6.1.178-rc1 review

This is the start of the stable review cycle for the 6.1.178 release. There are 1067 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 23 Jul 2026 15:23:00 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.178-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.1.178-rc1

HyeongJun An <[email protected]>
ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamp clock period by using lower value

Takashi Iwai <[email protected]>
ALSA: seq: Check UMP support for midi_version change

Takashi Iwai <[email protected]>
ALSA: seq: Skip event type filtering for UMP events

Pavel Skripkin <[email protected]>
bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX

Edward Adam Davis <[email protected]>
Bluetooth: Ignore too large handle values in BIG

Jean-Baptiste Maneyrol <[email protected]>
iio: invensense: fix odr switching to same value

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_mpu6050: fix frequency setting when chip is off

Xuan Zhuo <[email protected]>
virtio_ring: fix syncs DMA memory with different direction

Shyam Prasad N <[email protected]>
cifs: fix lock ordering while disabling multichannel

Liming Wu <[email protected]>
tools/virtio: Add dma sync api for virtio test

Takashi Iwai <[email protected]>
ALSA: seq: Avoid confusion of aligned read size

Danilo Krummrich <[email protected]>
driver core: Guard deferred probe timeout extension with delayed_work_pending()

Danilo Krummrich <[email protected]>
driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()

Easwar Hariharan <[email protected]>
jiffies: Cast to unsigned long in secs_to_jiffies() conversion

Easwar Hariharan <[email protected]>
jiffies: Define secs_to_jiffies()

Baokun Li <[email protected]>
writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()

Jan Kara <[email protected]>
writeback: Fix use after free in inode_switch_wbs_work_fn()

Stig Hornang <[email protected]>
Bluetooth: L2CAP: fix tx ident leak for commands without a response

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix regressions caused by reusing ident

Randy Dunlap <[email protected]>
seqlock: fix scoped_seqlock_read kernel-doc

Marc Zyngier <[email protected]>
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

SeongJae Park <[email protected]>
mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()

SeongJae Park <[email protected]>
mm/damon/core: make charge_addr_from aware of end-address exclusivity

Qu Wenruo <[email protected]>
btrfs: fix incorrect buffered IO fallback for append direct writes

Qu Wenruo <[email protected]>
btrfs: fix false IO failure after falling back to buffered write

Wentao Liang <[email protected]>
regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

Krzysztof Kozlowski <[email protected]>
regulator: scmi: Simplify with scoped for each OF child loop

Ricardo Robaina <[email protected]>
audit: fix potential integer overflow in audit_log_n_hex()

Ricardo Robaina <[email protected]>
audit: add audit_log_nf_skb helper function

Giovanni Cabiddu <[email protected]>
crypto: qat - validate RSA CRT component lengths

Qu Wenruo <[email protected]>
btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC

Ahsan Atta <[email protected]>
crypto: qat - fix restarting state leak on allocation failure

Neill Kapron <[email protected]>
usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile

Chaitanya Kulkarni <[email protected]>
nvmet: remove superfluous initialization

Thorsten Blum <[email protected]>
crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A

Uwe Kleine-König <[email protected]>
crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0

Krzysztof Kozlowski <[email protected]>
crypto: atmel-sha204a - Mark OF related data as maybe unused

Tyler Baker <[email protected]>
usb: gadget: f_fs: initialize reset_work at allocation time

Andy Yan <[email protected]>
usb: typec: tcpm: Fix VDM type for Enter Mode commands

Mauricio Faria de Oliveira <[email protected]>
usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()

Oliver Neukum <[email protected]>
usb: iowarrior: remove inherent race with minor number

Vlad Poenaru <[email protected]>
bpf: Allow LPM map access from sleepable BPF programs

Andrii Nakryiko <[email protected]>
bpf: Consistently use bpf_rcu_lock_held() everywhere

Tristan Madani <[email protected]>
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length

Viacheslav Dubeyko <[email protected]>
hfs/hfsplus: prevent getting negative values of offset/length

Andy Shevchenko <[email protected]>
serial: 8250_mid: Disable DMA for selected platforms

Ilpo Järvinen <[email protected]>

    serial: 8250_mid: Remove 8250_pci usage

Manish Khadka <[email protected]>
HID: appleir: fix UAF on pending key_up_timer in remove()

Thomas Gleixner <[email protected]>
treewide: Switch/rename to timer_delete[_sync]()

Jann Horn <[email protected]>
proc: protect ptrace_may_access() with exec_update_lock (part 1)

Oleg Nesterov <[email protected]>
seqlock: Change do_task_stat() to use scoped_seqlock_read()

Peter Zijlstra <[email protected]>
seqlock: Introduce scoped_seqlock_read()

Trung Nguyen <[email protected]>
HID: multitouch: fix out-of-bounds bit access on mt_io_flags

Angela Czubak <[email protected]>
HID: add haptics page defines

Jann Horn <[email protected]>
proc: protect ptrace_may_access() with exec_update_lock (FD links)

Christoph Hellwig <[email protected]>
proc: rename proc_setattr to proc_nochmod_setattr

Tyler Hicks (Microsoft) <[email protected]>
proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation

Thomas Weißschuh <[email protected]>
proc: use generic setattr() for /proc/$PID/net

Zide Chen <[email protected]>
perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()

Baokun Li <[email protected]>
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()

Jan Kara <[email protected]>

    writeback: Avoid contention on wb->list_lock when switching inodes

Namjae Jeon <[email protected]>
ksmbd: track the connection owning a byte-range lock

DaeMyung Kang <[email protected]>
ksmbd: centralize ksmbd_conn final release to plug transport leak

DaeMyung Kang <[email protected]>
ksmbd: destroy async_ida in ksmbd_conn_free()

Greg Kroah-Hartman <[email protected]>
ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc

Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger

ZhangGuoDong <[email protected]>
smb: move smb_version_values to common/smbglob.h

ZhangGuoDong <[email protected]>
smb: move some duplicate definitions to common/cifsglob.h

Namjae Jeon <[email protected]>
ksmbd: use opener credentials for FSCTL mutations

Michael Bommarito <[email protected]>
smb: client: resolve SWN tcon from live registrations

David Howells <[email protected]>
cifs: Add tracing for the cifs_tcon struct refcounting

David Howells <[email protected]>
cifs: Fix reacquisition of volume cookie on still-live connection

Shyam Prasad N <[email protected]>
cifs: after disabling multichannel, mark tcon for reconnect

Shyam Prasad N <[email protected]>
cifs: handle when server stops supporting multichannel

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO

Runyu Xiao <[email protected]>

    Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock

Hyunwoo Kim <[email protected]>
Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix not tracking outstanding TX ident

Siwei Zhang <[email protected]>
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister

Sungwoo Kim <[email protected]>
Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()

Luiz Augusto von Dentz <[email protected]>
Bluetooth: Remove BT_HS

Ziyang Xuan <[email protected]>
Bluetooth: Make handle of hci_conn be unique

Florian Westphal <[email protected]>
netfilter: ebtables: zero chainstack array

Qianfeng Rong <[email protected]>
netfilter: ebtables: Use vmalloc_array() to improve code

Qi Zheng <[email protected]>
mm: shrinker: fix NULL pointer dereference in debugfs

John Keeping <[email protected]>
mm: shrinkers: fix debugfs file permissions

Runyu Xiao <[email protected]>
gpio: sch: use raw_spinlock_t in the irq startup path

Runyu Xiao <[email protected]>
coresight: etb10: restore atomic_t for shared reading state

Shakeel Butt <[email protected]>
mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()

Qi Zheng <[email protected]>
mm: shrinker: remove redundant shrinker_rwsem in debugfs operations

Marco Nenciarini <[email protected]>
PCI: Skip Resizable BAR restore on read error

Ilpo Järvinen <[email protected]>
PCI: Move Resizable BAR code to rebar.c

Ilpo Järvinen <[email protected]>
PCI: Add kerneldoc for pci_resize_resource()

Ilpo Järvinen <[email protected]>
PCI: Fix restoring BARs on BAR resize rollback path

Ilpo Järvinen <[email protected]>
PCI: Free saved list without holding pci_bus_sem

Ilpo Järvinen <[email protected]>
PCI: Prevent resource tree corruption when BAR resize fails

Giovanni Cabiddu <[email protected]>
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

Nikolay Kulikov <[email protected]>
staging: rtl8723bs: fix spaces around binary operators

William Hansen-Baird <[email protected]>
staging: rtl8723bs: core: move constants to right side in comparison

Manivannan Sadhasivam <[email protected]>
PCI: mediatek: Fix IRQ domain leak when port fails to enable

Christian Marangi <[email protected]>
PCI: mediatek: Use generic MACRO for TPVPERL delay

Christian Marangi <[email protected]>
PCI: mediatek: Convert bool to single quirks entry and bitmap

Jiri Slaby (SUSE) <[email protected]>
PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

Franziska Naepelt <[email protected]>
staging: rtl8723bs: Fix space issues

Franziska Naepelt <[email protected]>
staging: rtl8723bs: Fix indentation issues

Richard Zhu <[email protected]>
PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling

Alex Williamson <[email protected]>
vfio/mlx5: Fix racy bitfields and tighten struct layout

Mahesh Vaidya <[email protected]>
PCI: altera: Fix resource leaks on probe failure

Alex Williamson <[email protected]>
vfio/pci: Latch disable_idle_d3 per device

Raghavendra Rao Ananta <[email protected]>
vfio/pci: Use a private flag to prevent power state change with VFs

Reinette Chatre <[email protected]>
vfio/pci: Use bitfield for struct vfio_pci_core_device flags

Herman van Hazendonk <[email protected]>
iio: common: st_sensors: honour channel endianness in read_axis_data

Alexander Lobakin <[email protected]>
bitops: make BYTES_TO_BITS() treewide-available

Zhao Dongdong <[email protected]>
ALSA: aoa: check snd_ctl_new1() return value

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: stabilized timestamp in interrupt

Jean-Baptiste Maneyrol <[email protected]>
iio: invensense: fix timestamp glitches when switching frequency

Colin Ian King <[email protected]>
iio: invensense: remove redundant initialization of variable period

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_mpu6050: use the common inv_sensors timestamp module

Jean-Baptiste Maneyrol <[email protected]>
iio: make invensense timestamp module generic

Jean-Baptiste Maneyrol <[email protected]>
iio: move inv_icm42600 timestamp module in common

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: make timestamp module chip independent

Zhang Lixu <[email protected]>
iio: hid-sensor-rotation: Fix stale or zero output when reading raw values

Runyu Xiao <[email protected]>
iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ

Rafael J. Wysocki <[email protected]>
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup

Sandipan Das <[email protected]>
perf/x86/amd/brs: Fix kernel address leakage

Pengpeng Hou <[email protected]>
mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout

Pengpeng Hou <[email protected]>
mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout

Pengpeng Hou <[email protected]>
mtd: rawnand: fsl_ifc: return errors for failed page reads

Runyu Xiao <[email protected]>
mmc: vub300: defer reset until cmd_mutex is unlocked

Pengpeng Hou <[email protected]>
mtd: mchp23k256: use SPI match data for chip caps

Pengpeng Hou <[email protected]>
mtd: onenand: samsung: report DMA completion timeouts

Rafael Beims <[email protected]>
wifi: mwifiex: fix permanently busy scans after multiple roam iterations

Zhiling Zou <[email protected]>
wifi: mac80211: free ack status frame on TX header build failure

Junrui Luo <[email protected]>
powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

Zhao Dongdong <[email protected]>
reset: sunxi: fix memory region leak on ioremap failure

Robby Cai <[email protected]>
reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ

Julian Anastasov <[email protected]>
ipvs: fix more places with wrong ipv6 transport offsets

Maoyi Xie <[email protected]>
memstick: ms_block: reject a card that reports too many blocks

James Raphael Tiovalen <[email protected]>
macsec: fix promiscuity refcount leak in macsec_dev_open()

Xuanqiang Luo <[email protected]>
llc: fix SAP refcount leak when creating incoming sockets

Laxman Acharya Padhya <[email protected]>
Bluetooth: btrtl: validate firmware patch bounds

Asim Viladi Oglu Manizada <[email protected]>
net: openvswitch: reject oversized nested action attrs

Abhishek Ojha <[email protected]>
regulator: ltc3676: Fix incorrect IRQSTAT bit offsets

Dawei Feng <[email protected]>

    wifi: mac80211: fix memory leak in ieee80211_register_hw()

Runyu Xiao <[email protected]>
wifi: rt2x00: avoid full teardown before work setup in probe

Thorsten Blum <[email protected]>
powerpc/pseries: fix memory leak on krealloc failure in papr_init

Farhad Alemi <[email protected]>
cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed

Tao Liu <[email protected]>
riscv: Prevent NULL pointer dereference in machine_kexec_prepare()

Michael Bommarito <[email protected]>
drbd: reject data replies with an out-of-range payload size

Daehyeon Ko <[email protected]>
macsec: don't read an unset MAC header in macsec_encrypt()

Yizhou Zhao <[email protected]>
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

Yizhou Zhao <[email protected]>
ipvs: use parsed transport offset in SCTP state lookup

Shuangpeng Bai <[email protected]>
llc: fix SAP refcount leak in llc_ui_autobind()

Yousef Alhouseen <[email protected]>
mac802154: remove interfaces with RCU list deletion

Gerald Schaefer <[email protected]>
s390/monwriter: Reject buffer reuse with different data length

HyeongJun An <[email protected]>
hwmon: (asus_atk0110) Check package count before accessing element

Maoyi Xie <[email protected]>
net: wwan: iosm: bound device offsets in the MUX downlink decoder

Wentao Liang <[email protected]>
ata: pata_pxa: Fix DMA channel leak on probe error

Bryam Vargas <[email protected]>
orangefs: keep the readdir entry size 64-bit in fill_from_part()

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix double addition of offset for @+FOFFSET

Bryam Vargas <[email protected]>
net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

Andrea Righi <[email protected]>
net: lan743x: Initialize eth_syslock spinlock before use

Haoxiang Li <[email protected]>
fsl/fman: Free init resources on KeyGen failure in fman_init()

Runyu Xiao <[email protected]>
hwmon: (occ) unregister sysfs devices outside occ lock

Haoxiang Li <[email protected]>
net: liquidio: fix BAR resource leak on PF number failure

Pengpeng Hou <[email protected]>
hwmon: (w83793) remove vrm sysfs file on probe failure

Pengpeng Hou <[email protected]>
hwmon: (w83627hf) remove VID sysfs files on error and remove

Conor Dooley <[email protected]>
rtc: mpfs: fix counter upload completion condition

Abdun Nihaal <[email protected]>
bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()

Hongchen Zhang <[email protected]>
LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()

Sven Eckelmann <[email protected]>
batman-adv: clean untagged VLAN on netdev registration failure

Sven Eckelmann <[email protected]>
batman-adv: ensure minimal ethernet header on TX

Sven Eckelmann <[email protected]>
batman-adv: retrieve ethhdr after potential skb realloc on RX

Liew Rui Yan <[email protected]>
mm/damon/reclaim: fix typo in damon_reclaim_timer_fn()

Jamal Hadi Salim <[email protected]>
net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants

Shitalkumar Gandhi <[email protected]>
ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

Shitalkumar Gandhi <[email protected]>
ieee802154: ca8210: fix cas_ctl leak on spi_async failure

Michael Bommarito <[email protected]>
ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation

Michael Bommarito <[email protected]>
ieee802154: admin-gate legacy LLSEC dump operations

Maoyi Xie <[email protected]>
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

Maoyi Xie <[email protected]>
net: ipip: require CAP_NET_ADMIN in the device netns for changelink

Maoyi Xie <[email protected]>
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink

Maoyi Xie <[email protected]>
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink

Dawei Feng <[email protected]>
net: ena: clean up XDP TX queues when regular TX setup fails

Haoxiang Li <[email protected]>
net: ixp4xx_hss: fix duplicate HDLC netdev allocation

Haoxiang Li <[email protected]>
net: wwan: t7xx: destroy DMA pool on CLDMA late init failure

Maoyi Xie <[email protected]>
net: sit: require CAP_NET_ADMIN in the device netns for changelink

Andreas Kemnade <[email protected]>
gpios: palmas: add .get_direction() op

Paul Louvel <[email protected]>
gpio-f7188x: Add support for NCT6126D version B

Bradley Morgan <[email protected]>
cpu: hotplug: Bound hotplug states sysfs output

Bradley Morgan <[email protected]>
cpu: hotplug: Preserve per instance callback errors

Zhan Xusheng <[email protected]>
posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()

Doruk Tan Ozturk <[email protected]>
net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix type confusion in CDC union descriptor parsing

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix race condition in reset_device sysfs callback

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix DMA mapping violation in line setup

Dmitry Torokhov <[email protected]>
Input: ims-pcu - add response length checks

Dmitry Torokhov <[email protected]>
Input: ims-pcu - validate control endpoint type

Dmitry Torokhov <[email protected]>
Input: ims-pcu - release data interface on disconnect

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix use-after-free and double-free in disconnect

Haoxiang Li <[email protected]>
scsi: elx: efct: Fix I/O leak on unsupported additional CDB

WenTao Liang <[email protected]>
scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()

Bryam Vargas <[email protected]>
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

Bryam Vargas <[email protected]>
scsi: target: Bound PR-OUT TransportID parsing to the received buffer

Michael Bommarito <[email protected]>
scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

Michael Bommarito <[email protected]>
scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

Xu Rao <[email protected]>
scsi: sg: Report request-table problems when any status is set

Abdun Nihaal <[email protected]>
scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()

Haoxiang Li <[email protected]>
scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path

Mikulas Patocka <[email protected]>
dm-verity: increase sprintf buffer size

Mikulas Patocka <[email protected]>
dm-verity: fix a possible NULL pointer dereference

Mikulas Patocka <[email protected]>
dm_early_create: fix freeing used table on dm_resume failure

Mikulas Patocka <[email protected]>
dm-stats: fix merge accounting

Mikulas Patocka <[email protected]>
dm-stats: fix dm_jiffies_to_msec64

Benjamin Marzinski <[email protected]>
dm-log: fix a bitset_size overflow on 32bit machines

Mikulas Patocka <[email protected]>
dm-bufio: fix wrong count calculation in dm_bufio_issue_discard

Samuel Moelius <[email protected]>
dm era: fix out-of-bounds memory access for non-zero start sector

Ming-Hung Tsai <[email protected]>
dm thin metadata: fix metadata snapshot consistency on commit failure

Genjian Zhang <[email protected]>
dm thin metadata: fix superblock refcount leak on snapshot shadow failure

Haoxiang Li <[email protected]>
net: sparx5: unregister blocking notifier on init failure

Jiri Olsa <[email protected]>
bpf: Add missing access_ok call to copy_user_syms

Oliver Hartkopp <[email protected]>
can: bcm: add missing rcu list annotations and operations

Oliver Hartkopp <[email protected]>
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure

Lee Jones <[email protected]>
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

Oliver Hartkopp <[email protected]>
can: isotp: use unconditional synchronize_rcu() in isotp_release()

Fan Wu <[email protected]>
can: esd_usb: kill anchored URBs before freeing netdevs

Bryam Vargas <[email protected]>
nvmet-rdma: handle inline data with a nonzero offset

Weiming Shi <[email protected]>
sctp: validate STALE_COOKIE cause length before reading staleness

Kunihiko Hayashi <[email protected]>
spi: uniphier: Fix completion initialization order before devm_request_irq()

Wang Yan <[email protected]>
time: Fix off-by-one in compat settimeofday() usec validation

Jaewon Yang <[email protected]>
tpm: Make the TPM character devices non-seekable

Thorsten Blum <[email protected]>
tpm: fix event_size output in tpm1_binary_bios_measurements_show

Maoyi Xie <[email protected]>
xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink

Sanman Pradhan <[email protected]>
xfrm: use compat translator only for u64 alignment mismatch

Wentao Liang <[email protected]>
xen/gntdev: fix error handling in ioctl

Xuanqiang Luo <[email protected]>
i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()

Roman Vivchar <[email protected]>
i2c: mediatek: fix WRRD for SoCs without auto_restart option

Joshua Crofts <[email protected]>
hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig

Ibrahim Hashimov <[email protected]>
ksmbd: fix integer overflow in set_file_allocation_info()

Fredric Cover <[email protected]>
smb: client: use kvzalloc() for megabyte buffer in simple fallocate

Frank Li <[email protected]>
dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK

Kartik Rajput <[email protected]>
dmaengine: tegra: Fix burst size calculation

Jarkko Sakkinen <[email protected]>
tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()

Bhargav Joshi <[email protected]>
irqchip/crossbar: Use correct index in crossbar_domain_free()

Florian Fuchs <[email protected]>
mtd: maps: vmu-flash: fix NULL pointer dereference in initialization

Miquel Raynal <[email protected]>
mtd: spi-nor: swp: Improve locking user experience

Sebastian Alba Vives <[email protected]>
fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()

Manivannan Sadhasivam <[email protected]>
bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path

Michael Bommarito <[email protected]>
ocfs2: reject non-inline dinodes with i_size and zero i_clusters

Michael Bommarito <[email protected]>
ocfs2: reject dinodes whose i_rdev disagrees with the file type

Michael Bommarito <[email protected]>
ocfs2: reject dinodes with non-canonical i_mode type

Joseph Qi <[email protected]>
ocfs2: add journal NULL check in ocfs2_checkpoint_inode()

Ian Bridges <[email protected]>
ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits

Kyle Zeng <[email protected]>
ocfs2: avoid moving extents to occupied clusters

Arseniy Krasnov <[email protected]>
mtd: rawnand: fix condition in 'nand_select_target()'

Vasiliy Kovalev <[email protected]>
net/9p: fix infinite loop in p9_client_rpc on fatal signal

Bastien Curutchet <[email protected]>
mtd: rawnand: pl353: fix probe resource allocation

Tristan Madani <[email protected]>
ocfs2: use kzalloc for quota recovery bitmap allocation

Ionut Nechita <[email protected]>
scsi: sas: Skip opt_sectors when DMA reports no real optimization hint

Martin Wilck <[email protected]>
scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()

Ruoyu Wang <[email protected]>
mtd: slram: remove failed entries from the device list

Krzysztof Wilczyński <[email protected]>
proc: only bump parent nlink when registering directories

Zishun Yi <[email protected]>
riscv: cacheinfo: Fix node reference leak in populate_cache_leaves

Aaron Tomlin <[email protected]>
mips: sched: Fix CPUMASK_OFFSTACK memory corruption

WenTao Liang <[email protected]>
power: supply: charger-manager: fix refcount leak in is_full_charged()

Tristan Madani <[email protected]>
ntfs3: fix out-of-bounds read in decompress_lznt

Michael Bommarito <[email protected]>
ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

Michael Bommarito <[email protected]>

    ntfs3: cap RESTART_TABLE free-chain walker at rt->used

Michael Bommarito <[email protected]>

    fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}

Michael Bommarito <[email protected]>
fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow

Konstantin Komarov <[email protected]>
fs/ntfs3: validate lcns_follow in log_replay conversion

Konstantin Komarov <[email protected]>
fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

Michael Bommarito <[email protected]>

    fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass

Konstantin Komarov <[email protected]>
fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

Zhan Xusheng <[email protected]>
fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename

Ma Ke <[email protected]>
power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak

Maciej W. Rozycki <[email protected]>
MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix device reference leak in probe

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix kfree() of static object

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix gio device memory leak

Chuck Lever <[email protected]>
lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure

Chuck Lever <[email protected]>
lockd: Plug nlm_file leak when nlm_do_fopen() fails

Abdun Nihaal <[email protected]>
nvdimm/btt: Free arena sub-allocations on discover_arenas() error path

Abdun Nihaal <[email protected]>
nvdimm/btt: Free arenas on btt_init() error paths

Junrui Luo <[email protected]>
jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

Pauli Virtanen <[email protected]>
Bluetooth: SCO: hold sk properly in sco_conn_ready

Pauli Virtanen <[email protected]>
Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready

Bartosz Golaszewski <[email protected]>
mfd: tps6586x: Fix OF node refcount

Sven Eckelmann <[email protected]>
batman-adv: tt: prevent TVLV OOB check overflow

Sven Eckelmann <[email protected]>
batman-adv: frag: fix primary_if leak on failed linearization

Sven Eckelmann <[email protected]>
batman-adv: frag: free unfragmentable packet

Sven Eckelmann <[email protected]>
batman-adv: fix VLAN priority offset

Sven Eckelmann <[email protected]>
batman-adv: tt: avoid request storms during pending request

Sven Eckelmann <[email protected]>
batman-adv: dat: fix tie-break for candidate selection

Sven Eckelmann <[email protected]>
batman-adv: dat: ensure accessible eth_hdr proto field

Sven Eckelmann <[email protected]>
batman-adv: bla: reacquire gw address after skb realloc

Sven Eckelmann <[email protected]>
batman-adv: dat: acquire ARP hw source only after skb realloc

Sven Eckelmann <[email protected]>

    batman-adv: access unicast_ttvn skb->data only after skb realloc

Sven Eckelmann <[email protected]>
batman-adv: gw: acquire ethernet header only after skb realloc

Sandipan Das <[email protected]>
perf/x86/amd/lbr: Fix kernel address leakage

Thorsten Blum <[email protected]>
x86/boot: Reject too long acpi_rsdp= values

Thorsten Blum <[email protected]>
x86/boot: Validate console=uart8250 baud rate to fix early boot hang

Ali Ahmet MEMIS <[email protected]>
tools/power/x86/intel-speed-select: Harden daemon pidfile open

Guangshuo Li <[email protected]>
mfd: sm501: Fix reference leak on failed device registration

Armin Wolf <[email protected]>
leds: uleds: Fix potential buffer overread

Stephen Smalley <[email protected]>
selinux: check connect-related permissions on TCP Fast Open

Wang Jun <[email protected]>
soc: fsl: qe: panic on ioremap() failure in qe_reset()

Siddharth Vadapalli <[email protected]>
soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy

Guangshuo Li <[email protected]>
gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

Xiang Mei (Microsoft) <[email protected]>
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()

Wyatt Feng <[email protected]>
netfilter: xt_nat: reject unsupported target families

Yizhou Zhao <[email protected]>
netfilter: ecache: fix inverted time_after() check

Yizhou Zhao <[email protected]>
netfilter: nf_conncount: fix zone comparison in tuple dedup

Xiang Mei <[email protected]>
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

Florian Westphal <[email protected]>
netfilter: nf_nat_sip: reload possible stale data pointer

Haoze Xie <[email protected]>
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

Wyatt Feng <[email protected]>
netfilter: xt_cluster: reject template conntracks in hash match

David Carlier <[email protected]>
netfilter: nfnl_cthelper: apply per-class values when updating policies

Muhammad Bilal <[email protected]>
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback

Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

Abdun Nihaal <[email protected]>
fbdev: tridentfb: fix potential memory leak in trident_pci_probe()

Abdun Nihaal <[email protected]>
fbdev: nvidia: fix potential memory leak in nvidiafb_probe()

Abdun Nihaal <[email protected]>
fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()

Abdun Nihaal <[email protected]>
fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()

Abdun Nihaal <[email protected]>
fbdev: uvesafb: fix potential memory leak in uvesafb_probe()

Abdun Nihaal <[email protected]>
fbdev: s3fb: fix potential memory leak in s3_pci_probe()

Abdun Nihaal <[email protected]>
fbdev: i740fb: fix potential memory leak in i740fb_probe()

Abdun Nihaal <[email protected]>
fbdev: radeon: fix potential memory leak in radeonfb_pci_register()

Li RongQing <[email protected]>
fbdev: sm712: Fix operator precedence in big_swap macro

Abdun Nihaal <[email protected]>
fbdev: hecubafb: fix potential memory leak in hecubafb_probe()

Abdun Nihaal <[email protected]>
fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()

Abdun Nihaal <[email protected]>
fbdev: metronomefb: fix potential memory leak in metronomefb_probe()

Sean Christopherson <[email protected]>
KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs

Matthew Rosato <[email protected]>
KVM: s390: pci: Fix handling of AIF enable without AISB

Hyunwoo Kim <[email protected]>
KVM: arm64: vgic: Check the interrupt is still ours before migrating it

Haoxiang Li <[email protected]>
KVM: s390: pci: Fix GISC refcount leak on AIF enable failure

Nickolay Goppen <[email protected]>
arm64: dts: qcom: sdm630: describe adsp_mem region properly

Mark Rutland <[email protected]>
arm64: fpsimd: Fix type mismatch in sve_{save,load}_state()

Yong Wang <[email protected]>
net: ife: require ETH_HLEN to be pullable in ife_decode()

Zhengchuan Liang <[email protected]>
net: atm: reject out-of-range traffic classes in QoS validation

Michael Bommarito <[email protected]>
net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get

Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc

Zhang Tianci <[email protected]>
vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter

Wentao Liang <[email protected]>
mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()

Guangshuo Li <[email protected]>
smb: client: fix overflow in passthrough ioctl bounds check

Harman Kalra <[email protected]>
octeontx2-af: fix VF bringup affecting PF promiscuous state

Li RongQing <[email protected]>
net/mlx5: Fix L3 tunnel entropy refcount leak

Timur Tabi <[email protected]>
regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK

Douglas Anderson <[email protected]>
regulator: core: Make regulator_lock_two() logic easier to follow

Cao Guanghui <[email protected]>
dm era: fix NULL pointer dereference in metadata_open()

Guangshuo Li <[email protected]>
cifs: validate DFS referral string offsets

Julian Anastasov <[email protected]>
ipvs: ensure inner headers in ICMP errors are in headroom

Yizhou Zhao <[email protected]>
ipvs: fix PMTU for GUE/GRE tunnel ICMP errors

Yizhou Zhao <[email protected]>
ipvs: use parsed transport offset in TCP state lookup

Yizhou Zhao <[email protected]>
ipvs: pass parsed transport offset to state handlers

Eric Dumazet <[email protected]>
ipv6: mcast: Fix potential UAF in MLD delayed work

Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Replace locking comments with lockdep annotations.

Suman Ghosh <[email protected]>
octeontx2-pf: check DMAC extraction support before filtering

Samuel Moelius <[email protected]>
net/sched: cake: reject overhead values that underflow length

Enrico Pozzobon <[email protected]>
net: usb: lan78xx: disable VLAN filter in promiscuous mode

Oleksij Rempel <[email protected]>
net: usb: lan78xx: move functions to avoid forward definitions

Hui Wang <[email protected]>
ring-buffer: Fix event length with forced 8-byte alignment

Weiming Shi <[email protected]>

    Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

Pauli Virtanen <[email protected]>
Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length

Cen Zhang <[email protected]>
Bluetooth: MGMT: Fix adv monitor add failure cleanup

Eric Dumazet <[email protected]>
amt: fix size calculation in amt_get_size()

Xiang Mei <[email protected]>
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

Xiang Mei <[email protected]>
net: qualcomm: rmnet: validate MAP frame length before ingress parsing

Daniele Palmas <[email protected]>
net: qualcomm: rmnet: add tx packets aggregation

Shigeru Yoshida <[email protected]>
qede: fix off-by-one in BD ring consumption on build_skb failure

Feng Liu <[email protected]>
net/mlx5e: Fix HV VHCA stats agent registration race

Feng Liu <[email protected]>
net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation

Wyatt Feng <[email protected]>
netfilter: xt_connmark: reject invalid shift parameters

Zhixing Chen <[email protected]>
netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop

Feng Wu <[email protected]>
netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()

Wyatt Feng <[email protected]>
netfilter: xt_u32: reject invalid shift counts

Qihang <[email protected]>
gue: validate REMCSUM private option length

Xiang Mei <[email protected]>
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

Anshuman Khandual <[email protected]>
arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()

Ryan Roberts <[email protected]>
arm64/mm: convert ptep_clear() to ptep_get_and_clear()

Lee Jones <[email protected]>
HID: core: Fix OOB read in hid_get_report for numbered reports

Georgiy Osokin <[email protected]>
HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

Myeonghun Pak <[email protected]>
ata: sata_gemini: unwind clocks on IDE pinctrl errors

David Howells <[email protected]>
afs: Fix unchecked-length string display in debug statement

David Howells <[email protected]>
afs: Fix the volume AFS_VOLUME_RM_TREE is set on

David Howells <[email protected]>
afs: Fix vllist leak

David Howells <[email protected]>
afs: Fix callback service message parsers to pass through -EAGAIN

Zilin Guan <[email protected]>
afs: use kvfree() to free memory allocated by kvcalloc()

Dan Carpenter <[email protected]>
afs: Fix error code in afs_extract_vl_addrs()

Samuel Moelius <[email protected]>
net/sched: hhf: clear heavy-hitter state on reset

Viacheslav Bocharov <[email protected]>
pinctrl: meson: restore non-sleeping GPIO access

Vladimir Zapolskiy <[email protected]>
gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe

Sechang Lim <[email protected]>
net/sched: act_bpf: use rcu_dereference_bh() to read the filter

Gleb Markov <[email protected]>
cxgb4: Fix decode strings dump for T6 adapters

Longjun Tang <[email protected]>
virtio_net: disable cb when NAPI is busy-polled

Qingshuang Fu <[email protected]>
irqchip/ts4800: Fix missing chained handler cleanup on remove

Yuho Choi <[email protected]>
irqchip/gic-v3-its: Fix OF node reference leak

Martin Kaiser <[email protected]>
tracing: eprobe: read the complete FILTER_PTR_STRING pointer

Masami Hiramatsu (Google) <[email protected]>
tracing/events: Fix to check the simple_tsk_fn creation

Ido Schimmel <[email protected]>
bridge: stp: Fix a potential use-after-free when deleting a bridge

Jamal Hadi Salim <[email protected]>
net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF

Rosen Penev <[email protected]>
net: gianfar: dispose irq mappings on probe failure and device removal

Petr Wozniak <[email protected]>
net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy

Xiang Mei <[email protected]>
usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()

Matti Vaittinen <[email protected]>
hwmon: adm1275: Prevent reading uninitialized stack

Wei Fang <[email protected]>
net: enetc: check the number of BDs needed for xdp_frame

Matvey Kovalev <[email protected]>

    qede: fix out-of-bounds check for cqe->len_list[]

Nuoqi Gui <[email protected]>
seg6: validate SRH length before reading fixed fields

Pengpeng Hou <[email protected]>
gpio: htc-egpio: use managed gpiochip registration

Pengpeng Hou <[email protected]>
gpio: mvebu: fail probe if gpiochip registration fails

Pengpeng Hou <[email protected]>
spi: sh-msiof: abort transfers when reset times out

Martin Kaiser <[email protected]>
tracing: probes: fix typo in a log message

Rob Herring (Arm) <[email protected]>
dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback

Shengjiu Wang <[email protected]>
ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count

Ruoyu Wang <[email protected]>
net: sungem: fix probe error cleanup

Yun Zhou <[email protected]>
net: mvneta: re-enable percpu interrupt on resume

Haoxiang Li <[email protected]>
rtc: cmos: unregister HPET IRQ handler on probe failure

Fredrik M Olsson <[email protected]>
rtc: ds1307: Fix off-by-one issue with wday for rx8130

Huiwen He <[email protected]>
smb/client: preserve errors from smb2_set_sparse()

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in disable_policy sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in forwarding sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in ignore_routes_with_linkdown sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in disable_ipv6 sysctl

Jamal Hadi Salim <[email protected]>
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

Eric Dumazet <[email protected]>
veth: fix NAPI leak in XDP enable error path

Aleksandrova Alyona <[email protected]>
net: dsa: sja1105: round up PTP perout pin duration

Xiang Mei <[email protected]>
net, bpf: check master for NULL in xdp_master_redirect()

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Add security_locked_down() check to pci_mmap_resource()

Koichiro Den <[email protected]>
NTB: epf: Fix doorbell bitmask and IRQ vector handling

Koichiro Den <[email protected]>
NTB: epf: Report 0-based doorbell vector via ntb_db_event()

Koichiro Den <[email protected]>
NTB: epf: Make db_valid_mask cover only real doorbell bits

Runyu Xiao <[email protected]>

    netfilter: nft_synproxy: stop bypassing the priv->info snapshot

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

Mathias Krause <[email protected]>
netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()

Bradley Morgan <[email protected]>
bpf: Disable xfrm_decode_session hook attachment

Xu Kuohai <[email protected]>
bpf, lsm: Add disabled BPF LSM hook list

Kuniyuki Iwashima <[email protected]>
ipv4: fib: Don't ignore error route in local/main tables.

Xiang Mei <[email protected]>
ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().

Gil Portnoy <[email protected]>

    ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE

Stepan Ionichev <[email protected]>
rtc: msc313: fix NULL deref in shared IRQ handler at probe

Lukasz Czapnik <[email protected]>
ice: fix AQ error code comparison in ice_set_pauseparam()

Dawid Osuchowski <[email protected]>
ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()

Manivannan Sadhasivam <[email protected]>
PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0

Manivannan Sadhasivam <[email protected]>
PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0

Xiang Mei <[email protected]>
drm/edid: fix OOB read in drm_parse_tiled_block()

Avinash Duduskar <[email protected]>
bpf: zero-initialize the fib lookup flow struct

Nuoqi Gui <[email protected]>
bpf: Fix stack slot index in nospec checks

Ronan Dalton <[email protected]>

    rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231

Antoni Pokusinski <[email protected]>

    rtc: abx80x: fix the RTC_VL_CLR clearing all status flags

Geetha sowjanya <[email protected]>
octeontx2-pf: mcs: Fix mcs resources free on PF shutdown

Subbaraya Sundeep <[email protected]>
octeontx2-pf: Clear stats of all resources when freeing resources

Geetha sowjanya <[email protected]>
octeontx2-af: mcs: Fix unsupported secy stats read

Ruoyu Wang <[email protected]>
net: marvell: prestera: initialize err in prestera_port_sfp_bind

Aboorva Devarajan <[email protected]>
selftests/mm: fix exclusive_cow test fork() handling

Sayali Patil <[email protected]>
selftests/mm: allow PUD-level entries in compound testcase of hmm tests

Sayali Patil <[email protected]>
selftests/mm: clarify alternate unmapping in compaction_test

Bhargav Joshi <[email protected]>
irqchip/crossbar: Fix parent domain resource leak

Florian Westphal <[email protected]>
netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak

Florian Westphal <[email protected]>
netfilter: nf_reject: skip iphdr options when looking for icmp header

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: annotate "pos" for concurrent readers/writers

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: Fix data race between add and dump in all hash types

Abd-Alrhman Masalkhi <[email protected]>
md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry

Aleksandr Nogikh <[email protected]>
ieee802154: fix kernel-infoleak in dgram_recvmsg()

Ivan Abramov <[email protected]>

    ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()

Xu Rao <[email protected]>
ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()

Andy Shevchenko <[email protected]>
ACPI: resource: Amend kernel-doc style

Ricardo Neri <[email protected]>
thermal: intel: Fix dangling resources on thermal_throttle_online() failure

Breno Leitao <[email protected]>
arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS

Yun Zhou <[email protected]>
flow_dissector: check device type before reading ETH_ADDRS

Ioana Ciornei <[email protected]>
dpaa2-switch: fix VLAN upper check not rejecting bridge join

Xiang Mei <[email protected]>
virtio-net: fix len check in receive_big()

Xuan Zhuo <[email protected]>
virtio_ring: introduce dma sync api for virtqueue

Xuan Zhuo <[email protected]>
virtio_ring: introduce dma map api for virtqueue

Xuan Zhuo <[email protected]>
virtio_ring: introduce virtqueue_set_dma_premapped()

Quang Nguyen <[email protected]>
spi: rpc-if: Use correct device for hardware reinitialization on resume

Mark Tomlinson <[email protected]>
PCI: iproc: Restore .map_irq() for the platform bus driver

Xin Long <[email protected]>
sctp: hold socket lock when dumping endpoints in sctp_diag

Jakub Kicinski <[email protected]>
net: psample: fix info leak in PSAMPLE_ATTR_DATA

Ratheesh Kannoth <[email protected]>
octeontx2-pf: Fix leak of SQ timestamp buffer on teardown

Thadeu Lima de Souza Cascardo <[email protected]>
drm/amdgpu: initialize irq.lock spinlock earlier

Mario Limonciello <[email protected]>
drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

Yunxiang Li <[email protected]>
drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free

Sen Wang <[email protected]>
ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Use snprintf() for guestmount path construction

Eric Dumazet <[email protected]>
xfrm: validate selector family and prefixlen during match

Eric Dumazet <[email protected]>

    xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]

Mike Yu <[email protected]>
xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path

Steffen Klassert <[email protected]>
xfrm: Use the XFRM_GRO to indicate a GRO call on input

Leon Romanovsky <[email protected]>
xfrm: add new packet offload flag

Jisheng Zhang <[email protected]>
spi: dw: fix wrong BAUDR setting after resume

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Bounds-check array offsets in bpil_offs_to_addr()

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Use snprintf() for root_dir path construction

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()

Pengpeng Hou <[email protected]>
sparc: led: avoid trimming a newline from empty writes

John Johansen <[email protected]>
apparmor: fix label can not be immediately before a declaration

Adrian Hunter <[email protected]>
i3c: master: Prevent reuse of dynamic address on device add failure

Zygmunt Krynicki <[email protected]>
apparmor: put secmark label after secid lookup

Zygmunt Krynicki <[email protected]>
apparmor: aa_getprocattr free procattr leak on format failure

Maxime Bélair <[email protected]>
apparmor: fix potential UAF in aa_replace_profiles

Ryan Lee <[email protected]>
apparmor: grab ns lock and refresh when looking up changehat child profiles

Zygmunt Krynicki <[email protected]>
apparmor: aa_label_alloc use aa_label_free on alloc failure

Ruoyu Wang <[email protected]>
apparmor: check label build before no_new_privs test

Andrew Morton <[email protected]>
security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref()

Yuanhe Shu <[email protected]>
Revert "PCI/MSI: Unmap MSI-X region on error"

Manivannan Sadhasivam <[email protected]>
PCI: mediatek: Use actual physical address instead of virt_to_phys()

Ryder Lee <[email protected]>
PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Add bounds checks to read_build_id() note iteration in minimal build

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Add bounds checks to elf_read_build_id() note iteration

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix mount_overload() snprintf truncation and toupper range

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix filename__write_int() writing uninitialized stack data

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Fix thread__set_comm_from_proc() on empty comm file

Arnaldo Carvalho de Melo <[email protected]>
perf intel-pt: Fix snprintf size tracking bug in insn decoder

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Bounds-check .gnu_debuglink section data

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Fix signed overflow in sysfs__read_build_id() size check

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix missing null termination in filename__read_int/ull()

Arnaldo Carvalho de Melo <[email protected]>
perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file

Arnaldo Carvalho de Melo <[email protected]>
perf pmu: Fix pmu_id() heap underwrite on empty identifier file

Chuck Lever <[email protected]>
xprtrdma: Return sendctx slot after Send preparation failure

Chuck Lever <[email protected]>
xprtrdma: Repost Receive buffers for malformed replies

Chuck Lever <[email protected]>
xprtrdma: Sanitize the reply credit grant after parsing

Chris Mason <[email protected]>
xprtrdma: Fix bcall rep leak and unbounded peek

Chuck Lever <[email protected]>
xprtrdma: Resize reply buffers before reposting receives

Chuck Lever <[email protected]>
xprtrdma: Document and assert reply-handler invariants

Chuck Lever <[email protected]>
xprtrdma: Check frwr_wp_create() during connect

Arnaldo Carvalho de Melo <[email protected]>
perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Fix idle-hist callchain display using wrong rb_first variant

Lad Prabhakar <[email protected]>
PCI: rcar-host: Remove unused LIST_HEAD(res)

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Fix get_max_num() size_t underflow on empty sysfs file

Li RongQing <[email protected]>
PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro

Mike Snitzer <[email protected]>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write

Mike Snitzer <[email protected]>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors

Dai Ngo <[email protected]>
NFSv4/pnfs: defer return_range callbacks until after inode unlock

Chuck Lever <[email protected]>
xprtrdma: Decouple req recycling from RPC completion

Chuck Lever <[email protected]>
xprtrdma: Use sendctx DMA state for Send signaling

Chuck Lever <[email protected]>
xprtrdma: Post receive buffers after RPC completion

Chuck Lever <[email protected]>
xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot

Chuck Lever <[email protected]>
xprtrdma: Avoid 250 ms delay on backlog wakeup

Chuck Lever <[email protected]>
xprtrdma: Remove temp allocation of rpcrdma_rep objects

Sagi Grimberg <[email protected]>
pNFS/filelayout: fix cheking if a layout is striped

Phillip Varney <[email protected]>
clk: qcom: a53: Corrected frequency multiplier for 1152MHz

Nuno Sá <[email protected]>
dmaengine: Fix possible use after free

Icenowy Zheng <[email protected]>
dmaengine: qcom: gpi: set DMA_PRIVATE capability

Arnaldo Carvalho de Melo <[email protected]>
perf c2c: Fix use-after-free in he__get_c2c_hists() error path

Arnaldo Carvalho de Melo <[email protected]>
perf mmap: Fix NULL deref in aio cleanup on alloc failure

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Replace BUG_ON and add NULL checks in replay event helpers

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Clean up idle_threads entry on init failure

Arnaldo Carvalho de Melo <[email protected]>
perf mmap: Guard cpu__get_node() return in aio_bind()

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Add bounds check to cpu__get_node()

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Fix NULL dereference in latency_runtime_event

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Replace BUG_ON on invalid CPU with graceful skip

Rui Qi <[email protected]>
perf: Fix off-by-one stack buffer overflow in kallsyms__parse()

Shengjiu Wang <[email protected]>
dmaengine: imx-sdma: Refine spba bus searching in probe

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add missing kdoc for ALLM parameters

Konstantin Komarov <[email protected]>
fs/ntfs3: add bounds check to run_get_highest_vcn()

Rosen Penev <[email protected]>
HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter

Yuho Choi <[email protected]>
clk: at91: keep securam node alive while mapping it

Sanjay Chitroda <[email protected]>

    iio: accel: mma8452: handle I2C read error(s) in mma8452_read()

Guilherme Ivo Bozi <[email protected]>
iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling

Joshua Crofts <[email protected]>
iio: magnetometer: ak8975: fix potential kernel stack memory leak

Joshua Crofts <[email protected]>
iio: light: si1133: prevent race condition on timeout

Joshua Crofts <[email protected]>
iio: light: si1133: reset counter to prevent race condition

Arnaldo Carvalho de Melo <[email protected]>
perf header: Sanity check HEADER_EVENT_DESC attr.size before swap

James Kim <[email protected]>
char: tlclk: fix use-after-free in tlclk_cleanup()

Seungjin Bae <[email protected]>
usb: host: max3421: Reject hub port requests for non-existent ports

Seungjin Bae <[email protected]>

    usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

Guangshuo Li <[email protected]>
staging: most: video: avoid double free on video register failure

Sergey Senozhatsky <[email protected]>
mailbox: mtk-adsp: fix UAF during device teardown

Andy Shevchenko <[email protected]>
phy: phy-can-transceiver: Check driver match and driver data against NULL

Sumit Kumar <[email protected]>
bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()

Rong Zhang <[email protected]>
PCI: loongson: Do not ignore downstream devices on external bridges

Ian Rogers <[email protected]>
perf sched: Add missing mmap2 handler in timehist

Rafael J. Wysocki <[email protected]>
platform/x86: xo15-ebook: Fix wakeup source and GPE handling

Rafael J. Wysocki <[email protected]>
x86/platform/olpc: xo15: Drop wakeup source on driver removal

Guixin Liu <[email protected]>
PCI: Check ROM header and data structure addr before accessing

Guixin Liu <[email protected]>
PCI: Introduce named defines for PCI ROM

Carlos Bilbao <[email protected]>
PCI/ASPM: Don't reconfigure ASPM entering low-power state

Leo Yan <[email protected]>
coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore

Yingchao Deng <[email protected]>
coresight: cti: Fix DT filter signals silently ignored

Alexandru Hossu <[email protected]>
staging: nvec: fix use-after-free in nvec_rx_completed()

Yizhou Zhao <[email protected]>

    net/9p: fix race condition on rdma->state in trans_rdma.c

Aleksandr Nogikh <[email protected]>
ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write

Guangshuo Li <[email protected]>
ksmbd: fix use-after-free in same_client_has_lease()

Eric Dumazet <[email protected]>

    tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

Eric Dumazet <[email protected]>
tipc: fix UAF in tipc_l2_send_msg()

Gui-Dong Han <[email protected]>
KEYS: Use acquire when reading state in keyring search

Aboorva Devarajan <[email protected]>
powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus

Aboorva Devarajan <[email protected]>
powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down

Aboorva Devarajan <[email protected]>
powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del

Yadan Fan <[email protected]>
MIPS: mm: Fix out-of-bounds write in maar_res_walk()

Sechang Lim <[email protected]>
bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check

Weiming Shi <[email protected]>
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

Leon Hwang <[email protected]>
bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket

Huiwen He <[email protected]>
smb/client: always return a value for FS_IOC_GETFLAGS

Jian Zhang <[email protected]>
cifs: remove all cifs files before kill super

Takashi Iwai <[email protected]>
ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()

Florian Westphal <[email protected]>
netfilter: nf_conncount: callers must hold rcu read lock

Runyu Xiao <[email protected]>
kcm: use WRITE_ONCE() when changing lower socket callbacks

Ovidiu Panait <[email protected]>
net: bcmgenet: Use weighted round-robin TX DMA arbitration

Dragos Tatulea <[email protected]>
net/mlx5: Check max_macs devlink param value against max capability

Sun Jian <[email protected]>
bpf: Run generic devmap egress prog on private skb

Aditya Garg <[email protected]>
net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check

Aditya Garg <[email protected]>
net: mana: initialize gdma queue id to INVALID_QUEUE_ID

Victor Nogueira <[email protected]>
net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

Victor Nogueira <[email protected]>
net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

Lucas Tsai <[email protected]>
power: supply: core: fix supplied_from allocations

Guangshuo Li <[email protected]>
ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO

Lars Pöschel <[email protected]>
spi: xilinx: use FIFO occupancy register to determine buffer size

Herbert Xu <[email protected]>
crypto: rng - Free default RNG on module exit

Felix Gu <[email protected]>
crypto: cavium/cpt - fix DMA cleanup using wrong loop index

Felix Gu <[email protected]>
crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

Dave Jiang <[email protected]>
cxl/test: Add check after kzalloc() memory in alloc_mock_res()

Michael Bommarito <[email protected]>
tipc: reject inverted service ranges from peer bindings

Michael Bommarito <[email protected]>
tipc: prevent snt_unacked underflow on CONN_ACK

Michael Bommarito <[email protected]>
tipc: require net admin for TIPCv2 netlink mutators

Victor Nogueira <[email protected]>
net/sched: sch_hfsc: Don't make class passive twice

Xin Long <[email protected]>
sctp: validate embedded address parameter length

Xiang Mei <[email protected]>
bridge: cfm: reject invalid CCM interval at configuration time

Kuniyuki Iwashima <[email protected]>
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

Jamal Hadi Salim <[email protected]>
net/sched: cls_flow: Dont expose folded kernel pointers

HyeongJun An <[email protected]>
ASoC: tegra: tegra210_ahub: Validate written enum value

HyeongJun An <[email protected]>
ASoC: fsl: fsl_audmix: Validate written enum values

HyeongJun An <[email protected]>
ASoC: codecs: hdac_hdmi: Validate written enum value

Leon Romanovsky <[email protected]>
RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one

Maher Sanalla <[email protected]>
RDMA/mlx5: Fix undefined shift of user RQ WQE size

Patrisious Haddad <[email protected]>
RDMA/mlx5: Remove raw RSS QP restrack tracking

Maxwell Doose <[email protected]>
fs: efs: remove unneeded debug prints

Samuel Moelius <[email protected]>
Bluetooth: hci: validate codec capability element length

Weiming Shi <[email protected]>
Bluetooth: eir: Fix stack OOB write when prepending the Flags AD

Heiko Carstens <[email protected]>
s390/process: Fix kernel thread function pointer type

Daniel Borkmann <[email protected]>
bpf: Tighten cgroup storage cookie checks for prog arrays

Dave Jiang <[email protected]>
cxl/test: Fix integer overflow in mock LSA bounds checks

Yonghong Song <[email protected]>
selftests/bpf: Fix bpf_iter/task_vma test

Louis Scalbert <[email protected]>
bonding: 3ad: fix mux port state on oper down

longlong yan <[email protected]>
tools/virtio: check mmap return value in vringh_test

Qing Ming <[email protected]>
vhost/net: complete zerocopy ubufs only once

Zhang Tianci <[email protected]>
vduse: Requeue failed read to send_list head

Qihang Tang <[email protected]>
vhost/vdpa: validate virtqueue index in mmap and fault paths

Qihang Tang <[email protected]>
vduse: hold vduse_lock across IDR lookup in open path

Jason Gunthorpe <[email protected]>
IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified

Johannes Thumshirn <[email protected]>
btrfs: zoned: don't account data relocation space-info in statfs free space

David Laight <[email protected]>
fbdev: sm501fb: Fix buffer errors in OF binding code

Filipe Manana <[email protected]>
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

Bjoern A. Zeeb <[email protected]>

    wifi: mt76: fix argument to ieee80211_is_first_frag()

Wolfram Sang <[email protected]>
hwspinlock: qcom: avoid uninitialized struct members

Hui Zhu <[email protected]>
vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()

Luca Leonardo Scorcia <[email protected]>
pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39

Luca Leonardo Scorcia <[email protected]>
pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39

David Disseldorp <[email protected]>
scsi: target: Fix hexadecimal CHAP_I handling

Yuho Choi <[email protected]>
watchdog: unregister PM notifier on watchdog unregister

Al Viro <[email protected]>

    configfs: fix lockless traversals of ->s_children

Dmitry Vyukov <[email protected]>
firmware_loader: Fix recursive lock in device_cache_fw_images()

Felix Gu <[email protected]>
spi: ep93xx: fix double-free of zeropage on DMA setup failure

Jason Gunthorpe <[email protected]>
IB/mlx5: Properly support implicit ODP rereg_mr

Jason Gunthorpe <[email protected]>
IB/mlx5: Don't take the rereg_mr fallback without a new translation

Pengjie Zhang <[email protected]>
cpufreq: Documentation: fix conservative governor freq_step description

Yuho Choi <[email protected]>
ACPI: IPMI: Fix message kref handling on dead device

Kyle Zeng <[email protected]>
ALSA: seq: Clear variable event pointer on read

Takashi Iwai <[email protected]>
ALSA: seq: Add UMP support

Takashi Iwai <[email protected]>
ALSA: seq: Introduce SNDRV_SEQ_IOCTL_USER_PVERSION ioctl

Rui Qi <[email protected]>

    riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe

Tristan Madani <[email protected]>
wifi: wcn36xx: fix OOB read from short trigger BA firmware response

Tristan Madani <[email protected]>
wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

Tristan Madani <[email protected]>
wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

Leon Hwang <[email protected]>
bpf: Update transport_header when encapsulating UDP tunnel in lwt

Leon Hwang <[email protected]>
bpf: Check tail zero of bpf_prog_info

Jacob Moroni <[email protected]>
RDMA/irdma: Fix OOB read during CQ MR registration

Jason Gunthorpe <[email protected]>
IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()

Pablo Neira Ayuso <[email protected]>
netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp

Fernando Fernandez Mancera <[email protected]>
netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures

Joseph Qi <[email protected]>
ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()

Zhang Cen <[email protected]>
ocfs2/dlm: require a ref for locking_state debugfs open

Zhang Cen <[email protected]>
ocfs2: reject FITRIM ranges shorter than a cluster

Dmitry Antipov <[email protected]>
ocfs2: fix buffer head management in ocfs2_read_blocks()

Zhang Cen <[email protected]>
ocfs2: rebase copied fsdlm LVB pointers in locking_state

Sandipan Das <[email protected]>
perf/x86/amd/core: Always use the NMI latency mitigation

Woojin Ji <[email protected]>
bpftool: Use libbpf error code for flow dissector query

Al Viro <[email protected]>

    configfs_lookup(): don't leave ->s_dentry dangling on failure

Alexander Potapenko <[email protected]>

    lib/test_meminit: use && for bools

Guanyou.Chen <[email protected]>
sched: restore timer_slack_ns when resetting RT policy on fork

Sang-Heon Jeon <[email protected]>
mm/fake-numa: fix under-allocation detection in uniform split

Deepanshu Kartikey <[email protected]>
bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

Dan Carpenter <[email protected]>
scsi: pm8001: Fix error code in non_fatal_log_show()

Martin Wilck <[email protected]>
scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"

Alison Schofield <[email protected]>
nvdimm/btt: Handle preemption in BTT lane acquisition

Yuho Choi <[email protected]>
ARM: imx31: Fix IIM mapping leak in revision check

Yuho Choi <[email protected]>
ARM: imx3: Fix CCM node reference leak

Zhang Yi <[email protected]>
ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback

Chen Cheng <[email protected]>
md/raid10: reset read_slot when reusing r10bio for discard

Renjiang Han <[email protected]>
media: qcom: venus: relax encoder frame/blur step size on v6

Renjiang Han <[email protected]>
media: qcom: venus: relax encoder frame/blur dimension steps on v4

Renjiang Han <[email protected]>
media: qcom: venus: drop extra padding in NV12 raw size calculation

Tristan Madani <[email protected]>
RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path

Tristan Madani <[email protected]>
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe

zhoumin <[email protected]>
EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info

Jessica Zhang <[email protected]>
drm/msm/dp: Fix the ISR_* enum values

Jessica Zhang <[email protected]>
drm/msm/dp: fix HPD state status bit shift value

Weili Qian <[email protected]>
crypto: hisilicon/qm - disable error report before flr

Tetsuo Handa <[email protected]>

    ocfs2: kill osb->system_file_mutex lock

ZhengYuan Huang <[email protected]>
ocfs2: don't BUG_ON an invalid journal dinode

Dan Carpenter <[email protected]>
rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()

Davidlohr Bueso <[email protected]>
dax/kmem: account for partial discontiguous resource upon removal

Carlos Llamas <[email protected]>
libbpf: Fix UAF in strset__add_str()

Michael Bommarito <[email protected]>
libbpf: Harden parse_vma_segs() path parsing

Timur Tabi <[email protected]>
drm/nouveau/bios: specify correct display fuse register for Ampere and Ada

Mikko Perttunen <[email protected]>
drm/tegra: Fix iommu_map_sgtable() return value check

Mikko Perttunen <[email protected]>
gpu: host1x: Fix iommu_map_sgtable() return value check

Felix Gu <[email protected]>
drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()

Mikko Perttunen <[email protected]>
gpu: host1x: Allow entries in BO caches to be freed

Jiayuan Chen <[email protected]>
net/sched: cls_bpf: prevent unbounded recursion in offload rollback

Eric Dumazet <[email protected]>
ipv6: guard against possible NULL deref in __in6_dev_stats_get()

Breno Leitao <[email protected]>
workqueue: drop spurious '*' from print_worker_info() fn declaration

Nilay Shroff <[email protected]>
nvme-multipath: fix flex array size in struct nvme_ns_head

Zhang Cen <[email protected]>
ALSA: seq: midi: Serialize output teardown with event_input

Miquel Raynal <[email protected]>
mtd: spi-nor: Drop duplicate Kconfig dependency

Rosen Penev <[email protected]>
mips: n64: add __iomem for writel call

Rosen Penev <[email protected]>
mips: ralink: mt7621: add missing __iomem

Maciej W. Rozycki <[email protected]>
MIPS: DEC: Remove do_IRQ() call indirection

Maciej W. Rozycki <[email protected]>
MIPS: Fix big-endian stack argument fetching in o32 wrapper

Jiakai Xu <[email protected]>
PM: sleep: Use complete() in device_pm_sleep_init()

Tao Cui <[email protected]>
RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup

Lianfa Weng <[email protected]>
RDMA/hns: Fix warning in poll cq direct mode

Guangshuo Li <[email protected]>
IB/mlx4: Fix refcount leak in add_port() error path

Jacob Moroni <[email protected]>
RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

Samuel Holland <[email protected]>
bus: sunxi-rsb: Always check register address validity

Ronaldo Nunez <[email protected]>
pwm: imx27: Fix variable truncation in .apply()

Lifeng Zheng <[email protected]>
cpufreq: conservative: Simplify frequency limit handling

Pengjie Zhang <[email protected]>
cpufreq: Documentation: fix sampling_down_factor range

Zhang Yuwei <[email protected]>
driver core: Use mod_delayed_work to prevent lost deferred probe work

Stepan Ionichev <[email protected]>
device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()

Geert Uytterhoeven <[email protected]>
firmware: arm_scmi: Fix OOB in scmi_power_name_get()

Sven Püschel <[email protected]>
media: rockchip: rga: fix too small buffer size

Eric Dumazet <[email protected]>

    net/sched: sch_drr: annotate data-races around cl->deficit

Greg Kroah-Hartman <[email protected]>
sysfs: clamp show() return value in sysfs_kf_read()

Sudeep Holla <[email protected]>
firmware: arm_scmi: Read sensor config as 32-bit value

Zilin Guan <[email protected]>
media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()

Sara Venkatesh <[email protected]>
RDMA/srpt: fix integer overflow in immediate data length check

Prathamesh Deshpande <[email protected]>
RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

Alexander Chesnokov <[email protected]>
RDMA/hns: Fix arithmetic overflow in calc_hem_config()

Linmao Li <[email protected]>
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD

Eric Dumazet <[email protected]>
net/sched: sch_htb: annotate data-races (I)

Eric Dumazet <[email protected]>

    net/sched: sch_htb: do not change sch->flags in htb_dump()

Sean Christopherson <[email protected]>
crypto: ccp - Treat zero-length cert chain as query for blob lengths

Eric Dumazet <[email protected]>
net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()

Rafael J. Wysocki <[email protected]>
thermal: hwmon: Fix critical temperature attribute removal

Pengpeng Hou <[email protected]>
evm: terminate and bound the evm_xattrs read buffer

Lin He <[email protected]>
drm/hisilicon/hibmc: use clock to look up the PLL value

Lin He <[email protected]>
drm/hisilicon/hibmc: move display contrl config to hibmc_probe()

Cristian Marussi <[email protected]>
clk: scmi: Fix clock rate rounding

Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host

Sean Christopherson <[email protected]>
iommu/amd: Fix a stale comment about which legacy mode is user visible

Weiming Shi <[email protected]>
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

Thorsten Blum <[email protected]>
crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve

Lothar Rubusch <[email protected]>
crypto: atmel-sha204a - fix blocking and non-blocking rng logic

Kuniyuki Iwashima <[email protected]>
vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

Weixin Guo <[email protected]>
arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc

Felix Gu <[email protected]>
pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path

Samuel Holland <[email protected]>
media: cedrus: Fix failure to clean up hardware on probe failure

Felix Gu <[email protected]>
watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure

Yingjie Gao <[email protected]>
watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH

Jihed Chaibi <[email protected]>
ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint

Tristan Madani <[email protected]>
wifi: ath9k: fix OOB access from firmware tx status queue ID

Xingjing Deng <[email protected]>
kconfig: fix potential NULL pointer dereference in conf_askvalue

Tristan Madani <[email protected]>
wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer

Danilo Krummrich <[email protected]>

    driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

Jon Hunter <[email protected]>
arm64: tegra: Fix Tegra234 MGBE PTP clock

Louis Kotze <[email protected]>
wifi: cfg80211: fix grammar in MLO group key error message

Baolin Liu <[email protected]>
Documentation: proc: fix section numbering in table of contents

Aaron Tomlin <[email protected]>
libbpf: Report error when a negative kprobe offset is specified

Yuho Choi <[email protected]>
drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

Werner Kasselman <[email protected]>
drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()

Tomi Valkeinen <[email protected]>
drm/tidss: Drop extra drm_mode_config_reset() call

Ian Bridges <[email protected]>
fbcon: fix NULL pointer dereference for a console without vc_data

David Howells <[email protected]>
afs: Fix further netns teardown to cancel the preallocation charger

Matvey Kovalev <[email protected]>
afs: fix NULL pointer dereference in afs_get_tree()

David Howells <[email protected]>
afs: Fix netns teardown to cancel the preallocation charger

Matthias Feser <[email protected]>
serial: 8250_omap: clear rx_running on zero-length DMA completes

Stephan Gerhold <[email protected]>
serial: msm: Disable DMA for kernel console UART

Guoniu Zhou <[email protected]>
dt-bindings: power: imx93: Add MIPI PHY power domain

Chen-Yu Tsai <[email protected]>
dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties

Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix buffer sequence in frame gaps

Ricardo Ribalda <[email protected]>
media: uvcvideo: Avoid partial metadata buffers

Eric Biggers <[email protected]>
crypto: hisi-trng - Remove crypto_rng interface

Eric Biggers <[email protected]>
crypto: af_alg - Remove zero-copy support from skcipher and aead

Eric Biggers <[email protected]>
crypto: crypto4xx - Remove insecure and unused rng_alg

Herbert Xu <[email protected]>
crypto: crypto4xx - Remove ahash-related code

Stephen Dolan <[email protected]>
x86/mm: Fix check/use ordering in switch_mm_irqs_off()

Eric Biggers <[email protected]>
crypto: sun4i-ss - Remove insecure and unused rng_alg

Sagi Grimberg <[email protected]>
nvmet-tcp: Fix potential UAF when ddgst mismatch

Shivam Kumar <[email protected]>
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

Vladimir Oltean <[email protected]>
net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths

Yichong Chen <[email protected]>
tools/mm/slabinfo: fix total_objects attribute name

Muhammet Kaan KILINÇ <[email protected]>

    crypto: algif_skcipher - force synchronous processing on trees without ctx->state

Shashank A P <[email protected]>
fs: quota: create dedicated workqueue for quota_release_work

Adam Li <[email protected]>
sched/fair: Only update stats for allowed CPUs when looking for dst group

ChenXiaoSong <[email protected]>
smb/server: do not require delete access for non-replacing links

Darrick J. Wong <[email protected]>
xfs: resample the data fork mapping after cycling ILOCK

Weiming Shi <[email protected]>
xfs: fail recovery on a committed log item with no regions

Shoichiro Miyamoto <[email protected]>
smb: client: reject overlapping data areas in SMB2 responses

Wongi Lee <[email protected]>
ipv4: account for fraggap on the paged allocation path

Joanne Koong <[email protected]>
fuse: re-lock request before returning from fuse_ref_folio()

Alberto Ruiz <[email protected]>
fuse: fix device node leak in cuse_process_init_reply()

Michael Bommarito <[email protected]>
RDMA/siw: bound Read Response placement to the RREAD length

Zhenhao Wan <[email protected]>
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

Dmitry Torokhov <[email protected]>
Input: maplecontrol - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: maplemouse - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: maple_keyb - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: mms114 - fix multi-touch slot corruption

Florian Fuchs <[email protected]>
Input: maplemouse - fix NULL pointer dereference in open()

Bryam Vargas <[email protected]>
Input: touchwin - reset the packet index on every complete packet

Bryam Vargas <[email protected]>
Input: iforce - bound the device-reported force-feedback effect index

Bryam Vargas <[email protected]>
Input: goodix - clamp the device-reported contact count

Ranjan Kumar <[email protected]>
Input: elan_i2c - prevent division by zero and arithmetic underflow

Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

Haoxiang Li <[email protected]>
Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure

Guillermo Rodríguez <[email protected]>
i2c: stm32f7: truncate clock period instead of rounding it

Johan Hovold <[email protected]>
i2c: core: fix adapter deregistration race

Mikhail Gavrilov <[email protected]>
udmabuf: fix DMA direction mismatch in release_udmabuf()

Sean Christopherson <[email protected]>
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

Sean Christopherson <[email protected]>
KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs

Koichiro Den <[email protected]>
NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()

Bryam Vargas <[email protected]>
exfat: bound uniname advance in exfat_find_dir_entry()

Andrii Kuchmenko <[email protected]>
module: decompress: check return value of module_extend_max_pages()

Benjamin Coddington <[email protected]>
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

Huihui Huang <[email protected]>
tracing: Prevent out-of-bounds read in glob matching

Janne Grunau <[email protected]>
watchdog: apple: Add "apple,t8103-wdt" compatible

Vasily Khoruzhick <[email protected]>
EDAC/i10nm: Don't fail probing if ADXL is missing

Carlos Song <[email protected]>
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

Carlos Song <[email protected]>
spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()

Paul Louvel <[email protected]>
crypto: talitos - move code in current_desc_hdr() into a standalone function

Paul Louvel <[email protected]>
crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function

Paul Louvel <[email protected]>
crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function

Paul Louvel <[email protected]>
crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1

Paul Louvel <[email protected]>
crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header

Eric Biggers <[email protected]>
crypto: drbg - Fix the fips_enabled priority boost

Eric Biggers <[email protected]>
crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels

Eric Biggers <[email protected]>
crypto: drbg - Fix returning success on failure in CTR_DRBG

Ruijie Li <[email protected]>
crypto: pcrypt - restore callback for non-parallel fallback

Anastasia Tishchenko <[email protected]>
crypto: ecc - Fix carry overflow in vli multiplication

Thorsten Blum <[email protected]>
crypto: caam - use print_hex_dump_devel to guard key hex dumps again

Thorsten Blum <[email protected]>
crypto: caam - use print_hex_dump_devel to guard key hex dumps

Bryam Vargas <[email protected]>
isofs: bound Rock Ridge symlink components to the SL record

Bryam Vargas <[email protected]>
partitions: aix: bound the pp_count scan to the ppe array

Qu Wenruo <[email protected]>
btrfs: do not trim a device which is not writeable

Achkinazi, Igor <[email protected]>
nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks

Mikulas Patocka <[email protected]>
dm-ioctl: report an error if a device has no table

Bryam Vargas <[email protected]>
udf: validate sparing table length as an entry count, not a byte count

Bryam Vargas <[email protected]>
udf: validate VAT header length against the VAT inode size

Michael Bommarito <[email protected]>
udf: validate free block extents against the partition length

Heinrich Schuchardt <[email protected]>
efivarfs: fix statfs() on efivarfs

Anisse Astier <[email protected]>
efivarfs: expose used and total size

Liviu Stan <[email protected]>
iio: temperature: ltc2983: Fix n_wires default bypassing rotation check

Paul Menzel <[email protected]>
usb: typec: ucsi: cancel pending work on system suspend

Fan Wu <[email protected]>
usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

Madhu M <[email protected]>
usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode

Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Invert DisplayPort role assignment

Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

Shuangpeng Bai <[email protected]>
usb: typec: class: drop PD lookup reference

Myeonghun Pak <[email protected]>
usb: typec: anx7411: use devm_pm_runtime_enable()

Sam Day <[email protected]>
usbip: vudc: fix NULL deref in vep_dequeue()

Yichong Chen <[email protected]>
usbip: tools: support SuperSpeedPlus devices

Xu Rao <[email protected]>
USB: usb-storage: ene_ub6250: restore media-ready check

Johan Hovold <[email protected]>
USB: ulpi: fix memory leak on registration failure

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix write buffer corruption

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix hard lockup on disconnect

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix broken rx after throttle

Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE990D50 compositions

Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix information leak

Haoxiang Li <[email protected]>
usb: mtu3: unmap request DMA on queue failure

Myeonghun Pak <[email protected]>
USB: misc: uss720: unregister parport on probe failure

Xu Rao <[email protected]>
USB: storage: include US_FL_NO_SAME in quirks mask

Myeonghun Pak <[email protected]>
usb: sl811-hcd: disable controller wakeup on remove

Johan Hovold <[email protected]>
USB: legousbtower: fix use-after-free on disconnect race

Erich E. Hoover <[email protected]>
USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD

Johan Hovold <[email protected]>
USB: iowarrior: fix use-after-free on disconnect

Johan Hovold <[email protected]>
USB: ldusb: fix use-after-free on disconnect race

Johan Hovold <[email protected]>
USB: idmouse: fix use-after-free on disconnect race

Jimmy Hu <[email protected]>
usb: gadget: udc: Fix use-after-free in gadget_match_driver

Maoyi Xie <[email protected]>
usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

WenTao Liang <[email protected]>
usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()

Rodrigo Lugathe da Conceição Alves <[email protected]>
USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub

Haoxiang Li <[email protected]>
usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()

Jared Baldridge <[email protected]>
usb: cdc_acm: Add quirk for Uniden BC125AT scanner

Maoyi Xie <[email protected]>
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

Dawei Feng <[email protected]>
bpf: Restore sysctl new-value from 1 to 0

Zhao Zhang <[email protected]>
bpf: Reject fragmented frames in devmap

Alexey Nepomnyashih <[email protected]>
xfs: fix unreachable BIGTIME check in dquot flush validation

Yousef Alhouseen <[email protected]>
xfs: use null daddr for unset first bad log block

Deepanshu Kartikey <[email protected]>
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers

Tristan Madani <[email protected]>
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

Srinivas Pandruvada <[email protected]>
HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads

Maoyi Xie <[email protected]>
HID: lg-g15: cancel pending work on remove to fix a use-after-free

Manish Khadka <[email protected]>
HID: letsketch: fix UAF on inrange_timer at driver unbind

Myeonghun Pak <[email protected]>
HID: wacom: stop hardware after post-start probe failures

Lukas Wunner <[email protected]>
X.509: Fix validation of ASN.1 certificate header

Kartik Rajput <[email protected]>
clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances

WenTao Liang <[email protected]>
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

Yuho Choi <[email protected]>
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

Tianxiang Chen <[email protected]>
cpufreq: Fix hotplug-suspend race during reboot

Steven Rostedt <[email protected]>
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT

Fushuai Wang <[email protected]>

    cpufreq: intel_pstate: Sync policy->cur during CPU offline

Guangshuo Li <[email protected]>
firmware_loader: fix device reference leak in firmware_upload_register()

Norbert Manthey <[email protected]>
smb: client: mask server-provided mode to 07777 in modefromsid

Zihan Xi <[email protected]>
smb: client: harden POSIX SID length parsing

Zihan Xi <[email protected]>
smb: client: use unaligned reads in parse_posix_ctxt()

Haoxiang Li <[email protected]>
smb: client: Fix next buffer leak in receive_encrypted_standard()

Gil Portnoy <[email protected]>
ksmbd: add per-handle permission check to FILE_LINK_INFORMATION

Namjae Jeon <[email protected]>
ksmbd: run set info with opener credentials

Gil Portnoy <[email protected]>
ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY

Namjae Jeon <[email protected]>
ksmbd: require source read access for duplicate extents

Davide Ornaghi <[email protected]>
ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation

Namjae Jeon <[email protected]>
ksmbd: serialize QUERY_DIRECTORY requests per file

Gil Portnoy <[email protected]>
ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

Gil Portnoy <[email protected]>
ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE

Sebastian Andrzej Siewior <[email protected]>
net: Drop the lock in skb_may_tx_timestamp()

Muhammad Bilal <[email protected]>
Bluetooth: L2CAP: validate option length before reading conf opt value

Yousef Alhouseen <[email protected]>
Bluetooth: fix UAF in bt_accept_dequeue()

Yousef Alhouseen <[email protected]>
Bluetooth: bnep: pin L2CAP connection during netdev registration

Sergey Senozhatsky <[email protected]>
Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()

Xiang Mei <[email protected]>
netfilter: ebtables: terminate table name before find_table_lock()

Florian Westphal <[email protected]>
netfilter: ebtables: module names must be null-terminated

Pratham Gupta <[email protected]>
netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump

Andrei Kuchynski <[email protected]>
mfd: cros_ec: Delay dev_set_drvdata() until probe success

Wyatt Feng <[email protected]>
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

Yuyang Huang <[email protected]>
ipv4: igmp: remove multicast group from hash table on device destruction

Runyu Xiao <[email protected]>
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

Runyu Xiao <[email protected]>
gpio: eic-sprd: use raw_spinlock_t in the irq startup path

Koichiro Den <[email protected]>
NTB: epf: Avoid calling pci_irq_vector() from hardirq context

Yunpeng Tian <[email protected]>
fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

Thomas Gleixner <[email protected]>
debugobjects: Plug race against a concurrent OOM disable

Chi Wang <[email protected]>
audit: Fix data races of skb_queue_len() readers on audit_queue

Zijing Yin <[email protected]>
net: af_key: initialize alg_key_len for IPComp states

Gil Portnoy <[email protected]>
ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL

Dawei Feng <[email protected]>
crypto: amlogic - avoid double cleanup in meson_crypto_probe()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB write in HT_caps_handler()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

Arnd Bergmann <[email protected]>
staging: media: atomisp: reduce load_primary_binaries() stack usage

Ricardo Ribalda <[email protected]>
media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe

Hao-Qun Huang <[email protected]>
staging: vme_user: fix location monitor leak in tsi148 bridge

Hao-Qun Huang <[email protected]>
staging: vme_user: fix location monitor leak in fake bridge

Shoichiro Miyamoto <[email protected]>
smb: client: restrict implied bcc[0] exemption to responses without data area

Michael Tautschnig <[email protected]>
staging: vme_user: bound slave read/write to the kern_buf size

Samuel Page <[email protected]>
tipc: fix out-of-bounds read in broadcast Gap ACK blocks

Yizhou Zhao <[email protected]>
6lowpan: fix NHC entry use-after-free on error path

Runyu Xiao <[email protected]>
usb: dwc3: run gadget disconnect from sleepable suspend context

Alan Stern <[email protected]>
USB: chaoskey: Fix slab-use-after-free in chaoskey_release()

Michael Bommarito <[email protected]>
hwrng: virtio: clamp device-reported used.len at copy_data()

Johan Hovold <[email protected]>
virtio-mmio: fix device release warning on module unload

Xiang Mei <[email protected]>
netfilter: ipset: fix race between dump and ip_set_list resize

SeongJae Park <[email protected]>
mm/damon/ops-common: handle extreme intervals in damon_hot_score()

Ratheesh Kannoth <[email protected]>
PCI: host-common: Request bus reassignment when not probe-only

Mahesh Vaidya <[email protected]>
PCI: altera: Do not dispose parent IRQ mapping

胡连勤 <[email protected]>
usb: xhci: Fix sleep in atomic context in xhci_free_streams()

Carlos Llamas <[email protected]>
binder: fix UAF in binder_free_transaction()

Carlos Llamas <[email protected]>
binder: fix UAF in binder_thread_release()

Johan Hovold <[email protected]>
Bluetooth: btusb: fix wakeup source leak on probe failure

Johan Hovold <[email protected]>
Bluetooth: btusb: fix use-after-free on marvell probe failure

Johan Hovold <[email protected]>
Bluetooth: btusb: fix use-after-free on registration failure

Alex Williamson <[email protected]>
vfio/pci: Release the VGA arbiter client on register_device() failure

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Update Babyface Pro control caches only after successful writes

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Roll back quirk control caches on write errors

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()

Darvell Long <[email protected]>
ALSA: usb-audio: avoid kobject path lookup in DualSense match

Zhao Dongdong <[email protected]>
ALSA: ice1712: check snd_ctl_new1() return value

Zhao Dongdong <[email protected]>
ALSA: gus: check snd_ctl_new1() return value

Maoyi Xie <[email protected]>
ALSA: firewire: isight: bound the sample count to the packet payload

Zhao Dongdong <[email protected]>
ALSA: es1938: check snd_ctl_new1() return value

Zhao Dongdong <[email protected]>
ALSA: cmipci: check snd_ctl_new1() return value

Maoyi Xie <[email protected]>
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser

Zhao Dongdong <[email protected]>
ALSA: ymfpci: check snd_ctl_new1() return value

Cássio Gabriel <[email protected]>
ALSA: virtio: Add missing 384 kHz PCM rate mapping

Liviu Stan <[email protected]>
iio: temperature: ltc2983: Fix reinit_completion() called after conversion start

Andy Shevchenko <[email protected]>
iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call

Javier Carrasco <[email protected]>
iio: light: veml6030: fix channel type when pushing events

Stepan Ionichev <[email protected]>
iio: light: tsl2591: return actual error from probe IRQ failure

Joshua Crofts <[email protected]>
iio: light: opt3001: fix missing state reset on timeout

Biren Pandya <[email protected]>
iio: light: gp2ap002: fix runtime PM leak on read error

Vidhu Sarwal <[email protected]>
iio: light: al3010: fix incorrect scale for the highest gain range

Andreas Kempe <[email protected]>
iio: imu: st_lsm6dsx: deselect shub page before reading whoami

Runyu Xiao <[email protected]>
iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ

Stepan Ionichev <[email protected]>
iio: gyro: bmg160: wait full startup time after mode change at probe

Stepan Ionichev <[email protected]>
iio: gyro: bmg160: bail out when bandwidth/filter is not in table

Lars-Peter Clausen <[email protected]>
iio: event: Fix event FIFO reset race

Maxwell Doose <[email protected]>
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug

Pengpeng Hou <[email protected]>
iio: adc: ti-ads124s08: Return reset GPIO lookup errors

Maxwell Doose <[email protected]>
iio: adc: spear: Initialize completion before requesting IRQ

Maxwell Doose <[email protected]>
iio: adc: lpc32xx: Initialize completion before requesting IRQ

Biren Pandya <[email protected]>
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error

Bryam Vargas <[email protected]>
iio: accel: bmc150: clamp the device-reported FIFO frame count

Griffin Kroah-Hartman <[email protected]>
usb: gadget: function: rndis: add length check for header

Griffin Kroah-Hartman <[email protected]>
usb: gadget: function: rndis: add length check to response query

Jonas Jelonek <[email protected]>
MIPS: smp: report dying CPU to RCU in stop_this_cpu()

Philo Lu <[email protected]>
virtio_net: Support dynamic rss indirection table size

Taeyang Lee <[email protected]>
perf/core: Detach event groups during remove_on_exec

Alice Ryhl <[email protected]>
rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER

Jeremy Linton <[email protected]>
ACPI: CPPC: Suppress UBSAN warning caused by field misuse

Christian Brauner <[email protected]>
eventpoll: fix ep_remove struct eventpoll / struct file UAF

Christian Brauner <[email protected]>
eventpoll: move epi_fget() up

Christian Brauner <[email protected]>
eventpoll: rename ep_remove_safe() back to ep_remove()

Christian Brauner <[email protected]>
eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()

Christian Brauner <[email protected]>
eventpoll: kill __ep_remove()

Christian Brauner <[email protected]>
eventpoll: split __ep_remove()

Christian Brauner <[email protected]>
eventpoll: use hlist_is_singular_node() in __ep_remove()

Christian Brauner <[email protected]>
file: add fput() cleanup helper

Linus Torvalds <[email protected]>
eventpoll: don't decrement ep refcount while still holding the ep mutex

Florian Fainelli <[email protected]>
perf trace beauty fcntl: Fix build with older kernel headers

Claudia Draghicescu <[email protected]>
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID

Jiayuan Chen <[email protected]>
mm/vmscan: flush deferred TLB before freeing large folios

NeilBrown <[email protected]>
nfsd: change nfs4_client_to_reclaim() to allocate data

NeilBrown <[email protected]>
nfsd: move name lookup out of nfsd4_list_rec_dir()

John Johansen <[email protected]>
apparmor: advertise the tcp fast open fix is applied

Trond Myklebust <[email protected]>
nfsd: Don't reset the write verifier on a commit EAGAIN

Michael Bommarito <[email protected]>
NFSv4/flexfiles: reject zero filehandle version count

Mingyu Wang <[email protected]>
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

Johan Hovold <[email protected]>
i2c: core: fix adapter registration race

Johan Hovold <[email protected]>
i2c: core: fix adapter debugfs creation

Johan Hovold <[email protected]>
i2c: core: fix NULL-deref on adapter registration failure

Johan Hovold <[email protected]>
i2c: core: fix hang on adapter registration failure

Johan Hovold <[email protected]>
i2c: core: fix irq domain leak on adapter registration failure

Yuho Choi <[email protected]>
rpmsg: char: Fix use-after-free on probe error path

Denis Arefev <[email protected]>
block: Avoid mounting the bdev pseudo-filesystem in userspace

Sean Christopherson <[email protected]>
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()

Keshav Verma <[email protected]>
f2fs: fix listxattr handling of corrupted xattr entries

Chao Yu <[email protected]>
f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()

Ruipeng Qi <[email protected]>
f2fs: fix potential deadlock in f2fs_balance_fs()

Bryam Vargas <[email protected]>
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes

Wenjie Qi <[email protected]>
f2fs: validate orphan inode entry count

Wenjie Qi <[email protected]>
f2fs: keep atomic write retry from zeroing original data

Bartosz Golaszewski <[email protected]>
device property: initialize the remaining fields of fwnode_handle in fwnode_init()

Maoyi Xie <[email protected]>
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd

Uwe Kleine-König <[email protected]>
slimbus: Convert to platform remove callback returning void

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Fix probe error path ordering

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Fix up platform_driver registration

Pedro Tammela <[email protected]>
net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys

Kiryl Shutsemau <[email protected]>
userfaultfd: gate must_wait writability check on pte_present()

Huacai Chen <[email protected]>
LoongArch: Report dying CPU to RCU in stop_this_cpu()

Jeff Layton <[email protected]>
nfsd: reset write verifier on deferred writeback errors

Chris Mason <[email protected]>
nfsd: release layout stid on setlease failure

Daniel Borkmann <[email protected]>
bpf, arm64: Reject out-of-range B.cond targets

Chaitanya Kulkarni <[email protected]>
nvmet-tcp: fix race between ICReq handling and queue teardown

-------------

Diffstat:

 Documentation/admin-guide/pm/cpufreq.rst           |    6 +-
 Documentation/crypto/userspace-if.rst              |   31 +-
 .../media/allwinner,sun4i-a10-video-engine.yaml    |   10 +
 .../devicetree/bindings/net/renesas,ether.yaml     |    3 +-
 Documentation/driver-api/nvdimm/btt.rst            |    5 +-
 Documentation/driver-api/pci/pci.rst               |    3 +
 Documentation/filesystems/proc.rst                 |   14 +-
 Makefile                                           |    7 +-
 arch/alpha/kernel/pci-sysfs.c                      |   13 +-
 arch/arm/boot/dts/am335x-sl50.dts                  |    4 +-
 arch/arm/configs/sunxi_defconfig                   |    1 -
 arch/arm/mach-imx/cpu-imx31.c                      |    9 +-
 arch/arm/mach-imx/mm-imx3.c                        |    2 +
 arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi   |    2 +-
 arch/arm64/boot/dts/nvidia/tegra234.dtsi           |    8 +-
 arch/arm64/boot/dts/qcom/sdm630.dtsi               |    9 +-
 arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts     |    2 +-
 arch/arm64/kernel/entry-fpsimd.S                   |    8 +-
 arch/arm64/kernel/hw_breakpoint.c                  |    9 +
 arch/arm64/kvm/vgic/vgic-its.c                     |    2 +
 arch/arm64/kvm/vgic/vgic.c                         |   11 +-
 arch/arm64/lib/insn.c                              |    2 +
 arch/arm64/mm/hugetlbpage.c                        |    2 +-
 arch/arm64/mm/mmu.c                                |   11 +-
 arch/loongarch/include/asm/pgtable.h               |    4 +
 arch/loongarch/kernel/smp.c                        |    1 +
 arch/mips/dec/int-handler.S                        |    2 +-
 arch/mips/dec/prom/init.c                          |    6 +-
 arch/mips/dec/setup.c                              |    6 -
 arch/mips/fw/lib/call_o32.S                        |    2 +-
 arch/mips/include/asm/dec/prom.h                   |   15 +-
 arch/mips/kernel/mips-mt-fpaff.c                   |   28 +-
 arch/mips/kernel/smp.c                             |    2 +
 arch/mips/mm/init.c                                |   12 +-
 arch/mips/n64/init.c                               |    2 +-
 arch/mips/ralink/mt7621.c                          |    2 +-
 arch/mips/sgi-ip22/ip22-gio.c                      |    7 +-
 arch/powerpc/kexec/core_64.c                       |    4 +-
 arch/powerpc/perf/core-fsl-emb.c                   |    3 +-
 arch/powerpc/platforms/cell/spufs/file.c           |    6 +-
 arch/powerpc/platforms/powernv/setup.c             |    3 +-
 .../platforms/pseries/papr_platform_attributes.c   |    8 +-
 arch/riscv/kernel/cacheinfo.c                      |    2 +-
 arch/riscv/kernel/machine_kexec.c                  |    3 +
 arch/riscv/kernel/stacktrace.c                     |    2 +-
 arch/s390/kernel/process.c                         |    2 +-
 arch/s390/kvm/pci.c                                |   12 +-
 arch/sparc/kernel/led.c                            |    2 +-
 arch/x86/boot/compressed/acpi.c                    |    7 +-
 arch/x86/boot/early_serial_console.c               |   11 +-
 arch/x86/events/amd/brs.c                          |   10 +-
 arch/x86/events/amd/core.c                         |    6 +-
 arch/x86/events/amd/lbr.c                          |    3 +-
 arch/x86/events/intel/uncore_snb.c                 |    7 -
 arch/x86/kvm/lapic.c                               |    8 +-
 arch/x86/kvm/vmx/vmx.c                             |   38 +-
 arch/x86/mm/numa_emulation.c                       |   17 +-
 arch/x86/mm/tlb.c                                  |   16 +-
 arch/x86/platform/efi/quirks.c                     |    8 +
 arch/x86/platform/olpc/olpc-xo15-sci.c             |    1 +
 block/bdev.c                                       |    4 -
 block/partitions/aix.c                             |    9 +
 crypto/af_alg.c                                    |    2 +-
 crypto/algif_skcipher.c                            |   49 +-
 crypto/asymmetric_keys/verify_pefile.c             |    2 +
 crypto/asymmetric_keys/x509_loader.c               |    2 +-
 crypto/drbg.c                                      |    4 +-
 crypto/ecc.c                                       |   31 +-
 crypto/ecrdsa.c                                    |    2 +-
 crypto/pcrypt.c                                    |    4 +
 crypto/rng.c                                       |   11 +
 drivers/acpi/acpi_ipmi.c                           |    4 +-
 drivers/acpi/cppc_acpi.c                           |   11 +-
 drivers/acpi/nfit/core.c                           |   15 +-
 drivers/acpi/resource.c                            |    6 +-
 drivers/android/binder.c                           |   19 +-
 drivers/ata/pata_pxa.c                             |    1 +
 drivers/ata/sata_gemini.c                          |    2 +-
 drivers/base/dd.c                                  |    7 +-
 drivers/base/firmware_loader/main.c                |    3 +-
 drivers/base/firmware_loader/sysfs_upload.c        |    8 +-
 drivers/base/power/main.c                          |    6 +-
 drivers/base/property.c                            |    4 +-
 drivers/block/drbd/drbd_receiver.c                 |    5 +
 drivers/bluetooth/bpa10x.c                         |    8 +-
 drivers/bluetooth/btmtksdio.c                      |    2 +-
 drivers/bluetooth/btrtl.c                          |    5 +-
 drivers/bluetooth/btusb.c                          |   37 +-
 drivers/bus/mhi/ep/main.c                          |    9 +-
 drivers/bus/sunxi-rsb.c                            |    3 +
 drivers/char/hw_random/virtio-rng.c                |   23 +-
 drivers/char/tlclk.c                               |    4 +
 drivers/char/tpm/eventlog/tpm1.c                   |    4 +-
 drivers/char/tpm/tpm-dev.c                         |    2 +-
 drivers/char/tpm/tpm_tis_core.c                    |   35 +-
 drivers/char/tpm/tpmrm-dev.c                       |    2 +-
 drivers/clk/at91/pmc.c                             |    2 +-
 drivers/clk/clk-scmi.c                             |    4 +-
 drivers/clk/qcom/a53-pll.c                         |    2 +-
 drivers/clocksource/timer-tegra186.c               |    3 +-
 drivers/cpufreq/cpufreq.c                          |    2 +
 drivers/cpufreq/cpufreq_conservative.c             |   12 +-
 drivers/cpufreq/intel_pstate.c                     |    6 +-
 drivers/cpufreq/pcc-cpufreq.c                      |    2 +
 drivers/crypto/allwinner/Kconfig                   |    8 -
 drivers/crypto/allwinner/sun4i-ss/Makefile         |    1 -
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss-core.c  |   36 -
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss-prng.c  |   69 --
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h       |   20 -
 drivers/crypto/amcc/crypto4xx_alg.c                |  106 --
 drivers/crypto/amcc/crypto4xx_core.c               |  130 +-
 drivers/crypto/amcc/crypto4xx_core.h               |   11 -
 drivers/crypto/amcc/crypto4xx_reg_def.h            |   11 -
 drivers/crypto/amlogic/amlogic-gxl-core.c          |    2 +-
 drivers/crypto/atmel-ecc.c                         |    2 +-
 drivers/crypto/atmel-sha204a.c                     |   31 +-
 drivers/crypto/caam/caamalg.c                      |   12 +-
 drivers/crypto/caam/caamalg_qi.c                   |   12 +-
 drivers/crypto/caam/caamalg_qi2.c                  |   12 +-
 drivers/crypto/caam/caamhash.c                     |    4 +-
 drivers/crypto/caam/key_gen.c                      |    4 +-
 drivers/crypto/cavium/cpt/cptvf_reqmanager.c       |    4 +-
 drivers/crypto/ccp/sev-dev.c                       |    3 +-
 drivers/crypto/hisilicon/Kconfig                   |    1 -
 drivers/crypto/hisilicon/qm.c                      |    4 +-
 drivers/crypto/hisilicon/trng/trng.c               |  298 +----
 drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c |    4 +-
 drivers/crypto/qat/qat_common/adf_accel_devices.h  |    2 +
 drivers/crypto/qat/qat_common/adf_aer.c            |    7 +-
 drivers/crypto/qat/qat_common/adf_common_drv.h     |    2 +
 drivers/crypto/qat/qat_common/adf_isr.c            |   39 +
 drivers/crypto/qat/qat_common/adf_sriov.c          |   20 +-
 drivers/crypto/qat/qat_common/qat_asym_algs.c      |   10 +-
 drivers/crypto/talitos.c                           |  221 +++-
 drivers/crypto/talitos.h                           |    2 +
 drivers/dax/kmem.c                                 |    6 +
 drivers/dma-buf/udmabuf.c                          |    5 +-
 drivers/dma/dmaengine.c                            |    3 +-
 drivers/dma/dw-edma/dw-edma-core.h                 |    2 +-
 drivers/dma/dw-edma/dw-edma-v0-core.c              |    6 +
 drivers/dma/imx-sdma.c                             |    4 +-
 drivers/dma/qcom/gpi.c                             |    1 +
 drivers/dma/tegra186-gpc-dma.c                     |    7 +
 drivers/edac/i10nm_base.c                          |   14 +-
 drivers/edac/skx_common.c                          |    3 +
 drivers/firmware/arm_scmi/power.c                  |    6 +-
 drivers/firmware/arm_scmi/sensors.c                |    2 +-
 drivers/firmware/efi/efi.c                         |    1 +
 drivers/firmware/efi/vars.c                        |   12 +
 drivers/fpga/microchip-spi.c                       |    3 +
 drivers/gpio/gpio-eic-sprd.c                       |    8 +-
 drivers/gpio/gpio-f7188x.c                         |    6 +-
 drivers/gpio/gpio-htc-egpio.c                      |    6 +-
 drivers/gpio/gpio-mvebu.c                          |    5 +-
 drivers/gpio/gpio-palmas.c                         |   19 +
 drivers/gpio/gpio-sch.c                            |   32 +-
 drivers/gpio/gpio-timberdale.c                     |    2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c   |   16 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |    6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c            |   25 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c            |    2 -
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |    3 +
 drivers/gpu/drm/amd/amdkfd/kfd_events.c            |    5 +
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c               |    1 +
 .../amd/display/modules/info_packet/info_packet.c  |    2 +
 drivers/gpu/drm/drm_edid.c                         |    8 +
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c     |   78 +-
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c    |   11 +
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c   |   22 -
 drivers/gpu/drm/i915/gt/intel_region_lmem.c        |    2 +-
 drivers/gpu/drm/msm/dp/dp_display.c                |    4 +-
 drivers/gpu/drm/msm/dp/dp_reg.h                    |    4 +-
 .../gpu/drm/nouveau/nvkm/subdev/bios/shadowramin.c |    3 +-
 drivers/gpu/drm/radeon/radeon_ring.c               |    4 +-
 drivers/gpu/drm/tegra/dc.c                         |    4 +-
 drivers/gpu/drm/tegra/gem.c                        |   22 +-
 drivers/gpu/drm/tegra/submit.c                     |    3 +-
 drivers/gpu/drm/tidss/tidss_kms.c                  |    2 -
 drivers/gpu/host1x/bus.c                           |   62 +-
 drivers/gpu/host1x/job.c                           |   10 +-
 drivers/hid/hid-appleir.c                          |   45 +-
 drivers/hid/hid-core.c                             |    7 +
 drivers/hid/hid-letsketch.c                        |   36 +-
 drivers/hid/hid-lg-g15.c                           |   16 +
 drivers/hid/hid-logitech-hidpp.c                   |    1 -
 drivers/hid/hid-multitouch.c                       |   32 +-
 drivers/hid/hid-picolcd_core.c                     |    3 +-
 drivers/hid/hid-sensor-hub.c                       |   77 +-
 drivers/hid/wacom_sys.c                            |   12 +-
 drivers/hwmon/Kconfig                              |    1 +
 drivers/hwmon/asus_atk0110.c                       |    3 +
 drivers/hwmon/occ/common.c                         |   34 +-
 drivers/hwmon/occ/common.h                         |    1 +
 drivers/hwmon/pmbus/adm1275.c                      |    2 +-
 drivers/hwmon/w83627hf.c                           |    4 +
 drivers/hwmon/w83793.c                             |    1 +
 drivers/hwspinlock/qcom_hwspinlock.c               |    5 +-
 .../hwtracing/coresight/coresight-cti-platform.c   |    1 +
 drivers/hwtracing/coresight/coresight-etb10.c      |    6 +-
 drivers/hwtracing/coresight/coresight-etm4x-core.c |    4 +-
 drivers/i2c/busses/i2c-mlxbf.c                     |    4 +-
 drivers/i2c/busses/i2c-mt65xx.c                    |    2 +-
 drivers/i2c/busses/i2c-stm32f7.c                   |    9 +-
 drivers/i2c/i2c-core-base.c                        |   85 +-
 drivers/i3c/master.c                               |   19 +-
 drivers/iio/accel/bmc150-accel-core.c              |    2 +
 drivers/iio/accel/kxsd9.c                          |    5 +-
 drivers/iio/accel/mma8452.c                        |    2 +
 drivers/iio/adc/lpc32xx_adc.c                      |    4 +-
 drivers/iio/adc/spear_adc.c                        |    3 +-
 drivers/iio/adc/ti-ads124s08.c                     |    3 +-
 drivers/iio/adc/xilinx-ams.c                       |    5 +
 drivers/iio/chemical/scd30_core.c                  |   19 +-
 drivers/iio/common/Kconfig                         |    1 +
 drivers/iio/common/Makefile                        |    1 +
 drivers/iio/common/inv_sensors/Kconfig             |    7 +
 drivers/iio/common/inv_sensors/Makefile            |    6 +
 .../inv_sensors/inv_sensors_timestamp.c}           |  120 +-
 drivers/iio/common/st_sensors/st_sensors_core.c    |   23 +-
 drivers/iio/gyro/bmg160_core.c                     |   16 +-
 drivers/iio/imu/adis_trigger.c                     |    2 +-
 drivers/iio/imu/bmi160/bmi160_core.c               |    3 +-
 drivers/iio/imu/inv_icm42600/Kconfig               |    1 +
 drivers/iio/imu/inv_icm42600/Makefile              |    1 -
 drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c  |   35 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c |   61 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h |    3 +
 drivers/iio/imu/inv_icm42600/inv_icm42600_core.c   |   24 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c   |   35 +-
 .../iio/imu/inv_icm42600/inv_icm42600_timestamp.h  |   85 --
 drivers/iio/imu/inv_mpu6050/Kconfig                |    1 +
 drivers/iio/imu/inv_mpu6050/inv_mpu_core.c         |   30 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h          |   18 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c         |   85 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c      |   11 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c       |   21 +-
 drivers/iio/industrialio-event.c                   |    5 +-
 drivers/iio/light/al3010.c                         |    2 +-
 drivers/iio/light/gp2ap002.c                       |    2 +-
 drivers/iio/light/opt3001.c                        |    6 +-
 drivers/iio/light/si1133.c                         |   14 +-
 drivers/iio/light/tsl2591.c                        |    6 +-
 drivers/iio/light/veml6030.c                       |    8 +-
 drivers/iio/magnetometer/ak8975.c                  |   15 +
 drivers/iio/orientation/hid-sensor-rotation.c      |   40 +-
 drivers/iio/temperature/ltc2983.c                  |    5 +-
 drivers/infiniband/core/cm.c                       |   13 +-
 drivers/infiniband/core/counters.c                 |    2 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |    8 +-
 drivers/infiniband/hw/hns/hns_roce_main.c          |    2 +-
 drivers/infiniband/hw/irdma/verbs.c                |   18 +-
 drivers/infiniband/hw/irdma/verbs.h                |    1 -
 drivers/infiniband/hw/mlx4/mlx4_ib.h               |    1 +
 drivers/infiniband/hw/mlx4/mr.c                    |    9 +-
 drivers/infiniband/hw/mlx4/sysfs.c                 |   45 +-
 drivers/infiniband/hw/mlx5/devx.c                  |   30 +-
 drivers/infiniband/hw/mlx5/main.c                  |    2 +-
 drivers/infiniband/hw/mlx5/mr.c                    |   17 +-
 drivers/infiniband/hw/mlx5/qp.c                    |   12 +-
 drivers/infiniband/sw/rxe/rxe_resp.c               |   33 +-
 drivers/infiniband/sw/siw/siw_qp_rx.c              |    9 +
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             |    5 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |    5 +-
 drivers/input/joystick/iforce/iforce-packets.c     |   18 +-
 drivers/input/joystick/maplecontrol.c              |    3 +-
 drivers/input/keyboard/maple_keyb.c                |    4 +-
 drivers/input/misc/ims-pcu.c                       |  117 +-
 drivers/input/mouse/elan_i2c_core.c                |   36 +-
 drivers/input/mouse/maplemouse.c                   |    9 +-
 drivers/input/rmi4/rmi_bus.c                       |    4 +-
 drivers/input/rmi4/rmi_f30.c                       |    2 +-
 drivers/input/rmi4/rmi_f3a.c                       |    2 +-
 drivers/input/touchscreen/goodix.c                 |    3 +-
 drivers/input/touchscreen/mms114.c                 |    2 +-
 drivers/input/touchscreen/touchwin.c               |   15 +-
 drivers/iommu/amd/amd_iommu_types.h                |   11 +-
 drivers/irqchip/irq-crossbar.c                     |   10 +-
 drivers/irqchip/irq-gic-v3-its.c                   |    6 +-
 drivers/irqchip/irq-ts4800.c                       |   10 +
 drivers/leds/uleds.c                               |    3 +-
 drivers/mailbox/mtk-adsp-mailbox.c                 |    9 +-
 drivers/md/dm-bufio.c                              |    4 +-
 drivers/md/dm-era-target.c                         |   10 +-
 drivers/md/dm-ioctl.c                              |    7 +-
 drivers/md/dm-log.c                                |    3 +
 drivers/md/dm-stats.c                              |   10 +-
 drivers/md/dm-thin-metadata.c                      |   67 +-
 drivers/md/dm-verity-loadpin.c                     |    2 +-
 drivers/md/dm-verity-target.c                      |    2 +-
 drivers/md/raid1.c                                 |    6 +
 drivers/md/raid10.c                                |    1 +
 drivers/media/platform/qcom/venus/helpers.c        |    4 +-
 .../media/platform/qcom/venus/hfi_platform_v4.c    |   20 +-
 .../media/platform/qcom/venus/hfi_platform_v6.c    |   16 +-
 drivers/media/platform/rockchip/rga/rga-hw.c       |    2 +-
 drivers/media/platform/rockchip/rga/rga-hw.h       |    2 +-
 drivers/media/usb/uvc/uvc_video.c                  |   30 +-
 drivers/memstick/core/ms_block.c                   |    4 +
 drivers/mfd/cros_ec_dev.c                          |    3 +-
 drivers/mfd/sm501.c                                |    4 +-
 drivers/mfd/tps6586x.c                             |    2 +-
 drivers/mmc/host/vub300.c                          |   26 +-
 drivers/mtd/devices/mchp23k256.c                   |    2 +-
 drivers/mtd/devices/slram.c                        |   22 +-
 drivers/mtd/maps/vmu-flash.c                       |    1 +
 drivers/mtd/nand/onenand/onenand_samsung.c         |    7 +-
 drivers/mtd/nand/raw/fsl_ifc_nand.c                |    9 +-
 drivers/mtd/nand/raw/lpc32xx_mlc.c                 |   12 +-
 drivers/mtd/nand/raw/lpc32xx_slc.c                 |   12 +-
 drivers/mtd/nand/raw/nand_base.c                   |    2 +-
 drivers/mtd/nand/raw/pl35x-nand-controller.c       |    2 +-
 drivers/mtd/spi-nor/Kconfig                        |    1 -
 drivers/mtd/spi-nor/swp.c                          |   11 +-
 drivers/net/amt.c                                  |    6 +-
 drivers/net/bonding/bond_3ad.c                     |    1 +
 drivers/net/can/usb/esd_usb.c                      |    5 +-
 drivers/net/dsa/sja1105/sja1105_ptp.c              |    2 +-
 drivers/net/ethernet/amazon/ena/ena_netdev.c       |   23 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c    |    3 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |   23 +-
 .../ethernet/cavium/liquidio/cn23xx_pf_device.c    |   18 +-
 drivers/net/ethernet/chelsio/cxgb4/t4_hw.c         |    8 -
 .../net/ethernet/freescale/dpaa2/dpaa2-switch.c    |    2 +-
 drivers/net/ethernet/freescale/enetc/enetc.c       |    7 +
 drivers/net/ethernet/freescale/fman/fman.c         |    4 +-
 drivers/net/ethernet/freescale/gianfar.c           |   16 +-
 drivers/net/ethernet/intel/ice/ice_common.c        |    1 -
 drivers/net/ethernet/intel/ice/ice_ethtool.c       |   12 +-
 drivers/net/ethernet/intel/ice/ice_vf_lib.c        |    2 +-
 drivers/net/ethernet/marvell/mvneta.c              |    3 +
 drivers/net/ethernet/marvell/octeontx2/af/mcs.c    |    6 +-
 .../ethernet/marvell/octeontx2/af/rvu_debugfs.c    |    3 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_nix.c    |    4 +-
 .../ethernet/marvell/octeontx2/nic/cn10k_macsec.c  |   10 +-
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |   44 +-
 .../net/ethernet/marvell/prestera/prestera_main.c  |    2 +-
 .../ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c |   29 +-
 .../ethernet/mellanox/mlx5/core/en_accel/macsec.c  |   47 +-
 .../net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c  |    8 +-
 .../net/ethernet/mellanox/mlx5/core/lib/hv_vhca.h  |    6 +-
 .../net/ethernet/mellanox/mlx5/core/lib/port_tun.c |    3 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   12 +-
 .../net/ethernet/mellanox/mlxsw/spectrum_router.c  |    1 +
 drivers/net/ethernet/microchip/lan743x_main.c      |    2 +-
 .../ethernet/microchip/sparx5/sparx5_switchdev.c   |    4 +-
 drivers/net/ethernet/microsoft/mana/gdma_main.c    |    2 +
 drivers/net/ethernet/microsoft/mana/mana_en.c      |    3 +-
 drivers/net/ethernet/qlogic/qede/qede_fp.c         |    9 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c |    5 +
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h |   20 +
 .../net/ethernet/qualcomm/rmnet/rmnet_handlers.c   |   23 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h    |    7 +
 .../net/ethernet/qualcomm/rmnet/rmnet_map_data.c   |  269 +++-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c    |    9 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h    |    1 +
 drivers/net/ethernet/sun/sungem.c                  |   13 +-
 drivers/net/ieee802154/ca8210.c                    |    9 +-
 drivers/net/macsec.c                               |    9 +-
 drivers/net/phy/sfp.c                              |    1 +
 drivers/net/usb/gl620a.c                           |    6 +-
 drivers/net/usb/kalmia.c                           |    8 +
 drivers/net/usb/lan78xx.c                          |  318 ++---
 drivers/net/usb/net1080.c                          |    2 +-
 drivers/net/veth.c                                 |    2 +
 drivers/net/virtio_net.c                           |   55 +-
 drivers/net/vxlan/vxlan_core.c                     |    8 +-
 drivers/net/wan/ixp4xx_hss.c                       |    4 +-
 drivers/net/wireless/ath/ath9k/xmit.c              |    5 +
 drivers/net/wireless/ath/wcn36xx/smd.c             |   13 +
 drivers/net/wireless/marvell/mwifiex/join.c        |    1 -
 drivers/net/wireless/mediatek/mt76/mac80211.c      |    2 +-
 drivers/net/wireless/ralink/rt2x00/rt2x00dev.c     |   12 +-
 drivers/net/wireless/realtek/rtw88/pci.c           |    5 +
 drivers/net/wwan/iosm/iosm_ipc_mux_codec.c         |   40 +-
 drivers/net/wwan/t7xx/t7xx_hif_cldma.c             |    3 +
 drivers/ntb/hw/epf/ntb_hw_epf.c                    |   89 +-
 drivers/nvdimm/btt.c                               |   14 +-
 drivers/nvdimm/nd.h                                |   11 +-
 drivers/nvdimm/region_devs.c                       |   66 +-
 drivers/nvme/host/core.c                           |    2 +-
 drivers/nvme/host/multipath.c                      |    6 +
 drivers/nvme/target/fabrics-cmd.c                  |    4 +-
 drivers/nvme/target/rdma.c                         |   18 +-
 drivers/nvme/target/tcp.c                          |   34 +-
 drivers/pci/Makefile                               |    2 +-
 drivers/pci/controller/dwc/pci-imx6.c              |    5 +-
 drivers/pci/controller/dwc/pcie-designware-host.c  |    2 +-
 .../pci/controller/mobiveil/pcie-mobiveil-host.c   |    8 +-
 drivers/pci/controller/pci-host-common.c           |    4 +
 drivers/pci/controller/pci-loongson.c              |   31 +-
 drivers/pci/controller/pcie-altera-msi.c           |    2 +-
 drivers/pci/controller/pcie-altera.c               |   32 +-
 drivers/pci/controller/pcie-iproc-bcma.c           |    2 +-
 drivers/pci/controller/pcie-iproc-platform.c       |    2 +-
 drivers/pci/controller/pcie-iproc.c                |    1 -
 drivers/pci/controller/pcie-iproc.h                |    2 -
 drivers/pci/controller/pcie-mediatek-gen3.c        |    4 +-
 drivers/pci/controller/pcie-mediatek.c             |  132 +-
 drivers/pci/controller/pcie-rcar-host.c            |    1 -
 drivers/pci/controller/pcie-xilinx-nwl.c           |    2 +-
 drivers/pci/endpoint/functions/pci-epf-ntb.c       |   21 +-
 drivers/pci/endpoint/functions/pci-epf-vntb.c      |    9 +-
 drivers/pci/msi/msi.c                              |    4 +-
 drivers/pci/pci-sysfs.c                            |   14 +-
 drivers/pci/pci.c                                  |  139 ---
 drivers/pci/pci.h                                  |    7 +
 drivers/pci/rebar.c                                |  218 ++++
 drivers/pci/rom.c                                  |  149 ++-
 drivers/pci/setup-bus.c                            |  104 +-
 drivers/pci/setup-res.c                            |   53 -
 drivers/phy/phy-can-transceiver.c                  |    3 +
 drivers/pinctrl/mediatek/pinctrl-mt8167.c          |    2 +-
 drivers/pinctrl/mediatek/pinctrl-mt8516.c          |    2 +-
 drivers/pinctrl/meson/pinctrl-meson.c              |    2 +-
 drivers/pinctrl/sunxi/pinctrl-sunxi.c              |    2 +-
 drivers/platform/x86/xo15-ebook.c                  |    7 +-
 drivers/power/supply/charger-manager.c             |    6 +-
 drivers/power/supply/cpcap-battery.c               |   11 +-
 drivers/power/supply/power_supply_core.c           |   11 +-
 drivers/pwm/pwm-imx27.c                            |    8 +-
 drivers/rapidio/devices/tsi721.c                   |    3 +-
 drivers/regulator/core.c                           |   29 +-
 drivers/regulator/ltc3676.c                        |   10 +-
 drivers/regulator/scmi-regulator.c                 |    6 +-
 drivers/reset/reset-imx7.c                         |    6 +
 drivers/reset/reset-sunxi.c                        |    4 +-
 drivers/rpmsg/rpmsg_char.c                         |   12 +-
 drivers/rtc/rtc-abx80x.c                           |    3 +-
 drivers/rtc/rtc-cmos.c                             |    6 +
 drivers/rtc/rtc-ds1307.c                           |   30 +-
 drivers/rtc/rtc-mpfs.c                             |    2 +-
 drivers/rtc/rtc-msc313.c                           |    4 +-
 drivers/s390/char/monwriter.c                      |    3 +
 drivers/scsi/elx/efct/efct_hw.c                    |    2 +
 drivers/scsi/elx/efct/efct_unsol.c                 |    1 +
 drivers/scsi/hpsa.c                                |    4 +
 drivers/scsi/lpfc/lpfc_init.c                      |    3 +-
 drivers/scsi/pm8001/pm8001_ctl.c                   |    5 +-
 drivers/scsi/scsi_scan.c                           |    2 +-
 drivers/scsi/scsi_transport_sas.c                  |  101 +-
 drivers/scsi/sg.c                                  |    7 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |    2 +-
 drivers/slimbus/qcom-ctrl.c                        |    5 +-
 drivers/slimbus/qcom-ngd-ctrl.c                    |  100 +-
 drivers/soc/fsl/qe/qe.c                            |    3 +
 drivers/soc/ti/k3-ringacc.c                        |    4 +-
 drivers/spi/spi-dw.h                               |    1 +
 drivers/spi/spi-ep93xx.c                           |    1 +
 drivers/spi/spi-fsl-lpspi.c                        |   18 +-
 drivers/spi/spi-rpc-if.c                           |    6 +-
 drivers/spi/spi-sh-msiof.c                         |   10 +-
 drivers/spi/spi-uniphier.c                         |    4 +-
 drivers/spi/spi-xilinx.c                           |   11 +-
 drivers/staging/media/atomisp/pci/atomisp_cmd.c    |    6 +-
 drivers/staging/media/atomisp/pci/sh_css.c         |    6 +-
 drivers/staging/media/ipu3/ipu3-css-params.c       |    8 +-
 drivers/staging/media/sunxi/cedrus/cedrus.c        |    4 +-
 drivers/staging/most/video/video.c                 |    7 +-
 drivers/staging/nvec/nvec.c                        |    4 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |   93 +-
 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c      |   20 +-
 drivers/staging/rtl8723bs/core/rtw_security.c      |    2 +-
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c     |   23 +-
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c  |   88 +-
 drivers/staging/vme_user/vme_fake.c                |    8 +
 drivers/staging/vme_user/vme_tsi148.c              |    8 +
 drivers/staging/vme_user/vme_user.c                |   22 +
 drivers/target/iscsi/iscsi_target_auth.c           |    6 +-
 drivers/target/target_core_fabric_lib.c            |   89 +-
 drivers/target/target_core_internal.h              |    3 +-
 drivers/target/target_core_pr.c                    |   12 +-
 drivers/thermal/intel/therm_throt.c                |    7 +-
 drivers/thermal/thermal_hwmon.c                    |    5 +-
 drivers/tty/serial/8250/8250_mid.c                 |   31 +-
 drivers/tty/serial/8250/8250_omap.c                |    3 +-
 drivers/tty/serial/msm_serial.c                    |    3 +-
 drivers/usb/atm/ueagle-atm.c                       |   36 +-
 drivers/usb/cdns3/cdnsp-mem.c                      |    2 +
 drivers/usb/class/cdc-acm.c                        |    3 +
 drivers/usb/common/ulpi.c                          |   23 +-
 drivers/usb/core/quirks.c                          |    6 +
 drivers/usb/dwc3/dwc3-meson-g12a.c                 |   14 +-
 drivers/usb/dwc3/gadget.c                          |   43 +-
 drivers/usb/gadget/composite.c                     |    5 +-
 drivers/usb/gadget/function/f_fs.c                 |    5 +-
 drivers/usb/gadget/function/rndis.c                |   20 +-
 drivers/usb/gadget/udc/core.c                      |   29 +-
 drivers/usb/host/max3421-hcd.c                     |    8 +
 drivers/usb/host/sl811-hcd.c                       |    1 +
 drivers/usb/host/xhci.c                            |   11 +-
 drivers/usb/misc/chaoskey.c                        |    1 -
 drivers/usb/misc/idmouse.c                         |   45 +-
 drivers/usb/misc/iowarrior.c                       |   21 +-
 drivers/usb/misc/ldusb.c                           |   38 +-
 drivers/usb/misc/legousbtower.c                    |   37 +-
 drivers/usb/misc/uss720.c                          |    5 +-
 drivers/usb/mtu3/mtu3_gadget.c                     |    1 +
 drivers/usb/serial/digi_acceleport.c               |   43 +-
 drivers/usb/serial/keyspan_pda.c                   |    2 +-
 drivers/usb/serial/option.c                        |   16 +
 drivers/usb/storage/ene_ub6250.c                   |    3 +-
 drivers/usb/storage/usb.c                          |    2 +-
 drivers/usb/typec/anx7411.c                        |    4 +-
 drivers/usb/typec/class.c                          |    1 +
 drivers/usb/typec/tcpm/tcpm.c                      |    7 +-
 drivers/usb/typec/ucsi/displayport.c               |    7 +-
 drivers/usb/typec/ucsi/ucsi.c                      |   20 +
 drivers/usb/typec/ucsi/ucsi.h                      |    1 +
 drivers/usb/typec/ucsi/ucsi_acpi.c                 |   10 +-
 drivers/usb/typec/ucsi/ucsi_ccg.c                  |    2 +-
 drivers/usb/usbip/vudc.h                           |    1 -
 drivers/usb/usbip/vudc_dev.c                       |    4 +-
 drivers/vdpa/vdpa_user/vduse_dev.c                 |   72 +-
 drivers/vfio/pci/mlx5/cmd.h                        |   13 +-
 drivers/vfio/pci/vfio_pci_core.c                   |   37 +-
 drivers/vhost/net.c                                |   15 +-
 drivers/vhost/vdpa.c                               |   29 +-
 drivers/video/fbdev/aty/radeon_base.c              |    1 +
 drivers/video/fbdev/broadsheetfb.c                 |    8 +-
 drivers/video/fbdev/carminefb.c                    |    1 +
 drivers/video/fbdev/core/fbcon.c                   |   14 +-
 drivers/video/fbdev/hecubafb.c                     |    6 +-
 drivers/video/fbdev/i740fb.c                       |    1 +
 drivers/video/fbdev/metronomefb.c                  |    8 +-
 drivers/video/fbdev/nvidia/nvidia.c                |    1 +
 drivers/video/fbdev/s3fb.c                         |    1 +
 drivers/video/fbdev/sm501fb.c                      |   16 +-
 drivers/video/fbdev/sm712.h                        |    2 +-
 drivers/video/fbdev/tdfxfb.c                       |    1 +
 drivers/video/fbdev/tridentfb.c                    |    1 +
 drivers/video/fbdev/uvesafb.c                      |    4 +-
 drivers/virtio/virtio_mmio.c                       |   26 +-
 drivers/virtio/virtio_ring.c                       |  196 +++
 drivers/watchdog/apple_wdt.c                       |    1 +
 drivers/watchdog/sp5100_tco.c                      |    3 +-
 drivers/watchdog/sprd_wdt.c                        |    5 +-
 drivers/watchdog/watchdog_core.c                   |    3 +
 drivers/xen/gntdev.c                               |    8 +-
 drivers/xen/xen-scsiback.c                         |   30 +-
 fs/afs/cell.c                                      |    2 +
 fs/afs/cmservice.c                                 |    2 -
 fs/afs/fs_operation.c                              |    2 +-
 fs/afs/rxrpc.c                                     |   11 +-
 fs/afs/super.c                                     |    3 +-
 fs/afs/vl_list.c                                   |   10 +-
 fs/afs/volume.c                                    |    2 +-
 fs/btrfs/ctree.h                                   |    2 +
 fs/btrfs/extent-tree.c                             |   17 +-
 fs/btrfs/file.c                                    |   12 +-
 fs/btrfs/inode.c                                   |  149 ++-
 fs/btrfs/ordered-data.c                            |   12 +
 fs/btrfs/ordered-data.h                            |    2 +
 fs/btrfs/reflink.c                                 |    5 +-
 fs/btrfs/super.c                                   |    3 +-
 fs/configfs/dir.c                                  |   57 +-
 fs/efivarfs/super.c                                |   45 +-
 fs/efs/file.c                                      |   21 +-
 fs/eventpoll.c                                     |  152 +--
 fs/exfat/dir.c                                     |   13 +-
 fs/ext4/ioctl.c                                    |   12 +-
 fs/f2fs/checkpoint.c                               |   14 +-
 fs/f2fs/data.c                                     |   45 +-
 fs/f2fs/f2fs.h                                     |    1 +
 fs/f2fs/inode.c                                    |   13 +-
 fs/f2fs/segment.c                                  |    8 +
 fs/f2fs/xattr.c                                    |    7 +-
 fs/fs-writeback.c                                  |  133 +-
 fs/fuse/cuse.c                                     |    4 +-
 fs/fuse/dev.c                                      |    2 +-
 fs/hfs/bfind.c                                     |    2 +-
 fs/hfs/bnode.c                                     |   56 +-
 fs/hfs/brec.c                                      |    2 +-
 fs/hfs/btree.c                                     |    2 +-
 fs/hfs/btree.h                                     |   71 +-
 fs/hfs/hfs_fs.h                                    |   88 +-
 fs/hfs/inode.c                                     |    3 +-
 fs/hfsplus/bfind.c                                 |    2 +-
 fs/hfsplus/bnode.c                                 |   62 +-
 fs/hfsplus/brec.c                                  |    2 +-
 fs/hfsplus/btree.c                                 |    2 +-
 fs/hfsplus/hfsplus_fs.h                            |   40 +-
 fs/isofs/rock.c                                    |   11 +
 fs/jbd2/journal.c                                  |    2 +
 fs/lockd/svcsubs.c                                 |    4 +-
 fs/nfs/callback_proc.c                             |    9 +-
 fs/nfs/dir.c                                       |    2 +
 fs/nfs/filelayout/filelayout.c                     |    2 +
 fs/nfs/flexfilelayout/flexfilelayout.c             |   33 +
 fs/nfs/flexfilelayout/flexfilelayout.h             |   16 +
 fs/nfs/pnfs.c                                      |    4 +-
 fs/nfsd/nfs4layouts.c                              |    4 +-
 fs/nfsd/nfs4recover.c                              |  120 +-
 fs/nfsd/nfs4state.c                                |   22 +-
 fs/nfsd/vfs.c                                      |   42 +-
 fs/nilfs2/segment.c                                |   22 +
 fs/ntfs3/fslog.c                                   |  106 +-
 fs/ntfs3/index.c                                   |   31 +-
 fs/ntfs3/lznt.c                                    |    2 +-
 fs/ntfs3/namei.c                                   |    2 +-
 fs/ntfs3/ntfs_fs.h                                 |    3 +-
 fs/ntfs3/run.c                                     |    9 +-
 fs/ocfs2/alloc.c                                   |    2 +-
 fs/ocfs2/aops.c                                    |   13 +-
 fs/ocfs2/buffer_head_io.c                          |    7 +-
 fs/ocfs2/dlm/dlmdebug.c                            |   16 +-
 fs/ocfs2/dlmglue.c                                 |   17 +
 fs/ocfs2/inode.c                                   |  150 ++-
 fs/ocfs2/journal.c                                 |   13 +-
 fs/ocfs2/journal.h                                 |    3 +
 fs/ocfs2/move_extents.c                            |    4 +-
 fs/ocfs2/ocfs2.h                                   |    2 -
 fs/ocfs2/quota_local.c                             |    2 +-
 fs/ocfs2/stack_user.c                              |   10 +-
 fs/ocfs2/super.c                                   |    2 -
 fs/ocfs2/sysfile.c                                 |    9 +-
 fs/orangefs/dir.c                                  |    7 +-
 fs/proc/array.c                                    |   15 +-
 fs/proc/base.c                                     |  184 ++-
 fs/proc/fd.c                                       |   71 +-
 fs/proc/generic.c                                  |    9 +-
 fs/proc/internal.h                                 |    6 +-
 fs/proc/namespaces.c                               |   16 +-
 fs/proc/proc_net.c                                 |    1 +
 fs/quota/dquot.c                                   |   10 +-
 fs/smb/client/cifs_swn.c                           |  329 ++++-
 fs/smb/client/cifsacl.c                            |    2 +-
 fs/smb/client/cifsfs.c                             |    2 +
 fs/smb/client/cifsglob.h                           |   44 +-
 fs/smb/client/cifsproto.h                          |   10 +-
 fs/smb/client/connect.c                            |   38 +-
 fs/smb/client/dfs_cache.c                          |    2 +-
 fs/smb/client/fscache.c                            |   20 +
 fs/smb/client/ioctl.c                              |   12 +-
 fs/smb/client/misc.c                               |   23 +-
 fs/smb/client/sess.c                               |   69 +-
 fs/smb/client/smb2misc.c                           |   62 +-
 fs/smb/client/smb2ops.c                            |   55 +-
 fs/smb/client/smb2pdu.c                            |   92 +-
 fs/smb/client/smb2transport.c                      |    2 +
 fs/smb/client/trace.h                              |   95 +-
 fs/smb/client/transport.c                          |    2 +-
 fs/smb/common/cifsglob.h                           |   61 +
 fs/smb/server/connection.c                         |   49 +-
 fs/smb/server/connection.h                         |    3 +
 fs/smb/server/oplock.c                             |   10 +-
 fs/smb/server/smb2misc.c                           |    2 +-
 fs/smb/server/smb2ops.c                            |   28 +-
 fs/smb/server/smb2pdu.c                            |  152 ++-
 fs/smb/server/smb_common.h                         |   43 +-
 fs/smb/server/vfs.c                                |   22 +-
 fs/smb/server/vfs_cache.c                          |   31 +-
 fs/smb/server/vfs_cache.h                          |    3 +
 fs/sysfs/file.c                                    |    4 +
 fs/udf/balloc.c                                    |    5 +-
 fs/udf/super.c                                     |   11 +-
 fs/userfaultfd.c                                   |   14 +-
 fs/xfs/xfs_dquot.c                                 |   16 +-
 fs/xfs/xfs_log_recover.c                           |   15 +-
 fs/xfs/xfs_reflink.c                               |   36 +
 include/crypto/drbg.h                              |   18 +-
 include/dt-bindings/power/fsl,imx93-power.h        |    1 +
 include/linux/audit.h                              |    8 +
 include/linux/backing-dev-defs.h                   |    4 +
 include/linux/bitops.h                             |    2 +
 include/linux/bpf.h                                |    3 +
 include/linux/bpf_local_storage.h                  |    3 -
 include/linux/damon.h                              |    8 +-
 include/linux/device.h                             |    5 +-
 include/linux/efi.h                                |   11 +
 include/linux/f2fs_fs.h                            |    3 +
 include/linux/file.h                               |    2 +
 include/linux/fwnode.h                             |    2 +
 include/linux/glob.h                               |    1 +
 include/linux/hid-sensor-hub.h                     |   25 +
 include/linux/hid.h                                |   29 +
 include/linux/host1x.h                             |    7 +
 include/linux/iio/common/inv_sensors_timestamp.h   |   94 ++
 include/linux/jiffies.h                            |   13 +
 include/linux/pci.h                                |    4 +-
 include/linux/seqlock.h                            |  110 ++
 include/linux/sunrpc/xprt.h                        |    2 +
 include/linux/vfio_pci_core.h                      |   24 +-
 include/linux/virtio.h                             |   18 +
 include/linux/vmalloc.h                            |    4 +-
 include/linux/writeback.h                          |    2 +
 include/net/addrconf.h                             |   10 +-
 include/net/bluetooth/hci.h                        |   19 +-
 include/net/bluetooth/hci_core.h                   |    9 +-
 include/net/bluetooth/l2cap.h                      |   54 +-
 include/net/fib_rules.h                            |    5 +
 include/net/gue.h                                  |    2 +-
 include/net/ip_fib.h                               |    7 +-
 include/net/ip_vs.h                                |    3 +-
 include/net/netfilter/nf_queue.h                   |    1 +
 include/net/rtnetlink.h                            |    2 +
 include/net/sctp/sctp.h                            |    3 +-
 include/net/sock.h                                 |    2 +-
 include/net/xfrm.h                                 |   22 +-
 include/sound/asequencer.h                         |    4 +
 include/sound/seq_kernel.h                         |    8 +
 include/uapi/linux/bpf.h                           |    1 +
 include/uapi/linux/xfrm.h                          |    6 +
 include/uapi/sound/asequencer.h                    |   54 +-
 io_uring/io-wq.c                                   |    2 +-
 kernel/audit.c                                     |   85 +-
 kernel/bpf/bpf_lsm.c                               |   34 +-
 kernel/bpf/cgroup.c                                |    2 +-
 kernel/bpf/core.c                                  |    2 +-
 kernel/bpf/devmap.c                                |   19 +
 kernel/bpf/hashtab.c                               |   21 +-
 kernel/bpf/helpers.c                               |   12 +-
 kernel/bpf/inode.c                                 |   13 +-
 kernel/bpf/lpm_trie.c                              |   10 +-
 kernel/bpf/syscall.c                               |    5 +-
 kernel/bpf/verifier.c                              |    3 +-
 kernel/cgroup/cpuset.c                             |    7 +-
 kernel/cpu.c                                       |   20 +-
 kernel/events/core.c                               |   14 +-
 kernel/module/decompress.c                         |    2 +
 kernel/sched/core.c                                |    1 +
 kernel/sched/fair.c                                |    2 +-
 kernel/sched/features.h                            |    8 +
 kernel/time/posix-cpu-timers.c                     |    3 +-
 kernel/time/time.c                                 |    2 +-
 kernel/trace/bpf_trace.c                           |   11 +-
 kernel/trace/ring_buffer.c                         |    3 +-
 kernel/trace/trace_eprobe.c                        |    2 +-
 kernel/trace/trace_events_filter.c                 |    6 +-
 kernel/trace/trace_probe.c                         |    3 +-
 kernel/trace/trace_probe.h                         |    2 +-
 kernel/workqueue.c                                 |    2 +-
 lib/debugobjects.c                                 |   17 +
 lib/glob.c                                         |   31 +-
 lib/test_meminit.c                                 |    2 +-
 mm/backing-dev.c                                   |    5 +
 mm/damon/core.c                                    |    2 +-
 mm/damon/ops-common.c                              |    1 +
 mm/damon/reclaim.c                                 |    2 +-
 mm/damon/sysfs.c                                   |    9 +-
 mm/shrinker_debug.c                                |   30 +-
 mm/vmscan.c                                        |    6 +-
 net/6lowpan/nhc.c                                  |    2 +-
 net/9p/client.c                                    |    2 +
 net/9p/trans_rdma.c                                |   19 +-
 net/atm/common.c                                   |    2 +
 net/batman-adv/distributed-arp-table.c             |   30 +-
 net/batman-adv/fragmentation.c                     |    8 +-
 net/batman-adv/gateway_client.c                    |    3 +-
 net/batman-adv/main.c                              |   13 +-
 net/batman-adv/routing.c                           |    3 +-
 net/batman-adv/soft-interface.c                    |   17 +-
 net/batman-adv/soft-interface.h                    |    2 +
 net/batman-adv/translation-table.c                 |    5 +-
 net/bluetooth/6lowpan.c                            |   35 +-
 net/bluetooth/Kconfig                              |    8 -
 net/bluetooth/Makefile                             |    1 -
 net/bluetooth/a2mp.c                               | 1054 ----------------
 net/bluetooth/a2mp.h                               |  154 ---
 net/bluetooth/af_bluetooth.c                       |   17 +-
 net/bluetooth/amp.c                                |  591 ---------
 net/bluetooth/amp.h                                |   61 -
 net/bluetooth/bnep/core.c                          |   27 +-
 net/bluetooth/eir.c                                |    8 +-
 net/bluetooth/hci_codec.c                          |    2 +-
 net/bluetooth/hci_conn.c                           |   60 +-
 net/bluetooth/hci_core.c                           |   65 +-
 net/bluetooth/hci_event.c                          |   66 +-
 net/bluetooth/hci_sync.c                           |   24 +
 net/bluetooth/iso.c                                |   16 +-
 net/bluetooth/l2cap_core.c                         | 1306 +++-----------------
 net/bluetooth/l2cap_sock.c                         |  125 +-
 net/bluetooth/mgmt.c                               |   75 +-
 net/bluetooth/msft.c                               |    2 +-
 net/bluetooth/sco.c                                |   62 +-
 net/bluetooth/smp.c                                |   27 +-
 net/bridge/br_cfm.c                                |    6 +
 net/bridge/br_cfm_netlink.c                        |    4 +-
 net/bridge/br_if.c                                 |    3 +
 net/bridge/br_stp.c                                |    3 +-
 net/bridge/netfilter/ebtables.c                    |   22 +-
 net/bridge/netfilter/nft_meta_bridge.c             |    4 +-
 net/can/bcm.c                                      |  127 +-
 net/can/isotp.c                                    |    9 +-
 net/core/fib_rules.c                               |    6 +-
 net/core/filter.c                                  |   28 +-
 net/core/flow_dissector.c                          |   12 +-
 net/core/lwt_bpf.c                                 |   12 +
 net/core/rtnetlink.c                               |    8 +
 net/core/skbuff.c                                  |   23 +-
 net/dsa/tag_ksz.c                                  |   18 +-
 net/ieee802154/core.c                              |    2 +-
 net/ieee802154/header_ops.c                        |    9 +-
 net/ieee802154/ieee802154.h                        |   17 +
 net/ieee802154/netlink.c                           |   36 +-
 net/ife/ife.c                                      |    2 +-
 net/ipv4/esp4_offload.c                            |    2 +-
 net/ipv4/igmp.c                                    |    1 +
 net/ipv4/ip_gre.c                                  |    6 +
 net/ipv4/ip_output.c                               |    4 +-
 net/ipv4/ip_vti.c                                  |    3 +
 net/ipv4/ipip.c                                    |    3 +
 net/ipv4/netfilter/nf_reject_ipv4.c                |    2 +-
 net/ipv4/sysctl_net_ipv4.c                         |   10 +-
 net/ipv4/tcp_output.c                              |    4 +-
 net/ipv6/addrconf.c                                |   23 +-
 net/ipv6/esp6_offload.c                            |    2 +-
 net/ipv6/ip6_gre.c                                 |    6 +
 net/ipv6/ip6_vti.c                                 |    3 +
 net/ipv6/mcast.c                                   |  165 ++-
 net/ipv6/netfilter.c                               |    4 +-
 net/ipv6/netfilter/ip6t_ah.c                       |    5 +
 net/ipv6/netfilter/ip6t_hbh.c                      |    1 +
 net/ipv6/netfilter/ip6t_rt.c                       |    3 +-
 net/ipv6/netfilter/nf_conntrack_reasm.c            |    3 +-
 net/ipv6/route.c                                   |    9 +-
 net/ipv6/seg6.c                                    |    3 +
 net/ipv6/sit.c                                     |    3 +
 net/kcm/kcmsock.c                                  |    8 +-
 net/key/af_key.c                                   |    1 +
 net/llc/af_llc.c                                   |    1 +
 net/llc/llc_conn.c                                 |    1 -
 net/mac80211/main.c                                |    3 +-
 net/mac80211/tx.c                                  |   17 +-
 net/mac802154/iface.c                              |    2 +-
 net/netfilter/ipset/ip_set_core.c                  |   12 +-
 net/netfilter/ipset/ip_set_hash_gen.h              |   67 +-
 net/netfilter/ipvs/ip_vs_app.c                     |   10 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |    4 +-
 net/netfilter/ipvs/ip_vs_core.c                    |   36 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |   18 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |   11 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c               |    3 +-
 net/netfilter/nf_conncount.c                       |   23 +-
 net/netfilter/nf_conntrack_core.c                  |   18 +-
 net/netfilter/nf_conntrack_ecache.c                |    2 +-
 net/netfilter/nf_conntrack_irc.c                   |    6 +-
 net/netfilter/nf_conntrack_netlink.c               |    2 +-
 net/netfilter/nf_conntrack_seqadj.c                |    2 +
 net/netfilter/nf_nat_core.c                        |   10 +
 net/netfilter/nf_nat_sip.c                         |   11 +
 net/netfilter/nf_queue.c                           |   14 +
 net/netfilter/nfnetlink_cthelper.c                 |    4 +-
 net/netfilter/nfnetlink_osf.c                      |    6 +-
 net/netfilter/nfnetlink_queue.c                    |    3 +
 net/netfilter/nft_log.c                            |   58 +-
 net/netfilter/nft_synproxy.c                       |    9 +-
 net/netfilter/xt_AUDIT.c                           |   58 +-
 net/netfilter/xt_cluster.c                         |    2 +-
 net/netfilter/xt_connmark.c                        |   14 +-
 net/netfilter/xt_nat.c                             |    9 +
 net/netfilter/xt_rateest.c                         |    2 +-
 net/netfilter/xt_u32.c                             |   12 +-
 net/openvswitch/conntrack.c                        |    2 +-
 net/openvswitch/flow_netlink.c                     |  201 ++-
 net/psample/psample.c                              |    6 +-
 net/qrtr/af_qrtr.c                                 |    2 +-
 net/sched/act_bpf.c                                |    2 +-
 net/sched/act_pedit.c                              |   11 +-
 net/sched/cls_api.c                                |    3 +
 net/sched/cls_bpf.c                                |   10 +-
 net/sched/cls_flow.c                               |   12 +-
 net/sched/sch_cake.c                               |    5 +-
 net/sched/sch_codel.c                              |   48 +-
 net/sched/sch_drr.c                                |    8 +-
 net/sched/sch_fq_codel.c                           |   41 +-
 net/sched/sch_hfsc.c                               |   24 +-
 net/sched/sch_hhf.c                                |   27 +
 net/sched/sch_htb.c                                |   14 +-
 net/sched/sch_multiq.c                             |    2 +-
 net/sched/sch_teql.c                               |  126 +-
 net/sctp/diag.c                                    |   67 +-
 net/sctp/sm_make_chunk.c                           |   10 +-
 net/sctp/sm_statefuns.c                            |   23 +-
 net/sctp/socket.c                                  |   29 +-
 net/smc/smc_cdc.c                                  |   15 +-
 net/socket.c                                       |    2 +-
 net/sunrpc/xprt.c                                  |   16 +
 net/sunrpc/xprtrdma/backchannel.c                  |    5 +-
 net/sunrpc/xprtrdma/frwr_ops.c                     |    2 +-
 net/sunrpc/xprtrdma/rpc_rdma.c                     |  172 ++-
 net/sunrpc/xprtrdma/transport.c                    |   85 +-
 net/sunrpc/xprtrdma/verbs.c                        |  167 ++-
 net/sunrpc/xprtrdma/xprt_rdma.h                    |    7 +-
 net/tipc/bcast.c                                   |   22 +-
 net/tipc/bcast.h                                   |    2 +-
 net/tipc/bearer.c                                  |    1 +
 net/tipc/name_distr.c                              |   13 +-
 net/tipc/netlink.c                                 |   12 +
 net/tipc/node.c                                    |   15 +-
 net/tipc/socket.c                                  |    3 +
 net/wireless/nl80211.c                             |    2 +-
 net/xfrm/xfrm_device.c                             |    3 +
 net/xfrm/xfrm_input.c                              |    6 +-
 net/xfrm/xfrm_interface_core.c                     |    3 +
 net/xfrm/xfrm_policy.c                             |   32 +-
 net/xfrm/xfrm_state.c                              |    2 +-
 net/xfrm/xfrm_user.c                               |   22 +-
 samples/trace_events/trace-events-sample.c         |    4 +
 scripts/kconfig/conf.c                             |    6 +-
 security/apparmor/apparmorfs.c                     |    2 +
 security/apparmor/domain.c                         |   58 +-
 security/apparmor/label.c                          |    2 +-
 security/apparmor/net.c                            |    2 +
 security/apparmor/policy.c                         |    5 +-
 security/apparmor/procattr.c                       |    2 +
 security/integrity/evm/evm_secfs.c                 |   16 +-
 security/keys/keyring.c                            |    2 +-
 security/selinux/hooks.c                           |   19 +-
 sound/aoa/fabrics/layout.c                         |    6 +
 sound/core/init.c                                  |   11 +-
 sound/core/seq/Kconfig                             |    7 +
 sound/core/seq/seq_clientmgr.c                     |  174 ++-
 sound/core/seq/seq_clientmgr.h                     |    2 +
 sound/core/seq/seq_compat.c                        |    1 +
 sound/core/seq/seq_memory.c                        |   10 +-
 sound/core/seq/seq_memory.h                        |   19 +-
 sound/core/seq/seq_midi.c                          |   55 +-
 sound/firewire/isight.c                            |    3 +-
 sound/isa/gus/gus_pcm.c                            |    2 +
 sound/pci/cmipci.c                                 |    6 +
 sound/pci/es1938.c                                 |    2 +
 sound/pci/ice1712/aureon.c                         |    2 +
 sound/pci/ice1712/ice1712.c                        |    8 +
 sound/pci/ice1712/ice1724.c                        |    6 +
 sound/pci/ymfpci/ymfpci_main.c                     |    6 +
 sound/soc/codecs/adau1372.c                        |    5 +
 sound/soc/codecs/hdac_hdmi.c                       |    4 +-
 sound/soc/codecs/tlv320aic3x.c                     |   25 +-
 sound/soc/fsl/fsl_asrc_dma.c                       |   20 +
 sound/soc/fsl/fsl_audmix.c                         |    6 +
 sound/soc/qcom/qdsp6/q6apm.c                       |    8 +
 sound/soc/sof/ipc3-control.c                       |   52 +-
 sound/soc/tegra/tegra210_ahub.c                    |    4 +-
 sound/usb/caiaq/input.c                            |    2 +-
 sound/usb/mixer_quirks.c                           |  101 +-
 sound/usb/mixer_scarlett.c                         |    4 +-
 sound/usb/mixer_us16x08.c                          |  127 +-
 sound/virtio/virtio_pcm.c                          |    3 +-
 sound/virtio/virtio_pcm_ops.c                      |    3 +-
 tools/bpf/bpftool/net.c                            |    4 +-
 tools/include/linux/bitops.h                       |    2 +
 tools/include/uapi/linux/bpf.h                     |    1 +
 tools/lib/api/fs/fs.c                              |   19 +-
 tools/lib/bpf/libbpf.c                             |    9 +-
 tools/lib/bpf/strset.c                             |   62 +-
 tools/lib/bpf/usdt.c                               |   16 +-
 tools/lib/symbol/kallsyms.c                        |    5 +-
 tools/perf/builtin-c2c.c                           |    1 +
 tools/perf/builtin-sched.c                         |   63 +-
 tools/perf/trace/beauty/fcntl.c                    |   16 +
 tools/perf/util/bpf-event.c                        |   18 +-
 tools/perf/util/bpf-utils.c                        |   16 +
 tools/perf/util/cpumap.c                           |   10 +
 tools/perf/util/event.c                            |   15 +-
 tools/perf/util/header.c                           |   54 +
 tools/perf/util/hist.c                             |    7 +-
 .../util/intel-pt-decoder/intel-pt-insn-decoder.c  |   11 +-
 tools/perf/util/machine.c                          |   10 +-
 tools/perf/util/mmap.c                             |   18 +-
 tools/perf/util/pmu.c                              |   10 +-
 tools/perf/util/probe-finder.c                     |    4 +-
 tools/perf/util/symbol-elf.c                       |   48 +-
 tools/perf/util/symbol-minimal.c                   |   11 +-
 tools/perf/util/symbol.c                           |    2 +-
 tools/perf/util/thread.c                           |    5 +
 tools/power/x86/intel-speed-select/isst-daemon.c   |    9 +-
 tools/testing/cxl/test/cxl.c                       |    8 +-
 tools/testing/cxl/test/mem.c                       |    4 +-
 .../selftests/bpf/progs/bpf_iter_task_vma.c        |    2 +-
 tools/testing/selftests/vm/compaction_test.c       |    3 +
 tools/testing/selftests/vm/hmm-tests.c             |   63 +-
 tools/usb/usbip/libsrc/usbip_common.c              |    2 +
 tools/usb/usbip/libsrc/usbip_device_driver.c       |    4 +
 tools/usb/usbip/libsrc/vhci_driver.c               |    1 +
 tools/virtio/linux/dma-mapping.h                   |   12 +
 tools/virtio/vringh_test.c                         |    5 +
 tools/vm/slabinfo.c                                |    4 +-
 virt/kvm/eventfd.c                                 |   12 +-
 virt/kvm/kvm_main.c                                |   16 +-
 979 files changed, 11753 insertions(+), 8931 deletions(-)

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chaitanya Kulkarni <[email protected]>

commit 5293a8882c549fab4a878bc76b0b6c951f980a61 upstream.

nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown.

If an NVMe/TCP host sends an Initialization Connection Request (ICReq) and immediately closes the connection, target-side teardown may start in softirq context before io_work drains the already buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue reference under state_lock.

If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and allows a later socket state change to re-enter teardown and issue a second kref_put() on an already released queue.

The ICResp send failure path has the same problem. If teardown has already moved the queue to DISCONNECTING, a send error can still overwrite the state with NVMET_TCP_Q_FAILED, again reopening the window for a second teardown path to drop the queue reference.

Fix this by serializing both post-send state transitions with state_lock and bailing out if teardown has already started.

Use -ESHUTDOWN as an internal sentinel for that bail-out path rather than propagating it as a transport error like -ECONNRESET. Keep nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before honoring that sentinel so receive-side parsing stays quiesced until the existing release path completes.

[ context diff adaptation: drop queue->state = NVMET_TCP_Q_FAILED since
the enum introduced in 6.7, 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall" ]

---
 drivers/nvme/target/tcp.c | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

index 01d685499b97de..a0751ca359f57e 100644
@@ -353,6 +353,19 @@ static int nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
 
 static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue)
 {
+	/*
+	 * Keep rcv_state at RECV_ERR even for the internal -ESHUTDOWN path.
+	 * nvmet_tcp_handle_icreq() can return -ESHUTDOWN after the ICReq has
+	 * already been consumed and queue teardown has started.
+	 *
+	 * If nvmet_tcp_data_ready() or nvmet_tcp_write_space() queues
+	 * nvmet_tcp_io_work() again before nvmet_tcp_release_queue_work()
+	 * cancels it, the queue must not keep that old receive state.
+	 * Otherwise the next nvmet_tcp_io_work() run can reach
+	 * nvmet_tcp_done_recv_pdu() and try to handle the same ICReq again.
+	 *
+	 * That is why queue->rcv_state needs to be updated before we return.
+	 */
 	queue->rcv_state = NVMET_TCP_RECV_ERR;
 	if (queue->nvme_sq.ctrl)
 		nvmet_ctrl_fatal_error(queue->nvme_sq.ctrl);

@@ -896,10 +909,24 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue)
 	iov.iov_base = icresp;
 	iov.iov_len = sizeof(*icresp);
 	ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
-	if (ret < 0)
+	if (ret < 0) {
+		spin_lock_bh(&queue->state_lock);
+		if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
+			spin_unlock_bh(&queue->state_lock);
+			return -ESHUTDOWN;
+		}
+		spin_unlock_bh(&queue->state_lock);
 		return ret; /* queue removal will cleanup */
+	}
 
+	spin_lock_bh(&queue->state_lock);
+	if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
+		spin_unlock_bh(&queue->state_lock);
+		/* Tell nvmet_tcp_socket_error() teardown is in progress. */
+		return -ESHUTDOWN;
+	}
 	queue->state = NVMET_TCP_Q_LIVE;
+	spin_unlock_bh(&queue->state_lock);
 	nvmet_prepare_receive_pdu(queue);
 	return 0;
 }

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <[email protected]>

[ Upstream commit 48d83d94930eb4db4c93d2de44838b9455cff626 ]

aarch64_insn_gen_cond_branch_imm() calls label_imm_common() to compute a 19-bit signed byte offset for a conditional branch, but unlike its siblings aarch64_insn_gen_branch_imm() and aarch64_insn_gen_comp_branch_imm(), it does not check whether label_imm_common() returned its out-of-range sentinel (range) before feeding the value to aarch64_insn_encode_immediate().

aarch64_insn_encode_immediate() unconditionally masks the value with the 19-bit field mask, so an offset that was rejected by label_imm_common() gets silently truncated. With the sentinel value SZ_1M, the resulting field ends up with bit 18 (the sign bit of the 19-bit signed displacement) set, and the CPU decodes it as a ~1 MiB *backward* branch, producing an incorrectly targeted B.cond instruction. For code-gen locations like the emit_bpf_tail_call() this function is the only barrier between an overflowing displacement and a silently miscompiled branch.

Fix it by returning AARCH64_BREAK_FAULT when the offset is out of range, so callers see a loud failure instead of a silently misencoded branch. validate_code() scans the generated image for any AARCH64_BREAK_FAULT and then lets the JIT fail.

---
 arch/arm64/lib/insn.c | 2 ++
 1 file changed, 2 insertions(+)

index 44bb90ee2f414b..a50f6c061c27a2 100644
@@ -423,6 +423,8 @@ u32 aarch64_insn_gen_cond_branch_imm(unsigned long pc, unsigned long addr,
 	long offset;
 
 	offset = label_imm_common(pc, addr, SZ_1M);
+	if (offset >= SZ_1M)
+		return AARCH64_BREAK_FAULT;
 
 	insn = aarch64_insn_get_bcond_value();
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Mason <[email protected]>

commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 upstream.

nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer.

The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail.

A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work.

    nfsd4_alloc_layout_stateid()
      nfs4_alloc_stid()           /* idr_alloc_cyclic under cl_lock */
      nfsd4_layout_setlease()     /* fails */
        nfs4_put_stid()
          nfsd4_free_layout_stateid()
            delayed_work_pending(&ls->ls_fence_work)  /* needs INIT */
            nfsd4_close_layout()  /* nfsd_file_put(ls->ls_file) */
          put_nfs4_file()

Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp).

---
 fs/nfsd/nfs4layouts.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

index 308214378fd352..84bb200e24adea 100644
@@ -242,9 +242,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
 	BUG_ON(!ls->ls_file);
 
 	if (nfsd4_layout_setlease(ls)) {
-		nfsd_file_put(ls->ls_file);
-		put_nfs4_file(fp);
-		kmem_cache_free(nfs4_layout_stateid_cache, ls);
+		nfs4_put_stid(stp);
 		return NULL;
 	}
 

2.53.0

perf also fails to build with:

In file included from builtin-sched.c:28:
builtin-sched.c: In function 'latency_switch_event':
builtin-sched.c:1182:34: error: 'struct perf_sample' has no member named 'file_offset'
1182 | sample->file_offset, cpu);
| ^~
util/debug.h:24:44: note: in definition of macro 'pr_warning'
24 | eprintf(0, verbose, pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~
builtin-sched.c: In function 'latency_runtime_event':
builtin-sched.c:1260:34: error: 'struct perf_sample' has no member named 'file_offset'
1260 | sample->file_offset, cpu);
| ^~
util/debug.h:24:44: note: in definition of macro 'pr_warning'
24 | eprintf(0, verbose, pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~
builtin-sched.c: In function 'map_switch_event':
builtin-sched.c:1622:34: error: 'struct perf_sample' has no member named 'file_offset'
1622 | sample->file_offset, this_cpu.cpu);
| ^~
util/debug.h:24:44: note: in definition of macro 'pr_warning'
24 | eprintf(0, verbose, pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~
make[5]: *** [/local/users/fainelli/buildroot/output/arm/build/linux-custom/tools/build/Makefile.build:96: /local/users/fainelli/buildroot/output/arm/build/linux-custom/tools/perf/builtin-sched.o] Error 1

It looks like we need to backport 7a490187f22b ("perf sample: Add file_offset field to struct perf_sample") and pay attention to struct perf_sample being defined in tools/perf/util/event.h in this older kernel version, whereas the upstream commit modifies tools/perf/util/sample.h (which was introduced later).

Florian

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jeff Layton <[email protected]>

commit 2090b05803faab8a9fa62fbff871007862cac1b7 upstream.

nfsd_vfs_write() and nfsd_commit() both call filemap_check_wb_err() to detect deferred writeback errors, but neither rotates the server's write verifier (nn->writeverf) when this check fails. Every other durable-storage-failure path in these functions calls commit_reset_write_verifier() before returning an error.

The missing rotation means clients holding UNSTABLE write data under the current verifier will COMMIT, receive the unchanged verifier back, and conclude their data is durable — silently dropping data that failed writeback. This violates the UNSTABLE+COMMIT durability contract (RFC 1813 §3.3.7, RFC 8881 §18.32).

Add commit_reset_write_verifier() calls at both filemap_check_wb_err() error sites, matching the pattern used by adjacent error paths in the same functions. The helper already filters -EAGAIN and -ESTALE internally, so the calls are unconditionally safe.

---
 fs/nfsd/vfs.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

index 87a596fc6654dd..c40b2a706691c5 100644
@@ -1134,8 +1134,11 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
 	nfsd_stats_io_write_add(nn, exp, *cnt);
 	fsnotify_modify(file);
 	host_err = filemap_check_wb_err(file->f_mapping, since);
-	if (host_err < 0)
+	if (host_err < 0) {
+		nfsd_reset_write_verifier(nn);
+		trace_nfsd_writeverf_reset(nn, rqstp, host_err);
 		goto out_nfserr;
+	}
 
 	if (stable && use_wgather) {
 		host_err = wait_for_concurrent_writes(file);

@@ -1271,6 +1274,10 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
 			nfsd_copy_write_verifier(verf, nn);
 			err2 = filemap_check_wb_err(nf->nf_file->f_mapping,
 						    since);
+			if (err2 < 0) {
+				nfsd_reset_write_verifier(nn);
+				trace_nfsd_writeverf_reset(nn, rqstp, err2);
+			}
 			err = nfserrno(err2);
 			break;
 		case -EINVAL:

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Huacai Chen <[email protected]>

commit f2539c56c74691e7a88af6372ba2b48c06ed2fe4 upstream.

This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all secondary CPUs in stop_this_cpu(). And the function marks the CPU offline for the scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps expecting a quiescent state from CPUs that are now spinning forever with interrupts disabled.

As long as nothing waits for an RCU grace period after smp_send_stop() this is harmless, which is why it went unnoticed. However, since commit 91840be8f710370 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT"), irq_work_sync() calls synchronize_rcu() on architectures without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() returns false. Any irq_work_sync() issued in the reboot/shutdown/halt path after smp_send_stop() then blocks on a grace period that can never complete, hanging the reboot:

  WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on
  ...
  rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
  rcu: Offline CPU 1 blocking current GP.
  rcu: Offline CPU 2 blocking current GP.
  rcu: Offline CPU 3 blocking current GP.

This issue needs some hacks to reproduce, and it was not noticed on LoongArch because arch_irq_work_has_interrupt() usually returns true.

Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring the generic CPU-hotplug offline path, so RCU stops waiting on the parked CPUs and grace periods can still complete. LoongArch shuts down all CPUs here without going through the CPU-hotplug mechanism, so this report is not otherwise issued.

---
 arch/loongarch/kernel/smp.c | 1 +
 1 file changed, 1 insertion(+)

index 18a2b37f4aea37..356918d5aa28f1 100644
@@ -517,6 +517,7 @@ static void stop_this_cpu(void *dummy)
 	set_cpu_online(smp_processor_id(), false);
 	calculate_cpu_foreign_map();
 	local_irq_disable();
+	rcu_report_dead(smp_processor_id());
 	while (true);
 }
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kiryl Shutsemau <[email protected]>

[ Upstream commit 8e80af52db652fbc41320eee45a4f73bc029faf2 ]

userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE without taking the page table lock and then apply pte_write() / huge_pte_write() to it. Those accessors decode bits from the present encoding only; on a swap or migration entry they read the offset bits that happen to share the same position and return an undefined result.

The intent of the check is "is this fault still WP-blocked?". A non-marker swap entry means the page is in transit -- the userfault context the original fault delivered against is no longer the same, and the swap-in or migration completion path will re-deliver a fresh fault if userspace still needs to handle it. Worst case under the current code the garbage write bit says "wait", and the thread stays asleep until a UFFDIO_WAKE that may never arrive.

Gate the writability check on pte_present() so the lockless re-check only inspects present-PTE bits when the entry is actually present. The non-present, non-marker case returns "don't wait" and lets the fault path retry.

[ kas: apply to fs/userfaultfd.c and fold the pte_present()/
huge_pte_present() gate into the existing writability checks; this tree predates the marker/return-style refactor of these functions ]

---
 fs/userfaultfd.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

index 7f8b397597b0d1..6ebee2b3a5a83e 100644
@@ -273,7 +273,12 @@ static inline bool userfaultfd_huge_must_wait(struct userfaultfd_ctx *ctx,
 	 */
 	if (huge_pte_none_mostly(pte))
 		ret = true;
-	if (!huge_pte_write(pte) && (reason & VM_UFFD_WP))
+	/*
+	 * Gate the writability check on pte_present(): huge_pte_write() on a
+	 * non-present migration entry decodes random offset bits. The
+	 * migration completion path re-delivers the fault if still needed.
+	 */
+	if (pte_present(pte) && !huge_pte_write(pte) && (reason & VM_UFFD_WP))
 		ret = true;
 out:
 	return ret;

@@ -355,7 +360,12 @@ static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
 	 */
 	if (pte_none_mostly(*pte))
 		ret = true;
-	if (!pte_write(*pte) && (reason & VM_UFFD_WP))
+	/*
+	 * Gate the writability check on pte_present(): pte_write() on a
+	 * non-present swap/migration entry decodes random offset bits. The
+	 * page-in path re-delivers the fault if it still needs userspace.
+	 */
+	if (pte_present(*pte) && !pte_write(*pte) && (reason & VM_UFFD_WP))
 		ret = true;
 	pte_unmap(pte);
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pedro Tammela <[email protected]>

[ Upstream commit 5036034572b79daa6d6600338e8e8229e2a44b09 ]

Transform two checks in the 'ex' key parsing into netlink policies removing extra if checks.

---
 net/sched/act_pedit.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

index 09310b56b45beb..1d06873da8f12d 100644
@@ -35,8 +35,9 @@ static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
 };
 
 static const struct nla_policy pedit_key_ex_policy[TCA_PEDIT_KEY_EX_MAX + 1] = {
-	[TCA_PEDIT_KEY_EX_HTYPE]  = { .type = NLA_U16 },
-	[TCA_PEDIT_KEY_EX_CMD]	  = { .type = NLA_U16 },
+	[TCA_PEDIT_KEY_EX_HTYPE] =
+		NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_HDR_TYPE_MAX),
+	[TCA_PEDIT_KEY_EX_CMD] = NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_CMD_MAX),
 };
 
 static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,

@@ -86,12 +87,6 @@ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,
 		k->htype = nla_get_u16(tb[TCA_PEDIT_KEY_EX_HTYPE]);
 		k->cmd = nla_get_u16(tb[TCA_PEDIT_KEY_EX_CMD]);
 
-		if (k->htype > TCA_PEDIT_HDR_TYPE_MAX ||
-		    k->cmd > TCA_PEDIT_CMD_MAX) {
-			err = -EINVAL;
-			goto err_out;
-		}
-
 		k++;
 	}
 

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjorn Andersson <[email protected]>

[ Upstream commit 8663e8334d7b6007f5d8a4e5dd270246f35107a6 ]

Device drivers should not invoke platform_driver_register()/unregister() in their probe and remove paths. They should further not rely on platform_driver_unregister() as their only means of "deleting" their child devices.

Introduce a helper to unregister the child device and move the platform_driver_register()/unregister() to module_init()/exit().

---
 drivers/slimbus/qcom-ngd-ctrl.c | 36 ++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

index d294965e49972c..a43daa48484f1e 100644
@@ -1488,6 +1488,13 @@ static int of_qcom_slim_ngd_register(struct device *parent,
 	return -ENODEV;
 }
 
+static void qcom_slim_ngd_unregister(struct qcom_slim_ngd_ctrl *ctrl)
+{
+	struct qcom_slim_ngd *ngd = ctrl->ngd;
+
+	platform_device_del(ngd->pdev);
+}
+
 static int qcom_slim_ngd_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;

@@ -1592,7 +1599,6 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 		goto err_pdr_lookup;
 	}
 
-	platform_driver_register(&qcom_slim_ngd_driver);
 	return of_qcom_slim_ngd_register(dev, ctrl);
 
 err_pdr_alloc:

@@ -1606,7 +1612,9 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 
 static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
 {
-	platform_driver_unregister(&qcom_slim_ngd_driver);
+	struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+	qcom_slim_ngd_unregister(ctrl);
 
 	return 0;
 }

@@ -1685,6 +1693,28 @@ static struct platform_driver qcom_slim_ngd_driver = {
 	},
 };
 
-module_platform_driver(qcom_slim_ngd_ctrl_driver);
+static int qcom_slim_ngd_init(void)
+{
+	int ret;
+
+	ret = platform_driver_register(&qcom_slim_ngd_driver);
+	if (ret)
+		return ret;
+
+	ret = platform_driver_register(&qcom_slim_ngd_ctrl_driver);
+	if (ret)
+		platform_driver_unregister(&qcom_slim_ngd_driver);
+
+	return ret;
+}
+
+static void qcom_slim_ngd_exit(void)
+{
+	platform_driver_unregister(&qcom_slim_ngd_ctrl_driver);
+	platform_driver_unregister(&qcom_slim_ngd_driver);
+}
+
+module_init(qcom_slim_ngd_init);
+module_exit(qcom_slim_ngd_exit);
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Qualcomm SLIMBus NGD controller");

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjorn Andersson <[email protected]>

[ Upstream commit 2c22ff152d380ec3d3af099fa05d0ac5ca9b4c1e ]

qcom_slim_ngd_ctrl_probe() first registers the SSR callback then allocates the PDR context, as such the error path needs to come in opposite order to allow us to unroll each step.

---
 drivers/slimbus/qcom-ngd-ctrl.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

index a43daa48484f1e..62b0615a62c68f 100644
@@ -1590,22 +1590,21 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 	if (IS_ERR(ctrl->pdr)) {
 		ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr),
 				    "Failed to init PDR handle\n");
-		goto err_pdr_alloc;
+		goto err_unregister_ssr;
 	}
 
 	pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
 	if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
 		ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n");
-		goto err_pdr_lookup;
+		goto err_pdr_release;
 	}
 
 	return of_qcom_slim_ngd_register(dev, ctrl);
 
-err_pdr_alloc:
-	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
-
-err_pdr_lookup:
+err_pdr_release:
 	pdr_handle_release(ctrl->pdr);
+err_unregister_ssr:
+	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
 
 	return ret;
 }

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjorn Andersson <[email protected]>

[ Upstream commit 960b53a3f76fa214c2fc493734ae7b3c5e713bbf ]

PDR and SSR callbacks are registred from the controller probe function, but currently released from the child device's remove function.

The remove() function should only be unwinding what was done in the same device's probe() function.

---
 drivers/slimbus/qcom-ngd-ctrl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

index 62b0615a62c68f..6003f6f99e1db3 100644
@@ -1613,6 +1613,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
 {
 	struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
 
+	pdr_handle_release(ctrl->pdr);
+	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
 	qcom_slim_ngd_unregister(ctrl);
 
 	return 0;

@@ -1623,8 +1626,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
 	struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
 
 	pm_runtime_disable(&pdev->dev);
-	pdr_handle_release(ctrl->pdr);
-	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
 	qcom_slim_ngd_enable(ctrl, false);
 	qcom_slim_ngd_exit_dma(ctrl);
 	qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Uwe Kleine-König <[email protected]>

[ Upstream commit 880b33b0580c8ac9d0202b6e592cb116c99d1b65 ]

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks.

To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().

Trivially convert the slimbus drivers from always returning zero in the remove callback to the void returning variant.

Stable-dep-of: 2a9d50e9ea40 ("slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd")

---
 drivers/slimbus/qcom-ctrl.c     |  5 ++---
 drivers/slimbus/qcom-ngd-ctrl.c | 15 +++++----------
 2 files changed, 7 insertions(+), 13 deletions(-)

index c0c4f895d76e20..31f46000ca030f 100644
@@ -628,7 +628,7 @@ static int qcom_slim_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static int qcom_slim_remove(struct platform_device *pdev)
+static void qcom_slim_remove(struct platform_device *pdev)
 {
 	struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev);
 

@@ -637,7 +637,6 @@ static int qcom_slim_remove(struct platform_device *pdev)
 	clk_disable_unprepare(ctrl->rclk);
 	clk_disable_unprepare(ctrl->hclk);
 	destroy_workqueue(ctrl->rxwq);
-	return 0;
 }
 
 /*

@@ -724,7 +723,7 @@ static const struct of_device_id qcom_slim_dt_match[] = {
 
 static struct platform_driver qcom_slim_driver = {
 	.probe = qcom_slim_probe,
-	.remove = qcom_slim_remove,
+	.remove_new = qcom_slim_remove,
 	.driver	= {
 		.name = "qcom_slim_ctrl",
 		.of_match_table = qcom_slim_dt_match,

index 6003f6f99e1db3..bf2007dc3cd043 100644
@@ -1537,7 +1537,6 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct qcom_slim_ngd_ctrl *ctrl;
-	struct resource *res;
 	int ret;
 	struct pdr_service *pds;
 

@@ -1547,8 +1546,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 
 	dev_set_drvdata(dev, ctrl);
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	ctrl->base = devm_ioremap_resource(dev, res);
+	ctrl->base = devm_platform_get_and_ioremap_resource(pdev, 0, NULL);
 	if (IS_ERR(ctrl->base))
 		return PTR_ERR(ctrl->base);
 

@@ -1609,7 +1607,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+static void qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
 {
 	struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
 

@@ -1617,11 +1615,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
 	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
 
 	qcom_slim_ngd_unregister(ctrl);
-
-	return 0;
 }
 
-static int qcom_slim_ngd_remove(struct platform_device *pdev)
+static void qcom_slim_ngd_remove(struct platform_device *pdev)
 {
 	struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
 

@@ -1634,7 +1630,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
 
 	kfree(ctrl->ngd);
 	ctrl->ngd = NULL;
-	return 0;
 }
 
 static int __maybe_unused qcom_slim_ngd_runtime_idle(struct device *dev)

@@ -1677,7 +1672,7 @@ static const struct dev_pm_ops qcom_slim_ngd_dev_pm_ops = {
 
 static struct platform_driver qcom_slim_ngd_ctrl_driver = {
 	.probe = qcom_slim_ngd_ctrl_probe,
-	.remove = qcom_slim_ngd_ctrl_remove,
+	.remove_new = qcom_slim_ngd_ctrl_remove,
 	.driver	= {
 		.name = "qcom,slim-ngd-ctrl",
 		.of_match_table = qcom_slim_ngd_dt_match,

@@ -1686,7 +1681,7 @@ static struct platform_driver qcom_slim_ngd_ctrl_driver = {
 
 static struct platform_driver qcom_slim_ngd_driver = {
 	.probe = qcom_slim_ngd_probe,
-	.remove = qcom_slim_ngd_remove,
+	.remove_new = qcom_slim_ngd_remove,
 	.driver	= {
 		.name = QCOM_SLIM_NGD_DRV_NAME,
 		.pm = &qcom_slim_ngd_dev_pm_ops,

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjorn Andersson <[email protected]>

[ Upstream commit 2a9d50e9ea406e0c8735938484adc20515ef1b47 ]

When the remoteproc starts in parallel with the NGD driver being probed, or the remoteproc is already up when the PDR lookup is being registered, or in the theoretical event that we get an interrupt from the hardware, these callbacks will operate on uninitialized data. This result in issues to boot the affected boards.

One such example can be seen in the following fault, where qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.

[   21.858578] ------------[ cut here ]------------
[   21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116
...
[   21.859251] Call trace:
[   21.859255]  __queue_work+0x5e0/0x790 (P)
[   21.859265]  queue_work_on+0x6c/0xf0
[   21.859273]  qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl]
[   21.859304]  qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl]
[   21.859318]  notifier_call_chain+0xa4/0x230
[   21.859329]  srcu_notifier_call_chain+0x64/0xb8
[   21.859338]  ssr_notify_start+0x40/0x78 [qcom_common]
[   21.859355]  rproc_start+0x130/0x230
[   21.859367]  rproc_boot+0x3d4/0x518

...

Move the enablement of interrupts, and the registration of SSR and PDR until after the NGD device has been registered.

This could be further refined by moving initialization to the control driver probe and by removing the platform driver model from the picture.

---
 drivers/slimbus/qcom-ngd-ctrl.c | 45 +++++++++++++++++++--------------
 1 file changed, 26 insertions(+), 19 deletions(-)

index bf2007dc3cd043..76cd7d187dd2e2 100644
@@ -1537,6 +1537,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct qcom_slim_ngd_ctrl *ctrl;
+	int irq;
 	int ret;
 	struct pdr_service *pds;
 

@@ -1550,20 +1551,16 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 	if (IS_ERR(ctrl->base))
 		return PTR_ERR(ctrl->base);
 
-	ret = platform_get_irq(pdev, 0);
-	if (ret < 0)
-		return ret;
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		return irq;
 
-	ret = devm_request_irq(dev, ret, qcom_slim_ngd_interrupt,
-			       IRQF_TRIGGER_HIGH, "slim-ngd", ctrl);
+	ret = devm_request_irq(dev, irq, qcom_slim_ngd_interrupt,
+			       IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN,
+			       "slim-ngd", ctrl);
 	if (ret)
 		return dev_err_probe(&pdev->dev, ret, "request IRQ failed\n");
 
-	ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
-	ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
-	if (IS_ERR(ctrl->notifier))
-		return PTR_ERR(ctrl->notifier);
-
 	ctrl->dev = dev;
 	ctrl->framer.rootfreq = SLIM_ROOT_FREQ >> 3;
 	ctrl->framer.superfreq =

@@ -1585,24 +1582,34 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 	init_completion(&ctrl->qmi_up);
 
 	ctrl->pdr = pdr_handle_alloc(slim_pd_status, ctrl);
-	if (IS_ERR(ctrl->pdr)) {
-		ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr),
-				    "Failed to init PDR handle\n");
-		goto err_unregister_ssr;
-	}
+	if (IS_ERR(ctrl->pdr))
+		return dev_err_probe(dev, PTR_ERR(ctrl->pdr), "Failed to init PDR handle\n");
+
+	ret = of_qcom_slim_ngd_register(dev, ctrl);
+	if (ret)
+		goto err_pdr_release;
 
 	pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
 	if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
 		ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n");
-		goto err_pdr_release;
+		goto err_unregister_ngd;
+	}
+
+	ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
+	ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
+	if (IS_ERR(ctrl->notifier)) {
+		ret = PTR_ERR(ctrl->notifier);
+		goto err_unregister_ngd;
 	}
 
-	return of_qcom_slim_ngd_register(dev, ctrl);
+	enable_irq(irq);
 
+	return 0;
+
+err_unregister_ngd:
+	qcom_slim_ngd_unregister(ctrl);
 err_pdr_release:
 	pdr_handle_release(ctrl->pdr);
-err_unregister_ssr:
-	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
 
 	return ret;
 }

2.53.0

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maoyi Xie <[email protected]>

[ Upstream commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 ]

A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.

Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper.

Gate ipgre_changelink() and erspan_changelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgre_netlink_parms() sets t->collect_md before ip_tunnel_changelink() runs.

Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK.

---
 include/net/rtnetlink.h |    2 ++
 net/core/rtnetlink.c    |    8 ++++++++
 net/ipv4/ip_gre.c       |    6 ++++++
 3 files changed, 16 insertions(+)

@@ -210,6 +210,8 @@ int rtnl_configure_link(struct net_devic
 int rtnl_nla_parse_ifinfomsg(struct nlattr **tb, const struct nlattr *nla_peer,
 			     struct netlink_ext_ack *exterr);
 struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid);
+bool rtnl_dev_link_net_capable(const struct net_device *dev,
+			       const struct net *link_net);
 
 #define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind)
 

@@ -2110,6 +2110,14 @@ struct net *rtnl_get_net_ns_capable(stru
 }
 EXPORT_SYMBOL_GPL(rtnl_get_net_ns_capable);
 
+bool rtnl_dev_link_net_capable(const struct net_device *dev,
+			       const struct net *link_net)
+{
+	return net_eq(link_net, dev_net(dev)) ||
+	       ns_capable(link_net->user_ns, CAP_NET_ADMIN);
+}
+EXPORT_SYMBOL_GPL(rtnl_dev_link_net_capable);
+
 static int rtnl_valid_dump_ifinfo_req(const struct nlmsghdr *nlh,
 				      bool strict_check, struct nlattr **tb,
 				      struct netlink_ext_ack *extack)

@@ -1406,6 +1406,9 @@ static int ipgre_changelink(struct net_d
 	struct ip_tunnel_parm p;
 	int err;
 
+	if (!rtnl_dev_link_net_capable(dev, t->net))
+		return -EPERM;
+
 	err = ipgre_newlink_encap_setup(dev, data);
 	if (err)
 		return err;

@@ -1435,6 +1438,9 @@ static int erspan_changelink(struct net_
 	struct ip_tunnel_parm p;
 	int err;
 
+	if (!rtnl_dev_link_net_capable(dev, t->net))
+		return -EPERM;
+
 	err = ipgre_newlink_encap_setup(dev, data);
 	if (err)
 		return err;

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bartosz Golaszewski <[email protected]>

[ Upstream commit 7eba000621fff223dd7bab484d48918c7c77a307 ]

If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitialized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. While at it: initialize the remaining fields of struct fwnode_handle too just to be sure.

---
 include/linux/fwnode.h |    2 ++
 1 file changed, 2 insertions(+)

@@ -195,8 +195,10 @@ static inline void fwnode_init(struct fw
 {
 	fwnode->secondary = NULL;
 	fwnode->ops = ops;
+	fwnode->dev = NULL;
 	INIT_LIST_HEAD(&fwnode->consumers);
 	INIT_LIST_HEAD(&fwnode->suppliers);
+	fwnode->flags = 0;
 }
 
 static inline void fwnode_set_flag(struct fwnode_handle *fwnode,

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wenjie Qi <[email protected]>

[ Upstream commit 6d874b65aadce56ac78f76129dbcfc2599b638f8 ]

A partial atomic write reserves a block in the COW inode before reading the original data page for the untouched bytes in that page.

If that read fails, write_begin returns an error but leaves the COW inode entry as NEW_ADDR. A retry of the same partial write then finds the COW entry, treats it as existing COW data, and f2fs_write_begin() zeroes the whole folio because blkaddr is NEW_ADDR.

If the retry is committed, the bytes outside the retried write range are committed as zeroes instead of preserving the original file contents.

Only use the COW inode as the read source when it already has a real data block. If the COW entry is still NEW_ADDR, treat it as a reservation to
reuse: keep reading the old data from the original inode and avoid reserving or accounting the same atomic block again.

---
 fs/f2fs/data.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

@@ -3561,6 +3561,7 @@ static int prepare_atomic_write_begin(st
 	pgoff_t index = page->index;
 	int err = 0;
 	block_t ori_blk_addr = NULL_ADDR;
+	bool cow_has_reserved_block = false;
 
 	/* If pos is beyond the end of file, reserve a new block in COW inode */
 	if ((pos & PAGE_MASK) >= i_size_read(inode))

@@ -3570,8 +3571,10 @@ static int prepare_atomic_write_begin(st
 	err = __find_data_block(cow_inode, index, blk_addr);
 	if (err)
 		return err;
-	else if (*blk_addr != NULL_ADDR)
+	else if (__is_valid_data_blkaddr(*blk_addr))
 		return 0;
+	else if (*blk_addr == NEW_ADDR)
+		cow_has_reserved_block = true;
 
 	/* Look for the block in the original inode */
 	err = __find_data_block(inode, index, &ori_blk_addr);

@@ -3580,10 +3583,13 @@ static int prepare_atomic_write_begin(st
 
 reserve_block:
 	/* Finally, we should reserve a new block in COW inode for the update */
-	err = __reserve_data_block(cow_inode, index, blk_addr, node_changed);
-	if (err)
-		return err;
-	inc_atomic_write_cnt(inode);
+	if (!cow_has_reserved_block) {
+		err = __reserve_data_block(cow_inode, index, blk_addr,
+					   node_changed);
+		if (err)
+			return err;
+		inc_atomic_write_cnt(inode);
+	}
 
 	if (ori_blk_addr != NULL_ADDR)
 		*blk_addr = ori_blk_addr;

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wenjie Qi <[email protected]>

[ Upstream commit 846c499a65816d13f1186e3090e825e8bb8bcb8b ]

f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers.

On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead.

Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.

---
 fs/f2fs/checkpoint.c    |   14 +++++++++++++-
 include/linux/f2fs_fs.h |    3 +++
 2 files changed, 16 insertions(+), 1 deletion(-)

@@ -743,6 +743,7 @@ int f2fs_recover_orphan_inodes(struct f2
 	for (i = 0; i < orphan_blocks; i++) {
 		struct page *page;
 		struct f2fs_orphan_block *orphan_blk;
+		unsigned int entry_count;
 
 		page = f2fs_get_meta_page(sbi, start_blk + i);
 		if (IS_ERR(page)) {

@@ -751,7 +752,18 @@ int f2fs_recover_orphan_inodes(struct f2
 		}
 
 		orphan_blk = (struct f2fs_orphan_block *)page_address(page);
-		for (j = 0; j < le32_to_cpu(orphan_blk->entry_count); j++) {
+		entry_count = le32_to_cpu(orphan_blk->entry_count);
+		if (entry_count > F2FS_ORPHANS_PER_BLOCK) {
+			f2fs_err(sbi, "invalid orphan inode entry count %u",
+				 entry_count);
+			set_sbi_flag(sbi, SBI_NEED_FSCK);
+			f2fs_handle_error(sbi, ERROR_INCONSISTENT_ORPHAN);
+			err = -EFSCORRUPTED;
+			f2fs_put_page(page, 1);
+			goto out;
+		}
+
+		for (j = 0; j < entry_count; j++) {
 			nid_t ino = le32_to_cpu(orphan_blk->ino[j]);
 
 			err = recover_orphan_inode(sbi, ino);

@@ -104,6 +104,9 @@ enum f2fs_error {
 	ERROR_INCONSISTENT_SIT,
 	ERROR_CORRUPTED_VERITY_XATTR,
 	ERROR_CORRUPTED_XATTR,
+	ERROR_INVALID_NODE_REFERENCE,
+	ERROR_INCONSISTENT_NAT,
+	ERROR_INCONSISTENT_ORPHAN,
 	ERROR_MAX,
 };
 

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bryam Vargas <[email protected]>

[ Upstream commit 378acf3cf19b6af6cba55e8dd1154c4e1504bae8 ]

When the flexible_inline_xattr feature is enabled, do_read_inode() loads the on-disk i_inline_xattr_size unconditionally:

	if (f2fs_sb_has_flexible_inline_xattr(sbi))
		fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);

but sanity_check_inode() only range-checks it when the inode also has the FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline data but not FI_INLINE_XATTR -- the normal layout for an inline directory -- therefore keeps a fully attacker-controlled i_inline_xattr_size from a crafted image.

get_inline_xattr_addrs() returns that value with no flag gating, so it feeds the inode geometry:

MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1) NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)
addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size

A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY() negative, so make_dentry_ptr_inline() sets d->max (int) to a negative value. The inline directory walk then compares an unsigned long bit_pos against that negative d->max, which is promoted to a huge unsigned bound, and reads far past the inline area:

	while (bit_pos < d->max)		/* fs/f2fs/dir.c */
		... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ...

Mounting a crafted image and reading such a directory triggers an out-of-bounds read in f2fs_fill_dentries(); the same underflow also corrupts ADDRS_PER_INODE for regular files.

Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the flexible_inline_xattr feature is enabled -- i.e. whenever the value is loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE bound gated on inodes that actually carry an inline xattr, so legitimate inodes with i_inline_xattr_size == 0 are still accepted.

---
 fs/f2fs/inode.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

@@ -242,14 +242,15 @@ static bool sanity_check_inode(struct in
 		return false;
 	}
 
-	if (f2fs_has_extra_attr(inode) &&
-		f2fs_sb_has_flexible_inline_xattr(sbi) &&
-		f2fs_has_inline_xattr(inode) &&
-		(!fi->i_inline_xattr_size ||
-		fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE)) {
+	if (f2fs_sb_has_flexible_inline_xattr(sbi) &&
+		(fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE ||
+		(f2fs_has_inline_xattr(inode) &&
+		fi->i_inline_xattr_size <
+			sizeof(struct f2fs_xattr_header) / sizeof(__le32)))) {
 		set_sbi_flag(sbi, SBI_NEED_FSCK);
-		f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, max: %zu",
+		f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, min: %zu, max: %zu",
 			  __func__, inode->i_ino, fi->i_inline_xattr_size,
+			  sizeof(struct f2fs_xattr_header) / sizeof(__le32),
 			  MAX_INLINE_XATTR_SIZE);
 		return false;
 	}

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ruipeng Qi <[email protected]>

[ Upstream commit dd3114870771562036fdcf5abe813956f36d224d ]

When the f2fs filesystem space is nearly exhausted, we encounter deadlock issues as below:

INFO: task A:1890 blocked for more than 120 seconds.
      Tainted: G           O       6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:A    state:D stack:0     pid:1890  tgid:1626  ppid:1153   flags:0x00000204
Call trace:
 __switch_to+0xf4/0x158
 __schedule+0x27c/0x908
 schedule+0x3c/0x118
 io_schedule+0x44/0x68
 folio_wait_bit_common+0x174/0x370
 folio_wait_bit+0x20/0x38
 folio_wait_writeback+0x54/0xc8
 truncate_inode_partial_folio+0x70/0x1e0
 truncate_inode_pages_range+0x1b0/0x450
 truncate_pagecache+0x54/0x88
 f2fs_file_write_iter+0x3e8/0xb80
 do_iter_readv_writev+0xf0/0x1e0
 vfs_writev+0x138/0x2c8
 do_writev+0x88/0x130
 __arm64_sys_writev+0x28/0x40
 invoke_syscall+0x50/0x120
 el0_svc_common.constprop.0+0xc8/0xf0
 do_el0_svc+0x24/0x38
 el0_svc+0x30/0xf8
 el0t_64_sync_handler+0x120/0x130
 el0t_64_sync+0x190/0x198

INFO: task kworker/u8:11:2680853 blocked for more than 120 seconds.
      Tainted: G           O       6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:11   state:D stack:0     pid:2680853 tgid:2680853 ppid:2      flags:0x00000208
Workqueue: writeback wb_workfn (flush-254:0)
Call trace:
 __switch_to+0xf4/0x158
 __schedule+0x27c/0x908
 schedule+0x3c/0x118
 io_schedule+0x44/0x68
 folio_wait_bit_common+0x174/0x370
 __filemap_get_folio+0x214/0x348
 pagecache_get_page+0x20/0x70
 f2fs_get_read_data_page+0x150/0x3e8
 f2fs_get_lock_data_page+0x2c/0x160
 move_data_page+0x50/0x478
 do_garbage_collect+0xd38/0x1528
 f2fs_gc+0x240/0x7e0
 f2fs_balance_fs+0x1a0/0x208
 f2fs_write_single_data_page+0x6e4/0x730
 f2fs_write_cache_pages+0x378/0x9b0
 f2fs_write_data_pages+0x2e4/0x388
 do_writepages+0x8c/0x2c8
 __writeback_single_inode+0x4c/0x498
 writeback_sb_inodes+0x234/0x4a8
 __writeback_inodes_wb+0x58/0x118
 wb_writeback+0x2f8/0x3c0
 wb_workfn+0x2c4/0x508
 process_one_work+0x180/0x408
 worker_thread+0x258/0x368
 kthread+0x118/0x128
 ret_from_fork+0x10/0x200

INFO: task kworker/u8:8:2641297 blocked for more than 120 seconds.
      Tainted: G           O       6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:8    state:D stack:0     pid:2641297 tgid:2641297 ppid:2      flags:0x00000208
Workqueue: writeback wb_workfn (flush-254:0)
Call trace:
 __switch_to+0xf4/0x158
 __schedule+0x27c/0x908
 rt_mutex_schedule+0x30/0x60
 __rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
 rwbase_write_lock+0x24c/0x378
 down_write+0x1c/0x30
 f2fs_balance_fs+0x184/0x208
 f2fs_write_inode+0xf4/0x328
 __writeback_single_inode+0x370/0x498
 writeback_sb_inodes+0x234/0x4a8
 __writeback_inodes_wb+0x58/0x118
 wb_writeback+0x2f8/0x3c0
 wb_workfn+0x2c4/0x508
 process_one_work+0x180/0x408
 worker_thread+0x258/0x368
 kthread+0x118/0x128
 ret_from_fork+0x10/0x20

INFO: task B:1902 blocked for more than 120 seconds.
      Tainted: G           O       6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:B     state:D stack:0     pid:1902  tgid:1626  ppid:1153   flags:0x0000020c
Call trace:
 __switch_to+0xf4/0x158
 __schedule+0x27c/0x908
 rt_mutex_schedule+0x30/0x60
 __rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
 rwbase_write_lock+0x24c/0x378
 down_write+0x1c/0x30
 f2fs_balance_fs+0x184/0x208
 f2fs_map_blocks+0x94c/0x1110
 f2fs_file_write_iter+0x228/0xb80
 do_iter_readv_writev+0xf0/0x1e0
 vfs_writev+0x138/0x2c8
 do_writev+0x88/0x130
 __arm64_sys_writev+0x28/0x40
 invoke_syscall+0x50/0x120
 el0_svc_common.constprop.0+0xc8/0xf0
 do_el0_svc+0x24/0x38
 el0_svc+0x30/0xf8
 el0t_64_sync_handler+0x120/0x130
 el0t_64_sync+0x190/0x198

INFO: task sync:2769849 blocked for more than 120 seconds.
      Tainted: G           O       6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:sync            state:D stack:0     pid:2769849 tgid:2769849 ppid:736    flags:0x0000020c
Call trace:
 __switch_to+0xf4/0x158
 __schedule+0x27c/0x908
 schedule+0x3c/0x118
 wb_wait_for_completion+0xb0/0xe8
 sync_inodes_sb+0xc8/0x2b0
 sync_inodes_one_sb+0x24/0x38
 iterate_supers+0xa8/0x138
 ksys_sync+0x54/0xc8
 __arm64_sys_sync+0x18/0x30
 invoke_syscall+0x50/0x120
 el0_svc_common.constprop.0+0xc8/0xf0
 do_el0_svc+0x24/0x38
 el0_svc+0x30/0xf8
 el0t_64_sync_handler+0x120/0x130
 el0t_64_sync+0x190/0x198

The root cause is a potential deadlock between the following tasks:

kworker/u8:11 Thread A
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- folio_start_writeback(X)
- f2fs_outplace_write_data
- bio_add_folio(X)
- folio_unlock(X)
- truncate_inode_pages_range
- __filemap_get_folio(X, FGP_LOCK)
- truncate_inode_partial_folio(X)
- folio_wait_writeback(X)
- f2fs_balance_fs
- f2fs_gc
- do_garbage_collect
- move_data_page
- f2fs_get_lock_data_page
- __filemap_get_folio(X, FGP_LOCK)

Both threads try to access folio X. Thread A holds the lock but waits for writeback, while kworker waits for the lock. This causes a deadlock.

Other threads also enter D state, waiting for locks such as gc_lock and writepages.

OPU/IPU DATA folio are all affected by this issue. To avoid such potential deadlocks, always commit these cached folios before triggering f2fs_gc() in f2fs_balance_fs().

Stable-dep-of: 8b4468ec023d ("f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()")

---
 fs/f2fs/data.c    |   29 +++++++++++++++++++++++++++++
 fs/f2fs/f2fs.h    |    1 +
 fs/f2fs/segment.c |    8 ++++++++
 3 files changed, 38 insertions(+)

@@ -913,6 +913,35 @@ void f2fs_submit_merged_ipu_write(struct
 	}
 }
 
+void f2fs_submit_all_merged_ipu_writes(struct f2fs_sb_info *sbi)
+{
+	struct bio_entry *be, *tmp;
+	struct f2fs_bio_info *io;
+	enum temp_type temp;
+
+	for (temp = HOT; temp < NR_TEMP_TYPE; temp++) {
+		LIST_HEAD(list);
+
+		io = sbi->write_io[DATA] + temp;
+
+		/* A lockless list_empty() check is safe here: any bios from
+		 * other kworkers that we miss will be submitted by those
+		 * kworkers accordingly.
+		 */
+		if (list_empty(&io->bio_list))
+			continue;
+
+		f2fs_down_write(&io->bio_list_lock);
+		list_splice_init(&io->bio_list, &list);
+		f2fs_up_write(&io->bio_list_lock);
+
+		list_for_each_entry_safe(be, tmp, &list, list) {
+			__submit_bio(sbi, be->bio, DATA);
+			del_bio_entry(be);
+		}
+	}
+}
+
 int f2fs_merge_page_bio(struct f2fs_io_info *fio)
 {
 	struct bio *bio = *fio->bio;

@@ -3782,6 +3782,7 @@ void f2fs_submit_merged_write_cond(struc
 				nid_t ino, enum page_type type);
 void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi,
 					struct bio **bio, struct page *page);
+void f2fs_submit_all_merged_ipu_writes(struct f2fs_sb_info *sbi);
 void f2fs_flush_merged_writes(struct f2fs_sb_info *sbi);
 int f2fs_submit_page_bio(struct f2fs_io_info *fio);
 int f2fs_merge_page_bio(struct f2fs_io_info *fio);

@@ -425,6 +425,14 @@ void f2fs_balance_fs(struct f2fs_sb_info
 				.should_migrate_blocks = false,
 				.err_gc_skipped = false,
 				.nr_free_secs = 1 };
+
+			/*
+			 * Submit all cached OPU/IPU DATA bios before triggering
+			 * foreground GC to avoid potential deadlocks.
+			 */
+			f2fs_submit_merged_write(sbi, DATA);
+			f2fs_submit_all_merged_ipu_writes(sbi);
+
 			f2fs_down_write(&sbi->gc_lock);
 			f2fs_gc(sbi, &gc_control);
 		}

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email protected]>

[ Upstream commit 8b4468ec023d0d1b4669dfb867588997cc03a06b ]

When we mount device w/ gc_merge mount option, we may suffer below potential deadlock:

Kworker GC trehad Truncator
- f2fs_write_cache_pages
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- folio_start_writeback --- set writeback flag on folio
- f2fs_outplace_write_data
: cached folio in internal bio cache
- f2fs_balance_fs
- wake_up(gc_thread)
: wake up gc thread to run foreground GC
- finish_wait(fggc_wq)
: wait on the waitqueue --- wait on GC thread to finish the work
- truncate_inode_pages_range
- __filemap_get_folio(, FGP_LOCK) --- lock folio
- truncate_inode_partial_folio
- folio_wait_writeback --- wait on writeback being cleared
- do_garbage_collect
- move_data_page
- f2fs_get_lock_data_folio
- lock on folio --- blocked on folio's lock

In order to avoid such deadlock, let's call below functions to commit cached bios in GC_MERGE path of f2fs_balance_fs() as the same as we did in NOGC_MERGE path.
- f2fs_submit_merged_write(sbi, DATA);
- f2fs_submit_all_merged_ipu_writes(sbi);

Reported: Sandeep Dhavale <[email protected]>

---
 fs/f2fs/segment.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

@@ -408,6 +408,13 @@ void f2fs_balance_fs(struct f2fs_sb_info
 	 * dir/node pages without enough free segments.
 	 */
 	if (has_not_enough_free_secs(sbi, 0, 0)) {
+		/*
+		 * Submit all cached OPU/IPU DATA bios before triggering
+		 * foreground GC to avoid potential deadlocks.
+		 */
+		f2fs_submit_merged_write(sbi, DATA);
+		f2fs_submit_all_merged_ipu_writes(sbi);
+
 		if (test_opt(sbi, GC_MERGE) && sbi->gc_thread &&
 					sbi->gc_thread->f2fs_gc_task) {
 			DEFINE_WAIT(wait);

@@ -426,13 +433,6 @@ void f2fs_balance_fs(struct f2fs_sb_info
 				.err_gc_skipped = false,
 				.nr_free_secs = 1 };
 
-			/*
-			 * Submit all cached OPU/IPU DATA bios before triggering
-			 * foreground GC to avoid potential deadlocks.
-			 */
-			f2fs_submit_merged_write(sbi, DATA);
-			f2fs_submit_all_merged_ipu_writes(sbi);
-
 			f2fs_down_write(&sbi->gc_lock);
 			f2fs_gc(sbi, &gc_control);
 		}

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Keshav Verma <[email protected]>

[ Upstream commit 5ef5bc304f23c3fe255d4936472378dcb74d0e94 ]

Validate the xattr entry before reading its fields in f2fs_listxattr(). Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a successful partial result.

---
 fs/f2fs/xattr.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

@@ -576,8 +576,7 @@ ssize_t f2fs_listxattr(struct dentry *de
 	last_base_addr = (void *)base_addr + XATTR_SIZE(inode);
 
 	list_for_each_xattr(entry, base_addr) {
-		const struct xattr_handler *handler =
-			f2fs_xattr_handler(entry->e_name_index);
+		const struct xattr_handler *handler;
 		const char *prefix;
 		size_t prefix_len;
 		size_t size;

@@ -589,9 +588,11 @@ ssize_t f2fs_listxattr(struct dentry *de
 			set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
 			f2fs_handle_error(F2FS_I_SB(inode),
 						ERROR_CORRUPTED_XATTR);
-			break;
+			error = -EFSCORRUPTED;
+			goto cleanup;
 		}
 
+		handler = f2fs_xattr_handler(entry->e_name_index);
 		if (!handler || (handler->list && !handler->list(dentry)))
 			continue;
 

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sean Christopherson <[email protected]>

[ Upstream commit f1edbed787ba67988ed34e0132ca128b052b6ce8 ]

Drop a BUG_ON() that has been reachable since it was first added, way back in 2009, and instead use get_unaligned() to perform potentially-unaligned accesses.

For a given store, KVM x86's emulator tracks the entire value in the destination operand, x86_emulate_ctxt.dst. If the destination is memory, and the target splits multiple pages and/or is emulated MMIO, then KVM handles each fragment independently. E.g. on a page split starting at page offset 0xffc, KVM writes 4 bytes to the first page, then the remaining bytes to the second page, using ctxt->dst as the source for both (with appropriate offsets).

If the destination splits a page *and* hits emulated MMIO on the second page, then KVM will complete the write to the first page, then emulate the MMIO access to the second page. If there is a datamatch-enabled ioeventfd at offset 0 of the second page, then KVM will process the remainder of the store as a potential ioeventfd signal.

Putting it all together, if the guest emits a store that splits a page starting at page offset N, and the second page has a datamatch-enabled ioeventfd at offset 0, then KVM will check for datamatch using &dst.valptr[N] as the source. Due to dst (and thus dst.valptr) being 32-byte aligned, if N is not aligned to @len, the BUG_ON() fires.

E.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8, all initial checks in ioeventfd_in_range() will succeed, and the BUG_ON() fires due to @val being 4-byte aligned, but not 8-byte aligned.

  ------------[ cut here ]------------
  kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783!
  Oops: invalid opcode: 0000 [#1] SMP
  CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm]
  Call Trace:
   <TASK>
   __kvm_io_bus_write+0x85/0xb0 [kvm]
   kvm_io_bus_write+0x53/0x80 [kvm]
   vcpu_mmio_write+0x66/0xf0 [kvm]
   emulator_read_write_onepage+0x12a/0x540 [kvm]
   emulator_read_write+0x109/0x2b0 [kvm]
   x86_emulate_insn+0x4f8/0xfb0 [kvm]
   x86_emulate_instruction+0x181/0x790 [kvm]
   kvm_mmu_page_fault+0x313/0x630 [kvm]
   vmx_handle_exit+0x18a/0x590 [kvm_intel]
   kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm]
   kvm_vcpu_ioctl+0x2d5/0x970 [kvm]
   __x64_sys_ioctl+0x8a/0xd0
   do_syscall_64+0xb7/0x890
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x7f19c931a9bf
   </TASK>
  Modules linked in: kvm_intel kvm irqbypass
  ---[ end trace 0000000000000000 ]---

In a perfect world, the fix would be to simply delete the BUG_ON(), as KVM x86 doesn't perform alignment checks on "normal" memory accesses at CPL0. Sadly, C99 ruins all the fun; while the x86 architecture plays nice, dereferencing an unaligned pointer directly is undefined behavior in C, e.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.

Message-ID: <[email protected]>

---
 virt/kvm/eventfd.c |   12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

@@ -24,6 +24,7 @@
 #include <linux/slab.h>
 #include <linux/seqlock.h>
 #include <linux/irqbypass.h>
+#include <asm/unaligned.h>
 #include <trace/events/kvm.h>
 
 #include <kvm/iodev.h>

@@ -724,21 +725,18 @@ ioeventfd_in_range(struct _ioeventfd *p,
 		return true;
 
 	/* otherwise, we have to actually compare the data */
-
-	BUG_ON(!IS_ALIGNED((unsigned long)val, len));
-
 	switch (len) {
 	case 1:
-		_val = *(u8 *)val;
+		_val = get_unaligned((u8 *)val);
 		break;
 	case 2:
-		_val = *(u16 *)val;
+		_val = get_unaligned((u16 *)val);
 		break;
 	case 4:
-		_val = *(u32 *)val;
+		_val = get_unaligned((u32 *)val);
 		break;
 	case 8:
-		_val = *(u64 *)val;
+		_val = get_unaligned((u64 *)val);
 		break;
 	default:
 		return false;

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Denis Arefev <[email protected]>

[ Upstream commit f73aa66dffcb8e61e78f01b56163ec16a15d06d2 ]

The bdev pseudo-filesystem is an internal kernel filesystem with which userspace should not interfere. Unregister it so that userspace cannot even attempt to mount it.

This fixes a bug [1] that occurs when attempting to access files, because the system call move_mount() uses pointers declared in the inode_operations structure, which for the bdev pseudo-filesystem are always equal to 0. inode->i_op = &empty_iops;

[1]

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 #PF: supervisor instruction fetch in kernel mode
 #PF: error_code(0x0010) - not-present page
 PGD 23380067 P4D 23380067 PUD 23381067 PMD 0
 Oops: 0010 [#1] PREEMPT SMP KASAN NOPTI
 CPU: 2 PID: 17125 Comm: syz-executor.0 Not tainted 6.1.155-syzkaller-00350-g84221fde2681 #0
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
 RIP: 0010:0x0

 Call Trace:
 <TASK>
 lookup_open.isra.0+0x700/0x1180 fs/namei.c:3460
 open_last_lookups fs/namei.c:3550 [inline]
 path_openat+0x953/0x2700 fs/namei.c:3780
 do_filp_open+0x1c5/0x410 fs/namei.c:3810
 do_sys_openat2+0x171/0x4d0 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __x64_sys_openat+0x13c/0x1f0 fs/open.c:1345
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

---
 block/bdev.c |    4 ----
 1 file changed, 4 deletions(-)

@@ -478,16 +478,12 @@ EXPORT_SYMBOL_GPL(blockdev_superblock);
 
 void __init bdev_cache_init(void)
 {
-	int err;
 	static struct vfsmount *bd_mnt;
 
 	bdev_cachep = kmem_cache_create("bdev_cache", sizeof(struct bdev_inode),
 			0, (SLAB_HWCACHE_ALIGN|SLAB_RECLAIM_ACCOUNT|
 				SLAB_MEM_SPREAD|SLAB_ACCOUNT|SLAB_PANIC),
 			init_once);
-	err = register_filesystem(&bd_type);
-	if (err)
-		panic("Cannot register bdev pseudo-fs");
 	bd_mnt = kern_mount(&bd_type);
 	if (IS_ERR(bd_mnt))
 		panic("Cannot create bdev pseudo-fs");

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yuho Choi <[email protected]>

[ Upstream commit 1ff3f528e67d20e2b1483dcaba899dc7832b2e6b ]

rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale priv pointer.

Avoid publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv pointer is published should be ignored by rpmsg_ept_cb(). Flow-control updates can hit rpmsg_ept_flow_cb() in the same window, so make both callbacks return success when priv is NULL.

---
 drivers/rpmsg/rpmsg_char.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

@@ -100,6 +100,9 @@ static int rpmsg_ept_cb(struct rpmsg_dev
 	struct rpmsg_eptdev *eptdev = priv;
 	struct sk_buff *skb;
 
+	if (!eptdev)
+		return 0;
+
 	skb = alloc_skb(len, GFP_ATOMIC);
 	if (!skb)
 		return -ENOMEM;

@@ -448,6 +451,7 @@ static int rpmsg_chrdev_probe(struct rpm
 	struct rpmsg_channel_info chinfo;
 	struct rpmsg_eptdev *eptdev;
 	struct device *dev = &rpdev->dev;
+	int ret;
 
 	memcpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE);
 	chinfo.src = rpdev->src;

@@ -460,13 +464,17 @@ static int rpmsg_chrdev_probe(struct rpm
 	/* Set the default_ept to the rpmsg device endpoint */
 	eptdev->default_ept = rpdev->ept;
 
+	ret = rpmsg_chrdev_eptdev_add(eptdev, chinfo);
+
+	if (ret)
+		return ret;
 	/*
 	 * The rpmsg_ept_cb uses *priv parameter to get its rpmsg_eptdev context.
-	 * Storedit in default_ept *priv field.
+	 * Stored it in default_ept *priv field.
 	 */
 	eptdev->default_ept->priv = eptdev;
 
-	return rpmsg_chrdev_eptdev_add(eptdev, chinfo);
+	return 0;
 }
 
 static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev)

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

[ Upstream commit 8ce19524e4cc2462685f596a6402fbd8fb984ab2 ]

Make sure to tear down the host notify irq domain on adapter registration failure to avoid leaking it.

This issue was flagged by Sashiko when reviewing another adapter registration fix.

Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")

---
 drivers/i2c/i2c-core-base.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -1556,7 +1556,7 @@ static int i2c_register_adapter(struct i
 	res = device_register(&adap->dev);
 	if (res) {
 		pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
-		goto out_list;
+		goto err_remove_irq_domain;
 	}
 
 	adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);

@@ -1604,6 +1604,8 @@ out_reg:
 	init_completion(&adap->dev_released);
 	device_unregister(&adap->dev);
 	wait_for_completion(&adap->dev_released);
+err_remove_irq_domain:
+	i2c_host_notify_irq_teardown(adap);
 out_list:
 	mutex_lock(&core_lock);
 	idr_remove(&i2c_adapter_idr, adap->nr);

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

[ Upstream commit 3c7e164344e5bcf6f274bbf59a3274f5caad9bc1 ]

Clients may be registered from bus notifier callbacks when the adapter is registered. On a subsequent error during registration, the adapter references taken by such clients prevent the wait for the references to be released from ever completing.

Fix this by refactoring client deregistration and deregistering also on late adapter registration failures.

Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")

---
 drivers/i2c/i2c-core-base.c |   49 ++++++++++++++++++++++++++------------------
 1 file changed, 29 insertions(+), 20 deletions(-)