6.1.175-rc1 review

This is the start of the stable review cycle for the 6.1.175 release. There are 969 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Mon, 01 Jun 2026 16:01:39 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.175-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.1.175-rc1

Linus Torvalds <[email protected]>
security/keys: fix missed RCU read section on lookup

Aditya Garg <[email protected]>
net: mana: validate rx_req_idx to prevent out-of-bounds array access

Bartosz Golaszewski <[email protected]>
gpio: cdev: check if uAPI v2 config attributes are correctly zeroed

Andy Shevchenko <[email protected]>
gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)

Jani Nikula <[email protected]>
string: add mem_is_zero() helper to check if memory area is all zeros

Rosen Penev <[email protected]>
net: ag71xx: check error for platform_get_irq

David Carlier <[email protected]>
tracing: Avoid NULL return from hist_field_name() on truncation

Ido Schimmel <[email protected]>
bridge: mcast: Fix a possible use-after-free when removing a bridge port

Petr Machata <[email protected]>
net: bridge: Flush multicast groups when snooping is disabled

Guangshuo Li <[email protected]>
RDMA/rtrs: Fix use-after-free in path file creation cleanup

Rafael J. Wysocki <[email protected]>
platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL

Rafael J. Wysocki <[email protected]>
platform/x86: intel-hid: Check ACPI_HANDLE() against NULL

Rafael J. Wysocki <[email protected]>
platform/x86: hp_accel: Check ACPI_COMPANION() against NULL

Rafael J. Wysocki <[email protected]>
platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL

Erni Sri Satya Vennela <[email protected]>
net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

Daniel Golle <[email protected]>
net: dsa: mt7530: preserve VLAN tags on trapped link-local frames

Arınç ÜNAL <[email protected]>

    net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw

Daniel Golle <[email protected]>
net: dsa: mt7530: fix FDB entries not aging out with short timeout

Daniel Golle <[email protected]>
net: dsa: mt7530: sync driver-specific behavior of MT7531 variants

Matthew Leach <[email protected]>
wifi: ath11k: fix peer resolution on rx path when peer_id=0

P Praneesh <[email protected]>
wifi: ath11k: fix rssi station dump not updated in QCN9074

Sriram R <[email protected]>
wifi: ath11k: add new hw ops for IPQ5018 to get rx dest ring hashmap

Sriram R <[email protected]>
wifi: ath11k: initialize hw_ops for IPQ5018

Sriram R <[email protected]>
wifi: ath11k: update hal srng regs for IPQ5018

Sriram R <[email protected]>
wifi: ath11k: remap ce register space for IPQ5018

Sriram R <[email protected]>
wifi: ath11k: update ce configurations for IPQ5018

Sriram R <[email protected]>
wifi: ath11k: update hw params for IPQ5018

Youghandhar Chintala <[email protected]>
wifi: ath11k: Trigger sta disconnect on hardware restart

Dmitry Baryshkov <[email protected]>
drm/msm/snapshot: fix dumping of the unaligned regions

Felix Gu <[email protected]>
spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()

Jakub Kicinski <[email protected]>
net: tls: prevent chain-after-chain in plain text SG

Jakub Kicinski <[email protected]>
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring

Xiang Mei <[email protected]>
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

Sayali Patil <[email protected]>
powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()

Mikko Perttunen <[email protected]>
drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN

Dmitry Baryshkov <[email protected]>
drm/msm/dsi: don't dump registers past the mapped region

Chenguang Zhao <[email protected]>
ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics

Xiang Mei <[email protected]>

    net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint

Lukas Bulwahn <[email protected]>
HID: quirks: really enable the intended work around for appledisplay

Nicolas Escande <[email protected]>
wifi: ath11k: fix error path leaks in some WMI WOW calls

Ethan Nelson-Moore <[email protected]>
net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference

Linus Walleij <[email protected]>
net: ethernet: cortina: Carry over frag counter

Andreas Haarmann-Thiemann <[email protected]>
net: ethernet: cortina: Drop half-assembled SKB

Linus Walleij <[email protected]>
net: ethernet: cortina: Make RX SKB per-port

Jiayuan Chen <[email protected]>
irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT

Rosen Penev <[email protected]>
irqchip/ath79-cpu: Remove unused function

Gabor Juhos <[email protected]>
phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access

Myeonghun Pak <[email protected]>
net: lan966x: avoid unregistering netdev on register failure

Bart Van Assche <[email protected]>
ice: fix locking in ice_dcb_rebuild()

Kuniyuki Iwashima <[email protected]>
tcp: Fix imbalanced icsk_accept_queue count.

Florian Westphal <[email protected]>
netfilter: bridge: eb_tables: close module init race

Florian Westphal <[email protected]>
netfilter: x_tables: close dangling table module init race

Florian Westphal <[email protected]>
netfilter: ebtables: close dangling table module init race

Florian Westphal <[email protected]>
netfilter: ebtables: move to two-stage removal scheme

Florian Westphal <[email protected]>
netfilter: x_tables: add and use xtables_unregister_table_exit

Florian Westphal <[email protected]>
netfilter: x_tables: add and use xt_unregister_table_pre_exit

Pablo Neira Ayuso <[email protected]>
netfilter: Exclude LEGACY TABLES on PREEMPT_RT.

Breno Leitao <[email protected]>
netfilter: Make legacy configs user selectable

Kuniyuki Iwashima <[email protected]>
netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c

Florian Westphal <[email protected]>
netfilter: xtables: fix up kconfig dependencies

Florian Westphal <[email protected]>
netfilter: ebtables: allow xtables-nft only builds

Florian Westphal <[email protected]>
netfilter: xtables: allow xtables-nft only builds

Florian Westphal <[email protected]>
netfilter: arptables: allow xtables-nft only builds

Florian Westphal <[email protected]>
netfilter: x_tables: unregister the templates first

Guenter Roeck <[email protected]>
ARM: integrator: Fix early initialization

Maulik Shah <[email protected]>
pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150

David Gow <[email protected]>
kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS

David Gow <[email protected]>
kunit: config: Enable KUNIT_DEBUGFS by default

Sudeep Holla <[email protected]>
firmware: arm_ffa: Skip free_pages on RX buffer alloc failure

Sudeep Holla <[email protected]>
firmware: arm_ffa: Check for NULL FF-A ID table while driver registration

Takashi Iwai <[email protected]>
HID: uclogic: Fix regression of input name assignment

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) reject implausible blackbox record_count

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) seed timestamp from the real-time clock

Sven Eckelmann <[email protected]>
batman-adv: tt: fix negative tt_buff_len

Sven Eckelmann <[email protected]>
batman-adv: tt: fix negative last_changeset_len

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: avoid use of uninit sender vars

Sven Eckelmann <[email protected]>
batman-adv: bla: fix report_work leak on backbone_gw purge

Sven Eckelmann <[email protected]>
batman-adv: frag: disallow unicast fragment in fragment

Luxiao Xu <[email protected]>
batman-adv: fix tp_meter counter underflow during shutdown

Ruide Cao <[email protected]>
batman-adv: fix fragment reassembly length accounting

Sven Eckelmann <[email protected]>
batman-adv: dat: handle forward allocation error

Ruijie Li <[email protected]>
batman-adv: clear current gateway during teardown

Sven Eckelmann <[email protected]>
batman-adv: mcast: fix use-after-free in orig_node RCU release

Harry Wentland <[email protected]>
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

Harry Wentland <[email protected]>
drm/amd/display: Validate GPIO pin LUT table size before iterating

Harry Wentland <[email protected]>
drm/amd/display: Fix integer overflow in bios_get_image()

Osama Abdelkader <[email protected]>
drm/bridge: megachips: remove bridge when irq request fails

Julien Chauveau <[email protected]>
drm/bridge: it66121: acquire reset GPIO in probe

Deepanshu Kartikey <[email protected]>
drm/virtio: use uninterruptible resv lock for plane updates

Bartosz Golaszewski <[email protected]>

    device property: set fwnode->secondary to NULL in fwnode_init()

Huacai Chen <[email protected]>
LoongArch: Remove unused code to avoid build warning

Michael Bommarito <[email protected]>
RDMA/siw: Reject MPA FPDU length underflow before signed receive math

Johan Hovold <[email protected]>
spi: ti-qspi: fix use-after-free after DMA setup failure

Johan Hovold <[email protected]>
spi: sprd: fix error pointer deref after DMA setup failure

Michael Bommarito <[email protected]>
scsi: isci: Fix use-after-free in device removal path

Osama Abdelkader <[email protected]>
drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe

Michael Bommarito <[email protected]>
KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

Masami Hiramatsu (Google) <[email protected]>

    tracing: Do not call map->ops->elt_free() if elt_alloc() fails

Zhihao Cheng <[email protected]>
cifs: Fix busy dentry used after unmounting

John Walker <[email protected]>

    wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

Marcin Szycik <[email protected]>
ice: fix setting promisc mode while adding VID filter

Michael Bommarito <[email protected]>
ixgbevf: fix use-after-free in VEPA multicast source pruning

Michael Bommarito <[email protected]>
ipv4: raw: reject IP_HDRINCL packets with ihl < 5

Kyle Farnung <[email protected]>
wifi: ath11k: clear shared SRNG pointer state on restart

Stefano Garzarella <[email protected]>
vsock/virtio: reset connection on receiving queue overflow

Minh Nguyen <[email protected]>
vsock/vmci: fix UAF when peer resets connection during handshake

Steven Rostedt <[email protected]>
ring-buffer: Fix reporting of missed events in iterator

Dawei Feng <[email protected]>
qed: fix double free in qed_cxt_tables_alloc()

Nan Li <[email protected]>
netfilter: ipset: stop hash:* range iteration at end

Haoze Xie <[email protected]>

    netfilter: nf_queue: hold bridge skb->dev while queued

Zhengchuan Liang <[email protected]>
netfilter: ip6t_hbh: reject oversized option lists

Michael Bommarito <[email protected]>
net: ifb: report ethtool stats over num_tx_queues

Nicolai Buchwitz <[email protected]>
net: bcmgenet: keep RBUF EEE/PM disabled

Zijing Yin <[email protected]>
phonet/pep: disable BH around forwarded sk_receive_skb()

Michael Bommarito <[email protected]>
Bluetooth: MGMT: validate Add Extended Advertising Data length

Mingyu Wang <[email protected]>
Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

Jann Horn <[email protected]>

    Bluetooth: bnep: Fix UAF read of dev->name

David Carlier <[email protected]>
Bluetooth: ISO: drop ISO_END frames received without prior ISO_START

Safa Karakuş <[email protected]>
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()

Abdun Nihaal <[email protected]>
net: wwan: iosm: fix potential memory leaks in ipc_imem_init()

Takashi Iwai <[email protected]>
ALSA: asihpi: Fix potential OOB array access at reading cache

Cássio Gabriel <[email protected]>
ALSA: ua101: Reject too-short USB descriptors

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX

Greg Kroah-Hartman <[email protected]>
sysfs: don't remove existing directory on update failure

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue

Asim Viladi Oglu Manizada <[email protected]>
smb: client: reject userspace cifs.spnego descriptions

Sasha Levin <[email protected]>
Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()"

Sasha Levin <[email protected]>
Revert "x86/vdso: Fix output operand size of RDPID"

Deepanshu Kartikey <[email protected]>

    wifi: mac80211: check tdls flag in ieee80211_tdls_oper

Pengpeng Hou <[email protected]>
s390/debug: Reject zero-length input before trimming a newline

Pavel Begunkov <[email protected]>
io_uring: prevent opcode speculation

Allison Henderson <[email protected]>
net/rds: reset op_nents when zerocopy page pin fails

Nicholas Carlini <[email protected]>
io-wq: check that the predecessor is hashed in io_wq_remove_pending()

Johan Hovold <[email protected]>
drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init

Johan Hovold <[email protected]>
drm/gma500/oaktrail_lvds: fix hang on init failure

Johan Hovold <[email protected]>
drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup

Gyeyoung Baek <[email protected]>
drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()

Sebastian Brzezinka <[email protected]>
drm/i915: skip __i915_request_skip() for already signaled requests

Naval Alcalá <[email protected]>
iommu/vt-d: Disable DMAR for Intel Q35 IGFX

Raphael Zimmer <[email protected]>
libceph: handle rbtree insertion error in decode_choose_args()

Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in crush_decode()

Raphael Zimmer <[email protected]>
libceph: Fix potential null-ptr-deref in decode_choose_args()

Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in osdmap_decode()

Ma Ke <[email protected]>
powerpc/warp: Fix error handling in pika_dtm_thread

Viacheslav Dubeyko <[email protected]>
ceph: fix a buffer leak in __ceph_setxattr()

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Bound MIDI endpoint descriptor scans

Chaitanya Kumar Borah <[email protected]>
drm/i915/dp: Fix VSC dynamic range signaling for RGB formats

Ye Bin <[email protected]>
smb/client: fix possible infinite loop and oob read in symlink_data()

Qiang Ma <[email protected]>
KVM: x86: Fix Xen hypercall tracepoint argument assignment

Junrui Luo <[email protected]>
KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

Aaron Sacks <[email protected]>
KVM: Reject wrapped offset in kvm_reset_dirty_gfn()

Sergio Correia <[email protected]>
audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV

Zoran Ilievski <[email protected]>
net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled

Li Xiasong <[email protected]>
netfilter: nft_ct: fix missing expect put in obj eval

Sergio Correia <[email protected]>
audit: fix incorrect inheritable capability in CAPSET records

Li Xiasong <[email protected]>
netfilter: nf_conntrack_sip: get helper before allocating expectation

Matt Vollrath <[email protected]>
i40e: Cleanup PTP pins on probe failure

Herbert Xu <[email protected]>

    crypto: af_alg - Cap AEAD AD length to 0x80000000

Tonghao Zhang <[email protected]>
net: bonding: update the slave array for broadcast mode

Hangbin Liu <[email protected]>
bonding: fix NULL pointer dereference in actor_port_prio setting

Breno Leitao <[email protected]>
netconsole: avoid out-of-bounds access on empty string in trim_newline()

Takahiro Kuwano <[email protected]>
mtd: spi-nor: spansion: Enable JFFS2 write buffer for S25FS256T

Peter Ujfalusi <[email protected]>
ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()

Peter Ujfalusi <[email protected]>
ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close

Cássio Gabriel <[email protected]>
ALSA: core: Serialize deferred fasync state checks

Takashi Iwai <[email protected]>
ALSA: misc: Use guard() for spin locks

Filipe Manana <[email protected]>
btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()

Justin Chen <[email protected]>
net: bcmgenet: fix leaking free_bds

Ryo Takakura <[email protected]>
net: bcmgenet: Initialize u64 stats seq counter

Eric Dumazet <[email protected]>
net/sched: sch_pie: annotate more data-races in pie_dump_stats()

Greg Kroah-Hartman <[email protected]>
smb: client: fix OOB reads parsing symlink error response

Liang Jie <[email protected]>
smb: client: correctly handle ErrorContextData as a flexible array

Paolo Abeni <[email protected]>
net/sched: cls_flower: revert unintended changes

Jakub Kicinski <[email protected]>
net: tls: fix strparser anchor skb leak on offload RX setup failure

Petr Oros <[email protected]>
ice: fix NULL pointer dereference in ice_reset_all_vfs()

Jacob Keller <[email protected]>
ice: Pull common tasks into ice_vf_post_vsi_rebuild

Petr Oros <[email protected]>
iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler

Petr Oros <[email protected]>
iavf: wait for PF confirmation before removing VLAN filters

Petr Oros <[email protected]>
iavf: stop removing VLAN filters from PF on interface down

Petr Oros <[email protected]>
iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING

Eric Dumazet <[email protected]>

    bonding: 3ad: implement proper RCU rules for port->aggregator

Hangbin Liu <[email protected]>
bonding: print churn state via netlink

Hangbin Liu <[email protected]>
bonding: add support for per-port LACP actor priority

Tonghao Zhang <[email protected]>
net: bonding: add broadcast_neighbor option for 802.3ad

Jones Syue 薛懷宗 <[email protected]>
bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner

Timur Kristóf <[email protected]>
drm/amd/display: Read EDID from VBIOS embedded panel info

Timur Kristóf <[email protected]>
drm/amd/display: Allow DCE link encoder without AUX registers

Sebastian Andrzej Siewior <[email protected]>
futex: Prevent lockup in requeue-PI during signal/ timeout wakeup

wangdicheng <[email protected]>
ALSA: hda/conexant: Fix missing error check for jack detection

wangdicheng <[email protected]>

    ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87

Oldherl Oh <[email protected]>
ALSA: hda/conexant: fix some typos

Breno Leitao <[email protected]>
netconsole: propagate device name truncation in dev_name_store()

Matthew Wood <[email protected]>
net: netconsole: move newline trimming to function

Eric Dumazet <[email protected]>
net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)

Weiming Shi <[email protected]>
bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

Beniamino Galvani <[email protected]>
ipv6: rename and move ip6_dst_lookup_tunnel()

Beniamino Galvani <[email protected]>
ipv4: add new arguments to udp_tunnel_dst_lookup()

Beniamino Galvani <[email protected]>
ipv4: remove "proto" argument from udp_tunnel_dst_lookup()

Beniamino Galvani <[email protected]>
ipv4: rename and move ip_route_output_tunnel()

Xin Long <[email protected]>
sctp: discard stale INIT after handshake completion

Xin Long <[email protected]>
netfilter: skip recording stale or retransmitted INIT

Christian A. Ehrhardt <[email protected]>
ASoC: codecs: ab8500: Fix casting of private data

Heiko Schocher <[email protected]>
net: phy: dp83869: fix setting CLK_O_SEL field.

William A. Kennington III <[email protected]>
net: mctp i2c: check length before marking flow active

Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams

Florian Westphal <[email protected]>
neigh: let neigh_xmit take skb ownership

Eric Dumazet <[email protected]>

    neighbour: add RCU protection to neigh_tables[]

Paul Geurts <[email protected]>
NFC: trf7970a: Ignore antenna noise when checking for RF field

Morduan Zang <[email protected]>
net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit

Zhan Jun <[email protected]>

    net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()

Ido Schimmel <[email protected]>
vrf: Fix a potential NPD when removing a port from a VRF

Eric Dumazet <[email protected]>
net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_choke: annotate data-races in choke_dump_stats()

Stephen Hemminger <[email protected]>
net/sched: netem: fix slot delay calculation overflow

Stephen Hemminger <[email protected]>
net/sched: netem: validate slot configuration

Stephen Hemminger <[email protected]>
net/sched: netem: fix queue limit check to include reordered packets

Stephen Hemminger <[email protected]>
net/sched: netem: fix probability gaps in 4-state loss model

Nikola Z. Ivanov <[email protected]>
netdevsim: zero initialize struct iphdr in dummy sk_buff

Daan De Meyer <[email protected]>
cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()

John Madieu <[email protected]>
spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ

Yang Yingliang <[email protected]>
spi: rockchip: switch to use modern name

Lizhe <[email protected]>
drivers/spi-rockchip.c : Remove redundant variable slave

Florian Westphal <[email protected]>
netfilter: nf_conntrack_sip: don't use simple_strtoul

Jiexun Wang <[email protected]>
netfilter: xt_policy: fix strict mode inbound policy matching

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)

Timur Kristóf <[email protected]>
drm/amdgpu/uvd3.1: Don't validate the firmware when already validated

Alexandre Demers <[email protected]>
drm/amdgpu: fix spelling typos

Keith Busch <[email protected]>
nvme-pci: fix missed admin queue sq doorbell write

Pablo Neira Ayuso <[email protected]>
netfilter: arp_tables: fix IEEE1394 ARP payload parsing

Maurizio Lombardi <[email protected]>
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

Breno Leitao <[email protected]>
tracing: branch: Fix inverted check on stat tracer registration

Mark Harmstone <[email protected]>
btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()

Wolfram Sang <[email protected]>
mailbox: mailbox-test: make data_ready a per-instance variable

Wolfram Sang <[email protected]>
mailbox: mailbox-test: initialize struct earlier

Wolfram Sang <[email protected]>
mailbox: mailbox-test: don't free the reused channel

Wolfram Sang <[email protected]>
mailbox: add sanity check for channel array

cuitao <[email protected]>
cgroup/rdma: fix integer overflow in rdmacg_try_charge()

Wolfram Sang <[email protected]>
mailbox: mailbox-test: free channels on probe error

Yuho Choi <[email protected]>
fbdev: offb: fix PCI device reference leak on probe failure

Anthony Pighin (Nokia) <[email protected]>

    rtc: abx80x: Disable alarm feature if no interrupt attached

Bae Yeonju <[email protected]>
fs/adfs: validate nzones in adfs_validate_bblk()

Kohei Enju <[email protected]>
vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()

Lee Jones <[email protected]>
tipc: fix double-free in tipc_buf_append()

Alexey Kodanev <[email protected]>
nfp: fix swapped arguments in nfp_encode_basic_qdr() calls

Mieczyslaw Nalewaj <[email protected]>
net: dsa: realtek: rtl8365mb: fix mode mask calculation

Eric Dumazet <[email protected]>
net/sched: sch_sfb: annotate data-races in sfb_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_red: annotate data-races in red_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_pie: annotate data-races in pie_dump_stats()

Eric Dumazet <[email protected]>
net_sched: sch_hhf: annotate data-races in hhf_dump_stats()

Michael Bommarito <[email protected]>
net/rds: zero per-item info buffer before handing it to visitors

Hyunwoo Kim <[email protected]>

    ksmbd: scope conn->binding slowpath to bound sessions only

DaeMyung Kang <[email protected]>
ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()

Jun Yan <[email protected]>
arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number

Weiming Shi <[email protected]>
slip: bound decode() reads against the compressed packet length

Weiming Shi <[email protected]>
slip: reject VJ receive packets on instances with no rstate array

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

Yingnan Zhang <[email protected]>
ipvs: fix MTU check for GSO packets in tunnel mode

Pablo Neira Ayuso <[email protected]>
netfilter: xtables: restrict several matches to inet family

Florian Westphal <[email protected]>
netfilter: conntrack: remove sprintf usage

Xiang Mei <[email protected]>
netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

Pablo Neira Ayuso <[email protected]>
netfilter: nft_osf: restrict it to ipv4

Weiming Shi <[email protected]>
openvswitch: cap upcall PID array size and pre-size vport replies

Qingfang Deng <[email protected]>
pppoe: drop PFC frames

Michael Bommarito <[email protected]>
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks

Eric Dumazet <[email protected]>
ipv6: fix possible UAF in icmpv6_rcv()

Matt Vollrath <[email protected]>
e1000e: Unroll PTP in probe error handling

Kohei Enju <[email protected]>
i40e: don't advertise IFF_SUPP_NOFCS

Eric Dumazet <[email protected]>

    tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->dsack_dups

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->bytes_retrans

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->bytes_sent

Eric Dumazet <[email protected]>

    tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans

Eric Dumazet <[email protected]>
tcp: preserve const qualifier in tcp_sk()

Greg Kroah-Hartman <[email protected]>
container_of: add container_of_const() that preserves const-ness of the pointer

Greg Kroah-Hartman <[email protected]>
container_of: remove container_of_safe()

Vinicius Costa Gomes <[email protected]>
net/sched: taprio: fix use-after-free in advance_sched() on schedule switch

Vladimir Oltean <[email protected]>
net/sched: taprio: rename close_time to end_time

Vladimir Oltean <[email protected]>
net/sched: taprio: refactor one skb dequeue from TXQ to separate function

Vladimir Oltean <[email protected]>
net/sched: taprio: continue with other TXQs if one dequeue() failed

Jiayuan Chen <[email protected]>
nexthop: fix IPv6 route referencing IPv4 nexthop

Dudu Lu <[email protected]>
net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys

Peng Fan <[email protected]>
arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT

René Rebe <[email protected]>
PCMCIA: Fix garbled log messages for KERN_CONT

Peng Fan <[email protected]>
arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT

Paul Moses <[email protected]>
crypto: ccp - copy IV using skcipher ivsize

T Pratham <[email protected]>
crypto: sa2ul - Fix AEAD fallback algorithm names

Ville Syrjälä <[email protected]>
drm/i915/wm: Verify the correct plane DDB entry

Stanislav Lisovskiy <[email protected]>
drm/i915: Loop over all active pipes in intel_mbus_dbox_update

Gustavo Sousa <[email protected]>
drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update()

Ville Syrjälä <[email protected]>
drm/i915: Constify watermark state checker

Yongpeng Yang <[email protected]>
f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()

Christophe JAILLET <[email protected]>
f2fs: Use sysfs_emit_at() to simplify code

Brian Masney <[email protected]>
clk: visconti: pll: initialize clk_init_data to zero

Geert Uytterhoeven <[email protected]>
lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-sc7180: Add missing MDSS resets

Konrad Dybcio <[email protected]>
dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets

Geert Uytterhoeven <[email protected]>
clk: xgene: Fix mapping leak in xgene_pllclk_init()

Arnd Bergmann <[email protected]>
clk: qoriq: avoid format string warning

Sebastian Krzyszkowiak <[email protected]>
clk: imx8mq: Correct the CSI PHY sels

Felix Gu <[email protected]>
clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()

Felix Gu <[email protected]>
clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()

Val Packett <[email protected]>
clk: qcom: dispcc-sm8250: Enable parents for pixel clocks

Val Packett <[email protected]>
clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Use retention for PCIe power domains

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Use retention for USB power domains

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Add missing GDSCs

Val Packett <[email protected]>

    dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs

Junrui Luo <[email protected]>
scsi: target: core: Fix integer overflow in UNMAP bounds check

Yang Erkun <[email protected]>
scsi: sg: Resolve soft lockup issue when opening /dev/sgX

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source

Florian Westphal <[email protected]>
RDMA/core: Prefer NLA_NUL_STRING

Pengpeng Hou <[email protected]>
platform/x86: dell-wmi-sysman: bound enumeration string aggregation

Fedor Pchelkin <[email protected]>
platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()

Pengpeng Hou <[email protected]>
fs/ntfs3: terminate the cached volume label after UTF-8 conversion

Andy Shevchenko <[email protected]>
nfs/blocklayout: Fix compilation error (make W=1) in bl_write_pagelist()

Abdun Nihaal <[email protected]>
mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()

Rafael J. Wysocki <[email protected]>
platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup

Randy Dunlap <[email protected]>
tty: hvc_iucv: fix off-by-one in number of supported devices

Chen Ni <[email protected]>

    leds: lgm-sso: Remove duplicate assignments for priv->mmap

Rafael J. Wysocki <[email protected]>
platform/surface: surfacepro3_button: Drop wakeup source on remove

Chen Ni <[email protected]>
backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()

Nuno Sa <[email protected]>
dev_printk: add new dev_err_probe() helpers

Andy Shevchenko <[email protected]>
driver core: Move dev_err_probe() to where it belogs

Greg Kroah-Hartman <[email protected]>
driver core: device.h: remove extern from function prototypes

Billy Tsai <[email protected]>
i3c: mipi-i3c-hci: fix IBI payload length calculation for final status

Arnaldo Carvalho de Melo <[email protected]>
perf util: Kill die() prototype, dead for a long time

Leo Yan <[email protected]>
perf expr: Return -EINVAL for syntax error in expr__find_ids()

Yu-Chun Lin <[email protected]>
pinctrl: abx500: Fix type of 'argument' variable

Mike Leach <[email protected]>
perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace

Ian Rogers <[email protected]>
perf branch: Avoid incrementing NULL

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Avoid returning positive values to user space

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: remove duplicate error message

Ethan Tidmore <[email protected]>
pinctrl: pinctrl-pic32: Fix resource leak

Puranjay Mohan <[email protected]>
bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT

Yihan Ding <[email protected]>
bpf: allow UTF-8 literals in bpf_bprintf_prepare()

Daniel Borkmann <[email protected]>
bpf: Fix precedence bug in convert_bpf_ld_abs alignment check

Michal Luczaj <[email protected]>
bpf, sockmap: Take state lock for af_unix iter

Michal Luczaj <[email protected]>
bpf, sockmap: Fix af_unix null-ptr-deref in proto update

Michal Luczaj <[email protected]>
bpf, sockmap: Fix af_unix iter deadlock

Daniel Borkmann <[email protected]>
bpf, arm64: Fix off-by-one in check_imm signed range check

Oliver Neukum <[email protected]>
HID: usbhid: fix deadlock in hid_post_reset()

Richard Genoud <[email protected]>
mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob

Cosmin Tanislav <[email protected]>
mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions

Cosmin Tanislav <[email protected]>
mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path

Shiji Yang <[email protected]>
mtd: spi-nor: swp: check SR_TB flag when getting tb_mask

Jonas Gorski <[email protected]>
mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation

Takahiro Kuwano <[email protected]>
mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook

Takahiro Kuwano <[email protected]>
mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook

Tudor Ambarus <[email protected]>
mtd: spi-nor: Allow post_sfdp hook to return errors

Takahiro Kuwano <[email protected]>
mtd: spi-nor: spansion: Add support for Infineon S25FS256T

Takahiro Kuwano <[email protected]>
mtd: spi-nor: spansion: Make RD_ANY_REG_OP macro take number of dummy bytes

Tudor Ambarus <[email protected]>
mtd: spi-nor: spansion: Replace hardcoded values for addr_nbytes/addr_mode_nbytes

Takahiro Kuwano <[email protected]>
mtd: spi-nor: spansion: Rename s28hs512t prefix

Haibo Chen <[email protected]>
mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations

Chen Ni <[email protected]>
mtd: physmap_of_gemini: Fix disabled pinctrl state check

Denis Benato <[email protected]>
HID: asus: do not abort probe when not necessary

Denis Benato <[email protected]>
HID: asus: make asus_resume adhere to linux kernel coding standards

Daniel Hodges <[email protected]>
ima: check return value of crypto_shash_final() in boot aggregate

Pengpeng Hou <[email protected]>
tracing: Rebuild full_name on each hist_field_name() call

Frank Li <[email protected]>
dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register()

Cole Leavitt <[email protected]>
soundwire: bus: demote UNATTACHED state warnings to dev_dbg()

Khairul Anuar Romli <[email protected]>
dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function

ZhengYuan Huang <[email protected]>
ocfs2: validate group add input before caching

ZhengYuan Huang <[email protected]>
ocfs2: validate bg_bits during freefrag scan

ZhengYuan Huang <[email protected]>
ocfs2: fix listxattr handling when the buffer is full

Christoph Hellwig <[email protected]>
arm64/xor: fix conflicting attributes for xor_block_template

Aaro Koskinen <[email protected]>
ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX

Alexander Koskovich <[email protected]>

    arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP

Alok Tiwari <[email protected]>
soc: qcom: aoss: compare against normalized cooling state

Alok Tiwari <[email protected]>
soc: qcom: llcc: fix v1 SB syndrome register offset

Junrui Luo <[email protected]>
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison

Junrui Luo <[email protected]>
ocfs2/dlm: validate qr_numregions in dlm_match_regions()

Michal Grzedzicki <[email protected]>
unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure

Sumit Gupta <[email protected]>
soc/tegra: cbb: Set ERD on resume for err interrupt

David Heidelberg <[email protected]>
arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm8450: Fix GIC_ITS range length

Dmitry Baryshkov <[email protected]>
soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available

Dmitry Baryshkov <[email protected]>
soc: qcom: ocmem: register reasons for probe deferrals

Krzysztof Kozlowski <[email protected]>
soc: qcom: ocmem: use scoped device node handling to simplify error paths

Akari Tsuyukusa <[email protected]>
arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count

Akari Tsuyukusa <[email protected]>
arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count

Sherry Sun <[email protected]>
arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1)

Mikko Perttunen <[email protected]>
memory: tegra30-emc: Fix dll_change check

Mikko Perttunen <[email protected]>
memory: tegra124-emc: Fix dll_change check

Rafał Miłecki <[email protected]>
ARM: dts: mediatek: mt7623: fix efuse fallback compatible

Joshua Klinesmith <[email protected]>
ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine

Thomas Huth <[email protected]>
efi/capsule-loader: fix incorrect sizeof in phys array reallocation

Andreas Gruenbacher <[email protected]>
gfs2: prevent NULL pointer dereference during unmount

Andreas Gruenbacher <[email protected]>
gfs2: add some missing log locking

Jan Kara <[email protected]>
quota: Fix race of dquot_scan_active() with quota deactivation

Ricardo B. Marlière <[email protected]>
ktest: Run POST_KTEST hooks on failure and cancellation

Ricardo B. Marlière <[email protected]>
ktest: Honor empty per-test option overrides

Ricardo B. Marlière <[email protected]>
ktest: Avoid undef warning when WARNINGS_FILE is unset

Andreas Gruenbacher <[email protected]>
gfs2: Call unlock_new_inode before d_instantiate

Ming-Hung Tsai <[email protected]>
dm cache: fix missing return in invalidate_committed's error path

Cássio Gabriel <[email protected]>
ALSA: sc6000: Keep the programmed board state in card-private data

Takashi Iwai <[email protected]>
ALSA: sc6000: Use standard print API

Pei Xiao <[email protected]>
spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback

Vidya Sagar <[email protected]>
PCI: tegra194: Allow system suspend when the Endpoint link is not up

Vidya Sagar <[email protected]>
PCI: tegra194: Disable direct speed change for Endpoint mode

Vidya Sagar <[email protected]>
PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Disable PERST# IRQ only in Endpoint mode

Vidya Sagar <[email protected]>
PCI: tegra194: Don't force the device into the D0 state before L2

Manivannan Sadhasivam <[email protected]>
PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0()

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Increase LTSSM poll time on surprise link down

Vidya Sagar <[email protected]>
PCI: tegra194: Fix polling delay for L2 state

Frank Li <[email protected]>
PCI: Add PCIE_PME_TO_L2_TIMEOUT_US L2 ready timeout value

Cássio Gabriel <[email protected]>
ASoC: SOF: compress: return the configured codec from get_params

Daniel Baluta <[email protected]>
ASoC: SOF: Add support for compress API for stream data/offset

Daniel Baluta <[email protected]>
ASoC: SOF: Prepare set_stream_data_offset for compress API

Daniel Baluta <[email protected]>
ASoC: SOF: Prepare ipc_msg_data to be used with compress API

V sujith kumar Reddy <[email protected]>
ASoC: SOF: amd: Fix for reading position updates from stream box.

Panagiotis Petrakopoulos <[email protected]>
ALSA: scarlett2: Add missing sentinel initializer field

Waiman Long <[email protected]>
selftest: memcg: skip memcg_sock test if address family not supported

Jane Chu <[email protected]>
Documentation: fix a hugetlbfs reservation statement

AnishMulay <[email protected]>
selftests/mm: skip migration tests if NUMA is unavailable

Chen-Yu Tsai <[email protected]>
PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found

Gerd Bayer <[email protected]>
PCI: Enable AtomicOps only if Root Port supports them

Srinivas Kandagatla <[email protected]>
ASoC: qcom: qdsp6: topology: check widget type before accessing data

Shengjiu Wang <[email protected]>
ASoC: fsl_easrc: Change the type for iec958 channel status controls

Shengjiu Wang <[email protected]>
ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()

Shengjiu Wang <[email protected]>
ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()

Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()

Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Fix event generation in micfil_quality_set()

Felix Gu <[email protected]>

    pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()

Felix Gu <[email protected]>
pmdomain: ti: omap_prm: Fix a reference leak on device node

Akhil P Oommen <[email protected]>
drm/msm/a6xx: Use barriers while updating HFI Q headers

Rob Clark <[email protected]>
drm/msm/shrinker: Fix can_block() logic

Rob Clark <[email protected]>
drm/msm/a6xx: Fix HLSQ register dumping

Lei Huang <[email protected]>
ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}')

Luke D. Jones <[email protected]>
ALSA: hda/realtek: Whitespace fix

Timur Kristóf <[email protected]>
drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Fill DW8 fields from SMC

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Clear EnabledForActivity field for memory levels

Timur Kristóf <[email protected]>

    drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0

Timur Kristóf <[email protected]>
drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled

Cássio Gabriel <[email protected]>
ALSA: core: Validate compress device numbers without dynamic minors

Sebastian Reichel <[email protected]>
drm/panel: simple: Correct G190EAN01 prepare timing

Alexander Koskovich <[email protected]>

    drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0

Yuanjie Yang <[email protected]>
drm/msm/dpu: fix mismatch between power and frequency

Pei Xiao <[email protected]>
spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo

Alex Deucher <[email protected]>
drm/amdgpu/gfx10: look at the right prop for gfx queue priority

Daniel Jordan <[email protected]>
padata: Put CPU offline callback in ONLINE section to allow failure

Chuyi Zhou <[email protected]>
padata: Remove cpu online check from cpu add and removal

Andy Shevchenko <[email protected]>
fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break

Guillaume Gonnet <[email protected]>
dm init: ensure device probing has finished in dm-mod.waitfor=

Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Add default case in DVI mode validation

Ethan Tidmore <[email protected]>
drm/sun4i: Fix resource leaks

Felix Gu <[email protected]>
spi: fsl-qspi: Use reinit_completion() for repeated operations

Junrui Luo <[email protected]>
dm log: fix out-of-bounds write due to region_count overflow

Ming-Hung Tsai <[email protected]>
dm cache metadata: fix memory leak on metadata abort retry

Ming-Hung Tsai <[email protected]>
dm cache: fix dirty mapping checking in passthrough mode switching

Ming-Hung Tsai <[email protected]>
dm cache: support shrinking the origin device

Ming-Hung Tsai <[email protected]>
dm cache: fix concurrent write failure in passthrough mode

Ming-Hung Tsai <[email protected]>
dm cache policy smq: fix missing locks in invalidating cache blocks

Ming-Hung Tsai <[email protected]>
dm cache: fix write hang in passthrough mode

Ming-Hung Tsai <[email protected]>
dm cache: fix write path cache coherency in passthrough mode

Ming-Hung Tsai <[email protected]>
dm cache: fix null-deref with concurrent writes in passthrough mode

Sander Vanheule <[email protected]>
ASoC: sti: use managed regmap_field allocations

Sander Vanheule <[email protected]>
ASoC: sti: Return errors from regmap_field_alloc()

Ethan Tidmore <[email protected]>
drm/sun4i: backend: fix error pointer dereference

Alexander Konyukhov <[email protected]>
drm/komeda: fix integer overflow in AFBC framebuffer size check

Jiayuan Chen <[email protected]>
net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master

Xin Long <[email protected]>
sctp: fix missing encap_port propagation for GSO fragments

Dudu Lu <[email protected]>
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

Pauli Virtanen <[email protected]>
Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER

Jonathan Rissanen <[email protected]>
Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU

Sun Jian <[email protected]>
bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb

Taegu Ha <[email protected]>
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

Greg Jumper <[email protected]>
net/rds: Restrict use of RDS/IB to the initial network namespace

Håkon Bugge <[email protected]>
net/rds: Optimize rds_ib_laddr_check

Jamal Hadi Salim <[email protected]>
net/sched: act_ct: Only release RCU read lock after ct_ft

Mashiro Chen <[email protected]>
net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf

Jiri Slaby (SUSE) <[email protected]>
6pack: propagage new tty types

Florian Westphal <[email protected]>
netfilter: nft_fwd_netdev: check ttl/hl before forwarding

Florian Westphal <[email protected]>
netfilter: xt_socket: enable defrag after all other checks

Justin Chen <[email protected]>
net: bcmgenet: fix racing timeout handler

Zak Kemble <[email protected]>
net: bcmgenet: switch to use 64bit statistics

Doug Berger <[email protected]>
net: bcmgenet: support reclaiming unsent Tx packets

Doug Berger <[email protected]>
net: bcmgenet: move DESC_INDEX flow to ring 0

Doug Berger <[email protected]>
net: bcmgenet: add bcmgenet_has_* helpers

Florian Fainelli <[email protected]>
net: bcmgenet: Remove custom ndo_poll_controller()

Florian Fainelli <[email protected]>
net: bcmgenet: Remove TX ring full logging

Justin Chen <[email protected]>
net: bcmgenet: fix off-by-one in bcmgenet_put_txcb

Wang Wensheng <[email protected]>
arm64: kexec: Remove duplicate allocation for trans_pgd

Haoyu Lu <[email protected]>
ACPI: AGDI: fix missing newline in error message

Weiming Shi <[email protected]>
bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()

Jiayuan Chen <[email protected]>
bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks

Ethan Tidmore <[email protected]>
wifi: brcmfmac: Fix error pointer dereference

Weiming Shi <[email protected]>
bpf: fix end-of-list detection in cgroup_storage_get_next_key()

Eric Dumazet <[email protected]>

    macvlan: annotate data-races around port->bc_queue_len_used

Sourabh Jain <[email protected]>
powerpc/crash: fix backup region offset update to elfcorehdr

Chih Kai Hsu <[email protected]>
r8152: fix incorrect register write to USB_UPHY_XTAL

Alexey Velichayshiy <[email protected]>
wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap()

David Carlier <[email protected]>
bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path

Thorsten Blum <[email protected]>
bpf, devmap: Remove unnecessary if check in for loop

Petr Pavlu <[email protected]>
module: Fix freeing of charp module parameters when CONFIG_SYSFS=n

Petr Pavlu <[email protected]>
params: Replace __modinit with __init_or_module

Shyam Saini <[email protected]>
kernel: globalize lookup_or_create_module_kobject()

Shyam Saini <[email protected]>
kernel: param: rename locate_module_kobject

Cai Xinchen <[email protected]>
dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n

Cai Xinchen <[email protected]>
dpaa2: add independent dependencies for FSL_DPAA2_SWITCH

Feng Yang <[email protected]>
bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap

Vadim Fedorenko <[email protected]>
bpf: Add CHECKSUM_COMPLETE to bpf test progs

Duoming Zhou <[email protected]>
wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet

Zilin Guan <[email protected]>
wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()

Mario Limonciello (AMD) <[email protected]>
firmware: dmi: Correct an indexing error in dmi.h

Bart Van Assche <[email protected]>
locking: Fix rwlock support in <linux/spinlock_up.h>

Thomas Gleixner <[email protected]>
hrtimer: Reduce trace noise in hrtimer_start()

Peter Zijlstra <[email protected]>
hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()

Richard Clark <[email protected]>
hrtimers: Update the return type of enqueue_hrtimer()

Brian Masney <[email protected]>
irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter

Gui-Dong Han <[email protected]>
debugfs: check for NULL pointer in debugfs_create_str()

Gopi Krishna Menon <[email protected]>
thermal/drivers/spear: Fix error condition for reading st,thermal-flags

Danilo Krummrich <[email protected]>
devres: fix missing node debug info in devm_krealloc()

Cole Leavitt <[email protected]>
pstore/ram: fix resource leak when ioremap() fails

Deepanshu Kartikey <[email protected]>
nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()

Bart Van Assche <[email protected]>
drbd: Balance RCU calls in drbd_adm_dump_devices()

HyungJung Joo <[email protected]>
fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START

Ming Lei <[email protected]>
blk-cgroup: wait for blkcg cleanup before initializing new disk

Mingzhe Zou <[email protected]>
bcache: fix uninitialized closure object

Amit Kumar Mahapatra <[email protected]>
mtd: spi-nor: sst: Fix SST write failure

Benjamin Cheng <[email protected]>
drm/amdgpu/vcn4: Avoid overflow on msg bound check

Benjamin Cheng <[email protected]>
drm/amdgpu/vcn3: Avoid overflow on msg bound check

Dudu Lu <[email protected]>
vsock/virtio: fix accept queue count leak on transport mismatch

Norbert Szetei <[email protected]>
vsock: fix buffer size clamping order

Viorel Suman (OSS) <[email protected]>
pwm: imx-tpm: Count the number of enabled channels in probe

Sanjaikumar V S <[email protected]>
mtd: spi-nor: sst: Fix write enable before AAI sequence

Bence Csókás <[email protected]>
mtd: spi-nor: sst: Factor out common write operation to sst_nor_write_data()

Siwei Zhang <[email protected]>
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()

Sven Eckelmann <[email protected]>
batman-adv: bla: put backbone reference on failed claim hash insert

Sven Eckelmann <[email protected]>
batman-adv: bla: only purge non-released claims

Sven Eckelmann <[email protected]>
batman-adv: bla: prevent use-after-free when deleting claims

Jiexun Wang <[email protected]>
batman-adv: stop caching unowned originator pointers in BAT IV

Jiexun Wang <[email protected]>
batman-adv: reject new tp_meter sessions during teardown

Lyes Bourennani <[email protected]>
batman-adv: fix integer overflow on buff_pos

Ben Morris <[email protected]>
sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

Alex Deucher <[email protected]>
drm/amdgpu/pm: align Hawaii mclk workaround with radeon

Alex Deucher <[email protected]>
drm/amdgpu/pm: add missing revision check for CI

John B. Moore <[email protected]>
drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission

John B. Moore <[email protected]>
drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ

Philip Yang <[email protected]>
drm/amdgpu: zero-initialize GART table on allocation

Alex Deucher <[email protected]>
drm/radeon: add missing revision check for CI

Alysa Liu <[email protected]>
drm/amdkfd: validate SVM ioctl nattr against buffer size

Ashutosh Desai <[email protected]>
drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

Benjamin Cheng <[email protected]>
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg

Benjamin Cheng <[email protected]>
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg

Benjamin Cheng <[email protected]>
drm/amdgpu/vce: Prevent partial address patches

Benjamin Cheng <[email protected]>
drm/amdgpu: Add bounds checking to ib_{get,set}_value

Johan Hovold <[email protected]>
spi: mpc52xx: fix use-after-free on unbind

Johan Hovold <[email protected]>
spi: orion: fix clock imbalance on registration failure

Johan Hovold <[email protected]>
spi: imx: fix runtime pm leak on probe deferral

Johan Hovold <[email protected]>
spi: mtk-nor: fix controller deregistration

Haoxiang Li <[email protected]>
media: omap3isp: drop the use count of v4l2 pipeline

Matthias Fend <[email protected]>
media: i2c: ov08d10: fix image vertical start setting

Wenmeng Liu <[email protected]>
media: i2c: imx412: Assert reset GPIO during probe

Sergey Shtylyov <[email protected]>

    media: dib8000: avoid division by 0 in dib8000_set_dds()

Abdun Nihaal <[email protected]>
media: pci: zoran: fix potential memory leak in zoran_probe()

Krishna Chomal <[email protected]>
platform/x86: hp-wmi: Ignore backlight and FnLock events

Wang Jun <[email protected]>
media: saa7164: add ioremap return checks and cleanups

Johan Hovold <[email protected]>
regulator: bd9571mwv: fix OF node reference imbalance

Johan Hovold <[email protected]>
regulator: act8945a: fix OF node reference imbalance

Oliver Neukum <[email protected]>
media: rc: streamzap: Error handling in probe

Oliver Neukum <[email protected]>
media: rc: xbox_remote: heed DMA restrictions

Johan Hovold <[email protected]>
regulator: max77650: fix OF node reference imbalance

Sakari Ailus <[email protected]>
staging: media: atomisp: Disallow all private IOCTLs

Alexander Koskovich <[email protected]>
media: i2c: ov8856: free control handler on error in ov8856_init_controls()

Ricardo Ribalda <[email protected]>
media: uvcvideo: Enable VB2_DMABUF for metadata stream

Paul E. McKenney <[email protected]>
exit: Sleep at TASK_IDLE when waiting for application core dump

Zhiguo Niu <[email protected]>
f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic

Zhiguo Niu <[email protected]>
f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi

Huacai Chen <[email protected]>
LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup

Wentao Guan <[email protected]>
LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()

David Woodhouse <[email protected]>
KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value

Yongpeng Yang <[email protected]>
f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()

Yongpeng Yang <[email protected]>
f2fs: fix fiemap boundary handling when read extent cache is incomplete

Cen Zhang <[email protected]>
f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()

Gang Yan <[email protected]>
mptcp: fix scheduling with atomic in timestamp sockopt

Gang Yan <[email protected]>
mptcp: sockopt: set timestamp flags on subflow socket, not msk

Shardul Bankar <[email protected]>
mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure

Shardul Bankar <[email protected]>
mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure

Jason Gunthorpe <[email protected]>
RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

Michael Bommarito <[email protected]>
RDMA/rxe: Reject unknown opcodes before ICRC processing

Jason Gunthorpe <[email protected]>
RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()

Jason Gunthorpe <[email protected]>
RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()

André Draszik <[email protected]>
power: supply: max17042: avoid overflow when determining health

Lukas Wunner <[email protected]>
PCI/AER: Stop ruling out unbound devices as error source

Shuai Xue <[email protected]>
PCI/AER: Clear only error bits in PCIe Device Status

Zisen Ye <[email protected]>
smb/client: fix out-of-bounds read in symlink_data()

Vasily Gorbik <[email protected]>
s390/debug: Reject zero-length input in debug_input_flush_fn()

Jason Gunthorpe <[email protected]>
RDMA/hns: Fix unlocked call to hns_roce_qp_remove()

Ilya Maximets <[email protected]>
openvswitch: vport: fix self-deadlock on release of tunnel ports

Chaitanya Kulkarni <[email protected]>
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free

Fedor Pchelkin <[email protected]>
nvme-apple: drop invalid put of admin queue reference count

Junrui Luo <[email protected]>
md/raid10: fix divide-by-zero in setup_geo() with zero far_copies

Raphael Zimmer <[email protected]>
libceph: Fix slab-out-of-bounds access in auth message processing

Michael Bommarito <[email protected]>
isofs: validate block number from NFS file handle in isofs_export_iget

Michael Bommarito <[email protected]>
isofs: validate Rock Ridge CE continuation extent against volume size

Eric Biggers <[email protected]>
dm-verity-fec: correctly reject too-small hash devices

Eric Biggers <[email protected]>
dm-verity-fec: correctly reject too-small FEC devices

Mikulas Patocka <[email protected]>
dm: fix a buffer overflow in ioctl processing

Mikulas Patocka <[email protected]>
dm: don't report warning when doing deferred remove

Mikulas Patocka <[email protected]>
dm-thin: fix metadata refcount underflow

Guangshuo Li <[email protected]>
btrfs: fix double free in create_space_info() error path

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm: remove child devices when apm is removed

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop

Cássio Gabriel <[email protected]>
ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error

Joseph Salisbury <[email protected]>
ASoC: fsl_easrc: fix comment typo

Tommaso Soncin <[email protected]>

    ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table

Shrikanth Hegde <[email protected]>
cpuidle: powerpc: avoid double clear when breaking snooze

Conor Dooley <[email protected]>
clk: microchip: mpfs-ccc: fix out of bounds access during output registration

Johan Hovold <[email protected]>
spi: topcliff-pch: fix use-after-free on unbind

Thorsten Blum <[email protected]>
thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp

Thorsten Blum <[email protected]>
thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata

Michael Bommarito <[email protected]>
udf: reject descriptors with oversized CRC length

Mingming Cao <[email protected]>
ibmveth: Disable GSO for packets with small MSS

Hamza Mahfooz <[email protected]>
hv_sock: fix ARM64 support

Xu Yang <[email protected]>
extcon: ptn5150: handle pending IRQ events during system resume

Shyam Prasad N <[email protected]>
cifs: change_conf needs to be called for session setup

Shyam Prasad N <[email protected]>
cifs: abort open_cached_dir if we don't request leases

Myeonghun Pak <[email protected]>
hwmon: (corsair-psu) Close HID device on probe errors

Sanman Pradhan <[email protected]>
hwmon: (ltc2992) Fix u32 overflow in power read path

Sanman Pradhan <[email protected]>
hwmon: (ltc2992) Clamp threshold writes to hardware range

Hongling Zeng <[email protected]>
parisc: Fix IRQ leak in LASI driver

Nan Li <[email protected]>
net/rds: handle zerocopy send cleanup before the message is queued

Maoyi Xie <[email protected]>

    ip6_gre: Use cached t->net in ip6erspan_changelink().

SeungJu Cheon <[email protected]>
sound: ua101: fix division by zero at probe

Kai Zen <[email protected]>
net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo

Miklos Szeredi <[email protected]>
fanotify: fix false positive on permission events

Johan Hovold <[email protected]>
staging: vme_user: fix root device leak on init failure

Johan Hovold <[email protected]>
spi: zynqmp-gqspi: fix controller deregistration

Siwei Zhang <[email protected]>
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()

Siwei Zhang <[email protected]>
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()

Michael Bommarito <[email protected]>
Bluetooth: virtio_bt: validate rx pkt_type header length

Michael Bommarito <[email protected]>
Bluetooth: virtio_bt: clamp rx length before skb_put

Yilin Zhu <[email protected]>
ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()

Ruijie Li <[email protected]>
xfrm: provide message size for XFRM_MSG_MAPPING

Sourabh Jain <[email protected]>

    powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o

Cássio Gabriel <[email protected]>
ALSA: firewire-tascam: Do not drop unread control events

Felix Gu <[email protected]>
usb: ulpi: fix memory leak on ulpi_register() error paths

Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion LE910Cx compositions

Aaro Koskinen <[email protected]>
USB: omap_udc: DMA: Don't enable burst 4 mode

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Fix UAC3 cluster descriptor size check

Takashi Iwai <[email protected]>
ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()

Greg Kroah-Hartman <[email protected]>
usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl

Greg Kroah-Hartman <[email protected]>
usb: usblp: fix heap leak in IEEE 1284 device ID via short response

Tristan Madani <[email protected]>
wifi: b43: enforce bounds check on firmware key index in b43_rx()

Jiri Slaby (SUSE) <[email protected]>
wifi: ath5k: do not access array OOB

Jeongjun Park <[email protected]>
wifi: rsi: fix kthread lifetime race between self-exit and external-stop

Tristan Madani <[email protected]>
wifi: b43legacy: enforce bounds check on firmware key index in RX path

Leon Yen <[email protected]>
wifi: mt76: mt7921: fix a potential clc buffer length underflow

Jann Horn <[email protected]>
exit: prevent preemption of oopsing TASK_DEAD task

Zilin Guan <[email protected]>
ice: Fix memory leak in ice_set_ringparam()

Cen Zhang <[email protected]>
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Remove remaining dependencies of hci_request

Jamal Hadi Salim <[email protected]>
net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked

Qingfang Deng <[email protected]>
flow_dissector: do not dissect PPPoE PFC frames

Dong Chenchen <[email protected]>
net: Fix icmp host relookup triggering ip_rt_bug

Sean Christopherson <[email protected]>
KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

Tejas Bharambe <[email protected]>
ext4: validate p_idx bounds in ext4_ext_correct_indexes

Felix Gu <[email protected]>
spi: meson-spicc: Fix double-put in remove path

Yussuf Khalil <[email protected]>
drm/amd/display: Do not skip unrelated mode changes in DSC validation

Johan Hovold <[email protected]>
spi: rockchip: fix controller deregistration

Mark Brown <[email protected]>
ASoC: SOF: Don't allow pointer operations on unconfigured streams

Shivam Kalra <[email protected]>
ACPI: video: force native backlight on HP OMEN 16 (8A44)

Jinjie Ruan <[email protected]>
ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug

Guangshuo Li <[email protected]>
ACPI: scan: Use acpi_dev_put() in object add error paths

Rajat Gupta <[email protected]>
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free

Corey Minyard <[email protected]>
ipmi:si: Return state to normal if message allocation fails

Corey Minyard <[email protected]>
ipmi: Check event message buffer response for bad data

Corey Minyard <[email protected]>
ipmi: Add limits to event and receive message requests

Greg Kroah-Hartman <[email protected]>
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

Kai Ma <[email protected]>
netfilter: reject zero shift in nft_bitwise

Andrea Mayer <[email protected]>
net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

Deepanshu Kartikey <[email protected]>
ALSA: caiaq: fix usb_dev refcount leak on probe failure

Arjan van de Ven <[email protected]>
drm/amdgpu: fix zero-size GDS range init on RDNA4

Greg Kroah-Hartman <[email protected]>
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

Takashi Iwai <[email protected]>
ALSA: caiaq: Don't abort when no input device is available

Takashi Iwai <[email protected]>
ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path

Douglas Anderson <[email protected]>
driver core: Add kernel-doc for DEV_FLAG_COUNT enum value

Yucheng Lu <[email protected]>
crypto: authencesn - reject short ahash digests during instance creation

Andrea Mayer <[email protected]>
seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode

Yang Xiuwei <[email protected]>
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails

Keenan Dong <[email protected]>
rtmutex: Use waiter::task instead of current in remove_waiter()

Tobias Gaertner <[email protected]>
ntfs3: fix integer overflow in run_unpack() volume boundary check

Tobias Gaertner <[email protected]>
ntfs3: add buffer boundary checks to run_unpack()

Steven Rostedt <[email protected]>
ktest: Fix the month in the name of the failure directory

Chen Zhao <[email protected]>
IB/core: Fix zero dmac race in neighbor resolution

Junrui Luo <[email protected]>
dm mirror: fix integer overflow in create_dirty_log()

Thorsten Blum <[email protected]>
crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path

Thorsten Blum <[email protected]>
crypto: atmel-tdes - fix DMA sync direction

Haoxiang Li <[email protected]>
crypto: ccree - fix a memory leak in cc_mac_digest()

Thomas Fourier <[email protected]>
crypto: hisilicon - Fix dma_unmap_single() direction

Thorsten Blum <[email protected]>
crypto: atmel-ecc - Release client on allocation failure

Thorsten Blum <[email protected]>
crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup

Eric Biggers <[email protected]>
crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit

Johan Hovold <[email protected]>
can: ucan: fix devres lifetime

Shuvam Pandey <[email protected]>
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

Yiyang Chen <[email protected]>
taskstats: set version in TGID exit notifications

Zhenzhong Wu <[email protected]>
tcp: call sk_data_ready() after listener migration

Chia-Ming Chang <[email protected]>
inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails

Junrui Luo <[email protected]>
md/raid5: validate payload size before accessing journal metadata

Chia-Ming Chang <[email protected]>
md/raid5: fix soft lockup in retry_aligned_read()

Sohei Koyama <[email protected]>
ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()

Jens Axboe <[email protected]>
io_uring/poll: fix multishot recv missing EOF on wakeup race

James Kim <[email protected]>
mtd: docg3: fix use-after-free in docg3_release()

Uwe Kleine-König <[email protected]>
mtd: docg3: Convert to platform remove callback returning void

Yosry Ahmed <[email protected]>
KVM: nSVM: Add missing consistency check for nCR3 validity

Yosry Ahmed <[email protected]>
KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS

Yosry Ahmed <[email protected]>

    KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT

Yosry Ahmed <[email protected]>
KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)

Yosry Ahmed <[email protected]>
KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN

Yosry Ahmed <[email protected]>

    KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT

Yosry Ahmed <[email protected]>
KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode

Sean Christopherson <[email protected]>
KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts

Kevin Cheng <[email protected]>
KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0

Yosry Ahmed <[email protected]>
KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2

Yosry Ahmed <[email protected]>
KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2

Yosry Ahmed <[email protected]>
KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state

Denis M. Karpov <[email protected]>
userfaultfd: allow registration of ranges below mmap_min_addr

Johan Hovold <[email protected]>
rtc: ntxec: fix OF node reference imbalance

Jacqueline Wong <[email protected]>
tpm: tpm_tis: add error logging for data transfer

Shawn Lin <[email protected]>
mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration

Bin Liu <[email protected]>
mmc: block: use single block write in retry

Ryan Roberts <[email protected]>
randomize_kstack: Maintain kstack_offset per task

Krzysztof Kozlowski <[email protected]>
power: supply: axp288_charger: Do not cancel work before initializing it

Huacai Chen <[email protected]>
LoongArch: Show CPU vulnerabilites correctly

Arnd Bergmann <[email protected]>
tpm: avoid -Wunused-but-set-variable

Nathan Chancellor <[email protected]>
extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'

Raphael Zimmer <[email protected]>
libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()

Ruide Cao <[email protected]>
ipv4: icmp: validate reply type before using icmp_pointers

hkbinbin <[email protected]>
RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

Luca Ceresoli <[email protected]>
drm/arcpgu: fix device node leak

Marek Vasut <[email protected]>
net: ks8851: Avoid excess softirq scheduling

Marek Vasut <[email protected]>
net: ks8851: Reinstate disabling of BHs around IRQ handler

Ruijie Li <[email protected]>
net/smc: avoid early lgr access in smc_clc_wait_msg

Ao Zhou <[email protected]>
net: rds: fix MR cleanup on copy error

Yiyang Chen <[email protected]>
tools/accounting: handle truncated taskstats netlink messages

Jonathan Santos <[email protected]>
iio: adc: ad7768-1: fix one-shot mode data acquisition

Cássio Gabriel <[email protected]>
ALSA: 6fire: Fix input volume change detection

Takashi Iwai <[email protected]>
ALSA: caiaq: Handle probe errors properly

Cássio Gabriel <[email protected]>
ALSA: caiaq: Fix control_put() result and cache rollback

Takashi Iwai <[email protected]>
ALSA: core: Fix potential data race at fasync handling

Jens Axboe <[email protected]>
io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE

Longxuan Yu <[email protected]>
io_uring/poll: fix signed comparison in io_poll_get_ownership()

David Lechner <[email protected]>
iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()

Pavel Begunkov <[email protected]>
io_uring/timeout: check unused sqe fields

Dawei Feng <[email protected]>
rbd: fix null-ptr-deref when device_add_disk() fails

Simon Liebold <[email protected]>
selftests/mqueue: Fix incorrectly named file

Helge Deller <[email protected]>
parisc: _llseek syscall is only available for 32-bit userspace

Robert Beckett <[email protected]>
nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set

Robert Beckett <[email protected]>
nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4

Josh Hunt <[email protected]>
md/raid10: fix deadlock with check operation and nowait requests

Gao Xiang <[email protected]>
erofs: fix the out-of-bounds nameoff handling for trailing dirents

Cássio Gabriel <[email protected]>
ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes

Harin Lee <[email protected]>
ALSA: ctxfi: Add fallback to default RSR for S/PDIF

Cássio Gabriel <[email protected]>
ALSA: aoa: i2sbus: fix OF node lifetime handling

Vasiliy Kovalev <[email protected]>
ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()

Manivannan Sadhasivam <[email protected]>
net: qrtr: ns: Fix use-after-free in driver remove()

Chen Ni <[email protected]>
media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe()

Josh Law <[email protected]>
lib/ts_kmp: fix integer overflow in pattern length calculation

Rong Zhang <[email protected]>
Revert "ALSA: usb: Increase volume range that triggers a warning"

Koichiro Den <[email protected]>
PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown

Luxiao Xu <[email protected]>
net: strparser: fix skb_head leak in strp_abort_strp()

Zhengchuan Liang <[email protected]>
net: caif: clear client service pointer on teardown

Ziqing Chen <[email protected]>
ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()

Ming Qian <[email protected]>
media: amphion: Fix race between m2m job_abort and device_run

Herbert Xu <[email protected]>
crypto: pcrypt - Fix handling of MAY_BACKLOG requests

Chao Yu <[email protected]>
f2fs: fix to detect potential corrupted nid in free_nid_list

Michael Bommarito <[email protected]>
um: drivers: call kernel_strrchr() explicitly in cow_user.c

Fedor Pchelkin <[email protected]>
wifi: rtw88: check for PCI upstream bridge existence

Douglas Anderson <[email protected]>
driver core: Don't let a device probe until it's ready

Heming Zhao <[email protected]>
ocfs2: split transactions in dio completion to avoid credit exhaustion

Douglas Anderson <[email protected]>
device property: Make modifications of fwnode "flags" thread safe

Douglas Anderson <[email protected]>
regset: use kvzalloc() for regset_get_alloc()

Youngmin Nam <[email protected]>
arm64: set __exception_irq_entry with __irq_entry as a default

Ming Lei <[email protected]>

    blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none

Jianpeng Chang <[email protected]>
net: enetc: fix the deadlock of enetc_mdio_lock

Jesse.Zhang <[email protected]>
drm/amdgpu: Limit BO list entry count to prevent resource exhaustion

Tvrtko Ursulin <[email protected]>
drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array

Herbert Xu <[email protected]>
padata: Remove comment for reorder_work

Herbert Xu <[email protected]>
padata: Fix pd UAF once and for all

Thomas Zimmermann <[email protected]>
firmware: google: framebuffer: Do not mark framebuffer as busy

Tyllis Xu <[email protected]>
ibmasm: fix heap over-read in ibmasm_send_i2o_message()

Tyllis Xu <[email protected]>
ibmasm: fix OOB reads in command_file_write due to missing size checks

Tyllis Xu <[email protected]>
misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()

Greg Kroah-Hartman <[email protected]>
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check

Takashi Iwai <[email protected]>
ALSA: usb-audio: Evaluate packsize caps at the right place

Michal Pecio <[email protected]>
usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Avoid false E-MU sample-rate notifications

Cássio Gabriel <[email protected]>
ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES

Anderson Nascimento <[email protected]>
rxrpc: Fix missing validation of ticket length in non-XDR key preparsing

Sean Christopherson <[email protected]>
crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed

Sean Christopherson <[email protected]>
crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed

Sean Christopherson <[email protected]>
crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed

Berk Cem Goksel <[email protected]>
ALSA: caiaq: take a reference on the USB device in create_card()

Cryolitia PukNgae <[email protected]>
ALSA: usb-audio: apply quirk for MOONDROP JU Jiu

George Saad <[email protected]>
f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()

Tristan Madani <[email protected]>
ksmbd: use check_add_overflow() to prevent u16 DACL size overflow

Tristan Madani <[email protected]>
ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment

Michael Bommarito <[email protected]>
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

Michael Bommarito <[email protected]>
smb: client: require a full NFS mode SID before reading mode bits

DaeMyung Kang <[email protected]>
smb: server: fix max_connections off-by-one in tcp accept path

Michael Bommarito <[email protected]>
smb: server: fix active_num_conn leak on transport allocation failure

Darrick J. Wong <[email protected]>
fuse: quiet down complaints in fuse_conn_limit_write

Samuel Page <[email protected]>
fuse: reject oversized dirents in page cache

Greg Kroah-Hartman <[email protected]>

    fs/ntfs3: validate rec->used in journal-replay file record check

Wang Jie <[email protected]>
rxrpc: only handle RESPONSE during service challenge

David Howells <[email protected]>
rxrpc: Fix anonymous key handling

Mark Rutland <[email protected]>
arm64: mm: fix VA-range sanity check

Nathan Chancellor <[email protected]>
scripts/dtc: Remove unused dts_version in dtc-lexer.l

Johannes Berg <[email protected]>

    wifi: iwlwifi: read txq->read_ptr under lock

Ye Bin <[email protected]>
f2fs: fix null-ptr-deref in f2fs_submit_page_bio()

Takashi Iwai <[email protected]>
ALSA: control: Avoid WARN() for symlink errors

André Draszik <[email protected]>
scsi: ufs: core: Fix use-after free in init error and remove paths

David Howells <[email protected]>
rxrpc: Fix recvmsg() unconditional requeue

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm: move component registration to unmanaged version

Dawei Li <[email protected]>
soc: qcom: apr: make remove callback of apr driver void returned

Koichiro Den <[email protected]>
PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup

Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer.py: define scripts

Ming Lei <[email protected]>
ublk: fix deadlock when reading partition table

David Woodhouse <[email protected]>
KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs

Yuqi Xu <[email protected]>
rxrpc: reject undecryptable rxkad response tickets

Guocai He <[email protected]>

    Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave"

David Howells <[email protected]>
rxrpc: Fix call removal to use RCU safe deletion

David Howells <[email protected]>
rxrpc: Fix key quota calculation for multitoken keys

Joseph Qi <[email protected]>
ocfs2: fix out-of-bounds write in ocfs2_write_end_inline

Deepanshu Kartikey <[email protected]>
ocfs2: validate inline data i_size during inode read

Dmitry Antipov <[email protected]>
ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()

Sebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V

Sebastian Krzyszkowiak <[email protected]>
Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"

Sebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage to 0.81V

Sebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq-librem5: Set the DVS voltages lower

Vladimir Oltean <[email protected]>
net: dsa: clean up FDB, MDB, VLAN entries on unbind

Felix Fietkau <[email protected]>
wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure

Andrew Price <[email protected]>
gfs2: Validate i_depth for exhash directories

Andrew Price <[email protected]>
gfs2: Improve gfs2_consist_inode() usage

Minhong He <[email protected]>
ipv6: add NULL checks for idev in SRv6 paths

Sasha Levin <[email protected]>
Revert "net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()"

Sasha Levin <[email protected]>
Revert "net: ethernet: xscale: Check for PTP support properly"

Koichiro Den <[email protected]>
PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown

Jeongjun Park <[email protected]>
media: hackrf: fix to not free memory after the device is registered in hackrf_probe()

Abd-Alrhman Masalkhi <[email protected]>
media: vidtv: fix pass-by-value structs causing MSAN warnings

Deepanshu Kartikey <[email protected]>
nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map

Jeongjun Park <[email protected]>
media: as102: fix to not free memory after the device is registered in as102_usb_probe()

Mingzhe Zou <[email protected]>
bcache: fix cached_dev.sb_bio use-after-free and crash

Berk Cem Goksel <[email protected]>
ALSA: 6fire: fix use-after-free on disconnect

Abhishek Kumar <[email protected]>

    media: em28xx: fix use-after-free in em28xx_v4l2_open()

Ruslan Valiyev <[email protected]>
media: vidtv: fix nfeeds state corruption on start_streaming failure

Breno Leitao <[email protected]>
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()

Ritesh Harjani (IBM) <[email protected]>
mm/kasan: fix double free for kasan pXds

Sean Christopherson <[email protected]>
KVM: x86: Use scratch field in MMIO fragment to hold small write values

Sasha Levin <[email protected]>
checkpatch: add support for Assisted-by tag

Pengpeng Hou <[email protected]>
rxrpc: proc: size address buffers for %pISpc output

Pablo Neira Ayuso <[email protected]>
nf_tables: nft_dynset: fix possible stateful expression memleak in error path

Christian König <[email protected]>
drm/amdgpu: remove two invalid BUG_ON()s

Wang Liang <[email protected]>
bonding: check xdp prog when set bond mode

Hangbin Liu <[email protected]>
bonding: return detailed error when loading native XDP fails

Eric Dumazet <[email protected]>
net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()

Eric Dumazet <[email protected]>
net: add proper RCU protection to /proc/net/ptype

Jeongjun Park <[email protected]>
ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free

Sasha Levin <[email protected]>
Revert "dmaengine: idxd: Fix not releasing workqueue on .release()"

Sean Christopherson <[email protected]>
KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION

ZhengYuan Huang <[email protected]>
ocfs2: handle invalid dinode in ocfs2_group_extend

Tejas Bharambe <[email protected]>
ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY

Joseph Qi <[email protected]>
ocfs2: fix possible deadlock between unlink and dio_end_io_write

Ruslan Valiyev <[email protected]>
media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections

Zhihao Cheng <[email protected]>
dcache: Limit the minimal number of bucket to two

Harin Lee <[email protected]>
ALSA: ctxfi: Limit PTP to a single page

SeongJae Park <[email protected]>
Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race

Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FN990A MBIM composition

Junrui Luo <[email protected]>
staging: sm750fb: fix division by zero in ps_to_hz()

Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer.py: avoid FD leak

Greg Kroah-Hartman <[email protected]>
fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

Xu Yang <[email protected]>
usb: port: add delay after usb_hub_set_port_power()

Dave Carey <[email protected]>
USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen

Daniel Brát <[email protected]>
usb: storage: Expand range of matched versions for VL817 quirks entry

Nathan Rebello <[email protected]>
usbip: validate number_of_packets in usbip_pack_ret_submit()

Greg Kroah-Hartman <[email protected]>
ksmbd: require 3 sub-authorities before reading sub_auth[2]

Greg Kroah-Hartman <[email protected]>
ksmbd: validate EaNameLength in smb2_get_ea()

Greg Kroah-Hartman <[email protected]>
usb: gadget: renesas_usb3: validate endpoint index in standard request handlers

Greg Kroah-Hartman <[email protected]>

    usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()

Greg Kroah-Hartman <[email protected]>
usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()

Greg Kroah-Hartman <[email protected]>
fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

Greg Kroah-Hartman <[email protected]>
ALSA: fireworks: bound device-supplied status before string array lookup

Greg Kroah-Hartman <[email protected]>
drm/vc4: platform_get_irq_byname() returns an int

Greg Kroah-Hartman <[email protected]>
NFC: digital: Bounds check NFC-A cascade depth in SDD response handler

Greg Kroah-Hartman <[email protected]>

    net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()

Greg Kroah-Hartman <[email protected]>
HID: core: clamp report_size in s32ton() to avoid undefined shift

Greg Kroah-Hartman <[email protected]>
HID: alps: fix NULL pointer dereference in alps_raw_event()

Lin YuChen <[email protected]>
staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()

Greg Kroah-Hartman <[email protected]>
i2c: s3c24xx: check the size of the SMBUS message before using it

Samuel Page <[email protected]>

    can: raw: fix ro->uniq use-after-free in raw_rcv()

Junxi Qian <[email protected]>
nfc: llcp: add missing return after LLCP_CLOSED checks

Jouni Högander <[email protected]>
drm/i915/psr: Do not use pipe_src as borders for SU area

Geoffrey D. Bennett <[email protected]>
ALSA: usb-audio: Improve Focusrite sample rate filtering

Florian Westphal <[email protected]>
netfilter: conntrack: add missing netlink policy validations

Maarten Lankhorst <[email protected]>
Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"

Zide Chen <[email protected]>
perf/x86/intel/uncore: Skip discovery table for offline dies

Samasth Norway Ananda <[email protected]>
gpio: tegra: fix irq_release_resources calling enable instead of disable

Alice Mikityanska <[email protected]>
l2tp: Drop large packets with UDP encap

Jiexun Wang <[email protected]>
af_unix: read UNIX_DIAG_VFS data under unix_state_lock

Zhengchuan Liang <[email protected]>
netfilter: ip6t_eui64: reject invalid MAC header for all packets

Ren Wei <[email protected]>
netfilter: xt_multiport: validate range encoding in checkentry

Xiang Mei <[email protected]>
netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator

Daniel Golle <[email protected]>
selftests: net: bridge_vlan_mcast: wait for h1 before querier check

Greg Kroah-Hartman <[email protected]>
xfrm_user: fix info leak in build_mapping()

Steffen Klassert <[email protected]>
xfrm: Wait for RCU readers during policy netns exit

Maciej Fijalkowski <[email protected]>
xsk: tighten UMEM headroom validation to account for tailroom and min frame

Agalakov Daniil <[email protected]>
e1000: check return value of e1000_read_eeprom

Michal Schmidt <[email protected]>
ixgbevf: add missing negotiate_features op to Hyper-V ops table

Pengpeng Hou <[email protected]>
tracing/probe: reject non-closed empty immediate strings

Jon Hunter <[email protected]>
dt-bindings: net: Fix Tegra234 MGBE PTP clock

Pengpeng Hou <[email protected]>
nfc: s3fwrn5: allocate rx skb before consuming bytes

Yiqi Sun <[email protected]>
ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

Eric Dumazet <[email protected]>
net: lapbether: handle NETDEV_PRE_TYPE_CHANGE

Ruide Cao <[email protected]>
net: sched: act_csum: validate nested VLAN headers

Nicholas Carlini <[email protected]>
eventpoll: defer struct eventpoll free to RCU grace period

Paolo Abeni <[email protected]>
epoll: use refcount to reduce ep_mutex contention

Maíra Canal <[email protected]>
drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock

Maíra Canal <[email protected]>
drm/vc4: Fix a memory leak in hang state error path

Maíra Canal <[email protected]>
drm/vc4: Fix memory leak of BO array in hang state

Maíra Canal <[email protected]>
drm/vc4: Release runtime PM reference after binding V3D

Long Li <[email protected]>
PCI: hv: Set default NUMA node to 0 for devices without affinity info

Sebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency

Potin Lai <[email protected]>
soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching

Tomasz Merta <[email protected]>
ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J

Pengpeng Hou <[email protected]>
wifi: brcmfmac: validate bsscfg indices in IF events

Arthur Husband <[email protected]>
ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585

Benoît Sevens <[email protected]>
HID: roccat: fix use-after-free in roccat_report_event

songxiebing <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10

leo vriska <[email protected]>
HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3

Andy Shevchenko <[email protected]>
pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer)

Gilson Marquato Júnior <[email protected]>

    ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx

Fredric Cover <[email protected]>
fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

Phil Willoughby <[email protected]>
ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex

Kuninori Morimoto <[email protected]>
ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list

Pengpeng Hou <[email protected]>
wifi: wl1251: validate packet IDs before indexing tx_frames

Dustin L. Howett <[email protected]>
ALSA: hda/realtek: add quirk for Framework F111:000F

Florian Westphal <[email protected]>
netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

César Montoya <[email protected]>

    ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx

Goldwyn Rodrigues <[email protected]>
btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()

Wenyuan Li <[email protected]>
can: mcp251x: add error handling for power enable in open and resume

Cássio Gabriel <[email protected]>
ASoC: SOF: topology: reject invalid vendor array size in token parser

Zhang Heng <[email protected]>
ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF

Arnd Bergmann <[email protected]>
ALSA: asihpi: avoid write overflow check warning

Arnd Bergmann <[email protected]>
media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl()

Andrii Kovalchuk <[email protected]>

    ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk

Vee Satayamas <[email protected]>
ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA

-------------

Diffstat:

 Documentation/admin-guide/mm/damon/reclaim.rst     |   4 +
 .../bindings/net/nvidia,tegra234-mgbe.yaml         |   4 +-
 Documentation/mm/hugetlbfs_reserv.rst              |   2 +-
 Documentation/networking/bonding.rst               |  15 +
 Makefile                                           |   4 +-
 arch/arm/boot/dts/mt7623.dtsi                      |   2 +-
 arch/arm/mach-omap1/clock_data.c                   |   4 +-
 arch/arm/mach-versatile/integrator_cp.c            |  13 +-
 arch/arm/net/bpf_jit_32.c                          |   6 +
 .../boot/dts/amlogic/meson-gxl-s905d-p230.dts      |   3 +-
 .../arm64/boot/dts/freescale/imx8mm-tqma8mqml.dtsi |   2 +-
 .../arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi |   2 +-
 .../arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi |   2 +-
 arch/arm64/boot/dts/freescale/imx8mp-evk.dts       |   2 +-
 .../boot/dts/freescale/imx8mp-icore-mx8mp.dtsi     |   2 +-
 arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi  |   2 +-
 arch/arm64/boot/dts/freescale/imx8mq.dtsi          |   2 +-
 arch/arm64/boot/dts/mediatek/mt6795.dtsi           |   2 +-
 arch/arm64/boot/dts/mediatek/mt7986a.dtsi          |   2 +-
 .../boot/dts/qcom/sdm845-xiaomi-beryllium.dts      |   1 +
 arch/arm64/boot/dts/qcom/sm8250.dtsi               |   5 +
 arch/arm64/boot/dts/qcom/sm8450.dtsi               |   5 +-
 arch/arm64/crypto/aes-modes.S                      |   4 +-
 arch/arm64/include/asm/exception.h                 |   5 -
 arch/arm64/include/asm/xor.h                       |   2 +-
 arch/arm64/kernel/machine_kexec.c                  |   3 -
 arch/arm64/kvm/vgic/vgic-its.c                     |   4 +
 arch/arm64/kvm/vgic/vgic-mmio-v2.c                 |   2 +-
 arch/arm64/kvm/vgic/vgic-mmio-v3.c                 |   2 +-
 arch/arm64/mm/mmu.c                                |   4 +-
 arch/arm64/net/bpf_jit_comp.c                      |   4 +-
 arch/loongarch/kernel/cpu-probe.c                  |   7 +
 arch/loongarch/mm/init.c                           |   4 -
 arch/loongarch/pci/acpi.c                          |   5 +
 arch/loongarch/pci/pci.c                           |   3 +
 arch/parisc/kernel/syscalls/syscall.tbl            |   2 +-
 arch/powerpc/kernel/time.c                         |   6 +-
 arch/powerpc/kexec/Makefile                        |   2 +-
 arch/powerpc/kexec/file_load_64.c                  |   2 +-
 arch/powerpc/platforms/44x/warp.c                  |   2 +
 arch/s390/kernel/debug.c                           |   8 +
 arch/s390/kvm/interrupt.c                          |   3 +-
 arch/s390/kvm/pci.c                                |   6 +-
 arch/um/drivers/cow_user.c                         |   8 +-
 arch/x86/events/intel/uncore_discovery.c           |   2 +-
 arch/x86/include/asm/segment.h                     |   8 +-
 arch/x86/include/uapi/asm/kvm.h                    |  12 +-
 arch/x86/kvm/mmu/mmu.c                             |  36 +-
 arch/x86/kvm/mmu/spte.h                            |   5 +
 arch/x86/kvm/svm/nested.c                          |  38 +-
 arch/x86/kvm/svm/sev.c                             |  11 +-
 arch/x86/kvm/svm/svm.c                             |  13 +
 arch/x86/kvm/svm/svm.h                             |   1 +
 arch/x86/kvm/trace.h                               |   2 +-
 arch/x86/kvm/x86.c                                 |  14 +-
 block/blk-cgroup.c                                 |  15 +
 block/blk-mq.c                                     |  10 +-
 certs/extract-cert.c                               |   6 +-
 crypto/af_alg.c                                    |   2 +
 crypto/authencesn.c                                |   5 +
 crypto/pcrypt.c                                    |   7 +-
 drivers/acpi/arm64/agdi.c                          |   2 +-
 drivers/acpi/cppc_acpi.c                           |   6 +-
 drivers/acpi/power.c                               |   2 +-
 drivers/acpi/scan.c                                |   2 +-
 drivers/acpi/video_detect.c                        |   8 +
 drivers/ata/ahci.c                                 |  14 +
 drivers/base/core.c                                |  39 +-
 drivers/base/dd.c                                  |  20 +
 drivers/base/devres.c                              |   2 +
 drivers/block/drbd/drbd_nl.c                       |   8 +-
 drivers/block/rbd.c                                |   6 +-
 drivers/block/ublk_drv.c                           |  28 +-
 drivers/bluetooth/btintel.c                        |  11 +-
 drivers/bluetooth/hci_ldisc.c                      |  51 +-
 drivers/bluetooth/virtio_bt.c                      |  39 +-
 drivers/bus/imx-weim.c                             |   2 +-
 drivers/cdrom/cdrom.c                              |  73 +-
 drivers/char/ipmi/ipmi_si_intf.c                   |  70 +-
 drivers/char/ipmi/ipmi_ssif.c                      |  23 +-
 drivers/char/tpm/tpm_tis_core.c                    |   4 +
 drivers/clk/clk-qoriq.c                            |  17 +-
 drivers/clk/clk-xgene.c                            |   2 +
 drivers/clk/imx/clk-imx6q.c                        |  12 +-
 drivers/clk/imx/clk-imx8mq.c                       |   4 +-
 drivers/clk/microchip/clk-mpfs-ccc.c               |   6 +-
 drivers/clk/qcom/dispcc-sc7180.c                   |   8 +
 drivers/clk/qcom/dispcc-sm8250.c                   |   6 +-
 drivers/clk/qcom/dispcc-sm8450.c                   |   2 +-
 drivers/clk/qcom/gcc-sc8180x.c                     |  64 +-
 drivers/clk/visconti/pll.c                         |   2 +-
 drivers/cpuidle/cpuidle-powernv.c                  |   5 +-
 drivers/cpuidle/cpuidle-pseries.c                  |   5 +-
 drivers/crypto/atmel-aes.c                         |   2 +-
 drivers/crypto/atmel-ecc.c                         |   1 +
 drivers/crypto/atmel-sha204a.c                     |   6 +-
 drivers/crypto/atmel-tdes.c                        |   8 +-
 drivers/crypto/ccp/ccp-crypto-aes.c                |   7 +-
 drivers/crypto/ccp/sev-dev.c                       |  19 +-
 drivers/crypto/ccree/cc_hash.c                     |   1 +
 drivers/crypto/hisilicon/sec/sec_algs.c            |   2 +-
 drivers/crypto/sa2ul.c                             |   4 +-
 drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c     |   2 -
 drivers/dma/idxd/sysfs.c                           |   1 -
 drivers/dma/mxs-dma.c                              |   1 +
 drivers/extcon/extcon-ptn5150.c                    |  14 +
 drivers/firmware/arm_ffa/bus.c                     |   4 +-
 drivers/firmware/arm_ffa/driver.c                  |   2 +-
 drivers/firmware/efi/capsule-loader.c              |   2 +-
 drivers/firmware/google/framebuffer-coreboot.c     |   2 +-
 drivers/firmware/imx/scu-pd.c                      |   1 +
 drivers/gpio/gpio-tegra.c                          |   2 +-
 drivers/gpio/gpiolib-cdev.c                        |  21 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c        |  43 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c     |   2 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c           |  13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h           |  11 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |   3 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c            |   3 +
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c             |   2 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c             |   2 -
 drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c              |  66 ++
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |   3 -
 drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c              |  16 +-
 drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c              |   3 +-
 drivers/gpu/drm/amd/amdgpu/vce_v2_0.c              |   2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c              |  25 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c              |  23 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |  26 +-
 drivers/gpu/drm/amd/amdkfd/kfd_priv.h              |   3 +
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |   5 +
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h  |   1 +
 .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c    |   7 +-
 drivers/gpu/drm/amd/display/dc/bios/bios_parser.c  |  62 ++
 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c |   9 +
 .../drm/amd/display/dc/bios/bios_parser_helper.c   |   9 +-
 drivers/gpu/drm/amd/display/dc/core/dc.c           |   6 +-
 .../gpu/drm/amd/display/dc/dce/dce_link_encoder.c  |   4 +-
 .../amd/display/include/grph_object_ctrl_defs.h    |   4 +
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c     |  15 +
 .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c    | 118 +++-
 .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.h    |   1 +
 drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h       |   1 +
 .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c    |  28 +-
 .../drm/arm/display/komeda/komeda_framebuffer.c    |   6 +-
 drivers/gpu/drm/bridge/chipone-icn6211.c           |   4 +-
 drivers/gpu/drm/bridge/ite-it66121.c               |   5 +
 .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c   |  16 +-
 drivers/gpu/drm/drm_file.c                         |   5 +-
 drivers/gpu/drm/drm_gem_framebuffer_helper.c       |   4 +-
 drivers/gpu/drm/drm_mode_config.c                  |   9 +-
 drivers/gpu/drm/gma500/oaktrail_hdmi.c             |   1 +
 drivers/gpu/drm/gma500/oaktrail_lvds.c             |   9 +-
 drivers/gpu/drm/i915/display/intel_dp.c            |   9 +-
 drivers/gpu/drm/i915/display/intel_psr.c           |  18 +-
 drivers/gpu/drm/i915/display/skl_watermark.c       |  43 +-
 drivers/gpu/drm/i915/display/skl_watermark.h       |   2 +-
 drivers/gpu/drm/i915/gt/intel_reset.c              |   3 +-
 drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c        |   2 +-
 drivers/gpu/drm/msm/adreno/a6xx_hfi.c              |  14 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c            |   2 -
 drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c  |  24 +-
 drivers/gpu/drm/msm/dsi/dsi_cfg.c                  |   4 +-
 drivers/gpu/drm/msm/dsi/dsi_cfg.h                  |   2 +-
 drivers/gpu/drm/msm/dsi/dsi_host.c                 |   1 +
 drivers/gpu/drm/msm/msm_gem_shrinker.c             |   5 +-
 drivers/gpu/drm/msm/msm_iommu.c                    |   5 +-
 drivers/gpu/drm/nouveau/nouveau_gem.c              |   2 +-
 drivers/gpu/drm/panel/panel-simple.c               |   2 +-
 drivers/gpu/drm/panfrost/panfrost_drv.c            |   2 +
 drivers/gpu/drm/radeon/ci_dpm.c                    |   9 +-
 drivers/gpu/drm/sun4i/sun4i_backend.c              |   6 +-
 drivers/gpu/drm/tiny/arcpgu.c                      |   3 +-
 drivers/gpu/drm/vc4/vc4_bo.c                       |   3 +
 drivers/gpu/drm/vc4/vc4_gem.c                      |  19 +-
 drivers/gpu/drm/vc4/vc4_hdmi.c                     |  14 +-
 drivers/gpu/drm/vc4/vc4_v3d.c                      |   1 +
 drivers/gpu/drm/virtio/virtgpu_drv.h               |   1 +
 drivers/gpu/drm/virtio/virtgpu_gem.c               |  17 +
 drivers/gpu/drm/virtio/virtgpu_plane.c             |  10 +-
 drivers/hid/hid-alps.c                             |   3 +
 drivers/hid/hid-asus.c                             |  28 +-
 drivers/hid/hid-core.c                             |   3 +
 drivers/hid/hid-ids.h                              |   3 +
 drivers/hid/hid-quirks.c                           |   3 +-
 drivers/hid/hid-roccat.c                           |   2 +
 drivers/hid/hid-uclogic-core.c                     |   4 +-
 drivers/hid/usbhid/hid-core.c                      |   2 +-
 drivers/hwmon/corsair-psu.c                        |   4 +-
 drivers/hwmon/ltc2992.c                            |  41 +-
 drivers/hwmon/pmbus/adm1266.c                      |  32 +-
 drivers/i2c/busses/i2c-s3c2410.c                   |   7 +-
 drivers/i2c/i2c-core-of.c                          |   2 +-
 drivers/i3c/master/mipi-i3c-hci/dma.c              |  30 +-
 drivers/iio/adc/ad7768-1.c                         |   9 +-
 drivers/iio/adc/ti-ads7950.c                       |  11 +-
 drivers/infiniband/core/addr.c                     |   3 +
 drivers/infiniband/core/iwpm_msg.c                 |   6 +-
 drivers/infiniband/hw/hns/hns_roce_qp.c            |   7 +
 drivers/infiniband/hw/mlx4/srq.c                   |   4 +-
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c        |   4 +-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c    |   2 +-
 drivers/infiniband/sw/rxe/rxe_recv.c               |  14 +-
 drivers/infiniband/sw/siw/siw_qp_rx.c              |  15 +
 drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c       |   2 +-
 drivers/iommu/intel/iommu.c                        |   3 +
 drivers/irqchip/irq-ath79-cpu.c                    |   7 -
 drivers/irqchip/irq-pic32-evic.c                   |   2 +-
 drivers/leds/blink/leds-lgm-sso.c                  |   2 -
 drivers/mailbox/mailbox-test.c                     |  39 +-
 drivers/mailbox/mailbox.c                          |   3 +-
 drivers/md/bcache/super.c                          |   8 +
 drivers/md/dm-cache-metadata.c                     |  24 +-
 drivers/md/dm-cache-metadata.h                     |   5 -
 drivers/md/dm-cache-policy-smq.c                   |   4 +
 drivers/md/dm-cache-target.c                       | 143 +++-
 drivers/md/dm-init.c                               |   4 +-
 drivers/md/dm-ioctl.c                              |   6 +-
 drivers/md/dm-log.c                                |   6 +-
 drivers/md/dm-raid1.c                              |   6 +-
 drivers/md/dm-verity-fec.c                         |   8 +-
 drivers/md/persistent-data/dm-btree-remove.c       |   8 +
 drivers/md/raid10.c                                |   6 +-
 drivers/md/raid5-cache.c                           |  48 +-
 drivers/md/raid5.c                                 |   8 +-
 drivers/media/dvb-frontends/dib8000.c              |   4 +-
 drivers/media/i2c/imx219.c                         |   3 +
 drivers/media/i2c/imx412.c                         |   2 +-
 drivers/media/i2c/ov08d10.c                        |  10 +-
 drivers/media/i2c/ov8856.c                         |  10 +-
 drivers/media/pci/saa7164/saa7164-core.c           |  47 +-
 drivers/media/pci/zoran/zoran_card.c               |   2 +-
 drivers/media/platform/amphion/vpu_v4l2.c          |   9 +-
 drivers/media/platform/ti/omap3isp/ispvideo.c      |   1 +
 drivers/media/rc/streamzap.c                       |  12 +-
 drivers/media/rc/xbox_remote.c                     |   9 +-
 drivers/media/test-drivers/vidtv/vidtv_bridge.c    |   4 +-
 drivers/media/test-drivers/vidtv/vidtv_channel.c   |   4 +
 drivers/media/test-drivers/vidtv/vidtv_mux.c       |   4 +-
 drivers/media/test-drivers/vidtv/vidtv_ts.c        |  48 +-
 drivers/media/test-drivers/vidtv/vidtv_ts.h        |   4 +-
 drivers/media/usb/as102/as102_usb_drv.c            |   2 +
 drivers/media/usb/em28xx/em28xx-video.c            |  14 +-
 drivers/media/usb/hackrf/hackrf.c                  |   7 +-
 drivers/media/usb/uvc/uvc_queue.c                  |   3 +-
 drivers/memory/tegra/tegra124-emc.c                |   2 +-
 drivers/memory/tegra/tegra30-emc.c                 |   6 +-
 drivers/mfd/mc13xxx-core.c                         |   2 +-
 drivers/misc/ibmasm/ibmasmfs.c                     |   7 +
 drivers/misc/ibmasm/lowlevel.c                     |  12 +-
 drivers/misc/ibmasm/remote.c                       |   5 +
 drivers/mmc/core/block.c                           |  12 +-
 drivers/mmc/core/queue.h                           |   3 +
 drivers/mmc/host/sdhci-of-dwcmshc.c                |  19 +-
 drivers/mtd/devices/docg3.c                        |   8 +-
 drivers/mtd/maps/physmap-gemini.c                  |   2 +-
 drivers/mtd/nand/raw/sunxi_nand.c                  |   6 +-
 drivers/mtd/parsers/ofpart_core.c                  |   4 +-
 drivers/mtd/spi-nor/core.c                         |   2 +-
 drivers/mtd/spi-nor/core.h                         |  10 +-
 drivers/mtd/spi-nor/micron-st.c                    |   4 +-
 drivers/mtd/spi-nor/sfdp.c                         |  47 +-
 drivers/mtd/spi-nor/spansion.c                     | 106 ++-
 drivers/mtd/spi-nor/sst.c                          |  50 +-
 drivers/mtd/spi-nor/swp.c                          |   4 +-
 drivers/net/bareudp.c                              |  24 +-
 drivers/net/bonding/bond_3ad.c                     | 123 ++--
 drivers/net/bonding/bond_main.c                    |  90 ++-
 drivers/net/bonding/bond_netlink.c                 |  37 +-
 drivers/net/bonding/bond_options.c                 |  74 +++
 drivers/net/bonding/bond_procfs.c                  |   3 +-
 drivers/net/bonding/bond_sysfs_slave.c             |  17 +-
 drivers/net/can/spi/mcp251x.c                      |  29 +-
 drivers/net/can/usb/ucan.c                         |   2 +-
 drivers/net/dsa/mt7530.c                           |  85 +--
 drivers/net/dsa/mt7530.h                           |  70 +-
 drivers/net/dsa/realtek/rtl8365mb.c                |   2 +-
 .../net/ethernet/aquantia/atlantic/aq_pci_func.c   |   2 +-
 drivers/net/ethernet/atheros/ag71xx.c              |   3 +
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     | 733 +++++++++------------
 drivers/net/ethernet/broadcom/genet/bcmgenet.h     |  68 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c |   4 +-
 drivers/net/ethernet/broadcom/genet/bcmmii.c       |   6 +-
 drivers/net/ethernet/cirrus/cs89x0.c               |   2 -
 drivers/net/ethernet/cortina/gemini.c              |  21 +-
 drivers/net/ethernet/freescale/Makefile            |   3 +-
 drivers/net/ethernet/freescale/dpaa2/Kconfig       |   4 +
 drivers/net/ethernet/freescale/enetc/enetc.c       |  25 +-
 drivers/net/ethernet/ibm/ibmveth.c                 |  22 +
 drivers/net/ethernet/ibm/ibmveth.h                 |   1 +
 drivers/net/ethernet/intel/e1000/e1000_ethtool.c   |   8 +-
 drivers/net/ethernet/intel/e1000e/netdev.c         |   1 +
 drivers/net/ethernet/intel/i40e/i40e.h             |   1 +
 drivers/net/ethernet/intel/i40e/i40e_main.c        |   2 +-
 drivers/net/ethernet/intel/i40e/i40e_ptp.c         |   3 +-
 drivers/net/ethernet/intel/iavf/iavf.h             |   9 +-
 drivers/net/ethernet/intel/iavf/iavf_main.c        |  52 +-
 drivers/net/ethernet/intel/iavf/iavf_virtchnl.c    |  76 +--
 drivers/net/ethernet/intel/ice/ice_dcb_lib.c       |   4 +-
 drivers/net/ethernet/intel/ice/ice_ethtool.c       |  11 +-
 drivers/net/ethernet/intel/ice/ice_main.c          |   2 +-
 drivers/net/ethernet/intel/ice/ice_sriov.c         |   2 -
 drivers/net/ethernet/intel/ice/ice_vf_lib.c        |  26 +-
 drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c  |   1 +
 drivers/net/ethernet/intel/ixgbevf/vf.c            |   7 +
 drivers/net/ethernet/micrel/ks8851.h               |   6 +-
 drivers/net/ethernet/micrel/ks8851_common.c        |  69 +-
 drivers/net/ethernet/micrel/ks8851_par.c           |  15 +-
 drivers/net/ethernet/micrel/ks8851_spi.c           |  11 +-
 .../net/ethernet/microchip/lan966x/lan966x_main.c  |   8 +-
 drivers/net/ethernet/microsoft/mana/hw_channel.c   |  35 +-
 .../ethernet/netronome/nfp/nfpcore/nfp_target.c    |  17 +-
 drivers/net/ethernet/qlogic/qed/qed_cxt.c          |   2 +
 drivers/net/ethernet/xscale/ixp4xx_eth.c           |  60 +-
 drivers/net/ethernet/xscale/ptp_ixp46x.c           |   3 -
 drivers/net/hamradio/6pack.c                       |  39 +-
 drivers/net/ifb.c                                  |  11 +-
 drivers/net/macvlan.c                              |   8 +-
 drivers/net/mctp/mctp-i2c.c                        |   4 +-
 drivers/net/netconsole.c                           |  26 +-
 drivers/net/netdevsim/dev.c                        |   2 +-
 drivers/net/phy/dp83869.c                          |  13 +-
 drivers/net/phy/mdio_bus.c                         |   4 +-
 drivers/net/ppp/ppp_generic.c                      |   5 +-
 drivers/net/ppp/pppoe.c                            |   8 +-
 drivers/net/slip/slhc.c                            |  49 +-
 drivers/net/usb/cdc-phonet.c                       |   7 +-
 drivers/net/usb/r8152.c                            |   2 +-
 drivers/net/usb/rtl8150.c                          |  12 +-
 drivers/net/vrf.c                                  |  15 +-
 drivers/net/wan/lapbether.c                        |  13 +-
 drivers/net/wireless/ath/ath11k/ahb.c              |  44 +-
 drivers/net/wireless/ath/ath11k/ce.h               |  16 +
 drivers/net/wireless/ath/ath11k/core.c             |  91 +++
 drivers/net/wireless/ath/ath11k/core.h             |  12 +
 drivers/net/wireless/ath/ath11k/dp_rx.c            |   3 +-
 drivers/net/wireless/ath/ath11k/hal.c              |  31 +-
 drivers/net/wireless/ath/ath11k/hal.h              |   5 +
 drivers/net/wireless/ath/ath11k/hal_rx.c           |  13 +-
 drivers/net/wireless/ath/ath11k/hal_rx.h           |  18 +-
 drivers/net/wireless/ath/ath11k/hw.c               | 398 ++++++++++-
 drivers/net/wireless/ath/ath11k/hw.h               |  14 +-
 drivers/net/wireless/ath/ath11k/mac.c              |   7 +
 drivers/net/wireless/ath/ath11k/pci.c              |   2 +
 drivers/net/wireless/ath/ath11k/wmi.c              |  19 +-
 drivers/net/wireless/ath/ath5k/base.c              |   3 +-
 drivers/net/wireless/ath/ath9k/channel.c           |   6 +-
 drivers/net/wireless/broadcom/b43/xmit.c           |   3 +-
 drivers/net/wireless/broadcom/b43legacy/xmit.c     |   3 +-
 .../wireless/broadcom/brcm80211/brcmfmac/chip.c    |  15 +
 .../wireless/broadcom/brcm80211/brcmfmac/fweh.c    |   5 +
 drivers/net/wireless/intel/iwlwifi/queue/tx.c      |   3 +-
 drivers/net/wireless/mac80211_hwsim.c              |   1 -
 drivers/net/wireless/marvell/mwifiex/11n_aggr.c    |   1 +
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c    |   3 +
 drivers/net/wireless/realtek/rtlwifi/pci.c         |   1 +
 drivers/net/wireless/realtek/rtw88/pci.c           |   3 +-
 drivers/net/wireless/realtek/rtw89/phy.c           |   2 +-
 drivers/net/wireless/rsi/rsi_common.h              |   5 +-
 drivers/net/wireless/ti/wl1251/tx.c                |   8 +-
 drivers/net/wwan/iosm/iosm_ipc_imem.c              |   2 +
 drivers/nfc/s3fwrn5/uart.c                         |  10 +-
 drivers/nfc/trf7970a.c                             |   3 +-
 drivers/nvme/host/apple.c                          |   6 +-
 drivers/nvme/host/core.c                           |   2 +-
 drivers/nvme/host/pci.c                            |   3 +
 drivers/nvme/target/core.c                         |   2 +-
 drivers/nvme/target/tcp.c                          |  51 +-
 drivers/of/base.c                                  |   2 +-
 drivers/of/dynamic.c                               |   2 +-
 drivers/of/platform.c                              |   2 +-
 drivers/parisc/lasi.c                              |  12 +-
 drivers/pci/controller/dwc/pcie-tegra194.c         | 151 ++---
 drivers/pci/controller/pci-hyperv.c                |   8 +
 drivers/pci/controller/pcie-mediatek-gen3.c        |   8 +-
 drivers/pci/endpoint/functions/pci-epf-ntb.c       |  56 +-
 drivers/pci/endpoint/functions/pci-epf-vntb.c      |  19 +-
 drivers/pci/pci.c                                  |  48 +-
 drivers/pci/pci.h                                  |   6 +
 drivers/pci/pcie/aer.c                             |   2 -
 drivers/pcmcia/rsrc_nonstatic.c                    |   6 +-
 drivers/phy/marvell/phy-mvebu-a3700-utmi.c         |   5 +-
 drivers/pinctrl/intel/pinctrl-intel.c              |   2 +-
 drivers/pinctrl/nomadik/pinctrl-abx500.c           |   2 +-
 drivers/pinctrl/pinctrl-cy8c95x0.c                 |  27 +-
 drivers/pinctrl/pinctrl-pic32.c                    |  20 +-
 drivers/pinctrl/qcom/pinctrl-sm8150.c              |   8 +-
 drivers/platform/surface/surfacepro3_button.c      |   1 +
 drivers/platform/x86/adv_swbutton.c                |   6 +-
 .../x86/dell/dell-wmi-sysman/enum-attributes.c     |  34 +-
 drivers/platform/x86/dell/dell_rbu.c               |   6 +-
 drivers/platform/x86/hp/hp-wmi.c                   |   5 +
 drivers/platform/x86/hp/hp_accel.c                 |   3 +
 drivers/platform/x86/intel/hid.c                   |   6 +-
 drivers/platform/x86/intel/vbtn.c                  |   6 +-
 drivers/platform/x86/panasonic-laptop.c            |   5 +-
 drivers/power/supply/axp288_charger.c              |  19 +-
 drivers/power/supply/max17042_battery.c            |   2 +-
 drivers/pwm/pwm-imx-tpm.c                          |   8 +
 drivers/regulator/act8945a-regulator.c             |   3 +-
 drivers/regulator/bd9571mwv-regulator.c            |   3 +-
 drivers/regulator/max77650-regulator.c             |   2 +-
 drivers/rtc/rtc-abx80x.c                           |   2 +
 drivers/rtc/rtc-ntxec.c                            |   2 +-
 drivers/s390/cio/css.c                             |   2 +-
 drivers/scsi/isci/host.c                           |   3 +
 drivers/scsi/sd.c                                  |   1 +
 drivers/scsi/sg.c                                  |  29 +-
 drivers/scsi/sr.c                                  |  11 +-
 drivers/scsi/sr.h                                  |   1 -
 drivers/soc/aspeed/aspeed-socinfo.c                |   2 +-
 drivers/soc/qcom/llcc-qcom.c                       |   2 +-
 drivers/soc/qcom/ocmem.c                           |  22 +-
 drivers/soc/qcom/qcom_aoss.c                       |   2 +-
 drivers/soc/tegra/cbb/tegra234-cbb.c               |   4 +
 drivers/soc/ti/omap_prm.c                          |   1 +
 drivers/soundwire/bus.c                            |   8 +-
 drivers/spi/spi-fsl-qspi.c                         |   3 +-
 drivers/spi/spi-hisi-kunpeng.c                     |  12 +-
 drivers/spi/spi-imx.c                              |   1 +
 drivers/spi/spi-meson-spicc.c                      |   2 -
 drivers/spi/spi-mpc52xx.c                          |   3 +-
 drivers/spi/spi-mtk-nor.c                          |   4 +-
 drivers/spi/spi-mtk-snfi.c                         |  16 +-
 drivers/spi/spi-orion.c                            |   6 +
 drivers/spi/spi-rockchip.c                         |  66 +-
 drivers/spi/spi-sprd.c                             |   3 +-
 drivers/spi/spi-ti-qspi.c                          |   1 +
 drivers/spi/spi-topcliff-pch.c                     |   6 +-
 drivers/spi/spi-zynqmp-gqspi.c                     |   4 +-
 drivers/spi/spi.c                                  |   2 +-
 drivers/staging/media/atomisp/pci/atomisp_ioctl.c  |   4 +
 drivers/staging/media/rkvdec/rkvdec-vp9.c          |   3 +-
 drivers/staging/rtl8723bs/core/rtw_security.c      |   2 +-
 drivers/staging/sm750fb/sm750.c                    |   3 +
 drivers/staging/vme_user/vme_fake.c                |   2 +
 drivers/target/target_core_configfs.c              |   2 +-
 drivers/target/target_core_sbc.c                   |   3 +-
 drivers/thermal/spear_thermal.c                    |   2 +-
 drivers/thermal/sprd_thermal.c                     |   4 +-
 drivers/tty/hvc/hvc_iucv.c                         |   2 +-
 drivers/ufs/core/ufshcd.c                          |  31 +-
 drivers/ufs/host/ufshcd-pci.c                      |   2 -
 drivers/ufs/host/ufshcd-pltfrm.c                   |  25 +-
 drivers/usb/class/cdc-acm.c                        |  53 +-
 drivers/usb/class/usblp.c                          |   3 +-
 drivers/usb/common/ulpi.c                          |   5 +-
 drivers/usb/core/port.c                            |   1 +
 drivers/usb/gadget/function/f_ncm.c                |   4 +-
 drivers/usb/gadget/function/f_phonet.c             |   9 +
 drivers/usb/gadget/udc/omap_udc.c                  |   4 -
 drivers/usb/gadget/udc/renesas_usb3.c              |   7 +-
 drivers/usb/host/xhci.c                            |   1 -
 drivers/usb/serial/option.c                        |   6 +
 drivers/usb/storage/unusual_devs.h                 |   7 +-
 drivers/usb/usbip/usbip_common.c                   |  12 +
 drivers/vhost/net.c                                |   4 +-
 drivers/video/backlight/sky81452-backlight.c       |   3 +
 drivers/video/fbdev/matrox/g450_pll.c              |   2 +-
 drivers/video/fbdev/offb.c                         |   7 +-
 drivers/video/fbdev/tdfxfb.c                       |   3 +
 drivers/video/fbdev/udlfb.c                        |  34 +-
 fs/adfs/super.c                                    |   3 +
 fs/binfmt_elf.c                                    |   2 +-
 fs/btrfs/inode.c                                   |   2 +-
 fs/btrfs/space-info.c                              |   2 +-
 fs/ceph/xattr.c                                    |   1 +
 fs/dcache.c                                        |   4 +-
 fs/debugfs/file.c                                  |   5 +-
 fs/erofs/dir.c                                     |  28 +-
 fs/eventpoll.c                                     | 201 ++++--
 fs/ext2/inode.c                                    |  14 +-
 fs/ext4/extents.c                                  |  15 +
 fs/ext4/xattr.c                                    |   4 +-
 fs/f2fs/compress.c                                 |  90 +--
 fs/f2fs/data.c                                     |  28 +-
 fs/f2fs/f2fs.h                                     |   2 +
 fs/f2fs/inode.c                                    |   2 +-
 fs/f2fs/node.c                                     |  17 +-
 fs/f2fs/super.c                                    |   8 +-
 fs/f2fs/sysfs.c                                    |  52 +-
 fs/fuse/control.c                                  |   4 +-
 fs/fuse/readdir.c                                  |   4 +
 fs/gfs2/dir.c                                      |  37 +-
 fs/gfs2/glops.c                                    |  40 +-
 fs/gfs2/inode.c                                    |   3 +-
 fs/gfs2/log.c                                      |  33 +-
 fs/gfs2/xattr.c                                    |  28 +-
 fs/isofs/export.c                                  |   2 +-
 fs/isofs/rock.c                                    |   9 +
 fs/nfs/blocklayout/blocklayout.c                   |   4 +-
 fs/nilfs2/dat.c                                    |   3 +
 fs/nilfs2/ioctl.c                                  |   6 +
 fs/notify/fsnotify.c                               |   2 +-
 fs/notify/inotify/inotify_user.c                   |   1 +
 fs/notify/mark.c                                   |  18 +-
 fs/ntfs3/fslog.c                                   |  12 +-
 fs/ntfs3/run.c                                     |  18 +-
 fs/ntfs3/super.c                                   |   7 +-
 fs/ocfs2/aops.c                                    |  75 ++-
 fs/ocfs2/dlm/dlmdomain.c                           |  10 +-
 fs/ocfs2/inode.c                                   |  31 +
 fs/ocfs2/ioctl.c                                   |  18 +-
 fs/ocfs2/mmap.c                                    |   7 +-
 fs/ocfs2/ocfs2_trace.h                             |  10 +-
 fs/ocfs2/resize.c                                  |  22 +-
 fs/ocfs2/xattr.c                                   |   4 +-
 fs/omfs/inode.c                                    |   6 +
 fs/pstore/ram_core.c                               |   4 +
 fs/quota/dquot.c                                   |  38 +-
 fs/smb/client/cached_dir.c                         |   8 +
 fs/smb/client/cifs_spnego.c                        |  16 +
 fs/smb/client/cifsacl.c                            |   1 +
 fs/smb/client/cifsfs.c                             |   2 +
 fs/smb/client/fs_context.c                         |   4 +
 fs/smb/client/smb2file.c                           |  27 +-
 fs/smb/client/smb2misc.c                           |   3 +-
 fs/smb/client/smb2ops.c                            |  17 +
 fs/smb/client/smb2pdu.h                            |   2 +-
 fs/smb/server/auth.c                               |  11 +-
 fs/smb/server/mgmt/user_session.c                  |  12 +-
 fs/smb/server/smb2pdu.c                            |   7 +
 fs/smb/server/smbacl.c                             |  19 +-
 fs/smb/server/transport_tcp.c                      |   4 +-
 fs/sysfs/group.c                                   |   2 +-
 fs/udf/misc.c                                      |   8 +-
 fs/userfaultfd.c                                   |   2 -
 include/dt-bindings/clock/qcom,dispcc-sc7180.h     |   7 +-
 include/dt-bindings/clock/qcom,gcc-sc8180x.h       |   5 +
 include/linux/cdrom.h                              |   1 +
 include/linux/container_of.h                       |  23 +-
 include/linux/cpuhotplug.h                         |   1 -
 include/linux/dev_printk.h                         |  10 +
 include/linux/device.h                             |  48 +-
 include/linux/dmi.h                                |   5 +
 include/linux/f2fs_fs.h                            |   1 +
 include/linux/fsnotify_backend.h                   |   1 +
 include/linux/fwnode.h                             |  45 +-
 include/linux/kvm_host.h                           |   3 +-
 include/linux/module.h                             |   2 +
 include/linux/moduleparam.h                        |  11 +-
 include/linux/netfilter/x_tables.h                 |   3 +-
 include/linux/netfilter_arp/arp_tables.h           |   1 -
 include/linux/netfilter_ipv4/ip_tables.h           |   1 -
 include/linux/netfilter_ipv6/ip6_tables.h          |   1 -
 include/linux/padata.h                             |  12 +-
 include/linux/ppp_defs.h                           |  16 +
 include/linux/printk.h                             |   5 +-
 include/linux/quotaops.h                           |   9 +-
 include/linux/randomize_kstack.h                   |  26 +-
 include/linux/sched.h                              |   4 +
 include/linux/soc/qcom/apr.h                       |   2 +-
 include/linux/spinlock_up.h                        |  20 +-
 include/linux/string.h                             |  12 +
 include/linux/tcp.h                                |  10 +-
 include/linux/tpm_eventlog.h                       |   9 +-
 include/linux/usb.h                                |   3 +-
 include/net/bluetooth/hci_sync.h                   |  17 +
 include/net/bond_3ad.h                             |   3 +-
 include/net/bond_options.h                         |   2 +
 include/net/bonding.h                              |   4 +
 include/net/ipv6.h                                 |   6 -
 include/net/mac80211.h                             |   4 +
 include/net/netfilter/nf_queue.h                   |   1 +
 include/net/netfilter/nf_tables.h                  |   2 +
 include/net/pie.h                                  |   2 +-
 include/net/pkt_cls.h                              |   2 +
 include/net/route.h                                |   6 -
 include/net/tcp.h                                  |   2 +-
 include/net/udp_tunnel.h                           |  15 +
 include/trace/events/btrfs.h                       |   9 +-
 include/trace/events/rxrpc.h                       |   4 +
 include/trace/events/timer.h                       |  11 +-
 include/uapi/linux/bpf.h                           |   2 +
 include/uapi/linux/if_link.h                       |   3 +
 include/uapi/linux/kvm.h                           |  11 +-
 include/ufs/ufshcd.h                               |   1 -
 include/video/udlfb.h                              |   1 +
 init/main.c                                        |   1 -
 io_uring/io-wq.c                                   |   3 +-
 io_uring/io_uring.c                                |   2 +
 io_uring/poll.c                                    |  14 +-
 io_uring/timeout.c                                 |   4 +
 kernel/audit.c                                     |   4 +
 kernel/auditsc.c                                   |   2 +-
 kernel/bpf/bpf_lsm.c                               |   1 -
 kernel/bpf/devmap.c                                |   8 +-
 kernel/bpf/helpers.c                               |  17 +-
 kernel/bpf/local_storage.c                         |   2 +-
 kernel/cgroup/rdma.c                               |   2 +-
 kernel/exit.c                                      |   3 +-
 kernel/fork.c                                      |  13 +-
 kernel/futex/requeue.c                             |  13 +-
 kernel/irq_work.c                                  |   7 +
 kernel/locking/rtmutex.c                           |  13 +-
 kernel/module/main.c                               |   4 +-
 kernel/padata.c                                    | 266 +++-----
 kernel/params.c                                    |  46 +-
 kernel/regset.c                                    |   6 +-
 kernel/taskstats.c                                 |   1 +
 kernel/time/hrtimer.c                              |  56 +-
 kernel/trace/ring_buffer.c                         |   8 +-
 kernel/trace/trace_branch.c                        |   8 +-
 kernel/trace/trace_events_hist.c                   |  12 +-
 kernel/trace/trace_probe.c                         |   2 +-
 kernel/trace/tracing_map.c                         |  17 +-
 lib/kunit/Kconfig                                  |   5 +-
 lib/ts_kmp.c                                       |  18 +-
 mm/backing-dev.c                                   |   5 +-
 mm/kasan/init.c                                    |   8 +-
 net/batman-adv/bat_iv_ogm.c                        |  85 ++-
 net/batman-adv/bridge_loop_avoidance.c             |  65 +-
 net/batman-adv/distributed-arp-table.c             |   3 +
 net/batman-adv/fragmentation.c                     |  58 +-
 net/batman-adv/gateway_client.c                    |   4 +
 net/batman-adv/originator.c                        |   4 +-
 net/batman-adv/tp_meter.c                          |  32 +-
 net/batman-adv/types.h                             |   6 +-
 net/bluetooth/af_bluetooth.c                       |  10 +
 net/bluetooth/bnep/core.c                          |   2 +-
 net/bluetooth/hci_event.c                          |  21 +-
 net/bluetooth/hci_request.h                        |  21 -
 net/bluetooth/hci_sync.c                           |  14 +-
 net/bluetooth/iso.c                                |  14 +-
 net/bluetooth/l2cap_core.c                         |   8 +-
 net/bluetooth/l2cap_sock.c                         |  60 +-
 net/bluetooth/mgmt.c                               |   6 +
 net/bluetooth/rfcomm/sock.c                        |   9 +-
 net/bluetooth/sco.c                                |   9 +-
 net/bpf/test_run.c                                 |  63 +-
 net/bridge/br_multicast.c                          |  27 +-
 net/bridge/netfilter/Kconfig                       |  13 +
 net/bridge/netfilter/Makefile                      |   2 +-
 net/bridge/netfilter/ebtable_broute.c              |  14 +-
 net/bridge/netfilter/ebtable_filter.c              |  14 +-
 net/bridge/netfilter/ebtable_nat.c                 |  12 +-
 net/bridge/netfilter/ebtables.c                    |  71 +-
 net/caif/cfsrvl.c                                  |  14 +-
 net/can/raw.c                                      |  11 +-
 net/ceph/auth.c                                    |   4 +-
 net/ceph/crush/crush.c                             |   6 +-
 net/ceph/mon_client.c                              |   2 +
 net/ceph/osdmap.c                                  |  14 +-
 net/core/filter.c                                  |   4 +-
 net/core/flow_dissector.c                          |  13 +-
 net/core/neighbour.c                               |  34 +-
 net/core/net-procfs.c                              |  49 +-
 net/core/rtnetlink.c                               |   1 +
 net/dsa/dsa2.c                                     |  38 +-
 net/ethtool/bitset.c                               |   8 +-
 net/ipv4/icmp.c                                    |  15 +-
 net/ipv4/inet_connection_sock.c                    |   5 +-
 net/ipv4/netfilter/Kconfig                         |  59 +-
 net/ipv4/netfilter/Makefile                        |   2 +-
 net/ipv4/netfilter/arp_tables.c                    |  36 +-
 net/ipv4/netfilter/arpt_mangle.c                   |   8 +
 net/ipv4/netfilter/arptable_filter.c               |  27 +-
 net/ipv4/netfilter/ip_tables.c                     |  18 +-
 net/ipv4/netfilter/iptable_filter.c                |  27 +-
 net/ipv4/netfilter/iptable_mangle.c                |  29 +-
 net/ipv4/netfilter/iptable_nat.c                   |   6 +-
 net/ipv4/netfilter/iptable_raw.c                   |  26 +-
 net/ipv4/netfilter/iptable_security.c              |  27 +-
 net/ipv4/nexthop.c                                 |   4 +-
 net/ipv4/raw.c                                     |   2 +-
 net/ipv4/route.c                                   |  48 --
 net/ipv4/tcp.c                                     |  17 +-
 net/ipv4/tcp_input.c                               |   6 +-
 net/ipv4/tcp_minisocks.c                           |   5 +-
 net/ipv4/tcp_output.c                              |  20 +-
 net/ipv4/tcp_recovery.c                            |   2 +-
 net/ipv4/udp_tunnel_core.c                         |  48 ++
 net/ipv6/exthdrs.c                                 |  13 +-
 net/ipv6/icmp.c                                    |  10 +-
 net/ipv6/ip6_gre.c                                 |   5 +-
 net/ipv6/ip6_output.c                              |  68 --
 net/ipv6/ip6_udp_tunnel.c                          |  69 ++
 net/ipv6/netfilter/Kconfig                         |  30 +-
 net/ipv6/netfilter/Makefile                        |   2 +-
 net/ipv6/netfilter/ip6_tables.c                    |  18 +-
 net/ipv6/netfilter/ip6t_eui64.c                    |   3 +-
 net/ipv6/netfilter/ip6t_hbh.c                      |   4 +
 net/ipv6/netfilter/ip6table_filter.c               |  26 +-
 net/ipv6/netfilter/ip6table_mangle.c               |  27 +-
 net/ipv6/netfilter/ip6table_nat.c                  |   6 +-
 net/ipv6/netfilter/ip6table_raw.c                  |  24 +-
 net/ipv6/netfilter/ip6table_security.c             |  27 +-
 net/ipv6/rpl_iptunnel.c                            |   9 +
 net/ipv6/seg6_hmac.c                               |   2 +
 net/ipv6/seg6_iptunnel.c                           |  12 +-
 net/ipv6/xfrm6_protocol.c                          |   4 +-
 net/l2tp/l2tp_core.c                               |   5 +
 net/mac80211/tdls.c                                |   2 +-
 net/mac80211/tx.c                                  |   4 +-
 net/mptcp/sockopt.c                                |  12 +-
 net/mptcp/subflow.c                                |   4 +-
 net/netfilter/Kconfig                              |  22 +-
 net/netfilter/ipset/ip_set_hash_ipmark.c           |   6 +-
 net/netfilter/ipset/ip_set_hash_ipport.c           |   5 +-
 net/netfilter/ipset/ip_set_hash_ipportip.c         |   5 +-
 net/netfilter/ipset/ip_set_hash_ipportnet.c        |   5 +-
 net/netfilter/ipvs/ip_vs_xmit.c                    |  19 +-
 net/netfilter/nf_conntrack_netlink.c               |   2 +-
 net/netfilter/nf_conntrack_proto_sctp.c            |  13 +-
 net/netfilter/nf_conntrack_sip.c                   | 160 +++--
 net/netfilter/nf_nat_amanda.c                      |   2 +-
 net/netfilter/nf_nat_sip.c                         |  34 +-
 net/netfilter/nf_queue.c                           |   4 +-
 net/netfilter/nf_tables_api.c                      |   4 +-
 net/netfilter/nfnetlink_log.c                      |   8 +-
 net/netfilter/nfnetlink_osf.c                      |  45 +-
 net/netfilter/nfnetlink_queue.c                    |   2 +
 net/netfilter/nft_bitwise.c                        |   3 +-
 net/netfilter/nft_ct.c                             |   2 +
 net/netfilter/nft_dynset.c                         |  10 +-
 net/netfilter/nft_fwd_netdev.c                     |  10 +
 net/netfilter/nft_osf.c                            |   6 +-
 net/netfilter/nft_set_pipapo_avx2.c                |  20 +-
 net/netfilter/x_tables.c                           | 116 +++-
 net/netfilter/xt_mac.c                             |  34 +-
 net/netfilter/xt_multiport.c                       |  34 +-
 net/netfilter/xt_owner.c                           |  37 +-
 net/netfilter/xt_physdev.c                         |  29 +-
 net/netfilter/xt_policy.c                          |   2 +-
 net/netfilter/xt_realm.c                           |   2 +-
 net/netfilter/xt_socket.c                          |  23 +-
 net/nfc/digital_technology.c                       |   6 +
 net/nfc/llcp_core.c                                |   2 +
 net/openvswitch/datapath.c                         |  35 +-
 net/openvswitch/vport-netdev.c                     |   6 +-
 net/openvswitch/vport.c                            |   3 +
 net/phonet/pep.c                                   |  19 +-
 net/qrtr/ns.c                                      |  11 +
 net/rds/af_rds.c                                   |  10 +-
 net/rds/connection.c                               |  14 +
 net/rds/ib.c                                       |  24 +-
 net/rds/ib.h                                       |   1 +
 net/rds/ib_rdma.c                                  |   2 +-
 net/rds/message.c                                  |  21 +-
 net/rds/rdma.c                                     |   4 -
 net/rxrpc/call_object.c                            |  22 +-
 net/rxrpc/conn_event.c                             |  17 +-
 net/rxrpc/key.c                                    |   9 +-
 net/rxrpc/proc.c                                   |  26 +-
 net/rxrpc/recvmsg.c                                |  22 +-
 net/rxrpc/rxkad.c                                  |   7 +-
 net/rxrpc/sendmsg.c                                |   2 +-
 net/sched/act_csum.c                               |   6 +-
 net/sched/act_ct.c                                 |   8 +-
 net/sched/em_cmp.c                                 |   5 +-
 net/sched/em_nbyte.c                               |   2 +
 net/sched/em_text.c                                |  11 +-
 net/sched/sch_cake.c                               |  15 +-
 net/sched/sch_choke.c                              |  26 +-
 net/sched/sch_fq_codel.c                           |   3 +-
 net/sched/sch_fq_pie.c                             |  19 +-
 net/sched/sch_hhf.c                                |  19 +-
 net/sched/sch_netem.c                              |  44 +-
 net/sched/sch_pie.c                                |  52 +-
 net/sched/sch_red.c                                |  33 +-
 net/sched/sch_sfb.c                                |  54 +-
 net/sched/sch_taprio.c                             | 176 ++---
 net/sctp/inqueue.c                                 |   1 +
 net/sctp/sm_statefuns.c                            |   6 +
 net/sctp/socket.c                                  |  11 +-
 net/smc/af_smc.c                                   |   3 +-
 net/smc/smc_clc.c                                  |   4 +-
 net/smc/smc_tracepoint.h                           |   2 +-
 net/strparser/strparser.c                          |   8 +
 net/tipc/msg.c                                     |  14 +-
 net/tls/tls.h                                      |   1 +
 net/tls/tls_strp.c                                 |   6 +
 net/tls/tls_sw.c                                   |  30 +-
 net/unix/af_unix.c                                 |   9 +-
 net/unix/diag.c                                    |  21 +-
 net/unix/unix_bpf.c                                |   3 +
 net/vmw_vsock/af_vsock.c                           |   6 +-
 net/vmw_vsock/hyperv_transport.c                   |   4 +-
 net/vmw_vsock/virtio_transport_common.c            |  23 +-
 net/vmw_vsock/vmci_transport.c                     |   2 +-
 net/wireless/core.c                                |   4 +-
 net/wireless/scan.c                                |   3 +
 net/xdp/xdp_umem.c                                 |   3 +-
 net/xfrm/xfrm_policy.c                             |   2 +
 net/xfrm/xfrm_user.c                               |   2 +
 scripts/checkpatch.pl                              |  10 +
 scripts/dtc/dtc-lexer.l                            |   3 -
 scripts/generate_rust_analyzer.py                  |  17 +-
 security/integrity/ima/ima_crypto.c                |   2 +-
 security/keys/keyring.c                            |   1 +
 sound/aoa/soundbus/i2sbus/core.c                   |   9 +-
 sound/core/compress_offload.c                      |   7 -
 sound/core/control.c                               |   4 +
 sound/core/control_led.c                           |  14 +-
 sound/core/misc.c                                  |  44 +-
 sound/core/seq/oss/seq_oss_rw.c                    |   6 +-
 sound/core/sound.c                                 |   7 +
 sound/firewire/fireworks/fireworks_command.c       |   5 +-
 sound/firewire/tascam/tascam-hwdep.c               |   1 +
 sound/isa/sc6000.c                                 | 285 ++++----
 sound/pci/asihpi/hpicmn.c                          |   6 +
 sound/pci/asihpi/hpimsgx.c                         |   6 +-
 sound/pci/ctxfi/ctatc.c                            |   3 +-
 sound/pci/ctxfi/ctvmem.h                           |   2 +-
 sound/pci/hda/patch_conexant.c                     |  34 +-
 sound/pci/hda/patch_realtek.c                      |   8 +-
 sound/soc/amd/yc/acp6x-mach.c                      |  35 +
 sound/soc/codecs/ab8500-codec.c                    |   6 +-
 sound/soc/fsl/fsl_easrc.c                          | 125 +++-
 sound/soc/fsl/fsl_micfil.c                         |  28 +-
 sound/soc/fsl/fsl_xcvr.c                           |  22 +-
 sound/soc/intel/boards/bytcr_wm5102.c              |   1 +
 sound/soc/qcom/qdsp6/q6apm-dai.c                   |   1 +
 sound/soc/qcom/qdsp6/q6apm-lpass-dais.c            |   2 +-
 sound/soc/qcom/qdsp6/q6apm.c                       |  17 +-
 sound/soc/qcom/qdsp6/q6core.c                      |   4 +-
 sound/soc/qcom/qdsp6/topology.c                    |   8 +-
 sound/soc/soc-core.c                               |   1 +
 sound/soc/sof/amd/acp-common.c                     |   1 +
 sound/soc/sof/amd/acp-ipc.c                        |  34 +-
 sound/soc/sof/amd/acp.h                            |   7 +-
 sound/soc/sof/compress.c                           |  11 +-
 sound/soc/sof/intel/hda-ipc.c                      |   8 +-
 sound/soc/sof/intel/hda.h                          |   4 +-
 sound/soc/sof/ipc3-pcm.c                           |   3 +-
 sound/soc/sof/ipc3.c                               |   4 +-
 sound/soc/sof/mediatek/mt8186/mt8186.c             |   2 +-
 sound/soc/sof/mediatek/mt8195/mt8195.c             |   2 +-
 sound/soc/sof/ops.h                                |   8 +-
 sound/soc/sof/pcm.c                                |   2 +
 sound/soc/sof/sof-priv.h                           |  13 +-
 sound/soc/sof/stream-ipc.c                         |  57 +-
 sound/soc/sof/topology.c                           |   2 +-
 sound/soc/sti/uniperif_player.c                    |   9 +-
 sound/soc/stm/stm32_sai_sub.c                      |   3 +
 sound/usb/6fire/chip.c                             |  17 +-
 sound/usb/6fire/control.c                          |  10 +-
 sound/usb/caiaq/control.c                          |  52 +-
 sound/usb/caiaq/device.c                           |  39 +-
 sound/usb/caiaq/input.c                            |   2 +-
 sound/usb/endpoint.c                               |   6 +-
 sound/usb/format.c                                 |  88 ++-
 sound/usb/midi.c                                   |  21 +-
 sound/usb/misc/ua101.c                             |  12 +-
 sound/usb/mixer.c                                  |  14 +-
 sound/usb/mixer_quirks.c                           |  12 +-
 sound/usb/mixer_scarlett2.c                        |   2 +-
 sound/usb/quirks.c                                 |   4 +-
 sound/usb/stream.c                                 |  62 +-
 sound/usb/stream.h                                 |   3 +-
 tools/accounting/getdelays.c                       |  41 +-
 tools/accounting/procacct.c                        |  40 +-
 tools/include/uapi/linux/bpf.h                     |   2 +
 tools/lib/bpf/relo_core.c                          |   2 +
 tools/perf/util/branch.h                           |   3 +
 tools/perf/util/cs-etm-decoder/cs-etm-decoder.c    |  51 +-
 tools/perf/util/expr.c                             |   3 +-
 tools/perf/util/util.h                             |   1 -
 tools/testing/ktest/ktest.pl                       |  37 +-
 tools/testing/selftests/bpf/prog_tests/snprintf.c  |   3 +-
 tools/testing/selftests/cgroup/test_memcontrol.c   |  11 +-
 .../testing/selftests/mqueue/{setting => settings} |   0
 .../selftests/net/forwarding/bridge_vlan_mcast.sh  |   1 +
 tools/testing/selftests/vm/migration.c             |   3 +-
 virt/kvm/dirty_ring.c                              |   3 +-
 867 files changed, 9112 insertions(+), 4400 deletions(-)

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vee Satayamas <[email protected]>

[ Upstream commit f200b2f9a810c440c6750b56fc647b73337749a1 ]

Add a DMI quirk for the Asus Expertbook BM1403CDA to resolve the issue of the internal microphone not being detected.

---
 sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
 1 file changed, 7 insertions(+)

index 991f8777cc859..be510328c5a0c 100644
@@ -563,6 +563,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "PM1503CDA"),
 		}
 	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "BM1403CDA"),
+		}
+	},
 	{}
 };
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrii Kovalchuk <[email protected]>

[ Upstream commit 793b008cd39516385791a1d1d223d817e947a471 ]

Add a PCI quirk for HP ENVY Laptop 13-ba0xxx (PCI device ID 0x8756) to enable proper mute LED and mic mute behavior using the ALC245_FIXUP_HP_X360_MUTE_LEDS fixup.

---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

index 9d6b3a6b8ed26..6048ad6319e3b 100644
@@ -9938,6 +9938,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x8730, "HP ProBook 445 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
 	SND_PCI_QUIRK(0x103c, 0x8735, "HP ProBook 435 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
 	SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+	SND_PCI_QUIRK(0x103c, 0x8756, "HP ENVY Laptop 13-ba0xxx", ALC245_FIXUP_HP_X360_MUTE_LEDS),
 	SND_PCI_QUIRK(0x103c, 0x8760, "HP EliteBook 8{4,5}5 G7", ALC285_FIXUP_HP_BEEP_MICMUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x876e, "HP ENVY x360 Convertible 13-ay0xxx", ALC245_FIXUP_HP_X360_MUTE_LEDS),
 	SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED),

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

[ Upstream commit c03b7dec3c4ddc97872fa12bfca75bae9cb46510 ]

The deeply nested loop in rkvdec_init_v4l2_vp9_count_tbl() needs a lot of registers, so when the clang register allocator runs out, it ends up spilling countless temporaries to the stack:

drivers/media/platform/rockchip/rkvdec/rkvdec-vp9.c:966:12: error: stack frame size (1472) exceeds limit (1280) in 'rkvdec_vp9_start' [-Werror,-Wframe-larger-than]

Marking this function as noinline_for_stack keeps it out of rkvdec_vp9_start(), giving the compiler more room for optimization.

The resulting code is good enough that both the total stack usage and the loop get enough better to stay under the warning limit, though it's still slow, and would need a larger rework if this function ends up being called in a fast path.

---
 drivers/staging/media/rkvdec/rkvdec-vp9.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index cfae99b40ccb4..dc3e6354c7974 100644
@@ -924,7 +924,8 @@ static void rkvdec_vp9_done(struct rkvdec_ctx *ctx,
 	update_ctx_last_info(vp9_ctx);
 }
 
-static void rkvdec_init_v4l2_vp9_count_tbl(struct rkvdec_ctx *ctx)
+static noinline_for_stack void
+rkvdec_init_v4l2_vp9_count_tbl(struct rkvdec_ctx *ctx)
 {
 	struct rkvdec_vp9_ctx *vp9_ctx = ctx->priv;
 	struct rkvdec_vp9_intra_frame_symbol_counts *intra_cnts = vp9_ctx->count_tbl.cpu;

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

[ Upstream commit 591721223be9e28f83489a59289579493b8e3d83 ]

clang-22 rightfully warns that the memcpy() in adapter_prepare() copies between different structures, crossing the boundary of nested structures inside it:

In file included from sound/pci/asihpi/hpimsgx.c:13:
In file included from include/linux/string.h:386:
include/linux/fortify-string.h:569:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
569 | __write_overflow_field(p_size_field, size);

The two structures seem to refer to the same layout, despite the separate definitions, so the code is in fact correct.

Avoid the warning by copying the two inner structures separately. I see the same pattern happens in other functions in the same file, so there is a chance that this may come back in the future, but this instance is the only one that I saw in practice, hitting it multiple times per day in randconfig build.

---
 sound/pci/asihpi/hpimsgx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

index b68e6bfbbfbab..ed1c7b7744361 100644
@@ -581,8 +581,10 @@ static u16 adapter_prepare(u16 adapter)
 		HPI_ADAPTER_OPEN);
 	hm.adapter_index = adapter;
 	hw_entry_point(&hm, &hr);
-	memcpy(&rESP_HPI_ADAPTER_OPEN[adapter], &hr,
-		sizeof(rESP_HPI_ADAPTER_OPEN[0]));
+	memcpy(&rESP_HPI_ADAPTER_OPEN[adapter].h, &hr,
+		sizeof(rESP_HPI_ADAPTER_OPEN[adapter].h));
+	memcpy(&rESP_HPI_ADAPTER_OPEN[adapter].a, &hr.u.ax.info,
+		sizeof(rESP_HPI_ADAPTER_OPEN[adapter].a));
 	if (hr.error)
 		return hr.error;
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhang Heng <[email protected]>

[ Upstream commit 1f182ec9d7084db7dfdb2372d453c28f0e5c3f0a ]

Add a DMI quirk for the Thin A15 B7VF fixing the issue where the internal microphone was not detected.

---
 sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
 1 file changed, 7 insertions(+)

index be510328c5a0c..d650091d3f302 100644
@@ -570,6 +570,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "BM1403CDA"),
 		}
 	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Micro-Star International Co., Ltd."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Thin A15 B7VE"),
+		}
+	},
 	{}
 };
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Cássio Gabriel <[email protected]>

[ Upstream commit 215e5fe75881a7e2425df04aeeed47a903d5cd5d ]

sof_parse_token_sets() accepts array->size values that can be invalid for a vendor tuple array header. In particular, a zero size does not advance the parser state and can lead to non-progress parsing on malformed topology data.

Validate array->size against the minimum header size and reject values smaller than sizeof(*array) before parsing. This preserves behavior for valid topologies and hardens malformed-input handling.

---
 sound/soc/sof/topology.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 374c8b1d69584..d803111e36385 100644
@@ -678,7 +678,7 @@ static int sof_parse_token_sets(struct snd_soc_component *scomp,
 		asize = le32_to_cpu(array->size);
 
 		/* validate asize */
-		if (asize < 0) { /* FIXME: A zero-size array makes no sense */
+		if (asize < sizeof(*array)) {
 			dev_err(scomp->dev, "error: invalid array size 0x%x\n",
 				asize);
 			return -EINVAL;

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wenyuan Li <[email protected]>

[ Upstream commit 7a57354756c7df223abe2c33774235ad70cb4231 ]

Add missing error handling for mcp251x_power_enable() calls in both mcp251x_open() and mcp251x_can_resume() functions.

In mcp251x_open(), if power enable fails, jump to error path to close candev without attempting to disable power again.

In mcp251x_can_resume(), properly check return values of power enable calls for both power and transceiver regulators. If any fails, return the error code to the PM framework and log the failure.

This ensures the driver properly handles power control failures and maintains correct device state.

---
 drivers/net/can/spi/mcp251x.c | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

index 72ae17b2313ec..d3ffab297b77b 100644
@@ -1213,7 +1213,11 @@ static int mcp251x_open(struct net_device *net)
 	}
 
 	mutex_lock(&priv->mcp_lock);
-	mcp251x_power_enable(priv->transceiver, 1);
+	ret = mcp251x_power_enable(priv->transceiver, 1);
+	if (ret) {
+		dev_err(&spi->dev, "failed to enable transceiver power: %pe\n", ERR_PTR(ret));
+		goto out_close_candev;
+	}
 
 	priv->force_quit = 0;
 	priv->tx_skb = NULL;

@@ -1260,6 +1264,7 @@ static int mcp251x_open(struct net_device *net)
 	mcp251x_hw_sleep(spi);
 out_close:
 	mcp251x_power_enable(priv->transceiver, 0);
+out_close_candev:
 	close_candev(net);
 	mutex_unlock(&priv->mcp_lock);
 	if (release_irq)

@@ -1499,11 +1504,25 @@ static int __maybe_unused mcp251x_can_resume(struct device *dev)
 {
 	struct spi_device *spi = to_spi_device(dev);
 	struct mcp251x_priv *priv = spi_get_drvdata(spi);
+	int ret = 0;
 
-	if (priv->after_suspend & AFTER_SUSPEND_POWER)
-		mcp251x_power_enable(priv->power, 1);
-	if (priv->after_suspend & AFTER_SUSPEND_UP)
-		mcp251x_power_enable(priv->transceiver, 1);
+	if (priv->after_suspend & AFTER_SUSPEND_POWER) {
+		ret = mcp251x_power_enable(priv->power, 1);
+		if (ret) {
+			dev_err(dev, "failed to restore power: %pe\n", ERR_PTR(ret));
+			return ret;
+		}
+	}
+
+	if (priv->after_suspend & AFTER_SUSPEND_UP) {
+		ret = mcp251x_power_enable(priv->transceiver, 1);
+		if (ret) {
+			dev_err(dev, "failed to restore transceiver power: %pe\n", ERR_PTR(ret));
+			if (priv->after_suspend & AFTER_SUSPEND_POWER)
+				mcp251x_power_enable(priv->power, 0);
+			return ret;
+		}
+	}
 
 	if (priv->after_suspend & (AFTER_SUSPEND_POWER | AFTER_SUSPEND_UP))
 		queue_work(priv->wq, &priv->restart_work);

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Goldwyn Rodrigues <[email protected]>

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ]

If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash.

Use file_inode(file)->i_sb to always get btrfs_sb.

---
 include/trace/events/btrfs.h | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

index 31847ccae4936..8054ce54807de 100644
@@ -760,12 +760,15 @@ TRACE_EVENT(btrfs_sync_file,
 	),
 
 	TP_fast_assign(
-		const struct dentry *dentry = file->f_path.dentry;
-		const struct inode *inode = d_inode(dentry);
+		struct dentry *dentry = file_dentry(file);
+		struct inode *inode = file_inode(file);
+		struct dentry *parent = dget_parent(dentry);
+		struct inode *parent_inode = d_inode(parent);
 
-		TP_fast_assign_fsid(btrfs_sb(file->f_path.dentry->d_sb));
+		dput(parent);
+		TP_fast_assign_fsid(btrfs_sb(inode->i_sb));
 		__entry->ino		= btrfs_ino(BTRFS_I(inode));
-		__entry->parent		= btrfs_ino(BTRFS_I(d_inode(dentry->d_parent)));
+		__entry->parent		= btrfs_ino(BTRFS_I(parent_inode));
 		__entry->datasync	= datasync;
 		__entry->root_objectid	=
 				 BTRFS_I(inode)->root->root_key.objectid;

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: César Montoya <[email protected]>

[ Upstream commit 2f388b4e8fdd6b0f27cafd281658daacfd85807e ]

The HP Pavilion 15-eg0xxx with subsystem ID 0x103c87cb uses a Realtek ALC287 codec with a mute LED wired to GPIO pin 4 (mask 0x10). The existing ALC287_FIXUP_HP_GPIO_LED fixup already handles this correctly, but the subsystem ID was missing from the quirk table.

GPIO pin confirmed via manual hda-verb testing:
hda-verb SET_GPIO_MASK 0x10
hda-verb SET_GPIO_DIRECTION 0x10
hda-verb SET_GPIO_DATA 0x10

---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

index 6048ad6319e3b..6bffce599c961 100644
@@ -9952,6 +9952,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x8788, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x87b7, "HP Laptop 14-fq0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x87cb, "HP Pavilion 15-eg0xxx", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x87cc, "HP Pavilion 15-eg0xxx", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x87d3, "HP Laptop 15-gw0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x87df, "HP ProBook 430 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Westphal <[email protected]>

[ Upstream commit d3c0037ffe1273fa1961e779ff6906234d6cf53c ]

New test case fails unexpectedly when avx2 matching functions are used.

The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e. nft -f foo.

This works. Then, it reloads the set after a flush:
(echo flush set t s; cat foo) | nft -f -

This is expected to work, because its the same set after all and it was already loaded once.

But with avx2, this fails: nft reports a clashing element.

The reported clash is of following form:

We successfully re-inserted
a . b
c . d

Then we try to insert a . d

avx2 finds the already existing a . d, which (due to 'flush set') is marked as invalid in the new generation. It skips the element and moves to next.

Due to incorrect masking, the skip-step finds the next matching element *only considering the first field*,

i.e. we return the already reinserted "a . b", even though the last field is different and the entry should not have been matched.

No such error is reported for the generic c implementation (no avx2) or when the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.

Bisection points to
7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection") but that fix merely uncovers this bug.

Before this commit, the wrong element is returned, but erronously reported as a full, identical duplicate.

The root-cause is too early return in the avx2 match functions. When we process the last field, we should continue to process data until the entire input size has been consumed to make sure no stale bits remain in the map.

---
 net/netfilter/nft_set_pipapo_avx2.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

index be7c16c79f711..2a761a644d4da 100644
@@ -242,7 +242,7 @@ static int nft_pipapo_avx2_lookup_4b_2(unsigned long *map, unsigned long *fill,
 
 		b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
 		if (last)
-			return b;
+			ret = b;
 
 		if (unlikely(ret == -1))
 			ret = b / XSAVE_YMM_SIZE;

@@ -319,7 +319,7 @@ static int nft_pipapo_avx2_lookup_4b_4(unsigned long *map, unsigned long *fill,
 
 		b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
 		if (last)
-			return b;
+			ret = b;
 
 		if (unlikely(ret == -1))
 			ret = b / XSAVE_YMM_SIZE;

@@ -414,7 +414,7 @@ static int nft_pipapo_avx2_lookup_4b_8(unsigned long *map, unsigned long *fill,
 
 		b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
 		if (last)
-			return b;
+			ret = b;
 
 		if (unlikely(ret == -1))
 			ret = b / XSAVE_YMM_SIZE;

@@ -505,7 +505,7 @@ static int nft_pipapo_avx2_lookup_4b_12(unsigned long *map, unsigned long *fill,
 
 		b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
 		if (last)
-			return b;
+			ret = b;
 
 		if (unlikely(ret == -1))
 			ret = b / XSAVE_YMM_SIZE;

@@ -641,7 +641,7 @@ static int nft_pipapo_avx2_lookup_4b_32(unsigned long *map, unsigned long *fill,
 
 		b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
 		if (last)
-			return b;
+			ret = b;
 
 		if (unlikely(ret == -1))
 			ret = b / XSAVE_YMM_SIZE;

@@ -699,7 +699,7 @@ static int nft_pipapo_avx2_lookup_8b_1(unsigned long *map, unsigned long *fill,
 
 		b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
 		if (last)
-			return b;
+			ret = b;
 
 		if (unlikely(ret == -1))
 			ret = b / XSAVE_YMM_SIZE;

@@ -764,7 +764,7 @@ static int nft_pipapo_avx2_lookup_8b_2(unsigned long *map, unsigned long *fill,
 
 		b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
 		if (last)
-			return b;
+			ret = b;
 
 		if (unlikely(ret == -1))
 			ret = b / XSAVE_YMM_SIZE;

@@ -839,7 +839,7 @@ static int nft_pipapo_avx2_lookup_8b_4(unsigned long *map, unsigned long *fill,
 
 		b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
 		if (last)
-			return b;
+			ret = b;
 
 		if (unlikely(ret == -1))
 			ret = b / XSAVE_YMM_SIZE;

@@ -925,7 +925,7 @@ static int nft_pipapo_avx2_lookup_8b_6(unsigned long *map, unsigned long *fill,
 
 		b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
 		if (last)
-			return b;
+			ret = b;
 
 		if (unlikely(ret == -1))
 			ret = b / XSAVE_YMM_SIZE;

@@ -1019,7 +1019,7 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill,
 
 		b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
 		if (last)
-			return b;
+			ret = b;
 
 		if (unlikely(ret == -1))
 			ret = b / XSAVE_YMM_SIZE;

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dustin L. Howett <[email protected]>

[ Upstream commit bac1e57adf08c9ee33e95fb09cd032f330294e70 ]

Similar to commit 7b509910b3ad ("ALSA hda/realtek: Add quirk for Framework F111:000C") and previous quirks for Framework systems with Realtek codecs.

000F is another new platform with an ALC285 which needs the same quirk.

---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

index 6bffce599c961..82de15e176746 100644
@@ -10474,6 +10474,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0xf111, 0x0009, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0xf111, 0x000b, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0xf111, 0x000c, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0xf111, 0x000f, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE),
 
 #if 0
 	/* Below is a quirk table taken from the old code.

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pengpeng Hou <[email protected]>

[ Upstream commit 0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0 ]

wl1251_tx_packet_cb() uses the firmware completion ID directly to index the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the completion block, and the callback does not currently verify that it fits the array before dereferencing it.

Reject completion IDs that fall outside wl->tx_frames[] and keep the existing NULL check in the same guard. This keeps the fix local to the trust boundary and avoids touching the rest of the completion flow.

---
 drivers/net/wireless/ti/wl1251/tx.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

index 06dc74cc6cb52..2b316c78eefc9 100644
@@ -402,12 +402,14 @@ static void wl1251_tx_packet_cb(struct wl1251 *wl,
 	int hdrlen;
 	u8 *frame;
 
-	skb = wl->tx_frames[result->id];
-	if (skb == NULL) {
-		wl1251_error("SKB for packet %d is NULL", result->id);
+	if (unlikely(result->id >= ARRAY_SIZE(wl->tx_frames) ||
+		     wl->tx_frames[result->id] == NULL)) {
+		wl1251_error("invalid packet id %u", result->id);
 		return;
 	}
 
+	skb = wl->tx_frames[result->id];
+
 	info = IEEE80211_SKB_CB(skb);
 
 	if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kuninori Morimoto <[email protected]>

[ Upstream commit b9eff9732cb0f86a68c9d1592a98ceab47c01e95 ]

Component has "card_aux_list" which is added/deled in bind/unbind aux dev function (A), and used in for_each_card_auxs() loop (B).

	static void soc_unbind_aux_dev(...)
	{
		...
		for_each_card_auxs_safe(...) {
			...
(A)			list_del(&component->card_aux_list);
		}			     ^^^^^^^^^^^^^
	}

	static int soc_bind_aux_dev(...)
	{
		...
		for_each_card_pre_auxs(...) {
			...
(A)			list_add(&component->card_aux_list, ...);
		}			     ^^^^^^^^^^^^^
		...
	}

	#define for_each_card_auxs(card, component)	\
(B)		list_for_each_entry(component, ..., card_aux_list)
						    ^^^^^^^^^^^^^

But it has been used without calling INIT_LIST_HEAD().

	> git grep card_aux_list sound/soc
	sound/soc/soc-core.c:           list_del(&component->card_aux_list);
	sound/soc/soc-core.c:           list_add(&component->card_aux_list, ...);

call missing INIT_LIST_HEAD() for it.

---
 sound/soc/soc-core.c | 1 +
 1 file changed, 1 insertion(+)

index dfd58d9db7c1f..33c991e578629 100644
@@ -2618,6 +2618,7 @@ int snd_soc_component_initialize(struct snd_soc_component *component,
 	INIT_LIST_HEAD(&component->dobj_list);
 	INIT_LIST_HEAD(&component->card_list);
 	INIT_LIST_HEAD(&component->list);
+	INIT_LIST_HEAD(&component->card_aux_list);
 	mutex_init(&component->io_mutex);
 
 	component->name = fmt_single_name(dev, &component->id);

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Phil Willoughby <[email protected]>

[ Upstream commit bc5b4e5ae1a67700a618328217b6a3bd0f296e97 ]

The NeuralDSP Quad Cortex does not support DSD playback. We need this product-specific entry with zero quirks because otherwise it falls through to the vendor-specific entry which marks it as supporting DSD playback.

---
 sound/usb/quirks.c | 2 ++
 1 file changed, 2 insertions(+)

index 74828de545e22..23361e78189d0 100644
@@ -2177,6 +2177,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
 		   QUIRK_FLAG_PLAYBACK_FIRST | QUIRK_FLAG_GENERIC_IMPLICIT_FB),
 	DEVICE_FLG(0x13e5, 0x0001, /* Serato Phono */
 		   QUIRK_FLAG_IGNORE_CTL_ERROR),
+	DEVICE_FLG(0x152a, 0x880a, /* NeuralDSP Quad Cortex */
+		   0), /* Doesn't have the vendor quirk which would otherwise apply */
 	DEVICE_FLG(0x154e, 0x1002, /* Denon DCD-1500RE */
 		   QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY),
 	DEVICE_FLG(0x154e, 0x1003, /* Denon DA-300USB */

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fredric Cover <[email protected]>

[ Upstream commit 78ec5bf2f589ec7fd8f169394bfeca541b077317 ]

When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read.

This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL.

The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs.

---
 fs/smb/client/fs_context.c | 4 ++++
 1 file changed, 4 insertions(+)

index 9000299e98cb4..35f2c94aafd14 100644
@@ -454,6 +454,10 @@ char *cifs_sanitize_prepath(char *prepath, gfp_t gfp)
 	while (IS_DELIM(*cursor1))
 		cursor1++;
 
+	/* exit in case of only delimiters */
+	if (!*cursor1)
+		return NULL;
+
 	/* copy the first letter */
 	*cursor2 = *cursor1;
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gilson Marquato Júnior <[email protected]>

[ Upstream commit 8ec017cf31299c4b6287ebe27afe81c986aeef88 ]

The HP Laptop 15-fc0xxx (subsystem ID 0x103c8dc9) has an internal DMIC connected to the AMD ACP6x audio coprocessor. Add a DMI quirk entry so the internal microphone is properly detected on this model.

Tested on HP Laptop 15-fc0237ns with Fedora 43 (kernel 6.19.9).

---
 sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
 1 file changed, 7 insertions(+)

index d650091d3f302..c9bc2289d3661 100644
@@ -45,6 +45,13 @@ static struct snd_soc_card acp6x_card = {
 };
 
 static const struct dmi_system_id yc_acp_quirk_table[] = {
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "HP"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "HP Laptop 15-fc0xxx"),
+		}
+	},
 	{
 		.driver_data = &acp6x_card,
 		.matches = {

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <[email protected]>

[ Upstream commit a4337a24d13e9e3b98a113e71d6b80dc5ed5f8c4 ]

The 1kOhm pull down and hardware debouncer are features of the revision 0.92 of the Chassis specification. Fix that in the code accordingly.

---
 drivers/pinctrl/intel/pinctrl-intel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 8542053d4d6d0..2c357a69e0345 100644
@@ -1547,7 +1547,7 @@ static int intel_pinctrl_probe(struct platform_device *pdev,
 		value = readl(regs + REVID);
 		if (value == ~0u)
 			return -ENODEV;
-		if (((value & REVID_MASK) >> REVID_SHIFT) >= 0x94) {
+		if (((value & REVID_MASK) >> REVID_SHIFT) >= 0x92) {
 			community->features |= PINCTRL_FEATURE_DEBOUNCE;
 			community->features |= PINCTRL_FEATURE_1K_PD;
 		}

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: leo vriska <[email protected]>

[ Upstream commit 532743944324a873bbaf8620fcabcd0e69e30c36 ]

According to a mailing list report [1], this controller's predecessor has the same issue. However, it uses the xpad driver instead of HID, so this quirk wouldn't apply.

[1]: https://lore.kernel.org/linux-input/[email protected]/

---
 drivers/hid/hid-ids.h    | 3 +++
 drivers/hid/hid-quirks.c | 1 +
 2 files changed, 4 insertions(+)

index fd3198d4b7c5b..23adda52f6ef5 100644
@@ -22,6 +22,9 @@
 #define USB_DEVICE_ID_3M2256		0x0502
 #define USB_DEVICE_ID_3M3266		0x0506
 
+#define USB_VENDOR_ID_8BITDO		0x2dc8
+#define USB_DEVICE_ID_8BITDO_PRO_3	0x6009
+
 #define USB_VENDOR_ID_A4TECH		0x09da
 #define USB_DEVICE_ID_A4TECH_WCP32PU	0x0006
 #define USB_DEVICE_ID_A4TECH_X5_005D	0x000a

index 030ad260e7566..99fca77d16641 100644
@@ -25,6 +25,7 @@
  */
 
 static const struct hid_device_id hid_quirks[] = {
+	{ HID_USB_DEVICE(USB_VENDOR_ID_8BITDO, USB_DEVICE_ID_8BITDO_PRO_3), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_AASHIMA, USB_DEVICE_ID_AASHIMA_GAMEPAD), HID_QUIRK_BADPAD },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_AASHIMA, USB_DEVICE_ID_AASHIMA_PREDATOR), HID_QUIRK_BADPAD },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ADATA_XPG, USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE), HID_QUIRK_ALWAYS_POLL },

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: songxiebing <[email protected]>

[ Upstream commit f0541edb2e7333f320642c7b491a67912c1f65db ]

The bass speakers are not working, and add the following entry in /etc/modprobe.d/snd.conf:
options snd-sof-intel-hda-generic hda_model=alc287-yoga9-bass-spk-pin Fixes the bass speakers.

So add the quick ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN here.

---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

index 82de15e176746..0889dfd80fa44 100644
@@ -10396,6 +10396,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x17aa, 0x3869, "Lenovo Yoga7 14IAL7", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
 	SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
 	SND_PCI_QUIRK(0x17aa, 0x390d, "Lenovo Yoga Pro 7 14ASP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
+	SND_PCI_QUIRK(0x17aa, 0x3911, "Lenovo Yoga Pro 7 14IAH10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
 	SND_PCI_QUIRK(0x17aa, 0x3913, "Lenovo 145", ALC236_FIXUP_LENOVO_INV_DMIC),
 	SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Benoît Sevens <[email protected]>

[ Upstream commit d802d848308b35220f21a8025352f0c0aba15c12 ]

roccat_report_event() iterates over the device->readers list without holding the readers_lock. This allows a concurrent roccat_release() to remove and free a reader while it's still being accessed, leading to a use-after-free.

Protect the readers list traversal with the readers_lock mutex.

---
 drivers/hid/hid-roccat.c | 2 ++
 1 file changed, 2 insertions(+)

index 6da80e442fdd1..420e4335c3e83 100644
@@ -257,6 +257,7 @@ int roccat_report_event(int minor, u8 const *data)
 	if (!new_value)
 		return -ENOMEM;
 
+	mutex_lock(&device->readers_lock);
 	mutex_lock(&device->cbuf_lock);
 
 	report = &device->cbuf[device->cbuf_end];

@@ -279,6 +280,7 @@ int roccat_report_event(int minor, u8 const *data)
 	}
 
 	mutex_unlock(&device->cbuf_lock);
+	mutex_unlock(&device->readers_lock);
 
 	wake_up_interruptible(&device->wait);
 	return 0;

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arthur Husband <[email protected]>

[ Upstream commit 105c42566a550e2d05fc14f763216a8765ee5d0e ]

The JMicron JMB585 (and JMB582) SATA controllers advertise 64-bit DMA support via the S64A bit in the AHCI CAP register, but their 64-bit DMA implementation is defective. Under sustained I/O, DMA transfers targeting addresses above 4GB silently corrupt data -- writes land at incorrect memory addresses with no errors logged.

The failure pattern is similar to the ASMedia ASM1061 (commit 20730e9b2778 ("ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers")), which also falsely advertised full 64-bit DMA support. However, the JMB585 requires a stricter 32-bit DMA mask rather than 43-bit, as corruption occurs with any address above 4GB.

On the Minisforum N5 Pro specifically, the combination of the JMB585's broken 64-bit DMA with the AMD Family 1Ah (Strix Point) IOMMU causes silent data corruption that is only detectable via checksumming filesystems (BTRFS/ZFS scrub). The corruption occurs when 32-bit IOVA space is exhausted and the kernel transparently switches to 64-bit DMA addresses.

Add device-specific PCI ID entries for the JMB582 (0x0582) and JMB585 (0x0585) before the generic JMicron class match, using a new board type that combines AHCI_HFLAG_IGN_IRQ_IF_ERR (preserving existing behavior) with AHCI_HFLAG_32BIT_ONLY to force 32-bit DMA masks.

---
 drivers/ata/ahci.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

index a4b0a499b67d4..c9fbf824901e2 100644
@@ -61,6 +61,7 @@ enum board_ids {
 	/* board IDs for specific chipsets in alphabetical order */
 	board_ahci_al,
 	board_ahci_avn,
+	board_ahci_jmb585,
 	board_ahci_mcp65,
 	board_ahci_mcp77,
 	board_ahci_mcp89,

@@ -200,6 +201,15 @@ static const struct ata_port_info ahci_port_info[] = {
 		.udma_mask	= ATA_UDMA6,
 		.port_ops	= &ahci_avn_ops,
 	},
+	/* JMicron JMB582/585: 64-bit DMA is broken, force 32-bit */
+	[board_ahci_jmb585] = {
+		AHCI_HFLAGS	(AHCI_HFLAG_IGN_IRQ_IF_ERR |
+				 AHCI_HFLAG_32BIT_ONLY),
+		.flags		= AHCI_FLAG_COMMON,
+		.pio_mask	= ATA_PIO4,
+		.udma_mask	= ATA_UDMA6,
+		.port_ops	= &ahci_ops,
+	},
 	[board_ahci_mcp65] = {
 		AHCI_HFLAGS	(AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
 				 AHCI_HFLAG_YES_NCQ),

@@ -433,6 +443,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {
 	/* Elkhart Lake IDs 0x4b60 & 0x4b62 https://sata-io.org/product/8803 not tested yet */
 	{ PCI_VDEVICE(INTEL, 0x4b63), board_ahci_low_power }, /* Elkhart Lake AHCI */
 
+	/* JMicron JMB582/585: force 32-bit DMA (broken 64-bit implementation) */
+	{ PCI_VDEVICE(JMICRON, 0x0582), board_ahci_jmb585 },
+	{ PCI_VDEVICE(JMICRON, 0x0585), board_ahci_jmb585 },
+
 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
 	{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
 	  PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci_ign_iferr },

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pengpeng Hou <[email protected]>

[ Upstream commit 304950a467d83678bd0b0f46331882e2ac23b12d ]

brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check.

Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array.

---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 +++++
 1 file changed, 5 insertions(+)

index dac7eb77799bd..e6be192dc0af2 100644
@@ -151,6 +151,11 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr,
 		bphy_err(drvr, "invalid interface index: %u\n", ifevent->ifidx);
 		return;
 	}
+	if (ifevent->bsscfgidx >= BRCMF_MAX_IFS) {
+		bphy_err(drvr, "invalid bsscfg index: %u\n",
+			 ifevent->bsscfgidx);
+		return;
+	}
 
 	ifp = drvr->iflist[ifevent->bsscfgidx];
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tomasz Merta <[email protected]>

[ Upstream commit 0669631dbccd41cf3ca7aa70213fcd8bb41c4b38 ]

The STM32 SAI driver do not set the clock strobing bit (CKSTR) for DSP_A, DSP_B and LEFT_J formats, causing data to be sampled on the wrong BCLK edge when SND_SOC_DAIFMT_NB_NF is used.

Per ALSA convention, NB_NF requires sampling on the rising BCLK edge. The STM32MP25 SAI reference manual states that CKSTR=1 is required for signals received by the SAI to be sampled on the SCK rising edge. Without setting CKSTR=1, the SAI samples on the falling edge, violating the NB_NF convention. For comparison, the NXP FSL SAI driver correctly sets FSL_SAI_CR2_BCP for DSP_A, DSP_B and LEFT_J, consistent with its I2S handling.

This patch adds SAI_XCR1_CKSTR for DSP_A, DSP_B and LEFT_J in stm32_sai_set_dai_fmt which was verified empirically with a cs47l35 codec. RIGHT_J (LSB) is not investigated and addressed by this patch.

Note: the STM32 I2S driver (stm32_i2s_set_dai_fmt) may have the same issue for DSP_A mode, as I2S_CGFR_CKPOL is not set. This has not been verified and is left for a separate investigation.

---
 sound/soc/stm/stm32_sai_sub.c | 3 +++
 1 file changed, 3 insertions(+)

index 8653be3c206ea..927834b4123f5 100644
@@ -669,6 +669,7 @@ static int stm32_sai_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
 		break;
 	/* Left justified */
 	case SND_SOC_DAIFMT_MSB:
+		cr1 |= SAI_XCR1_CKSTR;
 		frcr |= SAI_XFRCR_FSPOL | SAI_XFRCR_FSDEF;
 		break;
 	/* Right justified */

@@ -676,9 +677,11 @@ static int stm32_sai_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
 		frcr |= SAI_XFRCR_FSPOL | SAI_XFRCR_FSDEF;
 		break;
 	case SND_SOC_DAIFMT_DSP_A:
+		cr1 |= SAI_XCR1_CKSTR;
 		frcr |= SAI_XFRCR_FSPOL | SAI_XFRCR_FSOFF;
 		break;
 	case SND_SOC_DAIFMT_DSP_B:
+		cr1 |= SAI_XCR1_CKSTR;
 		frcr |= SAI_XFRCR_FSPOL;
 		break;
 	default:

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Potin Lai <[email protected]>

[ Upstream commit 7ec1bd3d9be671d04325b9e06149b8813f6a4836 ]

The siliconid_to_name() function currently masks the input silicon ID with 0xff00ffff, but compares it against unmasked table entries. This causes matching to fail if the table entries contain non-zero values in the bits covered by the mask (bits 16-23).

Update the logic to apply the 0xff00ffff mask to the table entries during comparison. This ensures that only the relevant model and revision bits are considered, providing a consistent match across different manufacturing batches.

[arj: Add Fixes: tag, fix 'soninfo' typo, clarify function reference]

---
 drivers/soc/aspeed/aspeed-socinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 67e9ac3d08ecc..a90b100f4d101 100644
@@ -39,7 +39,7 @@ static const char *siliconid_to_name(u32 siliconid)
 	unsigned int i;
 
 	for (i = 0 ; i < ARRAY_SIZE(rev_table) ; ++i) {
-		if (rev_table[i].id == id)
+		if ((rev_table[i].id & 0xff00ffff) == id)
 			return rev_table[i].name;
 	}
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sebastian Krzyszkowiak <[email protected]>

[ Upstream commit 1f99b5d93d99ca17d50b386a674d0ce1f20932d8 ]

According to i.MX 8M Quad Reference Manual, GPU_AHB_CLK_ROOT's maximum frequency is 400MHz.

---
 arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index e642cb7d54d77..25b0017eb7363 100644
@@ -1411,7 +1411,7 @@ gpu: gpu@38000000 {
 			                         <&clk IMX8MQ_GPU_PLL_OUT>,
 			                         <&clk IMX8MQ_GPU_PLL>;
 			assigned-clock-rates = <800000000>, <800000000>,
-			                       <800000000>, <800000000>, <0>;
+			                       <800000000>, <400000000>, <0>;
 			power-domains = <&pgc_gpu>;
 		};
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Long Li <[email protected]>

[ Upstream commit 7b3b1e5a87b2f5e35c52b5386d7c327be869454f ]

When hv_pci_assign_numa_node() processes a device that does not have HV_PCI_DEVICE_FLAG_NUMA_AFFINITY set or has an out-of-range virtual_numa_node, the device NUMA node is left unset. On x86_64, the uninitialized default happens to be 0, but on ARM64 it is NUMA_NO_NODE (-1).

Tests show that when no NUMA information is available from the Hyper-V host, devices perform best when assigned to node 0. With NUMA_NO_NODE the kernel may spread work across NUMA nodes, which degrades performance on Hyper-V, particularly for high-throughput devices like MANA.

Always set the device NUMA node to 0 before the conditional NUMA affinity check, so that devices get a performant default when the host provides no NUMA information, and behavior is consistent on both x86_64 and ARM64.

---
 drivers/pci/controller/pci-hyperv.c | 8 ++++++++
 1 file changed, 8 insertions(+)

index 09491d06589ee..58430ca37bbdf 100644
@@ -2291,6 +2291,14 @@ static void hv_pci_assign_numa_node(struct hv_pcibus_device *hbus)
 		if (!hv_dev)
 			continue;
 
+		/*
+		 * If the Hyper-V host doesn't provide a NUMA node for the
+		 * device, default to node 0. With NUMA_NO_NODE the kernel
+		 * may spread work across NUMA nodes, which degrades
+		 * performance on Hyper-V.
+		 */
+		set_dev_node(&dev->dev, 0);
+
 		if (hv_dev->desc.flags & HV_PCI_DEVICE_FLAG_NUMA_AFFINITY &&
 		    hv_dev->desc.virtual_numa_node < num_possible_nodes())
 			/*

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maíra Canal <[email protected]>

[ Upstream commit aaefbdde9abdc43699e110679c0e10972a5e1c59 ]

The vc4_v3d_bind() function acquires a runtime PM reference via pm_runtime_resume_and_get() to access V3D registers during setup. However, this reference is never released after a successful bind. This prevents the device from ever runtime suspending, since the reference count never reaches zero.

Release the runtime PM reference by adding pm_runtime_put_autosuspend() after autosuspend is configured, allowing the device to runtime suspend after the delay.

---
 drivers/gpu/drm/vc4/vc4_v3d.c | 1 +
 1 file changed, 1 insertion(+)

index 56abb0d6bc39b..a39e6f8eff0a6 100644
@@ -497,6 +497,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
 
 	pm_runtime_use_autosuspend(dev);
 	pm_runtime_set_autosuspend_delay(dev, 40); /* a little over 2 frames. */
+	pm_runtime_put_autosuspend(dev);
 
 	return 0;
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maíra Canal <[email protected]>

[ Upstream commit f4dfd6847b3e5d24e336bca6057485116d17aea4 ]

The hang state's BO array is allocated separately with kzalloc() in vc4_save_hang_state() but never freed in vc4_free_hang_state(). Add the missing kfree() for the BO array before freeing the hang state struct.

---
 drivers/gpu/drm/vc4/vc4_gem.c | 1 +
 1 file changed, 1 insertion(+)

index 628d40ff3aa1c..c446684a72183 100644
@@ -60,6 +60,7 @@ vc4_free_hang_state(struct drm_device *dev, struct vc4_hang_state *state)
 	for (i = 0; i < state->user_state.bo_count; i++)
 		drm_gem_object_put(state->bo[i]);
 
+	kfree(state->bo);
 	kfree(state);
 }
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maíra Canal <[email protected]>

[ Upstream commit 9525d169e5fd481538cf8c663cc5839e54f2e481 ]

When vc4_save_hang_state() encounters an early return condition, it returns without freeing the previously allocated kernel_state, leaking memory.

Add the missing kfree() calls by consolidating the early return paths into a single place.

---
 drivers/gpu/drm/vc4/vc4_gem.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

index c446684a72183..0d88226b17deb 100644
@@ -169,10 +169,8 @@ vc4_save_hang_state(struct drm_device *dev)
 	spin_lock_irqsave(&vc4->job_lock, irqflags);
 	exec[0] = vc4_first_bin_job(vc4);
 	exec[1] = vc4_first_render_job(vc4);
-	if (!exec[0] && !exec[1]) {
-		spin_unlock_irqrestore(&vc4->job_lock, irqflags);
-		return;
-	}
+	if (!exec[0] && !exec[1])
+		goto err_free_state;
 
 	/* Get the bos from both binner and renderer into hang state. */
 	state->bo_count = 0;

@@ -189,10 +187,8 @@ vc4_save_hang_state(struct drm_device *dev)
 	kernel_state->bo = kcalloc(state->bo_count,
 				   sizeof(*kernel_state->bo), GFP_ATOMIC);
 
-	if (!kernel_state->bo) {
-		spin_unlock_irqrestore(&vc4->job_lock, irqflags);
-		return;
-	}
+	if (!kernel_state->bo)
+		goto err_free_state;
 
 	k = 0;
 	for (i = 0; i < 2; i++) {

@@ -284,6 +280,12 @@ vc4_save_hang_state(struct drm_device *dev)
 		vc4->hang_state = kernel_state;
 		spin_unlock_irqrestore(&vc4->job_lock, irqflags);
 	}
+
+	return;
+
+err_free_state:
+	spin_unlock_irqrestore(&vc4->job_lock, irqflags);
+	kfree(kernel_state);
 }
 
 static void

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maíra Canal <[email protected]>

[ Upstream commit 338c56050d8e892604da97f67bfa8cc4015a955f ]

The mmap callback reads bo->madv without holding madv_lock, racing with concurrent DRM_IOCTL_VC4_GEM_MADVISE calls that modify the field under the same lock. Add the missing locking to prevent the data race.

---
 drivers/gpu/drm/vc4/vc4_bo.c | 3 +++
 1 file changed, 3 insertions(+)

index ce0ea446bd707..9028a56dd12b8 100644
@@ -738,12 +738,15 @@ static int vc4_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_struct
 		return -EINVAL;
 	}
 
+	mutex_lock(&bo->madv_lock);
 	if (bo->madv != VC4_MADV_WILLNEED) {
 		DRM_DEBUG("mmaping of %s BO not allowed\n",
 			  bo->madv == VC4_MADV_DONTNEED ?
 			  "purgeable" : "purged");
+		mutex_unlock(&bo->madv_lock);
 		return -EINVAL;
 	}
+	mutex_unlock(&bo->madv_lock);
 
 	return drm_gem_dma_mmap(&bo->base, vma);
 }

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paolo Abeni <[email protected]>

[ Upstream commit 58c9b016e12855286370dfb704c08498edbc857a ]

We are observing huge contention on the epmutex during an http connection/rate test:

83.17% 0.25% nginx [kernel.kallsyms] [k] entry_SYSCALL_64_after_hwframe
[...]

           |--66.96%--__fput
                      |--60.04%--eventpoll_release_file
                                 |--58.41%--__mutex_lock.isra.6
                                           |--56.56%--osq_lock

The application is multi-threaded, creates a new epoll entry for each incoming connection, and does not delete it before the connection shutdown - that is, before the connection's fd close().

Many different threads compete frequently for the epmutex lock, affecting the overall performance.

To reduce the contention this patch introduces explicit reference counting for the eventpoll struct. Each registered event acquires a reference, and references are released at ep_remove() time.

The eventpoll struct is released by whoever - among EP file close() and and the monitored file close() drops its last reference.

Additionally, this introduces a new 'dying' flag to prevent races between the EP file close() and the monitored file close(). ep_eventpoll_release() marks, under f_lock spinlock, each epitem as dying before removing it, while EP file close() does not touch dying epitems.

The above is needed as both close operations could run concurrently and drop the EP reference acquired via the epitem entry. Without the above flag, the monitored file close() could reach the EP struct via the epitem list while the epitem is still listed and then try to put it after its disposal.

An alternative could be avoiding touching the references acquired via the epitems at EP file close() time, but that could leave the EP struct alive for potentially unlimited time after EP file close(), with nasty side effects.

With all the above in place, we can drop the epmutex usage at disposal time.

Overall this produces a significant performance improvement in the mentioned connection/rate scenario: the mutex operations disappear from the topmost offenders in the perf report, and the measured connections/rate grows by ~60%.

To make the change more readable this additionally renames ep_free() to ep_clear_and_put(), and moves the actual memory cleanup in a separate ep_free() helper.

Stable-dep-of: 07712db80857 ("eventpoll: defer struct eventpoll free to RCU grace period")

---
 fs/eventpoll.c | 195 +++++++++++++++++++++++++++++++------------------
 1 file changed, 123 insertions(+), 72 deletions(-)

index 4c590e988d4a2..f20a35775cf66 100644
@@ -57,13 +57,7 @@
  * we need a lock that will allow us to sleep. This lock is a
  * mutex (ep->mtx). It is acquired during the event transfer loop,
  * during epoll_ctl(EPOLL_CTL_DEL) and during eventpoll_release_file().
- * Then we also need a global mutex to serialize eventpoll_release_file()
- * and ep_free().
- * This mutex is acquired by ep_free() during the epoll file
- * cleanup path and it is also acquired by eventpoll_release_file()
- * if a file has been pushed inside an epoll set and it is then
- * close()d without a previous call to epoll_ctl(EPOLL_CTL_DEL).
- * It is also acquired when inserting an epoll fd onto another epoll
+ * The epmutex is acquired when inserting an epoll fd onto another epoll
  * fd. We do this so that we walk the epoll tree and ensure that this
  * insertion does not create a cycle of epoll file descriptors, which
  * could lead to deadlock. We need a global mutex to prevent two

@@ -153,6 +147,13 @@ struct epitem {
 	/* The file descriptor information this item refers to */
 	struct epoll_filefd ffd;
 
+	/*
+	 * Protected by file->f_lock, true for to-be-released epitem already
+	 * removed from the "struct file" items list; together with
+	 * eventpoll->refcount orchestrates "struct eventpoll" disposal
+	 */
+	bool dying;
+
 	/* List containing poll wait queues */
 	struct eppoll_entry *pwqlist;
 

@@ -218,6 +219,12 @@ struct eventpoll {
 	struct hlist_head refs;
 	u8 loop_check_depth;
 
+	/*
+	 * usage count, used together with epitem->dying to
+	 * orchestrate the disposal of this struct
+	 */
+	refcount_t refcount;
+
 #ifdef CONFIG_NET_RX_BUSY_POLL
 	/* used to track busy poll napi_id */
 	unsigned int napi_id;

@@ -241,9 +248,7 @@ struct ep_pqueue {
 /* Maximum number of epoll watched descriptors, per user */
 static long max_user_watches __read_mostly;
 
-/*
- * This mutex is used to serialize ep_free() and eventpoll_release_file().
- */
+/* Used for cycles detection */
 static DEFINE_MUTEX(epmutex);
 
 static u64 loop_check_gen = 0;

@@ -558,8 +563,7 @@ static void ep_remove_wait_queue(struct eppoll_entry *pwq)
 
 /*
  * This function unregisters poll callbacks from the associated file
- * descriptor.  Must be called with "mtx" held (or "epmutex" if called from
- * ep_free).
+ * descriptor.  Must be called with "mtx" held.
  */
 static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
 {

@@ -682,11 +686,40 @@ static void epi_rcu_free(struct rcu_head *head)
 	kmem_cache_free(epi_cache, epi);
 }
 
+static void ep_get(struct eventpoll *ep)
+{
+	refcount_inc(&ep->refcount);
+}
+
+/*
+ * Returns true if the event poll can be disposed
+ */
+static bool ep_refcount_dec_and_test(struct eventpoll *ep)
+{
+	if (!refcount_dec_and_test(&ep->refcount))
+		return false;
+
+	WARN_ON_ONCE(!RB_EMPTY_ROOT(&ep->rbr.rb_root));
+	return true;
+}
+
+static void ep_free(struct eventpoll *ep)
+{
+	mutex_destroy(&ep->mtx);
+	free_uid(ep->user);
+	wakeup_source_unregister(ep->ws);
+	kfree(ep);
+}
+
 /*
  * Removes a "struct epitem" from the eventpoll RB tree and deallocates
  * all the associated resources. Must be called with "mtx" held.
+ * If the dying flag is set, do the removal only if force is true.
+ * This prevents ep_clear_and_put() from dropping all the ep references
+ * while running concurrently with eventpoll_release_file().
+ * Returns true if the eventpoll can be disposed.
  */
-static int ep_remove(struct eventpoll *ep, struct epitem *epi)
+static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force)
 {
 	struct file *file = epi->ffd.file;
 	struct epitems_head *to_free;

@@ -701,6 +734,11 @@ static int ep_remove(struct eventpoll *ep, struct epitem *epi)
 
 	/* Remove the current item from the list of epoll hooks */
 	spin_lock(&file->f_lock);
+	if (epi->dying && !force) {
+		spin_unlock(&file->f_lock);
+		return false;
+	}
+
 	to_free = NULL;
 	head = file->f_ep;
 	if (head->first == &epi->fllink && !epi->fllink.next) {

@@ -735,28 +773,28 @@ static int ep_remove(struct eventpoll *ep, struct epitem *epi)
 	call_rcu(&epi->rcu, epi_rcu_free);
 
 	percpu_counter_dec(&ep->user->epoll_watches);
+	return ep_refcount_dec_and_test(ep);
+}
 
-	return 0;
+/*
+ * ep_remove variant for callers owing an additional reference to the ep
+ */
+static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi)
+{
+	WARN_ON_ONCE(__ep_remove(ep, epi, false));
 }
 
-static void ep_free(struct eventpoll *ep)
+static void ep_clear_and_put(struct eventpoll *ep)
 {
-	struct rb_node *rbp;
+	struct rb_node *rbp, *next;
 	struct epitem *epi;
+	bool dispose;
 
 	/* We need to release all tasks waiting for these file */
 	if (waitqueue_active(&ep->poll_wait))
 		ep_poll_safewake(ep, NULL, 0);
 
-	/*
-	 * We need to lock this because we could be hit by
-	 * eventpoll_release_file() while we're freeing the "struct eventpoll".
-	 * We do not need to hold "ep->mtx" here because the epoll file
-	 * is on the way to be removed and no one has references to it
-	 * anymore. The only hit might come from eventpoll_release_file() but
-	 * holding "epmutex" is sufficient here.
-	 */
-	mutex_lock(&epmutex);
+	mutex_lock(&ep->mtx);
 
 	/*
 	 * Walks through the whole tree by unregistering poll callbacks.

@@ -769,26 +807,25 @@ static void ep_free(struct eventpoll *ep)
 	}
 
 	/*
-	 * Walks through the whole tree by freeing each "struct epitem". At this
-	 * point we are sure no poll callbacks will be lingering around, and also by
-	 * holding "epmutex" we can be sure that no file cleanup code will hit
-	 * us during this operation. So we can avoid the lock on "ep->lock".
-	 * We do not need to lock ep->mtx, either, we only do it to prevent
-	 * a lockdep warning.
+	 * Walks through the whole tree and try to free each "struct epitem".
+	 * Note that ep_remove_safe() will not remove the epitem in case of a
+	 * racing eventpoll_release_file(); the latter will do the removal.
+	 * At this point we are sure no poll callbacks will be lingering around.
+	 * Since we still own a reference to the eventpoll struct, the loop can't
+	 * dispose it.
 	 */
-	mutex_lock(&ep->mtx);
-	while ((rbp = rb_first_cached(&ep->rbr)) != NULL) {
+	for (rbp = rb_first_cached(&ep->rbr); rbp; rbp = next) {
+		next = rb_next(rbp);
 		epi = rb_entry(rbp, struct epitem, rbn);
-		ep_remove(ep, epi);
+		ep_remove_safe(ep, epi);
 		cond_resched();
 	}
+
+	dispose = ep_refcount_dec_and_test(ep);
 	mutex_unlock(&ep->mtx);
 
-	mutex_unlock(&epmutex);
-	mutex_destroy(&ep->mtx);
-	free_uid(ep->user);
-	wakeup_source_unregister(ep->ws);
-	kfree(ep);
+	if (dispose)
+		ep_free(ep);
 }
 
 static int ep_eventpoll_release(struct inode *inode, struct file *file)

@@ -796,7 +833,7 @@ static int ep_eventpoll_release(struct inode *inode, struct file *file)
 	struct eventpoll *ep = file->private_data;
 
 	if (ep)
-		ep_free(ep);
+		ep_clear_and_put(ep);
 
 	return 0;
 }

@@ -944,33 +981,34 @@ void eventpoll_release_file(struct file *file)
 {
 	struct eventpoll *ep;
 	struct epitem *epi;
-	struct hlist_node *next;
+	bool dispose;
 
 	/*
-	 * We don't want to get "file->f_lock" because it is not
-	 * necessary. It is not necessary because we're in the "struct file"
-	 * cleanup path, and this means that no one is using this file anymore.
-	 * So, for example, epoll_ctl() cannot hit here since if we reach this
-	 * point, the file counter already went to zero and fget() would fail.
-	 * The only hit might come from ep_free() but by holding the mutex
-	 * will correctly serialize the operation. We do need to acquire
-	 * "ep->mtx" after "epmutex" because ep_remove() requires it when called
-	 * from anywhere but ep_free().
-	 *
-	 * Besides, ep_remove() acquires the lock, so we can't hold it here.
+	 * Use the 'dying' flag to prevent a concurrent ep_clear_and_put() from
+	 * touching the epitems list before eventpoll_release_file() can access
+	 * the ep->mtx.
 	 */
-	mutex_lock(&epmutex);
-	if (unlikely(!file->f_ep)) {
-		mutex_unlock(&epmutex);
-		return;
-	}
-	hlist_for_each_entry_safe(epi, next, file->f_ep, fllink) {
+again:
+	spin_lock(&file->f_lock);
+	if (file->f_ep && file->f_ep->first) {
+		epi = hlist_entry(file->f_ep->first, struct epitem, fllink);
+		epi->dying = true;
+		spin_unlock(&file->f_lock);
+
+		/*
+		 * ep access is safe as we still own a reference to the ep
+		 * struct
+		 */
 		ep = epi->ep;
-		mutex_lock_nested(&ep->mtx, 0);
-		ep_remove(ep, epi);
+		mutex_lock(&ep->mtx);
+		dispose = __ep_remove(ep, epi, true);
 		mutex_unlock(&ep->mtx);
+
+		if (dispose)
+			ep_free(ep);
+		goto again;
 	}
-	mutex_unlock(&epmutex);
+	spin_unlock(&file->f_lock);
 }
 
 static int ep_alloc(struct eventpoll **pep)

@@ -993,6 +1031,7 @@ static int ep_alloc(struct eventpoll **pep)
 	ep->rbr = RB_ROOT_CACHED;
 	ep->ovflist = EP_UNACTIVE_PTR;
 	ep->user = user;
+	refcount_set(&ep->refcount, 1);
 
 	*pep = ep;
 

@@ -1177,10 +1216,10 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v
 		 */
 		list_del_init(&wait->entry);
 		/*
-		 * ->whead != NULL protects us from the race with ep_free()
-		 * or ep_remove(), ep_remove_wait_queue() takes whead->lock
-		 * held by the caller. Once we nullify it, nothing protects
-		 * ep/epi or even wait.
+		 * ->whead != NULL protects us from the race with
+		 * ep_clear_and_put() or ep_remove(), ep_remove_wait_queue()
+		 * takes whead->lock held by the caller. Once we nullify it,
+		 * nothing protects ep/epi or even wait.
 		 */
 		smp_store_release(&ep_pwq_from_wait(wait)->whead, NULL);
 	}

@@ -1451,16 +1490,22 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event,
 	if (tep)
 		mutex_unlock(&tep->mtx);
 
+	/*
+	 * ep_remove_safe() calls in the later error paths can't lead to
+	 * ep_free() as the ep file itself still holds an ep reference.
+	 */
+	ep_get(ep);
+
 	/* now check if we've created too many backpaths */
 	if (unlikely(full_check && reverse_path_check())) {
-		ep_remove(ep, epi);
+		ep_remove_safe(ep, epi);
 		return -EINVAL;
 	}
 
 	if (epi->event.events & EPOLLWAKEUP) {
 		error = ep_create_wakeup_source(epi);
 		if (error) {
-			ep_remove(ep, epi);
+			ep_remove_safe(ep, epi);
 			return error;
 		}
 	}

@@ -1484,7 +1529,7 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event,
 	 * high memory pressure.
 	 */
 	if (unlikely(!epq.epi)) {
-		ep_remove(ep, epi);
+		ep_remove_safe(ep, epi);
 		return -ENOMEM;
 	}
 

@@ -2016,7 +2061,7 @@ static int do_epoll_create(int flags)
 out_free_fd:
 	put_unused_fd(fd);
 out_free_ep:
-	ep_free(ep);
+	ep_clear_and_put(ep);
 	return error;
 }
 

@@ -2158,10 +2203,16 @@ int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds,
 			error = -EEXIST;
 		break;
 	case EPOLL_CTL_DEL:
-		if (epi)
-			error = ep_remove(ep, epi);
-		else
+		if (epi) {
+			/*
+			 * The eventpoll itself is still alive: the refcount
+			 * can't go to zero here.
+			 */
+			ep_remove_safe(ep, epi);
+			error = 0;
+		} else {
 			error = -ENOENT;
+		}
 		break;
 	case EPOLL_CTL_MOD:
 		if (epi) {

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nicholas Carlini <[email protected]>

[ Upstream commit 07712db80857d5d09ae08f3df85a708ecfc3b61f ]

In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.

---
 fs/eventpoll.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

index f20a35775cf66..f6038819fe79f 100644
@@ -225,6 +225,9 @@ struct eventpoll {
 	 */
 	refcount_t refcount;
 
+	/* used to defer freeing past ep_get_upwards_depth_proc() RCU walk */
+	struct rcu_head rcu;
+
 #ifdef CONFIG_NET_RX_BUSY_POLL
 	/* used to track busy poll napi_id */
 	unsigned int napi_id;

@@ -708,7 +711,8 @@ static void ep_free(struct eventpoll *ep)
 	mutex_destroy(&ep->mtx);
 	free_uid(ep->user);
 	wakeup_source_unregister(ep->ws);
-	kfree(ep);
+	/* ep_get_upwards_depth_proc() may still hold epi->ep under RCU */
+	kfree_rcu(ep, rcu);
 }
 
 /*

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ruide Cao <[email protected]>

[ Upstream commit c842743d073bdd683606cb414eb0ca84465dd834 ]

tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area.

If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants.

Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.

---
 net/sched/act_csum.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

index 1366adf9b9091..bcef42a3ad645 100644
@@ -602,8 +602,12 @@ static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
 			protocol = skb->protocol;
 			orig_vlan_tag_present = true;
 		} else {
-			struct vlan_hdr *vlan = (struct vlan_hdr *)skb->data;
+			struct vlan_hdr *vlan;
 
+			if (!pskb_may_pull(skb, VLAN_HLEN))
+				goto drop;
+
+			vlan = (struct vlan_hdr *)skb->data;
 			protocol = vlan->h_vlan_encapsulated_proto;
 			skb_pull(skb, VLAN_HLEN);
 			skb_reset_network_header(skb);

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit b120e4432f9f56c7103133d6a11245e617695adb ]

lapbeth_data_transmit() expects the underlying device type to be ARPHRD_ETHER.

Returning NOTIFY_BAD from lapbeth_device_event() makes sure bonding driver can not break this expectation.

---
 drivers/net/wan/lapbether.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

index 56326f38fe8a3..da61716a66c46 100644
@@ -444,33 +444,36 @@ static void lapbeth_free_device(struct lapbethdev *lapbeth)
 static int lapbeth_device_event(struct notifier_block *this,
 				unsigned long event, void *ptr)
 {
-	struct lapbethdev *lapbeth;
 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+	struct lapbethdev *lapbeth;
 
 	if (dev_net(dev) != &init_net)
 		return NOTIFY_DONE;
 
-	if (!dev_is_ethdev(dev) && !lapbeth_get_x25_dev(dev))
+	lapbeth = lapbeth_get_x25_dev(dev);
+	if (!dev_is_ethdev(dev) && !lapbeth)
 		return NOTIFY_DONE;
 
 	switch (event) {
 	case NETDEV_UP:
 		/* New ethernet device -> new LAPB interface	 */
-		if (!lapbeth_get_x25_dev(dev))
+		if (!lapbeth)
 			lapbeth_new_device(dev);
 		break;
 	case NETDEV_GOING_DOWN:
 		/* ethernet device closes -> close LAPB interface */
-		lapbeth = lapbeth_get_x25_dev(dev);
 		if (lapbeth)
 			dev_close(lapbeth->axdev);
 		break;
 	case NETDEV_UNREGISTER:
 		/* ethernet device disappears -> remove LAPB interface */
-		lapbeth = lapbeth_get_x25_dev(dev);
 		if (lapbeth)
 			lapbeth_free_device(lapbeth);
 		break;
+	case NETDEV_PRE_TYPE_CHANGE:
+		/* Our underlying device type must not change. */
+		if (lapbeth)
+			return NOTIFY_BAD;
 	}
 
 	return NOTIFY_DONE;