrom/cdrom.c                              |   73 +-
 drivers/char/ipmi/ssif_bmc.c                       |   34 +-
 drivers/clk/clk-qoriq.c                            |   17 +-
 drivers/clk/clk-xgene.c                            |    2 +
 drivers/clk/imx/clk-imx6q.c                        |   12 +-
 drivers/clk/imx/clk-imx8mq.c                       |    4 +-
 drivers/clk/qcom/dispcc-glymur.c                   |    4 +-
 drivers/clk/qcom/dispcc-milos.c                    |    1 -
 drivers/clk/qcom/dispcc-sc7180.c                   |    8 +
 drivers/clk/qcom/dispcc-sc8280xp.c                 |    4 -
 drivers/clk/qcom/dispcc-sm4450.c                   |    1 -
 drivers/clk/qcom/dispcc-sm8250.c                   |    6 +-
 drivers/clk/qcom/dispcc-sm8450.c                   |    2 +-
 drivers/clk/qcom/dispcc0-sa8775p.c                 |    2 -
 drivers/clk/qcom/dispcc1-sa8775p.c                 |    2 -
 drivers/clk/qcom/gcc-glymur.c                      |    1 +
 drivers/clk/qcom/gcc-sc8180x.c                     |   64 +-
 drivers/clk/qcom/gcc-x1e80100.c                    |    1 +
 drivers/clk/qcom/gdsc.c                            |   12 +-
 drivers/clk/renesas/r9a09g057-cpg.c                |  145 +-
 drivers/clk/spacemit/ccu_mix.c                     |    2 +-
 drivers/clk/sunxi-ng/ccu-sun55i-a523-r.c           |   17 +-
 drivers/clk/visconti/pll.c                         |    2 +-
 drivers/cpufreq/amd-pstate.c                       |    6 +-
 drivers/cpufreq/cpufreq.c                          |    6 +-
 drivers/cpufreq/intel_pstate.c                     |    4 +-
 drivers/crypto/atmel-aes.c                         |   23 +-
 drivers/crypto/atmel-sha.c                         |   27 +-
 drivers/crypto/atmel-tdes.c                        |   25 +-
 drivers/crypto/ccp/ccp-crypto-aes.c                |    7 +-
 drivers/crypto/hisilicon/sec2/sec_crypto.c         |    2 +-
 drivers/crypto/inside-secure/eip93/eip93-common.c  |    2 +-
 drivers/crypto/inside-secure/eip93/eip93-main.c    |   16 +-
 drivers/crypto/inside-secure/eip93/eip93-regs.h    |    2 +-
 drivers/crypto/intel/iaa/iaa_crypto_main.c         |    2 +-
 .../crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c |   20 +-
 .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c   |   14 +-
 .../intel/qat/qat_common/adf_sysfs_ras_counters.c  |   12 +-
 .../intel/qat/qat_common/icp_qat_hw_20_comp.h      |   10 +-
 .../crypto/intel/qat/qat_common/qat_comp_algs.c    |   10 +-
 drivers/crypto/sa2ul.c                             |    4 +-
 drivers/crypto/tegra/tegra-se-aes.c                |    9 +
 drivers/crypto/tegra/tegra-se-hash.c               |    3 +
 drivers/cxl/pci.c                                  |    3 +
 drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c     |    2 -
 drivers/dma/mxs-dma.c                              |    1 +
 drivers/dpll/dpll_core.c                           |  106 +
 drivers/dpll/dpll_core.h                           |    6 +
 drivers/dpll/dpll_netlink.c                        |   16 +
 drivers/dpll/dpll_netlink.h                        |    2 -
 drivers/firmware/arm_ffa/driver.c                  |    2 +-
 drivers/firmware/efi/capsule-loader.c              |    2 +-
 drivers/fwctl/main.c                               |    2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c     |    2 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c            |    5 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c            |   57 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c             |    2 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c             |    2 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c              |   66 +
 drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c             |    1 +
 drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c             |    2 +
 drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c             |    1 +
 drivers/gpu/drm/amd/amdgpu/jpeg_v4_0.c             |    1 +
 drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c           |    1 +
 drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c           |    1 +
 drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c           |    1 +
 drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c           |    1 +
 drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c              |   10 +
 drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c              |    5 +
 drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c              |    2 +
 drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c              |    2 +
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c              |    3 +
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c              |    1 +
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c            |    1 +
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c            |    1 +
 drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c            |    1 +
 drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c            |    1 +
 drivers/gpu/drm/amd/display/dc/bios/bios_parser.c  |   62 +
 .../gpu/drm/amd/display/dc/dce/dce_link_encoder.c  |    4 +-
 .../amd/display/dc/resource/dce60/dce60_resource.c |    3 +-
 .../amd/display/dc/resource/dce80/dce80_resource.c |    3 +-
 .../amd/display/include/grph_object_ctrl_defs.h    |    4 +
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c     |   15 +
 .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c    |  118 +-
 .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.h    |    1 +
 drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h       |    1 +
 .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c    |   15 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_12_ppt.c  |    5 +-
 .../drm/arm/display/komeda/komeda_framebuffer.c    |    6 +-
 .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c    |   72 +-
 .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.h    |    1 +
 .../gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c    |   18 +-
 drivers/gpu/drm/drm_color_mgmt.c                   |    2 +-
 drivers/gpu/drm/drm_gem.c                          |    7 +-
 drivers/gpu/drm/gma500/oaktrail_hdmi.c             |    1 +
 drivers/gpu/drm/gma500/oaktrail_lvds.c             |    9 +-
 drivers/gpu/drm/i915/display/intel_dp.c            |    9 +-
 drivers/gpu/drm/i915/display/skl_watermark.c       |    4 +-
 drivers/gpu/drm/i915/gt/intel_reset.c              |    3 +-
 drivers/gpu/drm/imagination/pvr_rogue_fwif.h       |    8 +-
 .../gpu/drm/imagination/pvr_rogue_fwif_shared.h    |    6 +-
 drivers/gpu/drm/loongson/lsdc_drv.c                |    2 +-
 drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c        |   14 +-
 drivers/gpu/drm/msm/adreno/a6xx_hfi.c              |   14 +-
 .../drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h   |    7 -
 drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c           |    3 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c            |    2 -
 drivers/gpu/drm/msm/dp/dp_display.c                |    1 +
 drivers/gpu/drm/msm/dsi/dsi.c                      |    1 +
 drivers/gpu/drm/msm/dsi/dsi_cfg.c                  |    4 +-
 drivers/gpu/drm/msm/dsi/dsi_cfg.h                  |    2 +-
 drivers/gpu/drm/msm/dsi/dsi_host.c                 |   16 +-
 drivers/gpu/drm/msm/dsi/phy/dsi_phy.c              |    1 +
 drivers/gpu/drm/msm/hdmi/hdmi.c                    |    1 +
 drivers/gpu/drm/msm/hdmi/hdmi_phy.c                |    1 +
 drivers/gpu/drm/msm/msm_fb.c                       |    7 +-
 drivers/gpu/drm/msm/msm_gem.c                      |    3 +
 drivers/gpu/drm/msm/msm_gem_shrinker.c             |    5 +-
 drivers/gpu/drm/msm/msm_gem_vma.c                  |   11 +-
 drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c    |    1 +
 drivers/gpu/drm/panel/panel-simple.c               |    2 +-
 drivers/gpu/drm/panfrost/panfrost_drv.c            |    2 +
 drivers/gpu/drm/sun4i/sun4i_backend.c              |    6 +-
 drivers/gpu/drm/sysfb/ofdrm.c                      |    2 +
 drivers/gpu/drm/ttm/ttm_bo.c                       |    2 +-
 drivers/gpu/drm/ttm/ttm_resource.c                 |    5 +-
 drivers/gpu/drm/v3d/v3d_drv.c                      |   16 +-
 drivers/gpu/drm/v3d/v3d_submit.c                   |    5 +
 drivers/gpu/drm/virtio/virtgpu_prime.c             |    2 +-
 drivers/gpu/drm/xe/xe_dma_buf.c                    |   52 +-
 drivers/gpu/drm/xe/xe_eu_stall.c                   |    4 +-
 drivers/gpu/drm/xe/xe_exec_queue.c                 |    7 +-
 drivers/gpu/drm/xe/xe_gsc.c                        |    2 +-
 drivers/gpu/drm/xe/xe_reg_whitelist.c              |    2 +-
 drivers/gpu/nova-core/bitfield.rs                  |  318 +++
 drivers/gpu/nova-core/falcon.rs                    |   38 +-
 drivers/gpu/nova-core/nova_core.rs                 |    3 +
 drivers/gpu/nova-core/regs/macros.rs               |  259 +-
 drivers/hid/bpf/hid_bpf_dispatch.c                 |    6 +-
 drivers/hid/hid-asus.c                             |   28 +-
 drivers/hid/hid-core.c                             |   67 +-
 drivers/hid/hid-gfrm.c                             |    4 +-
 drivers/hid/hid-logitech-hidpp.c                   |    2 +-
 drivers/hid/hid-multitouch.c                       |    2 +-
 drivers/hid/hid-primax.c                           |    2 +-
 drivers/hid/hid-vivaldi-common.c                   |    2 +-
 drivers/hid/i2c-hid/i2c-hid-core.c                 |    7 +-
 drivers/hid/usbhid/hid-core.c                      |   13 +-
 drivers/hid/wacom_sys.c                            |    6 +-
 drivers/hte/Kconfig                                |    6 +-
 drivers/hwmon/aspeed-g6-pwm-tach.c                 |    8 -
 drivers/i3c/master.c                               |   32 +-
 drivers/i3c/master/adi-i3c-master.c                |    2 +-
 drivers/i3c/master/dw-i3c-master.c                 |   16 +-
 drivers/i3c/master/mipi-i3c-hci/dma.c              |    5 +-
 drivers/i3c/master/renesas-i3c.c                   |    4 +-
 drivers/infiniband/core/iwpm_msg.c                 |    6 +-
 drivers/iommu/amd/iommu.c                          |   15 +-
 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c     |    7 +-
 drivers/iommu/intel/iommu.c                        |   16 +-
 drivers/iommu/iommufd/selftest.c                   |    4 +-
 drivers/iommu/iommufd/vfio_compat.c                |    2 +-
 drivers/iommu/riscv/Kconfig                        |    1 +
 drivers/iommu/riscv/iommu-platform.c               |   17 +-
 drivers/iommu/riscv/iommu.c                        |   84 +-
 drivers/irqchip/irq-gic-v5-its.c                   |   34 +-
 drivers/irqchip/irq-gic-v5.c                       |   98 +-
 drivers/irqchip/irq-meson-gpio.c                   |    3 +-
 drivers/irqchip/irq-pic32-evic.c                   |    2 +-
 drivers/irqchip/irq-renesas-rzg2l.c                |    2 +-
 drivers/irqchip/irq-riscv-imsic-early.c            |    2 +
 drivers/leds/blink/leds-lgm-sso.c                  |    2 -
 drivers/mailbox/mailbox-test.c                     |   39 +-
 drivers/mailbox/mailbox.c                          |    3 +-
 drivers/mailbox/mtk-cmdq-mailbox.c                 |    8 +-
 drivers/md/dm-bufio.c                              |    3 +-
 drivers/md/dm-cache-metadata.c                     |   24 +-
 drivers/md/dm-cache-metadata.h                     |    5 -
 drivers/md/dm-cache-policy-smq.c                   |    4 +
 drivers/md/dm-cache-target.c                       |   76 +-
 drivers/md/dm-clone-target.c                       |    3 +-
 drivers/md/dm-crypt.c                              |    6 +-
 drivers/md/dm-delay.c                              |    4 +-
 drivers/md/dm-init.c                               |    4 +-
 drivers/md/dm-integrity.c                          |   15 +-
 drivers/md/dm-kcopyd.c                             |    3 +-
 drivers/md/dm-log-userspace-base.c                 |    3 +-
 drivers/md/dm-log.c                                |    6 +-
 drivers/md/dm-mpath.c                              |   14 +-
 drivers/md/dm-raid1.c                              |    5 +-
 drivers/md/dm-snap-persistent.c                    |    3 +-
 drivers/md/dm-stripe.c                             |    2 +-
 drivers/md/dm-verity-target.c                      |    4 +-
 drivers/md/dm-writecache.c                         |    3 +-
 drivers/md/dm.c                                    |    3 +-
 drivers/md/md-bitmap.c                             |  133 +-
 drivers/md/md-bitmap.h                             |    2 +-
 drivers/md/md-llbitmap.c                           |    7 +-
 drivers/md/md.c                                    |  257 +-
 drivers/md/md.h                                    |    3 +
 drivers/md/raid1-10.c                              |    7 +-
 drivers/md/raid1.c                                 |    4 +-
 drivers/media/i2c/og01a1b.c                        |   13 +-
 drivers/memory/tegra/tegra124-emc.c                |    2 +-
 drivers/memory/tegra/tegra30-emc.c                 |    6 +-
 drivers/mfd/mc13xxx-core.c                         |    2 +-
 drivers/mtd/maps/physmap-gemini.c                  |    2 +-
 drivers/mtd/nand/raw/sunxi_nand.c                  |    6 +-
 drivers/mtd/nand/spi/core.c                        |  100 +-
 drivers/mtd/nand/spi/esmt.c                        |    2 +-
 drivers/mtd/nand/spi/micron.c                      |    2 +-
 drivers/mtd/nand/spi/winbond.c                     |   71 +-
 drivers/mtd/parsers/ofpart_core.c                  |    4 +-
 drivers/mtd/spi-nor/core.c                         |    2 +-
 drivers/mtd/spi-nor/core.h                         |    8 +-
 drivers/mtd/spi-nor/sfdp.c                         |   30 +-
 drivers/mtd/spi-nor/swp.c                          |    4 +-
 drivers/net/bareudp.c                              |    3 +
 drivers/net/bonding/bond_3ad.c                     |  109 +-
 drivers/net/bonding/bond_main.c                    |    8 +-
 drivers/net/bonding/bond_netlink.c                 |   21 +-
 drivers/net/bonding/bond_procfs.c                  |    3 +-
 drivers/net/bonding/bond_sysfs_slave.c             |   17 +-
 drivers/net/dsa/realtek/rtl8365mb.c                |    2 +-
 drivers/net/ethernet/airoha/airoha_eth.c           |  711 ++++--
 drivers/net/ethernet/airoha/airoha_eth.h           |   82 +-
 drivers/net/ethernet/airoha/airoha_ppe.c           |  261 +-
 drivers/net/ethernet/airoha/airoha_ppe_debugfs.c   |    3 +-
 drivers/net/ethernet/airoha/airoha_regs.h          |  115 +-
 drivers/net/ethernet/amazon/ena/ena_com.c          |    7 +-
 drivers/net/ethernet/amazon/ena/ena_phc.c          |    5 +-
 .../net/ethernet/aquantia/atlantic/aq_pci_func.c   |    2 +-
 drivers/net/ethernet/broadcom/bnge/bnge_core.c     |   30 +-
 drivers/net/ethernet/broadcom/bnge/bnge_rmem.c     |   16 -
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |   30 +-
 drivers/net/ethernet/freescale/Makefile            |    3 +-
 drivers/net/ethernet/freescale/dpaa2/Kconfig       |    4 +
 drivers/net/ethernet/freescale/enetc/ntmp.c        |  231 +-
 .../net/ethernet/freescale/enetc/ntmp_private.h    |   10 +-
 drivers/net/ethernet/intel/e1000e/netdev.c         |    1 +
 drivers/net/ethernet/intel/i40e/i40e.h             |    1 +
 drivers/net/ethernet/intel/i40e/i40e_main.c        |    2 +-
 drivers/net/ethernet/intel/i40e/i40e_ptp.c         |    3 +-
 drivers/net/ethernet/intel/iavf/iavf.h             |    9 +-
 drivers/net/ethernet/intel/iavf/iavf_main.c        |   52 +-
 drivers/net/ethernet/intel/iavf/iavf_type.h        |    2 +-
 drivers/net/ethernet/intel/iavf/iavf_virtchnl.c    |   76 +-
 drivers/net/ethernet/intel/ice/devlink/devlink.c   |    2 +
 drivers/net/ethernet/intel/ice/ice_adminq_cmd.h    |    2 +-
 drivers/net/ethernet/intel/ice/ice_common.c        |    2 -
 drivers/net/ethernet/intel/ice/ice_dpll.c          |  146 +-
 drivers/net/ethernet/intel/ice/ice_main.c          |    2 +
 drivers/net/ethernet/intel/ice/ice_ptp.c           |   44 +-
 drivers/net/ethernet/intel/ice/ice_ptp_consts.h    |   12 +-
 drivers/net/ethernet/intel/ice/ice_ptp_hw.c        |  259 +-
 drivers/net/ethernet/intel/ice/ice_ptp_hw.h        |    5 +
 drivers/net/ethernet/intel/ice/ice_txrx.c          |    7 +-
 drivers/net/ethernet/intel/ice/ice_vf_lib.c        |    7 +-
 drivers/net/ethernet/intel/idpf/idpf_idc.c         |    6 +
 .../mellanox/mlx5/core/en_accel/ipsec_offload.c    |   12 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |    8 +
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |    4 +-
 drivers/net/ethernet/meta/fbnic/fbnic_pci.c        |    2 +-
 drivers/net/ethernet/microsoft/mana/gdma_main.c    |  184 +-
 drivers/net/ethernet/microsoft/mana/hw_channel.c   |   12 +
 drivers/net/ethernet/microsoft/mana/mana_en.c      |  303 ++-
 drivers/net/ethernet/microsoft/mana/mana_ethtool.c |  123 +-
 .../ethernet/netronome/nfp/nfpcore/nfp_target.c    |   17 +-
 drivers/net/ethernet/sfc/efx_devlink.c             |    2 +-
 drivers/net/ethernet/ti/Makefile                   |   30 +-
 drivers/net/ethernet/ti/cpsw.c                     |    2 +-
 drivers/net/ethernet/ti/cpsw_ale.c                 |   25 +
 drivers/net/ethernet/ti/cpsw_ethtool.c             |   24 +
 drivers/net/ethernet/ti/cpsw_new.c                 |    2 +-
 drivers/net/ethernet/ti/cpsw_priv.c                |   39 +-
 drivers/net/ethernet/ti/cpsw_priv.h                |    2 +-
 drivers/net/ethernet/ti/cpsw_sl.c                  |   11 +
 drivers/net/ethernet/ti/davinci_cpdma.c            |   27 +
 drivers/net/hamradio/6pack.c                       |    9 +-
 drivers/net/ipa/gsi.c                              |    1 +
 drivers/net/ipa/ipa_main.c                         |    6 +-
 drivers/net/macsec.c                               |   71 +-
 drivers/net/macvlan.c                              |    9 +-
 drivers/net/mctp/mctp-i2c.c                        |    4 +-
 drivers/net/netconsole.c                           |    7 +
 drivers/net/netdevsim/dev.c                        |    2 +-
 drivers/net/phy/dp83869.c                          |   13 +-
 drivers/net/phy/phy_device.c                       |    4 +-
 drivers/net/phy/qcom/at803x.c                      |    2 +-
 drivers/net/ppp/ppp_generic.c                      |    5 +-
 drivers/net/ppp/pppoe.c                            |    8 +-
 drivers/net/slip/slhc.c                            |   49 +-
 drivers/net/usb/r8152.c                            |    2 +-
 drivers/net/usb/rtl8150.c                          |   12 +-
 drivers/net/virtio_net.c                           |    6 +
 drivers/net/vrf.c                                  |   15 +-
 drivers/net/wireless/ath/ath10k/wmi-tlv.c          |   26 +-
 .../wireless/broadcom/brcm80211/brcmfmac/chip.c    |   15 +
 drivers/net/wireless/marvell/libertas/if_usb.c     |   32 +-
 drivers/net/wireless/marvell/libertas/if_usb.h     |    3 +
 drivers/net/wireless/marvell/mwifiex/11n_aggr.c    |    1 +
 drivers/net/wireless/mediatek/mt76/channel.c       |   13 +-
 drivers/net/wireless/mediatek/mt76/dma.c           |   11 +-
 drivers/net/wireless/mediatek/mt76/mac80211.c      |    1 +
 drivers/net/wireless/mediatek/mt76/mt76.h          |    4 +
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c    |   15 -
 drivers/net/wireless/mediatek/mt76/mt7615/main.c   |    7 +-
 drivers/net/wireless/mediatek/mt76/mt7615/mcu.c    |   47 +
 drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h |    5 +-
 drivers/net/wireless/mediatek/mt76/mt7615/regs.h   |    2 -
 .../net/wireless/mediatek/mt76/mt76_connac_mac.c   |    6 +-
 .../net/wireless/mediatek/mt76/mt76_connac_mcu.h   |    2 +
 drivers/net/wireless/mediatek/mt76/mt7915/init.c   |    1 +
 drivers/net/wireless/mediatek/mt76/mt7915/mac.c    |   13 -
 drivers/net/wireless/mediatek/mt76/mt7915/main.c   |    7 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |   62 +
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.h    |   11 +
 drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h |    4 +
 drivers/net/wireless/mediatek/mt76/mt7921/main.c   |   22 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h |    2 +
 drivers/net/wireless/mediatek/mt76/mt7925/mac.c    |    9 +-
 drivers/net/wireless/mediatek/mt76/mt7925/main.c   |   26 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c    |   91 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.h    |    8 +
 drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h |   11 +-
 drivers/net/wireless/mediatek/mt76/mt7996/init.c   |   22 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mac.c    |   75 +-
 drivers/net/wireless/mediatek/mt76/mt7996/main.c   |  128 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c    |   55 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.h    |    5 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h |    3 +
 drivers/net/wireless/mediatek/mt76/scan.c          |   66 +-
 drivers/net/wireless/realtek/rtlwifi/pci.c         |    1 +
 drivers/net/wireless/realtek/rtw89/phy.c           |    2 +-
 drivers/nfc/trf7970a.c                             |    3 +-
 drivers/nvme/host/apple.c                          |    1 +
 drivers/nvme/host/pci.c                            |    1 +
 drivers/nvme/target/tcp.c                          |   51 +-
 drivers/opp/core.c                                 |    2 +-
 drivers/opp/debugfs.c                              |   20 +-
 drivers/pci/controller/dwc/pci-imx6.c              |    4 +-
 .../pci/controller/dwc/pcie-designware-debugfs.c   |   21 +-
 drivers/pci/controller/dwc/pcie-designware-ep.c    |    2 +-
 drivers/pci/controller/dwc/pcie-designware-host.c  |   18 +-
 drivers/pci/controller/dwc/pcie-designware.c       |   16 +-
 drivers/pci/controller/dwc/pcie-designware.h       |    2 +
 drivers/pci/controller/dwc/pcie-qcom.c             |   17 +-
 drivers/pci/controller/dwc/pcie-rcar-gen4.c        |    2 +-
 drivers/pci/controller/dwc/pcie-tegra194.c         |  247 +-
 drivers/pci/controller/pcie-mediatek-gen3.c        |    8 +-
 drivers/pci/endpoint/functions/pci-epf-test.c      |    8 +-
 drivers/pci/endpoint/pci-ep-msi.c                  |    5 +
 drivers/pci/npem.c                                 |    2 +-
 drivers/pci/pci-driver.c                           |   20 +-
 drivers/pci/pci-sysfs.c                            |   28 -
 drivers/pci/pci.c                                  |   41 +-
 drivers/pci/pcie/dpc.c                             |    1 +
 drivers/pci/probe.c                                |    1 -
 drivers/pci/setup-bus.c                            |   26 +-
 drivers/pci/tph.c                                  |    9 +-
 drivers/pcmcia/rsrc_nonstatic.c                    |    6 +-
 drivers/pinctrl/nomadik/pinctrl-abx500.c           |    2 +-
 drivers/pinctrl/pinconf-generic.c                  |    7 +-
 drivers/pinctrl/pinctrl-cy8c95x0.c                 |   27 +-
 drivers/pinctrl/pinctrl-pic32.c                    |   20 +-
 drivers/pinctrl/realtek/pinctrl-rtd.c              |    2 +-
 drivers/pinctrl/renesas/pinctrl-rzg2l.c            |    7 +
 drivers/pinctrl/sophgo/pinctrl-sg2042.c            |    2 +-
 drivers/pinctrl/sophgo/pinctrl-sg2044.c            |    2 +-
 drivers/platform/chrome/chromeos_tbmc.c            |    6 +
 drivers/platform/surface/surfacepro3_button.c      |    1 +
 drivers/platform/x86/asus-wmi.c                    |   50 +-
 drivers/platform/x86/barco-p50-gpio.c              |    5 +-
 .../x86/dell/dell-wmi-sysman/enum-attributes.c     |   34 +-
 drivers/platform/x86/dell/dell_rbu.c               |    6 +-
 drivers/platform/x86/intel/vsec_tpmi.c             |   10 +-
 drivers/platform/x86/lenovo/wmi-events.c           |    2 +-
 drivers/platform/x86/lenovo/wmi-gamezone.c         |    1 -
 drivers/platform/x86/lenovo/wmi-gamezone.h         |   20 -
 drivers/platform/x86/lenovo/wmi-helpers.h          |   13 +
 drivers/platform/x86/lenovo/wmi-other.c            |    8 +-
 drivers/platform/x86/panasonic-laptop.c            |    5 +-
 drivers/platform/x86/wmi.c                         |   36 +-
 drivers/pmdomain/imx/scu-pd.c                      |    1 +
 drivers/pmdomain/ti/omap_prm.c                     |    1 +
 drivers/pwm/pwm-atmel-tcb.c                        |   38 +-
 drivers/pwm/pwm-stm32.c                            |   22 +-
 drivers/remoteproc/imx_rproc.c                     |    6 +-
 drivers/remoteproc/xlnx_r5_remoteproc.c            |    2 +-
 drivers/reset/amlogic/reset-meson.c                |    1 +
 drivers/rtc/rtc-abx80x.c                           |    2 +
 drivers/s390/cio/cio.h                             |    5 -
 drivers/s390/cio/css.c                             |   34 +-
 drivers/scsi/sg.c                                  |   31 +-
 drivers/scsi/sr.c                                  |   11 +-
 drivers/scsi/sr.h                                  |    1 -
 drivers/soc/qcom/llcc-qcom.c                       |    2 +-
 drivers/soc/qcom/ocmem.c                           |   17 +-
 drivers/soc/qcom/qcom_aoss.c                       |    2 +-
 drivers/soc/tegra/cbb/tegra234-cbb.c               |   35 +-
 drivers/soundwire/bus.c                            |    8 +-
 drivers/soundwire/cadence_master.c                 |    8 +
 drivers/soundwire/debugfs.c                        |    9 +-
 drivers/soundwire/intel_ace2x.c                    |    5 +
 drivers/spi/spi-amlogic-spisg.c                    |    3 +-
 drivers/spi/spi-fsl-qspi.c                         |    3 +-
 drivers/spi/spi-hisi-kunpeng.c                     |   12 +-
 drivers/spi/spi-mtk-snfi.c                         |   14 +
 drivers/spi/spi-nxp-fspi.c                         |    3 +-
 drivers/spi/spi-rockchip.c                         |    3 +-
 drivers/spi/spi-sifive.c                           |   29 +-
 drivers/staging/greybus/hid.c                      |    2 +-
 drivers/staging/media/imx/imx-media-csi.c          |   44 +-
 drivers/target/target_core_sbc.c                   |    3 +-
 drivers/thermal/spear_thermal.c                    |    2 +-
 drivers/tty/hvc/hvc_iucv.c                         |    2 +-
 drivers/tty/serial/ip22zilog.c                     |    2 +-
 drivers/usb/typec/mux/ps883x.c                     |    1 +
 drivers/usb/typec/tipd/core.c                      |    6 +-
 drivers/vdpa/vdpa.c                                |   48 +-
 drivers/vfio/fsl-mc/vfio_fsl_mc.c                  |    4 +-
 drivers/vfio/pci/vfio_pci_core.c                   |   64 +-
 drivers/vhost/net.c                                |    4 +-
 drivers/video/backlight/sky81452-backlight.c       |    3 +
 drivers/video/fbdev/matrox/g450_pll.c              |    2 +-
 drivers/video/fbdev/offb.c                         |    7 +-
 drivers/virt/coco/arm-cca-guest/arm-cca-guest.c    |    3 +-
 drivers/virt/coco/sev-guest/sev-guest.c            |   12 +-
 drivers/xen/xen-pciback/pci_stub.c                 |    6 +-
 fs/adfs/super.c                                    |    3 +
 fs/btrfs/disk-io.c                                 |    1 +
 fs/btrfs/inode.c                                   |    8 +-
 fs/btrfs/reflink.c                                 |   45 +
 fs/btrfs/transaction.c                             |    9 +-
 fs/ceph/xattr.c                                    |   17 +
 fs/dcache.c                                        |   18 +-
 fs/debugfs/file.c                                  |    7 +-
 fs/erofs/data.c                                    |   14 +
 fs/erofs/erofs_fs.h                                |    4 +-
 fs/erofs/inode.c                                   |    2 +-
 fs/erofs/super.c                                   |    8 +-
 fs/erofs/zdata.c                                   |    2 +-
 fs/erofs/zmap.c                                    |   19 +-
 fs/eventpoll.c                                     |  126 +-
 fs/ext4/mballoc-test.c                             |    6 +-
 fs/f2fs/f2fs.h                                     |   98 +-
 fs/f2fs/gc.c                                       |   28 +-
 fs/f2fs/super.c                                    |   76 +-
 fs/f2fs/sysfs.c                                    |    7 +-
 fs/fuse/dir.c                                      |  226 +-
 fs/fuse/file.c                                     |   20 +-
 fs/fuse/fuse_i.h                                   |   10 +
 fs/fuse/inode.c                                    |    3 +
 fs/gfs2/aops.c                                     |    5 +-
 fs/gfs2/inode.c                                    |    3 +-
 fs/gfs2/log.c                                      |   33 +-
 fs/mbcache.c                                       |    1 +
 fs/netfs/iterator.c                                |   13 +-
 fs/nfs/blocklayout/blocklayout.c                   |    4 +-
 fs/nfsd/nfs4state.c                                |   17 +-
 fs/nilfs2/ioctl.c                                  |    6 +
 fs/notify/fanotify/fanotify_user.c                 |   50 +-
 fs/notify/mark.c                                   |   39 +-
 fs/ntfs3/super.c                                   |    7 +-
 fs/ocfs2/dlm/dlmdomain.c                           |   10 +-
 fs/ocfs2/ioctl.c                                   |   18 +-
 fs/ocfs2/resize.c                                  |   12 +-
 fs/ocfs2/xattr.c                                   |    4 +-
 fs/omfs/inode.c                                    |    6 +
 fs/pstore/ram_core.c                               |    4 +
 fs/quota/dquot.c                                   |   38 +-
 fs/smb/client/cifsglob.h                           |   22 -
 fs/smb/client/ioctl.c                              |    2 +-
 fs/smb/client/smb2file.c                           |    3 +
 fs/smb/client/smb2transport.c                      |   32 +-
 fs/smb/common/cifsglob.h                           |   31 +
 fs/smb/server/auth.c                               |   11 +-
 fs/smb/server/connection.c                         |    9 +
 fs/smb/server/mgmt/user_session.c                  |   12 +-
 fs/smb/server/smb2misc.c                           |    2 +-
 fs/smb/server/smb2ops.c                            |   32 +-
 fs/smb/server/smb2pdu.c                            |   25 +-
 fs/smb/server/smb_common.h                         |   29 -
 fs/tracefs/event_inode.c                           |    2 +-
 fs/xfs/xfs_zone_alloc.c                            |    2 +-
 include/acpi/actbl1.h                              |    6 +
 include/dt-bindings/clock/qcom,dispcc-sc7180.h     |    7 +-
 include/dt-bindings/clock/qcom,gcc-sc8180x.h       |    5 +
 include/dt-bindings/clock/qcom,glymur-gcc.h        |    1 +
 include/linux/bpf_verifier.h                       |    6 +-
 include/linux/cdrom.h                              |    1 +
 include/linux/cpufreq.h                            |    4 +-
 include/linux/cpuhotplug.h                         |    1 -
 include/linux/dcache.h                             |    2 +
 include/linux/dmi.h                                |    5 +
 include/linux/dpll.h                               |   41 +
 include/linux/fsl/mc.h                             |    4 -
 include/linux/fsl/ntmp.h                           |    9 +-
 include/linux/hid.h                                |    6 +-
 include/linux/hid_bpf.h                            |   14 +-
 include/linux/ieee80211-eht.h                      | 1182 +++++++++
 include/linux/ieee80211-he.h                       |  824 ++++++
 include/linux/ieee80211-ht.h                       |  292 +++
 include/linux/ieee80211-mesh.h                     |  230 ++
 include/linux/ieee80211-vht.h                      |  236 ++
 include/linux/ieee80211.h                          | 2663 +-------------------
 include/linux/iopoll.h                             |    8 +-
 include/linux/irqchip/arm-gic-v5.h                 |    3 -
 include/linux/kernel.h                             |  196 +-
 include/linux/moduleparam.h                        |   11 +-
 include/linux/mtd/spinand.h                        |   69 +-
 include/linux/nstree.h                             |    6 +-
 include/linux/padata.h                             |    8 +-
 include/linux/pci.h                                |    6 -
 include/linux/pm_domain.h                          |    4 +-
 include/linux/ppp_defs.h                           |   16 +
 include/linux/printk.h                             |    5 +-
 include/linux/quotaops.h                           |    9 +-
 include/linux/sched/topology.h                     |   24 +-
 include/linux/slab.h                               |   58 +
 include/linux/spinlock_up.h                        |   20 +-
 include/linux/stop_machine.h                       |    4 +-
 include/linux/tcp.h                                |    4 +-
 include/linux/trace_printk.h                       |  203 ++
 include/linux/vdpa.h                               |    4 -
 include/linux/vfio.h                               |    2 -
 include/linux/vfio_pci_core.h                      |   13 +
 include/linux/wmi.h                                |    4 -
 include/net/bond_3ad.h                             |    2 +-
 include/net/mana/gdma.h                            |   29 +-
 include/net/mana/hw_channel.h                      |    2 +
 include/net/mana/mana.h                            |   24 +-
 include/net/pie.h                                  |    2 +-
 include/net/tcp.h                                  |   33 +-
 include/net/tcp_ecn.h                              |    2 +-
 include/sound/soc.h                                |    3 +
 include/trace/events/net.h                         |    4 +-
 include/trace/events/timer.h                       |   11 +-
 include/uapi/linux/if_link.h                       |    2 +
 include/uapi/linux/iommufd.h                       |    5 +
 include/uapi/linux/mii.h                           |    3 +-
 io_uring/io-wq.c                                   |    3 +-
 io_uring/napi.c                                    |    2 +
 kernel/Kconfig.kexec                               |   12 +-
 kernel/Makefile                                    |    1 +
 kernel/audit.c                                     |    4 +
 kernel/auditsc.c                                   |    2 +-
 kernel/bpf/arena.c                                 |    4 +
 kernel/bpf/arraymap.c                              |    4 +-
 kernel/bpf/bpf_lsm.c                               |    3 -
 kernel/bpf/core.c                                  |    2 +
 kernel/bpf/devmap.c                                |    5 +-
 kernel/bpf/hashtab.c                               |    2 +-
 kernel/bpf/helpers.c                               |   17 +-
 kernel/bpf/local_storage.c                         |    2 +-
 kernel/bpf/syscall.c                               |   17 +
 kernel/bpf/task_iter.c                             |  151 +-
 kernel/bpf/verifier.c                              |  189 +-
 kernel/cgroup/cgroup.c                             |   46 +-
 kernel/cgroup/dmem.c                               |    1 +
 kernel/cgroup/rdma.c                               |    2 +-
 kernel/fork.c                                      |   23 +-
 kernel/futex/requeue.c                             |   13 +-
 kernel/kexec_handover.c                            |  269 +-
 kernel/kexec_handover_debugfs.c                    |  216 ++
 kernel/kexec_handover_internal.h                   |   35 +
 kernel/module/main.c                               |    4 +-
 kernel/padata.c                                    |  130 +-
 kernel/params.c                                    |   42 +-
 kernel/sched/core.c                                |   25 +-
 kernel/sched/cpufreq_schedutil.c                   |    5 +-
 kernel/sched/deadline.c                            |   18 +-
 kernel/sched/ext.c                                 |   14 +-
 kernel/sched/fair.c                                |  166 +-
 kernel/sched/rt.c                                  |   20 +-
 kernel/sched/topology.c                            |   14 +-
 kernel/time/hrtimer.c                              |   51 +-
 kernel/trace/trace.c                               |    7 +-
 kernel/trace/trace.h                               |    2 +-
 kernel/trace/trace_branch.c                        |    8 +-
 kernel/trace/trace_events_hist.c                   |   12 +-
 kernel/trace/trace_printk.c                        |    1 +
 kernel/workqueue.c                                 |    4 +-
 lib/tests/kunit_iov_iter.c                         |   14 +-
 mm/memblock.c                                      |    2 +-
 net/bluetooth/hci_event.c                          |    3 -
 net/bluetooth/l2cap_core.c                         |    8 +-
 net/bluetooth/sco.c                                |    3 +-
 net/bpf/test_run.c                                 |   35 +-
 net/ceph/crush/crush.c                             |    6 +-
 net/ceph/osdmap.c                                  |   14 +-
 net/core/filter.c                                  |    6 +-
 net/core/neighbour.c                               |   10 +-
 net/core/netpoll.c                                 |   19 +-
 net/core/page_pool.c                               |   10 +-
 net/dsa/conduit.c                                  |  169 +-
 net/ipv4/netfilter/arp_tables.c                    |   18 +-
 net/ipv4/netfilter/arpt_mangle.c                   |    8 +
 net/ipv4/netfilter/iptable_nat.c                   |    4 +-
 net/ipv4/nexthop.c                                 |    4 +-
 net/ipv4/syncookies.c                              |    2 +-
 net/ipv4/tcp.c                                     |   91 +-
 net/ipv4/tcp_bbr.c                                 |    6 +-
 net/ipv4/tcp_bic.c                                 |    2 +-
 net/ipv4/tcp_cdg.c                                 |    4 +-
 net/ipv4/tcp_cubic.c                               |    6 +-
 net/ipv4/tcp_dctcp.c                               |    2 +-
 net/ipv4/tcp_input.c                               |   56 +-
 net/ipv4/tcp_metrics.c                             |    6 +-
 net/ipv4/tcp_nv.c                                  |    4 +-
 net/ipv4/tcp_output.c                              |   43 +-
 net/ipv4/tcp_plb.c                                 |    2 +-
 net/ipv4/tcp_timer.c                               |    7 +-
 net/ipv4/tcp_vegas.c                               |    9 +-
 net/ipv4/tcp_westwood.c                            |    4 +-
 net/ipv4/tcp_yeah.c                                |    3 +-
 net/ipv4/udp.c                                     |   12 +-
 net/ipv6/icmp.c                                    |   10 +-
 net/ipv6/netfilter/ip6table_nat.c                  |    4 +-
 net/ipv6/udp.c                                     |   13 +-
 net/mac80211/mlme.c                                |    3 +-
 net/netfilter/ipvs/ip_vs_xmit.c                    |   19 +-
 net/netfilter/nf_conntrack_proto_sctp.c            |   10 +-
 net/netfilter/nf_conntrack_sip.c                   |  160 +-
 net/netfilter/nf_nat_amanda.c                      |    2 +-
 net/netfilter/nf_nat_core.c                        |   10 +-
 net/netfilter/nf_nat_sip.c                         |   34 +-
 net/netfilter/nf_tables_api.c                      |   44 +-
 net/netfilter/nfnetlink_osf.c                      |   45 +-
 net/netfilter/nft_ct.c                             |    2 +
 net/netfilter/nft_fwd_netdev.c                     |   10 +
 net/netfilter/nft_osf.c                            |    6 +-
 net/netfilter/xt_mac.c                             |   34 +-
 net/netfilter/xt_owner.c                           |   37 +-
 net/netfilter/xt_physdev.c                         |   29 +-
 net/netfilter/xt_policy.c                          |    2 +-
 net/netfilter/xt_realm.c                           |    2 +-
 net/netfilter/xt_socket.c                          |   23 +-
 net/openvswitch/datapath.c                         |   35 +-
 net/openvswitch/vport.c                            |    3 +
 net/psp/psp-nl-gen.c                               |    4 +-
 net/psp/psp_nl.c                                   |   10 +-
 net/rds/af_rds.c                                   |   10 +-
 net/rds/connection.c                               |   14 +
 net/rds/ib.c                                       |   24 +-
 net/rds/ib.h                                       |    1 +
 net/rds/ib_rdma.c                                  |    2 +-
 net/sched/act_ct.c                                 |    8 +-
 net/sched/act_mirred.c                             |    2 +-
 net/sched/sch_cake.c                               |   53 +-
 net/sched/sch_choke.c                              |   26 +-
 net/sched/sch_dualpi2.c                            |   32 +-
 net/sched/sch_fq_codel.c                           |    3 +-
 net/sched/sch_fq_pie.c                             |   19 +-
 net/sched/sch_hhf.c                                |   19 +-
 net/sched/sch_netem.c                              |   76 +-
 net/sched/sch_pie.c                                |   52 +-
 net/sched/sch_red.c                                |   31 +-
 net/sched/sch_sfb.c                                |   54 +-
 net/sched/sch_taprio.c                             |   22 +-
 net/sctp/inqueue.c                                 |    1 +
 net/sctp/sm_statefuns.c                            |    6 +
 net/sctp/socket.c                                  |    2 +-
 net/tipc/msg.c                                     |   14 +-
 net/tls/tls.h                                      |    1 +
 net/tls/tls_strp.c                                 |    6 +
 net/tls/tls_sw.c                                   |    4 +
 net/unix/af_unix.c                                 |    9 +-
 net/unix/unix_bpf.c                                |    3 +
 net/vmw_vsock/virtio_transport_common.c            |   11 +-
 rust/kernel/cpufreq.rs                             |   13 +-
 rust/kernel/sync/atomic.rs                         |    5 +-
 scripts/gdb/linux/timerlist.py                     |    2 +-
 scripts/package/builddeb                           |    8 +-
 security/integrity/ima/ima_crypto.c                |    2 +-
 security/integrity/ima/ima_fs.c                    |   16 +-
 sound/core/compress_offload.c                      |    7 -
 sound/core/sound.c                                 |    7 +
 sound/hda/codecs/cmedia.c                          |    7 -
 sound/hda/codecs/conexant.c                        |    8 +-
 sound/hda/codecs/realtek/alc269.c                  |   22 +-
 sound/hda/codecs/side-codecs/cs35l56_hda.c         |   12 +-
 sound/hda/codecs/side-codecs/cs35l56_hda.h         |    1 +
 sound/hda/codecs/side-codecs/tas2781_hda_spi.c     |   14 +-
 sound/isa/sc6000.c                                 |  152 +-
 sound/soc/amd/acp/acp-legacy-mach.c                |    2 +-
 sound/soc/amd/acp/acp-mach-common.c                |   22 +-
 sound/soc/amd/acp/acp-mach.h                       |    4 +
 sound/soc/amd/acp/acp-sdw-legacy-mach.c            |    4 +-
 sound/soc/amd/acp/acp-sof-mach.c                   |    2 +-
 sound/soc/codecs/ab8500-codec.c                    |    6 +-
 sound/soc/codecs/tas2764.c                         |    1 +
 sound/soc/codecs/tas2770.c                         |    4 +-
 sound/soc/fsl/fsl_easrc.c                          |  123 +-
 sound/soc/fsl/fsl_micfil.c                         |   60 +-
 sound/soc/fsl/fsl_xcvr.c                           |   22 +-
 sound/soc/intel/Kconfig                            |    2 +-
 sound/soc/intel/avs/tgl.c                          |   38 +-
 sound/soc/qcom/qdsp6/topology.c                    |    8 +-
 sound/soc/renesas/rcar/core.c                      |    2 +-
 sound/soc/rockchip/rockchip_sai.c                  |    4 +
 sound/soc/sdca/sdca_asoc.c                         |   41 +-
 sound/soc/soc-compress.c                           |    4 +-
 sound/soc/soc-pcm.c                                |    4 +-
 sound/soc/sof/compress.c                           |    8 +-
 sound/soc/sof/intel/hda-stream.c                   |   10 +-
 sound/soc/sof/sof-priv.h                           |    2 +
 sound/soc/sti/uniperif_player.c                    |    9 +-
 sound/usb/midi.c                                   |   12 +-
 sound/usb/midi2.c                                  |   12 +-
 sound/usb/mixer_scarlett2.c                        |    2 +-
 sound/usb/qcom/qc_audio_offload.c                  |   33 +-
 sound/usb/quirks.c                                 |    3 +-
 sound/usb/stream.c                                 |   58 +-
 sound/usb/stream.h                                 |    3 +-
 tools/include/nolibc/stdio.h                       |  138 +-
 tools/lib/bpf/libbpf.c                             |   23 +-
 tools/lib/bpf/relo_core.c                          |    2 +
 tools/perf/builtin-lock.c                          |    2 +-
 tools/perf/builtin-stat.c                          |   43 +-
 tools/perf/builtin-trace.c                         |   12 +-
 tools/perf/util/branch.h                           |    3 +
 tools/perf/util/cgroup.c                           |   30 +-
 tools/perf/util/cs-etm-decoder/cs-etm-decoder.c    |   51 +-
 tools/perf/util/expr.c                             |    3 +-
 tools/perf/util/maps.c                             |   15 +-
 tools/perf/util/symbol-elf.c                       |    8 +-
 tools/perf/util/util.h                             |    1 -
 tools/power/x86/turbostat/turbostat.8              |   12 +-
 tools/power/x86/turbostat/turbostat.c              |   26 +-
 tools/testing/ktest/ktest.pl                       |   35 +-
 tools/testing/selftests/arm64/gcs/gcs-util.h       |    6 -
 tools/testing/selftests/arm64/gcs/libc-gcs.c       |    1 +
 .../testing/selftests/bpf/prog_tests/reg_bounds.c  |   35 +
 tools/testing/selftests/bpf/prog_tests/snprintf.c  |    3 +-
 tools/testing/selftests/bpf/progs/bpf_misc.h       |    2 +-
 .../testing/selftests/bpf/progs/verifier_bounds.c  |    2 +-
 .../selftests/bpf/progs/verifier_scalar_ids.c      |    8 +-
 tools/testing/selftests/cgroup/test_memcontrol.c   |   11 +-
 .../selftests/futex/functional/futex_requeue.c     |   49 +-
 tools/testing/selftests/kho/vmtest.sh              |    1 +
 tools/testing/selftests/mm/migration.c             |    3 +-
 .../selftests/net/netfilter/nft_tproxy_udp.sh      |   14 +-
 .../net/packetdrill/tcp_ts_recent_invalid_ack.pkt  |    4 +-
 tools/testing/selftests/powerpc/vphn/Makefile      |    2 +-
 tools/testing/selftests/sched_ext/exit.c           |    2 +-
 tools/tracing/rtla/src/actions.c                   |    7 +-
 tools/tracing/rtla/src/osnoise_hist.c              |   26 +-
 tools/tracing/rtla/src/osnoise_top.c               |   26 +-
 tools/tracing/rtla/src/timerlat_hist.c             |   26 +-
 tools/tracing/rtla/src/timerlat_top.c              |   26 +-
 tools/tracing/rtla/src/utils.c                     |   65 +-
 tools/tracing/rtla/src/utils.h                     |    3 +
 virt/kvm/dirty_ring.c                              |    3 +-
 879 files changed, 14292 insertions(+), 8434 deletions(-)

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ming Lei <[email protected]>

[ Upstream commit 3dbaacf6ab68f81e3375fe769a2ecdbd3ce386fd ]

When a queue is shared across disk rebind (e.g., SCSI unbind/bind), the previous disk's blkcg state is cleaned up asynchronously via disk_release() -> blkcg_exit_disk(). If the new disk's blkcg_init_disk() runs before that cleanup finishes, we may overwrite q->root_blkg while the old one is still alive, and radix_tree_insert() in blkg_create() fails with -EEXIST because the old blkg entries still occupy the same queue id slot in blkcg->blkg_tree. This causes the sd probe to fail with -ENOMEM.

Fix it by waiting in blkcg_init_disk() for root_blkg to become NULL, which indicates the previous disk's blkcg cleanup has completed.

---
 block/blk-cgroup.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

index 3cffb68ba5d87..890c161bee25e 100644
@@ -24,6 +24,7 @@
 #include <linux/backing-dev.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
+#include <linux/wait_bit.h>
 #include <linux/atomic.h>
 #include <linux/ctype.h>
 #include <linux/resume_user_mode.h>

@@ -611,6 +612,8 @@ static void blkg_destroy_all(struct gendisk *disk)
 
 	q->root_blkg = NULL;
 	spin_unlock_irq(&q->queue_lock);
+
+	wake_up_var(&q->root_blkg);
 }
 
 static void blkg_iostat_set(struct blkg_iostat *dst, struct blkg_iostat *src)

@@ -1498,6 +1501,18 @@ int blkcg_init_disk(struct gendisk *disk)
 	struct blkcg_gq *new_blkg, *blkg;
 	bool preloaded;
 
+	/*
+	 * If the queue is shared across disk rebind (e.g., SCSI), the
+	 * previous disk's blkcg state is cleaned up asynchronously via
+	 * disk_release() -> blkcg_exit_disk(). Wait for that cleanup to
+	 * finish (indicated by root_blkg becoming NULL) before setting up
+	 * new blkcg state. Otherwise, we may overwrite q->root_blkg while
+	 * the old one is still alive, and radix_tree_insert() in
+	 * blkg_create() will fail with -EEXIST because the old entries
+	 * still occupy the same queue id slot in blkcg->blkg_tree.
+	 */
+	wait_var_event(&q->root_blkg, !READ_ONCE(q->root_blkg));
+
 	new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL);
 	if (!new_blkg)
 		return -ENOMEM;

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: HyungJung Joo <[email protected]>

[ Upstream commit 0621c385fda1376e967f37ccd534c26c3e511d14 ]

omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).

Later, omfs_make_empty() uses

    sbi->s_sys_blocksize - OMFS_DIR_START

as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer.

Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed.

---
 fs/omfs/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

index 135c49c5d848c..31218d89b7580 100644
@@ -512,6 +512,12 @@ static int omfs_fill_super(struct super_block *sb, struct fs_context *fc)
 		goto out_brelse_bh;
 	}
 
+	if (sbi->s_sys_blocksize < OMFS_DIR_START) {
+		printk(KERN_ERR "omfs: sysblock size (%d) is too small\n",
+			sbi->s_sys_blocksize);
+		goto out_brelse_bh;
+	}
+
 	if (sbi->s_blocksize < sbi->s_sys_blocksize ||
 	    sbi->s_blocksize > OMFS_MAX_BLOCK_SIZE) {
 		printk(KERN_ERR "omfs: block size (%d) is out of range\n",

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: HyungJung Joo <[email protected]>

[ Upstream commit d227786ab1119669df4dc333a61510c52047cce4 ]

mb_cache_destroy() calls shrinker_free() and then frees all cache entries and the cache itself, but it does not cancel the pending c_shrink_work work item first.

If mb_cache_entry_create() schedules c_shrink_work via schedule_work() and the work item is still pending or running when mb_cache_destroy() runs, mb_cache_shrink_worker() will access the cache after its memory has been freed, causing a use-after-free.

This is only reachable by a privileged user (root or CAP_SYS_ADMIN) who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem.

Cancel the work item with cancel_work_sync() before calling shrinker_free(), ensuring the worker has finished and will not be rescheduled before the cache is torn down.

---
 fs/mbcache.c | 1 +
 1 file changed, 1 insertion(+)

index e60a840999aa9..90b0564c62d0b 100644
@@ -408,6 +408,7 @@ void mb_cache_destroy(struct mb_cache *cache)
 {
 	struct mb_cache_entry *entry, *next;
 
+	cancel_work_sync(&cache->c_shrink_work);
 	shrinker_free(cache->c_shrink);
 
 	/*

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xiao Ni <[email protected]>

[ Upstream commit de3544d2e5ea99064498de3c21ba490155864657 ]

Interval tree uses [start, end] as a region which stores in the tree. In raid1, it uses the wrong end value. For example:
bio(A,B) is too big and needs to be split to bio1(A,C-1), bio2(C,B). The region of bio1 is [A,C] and the region of bio2 is [C,B]. So bio1 and bio2 overlap which is not right.

Fix this problem by using right end value of the region.

---
 drivers/md/raid1.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index ce7fd68869566..84dbf801e9b1b 100644
@@ -62,7 +62,7 @@ static int check_and_add_serial(struct md_rdev *rdev, struct r1bio *r1_bio,
 	unsigned long flags;
 	int ret = 0;
 	sector_t lo = r1_bio->sector;
-	sector_t hi = lo + r1_bio->sectors;
+	sector_t hi = lo + r1_bio->sectors - 1;
 	struct serial_in_rdev *serial = &rdev->serial[idx];
 
 	spin_lock_irqsave(&serial->serial_lock, flags);

@@ -453,7 +453,7 @@ static void raid1_end_write_request(struct bio *bio)
 	int mirror = find_bio_disk(r1_bio, bio);
 	struct md_rdev *rdev = conf->mirrors[mirror].rdev;
 	sector_t lo = r1_bio->sector;
-	sector_t hi = r1_bio->sector + r1_bio->sectors;
+	sector_t hi = r1_bio->sector + r1_bio->sectors - 1;
 	bool ignore_error = !raid1_should_handle_error(bio) ||
 		(bio->bi_status && bio_op(bio) == REQ_OP_DISCARD);
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bart Van Assche <[email protected]>

[ Upstream commit 2b31e86387e60b3689339f0f0fbb4d3623d9d494 ]

Make drbd_adm_dump_devices() call rcu_read_lock() before rcu_read_unlock() is called. This has been detected by the Clang thread-safety analyzer.

---
 drivers/block/drbd/drbd_nl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

index b502038be0a92..0ddbf71286a91 100644
@@ -3378,8 +3378,10 @@ int drbd_adm_dump_devices(struct sk_buff *skb, struct netlink_callback *cb)
 		if (resource_filter) {
 			retcode = ERR_RES_NOT_KNOWN;
 			resource = drbd_find_resource(nla_data(resource_filter));
-			if (!resource)
+			if (!resource) {
+				rcu_read_lock();
 				goto put_result;
+			}
 			cb->args[0] = (long)resource;
 		}
 	}

@@ -3628,8 +3630,10 @@ int drbd_adm_dump_peer_devices(struct sk_buff *skb, struct netlink_callback *cb)
 		if (resource_filter) {
 			retcode = ERR_RES_NOT_KNOWN;
 			resource = drbd_find_resource(nla_data(resource_filter));
-			if (!resource)
+			if (!resource) {
+				rcu_read_lock();
 				goto put_result;
+			}
 		}
 		cb->args[0] = (long)resource;
 	}

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daan De Meyer <[email protected]>

[ Upstream commit 267ec4d7223a783f029a980f41b93c39b17996da ]

When LOOP_CONFIGURE is called with LO_FLAGS_PARTSCAN, the following sequence occurs:

1. disk_force_media_change() sets GD_NEED_PART_SCAN
2. Uevent suppression is lifted and a KOBJ_CHANGE uevent is sent
3. loop_global_unlock() releases the lock
4. loop_reread_partitions() calls bdev_disk_changed() to scan

There is a race between steps 2 and 4: when udev receives the uevent and opens the device before loop_reread_partitions() runs, blkdev_get_whole() in bdev.c sees GD_NEED_PART_SCAN set and calls bdev_disk_changed() for a first scan. Then loop_reread_partitions() does a second scan. The open_mutex serializes these two scans, but does not prevent both from running.

The second scan in bdev_disk_changed() drops all partition devices from the first scan (via blk_drop_partitions()) before re-adding them, causing partition block devices to briefly disappear. This breaks any systemd unit with BindsTo= on the partition device: systemd observes the device going dead, fails the dependent units, and does not retry them when the device reappears.

Fix this by removing the GD_NEED_PART_SCAN set from disk_force_media_change() entirely. None of the current callers need the lazy on-open partition scan triggered by this flag:

- floppy: sets GENHD_FL_NO_PART, so disk_has_partscan() is always false and GD_NEED_PART_SCAN has no effect.
- loop (loop_configure, loop_change_fd): when LO_FLAGS_PARTSCAN is set, loop_reread_partitions() performs an explicit scan. When not set, GD_SUPPRESS_PART_SCAN prevents the lazy scan path.
- loop (__loop_clr_fd): calls bdev_disk_changed() explicitly if LO_FLAGS_PARTSCAN is set.
- nbd (nbd_clear_sock_ioctl): capacity is set to zero immediately after; nbd manages GD_NEED_PART_SCAN explicitly elsewhere.

With GD_NEED_PART_SCAN no longer set by disk_force_media_change(), udev opening the loop device after the uevent no longer triggers a redundant scan in blkdev_get_whole(), and only the single explicit scan from loop_reread_partitions() runs.

A regression test for this bug has been submitted to blktests:
https://github.com/linux-blktests/blktests/pull/240.

---
 block/disk-events.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 2f697224386aa..868823915bdc6 100644
@@ -290,13 +290,14 @@ EXPORT_SYMBOL(disk_check_media_change);
  * Should be called when the media changes for @disk.  Generates a uevent
  * and attempts to free all dentries and inodes and invalidates all block
  * device page cache entries in that case.
+ *
+ * Callers that need a partition re-scan should arrange for one explicitly.
  */
 void disk_force_media_change(struct gendisk *disk)
 {
 	disk_event_uevent(disk, DISK_EVENT_MEDIA_CHANGE);
 	inc_diskseq(disk);
 	bdev_mark_dead(disk->part0, true);
-	set_bit(GD_NEED_PART_SCAN, &disk->state);
 }
 EXPORT_SYMBOL_GPL(disk_force_media_change);
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Deepanshu Kartikey <[email protected]>

[ Upstream commit be3e5d10643d3be1cbac9d9939f220a99253f980 ]

nilfs_ioctl_mark_blocks_dirty() uses bd_oblocknr to detect dead blocks by comparing it with the current block number bd_blocknr. If they differ, the block is considered dead and skipped.

However, bd_oblocknr should never be 0 since block 0 typically stores the primary superblock and is never a valid GC target block. A corrupted ioctl request with bd_oblocknr set to 0 causes the comparison to incorrectly match when the lookup returns -ENOENT and sets bd_blocknr to 0, bypassing the dead block check and calling nilfs_bmap_mark() on a non-existent block. This causes nilfs_btree_do_lookup() to return -ENOENT, triggering the WARN_ON(ret == -ENOENT).

Fix this by rejecting ioctl requests with bd_oblocknr set to 0 at the beginning of each iteration.

[ryusuke: slightly modified the commit message and comments for accuracy]

---
 fs/nilfs2/ioctl.c | 6 ++++++
 1 file changed, 6 insertions(+)

index 3288c3b4be9ec..7fa02146f1e06 100644
@@ -736,6 +736,12 @@ static int nilfs_ioctl_mark_blocks_dirty(struct the_nilfs *nilfs,
 	int ret, i;
 
 	for (i = 0; i < nmembs; i++) {
+		/*
+		 * bd_oblocknr must never be 0 as block 0
+		 * is never a valid GC target block
+		 */
+		if (unlikely(!bdescs[i].bd_oblocknr))
+			return -EINVAL;
 		/* XXX: use macro or inline func to check liveness */
 		ret = nilfs_bmap_lookup_at_level(bmap,
 						 bdescs[i].bd_offset,

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jackie Liu <[email protected]>

[ Upstream commit 23308af722fefed00af5f238024c11710938fba3 ]

Add the missing put_disk() on the error path in blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or blkg_tryget() fails, the function jumps to the out label which only calls rcu_read_unlock() but does not release the disk reference acquired by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk is already set to NULL before the lookup, blkcg_exit() cannot release this reference either, causing the disk to never be freed.

Restore the reference release that was present as blk_put_queue() in the original code but was inadvertently dropped during the conversion from request_queue to gendisk.

---
 block/blk-cgroup.c | 1 +
 1 file changed, 1 insertion(+)

index 890c161bee25e..9a8d047be580b 100644
@@ -2037,6 +2037,7 @@ void blkcg_maybe_throttle_current(void)
 	return;
 out:
 	rcu_read_unlock();
+	put_disk(disk);
 }
 
 /**

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Cole Leavitt <[email protected]>

[ Upstream commit 2ddb69f686ef7a621645e97fc7329c50edf5d0e5 ]

In persistent_ram_iomap(), ioremap() or ioremap_wc() may return NULL on failure. Currently, if this happens, the function returns NULL without releasing the memory region acquired by request_mem_region().

This leads to a resource leak where the memory region remains reserved but unusable.

Additionally, the caller persistent_ram_buffer_map() handles NULL correctly by returning -ENOMEM, but without this check, a NULL return combined with request_mem_region() succeeding leaves resources in an inconsistent state.

This is the ioremap() counterpart to commit 05363abc7625 ("pstore:
ram_core: fix incorrect success return when vmap() fails") which fixed a similar issue in the vmap() path.

---
 fs/pstore/ram_core.c | 4 ++++
 1 file changed, 4 insertions(+)

index 7b6d6378a3b87..95675d4bab141 100644
@@ -489,6 +489,10 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size,
 	else
 		va = ioremap_wc(start, size);
 
+	/* We must release the mem region if ioremap fails. */
+	if (!va)
+		release_mem_region(start, size);
+
 	/*
 	 * Since request_mem_region() and ioremap() are byte-granularity
 	 * there is no need handle anything special like we do when the

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gao Xiang <[email protected]>

[ Upstream commit 307210c262a29f41d7177851295ea1703bd04175 ]

For file-backed mounts, metadata is fetched via the page cache of backing inodes to avoid double caching and redundant copy ops out of RO uptodate folios, which is used by Android APEXes, ComposeFS, containerd. However, rw_verify_area() was missing prior to metadata accesses.

Similar to vfs_iocb_iter_read(), fix this by:
- Enabling fanotify pre-content hooks on metadata accesses;
- security_file_permission() for security modules.

Verified that fanotify pre-content hooks now works correctly.

---
 fs/erofs/data.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

index 8ca29962a3dde..58aea2b48580c 100644
@@ -29,6 +29,20 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t offset, bool need_kmap)
 {
 	pgoff_t index = (buf->off + offset) >> PAGE_SHIFT;
 	struct folio *folio = NULL;
+	loff_t fpos;
+	int err;
+
+	/*
+	 * Metadata access for file-backed mounts reuses page cache of backing
+	 * fs inodes (only folio data will be needed) to prevent double caching.
+	 * However, the data access range must be verified here in advance.
+	 */
+	if (buf->file) {
+		fpos = index << PAGE_SHIFT;
+		err = rw_verify_area(READ, buf->file, &fpos, PAGE_SIZE);
+		if (err < 0)
+			return ERR_PTR(err);
+	}
 
 	if (buf->page) {
 		folio = page_folio(buf->page);

2.53.0

Hi Greg,

Could you please help drop this too, the same reason as:
https://lore.kernel.org/r/ag3qlMOcTYM2FBUQ@debian

I will address this backport manually later.

Thanks,
Gao Xiang

Dropped from the 6.18 queue (along with the 7.0 and 6.12 counterparts). Thanks.

--
Thanks,
Sasha

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhan Xusheng <[email protected]>

[ Upstream commit d6250d49da4d8f11afc0d8991c84e0307949f92e ]

erofs_ioctl_get_volume_label() passes strlen(sbi->volume_name) as the length to copy_to_user(), which copies the label string without the trailing NUL byte. Since FS_IOC_GETFSLABEL callers expect a NUL-terminated string in the FSLABEL_MAX-sized buffer and may not pre-zero the buffer, this can cause userspace to read past the label into uninitialised stack memory.

Fix this by using strlen() + 1 to include the NUL terminator, consistent with how ext4 and xfs implement FS_IOC_GETFSLABEL.

---
 fs/erofs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index cb780c095d282..218ab22589228 100644
@@ -348,7 +348,7 @@ static int erofs_ioctl_get_volume_label(struct inode *inode, void __user *arg)
 		ret = clear_user(arg, 1);
 	else
 		ret = copy_to_user(arg, sbi->volume_name,
-				   strlen(sbi->volume_name));
+				   strlen(sbi->volume_name) + 1);
 	return ret ? -EFAULT : 0;
 }
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email protected]>

[ Upstream commit 2aa72276fab9851dbd59c2daeb4b590c5a113908 ]

When "clear" is written to array_state, md_attr_store() breaks sysfs active protection so the array can delete itself from its own sysfs store method.

However, md_attr_store() currently drops the mddev reference before calling sysfs_unbreak_active_protection(). Once do_md_stop(..., 0) has made the mddev eligible for delayed deletion, the temporary kobject reference taken by sysfs_break_active_protection() can become the last kobject reference protecting the md kobject.

That allows sysfs_unbreak_active_protection() to drop the last kobject reference from the current sysfs writer context. kobject teardown then recurses into kernfs removal while the current sysfs node is still being unwound, and lockdep reports recursive locking on kn->active with kernfs_drain() in the call chain.

Reproducer on an existing level:
1. Create an md0 linear array and activate it:
mknod /dev/md0 b 9 0
echo none > /sys/block/md0/md/metadata_version
echo linear > /sys/block/md0/md/level
echo 1 > /sys/block/md0/md/raid_disks
echo "$(cat /sys/class/block/sdb/dev)" > /sys/block/md0/md/new_dev

   echo "$(($(cat /sys/class/block/sdb/size) / 2))" > \
	/sys/block/md0/md/dev-sdb/size

echo 0 > /sys/block/md0/md/dev-sdb/slot echo active > /sys/block/md0/md/array_state
2. Wait briefly for the array to settle, then clear it:
sleep 2
echo clear > /sys/block/md0/md/array_state

The warning looks like:

WARNING: possible recursive locking detected bash/588 is trying to acquire lock:
(kn->active#65) at __kernfs_remove+0x157/0x1d0
but task is already holding lock:
(kn->active#65) at sysfs_unbreak_active_protection+0x1f/0x40
...

  Call Trace:
   kernfs_drain
   __kernfs_remove
   kernfs_remove_by_name_ns
   sysfs_remove_group
   sysfs_remove_groups
   __kobject_del
   kobject_put
   md_attr_store
   kernfs_fop_write_iter
   vfs_write
   ksys_write

Restore active protection before mddev_put() so the extra sysfs kobject reference is dropped while the mddev is still held alive. The actual md kobject deletion is then deferred until after the sysfs write path has fully returned.

---
 drivers/md/md.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

index 92ec4be20db85..7560e98dc35b3 100644
@@ -6032,10 +6032,16 @@ md_attr_store(struct kobject *kobj, struct attribute *attr,
 	}
 	spin_unlock(&all_mddevs_lock);
 	rv = entry->store(mddev, page, length);
-	mddev_put(mddev);
 
+	/*
+	 * For "array_state=clear", dropping the extra kobject reference from
+	 * sysfs_break_active_protection() can trigger md kobject deletion.
+	 * Restore active protection before mddev_put() so deletion happens
+	 * after the sysfs write path fully unwinds.
+	 */
 	if (kn)
 		sysfs_unbreak_active_protection(kn);
+	mddev_put(mddev);
 
 	return rv;
 }

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhan Xusheng <[email protected]>

[ Upstream commit 63c2f06198ca7513433f1c92f2c654869d72417e ]

erofs_init_device() only reads blocks_lo and uniaddr_lo from the on-disk device slot, ignoring blocks_hi and uniaddr_hi that were introduced alongside the 48-bit block addressing feature.

For the primary device (dif0), erofs_read_superblock() already handles this correctly by combining blocks_lo with blocks_hi when 48-bit layout is enabled. But the same logic was not applied to extra devices.

With a 48-bit EROFS image using extra devices whose uniaddr or blocks exceed 32-bit range, the truncated values cause erofs_map_dev() to compute wrong physical addresses, leading to silent data corruption.

Fix this by reading blocks_hi and uniaddr_hi in erofs_init_device() when 48-bit layout is enabled, consistent with the primary device handling. Also fix the erofs_deviceslot on-disk definition where blocks_hi was incorrectly declared as __le32 instead of __le16.

---
 fs/erofs/erofs_fs.h | 4 ++--
 fs/erofs/super.c    | 8 ++++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

index 3d5738f80072e..63efadf75b1c0 100644
@@ -44,9 +44,9 @@ struct erofs_deviceslot {
 	u8 tag[64];		/* digest(sha256), etc. */
 	__le32 blocks_lo;	/* total blocks count of this device */
 	__le32 uniaddr_lo;	/* unified starting block of this device */
-	__le32 blocks_hi;	/* total blocks count MSB */
+	__le16 blocks_hi;	/* total blocks count MSB */
 	__le16 uniaddr_hi;	/* unified starting block MSB */
-	u8 reserved[50];
+	u8 reserved[52];
 };
 #define EROFS_DEVT_SLOT_SIZE	sizeof(struct erofs_deviceslot)
 

index ee37628ec99fb..f5f5d19459ecc 100644
@@ -140,6 +140,7 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,
 	struct erofs_fscache *fscache;
 	struct erofs_deviceslot *dis;
 	struct file *file;
+	bool _48bit;
 
 	dis = erofs_read_metabuf(buf, sb, *pos, false);
 	if (IS_ERR(dis))

@@ -186,8 +187,11 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,
 		dif->file = file;
 	}
 
-	dif->blocks = le32_to_cpu(dis->blocks_lo);
-	dif->uniaddr = le32_to_cpu(dis->uniaddr_lo);
+	_48bit = erofs_sb_has_48bit(sbi);
+	dif->blocks = le32_to_cpu(dis->blocks_lo) |
+		(_48bit ? (u64)le16_to_cpu(dis->blocks_hi) << 32 : 0);
+	dif->uniaddr = le32_to_cpu(dis->uniaddr_lo) |
+		(_48bit ? (u64)le16_to_cpu(dis->uniaddr_hi) << 32 : 0);
 	sbi->total_blocks += dif->blocks;
 	*pos += EROFS_DEVT_SLOT_SIZE;
 	return 0;

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marco Crivellari <[email protected]>

[ Upstream commit d4880868670198df321627a949e7b7f2d76cf54e ]

This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in:

commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")

The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default.

With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below.

In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU.

Stable-dep-of: e4979f4fac4d ("md: remove unused static md_wq workqueue")

---
 drivers/md/dm-bufio.c              |  3 ++-
 drivers/md/dm-cache-target.c       |  3 ++-
 drivers/md/dm-clone-target.c       |  3 ++-
 drivers/md/dm-crypt.c              |  6 ++++--
 drivers/md/dm-delay.c              |  4 +++-
 drivers/md/dm-integrity.c          | 15 ++++++++++-----
 drivers/md/dm-kcopyd.c             |  3 ++-
 drivers/md/dm-log-userspace-base.c |  3 ++-
 drivers/md/dm-mpath.c              |  5 +++--
 drivers/md/dm-raid1.c              |  5 +++--
 drivers/md/dm-snap-persistent.c    |  3 ++-
 drivers/md/dm-stripe.c             |  2 +-
 drivers/md/dm-verity-target.c      |  4 +++-
 drivers/md/dm-writecache.c         |  3 ++-
 drivers/md/dm.c                    |  3 ++-
 drivers/md/md.c                    |  4 ++--
 16 files changed, 45 insertions(+), 24 deletions(-)

index 5235f3e4924b7..f41f649c01d4e 100644
@@ -2833,7 +2833,8 @@ static int __init dm_bufio_init(void)
 	__cache_size_refresh();
 	mutex_unlock(&dm_bufio_clients_lock);
 
-	dm_bufio_wq = alloc_workqueue("dm_bufio_cache", WQ_MEM_RECLAIM, 0);
+	dm_bufio_wq = alloc_workqueue("dm_bufio_cache",
+				      WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!dm_bufio_wq)
 		return -ENOMEM;
 

index a10d75a562db0..7bad7cc87d370 100644
@@ -2533,7 +2533,8 @@ static int cache_create(struct cache_args *ca, struct cache **result)
 		goto bad;
 	}
 
-	cache->wq = alloc_workqueue("dm-" DM_MSG_PREFIX, WQ_MEM_RECLAIM, 0);
+	cache->wq = alloc_workqueue("dm-" DM_MSG_PREFIX,
+				    WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!cache->wq) {
 		*error = "could not create workqueue for metadata object";
 		goto bad;

index e956d980672c8..b25845e362744 100644
@@ -1877,7 +1877,8 @@ static int clone_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	clone->hydration_offset = 0;
 	atomic_set(&clone->hydrations_in_flight, 0);
 
-	clone->wq = alloc_workqueue("dm-" DM_MSG_PREFIX, WQ_MEM_RECLAIM, 0);
+	clone->wq = alloc_workqueue("dm-" DM_MSG_PREFIX,
+				    WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!clone->wq) {
 		ti->error = "Failed to allocate workqueue";
 		r = -ENOMEM;

index 5ef43231fe77f..fd735155336bc 100644
@@ -3441,7 +3441,9 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	if (test_bit(DM_CRYPT_HIGH_PRIORITY, &cc->flags))
 		common_wq_flags |= WQ_HIGHPRI;
 
-	cc->io_queue = alloc_workqueue("kcryptd_io-%s-%d", common_wq_flags, 1, devname, wq_id);
+	cc->io_queue = alloc_workqueue("kcryptd_io-%s-%d",
+				       common_wq_flags | WQ_PERCPU, 1,
+				       devname, wq_id);
 	if (!cc->io_queue) {
 		ti->error = "Couldn't create kcryptd io queue";
 		goto bad;

@@ -3449,7 +3451,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
 	if (test_bit(DM_CRYPT_SAME_CPU, &cc->flags)) {
 		cc->crypt_queue = alloc_workqueue("kcryptd-%s-%d",
-						  common_wq_flags | WQ_CPU_INTENSIVE,
+						  common_wq_flags | WQ_CPU_INTENSIVE | WQ_PERCPU,
 						  1, devname, wq_id);
 	} else {
 		/*

index 4bb6553278c74..029f04776490a 100644
@@ -290,7 +290,9 @@ static int delay_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	} else {
 		timer_setup(&dc->delay_timer, handle_delayed_timer, 0);
 		INIT_WORK(&dc->flush_expired_bios, flush_expired_bios);
-		dc->kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0);
+		dc->kdelayd_wq = alloc_workqueue("kdelayd",
+						 WQ_MEM_RECLAIM | WQ_PERCPU,
+						 0);
 		if (!dc->kdelayd_wq) {
 			ret = -EINVAL;
 			DMERR("Couldn't start kdelayd");

index ba52631052503..a9c0157bf42fe 100644
@@ -5003,7 +5003,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
 	}
 
 	ic->metadata_wq = alloc_workqueue("dm-integrity-metadata",
-					  WQ_MEM_RECLAIM, METADATA_WORKQUEUE_MAX_ACTIVE);
+					  WQ_MEM_RECLAIM | WQ_PERCPU,
+					  METADATA_WORKQUEUE_MAX_ACTIVE);
 	if (!ic->metadata_wq) {
 		ti->error = "Cannot allocate workqueue";
 		r = -ENOMEM;

@@ -5021,7 +5022,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
 		goto bad;
 	}
 
-	ic->offload_wq = alloc_workqueue("dm-integrity-offload", WQ_MEM_RECLAIM,
+	ic->offload_wq = alloc_workqueue("dm-integrity-offload",
+					  WQ_MEM_RECLAIM | WQ_PERCPU,
 					  METADATA_WORKQUEUE_MAX_ACTIVE);
 	if (!ic->offload_wq) {
 		ti->error = "Cannot allocate workqueue";

@@ -5029,7 +5031,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
 		goto bad;
 	}
 
-	ic->commit_wq = alloc_workqueue("dm-integrity-commit", WQ_MEM_RECLAIM, 1);
+	ic->commit_wq = alloc_workqueue("dm-integrity-commit",
+					WQ_MEM_RECLAIM | WQ_PERCPU, 1);
 	if (!ic->commit_wq) {
 		ti->error = "Cannot allocate workqueue";
 		r = -ENOMEM;

@@ -5038,7 +5041,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
 	INIT_WORK(&ic->commit_work, integrity_commit);
 
 	if (ic->mode == 'J' || ic->mode == 'B') {
-		ic->writer_wq = alloc_workqueue("dm-integrity-writer", WQ_MEM_RECLAIM, 1);
+		ic->writer_wq = alloc_workqueue("dm-integrity-writer",
+						WQ_MEM_RECLAIM | WQ_PERCPU, 1);
 		if (!ic->writer_wq) {
 			ti->error = "Cannot allocate workqueue";
 			r = -ENOMEM;

@@ -5210,7 +5214,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
 	}
 
 	if (ic->internal_hash) {
-		ic->recalc_wq = alloc_workqueue("dm-integrity-recalc", WQ_MEM_RECLAIM, 1);
+		ic->recalc_wq = alloc_workqueue("dm-integrity-recalc",
+						WQ_MEM_RECLAIM | WQ_PERCPU, 1);
 		if (!ic->recalc_wq) {
 			ti->error = "Cannot allocate workqueue";
 			r = -ENOMEM;

index 6ea75436a433a..cec9a60227b6f 100644
@@ -934,7 +934,8 @@ struct dm_kcopyd_client *dm_kcopyd_client_create(struct dm_kcopyd_throttle *thro
 		goto bad_slab;
 
 	INIT_WORK(&kc->kcopyd_work, do_work);
-	kc->kcopyd_wq = alloc_workqueue("kcopyd", WQ_MEM_RECLAIM, 0);
+	kc->kcopyd_wq = alloc_workqueue("kcopyd", WQ_MEM_RECLAIM | WQ_PERCPU,
+					0);
 	if (!kc->kcopyd_wq) {
 		r = -ENOMEM;
 		goto bad_workqueue;

index 9fbb4b48fb2bb..607436804a8b2 100644
@@ -299,7 +299,8 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
 	}
 
 	if (lc->integrated_flush) {
-		lc->dmlog_wq = alloc_workqueue("dmlogd", WQ_MEM_RECLAIM, 0);
+		lc->dmlog_wq = alloc_workqueue("dmlogd",
+					       WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 		if (!lc->dmlog_wq) {
 			DMERR("couldn't start dmlogd");
 			r = -ENOMEM;

index 7d3fdd96f4edf..00df5be165759 100644
@@ -2330,7 +2330,8 @@ static int __init dm_multipath_init(void)
 {
 	int r = -ENOMEM;
 
-	kmultipathd = alloc_workqueue("kmpathd", WQ_MEM_RECLAIM, 0);
+	kmultipathd = alloc_workqueue("kmpathd", WQ_MEM_RECLAIM | WQ_PERCPU,
+				      0);
 	if (!kmultipathd) {
 		DMERR("failed to create workqueue kmpathd");
 		goto bad_alloc_kmultipathd;

@@ -2349,7 +2350,7 @@ static int __init dm_multipath_init(void)
 		goto bad_alloc_kmpath_handlerd;
 	}
 
-	dm_mpath_wq = alloc_workqueue("dm_mpath_wq", 0, 0);
+	dm_mpath_wq = alloc_workqueue("dm_mpath_wq", WQ_PERCPU, 0);
 	if (!dm_mpath_wq) {
 		DMERR("failed to create workqueue dm_mpath_wq");
 		goto bad_alloc_dm_mpath_wq;

index bc8e04f6832a6..d9ec783a37ddc 100644
@@ -1128,7 +1128,8 @@ static int mirror_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	ti->num_discard_bios = 1;
 	ti->per_io_data_size = sizeof(struct dm_raid1_bio_record);
 
-	ms->kmirrord_wq = alloc_workqueue("kmirrord", WQ_MEM_RECLAIM, 0);
+	ms->kmirrord_wq = alloc_workqueue("kmirrord",
+					  WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!ms->kmirrord_wq) {
 		DMERR("couldn't start kmirrord");
 		r = -ENOMEM;

@@ -1500,7 +1501,7 @@ static int __init dm_mirror_init(void)
 {
 	int r;
 
-	dm_raid1_wq = alloc_workqueue("dm_raid1_wq", 0, 0);
+	dm_raid1_wq = alloc_workqueue("dm_raid1_wq", WQ_PERCPU, 0);
 	if (!dm_raid1_wq) {
 		DMERR("Failed to alloc workqueue");
 		return -ENOMEM;

index 568d10842b1f4..0e13d60bfdd12 100644
@@ -871,7 +871,8 @@ static int persistent_ctr(struct dm_exception_store *store, char *options)
 	atomic_set(&ps->pending_count, 0);
 	ps->callbacks = NULL;
 
-	ps->metadata_wq = alloc_workqueue("ksnaphd", WQ_MEM_RECLAIM, 0);
+	ps->metadata_wq = alloc_workqueue("ksnaphd",
+					  WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!ps->metadata_wq) {
 		DMERR("couldn't start header metadata update thread");
 		r = -ENOMEM;

index 1461dc740dae6..1cff9df5b8b47 100644
@@ -489,7 +489,7 @@ int __init dm_stripe_init(void)
 {
 	int r;
 
-	dm_stripe_wq = alloc_workqueue("dm_stripe_wq", 0, 0);
+	dm_stripe_wq = alloc_workqueue("dm_stripe_wq", WQ_PERCPU, 0);
 	if (!dm_stripe_wq)
 		return -ENOMEM;
 	r = dm_register_target(&stripe_target);

index c8695c079cfe0..a5cd55b2ba02f 100644
@@ -1549,7 +1549,9 @@ static int verity_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	 * will fall-back to using it for error handling (or if the bufio cache
 	 * doesn't have required hashes).
 	 */
-	v->verify_wq = alloc_workqueue("kverityd", WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+	v->verify_wq = alloc_workqueue("kverityd",
+				       WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_PERCPU,
+				       0);
 	if (!v->verify_wq) {
 		ti->error = "Cannot allocate workqueue";
 		r = -ENOMEM;

index d8de4a3076a17..af54e289bcebe 100644
@@ -2275,7 +2275,8 @@ static int writecache_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 		goto bad;
 	}
 
-	wc->writeback_wq = alloc_workqueue("writecache-writeback", WQ_MEM_RECLAIM, 1);
+	wc->writeback_wq = alloc_workqueue("writecache-writeback",
+					   WQ_MEM_RECLAIM | WQ_PERCPU, 1);
 	if (!wc->writeback_wq) {
 		r = -ENOMEM;
 		ti->error = "Could not allocate writeback workqueue";

index 52f01c44e73a6..fb6bcd598c5b8 100644
@@ -2363,7 +2363,8 @@ static struct mapped_device *alloc_dev(int minor)
 
 	format_dev_t(md->name, MKDEV(_major, minor));
 
-	md->wq = alloc_workqueue("kdmflush/%s", WQ_MEM_RECLAIM, 0, md->name);
+	md->wq = alloc_workqueue("kdmflush/%s", WQ_MEM_RECLAIM | WQ_PERCPU, 0,
+				 md->name);
 	if (!md->wq)
 		goto bad;
 

index 7560e98dc35b3..0fc779493fa78 100644
@@ -10345,11 +10345,11 @@ static int __init md_init(void)
 		goto err_bitmap;
 
 	ret = -ENOMEM;
-	md_wq = alloc_workqueue("md", WQ_MEM_RECLAIM, 0);
+	md_wq = alloc_workqueue("md", WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!md_wq)
 		goto err_wq;
 
-	md_misc_wq = alloc_workqueue("md_misc", 0, 0);
+	md_misc_wq = alloc_workqueue("md_misc", WQ_PERCPU, 0);
 	if (!md_misc_wq)
 		goto err_misc_wq;
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Abd-Alrhman Masalkhi <[email protected]>

[ Upstream commit e4979f4fac4d6bbe757be50441b45e28e6bf7360 ]

The md_wq workqueue is defined as static and initialized in md_init(), but it is not used anywhere within md.c.

All asynchronous and deferred work in this file is handled via md_misc_wq or dedicated md threads.

---
 drivers/md/md.c | 8 --------
 1 file changed, 8 deletions(-)

index 0fc779493fa78..0a3152f21d488 100644
@@ -84,7 +84,6 @@ static DEFINE_XARRAY(md_submodule);
 static const struct kobj_type md_ktype;
 
 static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
-static struct workqueue_struct *md_wq;
 
 /*
  * This workqueue is used for sync_work to register new sync_thread, and for

@@ -10345,10 +10344,6 @@ static int __init md_init(void)
 		goto err_bitmap;
 
 	ret = -ENOMEM;
-	md_wq = alloc_workqueue("md", WQ_MEM_RECLAIM | WQ_PERCPU, 0);
-	if (!md_wq)
-		goto err_wq;
-
 	md_misc_wq = alloc_workqueue("md_misc", WQ_PERCPU, 0);
 	if (!md_misc_wq)
 		goto err_misc_wq;

@@ -10373,8 +10368,6 @@ static int __init md_init(void)
 err_md:
 	destroy_workqueue(md_misc_wq);
 err_misc_wq:
-	destroy_workqueue(md_wq);
-err_wq:
 	md_llbitmap_exit();
 err_bitmap:
 	md_bitmap_exit();

@@ -10683,7 +10676,6 @@ static __exit void md_exit(void)
 	spin_unlock(&all_mddevs_lock);
 
 	destroy_workqueue(md_misc_wq);
-	destroy_workqueue(md_wq);
 	md_bitmap_exit();
 }
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email protected]>

[ Upstream commit cf86bb53b9c92354904a328e947a05ffbfdd1840 ]

During raid456 reshape, direct IO across the reshape position can sleep in raid5_make_request() waiting for reshape progress while still holding an active_io reference. If userspace then freezes reshape and writes md/suspend_lo or md/suspend_hi, mddev_suspend() kills active_io and waits for all in-flight IO to drain.

This can deadlock: the IO needs reshape progress to continue, but the reshape thread is already frozen, so the active_io reference is never dropped and suspend never completes.

raid5_prepare_suspend() already wakes wait_for_reshape for dm-raid. Do the same for normal md suspend when reshape is already interrupted, so waiting raid456 IO can abort, drop its reference, and let suspend finish.

The mdadm test tests/25raid456-reshape-deadlock reproduces the hang.

---
 drivers/md/md.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

index 0a3152f21d488..b91ac1b7d7a15 100644
@@ -486,6 +486,17 @@ int mddev_suspend(struct mddev *mddev, bool interruptible)
 	}
 
 	percpu_ref_kill(&mddev->active_io);
+
+	/*
+	 * RAID456 IO can sleep in wait_for_reshape while still holding an
+	 * active_io reference. If reshape is already interrupted or frozen,
+	 * wake those waiters so they can abort and drop the reference instead
+	 * of deadlocking suspend.
+	 */
+	if (mddev->pers && mddev->pers->prepare_suspend &&
+	    reshape_interrupted(mddev))
+		mddev->pers->prepare_suspend(mddev);
+
 	if (interruptible)
 		err = wait_event_interruptible(mddev->sb_wait,
 				percpu_ref_is_zero(&mddev->active_io));

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Filipe Manana <[email protected]>

[ Upstream commit b48c980b6a7e409050bb3067165db31cc6205e3e ]

When using the flushoncommit mount option, we can have a deadlock between a transaction commit and a reflink operation that copied an inline extent to an offset beyond the current i_size of the destination node.

The deadlock happens like this:

1) Task A clones an inline extent from inode X to an offset of inode Y that is beyond Y's current i_size. This means we copied the inline extent's data to a folio of inode Y that is beyond its EOF, using a call to copy_inline_to_page();

2) Task B starts a transaction commit and calls btrfs_start_delalloc_flush() to flush delalloc;

3) The delalloc flushing sees the new dirty folio of inode Y and when it attempts to flush it, it ends up at extent_writepage() and sees that the offset of the folio is beyond the i_size of inode Y, so it attempts to invalidate the folio by calling folio_invalidate(), which ends up at btrfs' folio invalidate callback - btrfs_invalidate_folio(). There it tries to lock the folio's range in inode Y's extent io tree, but it blocks since it's currently locked by task A - during a reflink we lock the inodes and the source and destination ranges after flushing all delalloc and waiting for ordered extent completion - after that we don't expect to have dirty folios in the ranges, the exception is if we have to copy an inline extent's data (because the destination offset is not zero);

4) Task A then attempts to start a transaction to update the inode item, and then it's blocked since the current transaction is in the TRANS_STATE_COMMIT_START state. Therefore task A has to wait for the current transaction to become unblocked (its state >= TRANS_STATE_UNBLOCKED).

So task A is waiting for the transaction commit done by task B, and the later waiting on the extent lock of inode Y that is currently held by task A.

Syzbot recently reported this with the following stack traces:

  INFO: task kworker/u8:7:1053 blocked for more than 143 seconds.
        Not tainted syzkaller #0
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  task:kworker/u8:7    state:D stack:23520 pid:1053  tgid:1053  ppid:2      task_flags:0x4208060 flags:0x00080000
  Workqueue: writeback wb_workfn (flush-btrfs-46)
  Call Trace:
   <TASK>
   context_switch kernel/sched/core.c:5298 [inline]
   __schedule+0x1553/0x5240 kernel/sched/core.c:6911
   __schedule_loop kernel/sched/core.c:6993 [inline]
   schedule+0x164/0x360 kernel/sched/core.c:7008
   wait_extent_bit fs/btrfs/extent-io-tree.c:811 [inline]
   btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:1914
   btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline]
   btrfs_invalidate_folio+0x43d/0xc40 fs/btrfs/inode.c:7704
   extent_writepage fs/btrfs/extent_io.c:1852 [inline]
   extent_write_cache_pages fs/btrfs/extent_io.c:2580 [inline]
   btrfs_writepages+0x12ff/0x2440 fs/btrfs/extent_io.c:2713
   do_writepages+0x32e/0x550 mm/page-writeback.c:2554
   __writeback_single_inode+0x133/0x11a0 fs/fs-writeback.c:1750
   writeback_sb_inodes+0x995/0x19d0 fs/fs-writeback.c:2042
   wb_writeback+0x456/0xb70 fs/fs-writeback.c:2227
   wb_do_writeback fs/fs-writeback.c:2374 [inline]
   wb_workfn+0x41a/0xf60 fs/fs-writeback.c:2414
   process_one_work kernel/workqueue.c:3276 [inline]
   process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
   worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
   kthread+0x388/0x470 kernel/kthread.c:436
   ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
   </TASK>
  INFO: task syz.4.64:6910 blocked for more than 143 seconds.
        Not tainted syzkaller #0
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  task:syz.4.64        state:D stack:22752 pid:6910  tgid:6905  ppid:5944   task_flags:0x400140 flags:0x00080002
  Call Trace:
   <TASK>
   context_switch kernel/sched/core.c:5298 [inline]
   __schedule+0x1553/0x5240 kernel/sched/core.c:6911
   __schedule_loop kernel/sched/core.c:6993 [inline]
   schedule+0x164/0x360 kernel/sched/core.c:7008
   wait_current_trans+0x39f/0x590 fs/btrfs/transaction.c:535
   start_transaction+0x6a7/0x1650 fs/btrfs/transaction.c:705
   clone_copy_inline_extent fs/btrfs/reflink.c:299 [inline]
   btrfs_clone+0x128a/0x24d0 fs/btrfs/reflink.c:529
   btrfs_clone_files+0x271/0x3f0 fs/btrfs/reflink.c:750
   btrfs_remap_file_range+0x76b/0x1320 fs/btrfs/reflink.c:903
   vfs_copy_file_range+0xda7/0x1390 fs/read_write.c:1600
   __do_sys_copy_file_range fs/read_write.c:1683 [inline]
   __se_sys_copy_file_range+0x2fb/0x480 fs/read_write.c:1650
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
  RIP: 0033:0x7f5f73afc799
  RSP: 002b:00007f5f7315e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000146
  RAX: ffffffffffffffda RBX: 00007f5f73d75fa0 RCX: 00007f5f73afc799
  RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000005
  RBP: 00007f5f73b92c99 R08: 0000000000000863 R09: 0000000000000000
  R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000000
  R13: 00007f5f73d76038 R14: 00007f5f73d75fa0 R15: 00007fff138a5068
   </TASK>
  INFO: task syz.4.64:6975 blocked for more than 143 seconds.
        Not tainted syzkaller #0
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  task:syz.4.64        state:D stack:24736 pid:6975  tgid:6905  ppid:5944   task_flags:0x400040 flags:0x00080002
  Call Trace:
   <TASK>
   context_switch kernel/sched/core.c:5298 [inline]
   __schedule+0x1553/0x5240 kernel/sched/core.c:6911
   __schedule_loop kernel/sched/core.c:6993 [inline]
   schedule+0x164/0x360 kernel/sched/core.c:7008
   wb_wait_for_completion+0x3e8/0x790 fs/fs-writeback.c:227
   __writeback_inodes_sb_nr+0x24c/0x2d0 fs/fs-writeback.c:2838
   try_to_writeback_inodes_sb+0x9a/0xc0 fs/fs-writeback.c:2886
   btrfs_start_delalloc_flush fs/btrfs/transaction.c:2175 [inline]
   btrfs_commit_transaction+0x82e/0x31a0 fs/btrfs/transaction.c:2364
   btrfs_ioctl+0xca7/0xd00 fs/btrfs/ioctl.c:5206
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:597 [inline]
   __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
  RIP: 0033:0x7f5f73afc799
  RSP: 002b:00007f5f7313d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
  RAX: ffffffffffffffda RBX: 00007f5f73d76090 RCX: 00007f5f73afc799
  RDX: 0000000000000000 RSI: 0000000000009408 RDI: 0000000000000004
  RBP: 00007f5f73b92c99 R08: 0000000000000000 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
  R13: 00007f5f73d76128 R14: 00007f5f73d76090 R15: 00007fff138a5068
   </TASK>

Fix this by updating the i_size of the destination inode of a reflink operation after we copy an inline extent's data to an offset beyond the i_size and before attempting to start a transaction to update the inode's item.

---
 fs/btrfs/reflink.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

index 5465a5eae9b2d..614e884c2a9bc 100644
@@ -321,6 +321,51 @@ static int clone_copy_inline_extent(struct btrfs_inode *inode,
 
 	ret = copy_inline_to_page(inode, new_key->offset,
 				  inline_data, size, datal, comp_type);
+
+	/*
+	 * If we copied the inline extent data to a page/folio beyond the i_size
+	 * of the destination inode, then we need to increase the i_size before
+	 * we start a transaction to update the inode item. This is to prevent a
+	 * deadlock when the flushoncommit mount option is used, which happens
+	 * like this:
+	 *
+	 * 1) Task A clones an inline extent from inode X to an offset of inode
+	 *    Y that is beyond Y's current i_size. This means we copied the
+	 *    inline extent's data to a folio of inode Y that is beyond its EOF,
+	 *    using the call above to copy_inline_to_page();
+	 *
+	 * 2) Task B starts a transaction commit and calls
+	 *    btrfs_start_delalloc_flush() to flush delalloc;
+	 *
+	 * 3) The delalloc flushing sees the new dirty folio of inode Y and when
+	 *    it attempts to flush it, it ends up at extent_writepage() and sees
+	 *    that the offset of the folio is beyond the i_size of inode Y, so
+	 *    it attempts to invalidate the folio by calling folio_invalidate(),
+	 *    which ends up at btrfs' folio invalidate callback -
+	 *    btrfs_invalidate_folio(). There it tries to lock the folio's range
+	 *    in inode Y's extent io tree, but it blocks since it's currently
+	 *    locked by task A - during reflink we lock the inodes and the
+	 *    source and destination ranges after flushing all delalloc and
+	 *    waiting for ordered extent completion - after that we don't expect
+	 *    to have dirty folios in the ranges, the exception is if we have to
+	 *    copy an inline extent's data (because the destination offset is
+	 *    not zero);
+	 *
+	 * 4) Task A then does the 'goto out' below and attempts to start a
+	 *    transaction to update the inode item, and then it's blocked since
+	 *    the current transaction is in the TRANS_STATE_COMMIT_START state.
+	 *    Therefore task A has to wait for the current transaction to become
+	 *    unblocked (its state >= TRANS_STATE_UNBLOCKED).
+	 *
+	 * This leads to a deadlock - the task committing the transaction
+	 * waiting for the delalloc flushing which is blocked during folio
+	 * invalidation on the inode's extent lock and the reflink task waiting
+	 * for the current transaction to be unblocked so that it can start a
+	 * a new one to update the inode item (while holding the extent lock).
+	 */
+	if (ret == 0 && new_key->offset + datal > i_size_read(&inode->vfs_inode))
+		i_size_write(&inode->vfs_inode, new_key->offset + datal);
+
 	goto out;
 }
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Manivannan Sadhasivam <[email protected]>

[ Upstream commit e560083c0467f86b72aecac377b27bd1e7d16c49 ]

Some OPP tables have entries with same rate and different performance level. For these entries, using only the rate as the debugfs directory name causes below error:

debugfs: 'opp:5000000' already exists in '[email protected]'

Fix it by appending the performance level to the dir name if available.

---
 drivers/opp/debugfs.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

index 8fc6238b17284..61506d30d5ff0 100644
@@ -130,22 +130,24 @@ void opp_debug_create_one(struct dev_pm_opp *opp, struct opp_table *opp_table)
 {
 	struct dentry *pdentry = opp_table->dentry;
 	struct dentry *d;
-	unsigned long id;
-	char name[25];	/* 20 chars for 64 bit value + 5 (opp:\0) */
+	char name[36];	/* "opp:"(4) + u64(20) + "-" (1) + u32(10) + NULL(1) */
 
 	/*
 	 * Get directory name for OPP.
 	 *
-	 * - Normally rate is unique to each OPP, use it to get unique opp-name.
+	 * - Normally rate is unique to each OPP, use it to get unique opp-name,
+	 *   together with performance level if available.
 	 * - For some devices rate isn't available or there are multiple, use
 	 *   index instead for them.
 	 */
-	if (likely(opp_table->clk_count == 1 && opp->rates[0]))
-		id = opp->rates[0];
-	else
-		id = _get_opp_count(opp_table);
-
-	snprintf(name, sizeof(name), "opp:%lu", id);
+	if (likely(opp_table->clk_count == 1 && opp->rates[0])) {
+		if (opp->level == OPP_LEVEL_UNSET)
+			snprintf(name, sizeof(name), "opp:%lu", opp->rates[0]);
+		else
+			snprintf(name, sizeof(name), "opp:%lu-%u", opp->rates[0], opp->level);
+	} else {
+		snprintf(name, sizeof(name), "opp:%u", _get_opp_count(opp_table));
+	}
 
 	/* Create per-opp directory */
 	d = debugfs_create_dir(name, pdentry);

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Viresh Kumar <[email protected]>

[ Upstream commit 3d2398f44a2d48fb1c575a6e0bc6b38f3e689e22 ]

The commit ff9c512041f2 ("OPP: Use mutex locking guards") unintentionally made the for loop run longer than required.

scoped_guard() is implemented as a for loop. The break statement now breaks out out the scoped_guard() and not out of the outer for loop. The outer loop always iterates to completion.

Fix it.

---
 drivers/opp/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 775d4a36f2f54..157c84b689feb 100644
@@ -2741,8 +2741,8 @@ struct dev_pm_opp *dev_pm_opp_xlate_required_opp(struct opp_table *src_table,
 					break;
 				}
 			}
-			break;
 		}
+		break;
 	}
 
 	if (IS_ERR(dest_opp)) {

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email protected]>

[ Upstream commit ba0b236736dde4059bdcb8e99beaa50d6e5b6e7e ]

Make multiple changes that do not alter functionality to the CMOS RTC ACPI address space handler driver, including the following:

- Drop the unused .detach() callback from cmos_rtc_handler.

- Rename acpi_cmos_rtc_attach_handler() to acpi_cmos_rtc_attach().

- Rearrange acpi_cmos_rtc_space_handler() to reduce the number of redundant checks and make white space follow the coding style.

- Adjust an error message in acpi_install_cmos_rtc_space_handler() and make the white space follow the coding style.

- Rearrange acpi_remove_cmos_rtc_space_handler() and adjust an error message in it.

No intentional functional impact.

Stable-dep-of: 6cee29ad9d7e ("ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver")

---
 drivers/acpi/x86/cmos_rtc.c | 61 +++++++++++++++++++------------------
 1 file changed, 32 insertions(+), 29 deletions(-)

index 51643ff6fe5fc..977234da9fc11 100644
@@ -24,31 +24,35 @@ static const struct acpi_device_id acpi_cmos_rtc_ids[] = {
 	{}
 };
 
-static acpi_status
-acpi_cmos_rtc_space_handler(u32 function, acpi_physical_address address,
-		      u32 bits, u64 *value64,
-		      void *handler_context, void *region_context)
+static acpi_status acpi_cmos_rtc_space_handler(u32 function,
+					       acpi_physical_address address,
+					       u32 bits, u64 *value64,
+					       void *handler_context,
+					       void *region_context)
 {
-	int i;
+	unsigned int i, bytes = DIV_ROUND_UP(bits, 8);
 	u8 *value = (u8 *)value64;
 
 	if (address > 0xff || !value64)
 		return AE_BAD_PARAMETER;
 
-	if (function != ACPI_WRITE && function != ACPI_READ)
-		return AE_BAD_PARAMETER;
+	guard(spinlock_irq)(&rtc_lock);
+
+	if (function == ACPI_WRITE) {
+		for (i = 0; i < bytes; i++, address++, value++)
+			CMOS_WRITE(*value, address);
 
-	spin_lock_irq(&rtc_lock);
+		return AE_OK;
+	}
 
-	for (i = 0; i < DIV_ROUND_UP(bits, 8); ++i, ++address, ++value)
-		if (function == ACPI_READ)
+	if (function == ACPI_READ) {
+		for (i = 0; i < bytes; i++, address++, value++)
 			*value = CMOS_READ(address);
-		else
-			CMOS_WRITE(*value, address);
 
-	spin_unlock_irq(&rtc_lock);
+		return AE_OK;
+	}
 
-	return AE_OK;
+	return AE_BAD_PARAMETER;
 }
 
 int acpi_install_cmos_rtc_space_handler(acpi_handle handle)

@@ -56,11 +60,11 @@ int acpi_install_cmos_rtc_space_handler(acpi_handle handle)
 	acpi_status status;
 
 	status = acpi_install_address_space_handler(handle,
-			ACPI_ADR_SPACE_CMOS,
-			&acpi_cmos_rtc_space_handler,
-			NULL, NULL);
+						    ACPI_ADR_SPACE_CMOS,
+						    acpi_cmos_rtc_space_handler,
+						    NULL, NULL);
 	if (ACPI_FAILURE(status)) {
-		pr_err("Error installing CMOS-RTC region handler\n");
+		pr_err("Failed to install CMOS-RTC address space handler\n");
 		return -ENODEV;
 	}
 

@@ -70,26 +74,25 @@ EXPORT_SYMBOL_GPL(acpi_install_cmos_rtc_space_handler);
 
 void acpi_remove_cmos_rtc_space_handler(acpi_handle handle)
 {
-	if (ACPI_FAILURE(acpi_remove_address_space_handler(handle,
-			ACPI_ADR_SPACE_CMOS, &acpi_cmos_rtc_space_handler)))
-		pr_err("Error removing CMOS-RTC region handler\n");
+	acpi_status status;
+
+	status = acpi_remove_address_space_handler(handle,
+						   ACPI_ADR_SPACE_CMOS,
+						   acpi_cmos_rtc_space_handler);
+	if (ACPI_FAILURE(status))
+		pr_err("Failed to remove CMOS-RTC address space handler\n");
 }
 EXPORT_SYMBOL_GPL(acpi_remove_cmos_rtc_space_handler);
 
-static int acpi_cmos_rtc_attach_handler(struct acpi_device *adev, const struct acpi_device_id *id)
+static int acpi_cmos_rtc_attach(struct acpi_device *adev,
+				const struct acpi_device_id *id)
 {
 	return acpi_install_cmos_rtc_space_handler(adev->handle);
 }
 
-static void acpi_cmos_rtc_detach_handler(struct acpi_device *adev)
-{
-	acpi_remove_cmos_rtc_space_handler(adev->handle);
-}
-
 static struct acpi_scan_handler cmos_rtc_handler = {
 	.ids = acpi_cmos_rtc_ids,
-	.attach = acpi_cmos_rtc_attach_handler,
-	.detach = acpi_cmos_rtc_detach_handler,
+	.attach = acpi_cmos_rtc_attach,
 };
 
 void __init acpi_cmos_rtc_init(void)

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email protected]>

[ Upstream commit 6cee29ad9d7e400d39ae0b1a54447fedcb62eecd ]

If a CMOS RTC (PNP0B00/PNP0B01/PNP0B02) device coexists with an ACPI TAD (timer and event alarm device, ACPI000E), the ACPI TAD driver will attempt to install the CMOS RTC address space hanlder that has been installed already and the TAD probing will fail.

Avoid that by changing acpi_install_cmos_rtc_space_handler() to return zero and acpi_remove_cmos_rtc_space_handler() to do nothing if the CMOS RTC address space handler has been installed already.

---
 drivers/acpi/x86/cmos_rtc.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

index 977234da9fc11..45db7e51cbe60 100644
@@ -24,6 +24,8 @@ static const struct acpi_device_id acpi_cmos_rtc_ids[] = {
 	{}
 };
 
+static bool cmos_rtc_space_handler_present __read_mostly;
+
 static acpi_status acpi_cmos_rtc_space_handler(u32 function,
 					       acpi_physical_address address,
 					       u32 bits, u64 *value64,

@@ -59,6 +61,9 @@ int acpi_install_cmos_rtc_space_handler(acpi_handle handle)
 {
 	acpi_status status;
 
+	if (cmos_rtc_space_handler_present)
+		return 0;
+
 	status = acpi_install_address_space_handler(handle,
 						    ACPI_ADR_SPACE_CMOS,
 						    acpi_cmos_rtc_space_handler,

@@ -68,6 +73,8 @@ int acpi_install_cmos_rtc_space_handler(acpi_handle handle)
 		return -ENODEV;
 	}
 
+	cmos_rtc_space_handler_present = true;
+
 	return 1;
 }
 EXPORT_SYMBOL_GPL(acpi_install_cmos_rtc_space_handler);

@@ -76,6 +83,9 @@ void acpi_remove_cmos_rtc_space_handler(acpi_handle handle)
 {
 	acpi_status status;
 
+	if (cmos_rtc_space_handler_present)
+		return;
+
 	status = acpi_remove_address_space_handler(handle,
 						   ACPI_ADR_SPACE_CMOS,
 						   acpi_cmos_rtc_space_handler);

@@ -87,7 +97,13 @@ EXPORT_SYMBOL_GPL(acpi_remove_cmos_rtc_space_handler);
 static int acpi_cmos_rtc_attach(struct acpi_device *adev,
 				const struct acpi_device_id *id)
 {
-	return acpi_install_cmos_rtc_space_handler(adev->handle);
+	int ret;
+
+	ret = acpi_install_cmos_rtc_space_handler(adev->handle);
+	if (ret < 0)
+		return ret;
+
+	return 1;
 }
 
 static struct acpi_scan_handler cmos_rtc_handler = {

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Danilo Krummrich <[email protected]>

[ Upstream commit f813ec9e84b4d0ca81ec1da94ab07bfb4a29266c ]

Fix missing call to set_node_dbginfo() for new devres nodes created by devm_krealloc().

---
 drivers/base/devres.c | 2 ++
 1 file changed, 2 insertions(+)

index c948c88d39560..9893d656302d9 100644
@@ -940,6 +940,8 @@ void *devm_krealloc(struct device *dev, void *ptr, size_t new_size, gfp_t gfp)
 	if (!new_dr)
 		return NULL;
 
+	set_node_dbginfo(&new_dr->node, "devm_krealloc_release", new_size);
+
 	/*
 	 * The spinlock protects the linked list against concurrent
 	 * modifications but not the resource itself.

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gopi Krishna Menon <[email protected]>

[ Upstream commit da2c4f332a0504d9c284e7626a561d343c8d6f57 ]

of_property_read_u32 returns 0 on success. The current check returns -EINVAL if the property is read successfully.

Fix the check by removing ! from of_property_read_u32

---
 drivers/thermal/spear_thermal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 603dadcd3df58..5e3e9c1f32f8e 100644
@@ -93,7 +93,7 @@ static int spear_thermal_probe(struct platform_device *pdev)
 	struct device_node *np = pdev->dev.of_node;
 	int ret = 0, val;
 
-	if (!np || !of_property_read_u32(np, "st,thermal-flags", &val)) {
+	if (!np || of_property_read_u32(np, "st,thermal-flags", &val)) {
 		dev_err(&pdev->dev, "Failed: DT Pdata not passed\n");
 		return -EINVAL;
 	}

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <[email protected]>

[ Upstream commit 31de83980d3764d784f79ff1bc93c42b324f4013 ]

Passing a NULL pointer to debugfs_create_str() leads to a NULL pointer dereference when the debugfs file is read. Following upstream discussions, forbid the creation of debugfs string files with NULL pointers. Add a WARN_ON() to expose offending callers and return early.

---
 fs/debugfs/file.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index 3ec3324c20603..252fca572eb76 100644
@@ -1127,7 +1127,7 @@ static const struct file_operations fops_str_wo = {
  *          directory dentry if set.  If this parameter is %NULL, then the
  *          file will be created in the root of the debugfs filesystem.
  * @value: a pointer to the variable that the file should read to and write
- *         from.
+ *         from. This pointer and the string it points to must not be %NULL.
  *
  * This function creates a file in debugfs with the given name that
  * contains the value of the variable @value.  If the @mode variable is so

@@ -1136,6 +1136,9 @@ static const struct file_operations fops_str_wo = {
 void debugfs_create_str(const char *name, umode_t mode,
 			struct dentry *parent, char **value)
 {
+	if (WARN_ON(!value || !*value))
+		return;
+
 	debugfs_create_mode_unsafe(name, mode, parent, value, &fops_str,
 				   &fops_str_ro, &fops_str_wo);
 }

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <[email protected]>

[ Upstream commit 4afc929c0f74c4f22b055a82b371d50586da58ca ]

The EXPORT_SYMBOL_GPL() for debugfs_create_str was placed incorrectly away from the function definition. Move it immediately below the debugfs_create_str() function where it belongs.

---
 fs/debugfs/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 252fca572eb76..880a8a9deacfe 100644
@@ -1047,7 +1047,6 @@ ssize_t debugfs_read_file_str(struct file *file, char __user *user_buf,
 
 	return ret;
 }
-EXPORT_SYMBOL_GPL(debugfs_create_str);
 
 static ssize_t debugfs_write_file_str(struct file *file, const char __user *user_buf,
 				      size_t count, loff_t *ppos)

@@ -1142,6 +1141,7 @@ void debugfs_create_str(const char *name, umode_t mode,
 	debugfs_create_mode_unsafe(name, mode, parent, value, &fops_str,
 				   &fops_str_ro, &fops_str_wo);
 }
+EXPORT_SYMBOL_GPL(debugfs_create_str);
 
 static ssize_t read_file_blob(struct file *file, char __user *user_buf,
 			      size_t count, loff_t *ppos)

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <[email protected]>

[ Upstream commit 7215e4552f31e53595eae56a834f7e286beecccc ]

Passing NULL to debugfs_create_str() causes a NULL pointer dereference, and creating debugfs nodes with NULL string pointers is no longer permitted.

Additionally, firmware_file is a global pointer. Previously, adding every new slave blindly overwrote it with NULL.

Fix these issues by initializing firmware_file to an allocated empty string once in the subsystem init path (sdw_debugfs_init), and freeing it in the exit path. Existing driver code handles empty strings correctly.

---
 drivers/soundwire/debugfs.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

index 1e0f9318b6165..feb4d15102753 100644
@@ -350,8 +350,8 @@ void sdw_slave_debugfs_init(struct sdw_slave *slave)
 	debugfs_create_file("go", 0200, d, slave, &cmd_go_fops);
 
 	debugfs_create_file("read_buffer", 0400, d, slave, &read_buffer_fops);
-	firmware_file = NULL;
-	debugfs_create_str("firmware_file", 0200, d, &firmware_file);
+	if (firmware_file)
+		debugfs_create_str("firmware_file", 0200, d, &firmware_file);
 
 	slave->debugfs = d;
 }

@@ -363,10 +363,15 @@ void sdw_slave_debugfs_exit(struct sdw_slave *slave)
 
 void sdw_debugfs_init(void)
 {
+	if (!firmware_file)
+		firmware_file = kstrdup("", GFP_KERNEL);
+
 	sdw_debugfs_root = debugfs_create_dir("soundwire", NULL);
 }
 
 void sdw_debugfs_exit(void)
 {
 	debugfs_remove_recursive(sdw_debugfs_root);
+	kfree(firmware_file);
+	firmware_file = NULL;
 }

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gautham R. Shenoy <[email protected]>

[ Upstream commit beda3b363546a423e4e29a7395e04c0ac4ff677e ]

On failure to set the epp, the function amd_pstate_epp_cpu_init() returns with an error code without freeing the cpudata object that was allocated at the beginning of the function.

Ensure that the cpudata object is freed before returning from the function.

This memory leak was discovered by Claude Opus 4.6 with the aid of Chris Mason's AI review-prompts
(https://github.com/masoncl/review-prompts/tree/main/kernel).

---
 drivers/cpufreq/amd-pstate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 602e4fa81d6c5..86d8762ac82c5 100644
@@ -1525,7 +1525,7 @@ static int amd_pstate_epp_cpu_init(struct cpufreq_policy *policy)
 
 	ret = amd_pstate_set_epp(policy, cpudata->epp_default);
 	if (ret)
-		return ret;
+		goto free_cpudata1;
 
 	current_pstate_driver->adjust_perf = NULL;
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gautham R. Shenoy <[email protected]>

[ Upstream commit fcc25a291fbdca2c06c2c6602532050873f0c9de ]

The function msr_update_perf() does not cache the new value that is written to MSR_AMD_CPPC_REQ into the variable cpudata->cppc_req_cached when the update is happening from the fast path.

Fix that by caching the value everytime the MSR_AMD_CPPC_REQ gets updated.

This issue was discovered by Claude Opus 4.6 with the aid of Chris Mason's AI review-prompts
(https://github.com/masoncl/review-prompts/tree/main/kernel).

---
 drivers/cpufreq/amd-pstate.c | 1 -
 1 file changed, 1 deletion(-)

index 86d8762ac82c5..39681ad1606f6 100644
@@ -259,7 +259,6 @@ static int msr_update_perf(struct cpufreq_policy *policy, u8 min_perf,
 
 	if (fast_switch) {
 		wrmsrq(MSR_AMD_CPPC_REQ, value);
-		return 0;
 	} else {
 		int ret = wrmsrq_on_cpu(cpudata->cpu, MSR_AMD_CPPC_REQ, value);
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: K Prateek Nayak <[email protected]>

[ Upstream commit c03791085adcd61fa9b766ab303c7d0941d7378d ]

cpufreq_cpu_get() can sleep on PREEMPT_RT in presence of concurrent writer(s), however amd-pstate depends on fetching the cpudata via the policy's driver data which necessitates grabbing the reference.

Since schedutil governor can call "cpufreq_driver->update_perf()" during sched_tick/enqueue/dequeue with rq_lock held and IRQs disabled, fetching the policy object using the cpufreq_cpu_get() helper in the scheduler fast-path leads to "BUG: scheduling while atomic" on PREEMPT_RT [1].

Pass the cached cpufreq policy object in sg_policy to the update_perf() instead of just the CPU. The CPU can be inferred using "policy->cpu".

The lifetime of cpufreq_policy object outlasts that of the governor and the cpufreq driver (allocated when the CPU is onlined and only reclaimed when the CPU is offlined / the CPU device is removed) which makes it safe to be referenced throughout the governor's lifetime.