6.6.145-rc1 review

This is the start of the stable review cycle for the 6.6.145 release. There are 1266 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 23 Jul 2026 15:23:00 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.145-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.145-rc1

Danilo Krummrich <[email protected]>
driver core: Guard deferred probe timeout extension with delayed_work_pending()

Danilo Krummrich <[email protected]>
driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()

Easwar Hariharan <[email protected]>
jiffies: Cast to unsigned long in secs_to_jiffies() conversion

Easwar Hariharan <[email protected]>
jiffies: Define secs_to_jiffies()

Baokun Li <[email protected]>
writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()

Jan Kara <[email protected]>
writeback: Fix use after free in inode_switch_wbs_work_fn()

Darrick J. Wong <[email protected]>
xfs: fix stupid compiler warning

Arnd Bergmann <[email protected]>
Bluetooth: btmtk: remove #ifdef around declarations

Arnd Bergmann <[email protected]>
Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder

Benjamin Tissoires <[email protected]>
selftests/hid: ensure CKI can compile our new tests on old kernels

Luiz Augusto von Dentz <[email protected]>

    Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state

Gil Portnoy <[email protected]>
ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd

Randy Dunlap <[email protected]>
seqlock: fix scoped_seqlock_read kernel-doc

Marc Zyngier <[email protected]>
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

Siwei Zhang <[email protected]>
Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()

Cen Zhang <[email protected]>

    Bluetooth: hci_sync: annotate data-races around hdev->req_status

Pauli Virtanen <[email protected]>
Bluetooth: separate CIS_LINK and BIS_LINK link types

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO

Qu Wenruo <[email protected]>
btrfs: fix incorrect buffered IO fallback for append direct writes

Qu Wenruo <[email protected]>
btrfs: fix false IO failure after falling back to buffered write

Rochan Avlur <[email protected]>
exfat: preserve benign secondary entries during rename and move

Yuezhang Mo <[email protected]>
exfat: move exfat_chain_set() out of __exfat_resolve_path()

Yuezhang Mo <[email protected]>
exfat: add exfat_get_dentry_set_by_ei() helper

Yuezhang Mo <[email protected]>
exfat: rename argument name for exfat_move_file and exfat_rename_file

Yuezhang Mo <[email protected]>
exfat: remove unnecessary read entry in __exfat_rename()

Yuezhang Mo <[email protected]>
exfat: move free cluster out of exfat_init_ext_entry()

Pedro Falcato <[email protected]>
mm: do file ownership checks with the proper mount idmap

Wentao Liang <[email protected]>
regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

Krzysztof Kozlowski <[email protected]>
regulator: scmi: Simplify with scoped for each OF child loop

Ricardo Robaina <[email protected]>
audit: fix potential integer overflow in audit_log_n_hex()

Ricardo Robaina <[email protected]>
audit: add audit_log_nf_skb helper function

Ahsan Atta <[email protected]>
crypto: qat - fix restarting state leak on allocation failure

Qu Wenruo <[email protected]>
btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC

Neill Kapron <[email protected]>
usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile

Tianchu Chen <[email protected]>
nvmet-auth: validate reply message payload bounds against transfer length

Hannes Reinecke <[email protected]>
nvmet: return DHCHAP status codes from nvmet_setup_auth()

Chaitanya Kulkarni <[email protected]>
nvmet: remove superfluous initialization

Tyler Baker <[email protected]>
usb: gadget: f_fs: initialize reset_work at allocation time

Thorsten Blum <[email protected]>
crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A

Uwe Kleine-König <[email protected]>
crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0

Andy Yan <[email protected]>
usb: typec: tcpm: Fix VDM type for Enter Mode commands

Mauricio Faria de Oliveira <[email protected]>
usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()

Oliver Neukum <[email protected]>
usb: iowarrior: remove inherent race with minor number

Vlad Poenaru <[email protected]>
bpf: Allow LPM map access from sleepable BPF programs

Andrii Nakryiko <[email protected]>
bpf: Consistently use bpf_rcu_lock_held() everywhere

Tristan Madani <[email protected]>
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length

Viacheslav Dubeyko <[email protected]>
hfs/hfsplus: prevent getting negative values of offset/length

Andy Shevchenko <[email protected]>
serial: 8250_mid: Disable DMA for selected platforms

Ilpo Järvinen <[email protected]>

    serial: 8250_mid: Remove 8250_pci usage

Manish Khadka <[email protected]>
HID: appleir: fix UAF on pending key_up_timer in remove()

Thomas Gleixner <[email protected]>
treewide: Switch/rename to timer_delete[_sync]()

Jann Horn <[email protected]>
proc: protect ptrace_may_access() with exec_update_lock (part 1)

Oleg Nesterov <[email protected]>
seqlock: Change do_task_stat() to use scoped_seqlock_read()

Peter Zijlstra <[email protected]>
seqlock: Introduce scoped_seqlock_read()

Vlastimil Babka (SUSE) <[email protected]>
mm/slab: do not limit zeroing to orig_size when only red zoning is enabled

Trung Nguyen <[email protected]>
HID: multitouch: fix out-of-bounds bit access on mt_io_flags

Angela Czubak <[email protected]>
HID: add haptics page defines

Zide Chen <[email protected]>
perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()

Baokun Li <[email protected]>
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()

Jan Kara <[email protected]>

    writeback: Avoid contention on wb->list_lock when switching inodes

Guangshuo Li <[email protected]>
cpufreq: qcom-cpufreq-hw: Fix possible double free

Lizhe <[email protected]>

    cpufreq: Make cpufreq_driver->exit() return void

Viresh Kumar <[email protected]>
cpufreq: pcc: Remove empty exit() callback

Jann Horn <[email protected]>
proc: protect ptrace_may_access() with exec_update_lock (FD links)

Christoph Hellwig <[email protected]>
proc: rename proc_setattr to proc_nochmod_setattr

Namjae Jeon <[email protected]>
ksmbd: track the connection owning a byte-range lock

DaeMyung Kang <[email protected]>
ksmbd: centralize ksmbd_conn final release to plug transport leak

Namjae Jeon <[email protected]>
ksmbd: use opener credentials for FSCTL mutations

Michael Bommarito <[email protected]>
smb: client: resolve SWN tcon from live registrations

Markus Elfring <[email protected]>
smb: client: Improve unlocking of a mutex in cifs_get_swn_reg()

Siwei Zhang <[email protected]>
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister

Runyu Xiao <[email protected]>

    Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock

Florian Westphal <[email protected]>
netfilter: ebtables: zero chainstack array

Qianfeng Rong <[email protected]>
netfilter: ebtables: Use vmalloc_array() to improve code

Xiaolei Wang <[email protected]>
media: nxp: imx8-isi: Fix use-after-free on remove

Frank Li <[email protected]>
media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code

Uwe Kleine-König <[email protected]>
media: nxp: imx8-isi: Convert to platform remove callback returning void

Runyu Xiao <[email protected]>
gpio: sch: use raw_spinlock_t in the irq startup path

Runyu Xiao <[email protected]>
coresight: etb10: restore atomic_t for shared reading state

Shakeel Butt <[email protected]>
mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()

Qi Zheng <[email protected]>
mm: shrinker: remove redundant shrinker_rwsem in debugfs operations

Marco Elver <[email protected]>
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

Giovanni Cabiddu <[email protected]>
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

Nikolay Kulikov <[email protected]>
staging: rtl8723bs: fix spaces around binary operators

William Hansen-Baird <[email protected]>
staging: rtl8723bs: core: move constants to right side in comparison

Marco Nenciarini <[email protected]>
PCI: Skip Resizable BAR restore on read error

Ilpo Järvinen <[email protected]>
PCI: Move Resizable BAR code to rebar.c

Ilpo Järvinen <[email protected]>
PCI: Add kerneldoc for pci_resize_resource()

Ilpo Järvinen <[email protected]>
PCI: Fix restoring BARs on BAR resize rollback path

Ilpo Järvinen <[email protected]>
PCI: Free saved list without holding pci_bus_sem

Ilpo Järvinen <[email protected]>
PCI: Prevent resource tree corruption when BAR resize fails

Manivannan Sadhasivam <[email protected]>
PCI: mediatek: Fix IRQ domain leak when port fails to enable

Christian Marangi <[email protected]>
PCI: mediatek: Use generic MACRO for TPVPERL delay

Christian Marangi <[email protected]>
PCI: mediatek: Convert bool to single quirks entry and bitmap

Jiri Slaby (SUSE) <[email protected]>
PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()

Richard Zhu <[email protected]>
PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling

Alex Williamson <[email protected]>
vfio/mlx5: Fix racy bitfields and tighten struct layout

Mahesh Vaidya <[email protected]>
PCI: altera: Fix resource leaks on probe failure

Zhao Dongdong <[email protected]>
ALSA: aoa: check snd_ctl_new1() return value

Herman van Hazendonk <[email protected]>
iio: common: st_sensors: honour channel endianness in read_axis_data

Alexander Lobakin <[email protected]>
bitops: make BYTES_TO_BITS() treewide-available

Biren Pandya <[email protected]>
iio: pressure: mpl115: fix runtime PM leak on read error

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: stabilized timestamp in interrupt

Jean-Baptiste Maneyrol <[email protected]>
iio: invensense: fix timestamp glitches when switching frequency

Colin Ian King <[email protected]>
iio: invensense: remove redundant initialization of variable period

Zhang Lixu <[email protected]>
iio: hid-sensor-rotation: Fix stale or zero output when reading raw values

Runyu Xiao <[email protected]>
iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ

Rafael J. Wysocki <[email protected]>
ACPI: NFIT: core: Fix possible deadlock and missing notifications

Rafael J. Wysocki <[email protected]>
ACPI: NFIT: core: Use devm_acpi_install_notify_handler()

Rafael J. Wysocki <[email protected]>
ACPI: bus: Introduce devm_acpi_install_notify_handler()

Rafael J. Wysocki <[email protected]>
ACPI: driver: Check ACPI_COMPANION() against NULL during probe

Rafael J. Wysocki <[email protected]>
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup

Sandipan Das <[email protected]>
perf/x86/amd/brs: Fix kernel address leakage

Pengpeng Hou <[email protected]>
mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout

Pengpeng Hou <[email protected]>
mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout

Pengpeng Hou <[email protected]>
mtd: rawnand: fsl_ifc: return errors for failed page reads

Runyu Xiao <[email protected]>
mmc: vub300: defer reset until cmd_mutex is unlocked

Pengpeng Hou <[email protected]>
mtd: mchp23k256: use SPI match data for chip caps

Pengpeng Hou <[email protected]>
mtd: onenand: samsung: report DMA completion timeouts

Rafael Beims <[email protected]>
wifi: mwifiex: fix permanently busy scans after multiple roam iterations

Zhiling Zou <[email protected]>
wifi: mac80211: free ack status frame on TX header build failure

Junrui Luo <[email protected]>
powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

Zhao Dongdong <[email protected]>
reset: sunxi: fix memory region leak on ioremap failure

Robby Cai <[email protected]>
reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ

Florian Westphal <[email protected]>
ipvs: reload ip header after head reallocation

Julian Anastasov <[email protected]>
ipvs: fix more places with wrong ipv6 transport offsets

Maoyi Xie <[email protected]>
memstick: ms_block: reject a card that reports too many blocks

James Raphael Tiovalen <[email protected]>
macsec: fix promiscuity refcount leak in macsec_dev_open()

Xuanqiang Luo <[email protected]>
llc: fix SAP refcount leak when creating incoming sockets

Laxman Acharya Padhya <[email protected]>
Bluetooth: btrtl: validate firmware patch bounds

Asim Viladi Oglu Manizada <[email protected]>
net: openvswitch: reject oversized nested action attrs

Abhishek Ojha <[email protected]>
regulator: ltc3676: Fix incorrect IRQSTAT bit offsets

Dawei Feng <[email protected]>

    wifi: mac80211: fix memory leak in ieee80211_register_hw()

Runyu Xiao <[email protected]>
wifi: rt2x00: avoid full teardown before work setup in probe

Thorsten Blum <[email protected]>
powerpc/pseries: fix memory leak on krealloc failure in papr_init

Peng Fan <[email protected]>
pmdomain: imx: Fix i.MX8MP VC8000E power up sequence

Peng Fan <[email protected]>
pmdomain: imx: Fix i.MX8MP power notifier

Farhad Alemi <[email protected]>
cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed

Crystal Wood <[email protected]>
tracing/osnoise: Call synchronize_rcu() when unregistering

Tao Liu <[email protected]>
riscv: Prevent NULL pointer dereference in machine_kexec_prepare()

Michael Bommarito <[email protected]>
drbd: reject data replies with an out-of-range payload size

Daehyeon Ko <[email protected]>
macsec: don't read an unset MAC header in macsec_encrypt()

Yizhou Zhao <[email protected]>
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

Yizhou Zhao <[email protected]>
ipvs: use parsed transport offset in SCTP state lookup

Shuangpeng Bai <[email protected]>
llc: fix SAP refcount leak in llc_ui_autobind()

Yousef Alhouseen <[email protected]>
mac802154: remove interfaces with RCU list deletion

Gerald Schaefer <[email protected]>
s390/monwriter: Reject buffer reuse with different data length

Martin Kaiser <[email protected]>
riscv: probes: save original sp in rethook trampoline

HyeongJun An <[email protected]>
hwmon: (asus_atk0110) Check package count before accessing element

Maoyi Xie <[email protected]>
net: wwan: iosm: bound device offsets in the MUX downlink decoder

Wentao Liang <[email protected]>
ata: pata_pxa: Fix DMA channel leak on probe error

Bryam Vargas <[email protected]>
orangefs: keep the readdir entry size 64-bit in fill_from_part()

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix double addition of offset for @+FOFFSET

Bryam Vargas <[email protected]>
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked

Bryam Vargas <[email protected]>
net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

Andrea Righi <[email protected]>
net: lan743x: Initialize eth_syslock spinlock before use

Haoxiang Li <[email protected]>
fsl/fman: Free init resources on KeyGen failure in fman_init()

Runyu Xiao <[email protected]>
hwmon: (occ) unregister sysfs devices outside occ lock

Haoxiang Li <[email protected]>
net: liquidio: fix BAR resource leak on PF number failure

Pengpeng Hou <[email protected]>
hwmon: (w83793) remove vrm sysfs file on probe failure

Pengpeng Hou <[email protected]>
hwmon: (w83627hf) remove VID sysfs files on error and remove

Conor Dooley <[email protected]>
rtc: mpfs: fix counter upload completion condition

Abdun Nihaal <[email protected]>
bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()

Sabrina Dubroca <[email protected]>
espintcp: use sk_msg_free_partial to fix partial send

Hongchen Zhang <[email protected]>
LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()

Sven Eckelmann <[email protected]>
batman-adv: clean untagged VLAN on netdev registration failure

Sven Eckelmann <[email protected]>
batman-adv: ensure minimal ethernet header on TX

Sven Eckelmann <[email protected]>
batman-adv: retrieve ethhdr after potential skb realloc on RX

Jamal Hadi Salim <[email protected]>
net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants

Shitalkumar Gandhi <[email protected]>
ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

Shitalkumar Gandhi <[email protected]>
ieee802154: ca8210: fix cas_ctl leak on spi_async failure

Michael Bommarito <[email protected]>
ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation

Michael Bommarito <[email protected]>
ieee802154: admin-gate legacy LLSEC dump operations

Maoyi Xie <[email protected]>
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

Maoyi Xie <[email protected]>
net: ipip: require CAP_NET_ADMIN in the device netns for changelink

Maoyi Xie <[email protected]>
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink

Maoyi Xie <[email protected]>
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink

Dawei Feng <[email protected]>
net: ena: clean up XDP TX queues when regular TX setup fails

Zihan Xi <[email protected]>
net/sched: act_ct: preserve tc_skb_cb across defragmentation

Haoxiang Li <[email protected]>
net: ixp4xx_hss: fix duplicate HDLC netdev allocation

Haoxiang Li <[email protected]>
net: wwan: t7xx: destroy DMA pool on CLDMA late init failure

Maoyi Xie <[email protected]>
net: sit: require CAP_NET_ADMIN in the device netns for changelink

Andreas Kemnade <[email protected]>
gpios: palmas: add .get_direction() op

Paul Louvel <[email protected]>
gpio-f7188x: Add support for NCT6126D version B

Bradley Morgan <[email protected]>
cpu: hotplug: Bound hotplug states sysfs output

Bradley Morgan <[email protected]>
cpu: hotplug: Preserve per instance callback errors

Zhan Xusheng <[email protected]>
posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()

Doruk Tan Ozturk <[email protected]>
net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix type confusion in CDC union descriptor parsing

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix race condition in reset_device sysfs callback

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix DMA mapping violation in line setup

Dmitry Torokhov <[email protected]>
Input: ims-pcu - add response length checks

Dmitry Torokhov <[email protected]>
Input: ims-pcu - validate control endpoint type

Dmitry Torokhov <[email protected]>
Input: ims-pcu - release data interface on disconnect

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix use-after-free and double-free in disconnect

Haoxiang Li <[email protected]>
scsi: elx: efct: Fix I/O leak on unsupported additional CDB

WenTao Liang <[email protected]>
scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()

Bryam Vargas <[email protected]>
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

Bryam Vargas <[email protected]>
scsi: target: Bound PR-OUT TransportID parsing to the received buffer

Michael Bommarito <[email protected]>
scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

Michael Bommarito <[email protected]>
scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

Xu Rao <[email protected]>
scsi: sg: Report request-table problems when any status is set

Abdun Nihaal <[email protected]>
scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()

Haoxiang Li <[email protected]>
scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path

Mikulas Patocka <[email protected]>
dm-verity: increase sprintf buffer size

Mikulas Patocka <[email protected]>
dm-verity: fix a possible NULL pointer dereference

Mikulas Patocka <[email protected]>
dm-integrity: don't increment hash_offset twice

Mikulas Patocka <[email protected]>
dm_early_create: fix freeing used table on dm_resume failure

Mikulas Patocka <[email protected]>
dm-stats: fix merge accounting

Mikulas Patocka <[email protected]>
dm-stats: fix dm_jiffies_to_msec64

Benjamin Marzinski <[email protected]>
dm-log: fix a bitset_size overflow on 32bit machines

Mikulas Patocka <[email protected]>
dm-ioctl: fix a possible overflow in list_version_get_info

Mikulas Patocka <[email protected]>
dm-bufio: fix wrong count calculation in dm_bufio_issue_discard

Samuel Moelius <[email protected]>
dm era: fix out-of-bounds memory access for non-zero start sector

Ming-Hung Tsai <[email protected]>
dm thin metadata: fix metadata snapshot consistency on commit failure

Genjian Zhang <[email protected]>
dm thin metadata: fix superblock refcount leak on snapshot shadow failure

Haoxiang Li <[email protected]>
net: sparx5: unregister blocking notifier on init failure

Jiri Olsa <[email protected]>
bpf: Add missing access_ok call to copy_user_syms

Jann Horn <[email protected]>

    bpf,fork: wipe ->bpf_storage before bailouts that access it

Oliver Hartkopp <[email protected]>
can: bcm: add missing rcu list annotations and operations

Oliver Hartkopp <[email protected]>
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure

Lee Jones <[email protected]>
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

Oliver Hartkopp <[email protected]>
can: isotp: use unconditional synchronize_rcu() in isotp_release()

Fan Wu <[email protected]>
can: esd_usb: kill anchored URBs before freeing netdevs

Bryam Vargas <[email protected]>
nvmet-rdma: handle inline data with a nonzero offset

Weiming Shi <[email protected]>
sctp: validate STALE_COOKIE cause length before reading staleness

Kunihiko Hayashi <[email protected]>
spi: uniphier: Fix completion initialization order before devm_request_irq()

Wang Yan <[email protected]>
time: Fix off-by-one in compat settimeofday() usec validation

Jaewon Yang <[email protected]>
tpm: Make the TPM character devices non-seekable

Thorsten Blum <[email protected]>
tpm: fix event_size output in tpm1_binary_bios_measurements_show

Maoyi Xie <[email protected]>
xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink

Sanman Pradhan <[email protected]>
xfrm: use compat translator only for u64 alignment mismatch

Wentao Liang <[email protected]>
xen/gntdev: fix error handling in ioctl

Paul Greenwalt <[email protected]>
ice: fix ice_init_link() error return preventing probe

Xuanqiang Luo <[email protected]>
i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()

Roman Vivchar <[email protected]>
i2c: mediatek: fix WRRD for SoCs without auto_restart option

Joshua Crofts <[email protected]>
hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig

Ibrahim Hashimov <[email protected]>
ksmbd: fix integer overflow in set_file_allocation_info()

Fredric Cover <[email protected]>
smb: client: use kvzalloc() for megabyte buffer in simple fallocate

Daniel Gibson <[email protected]>
platform/x86/amd/pmc: Add delay_suspend module parameter

Daniel Gibson <[email protected]>
platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops

Daniel Gibson <[email protected]>
platform/x86/amd/pmc: Check for intermediate wakeup in function

Frank Li <[email protected]>
dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK

Kartik Rajput <[email protected]>
dmaengine: tegra: Fix burst size calculation

Jarkko Sakkinen <[email protected]>
tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()

Bhargav Joshi <[email protected]>
irqchip/crossbar: Use correct index in crossbar_domain_free()

Florian Fuchs <[email protected]>
mtd: maps: vmu-flash: fix NULL pointer dereference in initialization

Miquel Raynal <[email protected]>
mtd: spi-nor: swp: Improve locking user experience

Sebastian Alba Vives <[email protected]>
fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()

Maoyi Xie <[email protected]>

    net: thunderbolt: Fix frags[] overflow by bounding frame_count

Manivannan Sadhasivam <[email protected]>
bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path

Sebastian Alba Vives <[email protected]>
fpga: dfl: add bounds check in dfh_get_param_size()

Michael Bommarito <[email protected]>
ocfs2: reject non-inline dinodes with i_size and zero i_clusters

Michael Bommarito <[email protected]>
ocfs2: reject dinodes whose i_rdev disagrees with the file type

Michael Bommarito <[email protected]>
ocfs2: reject dinodes with non-canonical i_mode type

Joseph Qi <[email protected]>
ocfs2: add journal NULL check in ocfs2_checkpoint_inode()

Ian Bridges <[email protected]>
ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits

Kyle Zeng <[email protected]>
ocfs2: avoid moving extents to occupied clusters

Arseniy Krasnov <[email protected]>
mtd: rawnand: fix condition in 'nand_select_target()'

Vasiliy Kovalev <[email protected]>
net/9p: fix infinite loop in p9_client_rpc on fatal signal

Bastien Curutchet <[email protected]>
mtd: rawnand: pl353: fix probe resource allocation

Tristan Madani <[email protected]>
ocfs2: use kzalloc for quota recovery bitmap allocation

Ionut Nechita <[email protected]>
scsi: sas: Skip opt_sectors when DMA reports no real optimization hint

Martin Wilck <[email protected]>
scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()

Breno Leitao <[email protected]>
9p: skip nlink update in cacheless mode to fix WARN_ON

Ruoyu Wang <[email protected]>
mtd: slram: remove failed entries from the device list

Muchun Song <[email protected]>
mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE

Krzysztof Wilczyński <[email protected]>
proc: only bump parent nlink when registering directories

SeongJae Park <[email protected]>
mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error

SeongJae Park <[email protected]>
mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()

Zishun Yi <[email protected]>
riscv: cacheinfo: Fix node reference leak in populate_cache_leaves

Aaron Tomlin <[email protected]>
mips: sched: Fix CPUMASK_OFFSTACK memory corruption

WenTao Liang <[email protected]>
power: supply: charger-manager: fix refcount leak in is_full_charged()

Tristan Madani <[email protected]>
ntfs3: fix out-of-bounds read in decompress_lznt

Michael Bommarito <[email protected]>
ntfs3: validate split-point offset in indx_insert_into_buffer

Michael Bommarito <[email protected]>
ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

Michael Bommarito <[email protected]>

    ntfs3: cap RESTART_TABLE free-chain walker at rt->used

Michael Bommarito <[email protected]>

    fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}

Michael Bommarito <[email protected]>
fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow

Konstantin Komarov <[email protected]>
fs/ntfs3: validate lcns_follow in log_replay conversion

Konstantin Komarov <[email protected]>
fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

Michael Bommarito <[email protected]>

    fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass

Konstantin Komarov <[email protected]>
fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

Zhan Xusheng <[email protected]>
fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename

SeongJae Park <[email protected]>
mm/damon/core: make charge_addr_from aware of end-address exclusivity

Ma Ke <[email protected]>
power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak

Maciej W. Rozycki <[email protected]>
MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix device reference leak in probe

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix kfree() of static object

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix gio device memory leak

Wasim Nazir <[email protected]>
remoteproc: qcom: Fix leak when custom dump_segments addition fails

Chuck Lever <[email protected]>
SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing

Chuck Lever <[email protected]>
lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure

Chuck Lever <[email protected]>
lockd: Plug nlm_file leak when nlm_do_fopen() fails

Chuck Lever <[email protected]>
sunrpc: wait for in-flight TLS handshake callback when cancel loses race

Chris Mason <[email protected]>
sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

Abdun Nihaal <[email protected]>
nvdimm/btt: Free arena sub-allocations on discover_arenas() error path

Abdun Nihaal <[email protected]>
nvdimm/btt: Free arenas on btt_init() error paths

Junrui Luo <[email protected]>
jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

Pauli Virtanen <[email protected]>
Bluetooth: SCO: hold sk properly in sco_conn_ready

Pauli Virtanen <[email protected]>
Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready

Benoît Sevens <[email protected]>
HID: playstation: validate num_touch_reports in DualShock 4 reports

Bartosz Golaszewski <[email protected]>
mfd: tps6586x: Fix OF node refcount

Shyam Prasad N <[email protected]>
cifs: invalidate cfid on unlink/rename/rmdir

Sven Eckelmann <[email protected]>
batman-adv: tt: prevent TVLV OOB check overflow

Sven Eckelmann <[email protected]>
batman-adv: frag: fix primary_if leak on failed linearization

Sven Eckelmann <[email protected]>
batman-adv: frag: free unfragmentable packet

Sven Eckelmann <[email protected]>
batman-adv: fix VLAN priority offset

Sven Eckelmann <[email protected]>
batman-adv: tt: avoid request storms during pending request

Sven Eckelmann <[email protected]>
batman-adv: dat: fix tie-break for candidate selection

Sven Eckelmann <[email protected]>
batman-adv: dat: ensure accessible eth_hdr proto field

Sven Eckelmann <[email protected]>
batman-adv: bla: reacquire gw address after skb realloc

Sven Eckelmann <[email protected]>
batman-adv: dat: acquire ARP hw source only after skb realloc

Sven Eckelmann <[email protected]>

    batman-adv: access unicast_ttvn skb->data only after skb realloc

Sven Eckelmann <[email protected]>
batman-adv: gw: acquire ethernet header only after skb realloc

Sumanth Korikkar <[email protected]>
s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()

Sandipan Das <[email protected]>
perf/x86/amd/lbr: Fix kernel address leakage

Thorsten Blum <[email protected]>
x86/boot: Reject too long acpi_rsdp= values

Thorsten Blum <[email protected]>
x86/boot: Validate console=uart8250 baud rate to fix early boot hang

Ali Ahmet MEMIS <[email protected]>
tools/power/x86/intel-speed-select: Harden daemon pidfile open

Guangshuo Li <[email protected]>
mfd: sm501: Fix reference leak on failed device registration

Armin Wolf <[email protected]>
leds: uleds: Fix potential buffer overread

Ondrej Mosnacek <[email protected]>
selinux: fix incorrect execmem checks on overlayfs

Stephen Smalley <[email protected]>
selinux: check connect-related permissions on TCP Fast Open

Wang Jun <[email protected]>
soc: fsl: qe: panic on ioremap() failure in qe_reset()

Siddharth Vadapalli <[email protected]>
soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy

Guangshuo Li <[email protected]>
gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

Xiang Mei (Microsoft) <[email protected]>
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()

Wyatt Feng <[email protected]>
netfilter: xt_nat: reject unsupported target families

Yizhou Zhao <[email protected]>
netfilter: ecache: fix inverted time_after() check

Yizhou Zhao <[email protected]>
netfilter: nf_conncount: fix zone comparison in tuple dedup

Xiang Mei <[email protected]>
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

Florian Westphal <[email protected]>
netfilter: nf_nat_sip: reload possible stale data pointer

Haoze Xie <[email protected]>
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

Wyatt Feng <[email protected]>
netfilter: xt_cluster: reject template conntracks in hash match

David Carlier <[email protected]>
netfilter: nfnl_cthelper: apply per-class values when updating policies

Muhammad Bilal <[email protected]>
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback

Cássio Gabriel <[email protected]>
ASoC: mediatek: mt8183: Release reserved memory on cleanup

Cássio Gabriel <[email protected]>
ASoC: mediatek: mt8192: Release reserved memory on cleanup

Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

Abdun Nihaal <[email protected]>
fbdev: tridentfb: fix potential memory leak in trident_pci_probe()

Abdun Nihaal <[email protected]>
fbdev: nvidia: fix potential memory leak in nvidiafb_probe()

Abdun Nihaal <[email protected]>
fbdev: vesafb: fix memory leak in vesafb_probe()

Abdun Nihaal <[email protected]>
fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()

Abdun Nihaal <[email protected]>
fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()

Abdun Nihaal <[email protected]>
fbdev: uvesafb: fix potential memory leak in uvesafb_probe()

Abdun Nihaal <[email protected]>
fbdev: s3fb: fix potential memory leak in s3_pci_probe()

Abdun Nihaal <[email protected]>
fbdev: i740fb: fix potential memory leak in i740fb_probe()

Abdun Nihaal <[email protected]>
fbdev: radeon: fix potential memory leak in radeonfb_pci_register()

Li RongQing <[email protected]>
fbdev: sm712: Fix operator precedence in big_swap macro

Abdun Nihaal <[email protected]>
fbdev: hecubafb: fix potential memory leak in hecubafb_probe()

Abdun Nihaal <[email protected]>
fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()

Abdun Nihaal <[email protected]>
fbdev: metronomefb: fix potential memory leak in metronomefb_probe()

Sean Christopherson <[email protected]>
KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs

Matthew Rosato <[email protected]>
KVM: s390: pci: Fix handling of AIF enable without AISB

Hyunwoo Kim <[email protected]>
KVM: arm64: vgic: Check the interrupt is still ours before migrating it

Haoxiang Li <[email protected]>
KVM: s390: pci: Fix GISC refcount leak on AIF enable failure

Nickolay Goppen <[email protected]>
arm64: dts: qcom: sdm630: describe adsp_mem region properly

Mark Rutland <[email protected]>
arm64: fpsimd: Fix type mismatch in sve_{save,load}_state()

Yong Wang <[email protected]>
net: ife: require ETH_HLEN to be pullable in ife_decode()

Zhengchuan Liang <[email protected]>
net: atm: reject out-of-range traffic classes in QoS validation

Michael Bommarito <[email protected]>
net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

Cássio Gabriel <[email protected]>
ASoC: SOF: topology: validate vendor array size before parsing

Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get

Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc

Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put

Zhang Tianci <[email protected]>
vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter

Wentao Liang <[email protected]>
mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()

Wentao Liang <[email protected]>
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()

Guangshuo Li <[email protected]>
smb: client: fix overflow in passthrough ioctl bounds check

Harman Kalra <[email protected]>
octeontx2-af: fix VF bringup affecting PF promiscuous state

Li RongQing <[email protected]>
net/mlx5: Fix L3 tunnel entropy refcount leak

Wang Yan <[email protected]>
selftests/net: fix EVP_MD_CTX leak in tcp_mmap

Timur Tabi <[email protected]>
regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK

Cao Guanghui <[email protected]>
dm era: fix NULL pointer dereference in metadata_open()

Chuck Lever <[email protected]>
SUNRPC: pin upper rpc_clnt across the TLS connect_worker

Chuck Lever <[email protected]>
SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED

Guangshuo Li <[email protected]>
cifs: validate DFS referral string offsets

Rongguang Wei <[email protected]>
s390/zcrypt: Remove the empty file

Julian Anastasov <[email protected]>
ipvs: ensure inner headers in ICMP errors are in headroom

Yizhou Zhao <[email protected]>
ipvs: fix PMTU for GUE/GRE tunnel ICMP errors

Yizhou Zhao <[email protected]>
ipvs: use parsed transport offset in TCP state lookup

Yizhou Zhao <[email protected]>
ipvs: pass parsed transport offset to state handlers

Eric Dumazet <[email protected]>
ipv6: mcast: Fix potential UAF in MLD delayed work

Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Replace locking comments with lockdep annotations.

Eric Dumazet <[email protected]>
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()

Suman Ghosh <[email protected]>
octeontx2-pf: check DMAC extraction support before filtering

Samuel Moelius <[email protected]>
net/sched: cake: reject overhead values that underflow length

Enrico Pozzobon <[email protected]>
net: usb: lan78xx: disable VLAN filter in promiscuous mode

Oleksij Rempel <[email protected]>
net: usb: lan78xx: move functions to avoid forward definitions

Chuck Lever <[email protected]>
net/tls: Consume empty data records in tls_sw_read_sock()

Hui Wang <[email protected]>
ring-buffer: Fix event length with forced 8-byte alignment

Weiming Shi <[email protected]>

    Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

Pauli Virtanen <[email protected]>
Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length

Cen Zhang <[email protected]>
Bluetooth: MGMT: Fix adv monitor add failure cleanup

Cen Zhang <[email protected]>
Bluetooth: 6lowpan: hold L2CAP conn across debugfs control

Eric Dumazet <[email protected]>
amt: fix size calculation in amt_get_size()

Xiang Mei <[email protected]>
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

Jamal Hadi Salim <[email protected]>
net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload

Xiang Mei <[email protected]>
net: qualcomm: rmnet: validate MAP frame length before ingress parsing

Shigeru Yoshida <[email protected]>
qede: fix off-by-one in BD ring consumption on build_skb failure

Jens Emil Schulz Østergaard <[email protected]>
net: microchip: vcap: fix races on the shared Super VCAP block

Feng Liu <[email protected]>
net/mlx5e: Fix HV VHCA stats agent registration race

Feng Liu <[email protected]>
net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation

Wyatt Feng <[email protected]>
netfilter: xt_connmark: reject invalid shift parameters

Zhixing Chen <[email protected]>
netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop

Feng Wu <[email protected]>
netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()

Wyatt Feng <[email protected]>
netfilter: xt_u32: reject invalid shift counts

Qihang <[email protected]>
gue: validate REMCSUM private option length

Xiang Mei <[email protected]>
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

Yiyang Chen <[email protected]>
selftests/hid: Cover hid_bpf_get_data() size overflow

Benjamin Tissoires <[email protected]>
selftests/hid: convert the hid_bpf selftests with struct_ops

Benjamin Tissoires <[email protected]>
selftests/hid: force using our compiled libbpf headers

Benjamin Tissoires <[email protected]>
selftests/hid: do not manually call headers_install

Benjamin Tissoires <[email protected]>
selftests/hid: ensure we can compile the tests on kernels pre-6.3

Anshuman Khandual <[email protected]>
arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()

Ryan Roberts <[email protected]>
arm64/mm: convert ptep_clear() to ptep_get_and_clear()

Ryan Roberts <[email protected]>

    arm64/mm: convert set_pte_at() to set_ptes(..., 1)

Ryan Roberts <[email protected]>
arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep)

Lee Jones <[email protected]>
HID: core: Fix OOB read in hid_get_report for numbered reports

Georgiy Osokin <[email protected]>
HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

Myeonghun Pak <[email protected]>
ata: sata_gemini: unwind clocks on IDE pinctrl errors

Michael Bommarito <[email protected]>
minix: avoid overflow in bitmap block count calculation

David Howells <[email protected]>
afs: Fix unchecked-length string display in debug statement

David Howells <[email protected]>
afs: Fix the volume AFS_VOLUME_RM_TREE is set on

David Howells <[email protected]>
afs: Fix vllist leak

David Howells <[email protected]>
afs: Fix callback service message parsers to pass through -EAGAIN

Zilin Guan <[email protected]>
afs: use kvfree() to free memory allocated by kvcalloc()

Dan Carpenter <[email protected]>
afs: Fix error code in afs_extract_vl_addrs()

Christian Brauner <[email protected]>
fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid

Samuel Moelius <[email protected]>
net/sched: hhf: clear heavy-hitter state on reset

Viacheslav Bocharov <[email protected]>
pinctrl: meson: restore non-sleeping GPIO access

Vladimir Zapolskiy <[email protected]>
gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe

Gil Portnoy <[email protected]>

    ksmbd: fix use-after-free of fp->owner.name in durable handle owner check

ZhangGuoDong <[email protected]>
smb: move some duplicate definitions to common/cifsglob.h

Haofeng Li <[email protected]>
ksmbd: reject undersized DACLs before parsing ACEs

Sechang Lim <[email protected]>
net/sched: act_bpf: use rcu_dereference_bh() to read the filter

Gleb Markov <[email protected]>
cxgb4: Fix decode strings dump for T6 adapters

Longjun Tang <[email protected]>
virtio_net: disable cb when NAPI is busy-polled

Qingshuang Fu <[email protected]>
irqchip/ts4800: Fix missing chained handler cleanup on remove

Yuho Choi <[email protected]>
irqchip/gic-v3-its: Fix OF node reference leak

Martin Kaiser <[email protected]>
tracing: eprobe: read the complete FILTER_PTR_STRING pointer

Masami Hiramatsu (Google) <[email protected]>
tracing/events: Fix to check the simple_tsk_fn creation

Ido Schimmel <[email protected]>
bridge: stp: Fix a potential use-after-free when deleting a bridge

Jamal Hadi Salim <[email protected]>
net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF

Rosen Penev <[email protected]>
net: gianfar: dispose irq mappings on probe failure and device removal

Petr Wozniak <[email protected]>
net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy

Xiang Mei <[email protected]>
usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()

Guenter Roeck <[email protected]>
hwmon: (pmbus) Fix passing events to regulator core

Matti Vaittinen <[email protected]>
hwmon: adm1275: Prevent reading uninitialized stack

Maciej W. Rozycki <[email protected]>
MIPS: DEC: Ensure RTC platform device deregistration upon failure

Yousef Alhouseen <[email protected]>
sctp: fix SCTP_RESET_STREAMS stream list length limit

Wei Fang <[email protected]>
net: enetc: check the number of BDs needed for xdp_frame

Matvey Kovalev <[email protected]>

    qede: fix out-of-bounds check for cqe->len_list[]

Nuoqi Gui <[email protected]>
seg6: validate SRH length before reading fixed fields

Pengpeng Hou <[email protected]>
gpio: htc-egpio: use managed gpiochip registration

Pengpeng Hou <[email protected]>
gpio: mvebu: fail probe if gpiochip registration fails

Pengpeng Hou <[email protected]>
spi: sh-msiof: abort transfers when reset times out

Martin Kaiser <[email protected]>
tracing: probes: fix typo in a log message

Rob Herring (Arm) <[email protected]>
dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback

Shengjiu Wang <[email protected]>
ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count

Shitalkumar Gandhi <[email protected]>
net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove

Ruoyu Wang <[email protected]>
net: sungem: fix probe error cleanup

Yun Zhou <[email protected]>
net: mvneta: re-enable percpu interrupt on resume

Haoxiang Li <[email protected]>
rtc: cmos: unregister HPET IRQ handler on probe failure

Fredrik M Olsson <[email protected]>
rtc: ds1307: Fix off-by-one issue with wday for rx8130

Huiwen He <[email protected]>
smb/client: preserve errors from smb2_set_sparse()

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in disable_policy sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in forwarding sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in ignore_routes_with_linkdown sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in disable_ipv6 sysctl

Jamal Hadi Salim <[email protected]>
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

Eric Dumazet <[email protected]>
veth: fix NAPI leak in XDP enable error path

Aleksandrova Alyona <[email protected]>
net: dsa: sja1105: round up PTP perout pin duration

Xiang Mei <[email protected]>
net, bpf: check master for NULL in xdp_master_redirect()

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Add security_locked_down() check to pci_mmap_resource()

Koichiro Den <[email protected]>
NTB: epf: Fix doorbell bitmask and IRQ vector handling

Koichiro Den <[email protected]>
NTB: epf: Report 0-based doorbell vector via ntb_db_event()

Koichiro Den <[email protected]>
NTB: epf: Make db_valid_mask cover only real doorbell bits

Florian Westphal <[email protected]>
netfilter: nft_compat: ebtables emulation must reject non-bridge targets

Runyu Xiao <[email protected]>

    netfilter: nft_synproxy: stop bypassing the priv->info snapshot

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

Mathias Krause <[email protected]>
netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()

Bradley Morgan <[email protected]>
bpf: Disable xfrm_decode_session hook attachment

Xu Kuohai <[email protected]>
bpf, lsm: Add disabled BPF LSM hook list

Kuniyuki Iwashima <[email protected]>
ipv4: fib: Don't ignore error route in local/main tables.

Xiang Mei <[email protected]>
ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().

Gil Portnoy <[email protected]>

    ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE

Stepan Ionichev <[email protected]>
rtc: msc313: fix NULL deref in shared IRQ handler at probe

Mohamed Khalfella <[email protected]>
i40e: Fix i40e_debug() to use struct i40e_hw argument

Lukasz Czapnik <[email protected]>
ice: fix AQ error code comparison in ice_set_pauseparam()

Dawid Osuchowski <[email protected]>
ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()

Manivannan Sadhasivam <[email protected]>
PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0

Manivannan Sadhasivam <[email protected]>
PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0

Xiang Mei <[email protected]>
drm/edid: fix OOB read in drm_parse_tiled_block()

Amery Hung <[email protected]>
bpf: Fix effective prog array index with BPF_F_PREORDER

Avinash Duduskar <[email protected]>
bpf: zero-initialize the fib lookup flow struct

Nuoqi Gui <[email protected]>
bpf: Fix stack slot index in nospec checks

Ronan Dalton <[email protected]>

    rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231

Antoni Pokusinski <[email protected]>

    rtc: abx80x: fix the RTC_VL_CLR clearing all status flags

Geetha sowjanya <[email protected]>
octeontx2-pf: mcs: Fix mcs resources free on PF shutdown

Subbaraya Sundeep <[email protected]>
octeontx2-pf: Clear stats of all resources when freeing resources

Geetha sowjanya <[email protected]>
octeontx2-af: mcs: Fix unsupported secy stats read

Wayen Yan <[email protected]>
net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths

Weiming Shi <[email protected]>
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

Ruoyu Wang <[email protected]>
net: marvell: prestera: initialize err in prestera_port_sfp_bind

Aboorva Devarajan <[email protected]>
selftests/mm: fix exclusive_cow test fork() handling

Sayali Patil <[email protected]>
selftests/mm: allow PUD-level entries in compound testcase of hmm tests

Sayali Patil <[email protected]>
selftests/mm: clarify alternate unmapping in compaction_test

Bhargav Joshi <[email protected]>
irqchip/crossbar: Fix parent domain resource leak

Florian Westphal <[email protected]>
netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak

Florian Westphal <[email protected]>
netfilter: nf_reject: skip iphdr options when looking for icmp header

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: annotate "pos" for concurrent readers/writers

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: Fix data race between add and dump in all hash types

Abd-Alrhman Masalkhi <[email protected]>
md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry

Aleksandr Nogikh <[email protected]>
ieee802154: fix kernel-infoleak in dgram_recvmsg()

Ivan Abramov <[email protected]>

    ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()

Xu Rao <[email protected]>
ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()

Andy Shevchenko <[email protected]>
ACPI: resource: Amend kernel-doc style

Ricardo Neri <[email protected]>
thermal: intel: Fix dangling resources on thermal_throttle_online() failure

Breno Leitao <[email protected]>
arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS

Cen Zhang <[email protected]>
ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints

Yun Zhou <[email protected]>
flow_dissector: check device type before reading ETH_ADDRS

Cosmin Ratiu <[email protected]>
devlink: Fix parent ref leak in devl_rate_node_create()

Ioana Ciornei <[email protected]>
dpaa2-switch: fix VLAN upper check not rejecting bridge join

Xiang Mei <[email protected]>
virtio-net: fix len check in receive_big()

Quang Nguyen <[email protected]>
spi: rpc-if: Use correct device for hardware reinitialization on resume

Mark Tomlinson <[email protected]>
PCI: iproc: Restore .map_irq() for the platform bus driver

Xin Long <[email protected]>
sctp: hold socket lock when dumping endpoints in sctp_diag

Jakub Kicinski <[email protected]>
net: psample: fix info leak in PSAMPLE_ATTR_DATA

Ratheesh Kannoth <[email protected]>
octeontx2-pf: Fix leak of SQ timestamp buffer on teardown

Thadeu Lima de Souza Cascardo <[email protected]>
drm/amdgpu: initialize irq.lock spinlock earlier

Mario Limonciello <[email protected]>
drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

Yunxiang Li <[email protected]>
drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free

Sen Wang <[email protected]>
ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode

Arnaldo Carvalho de Melo <[email protected]>
perf cs-etm: Require full global header in auxtrace_info size check

Arnaldo Carvalho de Melo <[email protected]>
perf cs-etm: Validate num_cpu before metadata allocation

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Use snprintf() for guestmount path construction

Eric Dumazet <[email protected]>
xfrm: validate selector family and prefixlen during match

Eric Dumazet <[email protected]>

    xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]

Mike Yu <[email protected]>
xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path

Steffen Klassert <[email protected]>
xfrm: Use the XFRM_GRO to indicate a GRO call on input

Jisheng Zhang <[email protected]>
spi: dw: fix wrong BAUDR setting after resume

Pengpeng Hou <[email protected]>
gpio: mlxbf3: fail probe if gpiochip registration fails

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Bounds-check array offsets in bpil_offs_to_addr()

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Use snprintf() for root_dir path construction

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()

Pengpeng Hou <[email protected]>
sparc: led: avoid trimming a newline from empty writes

John Johansen <[email protected]>
apparmor: fix label can not be immediately before a declaration

Adrian Hunter <[email protected]>
i3c: master: Prevent reuse of dynamic address on device add failure

Zygmunt Krynicki <[email protected]>
apparmor: put secmark label after secid lookup

Zygmunt Krynicki <[email protected]>
apparmor: aa_getprocattr free procattr leak on format failure

Maxime Bélair <[email protected]>
apparmor: fix potential UAF in aa_replace_profiles

Ryan Lee <[email protected]>
apparmor: grab ns lock and refresh when looking up changehat child profiles

John Johansen <[email protected]>
apparmor: fix rawdata_f_data implicit flex array

Zygmunt Krynicki <[email protected]>
apparmor: aa_label_alloc use aa_label_free on alloc failure

Ruoyu Wang <[email protected]>
apparmor: check label build before no_new_privs test

Andrew Morton <[email protected]>
security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref()

Yuanhe Shu <[email protected]>
Revert "PCI/MSI: Unmap MSI-X region on error"

Manivannan Sadhasivam <[email protected]>
PCI: mediatek: Use actual physical address instead of virt_to_phys()

Ryder Lee <[email protected]>
PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Add bounds checks to read_build_id() note iteration in minimal build

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Add bounds checks to elf_read_build_id() note iteration

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix mount_overload() snprintf truncation and toupper range

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix filename__write_int() writing uninitialized stack data

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Fix thread__set_comm_from_proc() on empty comm file

Arnaldo Carvalho de Melo <[email protected]>
perf intel-pt: Fix snprintf size tracking bug in insn decoder

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Bounds-check .gnu_debuglink section data

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Fix signed overflow in sysfs__read_build_id() size check

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix missing null termination in filename__read_int/ull()

Arnaldo Carvalho de Melo <[email protected]>
perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file

Arnaldo Carvalho de Melo <[email protected]>
perf pmu: Fix pmu_id() heap underwrite on empty identifier file

James Clark <[email protected]>
perf cs-etm: Queue context packets for frontend

James Clark <[email protected]>
perf cs-etm: Create decoders after both AUX and HW_ID search passes

Besar Wicaksono <[email protected]>
perf cs-etm: Fix incorrect or missing decoder for raw trace

Chuck Lever <[email protected]>
xprtrdma: Return sendctx slot after Send preparation failure

Chuck Lever <[email protected]>
xprtrdma: Repost Receive buffers for malformed replies

Chuck Lever <[email protected]>
xprtrdma: Sanitize the reply credit grant after parsing

Chris Mason <[email protected]>
xprtrdma: Fix bcall rep leak and unbounded peek

Chuck Lever <[email protected]>
xprtrdma: Resize reply buffers before reposting receives

Chuck Lever <[email protected]>
xprtrdma: Document and assert reply-handler invariants

Chuck Lever <[email protected]>
xprtrdma: Check frwr_wp_create() during connect

Arnaldo Carvalho de Melo <[email protected]>
perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Fix idle-hist callchain display using wrong rb_first variant

Lad Prabhakar <[email protected]>
PCI: rcar-host: Remove unused LIST_HEAD(res)

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Fix get_max_num() size_t underflow on empty sysfs file

Jamie Nguyen <[email protected]>

    fs/ntfs3: resize log->one_page_buf when adopting on-disk page size

Shuvam Pandey <[email protected]>
PCI: meson: Propagate devm_add_action_or_reset() failure

Li RongQing <[email protected]>
PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro

Mike Snitzer <[email protected]>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write

Mike Snitzer <[email protected]>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors

Clark Wang <[email protected]>
nfs: keep PG_UPTODATE clear after read errors in page groups

Dai Ngo <[email protected]>
NFSv4/pnfs: defer return_range callbacks until after inode unlock

Chuck Lever <[email protected]>
xprtrdma: Decouple req recycling from RPC completion

Chuck Lever <[email protected]>
xprtrdma: Use sendctx DMA state for Send signaling

Chuck Lever <[email protected]>
xprtrdma: Post receive buffers after RPC completion

Chuck Lever <[email protected]>
xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot

Chuck Lever <[email protected]>
xprtrdma: Avoid 250 ms delay on backlog wakeup

Chuck Lever <[email protected]>
xprtrdma: Remove temp allocation of rpcrdma_rep objects

Sagi Grimberg <[email protected]>
pNFS/filelayout: fix cheking if a layout is striped

Phillip Varney <[email protected]>
clk: qcom: a53: Corrected frequency multiplier for 1152MHz

Nuno Sá <[email protected]>
dmaengine: Fix possible use after free

Icenowy Zheng <[email protected]>
dmaengine: qcom: gpi: set DMA_PRIVATE capability

Arnaldo Carvalho de Melo <[email protected]>
perf c2c: Fix use-after-free in he__get_c2c_hists() error path

Arnaldo Carvalho de Melo <[email protected]>
perf mmap: Fix NULL deref in aio cleanup on alloc failure

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Replace BUG_ON and add NULL checks in replay event helpers

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Clean up idle_threads entry on init failure

Arnaldo Carvalho de Melo <[email protected]>
perf c2c: Bounds-check CPU and node IDs before bitmap and array access

Arnaldo Carvalho de Melo <[email protected]>
perf mmap: Guard cpu__get_node() return in aio_bind()

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Add bounds check to cpu__get_node()

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Fix NULL dereference in latency_runtime_event

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Replace BUG_ON on invalid CPU with graceful skip

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Guard test_bit from out-of-bounds sample CPU

Rui Qi <[email protected]>
perf: Fix off-by-one stack buffer overflow in kallsyms__parse()

Shengjiu Wang <[email protected]>
dmaengine: imx-sdma: Refine spba bus searching in probe

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add missing kdoc for ALLM parameters

Jamie Nguyen <[email protected]>
fs/ntfs3: fix mount failure on 64K page-size kernels

Konstantin Komarov <[email protected]>
fs/ntfs3: add bounds check to run_get_highest_vcn()

Rosen Penev <[email protected]>
HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter

Yuho Choi <[email protected]>
clk: at91: keep securam node alive while mapping it

Aldo Conte <[email protected]>
iio: tcs3472: power down chip on probe failure

Sanjay Chitroda <[email protected]>

    iio: accel: mma8452: handle I2C read error(s) in mma8452_read()

Guilherme Ivo Bozi <[email protected]>
iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling

Joshua Crofts <[email protected]>
iio: magnetometer: ak8975: fix potential kernel stack memory leak

Joshua Crofts <[email protected]>
iio: light: si1133: prevent race condition on timeout

Joshua Crofts <[email protected]>
iio: light: si1133: reset counter to prevent race condition

Arnaldo Carvalho de Melo <[email protected]>
perf header: Sanity check HEADER_EVENT_DESC attr.size before swap

James Kim <[email protected]>
char: tlclk: fix use-after-free in tlclk_cleanup()

Seungjin Bae <[email protected]>
usb: host: max3421: Reject hub port requests for non-existent ports

Seungjin Bae <[email protected]>

    usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

Guangshuo Li <[email protected]>
staging: most: video: avoid double free on video register failure

Sergey Senozhatsky <[email protected]>
mailbox: mtk-adsp: fix UAF during device teardown

Leo Yan <[email protected]>
perf pmu: Skip test on Arm64 when #slots is zero

Andy Shevchenko <[email protected]>
phy: phy-can-transceiver: Check driver match and driver data against NULL

Sumit Kumar <[email protected]>
bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()

Rong Zhang <[email protected]>
PCI: loongson: Do not ignore downstream devices on external bridges

Ian Rogers <[email protected]>
perf sched: Add missing mmap2 handler in timehist

Rafael J. Wysocki <[email protected]>
platform/x86: xo15-ebook: Fix wakeup source and GPE handling

Rafael J. Wysocki <[email protected]>
x86/platform/olpc: xo15: Drop wakeup source on driver removal

Guixin Liu <[email protected]>
PCI: Check ROM header and data structure addr before accessing

Guixin Liu <[email protected]>
PCI: Introduce named defines for PCI ROM

Carlos Bilbao <[email protected]>
PCI/ASPM: Don't reconfigure ASPM entering low-power state

Leo Yan <[email protected]>
coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore

Yingchao Deng <[email protected]>
coresight: cti: Fix DT filter signals silently ignored

Alexandru Hossu <[email protected]>
staging: nvec: fix use-after-free in nvec_rx_completed()

Yizhou Zhao <[email protected]>

    net/9p: fix race condition on rdma->state in trans_rdma.c

Aleksandr Nogikh <[email protected]>
ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write

Charles Keepax <[email protected]>
mfd: cs42l43: Sanity check firmware size

Guangshuo Li <[email protected]>
ksmbd: fix use-after-free in same_client_has_lease()

Brett Creeley <[email protected]>
ionic: Fix check in ionic_get_link_ext_stats

Eric Dumazet <[email protected]>

    tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

Eric Dumazet <[email protected]>
tipc: fix UAF in tipc_l2_send_msg()

Gui-Dong Han <[email protected]>
KEYS: Use acquire when reading state in keyring search

Aboorva Devarajan <[email protected]>
powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus

Aboorva Devarajan <[email protected]>
powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down

Aboorva Devarajan <[email protected]>
powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del

Yadan Fan <[email protected]>
MIPS: mm: Fix out-of-bounds write in maar_res_walk()

Sechang Lim <[email protected]>
bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check

Weiming Shi <[email protected]>
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

Leon Hwang <[email protected]>
bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket

Leo Yan <[email protected]>
selftests/bpf: Initialize operation name before use

Huiwen He <[email protected]>
smb/client: always return a value for FS_IOC_GETFLAGS

Jian Zhang <[email protected]>
cifs: remove all cifs files before kill super

Takashi Iwai <[email protected]>
ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()

Florian Westphal <[email protected]>
netfilter: nf_conncount: callers must hold rcu read lock

Runyu Xiao <[email protected]>
kcm: use WRITE_ONCE() when changing lower socket callbacks

Ovidiu Panait <[email protected]>
net: bcmgenet: Use weighted round-robin TX DMA arbitration

Ruoyu Wang <[email protected]>
net: wwan: t7xx: check skb_clone in control TX

Dragos Tatulea <[email protected]>
net/mlx5: Check max_macs devlink param value against max capability

Sun Jian <[email protected]>
bpf: Run generic devmap egress prog on private skb

Aditya Garg <[email protected]>
net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check

Aditya Garg <[email protected]>
net: mana: initialize gdma queue id to INVALID_QUEUE_ID

Victor Nogueira <[email protected]>
net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

Victor Nogueira <[email protected]>
net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

Chuck Lever <[email protected]>
handshake: Require admin permission for DONE command

Lucas Tsai <[email protected]>
power: supply: core: fix supplied_from allocations

Guangshuo Li <[email protected]>
ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO

Lars Pöschel <[email protected]>
spi: xilinx: use FIFO occupancy register to determine buffer size

Herbert Xu <[email protected]>
crypto: rng - Free default RNG on module exit

Felix Gu <[email protected]>
crypto: cavium/cpt - fix DMA cleanup using wrong loop index

Felix Gu <[email protected]>
crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

Dave Jiang <[email protected]>
cxl/test: Add check after kzalloc() memory in alloc_mock_res()

Michael Bommarito <[email protected]>
tipc: reject inverted service ranges from peer bindings

Michael Bommarito <[email protected]>
tipc: prevent snt_unacked underflow on CONN_ACK

Michael Bommarito <[email protected]>
tipc: require net admin for TIPCv2 netlink mutators

Victor Nogueira <[email protected]>
net/sched: sch_hfsc: Don't make class passive twice

Xin Long <[email protected]>
sctp: validate embedded address parameter length

Xiang Mei <[email protected]>
bridge: cfm: reject invalid CCM interval at configuration time

Kuniyuki Iwashima <[email protected]>
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

Jamal Hadi Salim <[email protected]>
net/sched: cls_flow: Dont expose folded kernel pointers

HyeongJun An <[email protected]>
ASoC: tegra: tegra210_ahub: Validate written enum value

HyeongJun An <[email protected]>
ASoC: fsl: fsl_audmix: Validate written enum values

HyeongJun An <[email protected]>
ASoC: codecs: hdac_hdmi: Validate written enum value

Leon Romanovsky <[email protected]>
RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one

Maher Sanalla <[email protected]>
RDMA/mlx5: Fix undefined shift of user RQ WQE size

Patrisious Haddad <[email protected]>
RDMA/mlx5: Remove raw RSS QP restrack tracking

Maxwell Doose <[email protected]>
fs: efs: remove unneeded debug prints

Samuel Moelius <[email protected]>
Bluetooth: vhci: validate devcoredump state before side effects

Samuel Moelius <[email protected]>
Bluetooth: hci: validate codec capability element length

Zijun Hu <[email protected]>
Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device

Heiko Carstens <[email protected]>
s390/process: Fix kernel thread function pointer type

Daniel Borkmann <[email protected]>
bpf: Tighten cgroup storage cookie checks for prog arrays

Sergey Shtylyov <[email protected]>
of: cpu: add check in __of_find_n_match_cpu_property()

Dave Jiang <[email protected]>
cxl/test: Zero out LSA backing memory to avoid leaking to user

Dave Jiang <[email protected]>
cxl/test: Fix integer overflow in mock LSA bounds checks

Yonghong Song <[email protected]>
selftests/bpf: Fix bpf_iter/task_vma test

Aditya Prakash Srivastava <[email protected]>
ext4: fix kernel BUG in ext4_write_inline_data_end

Louis Scalbert <[email protected]>
bonding: 3ad: fix mux port state on oper down

Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails

Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()

longlong yan <[email protected]>
tools/virtio: check mmap return value in vringh_test

Qing Ming <[email protected]>
vhost/net: complete zerocopy ubufs only once

Zhang Tianci <[email protected]>
vduse: Requeue failed read to send_list head

Qihang Tang <[email protected]>
vhost/vdpa: validate virtqueue index in mmap and fault paths

Qihang Tang <[email protected]>
vduse: hold vduse_lock across IDR lookup in open path

Val Packett <[email protected]>
ASoC: codecs: aw88261: fix incorrect masks for boost regs

Ruoyu Wang <[email protected]>
spi: meson-spifc: fix runtime PM leak on remove

Jason Gunthorpe <[email protected]>
IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified

Johannes Thumshirn <[email protected]>
btrfs: zoned: don't account data relocation space-info in statfs free space

Nikita Zhandarovich <[email protected]>
hwmon: (it87) Clamp negative values to zero in set_fan()

David Laight <[email protected]>
fbdev: sm501fb: Fix buffer errors in OF binding code

Filipe Manana <[email protected]>
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

Ryder Lee <[email protected]>
wifi: mt76: mt7921: fix potential tx_retries underflow

Ryder Lee <[email protected]>
wifi: mt76: mt7915: fix potential tx_retries underflow

Bjoern A. Zeeb <[email protected]>

    wifi: mt76: fix argument to ieee80211_is_first_frag()

Hongyan Xia <[email protected]>
sched/fair: Fix cpu_util runnable_avg arithmetic

Wolfram Sang <[email protected]>
hwspinlock: qcom: avoid uninitialized struct members

Hui Zhu <[email protected]>
vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()

Luca Leonardo Scorcia <[email protected]>
pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39

Luca Leonardo Scorcia <[email protected]>
pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39

Mike Christie <[email protected]>
scsi: target: Remove tcm_loop target reset handling

David Disseldorp <[email protected]>
scsi: target: Fix hexadecimal CHAP_I handling

Yuho Choi <[email protected]>
watchdog: unregister PM notifier on watchdog unregister

Al Viro <[email protected]>

    configfs: fix lockless traversals of ->s_children

Dmitry Vyukov <[email protected]>
firmware_loader: Fix recursive lock in device_cache_fw_images()

Felix Gu <[email protected]>
spi: ep93xx: fix double-free of zeropage on DMA setup failure

Jason Gunthorpe <[email protected]>
IB/mlx5: Properly support implicit ODP rereg_mr

Jason Gunthorpe <[email protected]>
IB/mlx5: Don't take the rereg_mr fallback without a new translation

Pengjie Zhang <[email protected]>
cpufreq: Documentation: fix conservative governor freq_step description

Yuho Choi <[email protected]>
ACPI: IPMI: Fix message kref handling on dead device

Kyle Zeng <[email protected]>
ALSA: seq: Clear variable event pointer on read

Rui Qi <[email protected]>

    riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe

HyeongJun An <[email protected]>
ALSA: seq: Fix partial userptr event expansion

Tristan Madani <[email protected]>
wifi: wcn36xx: fix OOB read from short trigger BA firmware response

Tristan Madani <[email protected]>
wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

Tristan Madani <[email protected]>
wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

Leon Hwang <[email protected]>
bpf: Update transport_header when encapsulating UDP tunnel in lwt

Leon Hwang <[email protected]>
bpf: Check tail zero of bpf_prog_info

Alexander Stein <[email protected]>
arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well

Jacob Moroni <[email protected]>

    RDMA/irdma: Initialize iwmr->access during MR registration

Jacob Moroni <[email protected]>
RDMA/irdma: Fix OOB read during CQ MR registration

Jason Gunthorpe <[email protected]>
IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()

Pablo Neira Ayuso <[email protected]>
netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp

Pablo Neira Ayuso <[email protected]>
netfilter: conntrack: revert ct extension genid infrastructure

Fernando Fernandez Mancera <[email protected]>
netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures

Joseph Qi <[email protected]>
ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()

Zhang Cen <[email protected]>
ocfs2/dlm: require a ref for locking_state debugfs open

Zhang Cen <[email protected]>
ocfs2: reject FITRIM ranges shorter than a cluster

Dmitry Antipov <[email protected]>
ocfs2: fix buffer head management in ocfs2_read_blocks()

Zhang Cen <[email protected]>
ocfs2: rebase copied fsdlm LVB pointers in locking_state

Sandipan Das <[email protected]>
perf/x86/amd/core: Always use the NMI latency mitigation

Woojin Ji <[email protected]>
bpftool: Use libbpf error code for flow dissector query

Yunxiang Li <[email protected]>
drm/amdgpu: set sub_block_index for mca ras sub-blocks

Al Viro <[email protected]>

    configfs_lookup(): don't leave ->s_dentry dangling on failure

Alexander Potapenko <[email protected]>

    lib/test_meminit: use && for bools

Guanyou.Chen <[email protected]>
sched: restore timer_slack_ns when resetting RT policy on fork

Danila Chernetsov <[email protected]>
ext2: fix ignored return value of generic_write_sync()

Sang-Heon Jeon <[email protected]>
mm/fake-numa: fix under-allocation detection in uniform split

Deepanshu Kartikey <[email protected]>
bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

Chanwoo Lee <[email protected]>
scsi: ufs: Fix wrong value printed in unexpected UPIU response case

Dan Carpenter <[email protected]>
scsi: pm8001: Fix error code in non_fatal_log_show()

Martin Wilck <[email protected]>
scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"

Alison Schofield <[email protected]>
nvdimm/btt: Handle preemption in BTT lane acquisition

Yuho Choi <[email protected]>
ARM: imx31: Fix IIM mapping leak in revision check

Bart Van Assche <[email protected]>
ata: libata: Fix ata_exec_internal()

J. Neuschäfer <[email protected]>
HID: wiimote: Fix table layout and whitespace errors

Yuho Choi <[email protected]>
ARM: imx3: Fix CCM node reference leak

John Madieu <[email protected]>
ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble

Zhang Yi <[email protected]>
ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback

Chen Cheng <[email protected]>
md/raid10: reset read_slot when reusing r10bio for discard

Danilo Krummrich <[email protected]>
rpmsg: use generic driver_override infrastructure

Renjiang Han <[email protected]>
media: qcom: venus: relax encoder frame/blur step size on v6

Renjiang Han <[email protected]>
media: qcom: venus: relax encoder frame/blur dimension steps on v4

Renjiang Han <[email protected]>
media: qcom: venus: drop extra padding in NV12 raw size calculation

Tristan Madani <[email protected]>
RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path

Tristan Madani <[email protected]>
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe

zhoumin <[email protected]>
EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info

Jessica Zhang <[email protected]>
drm/msm/dp: Fix the ISR_* enum values

Jessica Zhang <[email protected]>
drm/msm/dp: fix HPD state status bit shift value

Weili Qian <[email protected]>
crypto: hisilicon/qm - disable error report before flr

Tetsuo Handa <[email protected]>

    ocfs2: kill osb->system_file_mutex lock

ZhengYuan Huang <[email protected]>
ocfs2: don't BUG_ON an invalid journal dinode

Dan Carpenter <[email protected]>
rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()

Davidlohr Bueso <[email protected]>
dax/kmem: account for partial discontiguous resource upon removal

Carlos Llamas <[email protected]>
libbpf: Fix UAF in strset__add_str()

Michael Bommarito <[email protected]>
libbpf: Harden parse_vma_segs() path parsing

Timur Tabi <[email protected]>
drm/nouveau/bios: specify correct display fuse register for Ampere and Ada

Mikko Perttunen <[email protected]>
drm/tegra: Fix iommu_map_sgtable() return value check

Mikko Perttunen <[email protected]>
gpu: host1x: Fix iommu_map_sgtable() return value check

Felix Gu <[email protected]>
drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()

Mikko Perttunen <[email protected]>
gpu: host1x: Allow entries in BO caches to be freed

Ion Agorria <[email protected]>
drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove

Svyatoslav Ryhel <[email protected]>
drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered

Jiayuan Chen <[email protected]>
net/sched: cls_bpf: prevent unbounded recursion in offload rollback

Eric Dumazet <[email protected]>
ipv6: guard against possible NULL deref in __in6_dev_stats_get()

Breno Leitao <[email protected]>
workqueue: drop spurious '*' from print_worker_info() fn declaration

Nilay Shroff <[email protected]>
nvme-multipath: fix flex array size in struct nvme_ns_head

Charles Keepax <[email protected]>
pinctrl: cs42l43: Fix polarity on debounce

Zhang Cen <[email protected]>
ALSA: seq: midi: Serialize output teardown with event_input

Miquel Raynal <[email protected]>
mtd: spi-nor: Drop duplicate Kconfig dependency

Rosen Penev <[email protected]>
mips: n64: add __iomem for writel call

Rosen Penev <[email protected]>
mips: ralink: mt7621: add missing __iomem

Maciej W. Rozycki <[email protected]>
MIPS: DEC: Remove do_IRQ() call indirection

Maciej W. Rozycki <[email protected]>
MIPS: Fix big-endian stack argument fetching in o32 wrapper

Jiakai Xu <[email protected]>
PM: sleep: Use complete() in device_pm_sleep_init()

Tao Cui <[email protected]>
RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup

Lianfa Weng <[email protected]>
RDMA/hns: Fix warning in poll cq direct mode

Guangshuo Li <[email protected]>
IB/mlx4: Fix refcount leak in add_port() error path

Zhu Yanjun <[email protected]>
RDMA/rxe: Fix a use-after-free problem in rxe_mmap

Jacob Moroni <[email protected]>
RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

Samuel Holland <[email protected]>
bus: sunxi-rsb: Always check register address validity

Ronaldo Nunez <[email protected]>
pwm: imx27: Fix variable truncation in .apply()

Lifeng Zheng <[email protected]>
cpufreq: conservative: Simplify frequency limit handling

Pengjie Zhang <[email protected]>
cpufreq: Documentation: fix sampling_down_factor range

Saravana Kannan <[email protected]>
Revert "treewide: Fix probing of devices in DT overlays"

Zhang Yuwei <[email protected]>
driver core: Use mod_delayed_work to prevent lost deferred probe work

Stepan Ionichev <[email protected]>
device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()

Pengpeng Hou <[email protected]>
tracing: Bound synthetic-field strings with seq_buf

Harshal Dev <[email protected]>
arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node

Geert Uytterhoeven <[email protected]>
firmware: arm_scmi: Fix OOB in scmi_power_name_get()

Sven Püschel <[email protected]>
media: rockchip: rga: fix too small buffer size

Eric Dumazet <[email protected]>

    net/sched: sch_drr: annotate data-races around cl->deficit

Chen-Yu Tsai <[email protected]>
regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions

Randy Dunlap <[email protected]>
bitops: use common function parameter names

Greg Kroah-Hartman <[email protected]>
sysfs: clamp show() return value in sysfs_kf_read()

Sudeep Holla <[email protected]>
firmware: arm_scmi: Read sensor config as 32-bit value

Zilin Guan <[email protected]>
media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()

Sara Venkatesh <[email protected]>
RDMA/srpt: fix integer overflow in immediate data length check

Prathamesh Deshpande <[email protected]>
RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

Alexander Chesnokov <[email protected]>
RDMA/hns: Fix arithmetic overflow in calc_hem_config()

Prathamesh Deshpande <[email protected]>
IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier

Linmao Li <[email protected]>
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD

Eric Dumazet <[email protected]>
net/sched: sch_htb: annotate data-races (I)

Eric Dumazet <[email protected]>

    net/sched: sch_htb: do not change sch->flags in htb_dump()

Qiang Ma <[email protected]>
spi: hisi-kunpeng: Use dev_err_probe() for host registration failure

Sean Christopherson <[email protected]>
crypto: ccp - Treat zero-length cert chain as query for blob lengths

Eric Dumazet <[email protected]>
net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()

Stepan Ionichev <[email protected]>
clk: scpi: Unregister child clock providers on remove

Rafael J. Wysocki <[email protected]>
thermal: hwmon: Fix critical temperature attribute removal

Pengpeng Hou <[email protected]>
evm: terminate and bound the evm_xattrs read buffer

Lin He <[email protected]>
drm/hisilicon/hibmc: use clock to look up the PLL value

Lin He <[email protected]>
drm/hisilicon/hibmc: move display contrl config to hibmc_probe()

Kuldeep Singh <[email protected]>
arm64: dts: qcom: sm8450: Fix ICE reg size

Cristian Marussi <[email protected]>
clk: scmi: Fix clock rate rounding

Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host

Sean Christopherson <[email protected]>
iommu/amd: Fix a stale comment about which legacy mode is user visible

Shuangpeng Bai <[email protected]>
nilfs2: fix backing_dev_info reference leak

Alexander Aring <[email protected]>
dlm: fix add msg handle in send_queue ordered

Weiming Shi <[email protected]>
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

Thorsten Blum <[email protected]>
crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve

Lothar Rubusch <[email protected]>
crypto: atmel-sha204a - fix blocking and non-blocking rng logic

Kuniyuki Iwashima <[email protected]>
vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

Peng Fan <[email protected]>
arm64: dts: imx8x-colibri: Correct SODIMM PAD settings

Weixin Guo <[email protected]>
arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc

Felix Gu <[email protected]>
pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path

Nas Chung <[email protected]>
media: v4l2-common: Add YUV24 format info

Samuel Holland <[email protected]>
media: cedrus: Fix failure to clean up hardware on probe failure

Felix Gu <[email protected]>
watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure

Balakrishnan Sambath <[email protected]>
watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5

Yingjie Gao <[email protected]>
watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH

Jihed Chaibi <[email protected]>
ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint

Tristan Madani <[email protected]>
wifi: ath9k: fix OOB access from firmware tx status queue ID

Xingjing Deng <[email protected]>
kconfig: fix potential NULL pointer dereference in conf_askvalue

Tristan Madani <[email protected]>
wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer

Shin-Yi Lin <[email protected]>
wifi: rtw89: Correct data type for scan index to avoid infinite loop

Danilo Krummrich <[email protected]>

    driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

Krzysztof Kozlowski <[email protected]>
dt-bindings: pinctrl: nvidia,tegra234: Add missing required block

Jon Hunter <[email protected]>
arm64: tegra: Fix Tegra234 MGBE PTP clock

Louis Kotze <[email protected]>
wifi: cfg80211: fix grammar in MLO group key error message

Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning

Diederik de Haas <[email protected]>
arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S

Baolin Liu <[email protected]>
Documentation: proc: fix section numbering in table of contents

Aaron Tomlin <[email protected]>
libbpf: Report error when a negative kprobe offset is specified

Yuho Choi <[email protected]>
drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

Werner Kasselman <[email protected]>
drm/radeon: fix integer overflow in radeon_align_pitch()

Werner Kasselman <[email protected]>
drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()

Tomi Valkeinen <[email protected]>
drm/tidss: Drop extra drm_mode_config_reset() call

Thomas Zimmermann <[email protected]>
drm/rockchip: Test for imported buffers with drm_gem_is_imported()

Chen Ni <[email protected]>
clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive()

Ian Bridges <[email protected]>
fbcon: fix NULL pointer dereference for a console without vc_data

David Howells <[email protected]>
afs: Fix further netns teardown to cancel the preallocation charger

Matvey Kovalev <[email protected]>
afs: fix NULL pointer dereference in afs_get_tree()

David Howells <[email protected]>
afs: Fix netns teardown to cancel the preallocation charger

David Howells <[email protected]>
rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)

Jeffrey Altman <[email protected]>
rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc

Matthias Feser <[email protected]>
serial: 8250_omap: clear rx_running on zero-length DMA completes

Stephan Gerhold <[email protected]>
serial: msm: Disable DMA for kernel console UART

Guoniu Zhou <[email protected]>
dt-bindings: power: imx93: Add MIPI PHY power domain

Chen-Yu Tsai <[email protected]>
dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties

Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix sequence number when no EOF

Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix buffer sequence in frame gaps

Ricardo Ribalda <[email protected]>
media: uvcvideo: Avoid partial metadata buffers

Pawan Gupta <[email protected]>
bpf: Prefer dirty packs for eBPF allocations

Pawan Gupta <[email protected]>
bpf: Prefer packs that won't trigger an IBPB flush on allocation

Pawan Gupta <[email protected]>
bpf: Skip redundant IBPB in pack allocator

Pawan Gupta <[email protected]>
bpf: Restrict JIT predictor flush to cBPF

Pawan Gupta <[email protected]>
x86/bugs: Enable IBPB flush on BPF JIT allocation

Pawan Gupta <[email protected]>
bpf: Support for hardening against JIT spraying

Eric Biggers <[email protected]>
crypto: hisi-trng - Remove crypto_rng interface

Eric Biggers <[email protected]>
crypto: crypto4xx - Remove insecure and unused rng_alg

Herbert Xu <[email protected]>
crypto: crypto4xx - Remove ahash-related code

Stephen Dolan <[email protected]>
x86/mm: Fix check/use ordering in switch_mm_irqs_off()

Eric Biggers <[email protected]>
crypto: sun4i-ss - Remove insecure and unused rng_alg

Sagi Grimberg <[email protected]>
nvmet-tcp: Fix potential UAF when ddgst mismatch

Shivam Kumar <[email protected]>
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

Hyunwoo Kim <[email protected]>
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU

Hyunwoo Kim <[email protected]>
KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU

Muhammet Kaan KILINÇ <[email protected]>

    crypto: algif_skcipher - force synchronous processing on trees without ctx->state

Adam Li <[email protected]>
sched/fair: Only update stats for allowed CPUs when looking for dst group

Chao Shi <[email protected]>
block: skip sync_blockdev() on surprise removal in bdev_mark_dead()

ChenXiaoSong <[email protected]>
smb/server: do not require delete access for non-replacing links

Darrick J. Wong <[email protected]>
xfs: resample the data fork mapping after cycling ILOCK

Weiming Shi <[email protected]>
xfs: fail recovery on a committed log item with no regions

Shoichiro Miyamoto <[email protected]>
smb: client: reject overlapping data areas in SMB2 responses

Joanne Koong <[email protected]>
fuse: re-lock request before returning from fuse_ref_folio()

Alberto Ruiz <[email protected]>
fuse: fix device node leak in cuse_process_init_reply()

Michael Bommarito <[email protected]>
RDMA/siw: bound Read Response placement to the RREAD length

Zhenhao Wan <[email protected]>
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

Dmitry Torokhov <[email protected]>
Input: maplecontrol - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: maplemouse - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: maple_keyb - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: mms114 - fix multi-touch slot corruption

Florian Fuchs <[email protected]>
Input: maplemouse - fix NULL pointer dereference in open()

Bryam Vargas <[email protected]>
Input: mms114 - reject an oversized device packet size

Bryam Vargas <[email protected]>
Input: touchwin - reset the packet index on every complete packet

Dmitry Torokhov <[email protected]>
Input: mms114 - fix touch indexing for MMS134S and MMS136

Bryam Vargas <[email protected]>
Input: iforce - bound the device-reported force-feedback effect index

Bryam Vargas <[email protected]>
Input: goodix - clamp the device-reported contact count

Ranjan Kumar <[email protected]>
Input: elan_i2c - prevent division by zero and arithmetic underflow

Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

Haoxiang Li <[email protected]>
Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure

Guillermo Rodríguez <[email protected]>
i2c: stm32f7: truncate clock period instead of rounding it

Andy Shevchenko <[email protected]>
i2c: mpc: Fix timeout calculations

Johan Hovold <[email protected]>
i2c: core: fix adapter deregistration race

Mikhail Gavrilov <[email protected]>
udmabuf: fix DMA direction mismatch in release_udmabuf()

Sean Christopherson <[email protected]>
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

Sean Christopherson <[email protected]>
KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs

Koichiro Den <[email protected]>
NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()

Bryam Vargas <[email protected]>
exfat: bound uniname advance in exfat_find_dir_entry()

Andrii Kuchmenko <[email protected]>
module: decompress: check return value of module_extend_max_pages()

Benjamin Coddington <[email protected]>
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

Huihui Huang <[email protected]>
tracing: Prevent out-of-bounds read in glob matching

Janne Grunau <[email protected]>
watchdog: apple: Add "apple,t8103-wdt" compatible

Vasily Khoruzhick <[email protected]>
EDAC/i10nm: Don't fail probing if ADXL is missing

Carlos Song <[email protected]>
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

Carlos Song <[email protected]>
spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()

Mark Rutland <[email protected]>
arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()

Paul Louvel <[email protected]>
crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation

Paul Louvel <[email protected]>
crypto: talitos/hash - remove useless wrapper

Paul Louvel <[email protected]>
crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request

Paul Louvel <[email protected]>
crypto: talitos/hash - drop workqueue mechanism for SEC1

Paul Louvel <[email protected]>
crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue

Paul Louvel <[email protected]>
crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor

Paul Louvel <[email protected]>
crypto: talitos - move code in current_desc_hdr() into a standalone function

Paul Louvel <[email protected]>
crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function

Paul Louvel <[email protected]>
crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function

Paul Louvel <[email protected]>
crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1

Paul Louvel <[email protected]>
crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header

Giovanni Cabiddu <[email protected]>
crypto: qat - validate RSA CRT component lengths

Eric Biggers <[email protected]>
crypto: drbg - Fix the fips_enabled priority boost

Eric Biggers <[email protected]>
crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels

Eric Biggers <[email protected]>
crypto: drbg - Fix returning success on failure in CTR_DRBG

Ruijie Li <[email protected]>
crypto: pcrypt - restore callback for non-parallel fallback

Anastasia Tishchenko <[email protected]>
crypto: ecc - Fix carry overflow in vli multiplication

Thorsten Blum <[email protected]>
crypto: caam - use print_hex_dump_devel to guard key hex dumps again

Thorsten Blum <[email protected]>
crypto: caam - use print_hex_dump_devel to guard key hex dumps

Eric Biggers <[email protected]>
crypto: af_alg - Remove zero-copy support from skcipher and aead

Bryam Vargas <[email protected]>
isofs: bound Rock Ridge symlink components to the SL record

Bryam Vargas <[email protected]>
partitions: aix: bound the pp_count scan to the ppe array

Qu Wenruo <[email protected]>
btrfs: do not trim a device which is not writeable

Achkinazi, Igor <[email protected]>
nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks

Mikulas Patocka <[email protected]>
dm-ioctl: report an error if a device has no table

Wentao Liang <[email protected]>
hwrng: jh7110 - fix refcount leak in starfive_trng_read()

Bryam Vargas <[email protected]>
udf: validate sparing table length as an entry count, not a byte count

Bryam Vargas <[email protected]>
udf: validate VAT header length against the VAT inode size

Michael Bommarito <[email protected]>
udf: validate free block extents against the partition length

Maciej W. Rozycki <[email protected]>
PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining

Liviu Stan <[email protected]>
iio: temperature: ltc2983: Fix n_wires default bypassing rotation check

Paul Menzel <[email protected]>
usb: typec: ucsi: cancel pending work on system suspend

Fan Wu <[email protected]>
usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

Madhu M <[email protected]>
usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode

Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Invert DisplayPort role assignment

Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

Shuangpeng Bai <[email protected]>
usb: typec: class: drop PD lookup reference

Myeonghun Pak <[email protected]>
usb: typec: anx7411: use devm_pm_runtime_enable()

Sam Day <[email protected]>
usbip: vudc: fix NULL deref in vep_dequeue()

Yichong Chen <[email protected]>
usbip: tools: support SuperSpeedPlus devices

Xu Rao <[email protected]>
USB: usb-storage: ene_ub6250: restore media-ready check

Johan Hovold <[email protected]>
USB: ulpi: fix memory leak on registration failure

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix write buffer corruption

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix hard lockup on disconnect

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix broken rx after throttle

Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE990D50 compositions

Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix information leak

Haoxiang Li <[email protected]>
usb: mtu3: unmap request DMA on queue failure

Myeonghun Pak <[email protected]>
USB: misc: uss720: unregister parport on probe failure

Xu Rao <[email protected]>
USB: storage: include US_FL_NO_SAME in quirks mask

Myeonghun Pak <[email protected]>
usb: sl811-hcd: disable controller wakeup on remove

Johan Hovold <[email protected]>
USB: legousbtower: fix use-after-free on disconnect race

Erich E. Hoover <[email protected]>
USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD

Johan Hovold <[email protected]>
USB: iowarrior: fix use-after-free on disconnect

Johan Hovold <[email protected]>
USB: ldusb: fix use-after-free on disconnect race

Johan Hovold <[email protected]>
USB: idmouse: fix use-after-free on disconnect race

Xu Rao <[email protected]>
usb: gadget: f_printer: take kref only for successful open

Jimmy Hu <[email protected]>
usb: gadget: udc: Fix use-after-free in gadget_match_driver

Maoyi Xie <[email protected]>
usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

Dawei Feng <[email protected]>
usb: free iso schedules on failed submit

WenTao Liang <[email protected]>
usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()

Rodrigo Lugathe da Conceição Alves <[email protected]>
USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub

Haoxiang Li <[email protected]>
usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()

Jared Baldridge <[email protected]>
usb: cdc_acm: Add quirk for Uniden BC125AT scanner

Maoyi Xie <[email protected]>
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

Dawei Feng <[email protected]>
bpf: Restore sysctl new-value from 1 to 0

Zhao Zhang <[email protected]>
bpf: Reject fragmented frames in devmap

Alexey Nepomnyashih <[email protected]>
xfs: fix unreachable BIGTIME check in dquot flush validation

Yousef Alhouseen <[email protected]>
xfs: use null daddr for unset first bad log block

Louis-Alexis Eyraud <[email protected]>
media: mtk-jpeg: cancel workqueue on release for supported platforms only

Deepanshu Kartikey <[email protected]>
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers

Tristan Madani <[email protected]>
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

Srinivas Pandruvada <[email protected]>
HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads

Maoyi Xie <[email protected]>
HID: lg-g15: cancel pending work on remove to fix a use-after-free

Manish Khadka <[email protected]>
HID: letsketch: fix UAF on inrange_timer at driver unbind

Myeonghun Pak <[email protected]>
HID: wacom: stop hardware after post-start probe failures

Yichong Chen <[email protected]>
tools/mm/slabinfo: fix total_objects attribute name

Xuewen Wang <[email protected]>
tools/mm/slabinfo: Fix trace disable logic inversion

Lukas Wunner <[email protected]>
X.509: Fix validation of ASN.1 certificate header

Kartik Rajput <[email protected]>
clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances

WenTao Liang <[email protected]>
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

Yuho Choi <[email protected]>
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

Tianxiang Chen <[email protected]>
cpufreq: Fix hotplug-suspend race during reboot

Steven Rostedt <[email protected]>
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT

Fushuai Wang <[email protected]>

    cpufreq: intel_pstate: Sync policy->cur during CPU offline

Guangshuo Li <[email protected]>
firmware_loader: fix device reference leak in firmware_upload_register()

Abdun Nihaal <[email protected]>
OPP: of: Fix potential memory leak in opp_parse_supplies()

Norbert Manthey <[email protected]>
smb: client: mask server-provided mode to 07777 in modefromsid

Zihan Xi <[email protected]>
smb: client: harden POSIX SID length parsing

Zihan Xi <[email protected]>
smb: client: use unaligned reads in parse_posix_ctxt()

Haoxiang Li <[email protected]>
smb: client: Fix next buffer leak in receive_encrypted_standard()

Henrique Carvalho <[email protected]>
smb: client: fix double-free in SMB2_close() replay

Henrique Carvalho <[email protected]>
smb: client: fix double-free in SMB2_open() replay

Zhao Zhang <[email protected]>
smb: client: fix double-free in SMB2_flush() replay

Henrique Carvalho <[email protected]>
smb: client: fix change notify replay double-free

Henrique Carvalho <[email protected]>
smb: client: fix double-free in SMB2_ioctl() replay

Henrique Carvalho <[email protected]>
smb: client: fix query_info() replay double-free

Henrique Carvalho <[email protected]>
smb: client: fix query directory replay double-free

Namjae Jeon <[email protected]>
ksmbd: use opener credentials for delete-on-close

Gil Portnoy <[email protected]>
ksmbd: add per-handle permission check to FILE_LINK_INFORMATION

Gil Portnoy <[email protected]>
ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION

Namjae Jeon <[email protected]>
ksmbd: run set info with opener credentials

Gil Portnoy <[email protected]>
ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY

Namjae Jeon <[email protected]>
ksmbd: require source read access for duplicate extents

Davide Ornaghi <[email protected]>
ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation

Namjae Jeon <[email protected]>
ksmbd: serialize QUERY_DIRECTORY requests per file

Gil Portnoy <[email protected]>
ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

Gil Portnoy <[email protected]>
ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE

Dan Carpenter <[email protected]>
smb/client: Fix error code in smb2_aead_req_alloc()

Junrui Luo <[email protected]>
coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()

Deepanshu Kartikey <[email protected]>
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()

Konstantin Komarov <[email protected]>
fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()

Konstantin Komarov <[email protected]>
fs/ntfs3: handle attr_set_size() errors when truncating files

Konstantin Komarov <[email protected]>
fs/ntfs3: fsync files by syncing parent inodes

Muhammad Bilal <[email protected]>
Bluetooth: L2CAP: validate option length before reading conf opt value

Yousef Alhouseen <[email protected]>
Bluetooth: fix UAF in bt_accept_dequeue()

Maoyi Xie <[email protected]>
Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()

Yousef Alhouseen <[email protected]>
Bluetooth: bnep: pin L2CAP connection during netdev registration

Sergey Senozhatsky <[email protected]>
Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()

Xiang Mei <[email protected]>
netfilter: ebtables: terminate table name before find_table_lock()

Florian Westphal <[email protected]>
netfilter: ebtables: module names must be null-terminated

Pratham Gupta <[email protected]>
netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump

Qi Zheng <[email protected]>
mm: shrinker: fix NULL pointer dereference in debugfs

Andrei Kuchynski <[email protected]>
mfd: cros_ec: Delay dev_set_drvdata() until probe success

Wyatt Feng <[email protected]>
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

Yuyang Huang <[email protected]>
ipv4: igmp: remove multicast group from hash table on device destruction

Runyu Xiao <[email protected]>
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

Runyu Xiao <[email protected]>
gpio: eic-sprd: use raw_spinlock_t in the irq startup path

Koichiro Den <[email protected]>
NTB: epf: Avoid calling pci_irq_vector() from hardirq context

Yunpeng Tian <[email protected]>
fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

Thomas Gleixner <[email protected]>
debugobjects: Plug race against a concurrent OOM disable

Samuel Page <[email protected]>
Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete

Chi Wang <[email protected]>
audit: Fix data races of skb_queue_len() readers on audit_queue

Zijing Yin <[email protected]>
net: af_key: initialize alg_key_len for IPComp states

Gil Portnoy <[email protected]>
ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL

Dawei Feng <[email protected]>
crypto: amlogic - avoid double cleanup in meson_crypto_probe()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB write in HT_caps_handler()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

Arnd Bergmann <[email protected]>
staging: media: atomisp: reduce load_primary_binaries() stack usage

Ricardo Ribalda <[email protected]>
media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe

Hao-Qun Huang <[email protected]>
staging: vme_user: fix location monitor leak in tsi148 bridge

Hao-Qun Huang <[email protected]>
staging: vme_user: fix location monitor leak in fake bridge

Shoichiro Miyamoto <[email protected]>
smb: client: restrict implied bcc[0] exemption to responses without data area

Michael Tautschnig <[email protected]>
staging: vme_user: bound slave read/write to the kern_buf size

Samuel Page <[email protected]>
tipc: fix out-of-bounds read in broadcast Gap ACK blocks

Yizhou Zhao <[email protected]>
6lowpan: fix NHC entry use-after-free on error path

Runyu Xiao <[email protected]>
usb: dwc3: run gadget disconnect from sleepable suspend context

Alan Stern <[email protected]>
USB: chaoskey: Fix slab-use-after-free in chaoskey_release()

Michael Bommarito <[email protected]>
hwrng: virtio: clamp device-reported used.len at copy_data()

Johan Hovold <[email protected]>
virtio-mmio: fix device release warning on module unload

Xiang Mei <[email protected]>
netfilter: ipset: fix race between dump and ip_set_list resize

SeongJae Park <[email protected]>
mm/damon/ops-common: handle extreme intervals in damon_hot_score()

Ratheesh Kannoth <[email protected]>
PCI: host-common: Request bus reassignment when not probe-only

Mahesh Vaidya <[email protected]>
PCI: altera: Do not dispose parent IRQ mapping

Myeonghun Pak <[email protected]>
usb: typec: tcpci_rt1711h: unregister TCPCI port with devres

胡连勤 <[email protected]>
usb: xhci: Fix sleep in atomic context in xhci_free_streams()

Carlos Llamas <[email protected]>
binder: fix UAF in binder_free_transaction()

Carlos Llamas <[email protected]>
binder: fix UAF in binder_thread_release()

Johan Hovold <[email protected]>
Bluetooth: btusb: fix wakeup source leak on probe failure

Johan Hovold <[email protected]>
Bluetooth: btusb: fix use-after-free on marvell probe failure

Johan Hovold <[email protected]>
Bluetooth: btusb: fix use-after-free on registration failure

Zenm Chen <[email protected]>
Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB

Junrui Luo <[email protected]>
vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc

Alex Williamson <[email protected]>
vfio/pci: Fix racy bitfields and tighten struct layout

Alex Williamson <[email protected]>
vfio/pci: Release the VGA arbiter client on register_device() failure

Alex Williamson <[email protected]>
vfio/pci: Latch disable_idle_d3 per device

Raghavendra Rao Ananta <[email protected]>
vfio/pci: Use a private flag to prevent power state change with VFs

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Update Babyface Pro control caches only after successful writes

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Roll back quirk control caches on write errors

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()

Darvell Long <[email protected]>
ALSA: usb-audio: avoid kobject path lookup in DualSense match

HyeongJun An <[email protected]>
ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()

Zhao Dongdong <[email protected]>
ALSA: ice1712: check snd_ctl_new1() return value

Zhao Dongdong <[email protected]>
ALSA: gus: check snd_ctl_new1() return value

Maoyi Xie <[email protected]>
ALSA: firewire: isight: bound the sample count to the packet payload

Zhao Dongdong <[email protected]>
ALSA: es1938: check snd_ctl_new1() return value

Zhao Dongdong <[email protected]>
ALSA: cmipci: check snd_ctl_new1() return value

Maoyi Xie <[email protected]>
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser

Zhao Dongdong <[email protected]>
ALSA: ymfpci: check snd_ctl_new1() return value

Cássio Gabriel <[email protected]>
ALSA: virtio: Add missing 384 kHz PCM rate mapping

Liviu Stan <[email protected]>
iio: temperature: ltc2983: Fix reinit_completion() called after conversion start

Andy Shevchenko <[email protected]>
iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call

Javier Carrasco <[email protected]>
iio: light: veml6030: fix channel type when pushing events

Stepan Ionichev <[email protected]>
iio: light: tsl2591: return actual error from probe IRQ failure

Joshua Crofts <[email protected]>
iio: light: opt3001: fix missing state reset on timeout

Biren Pandya <[email protected]>
iio: light: gp2ap002: fix runtime PM leak on read error

Vidhu Sarwal <[email protected]>
iio: light: al3010: fix incorrect scale for the highest gain range

Andreas Kempe <[email protected]>
iio: imu: st_lsm6dsx: deselect shub page before reading whoami

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamp clock period by using lower value

Runyu Xiao <[email protected]>
iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ

Stepan Ionichev <[email protected]>
iio: gyro: bmg160: wait full startup time after mode change at probe

Stepan Ionichev <[email protected]>
iio: gyro: bmg160: bail out when bandwidth/filter is not in table

Lars-Peter Clausen <[email protected]>
iio: event: Fix event FIFO reset race

Maxwell Doose <[email protected]>
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug

Pengpeng Hou <[email protected]>
iio: adc: ti-ads124s08: Return reset GPIO lookup errors

Maxwell Doose <[email protected]>
iio: adc: spear: Initialize completion before requesting IRQ

Maxwell Doose <[email protected]>
iio: adc: lpc32xx: Initialize completion before requesting IRQ

Biren Pandya <[email protected]>
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error

Bryam Vargas <[email protected]>
iio: accel: bmc150: clamp the device-reported FIFO frame count

Griffin Kroah-Hartman <[email protected]>
usb: gadget: function: rndis: add length check for header

Griffin Kroah-Hartman <[email protected]>
usb: gadget: function: rndis: add length check to response query

Jonas Jelonek <[email protected]>
MIPS: smp: report dying CPU to RCU in stop_this_cpu()

Sebastian Andrzej Siewior <[email protected]>
net: Drop the lock in skb_may_tx_timestamp()

Huacai Chen <[email protected]>
LoongArch: Add PIO for early access before ACPI PCI root register

Philo Lu <[email protected]>
virtio_net: Support dynamic rss indirection table size

Fuad Tabba <[email protected]>
arm64: sysreg: Correct sign definitions for EIESB and DoubleLock

Marc Zyngier <[email protected]>
arm64: Revamp HCR_EL2.E2H RES1 detection

Ahmed Genidi <[email protected]>
KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()

Mark Rutland <[email protected]>
KVM: arm64: Initialize HCR_EL2.E2H early

Marc Zyngier <[email protected]>
arm64: Fix early handling of FEAT_E2H0 not being implemented

Marc Zyngier <[email protected]>
arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative

Marc Zyngier <[email protected]>
arm64: sysreg: Add layout for ID_AA64MMFR4_EL1

Paul Louvel <[email protected]>
crypto: talitos - rename first/last to first_desc/last_desc

Paul Louvel <[email protected]>
crypto: talitos - fix SEC1 32k ahash request limitation

Eric Biggers <[email protected]>
crypto: talitos - stop using crypto_ahash::init

Goetz Goerisch <[email protected]>
Revert "crypto: talitos - fix SEC1 32k ahash request limitation"

Goetz Goerisch <[email protected]>
Revert "crypto: talitos - rename first/last to first_desc/last_desc"

Taeyang Lee <[email protected]>
perf/core: Detach event groups during remove_on_exec

Alice Ryhl <[email protected]>
rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER

Rafael J. Wysocki <[email protected]>
ACPI: NFIT: core: Fix possible NULL pointer dereference

Jeremy Linton <[email protected]>
ACPI: CPPC: Suppress UBSAN warning caused by field misuse

Florian Fainelli <[email protected]>
perf trace beauty fcntl: Fix build with older kernel headers

Claudia Draghicescu <[email protected]>
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID

Darrick J. Wong <[email protected]>

    xfs: move ->iop_recover to xfs_defer_op_type

Darrick J. Wong <[email protected]>
xfs: use xfs_defer_finish_one to finish recovered work items

Darrick J. Wong <[email protected]>
xfs: dump the recovered xattri log item if corruption happens

Darrick J. Wong <[email protected]>
xfs: recreate work items when recovering intent items

Jiayuan Chen <[email protected]>
mm/vmscan: flush deferred TLB before freeing large folios

Jiayuan Chen <[email protected]>
team: fix header_ops type confusion with non-Ethernet ports

Eric Dumazet <[email protected]>
bonding: prevent potential infinite loop in bond_header_parse()

Jiayuan Chen <[email protected]>
bonding: fix type confusion in bond_setup_by_slave()

Hangbin Liu <[email protected]>
bonding: fix xfrm offload feature setup on active-backup mode

Hangbin Liu <[email protected]>
bonding: use common function to compute the features

Hangbin Liu <[email protected]>
net: add a common function to compute features for upper devices

Cosmin Ratiu <[email protected]>
bonding: Correctly support GSO ESP offload

Jianbo Liu <[email protected]>
bonding: add ESP offload features when slaves support

Daniel Borkmann <[email protected]>
bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features

Daniel Borkmann <[email protected]>
net, team, bonding: Add netdev_base_features helper

Hangbin Liu <[email protected]>
net: team: rename team to team_core for linking

NeilBrown <[email protected]>
nfsd: change nfs4_client_to_reclaim() to allocate data

NeilBrown <[email protected]>
nfsd: move name lookup out of nfsd4_list_rec_dir()

John Johansen <[email protected]>
apparmor: advertise the tcp fast open fix is applied

Trond Myklebust <[email protected]>
nfsd: Don't reset the write verifier on a commit EAGAIN

Michael Bommarito <[email protected]>
NFSv4/flexfiles: reject zero filehandle version count

Mingyu Wang <[email protected]>
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

Johan Hovold <[email protected]>
i2c: core: fix adapter registration race

Johan Hovold <[email protected]>
i2c: core: fix adapter debugfs creation

Johan Hovold <[email protected]>
i2c: core: fix NULL-deref on adapter registration failure

Johan Hovold <[email protected]>
i2c: core: fix hang on adapter registration failure

Johan Hovold <[email protected]>
i2c: core: fix irq domain leak on adapter registration failure

Denis Arefev <[email protected]>
block: Avoid mounting the bdev pseudo-filesystem in userspace

Sean Christopherson <[email protected]>
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()

Keshav Verma <[email protected]>
f2fs: fix listxattr handling of corrupted xattr entries

Chao Yu <[email protected]>
f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()

Ruipeng Qi <[email protected]>
f2fs: fix potential deadlock in f2fs_balance_fs()

Bryam Vargas <[email protected]>
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes

Chao Yu <[email protected]>
f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode

Wenjie Qi <[email protected]>
f2fs: validate orphan inode entry count

Bartosz Golaszewski <[email protected]>
device property: initialize the remaining fields of fwnode_handle in fwnode_init()

Maoyi Xie <[email protected]>
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

Tiezhu Yang <[email protected]>
drm/amd: Fix set but not used warnings

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd

Uwe Kleine-König <[email protected]>
slimbus: Convert to platform remove callback returning void

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Fix probe error path ordering

Chris Lu <[email protected]>
Bluetooth: btmtk: Fix btmtk.c undefined reference build error

Wentao Guan <[email protected]>
perf: Fix dangling cgroup pointer in cpuctx backport

Kiryl Shutsemau <[email protected]>
userfaultfd: gate must_wait writability check on pte_present()

Jiande Lu <[email protected]>
Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown

Chris Lu <[email protected]>
Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices.

Chris Lu <[email protected]>
Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c

Chris Lu <[email protected]>
Bluetooth: btusb: mediatek: return error for failed reg access

Chris Lu <[email protected]>
Bluetooth: btusb: mediatek: remove the unnecessary goto tag

Hao Qin <[email protected]>
Bluetooth: btusb: mediatek: add MT7922 subsystem reset

Hao Qin <[email protected]>
Bluetooth: btusb: mediatek: reset the controller before downloading the fw

Sean Wang <[email protected]>
Bluetooth: btmtk: apply the common btmtk_fw_get_filename

Huacai Chen <[email protected]>
LoongArch: Report dying CPU to RCU in stop_this_cpu()

Baokun Li <[email protected]>
ext4: get rid of ppath in get_ext_path()

Jeff Layton <[email protected]>
nfsd: reset write verifier on deferred writeback errors

Chris Mason <[email protected]>
nfsd: release layout stid on setlease failure

Daniel Borkmann <[email protected]>
bpf, arm64: Reject out-of-range B.cond targets

-------------

Diffstat:

 Documentation/admin-guide/pm/cpufreq.rst           |   6 +-
 Documentation/crypto/userspace-if.rst              |  31 +-
 .../media/allwinner,sun4i-a10-video-engine.yaml    |  10 +
 .../devicetree/bindings/net/renesas,ether.yaml     |   3 +-
 .../pinctrl/nvidia,tegra234-pinmux-aon.yaml        |   4 +
 .../bindings/pinctrl/nvidia,tegra234-pinmux.yaml   |   4 +
 .../bindings/regulator/mt6359-regulator.yaml       |  43 --
 Documentation/driver-api/nvdimm/btt.rst            |   5 +-
 Documentation/driver-api/pci/pci.rst               |   3 +
 Documentation/filesystems/proc.rst                 |  14 +-
 Documentation/netlink/specs/handshake.yaml         |   1 +
 Makefile                                           |   7 +-
 arch/alpha/kernel/pci-sysfs.c                      |  13 +-
 arch/arm/boot/dts/ti/omap/am335x-sl50.dts          |   4 +-
 arch/arm/configs/sunxi_defconfig                   |   1 -
 arch/arm/mach-imx/cpu-imx31.c                      |   9 +-
 arch/arm/mach-imx/mm-imx3.c                        |   2 +
 .../dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts    |   3 +
 arch/arm64/boot/dts/freescale/imx8x-colibri.dtsi   |   4 +-
 arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi   |   2 +-
 arch/arm64/boot/dts/nvidia/tegra234.dtsi           |   8 +-
 arch/arm64/boot/dts/qcom/sdm630.dtsi               |   9 +-
 .../qcom/sdm845-db845c-navigation-mezzanine.dtso   |   5 +
 arch/arm64/boot/dts/qcom/sm8450.dtsi               |   8 +-
 arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts     |   2 +-
 arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dts |   6 +-
 arch/arm64/include/asm/el2_setup.h                 |  56 +-
 arch/arm64/include/asm/kvm_hyp.h                   |   1 +
 arch/arm64/include/asm/pgtable.h                   |  14 +-
 arch/arm64/kernel/efi.c                            |   2 +-
 arch/arm64/kernel/entry-fpsimd.S                   |  16 +-
 arch/arm64/kernel/head.S                           |  20 +-
 arch/arm64/kernel/hw_breakpoint.c                  |   9 +
 arch/arm64/kernel/mte.c                            |   2 +-
 arch/arm64/kvm/arm.c                               |   2 +
 arch/arm64/kvm/guest.c                             |   2 +-
 arch/arm64/kvm/hyp/nvhe/hyp-init.S                 |   3 +-
 arch/arm64/kvm/hyp/nvhe/hyp-main.c                 |  12 +
 arch/arm64/kvm/hyp/nvhe/psci-relay.c               |   3 +
 arch/arm64/kvm/vgic/vgic-its.c                     |   2 +
 arch/arm64/kvm/vgic/vgic.c                         |  11 +-
 arch/arm64/lib/insn.c                              |   2 +
 arch/arm64/mm/fault.c                              |   6 +-
 arch/arm64/mm/hugetlbpage.c                        |  18 +-
 arch/arm64/mm/kasan_init.c                         |   2 +-
 arch/arm64/mm/mmu.c                                |  23 +-
 arch/arm64/mm/pageattr.c                           |   4 +-
 arch/arm64/mm/trans_pgd.c                          |   2 +-
 arch/arm64/tools/sysreg                            |  39 +-
 arch/loongarch/include/asm/acpi.h                  |   2 +
 arch/loongarch/include/asm/pgtable.h               |   4 +
 arch/loongarch/kernel/acpi.c                       |  28 +
 arch/loongarch/kernel/setup.c                      |   2 +
 arch/loongarch/kernel/smp.c                        |   1 +
 arch/loongarch/pci/acpi.c                          |   2 +
 arch/mips/dec/int-handler.S                        |   2 +-
 arch/mips/dec/platform.c                           |   6 +-
 arch/mips/dec/prom/init.c                          |   6 +-
 arch/mips/dec/setup.c                              |   6 -
 arch/mips/fw/lib/call_o32.S                        |   2 +-
 arch/mips/include/asm/dec/prom.h                   |  15 +-
 arch/mips/kernel/mips-mt-fpaff.c                   |  28 +-
 arch/mips/kernel/smp.c                             |   2 +
 arch/mips/mm/init.c                                |  12 +-
 arch/mips/n64/init.c                               |   2 +-
 arch/mips/ralink/mt7621.c                          |   2 +-
 arch/mips/sgi-ip22/ip22-gio.c                      |   7 +-
 arch/powerpc/kexec/core_64.c                       |   4 +-
 arch/powerpc/perf/core-fsl-emb.c                   |   3 +-
 arch/powerpc/platforms/cell/spufs/file.c           |   6 +-
 arch/powerpc/platforms/powernv/setup.c             |   3 +-
 .../platforms/pseries/papr_platform_attributes.c   |   8 +-
 arch/riscv/kernel/cacheinfo.c                      |   2 +-
 arch/riscv/kernel/machine_kexec.c                  |   3 +
 arch/riscv/kernel/probes/rethook_trampoline.S      |   3 +
 arch/riscv/kernel/stacktrace.c                     |   2 +-
 arch/riscv/net/bpf_jit_core.c                      |   3 +-
 arch/s390/kernel/perf_cpum_cf.c                    |   3 +
 arch/s390/kernel/process.c                         |   2 +-
 arch/s390/kvm/pci.c                                |  12 +-
 arch/sparc/kernel/led.c                            |   2 +-
 arch/x86/boot/compressed/acpi.c                    |   7 +-
 arch/x86/boot/early_serial_console.c               |  11 +-
 arch/x86/events/amd/brs.c                          |  10 +-
 arch/x86/events/amd/core.c                         |   6 +-
 arch/x86/events/amd/lbr.c                          |   3 +-
 arch/x86/events/intel/uncore_snb.c                 |   7 -
 arch/x86/include/asm/nospec-branch.h               |   4 +
 arch/x86/kernel/cpu/bugs.c                         |  50 +-
 arch/x86/kvm/lapic.c                               |   8 +-
 arch/x86/kvm/vmx/vmx.c                             |  38 +-
 arch/x86/mm/numa_emulation.c                       |  17 +-
 arch/x86/mm/tlb.c                                  |  16 +-
 arch/x86/net/bpf_jit_comp.c                        |   3 +-
 arch/x86/platform/olpc/olpc-xo15-sci.c             |   1 +
 block/bdev.c                                       |  11 +-
 block/partitions/aix.c                             |   9 +
 crypto/af_alg.c                                    |  69 +--
 crypto/algif_aead.c                                |   8 +-
 crypto/algif_skcipher.c                            |  49 +-
 crypto/asymmetric_keys/verify_pefile.c             |   2 +
 crypto/asymmetric_keys/x509_loader.c               |   2 +-
 crypto/drbg.c                                      |   4 +-
 crypto/ecc.c                                       |  31 +-
 crypto/ecrdsa.c                                    |   2 +-
 crypto/pcrypt.c                                    |   4 +
 crypto/rng.c                                       |  11 +
 drivers/acpi/acpi_ipmi.c                           |   4 +-
 drivers/acpi/acpi_tad.c                            |   6 +-
 drivers/acpi/bus.c                                 |  70 +++
 drivers/acpi/cppc_acpi.c                           |  11 +-
 drivers/acpi/nfit/core.c                           |  89 +++-
 drivers/acpi/pfr_telemetry.c                       |   6 +-
 drivers/acpi/pfr_update.c                          |   6 +-
 drivers/acpi/resource.c                            |   6 +-
 drivers/acpi/thermal.c                             |   2 +-
 drivers/android/binder.c                           |  19 +-
 drivers/ata/libata-core.c                          |  19 +-
 drivers/ata/pata_pxa.c                             |   1 +
 drivers/ata/sata_gemini.c                          |   2 +-
 drivers/base/dd.c                                  |   7 +-
 drivers/base/firmware_loader/main.c                |   3 +-
 drivers/base/firmware_loader/sysfs_upload.c        |   8 +-
 drivers/base/power/main.c                          |   6 +-
 drivers/base/property.c                            |   4 +-
 drivers/block/drbd/drbd_receiver.c                 |   5 +
 drivers/bluetooth/Kconfig                          |   2 +
 drivers/bluetooth/bpa10x.c                         |   8 +-
 drivers/bluetooth/btmtk.c                          | 470 ++++++++++++++++-
 drivers/bluetooth/btmtk.h                          |  23 +-
 drivers/bluetooth/btmtksdio.c                      |   5 +-
 drivers/bluetooth/btnxpuart.c                      |   6 +
 drivers/bluetooth/btrtl.c                          |   5 +-
 drivers/bluetooth/btusb.c                          | 418 ++-------------
 drivers/bluetooth/hci_qca.c                        |   2 +-
 drivers/bluetooth/hci_vhci.c                       |  10 +
 drivers/bus/imx-weim.c                             |   6 -
 drivers/bus/mhi/ep/main.c                          |   9 +-
 drivers/bus/sunxi-rsb.c                            |   3 +
 drivers/char/hw_random/jh7110-trng.c               |  13 +-
 drivers/char/hw_random/virtio-rng.c                |  23 +-
 drivers/char/tlclk.c                               |   4 +
 drivers/char/tpm/eventlog/tpm1.c                   |   4 +-
 drivers/char/tpm/tpm-dev.c                         |   2 +-
 drivers/char/tpm/tpm_tis_core.c                    |  35 +-
 drivers/char/tpm/tpmrm-dev.c                       |   2 +-
 drivers/clk/at91/pmc.c                             |   2 +-
 drivers/clk/clk-scmi.c                             |   4 +-
 drivers/clk/clk-scpi.c                             |   2 +-
 drivers/clk/qcom/a53-pll.c                         |   2 +-
 drivers/clocksource/timer-sun5i.c                  |   3 +
 drivers/clocksource/timer-tegra186.c               |   3 +-
 drivers/cpufreq/acpi-cpufreq.c                     |   4 +-
 drivers/cpufreq/amd-pstate.c                       |   7 +-
 drivers/cpufreq/apple-soc-cpufreq.c                |   4 +-
 drivers/cpufreq/bmips-cpufreq.c                    |   4 +-
 drivers/cpufreq/cppc_cpufreq.c                     |   3 +-
 drivers/cpufreq/cpufreq-dt.c                       |   3 +-
 drivers/cpufreq/cpufreq.c                          |   2 +
 drivers/cpufreq/cpufreq_conservative.c             |  12 +-
 drivers/cpufreq/e_powersaver.c                     |   3 +-
 drivers/cpufreq/intel_pstate.c                     |  14 +-
 drivers/cpufreq/mediatek-cpufreq-hw.c              |   4 +-
 drivers/cpufreq/mediatek-cpufreq.c                 |   4 +-
 drivers/cpufreq/omap-cpufreq.c                     |   3 +-
 drivers/cpufreq/pasemi-cpufreq.c                   |   6 +-
 drivers/cpufreq/pcc-cpufreq.c                      |   8 +-
 drivers/cpufreq/powernow-k6.c                      |   5 +-
 drivers/cpufreq/powernow-k7.c                      |   3 +-
 drivers/cpufreq/powernow-k8.c                      |   6 +-
 drivers/cpufreq/powernv-cpufreq.c                  |   4 +-
 drivers/cpufreq/ppc_cbe_cpufreq.c                  |   3 +-
 drivers/cpufreq/qcom-cpufreq-hw.c                  |   5 +-
 drivers/cpufreq/qoriq-cpufreq.c                    |   4 +-
 drivers/cpufreq/scmi-cpufreq.c                     |   4 +-
 drivers/cpufreq/scpi-cpufreq.c                     |   4 +-
 drivers/cpufreq/sh-cpufreq.c                       |   4 +-
 drivers/cpufreq/sparc-us2e-cpufreq.c               |   3 +-
 drivers/cpufreq/sparc-us3-cpufreq.c                |   3 +-
 drivers/cpufreq/speedstep-centrino.c               |  10 +-
 drivers/cpufreq/tegra194-cpufreq.c                 |   4 +-
 drivers/cpufreq/vexpress-spc-cpufreq.c             |   5 +-
 drivers/crypto/allwinner/Kconfig                   |   8 -
 drivers/crypto/allwinner/sun4i-ss/Makefile         |   1 -
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss-core.c  |  36 --
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss-prng.c  |  69 ---
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h       |  20 -
 drivers/crypto/amcc/crypto4xx_alg.c                | 106 ----
 drivers/crypto/amcc/crypto4xx_core.c               | 130 +----
 drivers/crypto/amcc/crypto4xx_core.h               |  11 -
 drivers/crypto/amcc/crypto4xx_reg_def.h            |  11 -
 drivers/crypto/amlogic/amlogic-gxl-core.c          |   2 +-
 drivers/crypto/atmel-ecc.c                         |   2 +-
 drivers/crypto/atmel-sha204a.c                     |  29 +-
 drivers/crypto/caam/caamalg.c                      |  12 +-
 drivers/crypto/caam/caamalg_qi.c                   |  12 +-
 drivers/crypto/caam/caamalg_qi2.c                  |  12 +-
 drivers/crypto/caam/caamhash.c                     |   4 +-
 drivers/crypto/caam/key_gen.c                      |   4 +-
 drivers/crypto/cavium/cpt/cptvf_reqmanager.c       |   4 +-
 drivers/crypto/ccp/sev-dev.c                       |   3 +-
 drivers/crypto/hisilicon/Kconfig                   |   1 -
 drivers/crypto/hisilicon/qm.c                      |   4 +-
 drivers/crypto/hisilicon/trng/trng.c               | 298 +----------
 .../intel/qat/qat_common/adf_accel_devices.h       |   2 +
 drivers/crypto/intel/qat/qat_common/adf_aer.c      |   7 +-
 .../crypto/intel/qat/qat_common/adf_common_drv.h   |   2 +
 drivers/crypto/intel/qat/qat_common/adf_isr.c      |  39 ++
 drivers/crypto/intel/qat/qat_common/adf_sriov.c    |  20 +-
 .../crypto/intel/qat/qat_common/qat_asym_algs.c    |  10 +-
 drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c |   4 +-
 drivers/crypto/talitos.c                           | 576 +++++++++++----------
 drivers/crypto/talitos.h                           |  12 +
 drivers/dax/kmem.c                                 |   6 +
 drivers/dma-buf/udmabuf.c                          |   5 +-
 drivers/dma/dmaengine.c                            |   3 +-
 drivers/dma/dw-edma/dw-edma-core.h                 |   2 +-
 drivers/dma/dw-edma/dw-edma-v0-core.c              |   6 +
 drivers/dma/imx-sdma.c                             |   4 +-
 drivers/dma/qcom/gpi.c                             |   1 +
 drivers/dma/tegra186-gpc-dma.c                     |   7 +
 drivers/edac/i10nm_base.c                          |  14 +-
 drivers/edac/skx_common.c                          |   3 +
 drivers/firewire/net.c                             |   5 +-
 drivers/firmware/arm_scmi/power.c                  |   6 +-
 drivers/firmware/arm_scmi/sensors.c                |   2 +-
 drivers/fpga/dfl.c                                 |   2 +
 drivers/fpga/microchip-spi.c                       |   3 +
 drivers/gpio/gpio-eic-sprd.c                       |   8 +-
 drivers/gpio/gpio-f7188x.c                         |   6 +-
 drivers/gpio/gpio-htc-egpio.c                      |   6 +-
 drivers/gpio/gpio-mlxbf3.c                         |   3 +-
 drivers/gpio/gpio-mvebu.c                          |   5 +-
 drivers/gpio/gpio-palmas.c                         |  19 +
 drivers/gpio/gpio-sch.c                            |  32 +-
 drivers/gpio/gpio-timberdale.c                     |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c   |  16 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c           |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c            |  25 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c            |   2 -
 drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c            |   3 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h            |   3 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |   3 +
 drivers/gpu/drm/amd/amdkfd/kfd_events.c            |   5 +
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c               |   1 +
 drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c       |  11 +-
 .../amd/display/modules/info_packet/info_packet.c  |   2 +
 drivers/gpu/drm/drm_edid.c                         |   8 +
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c     |  78 +--
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c    |  11 +
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c   |  22 -
 drivers/gpu/drm/i915/gt/intel_region_lmem.c        |   2 +-
 drivers/gpu/drm/msm/dp/dp_display.c                |   4 +-
 drivers/gpu/drm/msm/dp/dp_reg.h                    |   4 +-
 .../gpu/drm/nouveau/nvkm/subdev/bios/shadowramin.c |   3 +-
 drivers/gpu/drm/radeon/radeon_gem.c                |  13 +-
 drivers/gpu/drm/radeon/radeon_ring.c               |   4 +-
 drivers/gpu/drm/rockchip/rockchip_drm_gem.c        |   2 +-
 drivers/gpu/drm/tegra/dc.c                         |   4 +-
 drivers/gpu/drm/tegra/gem.c                        |  22 +-
 drivers/gpu/drm/tegra/gr2d.c                       |  19 +-
 drivers/gpu/drm/tegra/gr3d.c                       |  19 +-
 drivers/gpu/drm/tegra/submit.c                     |   3 +-
 drivers/gpu/drm/tidss/tidss_kms.c                  |   2 -
 drivers/gpu/host1x/bus.c                           |  62 ++-
 drivers/gpu/host1x/job.c                           |  10 +-
 drivers/hid/hid-appleir.c                          |  45 +-
 drivers/hid/hid-core.c                             |   7 +
 drivers/hid/hid-letsketch.c                        |  36 +-
 drivers/hid/hid-lg-g15.c                           |  16 +
 drivers/hid/hid-logitech-hidpp.c                   |   1 -
 drivers/hid/hid-multitouch.c                       |  32 +-
 drivers/hid/hid-picolcd_core.c                     |   3 +-
 drivers/hid/hid-playstation.c                      |  12 +
 drivers/hid/hid-sensor-hub.c                       |  77 ++-
 drivers/hid/hid-wiimote-modules.c                  |  58 +--
 drivers/hid/wacom_sys.c                            |  12 +-
 drivers/hwmon/Kconfig                              |   1 +
 drivers/hwmon/asus_atk0110.c                       |   3 +
 drivers/hwmon/it87.c                               |   3 +
 drivers/hwmon/occ/common.c                         |  34 +-
 drivers/hwmon/occ/common.h                         |   1 +
 drivers/hwmon/pmbus/adm1275.c                      |   2 +-
 drivers/hwmon/pmbus/pmbus_core.c                   |  13 +-
 drivers/hwmon/w83627hf.c                           |   4 +
 drivers/hwmon/w83793.c                             |   1 +
 drivers/hwspinlock/qcom_hwspinlock.c               |   5 +-
 .../hwtracing/coresight/coresight-cti-platform.c   |   1 +
 drivers/hwtracing/coresight/coresight-etb10.c      |   6 +-
 drivers/hwtracing/coresight/coresight-etm4x-core.c |   4 +-
 drivers/hwtracing/coresight/ultrasoc-smb.c         |   1 +
 drivers/i2c/busses/i2c-mlxbf.c                     |   4 +-
 drivers/i2c/busses/i2c-mpc.c                       |   2 +-
 drivers/i2c/busses/i2c-mt65xx.c                    |   2 +-
 drivers/i2c/busses/i2c-stm32f7.c                   |   9 +-
 drivers/i2c/i2c-core-base.c                        |  85 +--
 drivers/i2c/i2c-core-of.c                          |   5 -
 drivers/i3c/master.c                               |  19 +-
 drivers/iio/accel/bmc150-accel-core.c              |   2 +
 drivers/iio/accel/kxsd9.c                          |   5 +-
 drivers/iio/accel/mma8452.c                        |   2 +
 drivers/iio/adc/lpc32xx_adc.c                      |   4 +-
 drivers/iio/adc/spear_adc.c                        |   3 +-
 drivers/iio/adc/ti-ads124s08.c                     |   3 +-
 drivers/iio/adc/xilinx-ams.c                       |   5 +
 drivers/iio/chemical/scd30_core.c                  |  19 +-
 .../iio/common/inv_sensors/inv_sensors_timestamp.c |  26 +-
 drivers/iio/common/st_sensors/st_sensors_core.c    |  23 +-
 drivers/iio/gyro/bmg160_core.c                     |  16 +-
 drivers/iio/imu/adis_trigger.c                     |   2 +-
 drivers/iio/imu/bmi160/bmi160_core.c               |   3 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c  |   4 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c |  44 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h |   3 +
 drivers/iio/imu/inv_icm42600/inv_icm42600_core.c   |   1 +
 drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c   |   4 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c         |   2 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c       |  21 +-
 drivers/iio/industrialio-event.c                   |   5 +-
 drivers/iio/light/al3010.c                         |   2 +-
 drivers/iio/light/gp2ap002.c                       |   2 +-
 drivers/iio/light/opt3001.c                        |   6 +-
 drivers/iio/light/si1133.c                         |  14 +-
 drivers/iio/light/tcs3472.c                        |  38 +-
 drivers/iio/light/tsl2591.c                        |   6 +-
 drivers/iio/light/veml6030.c                       |   8 +-
 drivers/iio/magnetometer/ak8975.c                  |  15 +
 drivers/iio/orientation/hid-sensor-rotation.c      |  40 +-
 drivers/iio/pressure/mpl115.c                      |   8 +-
 drivers/iio/temperature/ltc2983.c                  |   5 +-
 drivers/infiniband/core/cm.c                       |  13 +-
 drivers/infiniband/core/counters.c                 |   2 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |   8 +-
 drivers/infiniband/hw/hns/hns_roce_main.c          |   2 +-
 drivers/infiniband/hw/irdma/verbs.c                |  19 +-
 drivers/infiniband/hw/irdma/verbs.h                |   1 -
 drivers/infiniband/hw/mlx4/mlx4_ib.h               |   1 +
 drivers/infiniband/hw/mlx4/mr.c                    |   9 +-
 drivers/infiniband/hw/mlx4/sysfs.c                 |  45 +-
 drivers/infiniband/hw/mlx5/devx.c                  |  30 +-
 drivers/infiniband/hw/mlx5/main.c                  |  17 +-
 drivers/infiniband/hw/mlx5/mr.c                    |  17 +-
 drivers/infiniband/hw/mlx5/qp.c                    |  12 +-
 drivers/infiniband/sw/rxe/rxe_mmap.c               |  19 +-
 drivers/infiniband/sw/rxe/rxe_resp.c               |  33 +-
 drivers/infiniband/sw/siw/siw_qp_rx.c              |   9 +
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             |   5 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |   5 +-
 drivers/input/joystick/iforce/iforce-packets.c     |  18 +-
 drivers/input/joystick/maplecontrol.c              |   3 +-
 drivers/input/keyboard/maple_keyb.c                |   4 +-
 drivers/input/misc/ims-pcu.c                       | 117 ++++-
 drivers/input/mouse/elan_i2c_core.c                |  36 +-
 drivers/input/mouse/maplemouse.c                   |   9 +-
 drivers/input/rmi4/rmi_bus.c                       |   4 +-
 drivers/input/rmi4/rmi_f30.c                       |   2 +-
 drivers/input/rmi4/rmi_f3a.c                       |   2 +-
 drivers/input/touchscreen/goodix.c                 |   3 +-
 drivers/input/touchscreen/mms114.c                 |  26 +-
 drivers/input/touchscreen/touchwin.c               |  15 +-
 drivers/iommu/amd/amd_iommu_types.h                |  11 +-
 drivers/irqchip/irq-crossbar.c                     |  10 +-
 drivers/irqchip/irq-gic-v3-its.c                   |   6 +-
 drivers/irqchip/irq-ts4800.c                       |  10 +
 drivers/leds/uleds.c                               |   3 +-
 drivers/mailbox/mtk-adsp-mailbox.c                 |   9 +-
 drivers/md/dm-bufio.c                              |   4 +-
 drivers/md/dm-era-target.c                         |  10 +-
 drivers/md/dm-integrity.c                          |   3 -
 drivers/md/dm-ioctl.c                              |   9 +-
 drivers/md/dm-log.c                                |   3 +
 drivers/md/dm-stats.c                              |  10 +-
 drivers/md/dm-thin-metadata.c                      |  67 +--
 drivers/md/dm-verity-loadpin.c                     |   2 +-
 drivers/md/dm-verity-target.c                      |   2 +-
 drivers/md/raid1.c                                 |   6 +
 drivers/md/raid10.c                                |   1 +
 .../media/platform/mediatek/jpeg/mtk_jpeg_core.c   |   3 +-
 .../media/platform/nxp/imx8-isi/imx8-isi-core.c    |  24 +-
 drivers/media/platform/qcom/venus/helpers.c        |   4 +-
 .../media/platform/qcom/venus/hfi_platform_v4.c    |  20 +-
 .../media/platform/qcom/venus/hfi_platform_v6.c    |  16 +-
 drivers/media/platform/rockchip/rga/rga-hw.c       |   2 +-
 drivers/media/platform/rockchip/rga/rga-hw.h       |   2 +-
 drivers/media/usb/uvc/uvc_video.c                  | 122 +++--
 drivers/media/v4l2-core/v4l2-common.c              |   1 +
 drivers/memstick/core/ms_block.c                   |   4 +
 drivers/mfd/cros_ec_dev.c                          |   3 +-
 drivers/mfd/cs42l43.c                              |   2 +-
 drivers/mfd/sm501.c                                |   4 +-
 drivers/mfd/tps6586x.c                             |   2 +-
 drivers/mmc/host/vub300.c                          |  26 +-
 drivers/mtd/devices/mchp23k256.c                   |   2 +-
 drivers/mtd/devices/slram.c                        |  22 +-
 drivers/mtd/maps/vmu-flash.c                       |   1 +
 drivers/mtd/nand/onenand/onenand_samsung.c         |   7 +-
 drivers/mtd/nand/raw/fsl_ifc_nand.c                |   9 +-
 drivers/mtd/nand/raw/lpc32xx_mlc.c                 |  12 +-
 drivers/mtd/nand/raw/lpc32xx_slc.c                 |  12 +-
 drivers/mtd/nand/raw/nand_base.c                   |   2 +-
 drivers/mtd/nand/raw/pl35x-nand-controller.c       |   2 +-
 drivers/mtd/spi-nor/Kconfig                        |   1 -
 drivers/mtd/spi-nor/swp.c                          |  11 +-
 drivers/net/amt.c                                  |   6 +-
 drivers/net/bonding/bond_3ad.c                     |   1 +
 drivers/net/bonding/bond_main.c                    | 133 ++---
 drivers/net/bonding/bond_netlink.c                 |  16 +-
 drivers/net/can/usb/esd_usb.c                      |   5 +-
 drivers/net/dsa/sja1105/sja1105_ptp.c              |   2 +-
 drivers/net/ethernet/amazon/ena/ena_netdev.c       |  23 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c    |   3 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |  23 +-
 .../ethernet/cavium/liquidio/cn23xx_pf_device.c    |  18 +-
 drivers/net/ethernet/chelsio/cxgb4/t4_hw.c         |   8 -
 .../net/ethernet/freescale/dpaa2/dpaa2-switch.c    |   2 +-
 drivers/net/ethernet/freescale/enetc/enetc.c       |   7 +
 drivers/net/ethernet/freescale/fman/fman.c         |   4 +-
 drivers/net/ethernet/freescale/gianfar.c           |  16 +-
 drivers/net/ethernet/intel/i40e/i40e_debug.h       |   2 +-
 drivers/net/ethernet/intel/ice/ice_common.c        |   1 -
 drivers/net/ethernet/intel/ice/ice_ethtool.c       |  12 +-
 drivers/net/ethernet/intel/ice/ice_main.c          |  16 +-
 drivers/net/ethernet/intel/ice/ice_vf_lib.c        |   2 +-
 drivers/net/ethernet/marvell/mvneta.c              |   3 +
 drivers/net/ethernet/marvell/octeontx2/af/mcs.c    |   6 +-
 .../ethernet/marvell/octeontx2/af/rvu_debugfs.c    |   3 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_nix.c    |   4 +-
 .../ethernet/marvell/octeontx2/nic/cn10k_macsec.c  |  10 +-
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |  44 +-
 .../net/ethernet/marvell/prestera/prestera_main.c  |   2 +-
 drivers/net/ethernet/mediatek/mtk_ppe.c            |   4 +-
 .../ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c |  29 +-
 .../ethernet/mellanox/mlx5/core/en_accel/macsec.c  |  47 +-
 .../net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c  |   8 +-
 .../net/ethernet/mellanox/mlx5/core/lib/hv_vhca.h  |   6 +-
 .../net/ethernet/mellanox/mlx5/core/lib/port_tun.c |   3 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |  12 +-
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c     |   2 +-
 .../net/ethernet/mellanox/mlxsw/spectrum_router.c  |   1 +
 drivers/net/ethernet/microchip/lan743x_main.c      |   2 +-
 .../ethernet/microchip/lan966x/lan966x_vcap_impl.c |   5 +-
 .../ethernet/microchip/sparx5/sparx5_switchdev.c   |   4 +-
 .../ethernet/microchip/sparx5/sparx5_vcap_impl.c   |   5 +-
 drivers/net/ethernet/microchip/vcap/vcap_api.c     |  72 +--
 drivers/net/ethernet/microchip/vcap/vcap_api.h     |   3 +-
 .../net/ethernet/microchip/vcap/vcap_api_debugfs.c |   8 +-
 .../microchip/vcap/vcap_api_debugfs_kunit.c        |   3 +-
 .../net/ethernet/microchip/vcap/vcap_api_kunit.c   |   3 +-
 .../net/ethernet/microchip/vcap/vcap_api_private.h |   3 +
 drivers/net/ethernet/microsoft/mana/gdma_main.c    |   2 +
 drivers/net/ethernet/microsoft/mana/mana_en.c      |   3 +-
 .../net/ethernet/pensando/ionic/ionic_ethtool.c    |  11 +-
 drivers/net/ethernet/qlogic/qede/qede_fp.c         |   9 +-
 .../net/ethernet/qualcomm/rmnet/rmnet_handlers.c   |   5 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h    |   1 +
 .../net/ethernet/qualcomm/rmnet/rmnet_map_data.c   |  78 +--
 drivers/net/ethernet/sun/sungem.c                  |  13 +-
 drivers/net/ethernet/sunplus/spl2sw_phy.c          |   6 +-
 drivers/net/ieee802154/ca8210.c                    |   9 +-
 drivers/net/macsec.c                               |   9 +-
 drivers/net/phy/sfp.c                              |   1 +
 drivers/net/team/Makefile                          |   1 +
 drivers/net/team/{team.c => team_core.c}           |  68 ++-
 drivers/net/thunderbolt/main.c                     |   8 +-
 drivers/net/usb/gl620a.c                           |   6 +-
 drivers/net/usb/kalmia.c                           |   8 +
 drivers/net/usb/lan78xx.c                          | 318 ++++++------
 drivers/net/usb/net1080.c                          |   2 +-
 drivers/net/veth.c                                 |   2 +
 drivers/net/virtio_net.c                           |  55 +-
 drivers/net/vxlan/vxlan_core.c                     |   8 +-
 drivers/net/wan/ixp4xx_hss.c                       |   4 +-
 drivers/net/wireless/ath/ath9k/xmit.c              |   5 +
 drivers/net/wireless/ath/wcn36xx/smd.c             |  13 +
 drivers/net/wireless/cisco/airo.c                  |   4 +-
 drivers/net/wireless/intersil/hostap/hostap_main.c |   1 +
 drivers/net/wireless/marvell/mwifiex/join.c        |   1 -
 drivers/net/wireless/mediatek/mt76/mac80211.c      |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mac.c    |  10 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mac.c    |   5 +-
 drivers/net/wireless/ralink/rt2x00/rt2x00dev.c     |  12 +-
 drivers/net/wireless/realtek/rtw88/pci.c           |   5 +
 drivers/net/wireless/realtek/rtw89/fw.c            |   2 +-
 drivers/net/wwan/iosm/iosm_ipc_mux_codec.c         |  40 +-
 drivers/net/wwan/t7xx/t7xx_hif_cldma.c             |   3 +
 drivers/net/wwan/t7xx/t7xx_port_wwan.c             |   2 +
 drivers/ntb/hw/epf/ntb_hw_epf.c                    |  89 ++--
 drivers/nvdimm/btt.c                               |  14 +-
 drivers/nvdimm/nd.h                                |  11 +-
 drivers/nvdimm/region_devs.c                       |  66 +--
 drivers/nvme/host/core.c                           |   2 +-
 drivers/nvme/host/multipath.c                      |   6 +
 drivers/nvme/target/auth.c                         |  20 +-
 drivers/nvme/target/fabrics-cmd-auth.c             |  60 ++-
 drivers/nvme/target/fabrics-cmd.c                  |  15 +-
 drivers/nvme/target/nvmet.h                        |   8 +-
 drivers/nvme/target/rdma.c                         |  18 +-
 drivers/nvme/target/tcp.c                          |   5 +-
 drivers/of/cpu.c                                   |   2 +-
 drivers/of/dynamic.c                               |   1 -
 drivers/of/platform.c                              |   5 -
 drivers/opp/of.c                                   |   3 +-
 drivers/pci/Makefile                               |   2 +-
 drivers/pci/controller/dwc/pci-imx6.c              |   4 +-
 drivers/pci/controller/dwc/pci-meson.c             |   4 +-
 drivers/pci/controller/dwc/pcie-designware-host.c  |   2 +-
 .../pci/controller/mobiveil/pcie-mobiveil-host.c   |   8 +-
 drivers/pci/controller/pci-host-common.c           |   4 +
 drivers/pci/controller/pci-loongson.c              |  31 +-
 drivers/pci/controller/pcie-altera-msi.c           |   2 +-
 drivers/pci/controller/pcie-altera.c               |  32 +-
 drivers/pci/controller/pcie-iproc-bcma.c           |   2 +-
 drivers/pci/controller/pcie-iproc-platform.c       |   2 +-
 drivers/pci/controller/pcie-iproc.c                |   1 -
 drivers/pci/controller/pcie-iproc.h                |   2 -
 drivers/pci/controller/pcie-mediatek-gen3.c        |   4 +-
 drivers/pci/controller/pcie-mediatek.c             | 132 +++--
 drivers/pci/controller/pcie-rcar-host.c            |   1 -
 drivers/pci/controller/pcie-xilinx-nwl.c           |   2 +-
 drivers/pci/endpoint/functions/pci-epf-ntb.c       |  21 +-
 drivers/pci/endpoint/functions/pci-epf-vntb.c      |   9 +-
 drivers/pci/msi/msi.c                              |   4 +-
 drivers/pci/pci-sysfs.c                            |  14 +-
 drivers/pci/pci.c                                  | 139 -----
 drivers/pci/pci.h                                  |   4 +
 drivers/pci/quirks.c                               |  51 +-
 drivers/pci/rebar.c                                | 218 ++++++++
 drivers/pci/rom.c                                  | 149 +++++-
 drivers/pci/setup-bus.c                            | 104 ++--
 drivers/pci/setup-res.c                            |  53 --
 drivers/phy/phy-can-transceiver.c                  |   3 +
 drivers/pinctrl/cirrus/pinctrl-cs42l43.c           |   2 +-
 drivers/pinctrl/mediatek/pinctrl-mt8167.c          |   2 +-
 drivers/pinctrl/mediatek/pinctrl-mt8516.c          |   2 +-
 drivers/pinctrl/meson/pinctrl-meson.c              |   2 +-
 drivers/pinctrl/sunxi/pinctrl-sunxi.c              |   2 +-
 drivers/platform/x86/amd/pmc/pmc-quirks.c          |  39 ++
 drivers/platform/x86/amd/pmc/pmc.c                 |  60 ++-
 drivers/platform/x86/amd/pmc/pmc.h                 |   1 +
 drivers/platform/x86/xo15-ebook.c                  |   7 +-
 drivers/pmdomain/imx/imx8m-blk-ctrl.c              |  46 +-
 drivers/power/supply/charger-manager.c             |   6 +-
 drivers/power/supply/cpcap-battery.c               |  11 +-
 drivers/power/supply/power_supply_core.c           |  11 +-
 drivers/pwm/pwm-imx27.c                            |   8 +-
 drivers/rapidio/devices/tsi721.c                   |   3 +-
 drivers/regulator/core.c                           |   4 +-
 drivers/regulator/ltc3676.c                        |  10 +-
 drivers/regulator/scmi-regulator.c                 |   6 +-
 drivers/remoteproc/qcom_common.c                   |  14 +-
 drivers/reset/reset-imx7.c                         |   6 +
 drivers/reset/reset-sunxi.c                        |   4 +-
 drivers/rpmsg/qcom_glink_native.c                  |   2 -
 drivers/rpmsg/rpmsg_core.c                         |  43 +-
 drivers/rpmsg/virtio_rpmsg_bus.c                   |   1 -
 drivers/rtc/rtc-abx80x.c                           |   3 +-
 drivers/rtc/rtc-cmos.c                             |   6 +
 drivers/rtc/rtc-ds1307.c                           |  30 +-
 drivers/rtc/rtc-mpfs.c                             |   2 +-
 drivers/rtc/rtc-msc313.c                           |   4 +-
 drivers/s390/char/monwriter.c                      |   3 +
 drivers/s390/crypto/zcrypt_cex2a.c                 |   0
 drivers/s390/crypto/zcrypt_cex2a.h                 |   0
 drivers/s390/crypto/zcrypt_cex2c.c                 |   0
 drivers/s390/crypto/zcrypt_cex2c.h                 |   0
 drivers/scsi/elx/efct/efct_hw.c                    |   2 +
 drivers/scsi/elx/efct/efct_unsol.c                 |   1 +
 drivers/scsi/hpsa.c                                |   4 +
 drivers/scsi/lpfc/lpfc_init.c                      |   3 +-
 drivers/scsi/pm8001/pm8001_ctl.c                   |   5 +-
 drivers/scsi/scsi_scan.c                           |   2 +-
 drivers/scsi/scsi_transport_sas.c                  | 101 ++--
 drivers/scsi/sg.c                                  |   7 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |   2 +-
 drivers/slimbus/qcom-ctrl.c                        |   5 +-
 drivers/slimbus/qcom-ngd-ctrl.c                    |  62 +--
 drivers/soc/fsl/qe/qe.c                            |   3 +
 drivers/soc/ti/k3-ringacc.c                        |   4 +-
 drivers/spi/spi-dw.h                               |   1 +
 drivers/spi/spi-ep93xx.c                           |   1 +
 drivers/spi/spi-fsl-lpspi.c                        |  18 +-
 drivers/spi/spi-hisi-kunpeng.c                     |   6 +-
 drivers/spi/spi-meson-spifc.c                      |   1 +
 drivers/spi/spi-rpc-if.c                           |   6 +-
 drivers/spi/spi-sh-msiof.c                         |  10 +-
 drivers/spi/spi-uniphier.c                         |   4 +-
 drivers/spi/spi-xilinx.c                           |  11 +-
 drivers/spi/spi.c                                  |   5 -
 drivers/staging/media/atomisp/pci/atomisp_cmd.c    |   6 +-
 drivers/staging/media/atomisp/pci/sh_css.c         |   6 +-
 drivers/staging/media/ipu3/ipu3-css-params.c       |   8 +-
 drivers/staging/media/sunxi/cedrus/cedrus.c        |   4 +-
 drivers/staging/most/video/video.c                 |   7 +-
 drivers/staging/nvec/nvec.c                        |   4 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |  93 ++--
 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c      |  20 +-
 drivers/staging/rtl8723bs/core/rtw_security.c      |   2 +-
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c     |  23 +-
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c  |   8 +
 drivers/staging/vme_user/vme_fake.c                |   8 +
 drivers/staging/vme_user/vme_tsi148.c              |   8 +
 drivers/staging/vme_user/vme_user.c                |  22 +
 drivers/target/iscsi/iscsi_target_auth.c           |   6 +-
 drivers/target/loopback/tcm_loop.c                 |  64 ---
 drivers/target/target_core_fabric_lib.c            |  89 +++-
 drivers/target/target_core_internal.h              |   3 +-
 drivers/target/target_core_pr.c                    |  12 +-
 drivers/thermal/intel/therm_throt.c                |   7 +-
 drivers/thermal/thermal_hwmon.c                    |   5 +-
 drivers/tty/serial/8250/8250_mid.c                 |  31 +-
 drivers/tty/serial/8250/8250_omap.c                |   3 +-
 drivers/tty/serial/msm_serial.c                    |   3 +-
 drivers/ufs/core/ufshcd.c                          |   2 +-
 drivers/usb/atm/ueagle-atm.c                       |  36 +-
 drivers/usb/cdns3/cdnsp-mem.c                      |   2 +
 drivers/usb/class/cdc-acm.c                        |   3 +
 drivers/usb/common/ulpi.c                          |  23 +-
 drivers/usb/core/quirks.c                          |   6 +
 drivers/usb/dwc3/dwc3-meson-g12a.c                 |  14 +-
 drivers/usb/dwc3/gadget.c                          |  43 +-
 drivers/usb/fotg210/fotg210-hcd.c                  |   6 +-
 drivers/usb/gadget/composite.c                     |   5 +-
 drivers/usb/gadget/function/f_fs.c                 |   5 +-
 drivers/usb/gadget/function/f_printer.c            |   3 +-
 drivers/usb/gadget/function/rndis.c                |  20 +-
 drivers/usb/gadget/udc/core.c                      |  29 +-
 drivers/usb/host/ehci-sched.c                      |  11 +-
 drivers/usb/host/max3421-hcd.c                     |   8 +
 drivers/usb/host/sl811-hcd.c                       |   1 +
 drivers/usb/host/xhci.c                            |  11 +-
 drivers/usb/misc/chaoskey.c                        |   1 -
 drivers/usb/misc/idmouse.c                         |  45 +-
 drivers/usb/misc/iowarrior.c                       |  21 +-
 drivers/usb/misc/ldusb.c                           |  38 +-
 drivers/usb/misc/legousbtower.c                    |  37 +-
 drivers/usb/misc/uss720.c                          |   5 +-
 drivers/usb/mtu3/mtu3_gadget.c                     |   1 +
 drivers/usb/serial/digi_acceleport.c               |  43 +-
 drivers/usb/serial/keyspan_pda.c                   |   2 +-
 drivers/usb/serial/option.c                        |  16 +
 drivers/usb/storage/ene_ub6250.c                   |   3 +-
 drivers/usb/storage/usb.c                          |   2 +-
 drivers/usb/typec/anx7411.c                        |   4 +-
 drivers/usb/typec/class.c                          |   1 +
 drivers/usb/typec/tcpm/tcpci_rt1711h.c             |  13 +-
 drivers/usb/typec/tcpm/tcpm.c                      |   7 +-
 drivers/usb/typec/ucsi/displayport.c               |   7 +-
 drivers/usb/typec/ucsi/ucsi.c                      |  20 +
 drivers/usb/typec/ucsi/ucsi.h                      |   1 +
 drivers/usb/typec/ucsi/ucsi_acpi.c                 |  10 +-
 drivers/usb/typec/ucsi/ucsi_ccg.c                  |   2 +-
 drivers/usb/usbip/vudc.h                           |   1 -
 drivers/usb/usbip/vudc_dev.c                       |   4 +-
 drivers/vdpa/vdpa_user/vduse_dev.c                 |  72 ++-
 drivers/vfio/pci/mlx5/cmd.h                        |  13 +-
 drivers/vfio/pci/vfio_pci_core.c                   |  37 +-
 drivers/vfio/vfio_main.c                           |   3 +-
 drivers/vhost/net.c                                |  15 +-
 drivers/vhost/vdpa.c                               |  29 +-
 drivers/video/fbdev/aty/radeon_base.c              |   1 +
 drivers/video/fbdev/broadsheetfb.c                 |   8 +-
 drivers/video/fbdev/carminefb.c                    |   1 +
 drivers/video/fbdev/core/fbcon.c                   |  14 +-
 drivers/video/fbdev/hecubafb.c                     |   6 +-
 drivers/video/fbdev/i740fb.c                       |   1 +
 drivers/video/fbdev/metronomefb.c                  |   8 +-
 drivers/video/fbdev/nvidia/nvidia.c                |   1 +
 drivers/video/fbdev/s3fb.c                         |   1 +
 drivers/video/fbdev/sm501fb.c                      |  16 +-
 drivers/video/fbdev/sm712.h                        |   2 +-
 drivers/video/fbdev/tdfxfb.c                       |   1 +
 drivers/video/fbdev/tridentfb.c                    |   1 +
 drivers/video/fbdev/uvesafb.c                      |   4 +-
 drivers/video/fbdev/vesafb.c                       |   1 +
 drivers/virtio/virtio_mmio.c                       |  26 +-
 drivers/watchdog/apple_wdt.c                       |   1 +
 drivers/watchdog/sama5d4_wdt.c                     |  48 +-
 drivers/watchdog/sp5100_tco.c                      |   3 +-
 drivers/watchdog/sprd_wdt.c                        |   5 +-
 drivers/watchdog/watchdog_core.c                   |   3 +
 drivers/xen/gntdev.c                               |   8 +-
 drivers/xen/xen-scsiback.c                         |  30 +-
 fs/9p/vfs_inode.c                                  |   9 +
 fs/afs/cell.c                                      |   2 +
 fs/afs/cmservice.c                                 |   2 -
 fs/afs/fs_operation.c                              |   2 +-
 fs/afs/rxrpc.c                                     |  11 +-
 fs/afs/super.c                                     |   3 +-
 fs/afs/vl_list.c                                   |  10 +-
 fs/afs/volume.c                                    |   2 +-
 fs/btrfs/btrfs_inode.h                             |   2 +
 fs/btrfs/extent-tree.c                             |  17 +-
 fs/btrfs/file.c                                    |  12 +-
 fs/btrfs/inode.c                                   | 138 +++--
 fs/btrfs/ordered-data.c                            |  12 +
 fs/btrfs/ordered-data.h                            |   2 +
 fs/btrfs/reflink.c                                 |   5 +-
 fs/btrfs/super.c                                   |   3 +-
 fs/configfs/dir.c                                  |  57 +-
 fs/dlm/midcomms.c                                  |   4 +-
 fs/efs/file.c                                      |  21 +-
 fs/exfat/dir.c                                     |  61 ++-
 fs/exfat/exfat_fs.h                                |   7 +-
 fs/exfat/inode.c                                   |   2 +-
 fs/exfat/namei.c                                   | 331 ++++++------
 fs/ext2/file.c                                     |   9 +-
 fs/ext4/extents.c                                  |   5 +-
 fs/ext4/inode.c                                    |   3 +-
 fs/ext4/ioctl.c                                    |  12 +-
 fs/ext4/move_extent.c                              |  34 +-
 fs/f2fs/checkpoint.c                               |  14 +-
 fs/f2fs/data.c                                     |  29 ++
 fs/f2fs/f2fs.h                                     |   1 +
 fs/f2fs/gc.c                                       |  50 +-
 fs/f2fs/inode.c                                    |  30 +-
 fs/f2fs/segment.c                                  |   8 +
 fs/f2fs/xattr.c                                    |   6 +-
 fs/fs-writeback.c                                  | 133 +++--
 fs/fuse/cuse.c                                     |   4 +-
 fs/fuse/dev.c                                      |   2 +-
 fs/hfs/bfind.c                                     |   2 +-
 fs/hfs/bnode.c                                     |  56 +-
 fs/hfs/brec.c                                      |   2 +-
 fs/hfs/btree.c                                     |   2 +-
 fs/hfs/btree.h                                     |  71 +--
 fs/hfs/hfs_fs.h                                    |  88 ++--
 fs/hfs/inode.c                                     |   3 +-
 fs/hfsplus/bfind.c                                 |   2 +-
 fs/hfsplus/bnode.c                                 |  62 +--
 fs/hfsplus/brec.c                                  |   2 +-
 fs/hfsplus/btree.c                                 |   2 +-
 fs/hfsplus/hfsplus_fs.h                            |  40 +-
 fs/isofs/rock.c                                    |  11 +
 fs/jbd2/journal.c                                  |   2 +
 fs/lockd/svcsubs.c                                 |   4 +-
 fs/minix/minix.h                                   |   2 +-
 fs/namei.c                                         |   4 +
 fs/nfs/callback_proc.c                             |   9 +-
 fs/nfs/dir.c                                       |   2 +
 fs/nfs/filelayout/filelayout.c                     |   2 +
 fs/nfs/flexfilelayout/flexfilelayout.c             |  33 ++
 fs/nfs/flexfilelayout/flexfilelayout.h             |  16 +
 fs/nfs/pnfs.c                                      |   4 +-
 fs/nfs/read.c                                      |  25 +-
 fs/nfsd/nfs4layouts.c                              |   4 +-
 fs/nfsd/nfs4recover.c                              | 120 ++---
 fs/nfsd/nfs4state.c                                |  22 +-
 fs/nfsd/vfs.c                                      |  42 +-
 fs/nilfs2/segment.c                                |  22 +
 fs/nilfs2/super.c                                  |   2 -
 fs/ntfs3/attrib.c                                  |  14 +
 fs/ntfs3/dir.c                                     |   2 +-
 fs/ntfs3/file.c                                    |  48 +-
 fs/ntfs3/frecord.c                                 |  51 ++
 fs/ntfs3/fslog.c                                   | 131 ++++-
 fs/ntfs3/index.c                                   |  45 +-
 fs/ntfs3/inode.c                                   |   8 +
 fs/ntfs3/lznt.c                                    |   2 +-
 fs/ntfs3/namei.c                                   |   2 +-
 fs/ntfs3/ntfs_fs.h                                 |   5 +-
 fs/ntfs3/run.c                                     |   9 +-
 fs/ocfs2/alloc.c                                   |   2 +-
 fs/ocfs2/aops.c                                    |  13 +-
 fs/ocfs2/buffer_head_io.c                          |   7 +-
 fs/ocfs2/dlm/dlmdebug.c                            |  16 +-
 fs/ocfs2/dlmglue.c                                 |  17 +
 fs/ocfs2/inode.c                                   | 150 +++++-
 fs/ocfs2/journal.c                                 |  13 +-
 fs/ocfs2/journal.h                                 |   3 +
 fs/ocfs2/move_extents.c                            |   4 +-
 fs/ocfs2/ocfs2.h                                   |   2 -
 fs/ocfs2/quota_local.c                             |   2 +-
 fs/ocfs2/stack_user.c                              |  10 +-
 fs/ocfs2/super.c                                   |   2 -
 fs/ocfs2/sysfile.c                                 |   9 +-
 fs/orangefs/dir.c                                  |   7 +-
 fs/proc/array.c                                    |  15 +-
 fs/proc/base.c                                     | 184 +++----
 fs/proc/fd.c                                       |  31 +-
 fs/proc/generic.c                                  |   9 +-
 fs/proc/internal.h                                 |   6 +-
 fs/proc/namespaces.c                               |  16 +-
 fs/proc/proc_net.c                                 |   2 +-
 fs/smb/client/cifs_swn.c                           | 329 +++++++++---
 fs/smb/client/cifsacl.c                            |   2 +-
 fs/smb/client/cifsglob.h                           |  19 +-
 fs/smb/client/connect.c                            |   3 +
 fs/smb/client/inode.c                              |  30 +-
 fs/smb/client/ioctl.c                              |  12 +-
 fs/smb/client/misc.c                               |   8 +
 fs/smb/client/smb2misc.c                           |  52 +-
 fs/smb/client/smb2ops.c                            |  56 +-
 fs/smb/client/smb2pdu.c                            |  22 +-
 fs/smb/client/trace.h                              |   2 +
 fs/smb/common/cifsglob.h                           |  30 ++
 fs/smb/server/connection.c                         | 101 +++-
 fs/smb/server/connection.h                         |   6 +
 fs/smb/server/oplock.c                             |  13 +-
 fs/smb/server/server.c                             |  12 +
 fs/smb/server/smb2pdu.c                            | 146 ++++--
 fs/smb/server/smb_common.h                         |  14 +-
 fs/smb/server/smbacl.c                             |   7 +-
 fs/smb/server/vfs.c                                |  29 +-
 fs/smb/server/vfs_cache.c                          | 119 ++++-
 fs/smb/server/vfs_cache.h                          |   3 +
 fs/sysfs/file.c                                    |   4 +
 fs/udf/balloc.c                                    |   5 +-
 fs/udf/super.c                                     |  11 +-
 fs/userfaultfd.c                                   |  14 +-
 fs/xfs/libxfs/xfs_defer.c                          |  22 +-
 fs/xfs/libxfs/xfs_defer.h                          |  14 +
 fs/xfs/libxfs/xfs_log_recover.h                    |   4 +-
 fs/xfs/xfs_attr_item.c                             | 115 ++--
 fs/xfs/xfs_bmap_item.c                             |  92 ++--
 fs/xfs/xfs_dquot.c                                 |  16 +-
 fs/xfs/xfs_extfree_item.c                          | 117 ++---
 fs/xfs/xfs_log_recover.c                           |  52 +-
 fs/xfs/xfs_refcount_item.c                         | 127 ++---
 fs/xfs/xfs_reflink.c                               |  36 ++
 fs/xfs/xfs_rmap_item.c                             | 151 +++---
 fs/xfs/xfs_trans.h                                 |   4 -
 include/acpi/acpi_bus.h                            |   2 +
 include/asm-generic/bitops/lock.h                  |  22 +-
 include/crypto/drbg.h                              |  18 +-
 include/dt-bindings/power/fsl,imx93-power.h        |   1 +
 include/linux/audit.h                              |   8 +
 include/linux/backing-dev-defs.h                   |   4 +
 include/linux/bitops.h                             |   2 +
 include/linux/bpf.h                                |   3 +
 include/linux/bpf_local_storage.h                  |   3 -
 include/linux/cpufreq.h                            |   2 +-
 include/linux/damon.h                              |   8 +-
 include/linux/device.h                             |   5 +-
 include/linux/etherdevice.h                        |   3 +-
 include/linux/f2fs_fs.h                            |   1 +
 include/linux/filter.h                             |  15 +-
 include/linux/fs.h                                 |   5 +
 include/linux/fwnode.h                             |   2 +
 include/linux/glob.h                               |   1 +
 include/linux/hid-sensor-hub.h                     |  25 +
 include/linux/hid.h                                |  29 ++
 include/linux/host1x.h                             |   7 +
 include/linux/if_ether.h                           |   3 +-
 include/linux/iio/common/inv_sensors_timestamp.h   |   3 +-
 include/linux/inetdevice.h                         |   5 +
 include/linux/jiffies.h                            |  13 +
 include/linux/netdev_features.h                    |  25 +
 include/linux/netdevice.h                          |   7 +-
 include/linux/nfs_page.h                           |   1 +
 include/linux/pci.h                                |   4 +-
 include/linux/rpmsg.h                              |   4 -
 include/linux/seqlock.h                            | 110 ++++
 include/linux/sunrpc/clnt.h                        |   1 +
 include/linux/sunrpc/xprt.h                        |   2 +
 include/linux/vfio_pci_core.h                      |  15 +-
 include/linux/vmalloc.h                            |   4 +-
 include/linux/writeback.h                          |   2 +
 include/net/addrconf.h                             |  10 +-
 include/net/bluetooth/hci.h                        |  21 +-
 include/net/bluetooth/hci_core.h                   |  39 +-
 include/net/bluetooth/l2cap.h                      |  11 +-
 include/net/bonding.h                              |   1 +
 include/net/fib_rules.h                            |   5 +
 include/net/gue.h                                  |   2 +-
 include/net/ip_fib.h                               |   7 +-
 include/net/ip_vs.h                                |   3 +-
 include/net/netfilter/nf_conntrack_extend.h        |  12 -
 include/net/netfilter/nf_queue.h                   |   1 +
 include/net/rtnetlink.h                            |   2 +
 include/net/sctp/sctp.h                            |   3 +-
 include/net/sock.h                                 |   2 +-
 include/net/tc_act/tc_pedit.h                      |  18 +-
 include/net/xfrm.h                                 |  15 +-
 include/uapi/linux/bpf.h                           |   1 +
 io_uring/io-wq.c                                   |   2 +-
 kernel/audit.c                                     |  85 ++-
 kernel/bpf/bpf_lsm.c                               |  34 +-
 kernel/bpf/cgroup.c                                | 110 ++--
 kernel/bpf/core.c                                  |  70 ++-
 kernel/bpf/devmap.c                                |  19 +
 kernel/bpf/dispatcher.c                            |   2 +-
 kernel/bpf/hashtab.c                               |  21 +-
 kernel/bpf/helpers.c                               |  12 +-
 kernel/bpf/inode.c                                 |  13 +-
 kernel/bpf/lpm_trie.c                              |  10 +-
 kernel/bpf/syscall.c                               |   5 +-
 kernel/bpf/verifier.c                              |   3 +-
 kernel/cgroup/cpuset.c                             |   7 +-
 kernel/cpu.c                                       |  20 +-
 kernel/events/core.c                               |  19 +-
 kernel/fork.c                                      |   9 +-
 kernel/module/decompress.c                         |   2 +
 kernel/sched/core.c                                |   1 +
 kernel/sched/fair.c                                |  25 +-
 kernel/sched/features.h                            |   8 +
 kernel/time/posix-cpu-timers.c                     |   3 +-
 kernel/time/time.c                                 |   2 +-
 kernel/trace/bpf_trace.c                           |  11 +-
 kernel/trace/ring_buffer.c                         |   3 +-
 kernel/trace/trace_eprobe.c                        |   2 +-
 kernel/trace/trace_events_filter.c                 |   6 +-
 kernel/trace/trace_events_hist.c                   |  41 +-
 kernel/trace/trace_osnoise.c                       |   4 +-
 kernel/trace/trace_probe.c                         |   3 +-
 kernel/trace/trace_probe.h                         |   2 +-
 kernel/workqueue.c                                 |   2 +-
 lib/debugobjects.c                                 |  17 +
 lib/glob.c                                         |  31 +-
 lib/test_meminit.c                                 |   2 +-
 mm/backing-dev.c                                   |   5 +
 mm/damon/core.c                                    |   2 +-
 mm/damon/ops-common.c                              |   1 +
 mm/damon/sysfs-schemes.c                           |  17 +-
 mm/filemap.c                                       |   2 +-
 mm/madvise.c                                       |   3 +-
 mm/mincore.c                                       |   3 +-
 mm/mm_init.c                                       |  13 +-
 mm/shrinker_debug.c                                |  30 +-
 mm/slab.h                                          |  17 +-
 mm/vmscan.c                                        |   6 +-
 net/6lowpan/nhc.c                                  |   2 +-
 net/9p/client.c                                    |   2 +
 net/9p/trans_rdma.c                                |  19 +-
 net/atm/common.c                                   |   2 +
 net/batman-adv/distributed-arp-table.c             |  30 +-
 net/batman-adv/fragmentation.c                     |   8 +-
 net/batman-adv/gateway_client.c                    |   3 +-
 net/batman-adv/main.c                              |  13 +-
 net/batman-adv/routing.c                           |   3 +-
 net/batman-adv/soft-interface.c                    |  17 +-
 net/batman-adv/soft-interface.h                    |   2 +
 net/batman-adv/translation-table.c                 |   5 +-
 net/bluetooth/6lowpan.c                            |  74 +--
 net/bluetooth/af_bluetooth.c                       |  17 +-
 net/bluetooth/bnep/core.c                          |  27 +-
 net/bluetooth/hci_codec.c                          |   2 +-
 net/bluetooth/hci_conn.c                           |  56 +-
 net/bluetooth/hci_core.c                           |  83 ++-
 net/bluetooth/hci_event.c                          |  29 +-
 net/bluetooth/hci_sync.c                           | 197 +++++--
 net/bluetooth/iso.c                                |  20 +-
 net/bluetooth/l2cap_core.c                         | 159 ++++--
 net/bluetooth/l2cap_sock.c                         | 107 ++--
 net/bluetooth/mgmt.c                               |   8 +-
 net/bluetooth/msft.c                               |   2 +-
 net/bluetooth/rfcomm/tty.c                         |   4 +-
 net/bluetooth/sco.c                                |  62 ++-
 net/bluetooth/smp.c                                |  27 +-
 net/bridge/br_cfm.c                                |   6 +
 net/bridge/br_cfm_netlink.c                        |   4 +-
 net/bridge/br_if.c                                 |   3 +
 net/bridge/br_stp.c                                |   3 +-
 net/bridge/netfilter/ebtables.c                    |  22 +-
 net/bridge/netfilter/nft_meta_bridge.c             |   4 +-
 net/can/bcm.c                                      | 127 ++++-
 net/can/isotp.c                                    |   9 +-
 net/core/dev.c                                     |  88 ++++
 net/core/fib_rules.c                               |   6 +-
 net/core/filter.c                                  |  28 +-
 net/core/flow_dissector.c                          |  12 +-
 net/core/lwt_bpf.c                                 |  12 +
 net/core/rtnetlink.c                               |   8 +
 net/core/skbuff.c                                  |  23 +-
 net/devlink/rate.c                                 |  10 +-
 net/ethernet/eth.c                                 |   9 +-
 net/handshake/genl.c                               |   2 +-
 net/ieee802154/core.c                              |   2 +-
 net/ieee802154/header_ops.c                        |   9 +-
 net/ieee802154/ieee802154.h                        |  17 +
 net/ieee802154/netlink.c                           |  36 +-
 net/ife/ife.c                                      |   2 +-
 net/ipv4/esp4_offload.c                            |   2 +-
 net/ipv4/igmp.c                                    |  15 +-
 net/ipv4/ip_gre.c                                  |   9 +-
 net/ipv4/ip_vti.c                                  |   3 +
 net/ipv4/ipip.c                                    |   3 +
 net/ipv4/netfilter/nf_reject_ipv4.c                |   2 +-
 net/ipv4/sysctl_net_ipv4.c                         |  10 +-
 net/ipv4/tcp_output.c                              |   4 +-
 net/ipv6/addrconf.c                                |  23 +-
 net/ipv6/esp6_offload.c                            |   2 +-
 net/ipv6/ip6_gre.c                                 |   6 +
 net/ipv6/ip6_vti.c                                 |   3 +
 net/ipv6/mcast.c                                   | 165 +++---
 net/ipv6/netfilter.c                               |   4 +-
 net/ipv6/netfilter/ip6t_ah.c                       |   5 +
 net/ipv6/netfilter/ip6t_hbh.c                      |   1 +
 net/ipv6/netfilter/ip6t_rt.c                       |   3 +-
 net/ipv6/netfilter/nf_conntrack_reasm.c            |   3 +-
 net/ipv6/route.c                                   |   9 +-
 net/ipv6/seg6.c                                    |   3 +
 net/ipv6/sit.c                                     |   3 +
 net/kcm/kcmsock.c                                  |   8 +-
 net/key/af_key.c                                   |   1 +
 net/llc/af_llc.c                                   |   1 +
 net/llc/llc_conn.c                                 |   1 -
 net/mac80211/main.c                                |   3 +-
 net/mac80211/tx.c                                  |  17 +-
 net/mac802154/iface.c                              |   6 +-
 net/netfilter/ipset/ip_set_core.c                  |  12 +-
 net/netfilter/ipset/ip_set_hash_gen.h              |  67 ++-
 net/netfilter/ipvs/ip_vs_app.c                     |  10 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |   4 +-
 net/netfilter/ipvs/ip_vs_core.c                    |  36 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |  18 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  11 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c               |   3 +-
 net/netfilter/ipvs/ip_vs_xmit.c                    |   6 +-
 net/netfilter/nf_conncount.c                       |  23 +-
 net/netfilter/nf_conntrack_core.c                  |  79 +--
 net/netfilter/nf_conntrack_ecache.c                |   2 +-
 net/netfilter/nf_conntrack_extend.c                |  32 +-
 net/netfilter/nf_conntrack_irc.c                   |   6 +-
 net/netfilter/nf_conntrack_netlink.c               |   2 +-
 net/netfilter/nf_conntrack_seqadj.c                |   2 +
 net/netfilter/nf_nat_core.c                        |  10 +
 net/netfilter/nf_nat_sip.c                         |  11 +
 net/netfilter/nf_queue.c                           |  14 +
 net/netfilter/nfnetlink_cthelper.c                 |   4 +-
 net/netfilter/nfnetlink_osf.c                      |   6 +-
 net/netfilter/nfnetlink_queue.c                    |   3 +
 net/netfilter/nft_compat.c                         |  24 +-
 net/netfilter/nft_log.c                            |  58 +--
 net/netfilter/nft_synproxy.c                       |   9 +-
 net/netfilter/xt_AUDIT.c                           |  58 +--
 net/netfilter/xt_cluster.c                         |   2 +-
 net/netfilter/xt_connmark.c                        |  14 +-
 net/netfilter/xt_nat.c                             |   9 +
 net/netfilter/xt_rateest.c                         |   2 +-
 net/netfilter/xt_u32.c                             |  12 +-
 net/openvswitch/conntrack.c                        |   2 +-
 net/openvswitch/flow_netlink.c                     | 201 +++++--
 net/phonet/af_phonet.c                             |   5 +-
 net/psample/psample.c                              |   6 +-
 net/qrtr/af_qrtr.c                                 |   2 +-
 net/rxrpc/recvmsg.c                                |   5 +-
 net/sched/act_api.c                                |  13 +-
 net/sched/act_bpf.c                                |   2 +-
 net/sched/act_ct.c                                 |   7 +-
 net/sched/act_pedit.c                              |  13 +-
 net/sched/cls_api.c                                |  25 +-
 net/sched/cls_bpf.c                                |  10 +-
 net/sched/cls_flow.c                               |  12 +-
 net/sched/sch_cake.c                               |   5 +-
 net/sched/sch_codel.c                              |  48 +-
 net/sched/sch_drr.c                                |   8 +-
 net/sched/sch_fq_codel.c                           |  41 +-
 net/sched/sch_hfsc.c                               |  24 +-
 net/sched/sch_hhf.c                                |  27 +
 net/sched/sch_htb.c                                |  14 +-
 net/sched/sch_multiq.c                             |   2 +-
 net/sched/sch_taprio.c                             |   2 +-
 net/sched/sch_teql.c                               | 126 +++--
 net/sctp/diag.c                                    |  67 ++-
 net/sctp/sm_make_chunk.c                           |  10 +-
 net/sctp/sm_statefuns.c                            |  23 +-
 net/sctp/socket.c                                  |  38 +-
 net/smc/smc_cdc.c                                  |  15 +-
 net/socket.c                                       |   2 +-
 net/sunrpc/clnt.c                                  |  19 +-
 net/sunrpc/svcsock.c                               |  10 +
 net/sunrpc/xdr.c                                   |  14 +-
 net/sunrpc/xprt.c                                  |  16 +
 net/sunrpc/xprtrdma/backchannel.c                  |   5 +-
 net/sunrpc/xprtrdma/frwr_ops.c                     |   2 +-
 net/sunrpc/xprtrdma/rpc_rdma.c                     | 172 ++++--
 net/sunrpc/xprtrdma/transport.c                    |  85 ++-
 net/sunrpc/xprtrdma/verbs.c                        | 167 ++++--
 net/sunrpc/xprtrdma/xprt_rdma.h                    |   7 +-
 net/sunrpc/xprtsock.c                              |  16 +-
 net/tipc/bcast.c                                   |  22 +-
 net/tipc/bcast.h                                   |   2 +-
 net/tipc/bearer.c                                  |   1 +
 net/tipc/core.c                                    |   5 +
 net/tipc/discover.c                                |  14 +-
 net/tipc/name_distr.c                              |  13 +-
 net/tipc/netlink.c                                 |  12 +
 net/tipc/node.c                                    |  15 +-
 net/tipc/socket.c                                  |   3 +
 net/tls/tls_sw.c                                   |  11 +
 net/wireless/nl80211.c                             |   2 +-
 net/xfrm/espintcp.c                                |  34 +-
 net/xfrm/xfrm_input.c                              |   6 +-
 net/xfrm/xfrm_interface_core.c                     |   3 +
 net/xfrm/xfrm_policy.c                             |  32 +-
 net/xfrm/xfrm_state.c                              |   2 +-
 net/xfrm/xfrm_user.c                               |  20 +-
 samples/trace_events/trace-events-sample.c         |   4 +
 scripts/kconfig/conf.c                             |   6 +-
 security/apparmor/apparmorfs.c                     |   9 +-
 security/apparmor/domain.c                         |  58 ++-
 security/apparmor/label.c                          |   2 +-
 security/apparmor/net.c                            |   2 +
 security/apparmor/policy.c                         |   5 +-
 security/apparmor/procattr.c                       |   2 +
 security/integrity/evm/evm_secfs.c                 |  16 +-
 security/keys/keyring.c                            |   2 +-
 security/selinux/hooks.c                           |  61 ++-
 sound/aoa/fabrics/layout.c                         |   6 +
 sound/core/init.c                                  |  11 +-
 sound/core/seq/seq_clientmgr.c                     |   1 +
 sound/core/seq/seq_memory.c                        |   4 +-
 sound/core/seq/seq_midi.c                          |  55 +-
 sound/firewire/isight.c                            |   3 +-
 sound/isa/gus/gus_pcm.c                            |   2 +
 sound/pci/cmipci.c                                 |   6 +
 sound/pci/es1938.c                                 |   2 +
 sound/pci/ice1712/aureon.c                         |   2 +
 sound/pci/ice1712/ice1712.c                        |   8 +
 sound/pci/ice1712/ice1724.c                        |   6 +
 sound/pci/ymfpci/ymfpci_main.c                     |   6 +
 sound/soc/codecs/adau1372.c                        |   5 +
 sound/soc/codecs/aw88261.c                         |  12 +-
 sound/soc/codecs/cs35l56.c                         |  14 +-
 sound/soc/codecs/hdac_hdmi.c                       |   4 +-
 sound/soc/codecs/tlv320aic3x.c                     |  25 +-
 sound/soc/fsl/fsl_asrc_dma.c                       |  20 +
 sound/soc/fsl/fsl_audmix.c                         |   6 +
 sound/soc/mediatek/mt8183/mt8183-afe-pcm.c         |  11 +
 sound/soc/mediatek/mt8192/mt8192-afe-pcm.c         |   9 +
 sound/soc/qcom/qdsp6/q6apm.c                       |   8 +
 sound/soc/sh/rcar/rsnd.h                           |   2 +-
 sound/soc/sof/ipc3-control.c                       |  79 ++-
 sound/soc/sof/ipc4-control.c                       |  11 +-
 sound/soc/sof/topology.c                           |   5 +-
 sound/soc/tegra/tegra210_ahub.c                    |   4 +-
 sound/usb/caiaq/input.c                            |   2 +-
 sound/usb/midi2.c                                  |   5 +
 sound/usb/mixer_quirks.c                           | 101 ++--
 sound/usb/mixer_scarlett.c                         |   4 +-
 sound/usb/mixer_us16x08.c                          | 127 +++--
 sound/virtio/virtio_pcm.c                          |   3 +-
 sound/virtio/virtio_pcm_ops.c                      |   3 +-
 tools/bpf/bpftool/net.c                            |   4 +-
 tools/include/linux/bitops.h                       |   2 +
 tools/include/uapi/linux/bpf.h                     |   1 +
 tools/lib/api/fs/fs.c                              |  19 +-
 tools/lib/bpf/libbpf.c                             |   9 +-
 tools/lib/bpf/strset.c                             |  62 ++-
 tools/lib/bpf/usdt.c                               |  16 +-
 tools/lib/symbol/kallsyms.c                        |   5 +-
 tools/mm/slabinfo.c                                |   6 +-
 tools/perf/builtin-annotate.c                      |   3 +-
 tools/perf/builtin-c2c.c                           |  20 +-
 tools/perf/builtin-diff.c                          |   3 +-
 tools/perf/builtin-report.c                        |   3 +-
 tools/perf/builtin-sched.c                         |  69 ++-
 tools/perf/tests/pmu-events.c                      |  24 +-
 tools/perf/trace/beauty/fcntl.c                    |  16 +
 tools/perf/util/bpf-event.c                        |  18 +-
 tools/perf/util/bpf-utils.c                        |  16 +
 tools/perf/util/cpumap.c                           |  28 +-
 tools/perf/util/cs-etm-base.c                      |   4 +-
 tools/perf/util/cs-etm-decoder/cs-etm-decoder.c    |  21 +-
 tools/perf/util/cs-etm.c                           | 522 ++++++++++++-------
 tools/perf/util/cs-etm.h                           |   8 +-
 tools/perf/util/event.c                            |  15 +-
 tools/perf/util/header.c                           |  54 ++
 tools/perf/util/hist.c                             |   7 +-
 .../util/intel-pt-decoder/intel-pt-insn-decoder.c  |  11 +-
 tools/perf/util/machine.c                          |  10 +-
 tools/perf/util/mmap.c                             |  18 +-
 tools/perf/util/pmu.c                              |  10 +-
 tools/perf/util/probe-finder.c                     |   4 +-
 tools/perf/util/symbol-elf.c                       |  48 +-
 tools/perf/util/symbol-minimal.c                   |  11 +-
 tools/perf/util/symbol.c                           |   2 +-
 tools/perf/util/thread.c                           |   5 +
 tools/power/x86/intel-speed-select/isst-daemon.c   |   9 +-
 tools/testing/cxl/test/cxl.c                       |   8 +-
 tools/testing/cxl/test/mem.c                       |   6 +-
 .../selftests/bpf/prog_tests/verifier_log.c        |   1 +
 .../selftests/bpf/progs/bpf_iter_task_vma.c        |   2 +-
 tools/testing/selftests/hid/Makefile               |  10 +-
 tools/testing/selftests/hid/hid_bpf.c              |  70 ++-
 tools/testing/selftests/hid/progs/hid.c            |  94 +++-
 .../testing/selftests/hid/progs/hid_bpf_helpers.h  |  84 ++-
 tools/testing/selftests/mm/compaction_test.c       |   3 +
 tools/testing/selftests/mm/hmm-tests.c             |  63 ++-
 tools/testing/selftests/net/tcp_mmap.c             |   4 +
 tools/usb/usbip/libsrc/usbip_common.c              |   2 +
 tools/usb/usbip/libsrc/usbip_device_driver.c       |   4 +
 tools/usb/usbip/libsrc/vhci_driver.c               |   1 +
 tools/virtio/vringh_test.c                         |   5 +
 virt/kvm/eventfd.c                                 |  12 +-
 virt/kvm/kvm_main.c                                |  16 +-
 1187 files changed, 14330 insertions(+), 8071 deletions(-)

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <[email protected]>

[ Upstream commit 48d83d94930eb4db4c93d2de44838b9455cff626 ]

aarch64_insn_gen_cond_branch_imm() calls label_imm_common() to compute a 19-bit signed byte offset for a conditional branch, but unlike its siblings aarch64_insn_gen_branch_imm() and aarch64_insn_gen_comp_branch_imm(), it does not check whether label_imm_common() returned its out-of-range sentinel (range) before feeding the value to aarch64_insn_encode_immediate().

aarch64_insn_encode_immediate() unconditionally masks the value with the 19-bit field mask, so an offset that was rejected by label_imm_common() gets silently truncated. With the sentinel value SZ_1M, the resulting field ends up with bit 18 (the sign bit of the 19-bit signed displacement) set, and the CPU decodes it as a ~1 MiB *backward* branch, producing an incorrectly targeted B.cond instruction. For code-gen locations like the emit_bpf_tail_call() this function is the only barrier between an overflowing displacement and a silently miscompiled branch.

Fix it by returning AARCH64_BREAK_FAULT when the offset is out of range, so callers see a loud failure instead of a silently misencoded branch. validate_code() scans the generated image for any AARCH64_BREAK_FAULT and then lets the JIT fail.

---
 arch/arm64/lib/insn.c | 2 ++
 1 file changed, 2 insertions(+)

index 7232b1e70a125f..cb845b3649a188 100644
@@ -338,6 +338,8 @@ u32 aarch64_insn_gen_cond_branch_imm(unsigned long pc, unsigned long addr,
 	long offset;
 
 	offset = label_imm_common(pc, addr, SZ_1M);
+	if (offset >= SZ_1M)
+		return AARCH64_BREAK_FAULT;
 
 	insn = aarch64_insn_get_bcond_value();
 

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Mason <[email protected]>

commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 upstream.

nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer.

The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail.

A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work.

    nfsd4_alloc_layout_stateid()
      nfs4_alloc_stid()           /* idr_alloc_cyclic under cl_lock */
      nfsd4_layout_setlease()     /* fails */
        nfs4_put_stid()
          nfsd4_free_layout_stateid()
            delayed_work_pending(&ls->ls_fence_work)  /* needs INIT */
            nfsd4_close_layout()  /* nfsd_file_put(ls->ls_file) */
          put_nfs4_file()

Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp).

---
 fs/nfsd/nfs4layouts.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

index 308214378fd352..84bb200e24adea 100644
@@ -242,9 +242,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
 	BUG_ON(!ls->ls_file);
 
 	if (nfsd4_layout_setlease(ls)) {
-		nfsd_file_put(ls->ls_file);
-		put_nfs4_file(fp);
-		kmem_cache_free(nfs4_layout_stateid_cache, ls);
+		nfs4_put_stid(stp);
 		return NULL;
 	}
 

2.53.0

Same perf build error on 6.6.145-rc1 as reported for 6.1.178-rc1:

In file included from builtin-sched.c:27:
builtin-sched.c: In function 'latency_switch_event':
builtin-sched.c:1182:34: error: 'struct perf_sample' has no member named 'file_offset'
1182 | sample->file_offset, cpu);
| ^~
util/debug.h:24:44: note: in definition of macro 'pr_warning'
24 | eprintf(0, verbose, pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~
builtin-sched.c: In function 'latency_runtime_event':
builtin-sched.c:1260:34: error: 'struct perf_sample' has no member named 'file_offset'
1260 | sample->file_offset, cpu);
| ^~
util/debug.h:24:44: note: in definition of macro 'pr_warning'
24 | eprintf(0, verbose, pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~
builtin-sched.c: In function 'map_switch_event':
builtin-sched.c:1637:34: error: 'struct perf_sample' has no member named 'file_offset'
1637 | sample->file_offset, this_cpu.cpu);
| ^~
util/debug.h:24:44: note: in definition of macro 'pr_warning'
24 | eprintf(0, verbose, pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~
make[5]: *** [/local/users/fainelli/buildroot/output/arm64/build/linux-custom/tools/build/Makefile.build:97: /local/users/fainelli/buildroot/output/arm64/build/linux-custom/tools/perf/builtin-sched.o] Error 1

Florian

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jeff Layton <[email protected]>

commit 2090b05803faab8a9fa62fbff871007862cac1b7 upstream.

nfsd_vfs_write() and nfsd_commit() both call filemap_check_wb_err() to detect deferred writeback errors, but neither rotates the server's write verifier (nn->writeverf) when this check fails. Every other durable-storage-failure path in these functions calls commit_reset_write_verifier() before returning an error.

The missing rotation means clients holding UNSTABLE write data under the current verifier will COMMIT, receive the unchanged verifier back, and conclude their data is durable — silently dropping data that failed writeback. This violates the UNSTABLE+COMMIT durability contract (RFC 1813 §3.3.7, RFC 8881 §18.32).

Add commit_reset_write_verifier() calls at both filemap_check_wb_err() error sites, matching the pattern used by adjacent error paths in the same functions. The helper already filters -EAGAIN and -ESTALE internally, so the calls are unconditionally safe.

[ cel: 6.6.y predates the commit_reset_write_verifier() helper (v6.7);
open-coded nfsd_reset_write_verifier() and the reset tracepoint at both sites, matching the other reset paths in these functions ]

---
 fs/nfsd/vfs.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

index ae1f43eb515a81..6658c92340f20b 100644
@@ -1185,8 +1185,11 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
 	nfsd_stats_io_write_add(nn, exp, *cnt);
 	fsnotify_modify(file);
 	host_err = filemap_check_wb_err(file->f_mapping, since);
-	if (host_err < 0)
+	if (host_err < 0) {
+		nfsd_reset_write_verifier(nn);
+		trace_nfsd_writeverf_reset(nn, rqstp, host_err);
 		goto out_nfserr;
+	}
 
 	if (stable && use_wgather) {
 		host_err = wait_for_concurrent_writes(file);

@@ -1330,6 +1333,10 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
 			nfsd_copy_write_verifier(verf, nn);
 			err2 = filemap_check_wb_err(nf->nf_file->f_mapping,
 						    since);
+			if (err2 < 0) {
+				nfsd_reset_write_verifier(nn);
+				trace_nfsd_writeverf_reset(nn, rqstp, err2);
+			}
 			err = nfserrno(err2);
 			break;
 		case -EINVAL:

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Baokun Li <[email protected]>

[ Upstream commit 6b854d552711aa33f59eda334e6d94a00d8825bb ]

The use of path and ppath is now very confusing, so to make the code more readable, pass path between functions uniformly, and get rid of ppath.

After getting rid of ppath in get_ext_path(), its caller may pass an error pointer to ext4_free_ext_path(), so it needs to teach ext4_free_ext_path() and ext4_ext_drop_refs() to skip the error pointer. No functional changes.

---
 fs/ext4/extents.c     |  5 +++--
 fs/ext4/move_extent.c | 34 +++++++++++++++++-----------------
 2 files changed, 20 insertions(+), 19 deletions(-)

index a94798e23c1afb..9c2d23958146bf 100644
@@ -114,7 +114,7 @@ static void ext4_ext_drop_refs(struct ext4_ext_path *path)
 {
 	int depth, i;
 
-	if (!path)
+	if (IS_ERR_OR_NULL(path))
 		return;
 	depth = path->p_depth;
 	for (i = 0; i <= depth; i++, path++) {

@@ -125,6 +125,8 @@ static void ext4_ext_drop_refs(struct ext4_ext_path *path)
 
 void ext4_free_ext_path(struct ext4_ext_path *path)
 {
+	if (IS_ERR_OR_NULL(path))
+		return;
 	ext4_ext_drop_refs(path);
 	kfree(path);
 }

@@ -4242,7 +4244,6 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
 	path = ext4_find_extent(inode, map->m_lblk, NULL, 0);
 	if (IS_ERR(path)) {
 		err = PTR_ERR(path);
-		path = NULL;
 		goto out;
 	}
 

index d5636a2a718a8d..96a84de321690d 100644
@@ -17,27 +17,23 @@
  * get_ext_path() - Find an extent path for designated logical block number.
  * @inode:	inode to be searched
  * @lblock:	logical block number to find an extent path
- * @ppath:	pointer to an extent path pointer (for output)
+ * @path:	pointer to an extent path
  *
- * ext4_find_extent wrapper. Return 0 on success, or a negative error value
- * on failure.
+ * ext4_find_extent wrapper. Return an extent path pointer on success,
+ * or an error pointer on failure.
  */
-static inline int
+static inline struct ext4_ext_path *
 get_ext_path(struct inode *inode, ext4_lblk_t lblock,
-		struct ext4_ext_path **ppath)
+	     struct ext4_ext_path *path)
 {
-	struct ext4_ext_path *path = *ppath;
-
-	*ppath = NULL;
 	path = ext4_find_extent(inode, lblock, path, EXT4_EX_NOCACHE);
 	if (IS_ERR(path))
-		return PTR_ERR(path);
+		return path;
 	if (path[ext_depth(inode)].p_ext == NULL) {
 		ext4_free_ext_path(path);
-		return -ENODATA;
+		return ERR_PTR(-ENODATA);
 	}
-	*ppath = path;
-	return 0;
+	return path;
 }
 
 /**

@@ -95,9 +91,11 @@ mext_check_coverage(struct inode *inode, ext4_lblk_t from, ext4_lblk_t count,
 	int ret = 0;
 	ext4_lblk_t last = from + count;
 	while (from < last) {
-		*err = get_ext_path(inode, from, &path);
-		if (*err)
-			goto out;
+		path = get_ext_path(inode, from, path);
+		if (IS_ERR(path)) {
+			*err = PTR_ERR(path);
+			return ret;
+		}
 		ext = path[ext_depth(inode)].p_ext;
 		if (unwritten != ext4_ext_is_unwritten(ext))
 			goto out;

@@ -634,9 +632,11 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,
 		int offset_in_page;
 		int unwritten, cur_len;
 
-		ret = get_ext_path(orig_inode, o_start, &path);
-		if (ret)
+		path = get_ext_path(orig_inode, o_start, path);
+		if (IS_ERR(path)) {
+			ret = PTR_ERR(path);
 			goto out;
+		}
 		ex = path[path->p_depth].p_ext;
 		cur_blk = le32_to_cpu(ex->ee_block);
 		cur_len = ext4_ext_get_actual_len(ex);

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Huacai Chen <[email protected]>

commit f2539c56c74691e7a88af6372ba2b48c06ed2fe4 upstream.

This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all secondary CPUs in stop_this_cpu(). And the function marks the CPU offline for the scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps expecting a quiescent state from CPUs that are now spinning forever with interrupts disabled.

As long as nothing waits for an RCU grace period after smp_send_stop() this is harmless, which is why it went unnoticed. However, since commit 91840be8f710370 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT"), irq_work_sync() calls synchronize_rcu() on architectures without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() returns false. Any irq_work_sync() issued in the reboot/shutdown/halt path after smp_send_stop() then blocks on a grace period that can never complete, hanging the reboot:

  WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on
  ...
  rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
  rcu: Offline CPU 1 blocking current GP.
  rcu: Offline CPU 2 blocking current GP.
  rcu: Offline CPU 3 blocking current GP.

This issue needs some hacks to reproduce, and it was not noticed on LoongArch because arch_irq_work_has_interrupt() usually returns true.

Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring the generic CPU-hotplug offline path, so RCU stops waiting on the parked CPUs and grace periods can still complete. LoongArch shuts down all CPUs here without going through the CPU-hotplug mechanism, so this report is not otherwise issued.

---
 arch/loongarch/kernel/smp.c | 1 +
 1 file changed, 1 insertion(+)

index ed67629454374f..d3fafa5cdf6bc8 100644
@@ -613,6 +613,7 @@ static void stop_this_cpu(void *dummy)
 	set_cpu_online(smp_processor_id(), false);
 	calculate_cpu_foreign_map();
 	local_irq_disable();
+	rcu_report_dead(smp_processor_id());
 	while (true);
 }
 

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sean Wang <[email protected]>

[ Upstream commit 7f935b21bee4d8a9f26b57ae6c3682161b247809 ]

Apply the common btmtk_fw_get_filename to avoid the similar coding in each driver.

Stable-dep-of: 5c5e8c52e3ca ("Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c")

---
 drivers/bluetooth/btmtksdio.c |  3 +++
 drivers/bluetooth/btusb.c     | 10 ++--------
 2 files changed, 5 insertions(+), 8 deletions(-)

index e249aa7587833b..2be38c8e353efb 100644
@@ -1111,6 +1111,9 @@ static int btmtksdio_setup(struct hci_dev *hdev)
 			return err;
 		}
 
+		btmtk_fw_get_filename(fwname, sizeof(fwname), dev_id,
+				      fw_version, 0);
+
 		snprintf(fwname, sizeof(fwname),
 			 "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
 			 dev_id & 0xffff, (fw_version & 0xff) + 1);

index 9b2857a8e7ac1f..048929e336cf64 100644
@@ -2940,14 +2940,8 @@ static int btusb_mtk_setup(struct hci_dev *hdev)
 	case 0x7922:
 	case 0x7961:
 	case 0x7925:
-		if (dev_id == 0x7925)
-			snprintf(fw_bin_name, sizeof(fw_bin_name),
-				 "mediatek/mt%04x/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
-				 dev_id & 0xffff, dev_id & 0xffff, (fw_version & 0xff) + 1);
-		else
-			snprintf(fw_bin_name, sizeof(fw_bin_name),
-				 "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
-				 dev_id & 0xffff, (fw_version & 0xff) + 1);
+		btmtk_fw_get_filename(fw_bin_name, sizeof(fw_bin_name), dev_id,
+				      fw_version, 0);
 
 		err = btmtk_setup_firmware_79xx(hdev, fw_bin_name,
 						btmtk_usb_hci_wmt_sync);

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hao Qin <[email protected]>

[ Upstream commit ccfc8948d7e4d93cab341a99774b24586717d89a ]

Reset the controller before downloading the firmware to improve its reliability. This includes situations like cold or warm reboots, ensuring the controller is in its initial state before starting the firmware download.

Stable-dep-of: 5c5e8c52e3ca ("Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c")

---
 drivers/bluetooth/btusb.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

index 048929e336cf64..c6b62437be2d5a 100644
@@ -2940,6 +2940,13 @@ static int btusb_mtk_setup(struct hci_dev *hdev)
 	case 0x7922:
 	case 0x7961:
 	case 0x7925:
+		/* Reset the device to ensure it's in the initial state before
+		 * downloading the firmware to ensure.
+		 */
+
+		if (!test_bit(BTUSB_FIRMWARE_LOADED, &data->flags))
+			btusb_mtk_subsys_reset(hdev, dev_id);
+
 		btmtk_fw_get_filename(fw_bin_name, sizeof(fw_bin_name), dev_id,
 				      fw_version, 0);
 

@@ -2947,9 +2954,12 @@ static int btusb_mtk_setup(struct hci_dev *hdev)
 						btmtk_usb_hci_wmt_sync);
 		if (err < 0) {
 			bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
+			clear_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
 			return err;
 		}
 
+		set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
+
 		/* It's Device EndPoint Reset Option Register */
 		btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
 

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hao Qin <[email protected]>

[ Upstream commit 064aee501012eaeeeb40a2acb991598e0a89fac9 ]

Add the support of MT7922 bluetooth subsystem reset that was called the auto revert to self-recover from the fatal error in the controller like the host encounters HCI cmd timeout or the controller crashes.

Stable-dep-of: 5c5e8c52e3ca ("Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c")

---
 drivers/bluetooth/btusb.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

index c6b62437be2d5a..536b013ff7aedc 100644
@@ -2811,7 +2811,16 @@ static int btusb_mtk_subsys_reset(struct hci_dev *hdev, u32 dev_id)
 	u32 val;
 	int err;
 
-	if (dev_id == 0x7925) {
+	if (dev_id == 0x7922) {
+		btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+		val |= 0x00002020;
+		btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
+		btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
+		btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+		val |= BIT(0);
+		btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
+		msleep(100);
+	} else if (dev_id == 0x7925) {
 		btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
 		val |= (1 << 5);
 		btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);

@@ -2851,6 +2860,9 @@ static int btusb_mtk_subsys_reset(struct hci_dev *hdev, u32 dev_id)
 	if (err < 0)
 		bt_dev_err(hdev, "Reset timeout");
 
+	if (dev_id == 0x7922)
+		btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
+
 	btusb_mtk_id_get(data, 0x70010200, &val);
 	if (!val)
 		bt_dev_err(hdev, "Can't get device id, subsys reset fail.");

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Lu <[email protected]>

[ Upstream commit be71dfb9ad2042bba713975ef50c3a5b0429f1d2 ]

Remove the unnecessary goto tag whether there is an error or not, we have to free the buffer at the end of the function.

Stable-dep-of: 5c5e8c52e3ca ("Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c")

---
 drivers/bluetooth/btusb.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

index 536b013ff7aedc..926ca7ecaf0cc2 100644
@@ -2725,12 +2725,9 @@ static int btusb_mtk_uhw_reg_write(struct btusb_data *data, u32 reg, u32 val)
 			      0x5E,
 			      reg >> 16, reg & 0xffff,
 			      buf, 4, USB_CTRL_SET_TIMEOUT);
-	if (err < 0) {
+	if (err < 0)
 		bt_dev_err(hdev, "Failed to write uhw reg(%d)", err);
-		goto err_free_buf;
-	}
 
-err_free_buf:
 	kfree(buf);
 
 	return err;

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Lu <[email protected]>

[ Upstream commit 3dcb122b30643444352ff4b9aa16367dd24d7571 ]

Update the code to immediately return an error code if accessing a related register fails. This ensures that our desired logic for subsequent register operations is maintained and allows us to promptly catch any unexpected errors.

Stable-dep-of: 5c5e8c52e3ca ("Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c")

---
 drivers/bluetooth/btusb.c | 114 ++++++++++++++++++++++++++++----------
 1 file changed, 84 insertions(+), 30 deletions(-)

index 926ca7ecaf0cc2..a7aa4c1dacb295 100644
@@ -2809,47 +2809,98 @@ static int btusb_mtk_subsys_reset(struct hci_dev *hdev, u32 dev_id)
 	int err;
 
 	if (dev_id == 0x7922) {
-		btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+		err = btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+		if (err < 0)
+			return err;
 		val |= 0x00002020;
-		btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
-		btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
-		btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+		err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+		if (err < 0)
+			return err;
 		val |= BIT(0);
-		btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
+		err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
+		if (err < 0)
+			return err;
 		msleep(100);
 	} else if (dev_id == 0x7925) {
-		btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+		err = btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+		if (err < 0)
+			return err;
 		val |= (1 << 5);
-		btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
-		btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+		err = btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+		if (err < 0)
+			return err;
 		val &= 0xFFFF00FF;
+		if (err < 0)
+			return err;
 		val |= (1 << 13);
-		btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
-		btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
-		btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+		err = btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+		if (err < 0)
+			return err;
 		val |= (1 << 0);
-		btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
-		btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
-		btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
-		btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
-		btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
+		err = btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
+		if (err < 0)
+			return err;
 		msleep(100);
 	} else {
 		/* It's Device EndPoint Reset Option Register */
 		bt_dev_dbg(hdev, "Initiating reset mechanism via uhw");
-		btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
-		btusb_mtk_uhw_reg_read(data, MTK_BT_WDT_STATUS, &val);
-
+		err = btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_read(data, MTK_BT_WDT_STATUS, &val);
+		if (err < 0)
+			return err;
 		/* Reset the bluetooth chip via USB interface. */
-		btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 1);
-		btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
-		btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
-		btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
-		btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
+		err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 1);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
+		if (err < 0)
+			return err;
 		/* MT7921 need to delay 20ms between toggle reset bit */
 		msleep(20);
-		btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 0);
-		btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+		err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 0);
+		if (err < 0)
+			return err;
+		err = btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+		if (err < 0)
+			return err;
 	}
 
 	err = readx_poll_timeout(btusb_mtk_reset_done, hdev, val,

@@ -2857,11 +2908,14 @@ static int btusb_mtk_subsys_reset(struct hci_dev *hdev, u32 dev_id)
 	if (err < 0)
 		bt_dev_err(hdev, "Reset timeout");
 
-	if (dev_id == 0x7922)
-		btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
+	if (dev_id == 0x7922) {
+		err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
+		if (err < 0)
+			return err;
+	}
 
-	btusb_mtk_id_get(data, 0x70010200, &val);
-	if (!val)
+	err = btusb_mtk_id_get(data, 0x70010200, &val);
+	if (err < 0 || !val)
 		bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
 
 	return err;

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Lu <[email protected]>

[ Upstream commit 5c5e8c52e3cafaa6f71efd44a42a674271e5b3ad ]

Move btusb_mtk_[setup, shutdown] and related function from btusb.c to btmtk.c which holds vendor specific stuff and would make btusb.c clean.

---
 drivers/bluetooth/btmtk.c | 454 +++++++++++++++++++++++++++++++++++++-
 drivers/bluetooth/btmtk.h |  23 +-
 drivers/bluetooth/btusb.c | 446 ++-----------------------------------
 3 files changed, 484 insertions(+), 439 deletions(-)

index 582915f9a8d700..8fd923de47c1f3 100644
@@ -5,6 +5,8 @@
 #include <linux/module.h>
 #include <linux/firmware.h>
 #include <linux/usb.h>
+#include <linux/iopoll.h>
+#include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>

@@ -573,8 +575,8 @@ static int btmtk_usb_submit_wmt_recv_urb(struct hci_dev *hdev)
 	return err;
 }
 
-int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
-			   struct btmtk_hci_wmt_params *wmt_params)
+static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
+				  struct btmtk_hci_wmt_params *wmt_params)
 {
 	struct btmtk_data *data = hci_get_priv(hdev);
 	struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;

@@ -711,7 +713,453 @@ int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
 	kfree(wc);
 	return err;
 }
-EXPORT_SYMBOL_GPL(btmtk_usb_hci_wmt_sync);
+
+static int btmtk_usb_func_query(struct hci_dev *hdev)
+{
+	struct btmtk_hci_wmt_params wmt_params;
+	int status, err;
+	u8 param = 0;
+
+	/* Query whether the function is enabled */
+	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
+	wmt_params.flag = 4;
+	wmt_params.dlen = sizeof(param);
+	wmt_params.data = &param;
+	wmt_params.status = &status;
+
+	err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
+	if (err < 0) {
+		bt_dev_err(hdev, "Failed to query function status (%d)", err);
+		return err;
+	}
+
+	return status;
+}
+
+static int btmtk_usb_uhw_reg_write(struct hci_dev *hdev, u32 reg, u32 val)
+{
+	struct btmtk_data *data = hci_get_priv(hdev);
+	int pipe, err;
+	void *buf;
+
+	buf = kzalloc(4, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	put_unaligned_le32(val, buf);
+
+	pipe = usb_sndctrlpipe(data->udev, 0);
+	err = usb_control_msg(data->udev, pipe, 0x02,
+			      0x5E,
+			      reg >> 16, reg & 0xffff,
+			      buf, 4, USB_CTRL_SET_TIMEOUT);
+	if (err < 0)
+		bt_dev_err(hdev, "Failed to write uhw reg(%d)", err);
+
+	kfree(buf);
+
+	return err;
+}
+
+static int btmtk_usb_uhw_reg_read(struct hci_dev *hdev, u32 reg, u32 *val)
+{
+	struct btmtk_data *data = hci_get_priv(hdev);
+	int pipe, err;
+	void *buf;
+
+	buf = kzalloc(4, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	pipe = usb_rcvctrlpipe(data->udev, 0);
+	err = usb_control_msg(data->udev, pipe, 0x01,
+			      0xDE,
+			      reg >> 16, reg & 0xffff,
+			      buf, 4, USB_CTRL_GET_TIMEOUT);
+	if (err < 0) {
+		bt_dev_err(hdev, "Failed to read uhw reg(%d)", err);
+		goto err_free_buf;
+	}
+
+	*val = get_unaligned_le32(buf);
+	bt_dev_dbg(hdev, "reg=%x, value=0x%08x", reg, *val);
+
+err_free_buf:
+	kfree(buf);
+
+	return err;
+}
+
+static int btmtk_usb_reg_read(struct hci_dev *hdev, u32 reg, u32 *val)
+{
+	struct btmtk_data *data = hci_get_priv(hdev);
+	int pipe, err, size = sizeof(u32);
+	void *buf;
+
+	buf = kzalloc(size, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	pipe = usb_rcvctrlpipe(data->udev, 0);
+	err = usb_control_msg(data->udev, pipe, 0x63,
+			      USB_TYPE_VENDOR | USB_DIR_IN,
+			      reg >> 16, reg & 0xffff,
+			      buf, size, USB_CTRL_GET_TIMEOUT);
+	if (err < 0)
+		goto err_free_buf;
+
+	*val = get_unaligned_le32(buf);
+
+err_free_buf:
+	kfree(buf);
+
+	return err;
+}
+
+static int btmtk_usb_id_get(struct hci_dev *hdev, u32 reg, u32 *id)
+{
+	return btmtk_usb_reg_read(hdev, reg, id);
+}
+
+static u32 btmtk_usb_reset_done(struct hci_dev *hdev)
+{
+	u32 val = 0;
+
+	btmtk_usb_uhw_reg_read(hdev, MTK_BT_MISC, &val);
+
+	return val & MTK_BT_RST_DONE;
+}
+
+int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id)
+{
+	u32 val;
+	int err;
+
+	if (dev_id == 0x7922) {
+		err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
+		if (err < 0)
+			return err;
+		val |= 0x00002020;
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, val);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, 0x00010001);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
+		if (err < 0)
+			return err;
+		val |= BIT(0);
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, val);
+		if (err < 0)
+			return err;
+		msleep(100);
+	} else if (dev_id == 0x7925) {
+		err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
+		if (err < 0)
+			return err;
+		val |= (1 << 5);
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
+		if (err < 0)
+			return err;
+		val &= 0xFFFF00FF;
+		val |= (1 << 13);
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, 0x00010001);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
+		if (err < 0)
+			return err;
+		val |= (1 << 0);
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT, &val);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT1, 0x000000FF);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT1, &val);
+		if (err < 0)
+			return err;
+		msleep(100);
+	} else {
+		/* It's Device EndPoint Reset Option Register */
+		bt_dev_dbg(hdev, "Initiating reset mechanism via uhw");
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_WDT_STATUS, &val);
+		if (err < 0)
+			return err;
+		/* Reset the bluetooth chip via USB interface. */
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, 1);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT, &val);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT1, 0x000000FF);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT1, &val);
+		if (err < 0)
+			return err;
+		/* MT7921 need to delay 20ms between toggle reset bit */
+		msleep(20);
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, 0);
+		if (err < 0)
+			return err;
+		err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
+		if (err < 0)
+			return err;
+	}
+
+	err = readx_poll_timeout(btmtk_usb_reset_done, hdev, val,
+				 val & MTK_BT_RST_DONE, 20000, 1000000);
+	if (err < 0)
+		bt_dev_err(hdev, "Reset timeout");
+
+	if (dev_id == 0x7922) {
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
+		if (err < 0)
+			return err;
+	}
+
+	err = btmtk_usb_id_get(hdev, 0x70010200, &val);
+	if (err < 0 || !val)
+		bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
+
+	return err;
+}
+EXPORT_SYMBOL_GPL(btmtk_usb_subsys_reset);
+
+int btmtk_usb_setup(struct hci_dev *hdev)
+{
+	struct btmtk_data *btmtk_data = hci_get_priv(hdev);
+	struct btmtk_hci_wmt_params wmt_params;
+	ktime_t calltime, delta, rettime;
+	struct btmtk_tci_sleep tci_sleep;
+	unsigned long long duration;
+	struct sk_buff *skb;
+	const char *fwname;
+	int err, status;
+	u32 dev_id = 0;
+	char fw_bin_name[64];
+	u32 fw_version = 0, fw_flavor = 0;
+	u8 param;
+
+	calltime = ktime_get();
+
+	err = btmtk_usb_id_get(hdev, 0x80000008, &dev_id);
+	if (err < 0) {
+		bt_dev_err(hdev, "Failed to get device id (%d)", err);
+		return err;
+	}
+
+	if (!dev_id || dev_id != 0x7663) {
+		err = btmtk_usb_id_get(hdev, 0x70010200, &dev_id);
+		if (err < 0) {
+			bt_dev_err(hdev, "Failed to get device id (%d)", err);
+			return err;
+		}
+		err = btmtk_usb_id_get(hdev, 0x80021004, &fw_version);
+		if (err < 0) {
+			bt_dev_err(hdev, "Failed to get fw version (%d)", err);
+			return err;
+		}
+		err = btmtk_usb_id_get(hdev, 0x70010020, &fw_flavor);
+		if (err < 0) {
+			bt_dev_err(hdev, "Failed to get fw flavor (%d)", err);
+			return err;
+		}
+		fw_flavor = (fw_flavor & 0x00000080) >> 7;
+	}
+
+	btmtk_data->dev_id = dev_id;
+
+	err = btmtk_register_coredump(hdev, btmtk_data->drv_name, fw_version);
+	if (err < 0)
+		bt_dev_err(hdev, "Failed to register coredump (%d)", err);
+
+	switch (dev_id) {
+	case 0x7663:
+		fwname = FIRMWARE_MT7663;
+		break;
+	case 0x7668:
+		fwname = FIRMWARE_MT7668;
+		break;
+	case 0x7922:
+	case 0x7961:
+	case 0x7925:
+		/* Reset the device to ensure it's in the initial state before
+		 * downloading the firmware to ensure.
+		 */
+
+		if (!test_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags))
+			btmtk_usb_subsys_reset(hdev, dev_id);
+
+		btmtk_fw_get_filename(fw_bin_name, sizeof(fw_bin_name), dev_id,
+				      fw_version, fw_flavor);
+
+		err = btmtk_setup_firmware_79xx(hdev, fw_bin_name,
+						btmtk_usb_hci_wmt_sync);
+		if (err < 0) {
+			bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
+			clear_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags);
+			return err;
+		}
+
+		set_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags);
+
+		/* It's Device EndPoint Reset Option Register */
+		err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT,
+					      MTK_EP_RST_IN_OUT_OPT);
+		if (err < 0)
+			return err;
+
+		/* Enable Bluetooth protocol */
+		param = 1;
+		wmt_params.op = BTMTK_WMT_FUNC_CTRL;
+		wmt_params.flag = 0;
+		wmt_params.dlen = sizeof(param);
+		wmt_params.data = &param;
+		wmt_params.status = NULL;
+
+		err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
+		if (err < 0) {
+			bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
+			return err;
+		}
+
+		hci_set_msft_opcode(hdev, 0xFD30);
+		hci_set_aosp_capable(hdev);
+
+		goto done;
+	default:
+		bt_dev_err(hdev, "Unsupported hardware variant (%08x)",
+			   dev_id);
+		return -ENODEV;
+	}
+
+	/* Query whether the firmware is already download */
+	wmt_params.op = BTMTK_WMT_SEMAPHORE;
+	wmt_params.flag = 1;
+	wmt_params.dlen = 0;
+	wmt_params.data = NULL;
+	wmt_params.status = &status;
+
+	err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
+	if (err < 0) {
+		bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
+		return err;
+	}
+
+	if (status == BTMTK_WMT_PATCH_DONE) {
+		bt_dev_info(hdev, "firmware already downloaded");
+		goto ignore_setup_fw;
+	}
+
+	/* Setup a firmware which the device definitely requires */
+	err = btmtk_setup_firmware(hdev, fwname,
+				   btmtk_usb_hci_wmt_sync);
+	if (err < 0)
+		return err;
+
+ignore_setup_fw:
+	err = readx_poll_timeout(btmtk_usb_func_query, hdev, status,
+				 status < 0 || status != BTMTK_WMT_ON_PROGRESS,
+				 2000, 5000000);
+	/* -ETIMEDOUT happens */
+	if (err < 0)
+		return err;
+
+	/* The other errors happen in btmtk_usb_func_query */
+	if (status < 0)
+		return status;
+
+	if (status == BTMTK_WMT_ON_DONE) {
+		bt_dev_info(hdev, "function already on");
+		goto ignore_func_on;
+	}
+
+	/* Enable Bluetooth protocol */
+	param = 1;
+	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
+	wmt_params.flag = 0;
+	wmt_params.dlen = sizeof(param);
+	wmt_params.data = &param;
+	wmt_params.status = NULL;
+
+	err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
+	if (err < 0) {
+		bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
+		return err;
+	}
+
+ignore_func_on:
+	/* Apply the low power environment setup */
+	tci_sleep.mode = 0x5;
+	tci_sleep.duration = cpu_to_le16(0x640);
+	tci_sleep.host_duration = cpu_to_le16(0x640);
+	tci_sleep.host_wakeup_pin = 0;
+	tci_sleep.time_compensation = 0;
+
+	skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
+			     HCI_INIT_TIMEOUT);
+	if (IS_ERR(skb)) {
+		err = PTR_ERR(skb);
+		bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
+		return err;
+	}
+	kfree_skb(skb);
+
+done:
+	rettime = ktime_get();
+	delta = ktime_sub(rettime, calltime);
+	duration = (unsigned long long)ktime_to_ns(delta) >> 10;
+
+	bt_dev_info(hdev, "Device setup in %llu usecs", duration);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(btmtk_usb_setup);
+
+int btmtk_usb_shutdown(struct hci_dev *hdev)
+{
+	struct btmtk_hci_wmt_params wmt_params;
+	u8 param = 0;
+	int err;
+
+	/* Disable the device */
+	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
+	wmt_params.flag = 0;
+	wmt_params.dlen = sizeof(param);
+	wmt_params.data = &param;
+	wmt_params.status = NULL;
+
+	err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
+	if (err < 0) {
+		bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
+		return err;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(btmtk_usb_shutdown);
 
 MODULE_AUTHOR("Sean Wang <[email protected]>");
 MODULE_AUTHOR("Mark Chen <[email protected]>");

index 3055b9728ae250..fe41528ae509bf 100644
@@ -140,6 +140,8 @@ struct btmtk_hci_wmt_params {
 
 enum {
 	BTMTK_TX_WAIT_VND_EVT,
+	BTMTK_FIRMWARE_LOADED,
+	BTMTK_HW_RESET_ACTIVE,
 };
 
 typedef int (*btmtk_reset_sync_func_t)(struct hci_dev *, void *);

@@ -152,6 +154,7 @@ struct btmtk_coredump_info {
 };
 
 struct btmtk_data {
+	const char *drv_name;
 	unsigned long flags;
 	u32 dev_id;
 	btmtk_reset_sync_func_t reset_sync;

@@ -186,8 +189,11 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb);
 void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id, u32 fw_ver,
 			   u32 fw_flavor);
 
-int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
-			   struct btmtk_hci_wmt_params *wmt_params);
+int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id);
+
+int btmtk_usb_setup(struct hci_dev *hdev);
+
+int btmtk_usb_shutdown(struct hci_dev *hdev);
 #else
 
 static inline int btmtk_set_bdaddr(struct hci_dev *hdev,

@@ -228,8 +234,17 @@ static void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id,
 {
 }
 
-static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
-				  struct btmtk_hci_wmt_params *wmt_params)
+static int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id)
+{
+	return -EOPNOTSUPP;
+}
+
+static int btmtk_usb_setup(struct hci_dev *hdev)
+{
+	return -EOPNOTSUPP;
+}
+
+static int btmtk_usb_shutdown(struct hci_dev *hdev)
 {
 	return -EOPNOTSUPP;
 }

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Lu <[email protected]>

[ Upstream commit 67dba2c28fe0af7e25ea1aeade677162ed05310a ]

Use usb_autopm_get_interface() and usb_autopm_put_interface() in btmtk_usb_shutdown(), it could send func ctrl after enabling autosuspend.

Bluetooth: btmtk_usb_hci_wmt_sync() hci0: Execution of wmt command
timed out
Bluetooth: btmtk_usb_shutdown() hci0: Failed to send wmt func ctrl

           (-110)

---
 drivers/bluetooth/btmtk.c  | 7 +++++++
 net/bluetooth/rfcomm/tty.c | 4 ++--
 2 files changed, 9 insertions(+), 2 deletions(-)

index 8fd923de47c1f3..29d4a04ea0d46a 100644
@@ -1140,10 +1140,15 @@ EXPORT_SYMBOL_GPL(btmtk_usb_setup);
 
 int btmtk_usb_shutdown(struct hci_dev *hdev)
 {
+	struct btmtk_data *data = hci_get_priv(hdev);
 	struct btmtk_hci_wmt_params wmt_params;
 	u8 param = 0;
 	int err;
 
+	err = usb_autopm_get_interface(data->intf);
+	if (err < 0)
+		return err;
+
 	/* Disable the device */
 	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
 	wmt_params.flag = 0;

@@ -1154,9 +1159,11 @@ int btmtk_usb_shutdown(struct hci_dev *hdev)
 	err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
 	if (err < 0) {
 		bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
+		usb_autopm_put_interface(data->intf);
 		return err;
 	}
 
+	usb_autopm_put_interface(data->intf);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(btmtk_usb_shutdown);

index 912e37cb8310c6..389d7b47ad6132 100644
@@ -201,14 +201,14 @@ static ssize_t address_show(struct device *tty_dev,
 			    struct device_attribute *attr, char *buf)
 {
 	struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
-	return sprintf(buf, "%pMR\n", &dev->dst);
+	return sysfs_emit(buf, "%pMR\n", &dev->dst);
 }
 
 static ssize_t channel_show(struct device *tty_dev,
 			    struct device_attribute *attr, char *buf)
 {
 	struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
-	return sprintf(buf, "%d\n", dev->channel);
+	return sysfs_emit(buf, "%d\n", dev->channel);
 }
 
 static DEVICE_ATTR_RO(address);

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jiande Lu <[email protected]>

[ Upstream commit 099799fa9b76c5c02b49e07005a85117a25b01ea ]

During the shutdown process, an interrupt occurs that prematurely terminates the wait for the expected event. This change replaces TASK_INTERRUPTIBLE with TASK_UNINTERRUPTIBLE in the wait_on_bit_timeout call to ensure the shutdown process completes as intended without being interrupted by signals.

---
 drivers/bluetooth/btmtk.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

index 29d4a04ea0d46a..bd28a2d52af169 100644
@@ -640,12 +640,7 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
 	 * WMT command.
 	 */
 	err = wait_on_bit_timeout(&data->flags, BTMTK_TX_WAIT_VND_EVT,
-				  TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
-	if (err == -EINTR) {
-		bt_dev_err(hdev, "Execution of wmt command interrupted");
-		clear_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags);
-		goto err_free_wc;
-	}
+				  TASK_UNINTERRUPTIBLE, HCI_INIT_TIMEOUT);
 
 	if (err) {
 		bt_dev_err(hdev, "Execution of wmt command timed out");