6.12.110-rc1 review

This is the start of the stable review cycle for the 6.12.110 release. There are 1376 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Mon, 14 Sep 2026 06:54:17 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.110-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.12.110-rc1

Tony W Wang-oc <[email protected]>
ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()

Nathan Chancellor <[email protected]>
integrity: Eliminate weak definition of arch_get_secureboot()

Hao Ge <[email protected]>

    slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL

Alexander Popov <[email protected]>
x86/Kconfig: Reenable PTDUMP on i386

Dan Carpenter <[email protected]>
pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()

Tomas Glozar <[email protected]>
tools/build: Use SYSTEM_BPFTOOL for system bpftool

Eric Dumazet <[email protected]>
net_sched: add back BH safety to tcf_lock

Eric Dumazet <[email protected]>
net_sched: act_tunnel_key: use RCU in tunnel_key_dump()

Eric Dumazet <[email protected]>
net_sched: act_vlan: use RCU in tcf_vlan_dump()

Eric Dumazet <[email protected]>
net_sched: act_skbedit: use RCU in tcf_skbedit_dump()

Eric Dumazet <[email protected]>
net_sched: act_ctinfo: use RCU in tcf_ctinfo_dump()

Eric Dumazet <[email protected]>
net_sched: act_ct: use RCU in tcf_ct_dump()

Zheng Qixing <[email protected]>
md: fix sync_action incorrect display during resync

Zheng Qixing <[email protected]>
md: add helper rdev_needs_recovery()

Catalin Marinas <[email protected]>
kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c

Catalin Marinas <[email protected]>
kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings

Jamal Hadi Salim <[email protected]>
net/sched: fq: clamp quantum and initial_quantum in change path

Arnd Bergmann <[email protected]>

    Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array

e.kubanski <[email protected]>
xsk: Fix offset calculation in unaligned mode

Gao Xiang <[email protected]>
erofs: fix managed cache race for unaligned extents

Chen Ridong <[email protected]>
cpuset: fix warning when disabling remote partition

Nick Chan <[email protected]>

    nvme-apple: Reset q->sq_tail during queue init

Nick Chan <[email protected]>
nvme-apple: Prevent shared tags across queues on Apple A11

Thomas Weißschuh <[email protected]>
powerpc/vdso: Remove unused clockmode asm offsets

Krzysztof Kozlowski <[email protected]>
phy: qcom: qmp-combo: Add missing PLL (VCO) configuration on SM8750

James Clark <[email protected]>
perf test: Don't signal all processes on system when interrupting tests

Yuyang Huang <[email protected]>
bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat

Yuyang Huang <[email protected]>
selftests/bpf: add verification for BPF_PROG_QUERY attr size boundaries

Yang Xiuwei <[email protected]>
scsi: sd: Fix error handling in sd_probe() after large pool creation failure

Pankaj Raghav <[email protected]>
block: reject bs > ps block devices when THP is disabled

Yongpeng Yang <[email protected]>

    fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT

Rafael J. Wysocki <[email protected]>
ACPI: processor: Update cpuidle driver check in __acpi_processor_start()

Kuniyuki Iwashima <[email protected]>
slub: Don't call lockdep_unregister_key() for immature kmem_cache.

Xiao Ni <[email protected]>
md: keep recovery_cp in mdp_superblock_s

Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers

Hao Chang <[email protected]>
pinctrl: mediatek: Fix new design debounce issue

Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask()

Mario Limonciello <[email protected]>
cpufreq/amd-pstate: Fix prefcore rankings

Rafael J. Wysocki <[email protected]>
platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL

Jamal Hadi Salim <[email protected]>
net/sched: sch_htb: limit htb_classify inner-class filter hops

Jiayuan Chen <[email protected]>
tcp: fix corruption of urgent data on multi-segment retransmit

Deepanshu Kartikey <[email protected]>
usb: atm: usbatm: fix invalid ci_range initialization

bui duc phuc <[email protected]>
net: fec: only stop PTP if it was initialized

Eric Dumazet <[email protected]>
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

Jamal Hadi Salim <[email protected]>
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

Maxime Chevallier <[email protected]>
net: stmmac: selftests: Account for the UC filter list for filtering tests

Maxime Chevallier <[email protected]>
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering

Maxime Chevallier <[email protected]>
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering

Maxime Chevallier <[email protected]>
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering

Maxime Chevallier <[email protected]>
net: stmmac: selftests: Check multiple MMC counters

Muhammad Usama Anjum <[email protected]>
selftests/arm64: Treat KSM merge_across_nodes as optional

Muhammad Usama Anjum <[email protected]>
selftests/arm64: Print missing MTE TAP headers

Yang Shi <[email protected]>
selftests: arm64: add hugetlb mte tests

Takashi Iwai <[email protected]>
ALSA: control: Don't add invalid kcontrols to LED layer

Pablo Neira Ayuso <[email protected]>
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()

Marino Dzalto <[email protected]>
netfilter: xt_HL: add pr_fmt and checkentry validation

Michal Koutný <[email protected]>
netfilter: xt_cgroup: Make it independent from net_cls

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: move hardware offload step after building the chain blob

Alice Mikityanska <[email protected]>
virtio-net: Ensure that TCP packets don't overflow gso_segs

Maxime Chevallier <[email protected]>
net: stmmac: selftests: Pass the IP proto mask in the TC selftest

Jiawen Wu <[email protected]>
net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs

Yifei Chu <[email protected]>
net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

bui duc phuc <[email protected]>
net: ethernet: sun4i-emac: Fix IRQ error handling

Haotian Zhang <[email protected]>
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

Haotian Zhang <[email protected]>
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify

Aleksandr Nogikh <[email protected]>
libceph: validate banner payload length

Xiubo Li <[email protected]>
ceph: revalidate ki_pos for O_APPEND writes after cap acquisition

HyeongJun An <[email protected]>
ASoC: dapm: Fix off-by-one check on the second enum channel

John Johansen <[email protected]>
apparmor: policy_int make sure list heads are initialized before fail path

Thorsten Blum <[email protected]>
apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init

Ruoyu Wang <[email protected]>
tpm: st33zp24: Validate locality read result

Ruoyu Wang <[email protected]>
tpm: st33zp24: Return zero on status read failure

Victor Nogueira <[email protected]>

    net/sched: sch_teql: restore skb->dev on the slave failure path

Jamal Hadi Salim <[email protected]>
net/sched: sfq: clamp quantum to avoid signed overflow soft lockup

Jamal Hadi Salim <[email protected]>
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow

Jamal Hadi Salim <[email protected]>
net/sched: fq_pie: clamp default quantum to avoid signed overflow

Jamal Hadi Salim <[email protected]>
net/sched: sch_codel: clamp default mtu to avoid disabling CoDel

Jamal Hadi Salim <[email protected]>
net/sched: fq_codel: clamp default quantum and mtu

Jamal Hadi Salim <[email protected]>
net/sched: fq: add overflow bounds to quantum and initial quantum

Mina Almasry <[email protected]>
net: core: check skb_frags_readable before uncloning in skb_copy_ubufs

Eric Dumazet <[email protected]>
net/sched: act_skbmod: fix length calculations and avoid invalid header warnings

Eric Dumazet <[email protected]>
net_sched: act_skbmod: use RCU in tcf_skbmod_dump()

Liam R. Howlett (Oracle) <[email protected]>
maple_tree: fix argument name in header

Liam R. Howlett (Oracle) <[email protected]>
maple_tree: catch race in mas_alloc_cyclic()

Muhammad Usama Anjum <[email protected]>
selftests/mm: skip COW tmpfile cases when fallocate() is unsupported

Mark Brown <[email protected]>
selftests/mm: report unique test names for each cow test

Hao Ge <[email protected]>
selftests/mm/cow: modify the incorrect checking parameters

Frank Sorenson <[email protected]>
cifs: fix clearing stats for fastest execution of each smb2 command

Allison Henderson <[email protected]>
net/rds: use wq_has_sleeper() in rds_cong_map_updated()

Naveen Mamindlapalli <[email protected]>
octeontx2-af: Fix TL3/TL2 link config ENA clearing

Xiang Mei <[email protected]>

    net: qualcomm: rmnet: restore skb->dev on deaggregated frames

Anshumali Gaur <[email protected]>
octeontx2-af: fix NULL deref in NIX TM tree debugfs read path

Cen Zhang (Microsoft) <[email protected]>
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

Hyunwoo Kim <[email protected]>
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

Chris Lu <[email protected]>
Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path

Chris Lu <[email protected]>
Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX

Ismail Tarim <[email protected]>
Bluetooth: btmtk: Do not discard the subsystem reset timeout

Ismail Tarim <[email protected]>
Bluetooth: btmtk: Do not report success when subsys reset fails

Greg Kroah-Hartman <[email protected]>
Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()

Javier Tia <[email protected]>
Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support

Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

Pavel Shpakovskiy <[email protected]>

    Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference

Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

Wei-Lin Chang <[email protected]>
arm64: ptdump: Make note_page_flush() range aware

Anshuman Khandual <[email protected]>
mm/ptdump: split note_page() into level specific callbacks

Anshuman Khandual <[email protected]>
mm: rename GENERIC_PTDUMP and PTDUMP_CORE

Anshuman Khandual <[email protected]>
mm: make DEBUG_WX depdendent on GENERIC_PTDUMP

Shrikanth Hegde <[email protected]>
powerpc: Add preempt lazy support

Heiko Carstens <[email protected]>
s390: Add ARCH_HAS_PREEMPT_LAZY support

Heiko Carstens <[email protected]>
s390: Add missing _TIF defines

Yicong Yang <[email protected]>
arm64: Enable ARCH_HAS_NONLEAF_PMD_YOUNG

Geert Uytterhoeven <[email protected]>
erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic

Dan Carpenter <[email protected]>
scsi: qla2xxx: Fix an loop timeout test

Rong Zhang <[email protected]>
net: page_pool: Remove zone/policy GFP flags when allocating XArray entries

Guenter Roeck <[email protected]>
bnxt_en: Fix call to hardware monitoring event handler

Cosmo Chou <[email protected]>
rtc: pcf85363: Add error checking to regmap calls in probe()

Junrui Luo <[email protected]>
NFSv4/pnfs: key the data server cache on the NFS version

Jeff Layton <[email protected]>
nfs: move the nfs4_data_server_cache into struct nfs_net

Junrui Luo <[email protected]>
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion

Mahanta Jambigi <[email protected]>
net/smc: free pending qentry in smc_llc_flow_stop() before memset

Mahanta Jambigi <[email protected]>
net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition

Jamal Hadi Salim <[email protected]>
net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue

Eric Dumazet <[email protected]>
inetpeer: randomize RB-tree node comparison using SipHash

Pengpeng Hou <[email protected]>
net: qlcnic: validate unified ROM sections before loading

Tetsuo Handa <[email protected]>
net: add missing ref_tracker_dir_exit() to net_passive_dec()

Ruoyu Wang <[email protected]>
net: ipa: balance runtime PM reference on remove error

Marek Czernohous <[email protected]>
forcedeth: stop the tx_timeout register dump past the requested window

Fan Ye <[email protected]>
net: thunderbolt: Count delivered packets in rx_packets and rx_bytes

Victor Nogueira <[email protected]>
net/sched: add get_fill_size callbacks for actions missing them

Ruoyu Wang <[email protected]>
net: bridge: Reject descending VLAN tunnel ranges

Cen Zhang (Microsoft) <[email protected]>
xsk: fix NULL pointer dereference in __xsk_rcv()

Maciej Fijalkowski <[email protected]>
xsk: avoid double checking against rx queue being full

Maciej Fijalkowski <[email protected]>
xsk: Get rid of xdp_buff_xsk::orig_addr

Serhat Kumral <[email protected]>
RDMA/ucma: Allow path records to exactly fit the output buffer

Haotian Zhang <[email protected]>
ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup

Cássio Gabriel <[email protected]>
ALSA: core: Add scoped cleanup helper for card references

Geert Uytterhoeven <[email protected]>
clk: visconti: Make sure clk_init_data is fully initialized

Geert Uytterhoeven <[email protected]>
clk: ti: Make sure clk_init_data is fully initialized

Bradley Morgan <[email protected]>
prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator

Linkai Gong <[email protected]>
rtc: gamecube: check return value of devm_rtc_register_device()

Ruoyu Wang <[email protected]>
i2c: ocores: Disable clock on failed resume

Biju Das <[email protected]>
irqchip/renesas-rzg2l: Fix loss of interrupt

Pengpeng Hou <[email protected]>
rtc: zynqmp: Return optional clock lookup errors

Christopher Lusk <[email protected]>
smb: client: fix request buffer leak in smb2_new_read_req()

Yi Ding <[email protected]>
rtc: pcf8563: fix clock provider leak on unbind

Li RongQing <[email protected]>
vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

Li RongQing <[email protected]>
virtio_pci: fix wrong queue index for admin vq in intx path

Linfeng Sun  <[email protected]>
vdpa_sim: fix cleanup after worker creation failure

Michael S. Tsirkin <[email protected]>
virtio_balloon: disable indirect descriptors

Jian-Ming Liao <[email protected]>
i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Refactor PIO register initialization

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Quieten initialization messages

Tetsuo Handa <[email protected]>
net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()

Ruoyu Wang <[email protected]>
bonding: initialize err for empty target lists

Nikolay Kulikov <[email protected]>
mlxbf-bootctl: fix the build error with FIELD_PREP()

Guangshuo Li <[email protected]>
platform/x86: hp-bioscfg: fix password encoding bounds check

Nguyen Dinh Phi <[email protected]>
vsock: use sock_error() to consume sk_err after a failed connect

Nguyen Dinh Phi <[email protected]>
vsock: don't check the listener's sk_err in vsock_accept()

Laurence Rowe <[email protected]>
vsock: avoid timeout for non-blocking accept() with empty backlog

HyeongJun An <[email protected]>
platform/x86: dell-wmi-sysman: Fix instance ID bounds

Mahanta Jambigi <[email protected]>
net/smc: hash socket only after full initialisation in smc_sk_init()

Karl Mehltretter <[email protected]>
8139cp: fix Rx and Tx not being disabled in cp_suspend

Baul Lee <[email protected]>
vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()

Xu Rao <[email protected]>
ALSA: hda: Fix connection list comparison in proc output

Baokun Li <[email protected]>
fuse: check for NULL root inode in fuse_fill_super_submount

Zhang Tianci <[email protected]>
fuse: check attributes staleness on fuse_iget()

Joanne Koong <[email protected]>
fuse: convert readdir to use folios

Joanne Koong <[email protected]>
fuse: support folios in struct fuse_args_pages and fuse_copy_pages()

Weiming Shi <[email protected]>

    fs/ntfs3: validate ef->size covers the record's name and value

Konstantin Komarov <[email protected]>
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

Baokun Li <[email protected]>
cuse: wait for pending RCU callbacks on module exit

Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: fix inverted default vlan notification

Maximilian Immanuel Brandtner <[email protected]>
tls: fix RX desync on overlapping skbs

Ruoyu Wang <[email protected]>
net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error

Xiang Mei <[email protected]>
vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

Joas Antonio dos Santos <[email protected]>
ipvs: fix integer overflow in ftp helper port/address parsing

Chao Yu <[email protected]>
f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode

Chao Yu <[email protected]>

    f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}

liujinbao1 <[email protected]>
f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled

Chao Yu <[email protected]>
f2fs: fix to parse temperature correctly in f2fs_get_segment_temp()

Xin Xie <[email protected]>
net: hsr: free learned nodes on device setup failure

Qingfang Deng <[email protected]>
pppox: drain queued packets on channel handoff

Vladimir Oltean <[email protected]>
net: dsa: b53: fix error propagation from b53_fdb_dump()

Junseo Lim <[email protected]>
net: kcm: Hold RCU read lock while running BPF parser

Prabu Thayalan <[email protected]>
ionic: fix completion descriptor access with 2x desc size

Dan Carpenter <[email protected]>
drm/xe: tests: fix error message in xe_migrate_sanity_test()

Karl Mehltretter <[email protected]>
octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()

Mathieu Dubois-Briand <[email protected]>
clk: ti: mux: resolve parent clocks by DT index, not by name

Ethan Carter Edwards <[email protected]>
clk: ti: use kcalloc() instead of kzalloc()

Onur Özkan <[email protected]>
clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()

Michael Nemanov <[email protected]>
nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3

Zhansong Gao <[email protected]>
NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()

ZhangGuoDong <[email protected]>
pnfs/blocklayout: Fix device leaks on parse failure

Ruoyu Wang <[email protected]>
NFSv4: remove callback IDR entry on client allocation failure

Arnaud Bonnet <[email protected]>
nfs: refactor pNFS functions using clear_and_wake_up_bit

Arnaud Bonnet <[email protected]>
nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper

Ze Tan <[email protected]>
smb/server: fix session leak in ksmbd_session_register()

Hang Nan <[email protected]>
ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size

Namjae Jeon <[email protected]>
ksmbd: disconnect on SMB3 decryption failure

Junseo Lim <[email protected]>
bpf: Reject negative optlen in cgroup getsockopt hook

Andreas Schwab <[email protected]>
m68k: nfcon: Do not call console_is_registered() in nfcon_device()

Junseo Lim <[email protected]>
bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks

Ojaswin Mujoo <[email protected]>
erofs: fix unused pcluster_pools for higher page sizes

Gao Xiang <[email protected]>
erofs: support unaligned encoded data

Gao Xiang <[email protected]>
erofs: convert z_erofs_bind_cache() to folios

Junseo Lim <[email protected]>
lwt_bpf: Restore reserved headroom after xmit program

ZhangGuoDong <[email protected]>
smb/server: preserve error status in smb2_handle_negotiate()

ZhangGuoDong <[email protected]>
smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

ZhangGuoDong <[email protected]>
smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()

Namjae Jeon <[email protected]>
ksmbd: free preauth sessions on connection teardown

Namjae Jeon <[email protected]>
ksmbd: do not advertise unimplemented CA support

Yunseong Kim <[email protected]>
ksmbd: validate ipc response length before dereferencing its fields

Enzo Matsumiya <[email protected]>
smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer

Guangshuo Li <[email protected]>
ksmbd: Do not skip lock checks for single-byte ranges

Marius Cristea <[email protected]>
hwmon: (emc1403) Drop hysteresis for low limit temperature

Guenter Roeck <[email protected]>
hwmon: (emc1403) Rely on subsystem locking

Szymon Wilczek <[email protected]>
hwmon: (coretemp) Fix core_data leak on CPUs without PTS

Hongyan Xu <[email protected]>
block: mtip32xx: synchronize ioctls with device removal

Yao Sang <[email protected]>
ublk: reject non-power-of-2 zone sizes in SET_PARAMS

Niklas Cassel <[email protected]>
null_blk: serialize configfs attribute updates with device setup

Zizhi Wo <[email protected]>
null_blk: serialize configfs attribute stores with the lock

Zizhi Wo <[email protected]>
null_blk: reject per-device queue resize for shared tag set

Zizhi Wo <[email protected]>
null_blk: free zones array on device power-off

Zizhi Wo <[email protected]>
null_blk: free global tag_set on init error path

Zizhi Wo <[email protected]>
null_blk: register configfs subsystem after creating default devices

Zizhi Wo <[email protected]>
null_blk: use DEFINE_MUTEX for the file-scope mutex

Huisong Li <[email protected]>
mailbox: pcc: Fix command timeout due to missed interrupt

Sudeep Holla <[email protected]>
Revert "mailbox/pcc: support mailbox management of the shared buffer"

Adam Young <[email protected]>
mailbox/pcc: support mailbox management of the shared buffer

Sudeep Holla <[email protected]>
mailbox: pcc: Always map the shared memory communication address

Linmao Li <[email protected]>
mailbox: rockchip: disable pclk on probe failure and unbind

Jia Yang <[email protected]>
mailbox: qcom-cpucp: handle NULL data in send_data callback

Jia Yang <[email protected]>
mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler

Arnaldo Carvalho de Melo <[email protected]>
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()

Arnaldo Carvalho de Melo <[email protected]>
perf dso: Use stored fd error instead of stale errno in file_read() and file_size()

Arnaldo Carvalho de Melo <[email protected]>
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()

Tao Cui <[email protected]>
sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry

Karl Mehltretter <[email protected]>
crypto: lskcipher - propagate errors from unaligned crypt

Zhushuai Yin <[email protected]>
crypto: hisilicon/sec2 - fix CCM algorithm long packet failure

Israel Téllez García <[email protected]>
bpf: Fix pending_pos walk on 32-bit ring position wrap

Hongyan Xu <[email protected]>
ACPI: scan: fix bus ID cleanup on device_add() failures

Vincent Donnefort <[email protected]>
ring-buffer: Remove trace_buffer::cpus

Pu Lehui <[email protected]>
riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args

Xianglin Lin <[email protected]>
HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU

Pengpeng Hou <[email protected]>
ASoC: SOF: validate topology volume range before allocation

Steven Rostedt <[email protected]>
tracing: Have trace_event_update_all() only handle module that is loading

Masami Hiramatsu (Google) <[email protected]>
tracing: Remove "__attribute__()" from the type field of event format

Aleksandr Nogikh <[email protected]>
ALSA: core: Fix use-after-free in snd_card_do_free()

Zhan Xusheng <[email protected]>
fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

Zhan Xusheng <[email protected]>
fs/ntfs3: fix integer overflow in MFT cluster validation

Jijie Shao <[email protected]>
net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race

Byungchul Park <[email protected]>
page_pool: rename __page_pool_release_page_dma() to __page_pool_release_netmem_dma()

Bart Van Assche <[email protected]>
scsi: ufs: core: Set task state before io_schedule_timeout()

Avri Altman <[email protected]>
scsi: ufs: core: Remove redundant host_lock calls around UTMRLDBR

Chandrakanth Patil <[email protected]>
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers

Eduard Zingerman <[email protected]>
selftests/bpf: Fix for veristat file/prog filters processing

Phillip Lougher <[email protected]>
Squashfs: check block offset is not negative

Krystian Kaniewski <[email protected]>
ocfs2: fix circular locking dependency in ocfs2_init_acl()

Yuan Chen <[email protected]>
bpftool: Fix double close in map dump

Bijan Tabatabai <[email protected]>
x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported

Rui Qi <[email protected]>
selftests/cgroup: Preserve CPU hotplug write errors

Waiman Long <[email protected]>
selftest/cgroup: Clean up and restructure test_cpuset_prs.sh

Waiman Long <[email protected]>
selftest/cgroup: Update test_cpuset_prs.sh to use | as effective CPUs and state separator

Waiman Long <[email protected]>
cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition

everestkc <[email protected]>
cgroup/cpuset: Fix spelling errors in file kernel/cgroup/cpuset.c

John Keeping <[email protected]>
ALSA: seq: midi: Serialize input teardown with event_input

Takashi Iwai <[email protected]>
ALSA: seq: midi: Optimize event_input locking with RCU

Yuho Choi <[email protected]>
clocksource/drivers/armada: Unwind timer clock on init failure

Guangshuo Li <[email protected]>
clocksource/drivers/clps711x: Do not unmap clocksource MMIO

Peter Oberparleiter <[email protected]>
s390/debug: Fix deadlock during unregister

Yuho Choi <[email protected]>
xenbus: Unregister reboot notifier on init failure

Henrik Grimler <[email protected]>
power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address

Henrik Grimler <[email protected]>
power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address

Henrik Grimler <[email protected]>
power: supply: bq27xxx: bq27520g4: fix REG_TTES address

Matti Vaittinen <[email protected]>
power: supply: bd99954: Drop bad register fields

Krishna Chaitanya Chundru <[email protected]>
PCI/ASPM: Disable/restore ASPM on every function for multi-function devices

Bjorn Helgaas <[email protected]>
PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden

Felix Gu <[email protected]>
spi: img-spfi: don't disable runtime PM on DMA deferred probe

Vineet Gupta <[email protected]>
selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM

David Matlack <[email protected]>
selftests: harness: Mark test fixture objects __maybe_unused

Thomas Weißschuh <[email protected]>
selftests: harness: Restore order of test functions

Daniel Borkmann <[email protected]>
bpf, s390: Clear fetch destination on faulting arena atomic

Mohammad Abu-Khader <[email protected]>
kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix

Karl Mehltretter <[email protected]>
super: fix dying superblock warning messages

Krishna Chaitanya Chundru <[email protected]>
PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore

Takashi Sakamoto <[email protected]>
firewire: core: fix memory leak in error path of build_tree()

Takashi Sakamoto <[email protected]>
firewire: core: validate parent port count before allocating nodes in build_tree()

Takashi Sakamoto <[email protected]>
firewire: core: consolidate port counting in build_tree()

Takashi Sakamoto <[email protected]>
firewire: core: add KUnit tests for failure of tree building

Takashi Sakamoto <[email protected]>
firewire: core: add KUnit tests for successful tree building

Takashi Sakamoto <[email protected]>
firewire: core: add KUnit test skeleton for node tree

Ran Hongyun <[email protected]>
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC

Rosen Penev <[email protected]>
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error

Yuho Choi <[email protected]>
mtd: ubi: Release device reference on busy detach

Yuho Choi <[email protected]>
ubi: Fix rollback for explicit UBI device numbers

Zhihao Cheng <[email protected]>
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs

Zhihao Cheng <[email protected]>
UBI: Preserve torture flag when rescheduling failed erasures

LiangCheng Wang <[email protected]>
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready

bui duc phuc <[email protected]>
ASoC: pxa: Use devm_clk_get_optional() for extclk clock

Petr Oros <[email protected]>
ice: clear the default forwarding VSI rule when releasing a VSI

Zhu Yanjun <[email protected]>
RDMA/cma: Fix WARNING in res_to_rt

Fan Wu <[email protected]>
RDMA/cxgb4: Free debugfs on registration failure

Guangshuo Li <[email protected]>
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal

HyeongJun An <[email protected]>
ALSA: seq: Don't leak the extension cell pointer in the bounce payload

Yun Zhou <[email protected]>
nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

Linmao Li <[email protected]>
nfc: digital: Do not dump a NULL response in command completion

Yinhao Hu <[email protected]>
nfc: pn533: hold a reference to the request skb during send_frame

Doruk Tan Ozturk <[email protected]>
nfc: llcp: bound SNL TLV parsing to the skb and add length checks

Zhenghang Xiao <[email protected]>
nfc: nci: fix double completion race in nci_data_exchange_complete

Breno Leitao <[email protected]>

    nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

Breno Leitao <[email protected]>
nfc: llcp: avoid userspace overflow on invalid optlen

Chao Shi <[email protected]>
nvme: reject passthrough of driver-managed Set Features

Yang Xiuwei <[email protected]>
nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

Guixin Liu <[email protected]>
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

Sven Peter <[email protected]>
nvme-apple: Drop the PRP null check chicken bit

Nick Chan <[email protected]>
nvme: apple: Add Apple A11 support

Sven Peter <[email protected]>
nvme-apple: Never set the opcode in the NVMMU TCB

Sven Peter <[email protected]>
nvme-apple: Don't set a DMA direction for commands without a data transfer

Sven Peter <[email protected]>
nvme-apple: Destroy the admin queue on removal

Guixin Liu <[email protected]>
nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

Alistair Francis <[email protected]>
nvme: Add the DHCHAP maximum HD IDs

Guixin Liu <[email protected]>
nvme: introduce change ptpl and iekey definition

Guixin Liu <[email protected]>
nvme: add reservation command's defines

Ilya Leoshkevich <[email protected]>
s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN

Coiby Xu <[email protected]>
s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT

Coiby Xu <[email protected]>
integrity: Make arch_ima_get_secureboot integrity-wide

Thorsten Blum <[email protected]>
powerpc: Use str_enabled_disabled() helper function

Christophe Leroy <[email protected]>
powerpc/vdso: Add a page for non-time data

Jorijn van der Graaf <[email protected]>
ASoC: qcom: q6apm: keep the graph start count in sync with the DSP

Babanpreet Singh <[email protected]>
spi: sprd-adi: Fix probe succeeding without registering the controller

Esteban Urrutia <[email protected]>
phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy

Abel Vesa <[email protected]>
phy: qualcomm: qmp-combo: Add DP offsets and settings for Glymur platforms

Wesley Cheng <[email protected]>
phy: qualcomm: qmp-combo: Update QMP PHY with Glymur settings

Wesley Cheng <[email protected]>
phy: qualcomm: Update the QMP clamp register for V6

Faisal Hassan <[email protected]>
phy: qcom-qmp-combo: Use regulator_bulk_data with init_load_uA for regulator setup

Wesley Cheng <[email protected]>
phy: qcom: qmp-combo: Add new PHY sequences for SM8750

Dmitry Baryshkov <[email protected]>
phy: qualcomm: qmp-combo: add support for SAR2130P

Esteban Urrutia <[email protected]>
phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs

Vasant Hegde <[email protected]>
iommu/amd: Fix incorrect device ID in invalid PASID error message

Michael Walle <[email protected]>
powerpc/configs: enable CONFIG_RAS to fix EDAC support

Runyu Xiao <[email protected]>
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

Weiming Shi <[email protected]>
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

Marco Elver <[email protected]>
arm64: Disable KCSAN instrumentation in delay.o

Chuck Lever <[email protected]>
xdrgen: Fix opaque and string encoders for unbounded members

Chuck Lever <[email protected]>
xdrgen: Do not declare union XDR functions in the definitions header

Chuck Lever <[email protected]>
xdrgen: Address some checkpatch whitespace complaints

Chuck Lever <[email protected]>
xdrgen: Implement big-endian enums

Chuck Lever <[email protected]>
xdrgen: Rename "enum yada" types as just "yada"

Karl Mehltretter <[email protected]>
m68k: Fix backtraces for non-running tasks

Lu Baolu <[email protected]>
iommu/vt-d: Tear down scalable-mode context on probe failure

Lu Baolu <[email protected]>
iommu/vt-d: Clear Present bit before tearing down copied context entry

Desnes Nunes <[email protected]>
iommu/vt-d: Fix UCTP context table slot when copying root entries

Danila Chernetsov <[email protected]>
fbdev: kyro: Validate overlay viewport coordinates

Myeonghun Pak <[email protected]>
fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()

Ian Rogers <[email protected]>
perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads

Ian Rogers <[email protected]>
perf python: Check counts_values size in set_values

Gautam Menghani <[email protected]>
perf python: Add support for 'struct perf_counts_values' to return counter data

Ian Rogers <[email protected]>
perf python: Remove python 2 scripting support

Ian Rogers <[email protected]>
perf test: Fix skiplist leak in cmd_test

Ian Rogers <[email protected]>
perf test: Support dynamic test suites with setup callback and private data

Ian Rogers <[email protected]>
perf test: Send list output to stdout rather than stderr

Ian Rogers <[email protected]>
perf test: Rename functions and variables for better clarity

Ian Rogers <[email protected]>
perf test: Sort tests placing exclusive tests last

Ian Rogers <[email protected]>
perf test: Add a signal handler to kill forked child processes

Ian Rogers <[email protected]>
perf test: Run parallel tests in two passes

Ian Rogers <[email protected]>
perf test: Add a signal handler around running a test

Ian Rogers <[email protected]>
perf test: Display number of active running tests

Arnaldo Carvalho de Melo <[email protected]>
perf test: Introduce workloads__for_each()

Ian Rogers <[email protected]>
perf synthetic-events: Fix uninitialized pthread_join

Ian Rogers <[email protected]>
perf stat: Fix evsel_list leak in cmd_stat

Rosen Penev <[email protected]>
ARM: dts: helios4: add SATA regulator supplies

Rosen Penev <[email protected]>
ARM: dts: helios4: add vcc-supply to GPIO expander

Rosen Penev <[email protected]>
ARM: dts: helios4: add vcc-supply to EEPROM

Tomáš Macholda <[email protected]>
arm64: dts: turris-mox: fix usb3 phys

Guodong Xu <[email protected]>
riscv: cpufeature: Clarify ISA spec version for canonical order

Victor Nogueira <[email protected]>
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss

Nikhil Gautam <[email protected]>
iio: light: gp2ap002: re-enable irq if runtime suspend fails

Nikhil Gautam <[email protected]>
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes

Pu Lehui <[email protected]>
bpf, cgroup: Fix storage null-ptr-deref after replacing prog

Yonghong Song <[email protected]>
bpf: Implement mprog API on top of existing cgroup progs

Yonghong Song <[email protected]>
cgroup: Add bpf prog revisions to struct cgroup_bpf

Ali Ahmet Memis <[email protected]>
Bluetooth: MSFT: validate evt_prefix_len against the response length

Guangshuo Li <[email protected]>
Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative

Sean Wang <[email protected]>
Bluetooth: btmtk: add MT7902 SDIO support

Sean Wang <[email protected]>
Bluetooth: btmtk: add MT7902 MCU support

Sean Wang <[email protected]>
mmc: sdio: add MediaTek MT7902 SDIO device ID

Linmao Li <[email protected]>
Bluetooth: MGMT: free the mesh send cancel command when it is cancelled

Linmao Li <[email protected]>
Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths

Linmao Li <[email protected]>
Bluetooth: hci_conn: fix the SCO setup context lifetime

Zijun Hu <[email protected]>
Bluetooth: btintel: Fix diagnostics event detection

HyeongJun An <[email protected]>
Bluetooth: virtio_bt: avoid OOB read of build info string

Yichong Chen <[email protected]>
btrfs: retry verity reads for not-uptodate Merkle folios

Yang Xiuwei <[email protected]>
scsi: sd: Fix sd_done() sense handling condition

Yang Xiuwei <[email protected]>
scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails

Swarna Prabhu <[email protected]>
scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver

Bart Van Assche <[email protected]>
scsi: sd: Move the sd_config_discard() function definition

Bart Van Assche <[email protected]>
scsi: sd: Move the sd_remove() function definition

Uwe Kleine-König <[email protected]>
scsi: sd: Convert to SCSI bus methods

Uwe Kleine-König <[email protected]>
scsi: core: sysfs: Make use of bus callbacks

Uwe Kleine-König <[email protected]>
scsi: core: Pass a struct scsi_driver to scsi_{,un}register_driver()

Luis Chamberlain <[email protected]>
block/bdev: lift block size restrictions to 64k

Tanushree Shah <[email protected]>
perf trace-event: Fix integer truncation in do_read() and skip()

Zijun Hu <[email protected]>
Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices

Zijun Hu <[email protected]>
Bluetooth: btusb: Record matched usb_device_id into btusb_data

Johan Hovold <[email protected]>
Bluetooth: btusb: refactor endpoint lookup

Zijun Hu <[email protected]>
Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()

Zijun Hu <[email protected]>
Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event

Ricardo Neri <[email protected]>
sched/fair: Check CPU capacity before comparing group types during load balance

Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix stop/start with no update

Adrian Hunter <[email protected]>
perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED

Adrian Hunter <[email protected]>
perf/x86/intel/pt: Factor out pt_config_enable()

Adrian Hunter <[email protected]>
perf/x86/intel/pt: Add support for pause / resume

Yuho Choi <[email protected]>
ACPI: video: Release PCI device reference after lookup

Kamal Wadhwa <[email protected]>
regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling

Yeoreum Yun <[email protected]>
coresight: etm4x: fix leaked trace id

Yeoreum Yun <[email protected]>
coresight: etm4x: fix underflow for usage of (nrseqstate - 1)

James Clark <[email protected]>
coresight: Change syncfreq to be a u8

Yeoreum Yun <[email protected]>
coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()

Bruce Johnston <[email protected]>
md/raid1: don't set array_frozen in raid1_takeover()

Yu Kuai <[email protected]>
md: avoid stale clone I/O accounting timestamps

Yu Kuai <[email protected]>
md/raid5: round bitmap stripes with sector division

Loic Poulain <[email protected]>
phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend

Loic Poulain <[email protected]>
phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend

Loic Poulain <[email protected]>
phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend

Mohd Ayaan Anwar <[email protected]>
phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads

Russell King (Oracle) <[email protected]>
phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()

Linkai Gong <[email protected]>
soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()

Yichong Chen <[email protected]>
hugetlbfs: release subpool on fill_super failure

Simon Glass <[email protected]>
pinctrl: rockchip: Reset the pin count when recalculating SoC data

Mukesh Ojha <[email protected]>
firmware_loader: do not queue completed sysfs fallback requests

Manish Rangankar <[email protected]>
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Use PFP on the compute queues too

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets

Tanushree Shah <[email protected]>
perf trace-event: Fix buffer overflow in read_string()

Gerald Loacker <[email protected]>
phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table

Felix Gu <[email protected]>
phy: sunplus: fix error handling in sp_uphy_init()

Meghana Malladi <[email protected]>
arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node

Jan Kara <[email protected]>
ext4: fix spurious message about orphan cleanup on RO fs

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Fixup emit_cntxcntl()

Pengpeng Hou <[email protected]>
mfd: iqs62x: Reject zero-length firmware records

Pengpeng Hou <[email protected]>
mfd: rave-sp: validate received frame payload lengths

Vladimir Murzin <[email protected]>
arm64: hibernate: Restore DAIF state on error

Ada Couprie Diaz <[email protected]>
arm64: hibernate: mask DAIF before restoring hibernated kernel

Felix Fietkau <[email protected]>
wifi: mac80211: skip default WMM setup for AP_VLAN links

Leon Romanovsky <[email protected]>
RDMA/erdma: restrict the driver to little-endian systems

Petr Pavlu <[email protected]>
module/dups: Fix use-after-free in kmod_dup_req lifetime handling

Petr Pavlu <[email protected]>
module/dups: Inform duplicate requests about the result directly

Naveen Kumar Chaudhary <[email protected]>
module: use strscpy() to copy module names in stats and dup tracking

Marco Crivellari <[email protected]>
module: replace use of system_wq with system_dfl_wq

Shuangpeng Bai <[email protected]>
RDMA/siw: Fix use-after-free in siw_accept()

Yehyeong Lee <[email protected]>
IB/isert: post the full-feature receive buffers after session registration

Yehyeong Lee <[email protected]>
IB/isert: delay the final Login Response until the session is registered

Karl Mehltretter <[email protected]>
cpufreq: imx6q: fix out-of-bounds write when probed more than once

Karl Mehltretter <[email protected]>
cpufreq: imx6q: fix devres accumulation across driver rebind

Jernej Skrabec <[email protected]>
drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz

Jernej Skrabec <[email protected]>
drm/sun4i: dw-hdmi: Drop TCON TOP port reference

Jernej Skrabec <[email protected]>
drm/sun4i: tcon: Drop remote endpoint reference

Jernej Skrabec <[email protected]>
drm/sun4i: crtc: Propagate layer initialization error

Jernej Skrabec <[email protected]>
drm/sun4i: hdmi: Don't leak sync polarity bits into packet control

Jernej Skrabec <[email protected]>
drm/sun4i: tcon: Drop TCON TOP device reference

Jernej Skrabec <[email protected]>
drm/sun4i: tcon: Set output mux for DSI and LVDS

Kuninori Morimoto <[email protected]>
of: property: add of_graph_get_next_port_endpoint()

Kuninori Morimoto <[email protected]>
of: property: add of_graph_get_next_port()

Jernej Skrabec <[email protected]>
drm/sun4i: vi scaler: Fix coefficient selection

Alexey Charkov <[email protected]>
clk: rockchip: rk3576: fix source muxes for SPI0..SPI4

Cen Zhang <[email protected]>
ocfs2: synchronize heartbeat callbacks with o2net teardown

Xie Yuanbin <[email protected]>
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults

Linus Walleij <[email protected]>
ARM: 9481/2: breakpoint: CFI breakpoints only on demand

Yehyeong Lee <[email protected]>
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ

Cheng Xu <[email protected]>
RDMA/erdma: Hold QP references for AE and CM processing

Cheng Xu <[email protected]>
RDMA/erdma: Hold CQ references when processing EQ events

Robertus Diawan Chris <[email protected]>
modpost: prevent leak when early return no suffix .o in read_symbols()

Sergei Litvin <[email protected]>
scripts/tags.sh: Prevent binary files appearing in cscope.files

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies

Sayali Patil <[email protected]>
selftests/mm: fix ternary operator precedence in ksm_tests

Sayali Patil <[email protected]>
selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes

Mike Rapoport (Microsoft) <[email protected]>
selftests/mm: ksm_tests: use kselftest framework

Li Wang <[email protected]>
ksm_tests: skip hugepage test when Transparent Hugepages are disabled

Donet Tom <[email protected]>
selftests/mm: add new test cases to the migration test

Pu Lehui <[email protected]>
bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed

Mukesh Ojha <[email protected]>
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

Mukesh Ojha <[email protected]>
remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()

Mukesh Ojha <[email protected]>
remoteproc: Move resource table data structure to its own header

Imran Shaik <[email protected]>
arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC

Andreas Kemnade <[email protected]>
drm/omap: dsi: Do not copy isr table

Inochi Amaoto <[email protected]>

    riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller

Yichong Chen <[email protected]>
fat: release buffer head after rebuilding parent

Guangshuo Li <[email protected]>

    rapidio: clear mport->net when rio_add_net() fails

Calvin Owens <[email protected]>
pps-gpio: remove dead capture_clear code

Michael Byczkowski <[email protected]>
pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler

Bastien Curutchet <[email protected]>
pps: clients: gpio: Bypass edge's direction check when not needed

Calvin Owens <[email protected]>
pps: don't try to wait for negative timeouts in PPS_FETCH

Bradley Morgan <[email protected]>
lib/string: fix memchr_inv() for large ranges

Cen Zhang <[email protected]>
ocfs2/cluster: keep heartbeat local node stable

Al Viro <[email protected]>
o2hb_region_dev_store(): avoid goto around fdget()/fdput()

Caleb Sander Mateos <[email protected]>
ublk: check for ublk_unmap_io() returning 0

Tao Cui <[email protected]>
block/kyber-iosched: flush per-cpu latency buckets over possible CPUs

Tao Cui <[email protected]>
block/blk-iocost: collect per-cpu latency stats over possible CPUs

Tao Cui <[email protected]>
block/blk-stat: drain per-cpu callback stats over possible CPUs

Zheng Qixing <[email protected]>
blk-cgroup: skip dying blkg in blkcg_activate_policy()

Breno Leitao <[email protected]>
phonet: pep: do not write beyond optlen in getsockopt

Zxyan Zhu <[email protected]>
net: stmmac: Skip PHY attach if custom PCS is in use

Sang-Heon Jeon <[email protected]>
iio: light: tsl2583: return zero in write_raw() on success

Sang-Heon Jeon <[email protected]>
iio: light: isl29028: return zero in write_raw() on success

Yuanshen Cao <[email protected]>
iio: light: tsl2772: fix ALS calibscale readback

Arnaldo Carvalho de Melo <[email protected]>
perf intel-bts: Fix off-by-one in auxtrace_info minimum size check

Arnaldo Carvalho de Melo <[email protected]>
perf intel-pt: Fix off-by-one in auxtrace_info minimum size check

Arnaldo Carvalho de Melo <[email protected]>
perf auxtrace: Fix queue grow overflow and old array leak

Arnaldo Carvalho de Melo <[email protected]>
perf thread-stack: Fix heap buffer overflow on branch stack wrap copy

Jiancheng Huang <[email protected]>
HID: lg4ff: validate report length before fixed offsets

Chao Huang <[email protected]>
HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure

Ai Chao <[email protected]>
HID: i2c-hid: Fix "(null)" output when reading report descriptor fails

Yousef Alhouseen <[email protected]>
HID: synchronize input before cleaning up a failed probe

谢致邦 (XIE Zhibang) <[email protected]>
HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver

Karl Mehltretter <[email protected]>
tty: clear cdev pointer after cdev_add() failure

Karl Mehltretter <[email protected]>
serial: amba-pl011: unprepare console clock on unregister

Thomas Bogendoerfer <[email protected]>
MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL

Saket Kumar Bhaskar <[email protected]>
powerpc/irq: Fix missing r2 clobber in PCREL inline assembly

Gou Hao <[email protected]>
powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass

Laxman Acharya Padhya <[email protected]>
firmware: coreboot: Validate table bounds

Titouan Ameline de Cadeville <[email protected]>
firmware: google: Add bounds checks in coreboot_table_populate()

Johannes Berg <[email protected]>
wifi: mac80211: disconnect on CSA to channel 0

Zhao Li <[email protected]>
wifi: mac80211: skip unused probe response countdown offsets

Slawomir Stepien <[email protected]>
wifi: zd1211rw: reject secondary interfaces to prevent conflicts

Zhao Li <[email protected]>
wifi: mac80211: send TWT teardown to peer after setup TX failure

Davidlohr Bueso <[email protected]>
perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register

Pranjal Shrivastava <[email protected]>
iommu/arm-smmu-v3: Convert to use atomic poll timeout

Linghui Wu <[email protected]>
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump

shengwei.lu <[email protected]>
wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum

Javier Tia <[email protected]>
wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: report RX chain signal for all RX paths

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1

StanleyYP Wang <[email protected]>
wifi: mt76: mt7996: fix reg addr remap when addr is 0

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: release hif2 reference on probe IRQ failure

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: fix ext PHY use-after-free on register error path

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: fix double hif2 init on the non-WED path

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement

Yonghong Song <[email protected]>
bpf, x86: Fix trampoline stack size for 128-bit arguments

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Check snprintf truncation for guest kallsyms path

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Free scandir entries in guest kernel map creation

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Reset errno before strtol in guest kernel map creation

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Don't abort guest map creation on first inaccessible dir

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Check snprintf truncation in machines__findnew()

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Use snprintf() for guestmount path construction

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Guard against NULL strlist in machines__findnew()

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Fix NULL parent dereference in fork event processing

Joy Zou <[email protected]>
regulator: core: use system_freezable_wq for init complete work

Jeff Johnson <[email protected]>
wifi: ath11k: fix leak in ath11k_service_ready_ext_event()

Konrad Dybcio <[email protected]>
drm/msm/dsi: Drop dev_pm_opp_set_rate(0)

Konrad Dybcio <[email protected]>
drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)

Leo Yan <[email protected]>
perf: arm_spe: Make wakeup range check overflow safe

Can Peng <[email protected]>
ACPI: processor: Unregister cpufreq notifier on init failure

Huisong Li <[email protected]>
ACPI: processor: idle: Optimize ACPI idle driver registration

Felix Fietkau <[email protected]>
wifi: mt76: only consume the WO drop bit on WED v2 devices

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields

Felix Fietkau <[email protected]>
wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: unwind state on add_interface failure

Felix Fietkau <[email protected]>

    wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config

Rex Lu <[email protected]>
wifi: mt76: check txfree done event on the WED hw path

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie

Felix Fietkau <[email protected]>
wifi: mt76: fix stranded frames in mt76_txq_schedule_pending

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: write RX header translation bit to the correct register

Felix Fietkau <[email protected]>
wifi: mt76: mt7996: don't report a zero TX bitrate

Felix Fietkau <[email protected]>

    wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear

Felix Fietkau <[email protected]>
wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset

Felix Fietkau <[email protected]>

    wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]

Michael-CY Lee <[email protected]>
wifi: mt76: fix non-AQL packet accounting for MLO stations

Shayne Chen <[email protected]>
wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU

Eason Lai <[email protected]>
wifi: mt76: mt792x: Fix memory leak in SDIO TX path

Jared.Huang <[email protected]>
wifi: mt76: mt7925: fix msg len mismatch between driver and firmware

Eason Lai <[email protected]>
wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete

Sean Wang <[email protected]>
wifi: mt76: add init_wiphy callback

Zhi-Jun You <[email protected]>

    wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986

Laxman Acharya Padhya <[email protected]>
wifi: mt76: mt7921: validate CLC firmware records

Devin Wittmayer <[email protected]>
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length

Yichong Chen <[email protected]>
fanotify: report full event length for FIONREAD

Muhammad Usama Anjum <[email protected]>
misc: sgi-gru: remove interrupt-context page-table walks

Abdun Nihaal <[email protected]>
misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()

Jinjie Ruan <[email protected]>
powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()

Naveen Kumar Chaudhary <[email protected]>
locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

Martin Wilck <[email protected]>
md/raid1: create serial pool adding rdev to array with serialize_policy=1

Yu Kuai <[email protected]>
md: merge mddev serialize_policy into mddev_flags

Yu Kuai <[email protected]>
md: merge mddev faillast_dev into mddev_flags

Yu Kuai <[email protected]>
md: merge mddev has_superblock into mddev_flags

Adrian Hunter <[email protected]>
i3c: master: Fix device_register() error path

Jakub Kicinski <[email protected]>
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices

Aneesh Kumar K.V (Arm) <[email protected]>
swiotlb: Preserve allocation virtual address for dynamic pools

Aneesh Kumar K.V (Arm) <[email protected]>
iommu/dma: Check atomic pool allocation result directly

Chen Cheng <[email protected]>
md: scope memalloc_noio to allocation critical sections

Abd-Alrhman Masalkhi <[email protected]>
md: skip redundant raid_disks update when value is unchanged

Chen Cheng <[email protected]>
md: remove unused mddev argument from export_rdev

Chen Cheng <[email protected]>
md/bitmap: resume array on backlog_store() error path

Vladimir Zapolskiy <[email protected]>
clk: qcom: Return expected ENOMEM error on dynamic allocation failure

Imran Shaik <[email protected]>
clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable

Stanislav Kinsburskii <[email protected]>
lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone

Pu Lehui <[email protected]>
bpf: Fix potential UAF when reading bpf link info

Pu Lehui <[email protected]>
bpf: Fix potential UAF in bpf_netns_link_update_prog

Hongyan Xu <[email protected]>
power: supply: sc2731_charger: cancel work on remove

Hongyan Xu <[email protected]>
power: supply: isp1704_charger: cancel work on remove

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries

Neil Armstrong <[email protected]>
arm64: dts: qcom: sm8650: add OPP table support to PCIe

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>

    arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries

Dawid Wróbel <[email protected]>
arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID

Mukesh Ojha <[email protected]>
firmware: qcom: scm: Fix tzmem state on probe retry

Mukesh Ojha <[email protected]>
firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published

Yuvaraj Ranganathan <[email protected]>
firmware: qcom: scm: instrument SMC call path with tracepoints

Yuvaraj Ranganathan <[email protected]>
firmware: qcom: scm: add trace events for the SMC call interface

Unnathi Chalicheemala <[email protected]>
firmware: qcom_scm: Support multiple waitq contexts

Unnathi Chalicheemala <[email protected]>
firmware: qcom_scm: Add API to get waitqueue IRQ info

Konrad Dybcio <[email protected]>

    arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en

Dmitry Baryshkov <[email protected]>
clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration

Krishna Kurapati <[email protected]>
arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property

Konrad Dybcio <[email protected]>
arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep

Itai Handler <[email protected]>

    rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs

Jeff Johnson <[email protected]>
wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()

Jeff Johnson <[email protected]>
wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()

Alexei Starovoitov <[email protected]>
slab: Reuse first bit for OBJEXTS_ALLOC_FAIL

Alexei Starovoitov <[email protected]>
slab: Make slub local_(try)lock more precise for LOCKDEP

Vlastimil Babka <[email protected]>
slab: simplify init_kmem_cache_nodes() error handling

Cheng-Han Wu <[email protected]>
selftests/zram: fix kernel_gte() for POSIX sh

Abd-Alrhman Masalkhi <[email protected]>
md: recheck spare changes before starting sync

Thomas Weißschuh <[email protected]>
tools/nolibc/powerpc: mark ctr and xer as clobbered by system call

Chen Cheng <[email protected]>
md/raid5: protect lockless recovery_offset accesses during reshape

Yu Kuai <[email protected]>
md: add a new recovery_flag MD_RECOVERY_LAZY_RECOVER

Li Nan <[email protected]>
md: rename recovery_cp to resync_offset

Zheng Qixing <[email protected]>
md: allow removing faulty rdev during resync

Li Nan <[email protected]>
md: ensure resync is prioritized over recovery

Sajal Gupta <[email protected]>
md/raid5-ppl: fix use-after-free in ppl_do_flush()

Chen Cheng <[email protected]>
md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency

Yuho Choi <[email protected]>
bus: mhi: host: Fix controller cleanup on EDL sysfs failure

Manivannan Sadhasivam <[email protected]>
bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET

Abdun Nihaal <[email protected]>
wifi: rtlwifi: pci: fix error path in rtl_pci_probe()

Hongyan Xu <[email protected]>
platform/chrome: cros_ec_debugfs: Unregister panic notifier

Hongyan Xu <[email protected]>
platform/chrome: cros_ec_debugfs: Clean up console log on probe failure

Ali Tariq <[email protected]>
PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe

Ali Tariq <[email protected]>
PCI: starfive: Fix Runtime PM handling and teardown ordering

Jeff Johnson <[email protected]>
wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()

Fan Wu <[email protected]>
spi: davinci: switch to managed controller allocation

Guixin Liu <[email protected]>
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request

Yehyeong Lee <[email protected]>
IB/isert: reject login PDUs declaring more data than was received

Yehyeong Lee <[email protected]>
IB/isert: reject PDUs declaring more data than was received

Leon Romanovsky <[email protected]>
RDMA/cxgb4: free STAG index when TPT entry write fails

Leon Romanovsky <[email protected]>
RDMA/mlx5: Send cong param changes to the resolved port mdev

Leon Romanovsky <[email protected]>
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

David Strahan <[email protected]>
scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.

Ryusuke Konishi <[email protected]>
nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

David Lee <[email protected]>
nilfs2: prevent out-of-bounds read in super root block parsing

Joshua Crofts <[email protected]>
nilfs2: fix infinite loop in nilfs_clean_segments()

Alexey Charkov <[email protected]>
clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs

Akari Tsuyukusa <[email protected]>
clk: mediatek: mt8135: Fix inverted gate control for devapc_ck

longlong yan <[email protected]>
clk/x86: pmc_atom: add kasprintf return value check

Myeonghun Pak <[email protected]>
clk: palmas: Manage external-control prepare with devm

Guangshuo Li <[email protected]>
clk: tegra: tegra124-emc: put EMC node on register failure

Ondrej Jirman <[email protected]>
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix

Zhao Li <[email protected]>
wifi: mac80211: fix per-STA profile length in cross-link CSA parsing

Yonatan Nachum <[email protected]>
RDMA/efa: Fix PBL chunk length computation

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Use request_threaded_irq

Weiming Shi <[email protected]>
fs/ntfs3: reject restart table growth beyond U16_MAX entries

Ivy Lopez <[email protected]>
staging: rtl8723bs: use kfree_sensitive() for key material

Bjorn Andersson <[email protected]>
remoteproc: Prevent crash handling to race with rproc_del()

Jingyi Wang <[email protected]>
remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()

Bjorn Andersson <[email protected]>
remoteproc: Allow shutdown of crashed processors

Peng Fan <[email protected]>
remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()

Babanpreet Singh <[email protected]>

    w1: ds2482: Fix signedness bug in ds2482_w1_triplet()

Fan Wu <[email protected]>
spi: oc-tiny: switch to managed controller allocation

Yichong Chen <[email protected]>
isofs: release zisofs block pointer buffer head

Sumeet Pawnikar <[email protected]>
powercap: intel_rapl_tpmi: Handle PMU registration failure during probe

Maher Sanalla <[email protected]>
RDMA/mlx5: Fix integer overflow of user QP buffer size

Can Peng <[email protected]>
crypto: keembay - publish OF module alias for OCS AES/SM4

Linmao Li <[email protected]>
crypto: keembay - Initialize completion before requesting IRQ

Li Qiang <[email protected]>
scsi: ufs: debugfs: Reserve space for a string terminator

Babanpreet Singh <[email protected]>
power: supply: sbs-battery: Use a per-device serial number buffer

James Clark <[email protected]>
tools/build: Allow versioning of all LLVM tools defined in Makefile.include

Tomas Glozar <[email protected]>
tools/build: Add bpftool-skeletons feature test

Justin Yeh <[email protected]>
pinctrl: mediatek: free EINT resources on unbind

Nícolas F. R. A. Prado <[email protected]>
pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms

Hao Chang <[email protected]>
pinctrl: mediatek: Fix the invalid conditions

Hao Chang <[email protected]>
pinctrl: mediatek: Add EINT support for multiple addresses

Alison Schofield <[email protected]>
cxl/region: Fix use-after-free in find_pos_and_ways() error path

Feng Yang <[email protected]>
selftests/bpf: Fix memory leak on subtest_states reallocation

Feng Yang <[email protected]>
selftests/bpf: Fix incorrect error checking for pthread_create

Karl Mehltretter <[email protected]>
ARM: lpc32xx: only run SoC init on LPC32xx hardware

Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt

Osama Abdelkader <[email protected]>
drm/panthor: return PTR_ERR() from devm_drm_dev_alloc()

Weiming Wu <[email protected]>
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init

Florian Westphal <[email protected]>
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet

Can Peng <[email protected]>
drm/tve200: add OF module alias for autoloading

Cosmo Chou <[email protected]>
leds: pca9532: Fix phantom device registration on missing hardware

Malaya Kumar Rout <[email protected]>
PM: hibernate: Fix memory leak in snapshot_write_next() error path

Leon Romanovsky <[email protected]>
RDMA/erdma: complete object teardown when the destroy command fails

Boshi Yu <[email protected]>
RDMA/erdma: Support non-sleeping erdma_post_cmd_wait()

Boshi Yu <[email protected]>
RDMA/erdma: Fix incorrect response returned from query_qp

Boshi Yu <[email protected]>
RDMA/erdma: Add the query_qp command to the cmdq

Boshi Yu <[email protected]>
RDMA/erdma: Refactor the code of the modify_qp interface

Boshi Yu <[email protected]>
RDMA/erdma: Add erdma_modify_qp_rocev2() interface

Boshi Yu <[email protected]>
RDMA/erdma: Add address handle implementation

Boshi Yu <[email protected]>
RDMA/erdma: Add the erdma_query_pkey() interface

Boshi Yu <[email protected]>
RDMA/erdma: Add GID table management interfaces

Boshi Yu <[email protected]>
RDMA/erdma: Probe the erdma RoCEv2 device

Sanghyun Park <[email protected]>
xfrm: Fix skb double-free in xfrm_dev_direct_output()

Leo Yan <[email protected]>
perf cs-etm: Avoid truncating AUX buffer sizes to int

Leo Yan <[email protected]>
perf cs-etm: Flush thread stacks after decoder reset

Sudeep Holla <[email protected]>
firmware: arm_scmi: Unrequest devices if driver registration fails

Sudeep Holla <[email protected]>
firmware: arm_scmi: Roll back partial protocol table registration

Marco Scardovi <[email protected]>
cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems

Lifeng Zheng <[email protected]>
ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel()

Lifeng Zheng <[email protected]>
ACPI: CPPC: Refactor register value get and set ABIs

Lifeng Zheng <[email protected]>
ACPI: CPPC: Add cppc_set_reg_val()

Lifeng Zheng <[email protected]>
ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val()

Lifeng Zheng <[email protected]>
ACPI: CPPC: Optimize cppc_get_perf()

Lifeng Zheng <[email protected]>
ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional

Mario Limonciello <[email protected]>
cpufreq/amd-pstate: Store the boost numerator as highest perf again

Andre Przywara <[email protected]>
ARM: dts: allwinner: a10: Fix PMU interrupt

Xiang Mei <[email protected]>
ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

Guanghui Yang <[email protected]>
ext4: fix buffer_head leak in ext4_init_orphan_info

Selvin Xavier <[email protected]>
RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap

Jeff Johnson <[email protected]>
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

Jeff Johnson <[email protected]>
wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()

Jeff Johnson <[email protected]>
wifi: ath11k: Correctly copy the hint BSSID in WMI scan request

Jeff Johnson <[email protected]>
wifi: ath12k: Correctly copy the hint BSSID in WMI scan request

Jeff Johnson <[email protected]>
wifi: ath6kl: avoid buffer overreads in WMI event handlers

Baokun Li <[email protected]>
ext4: drain in-flight DIO before buffered write fallback

Gerald Yang <[email protected]>
ext4: clear stale xarray tags on folios skipped during writeback

Pengpeng Hou <[email protected]>
thermal: intel: int3400: clean up ODVP on probe failures

Mukesh Ojha <[email protected]>
iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()

Haoxiang Li <[email protected]>
iommu/qcom: Remove sysfs device on probe failure path

Sudeep Holla <[email protected]>
firmware: arm_scmi: Fix requested device removal race

Patrisious Haddad <[email protected]>
RDMA/core: Fix potential use after free in ib_dealloc_pd_user()

Patrisious Haddad <[email protected]>
RDMA/core: Fix potential use after free in ib_free_cq()

Mark Zhang <[email protected]>
RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq()

Patrisious Haddad <[email protected]>
RDMA/core: Fix potential use after free in counter_release()

Patrisious Haddad <[email protected]>
RDMA/core: Fix potential use after free in ib_destroy_srq_user()

Patrisious Haddad <[email protected]>
RDMA/core: Fix potential use after free in ib_destroy_cq_user()

Patrisious Haddad <[email protected]>
RDMA/core: Fix use after free in ib_query_qp()

Patrisious Haddad <[email protected]>
RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations

Jason Gunthorpe <[email protected]>

    RDMA/nldev: Fix locking when accessing mr->pd

Kalesh AP <[email protected]>
RDMA/restrack: Fix typos in the comments

Myeonghun Pak <[email protected]>
RDMA/erdma: Fix CEQ tasklet use-after-free on removal

Takuma Fujiwara <[email protected]>
PCI: j721e: Fix incorrect max_lanes for J7200

Leon Romanovsky <[email protected]>
RDMA/srpt: Pass the mapped task attribute to target_init_cmd()

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Preserve unique-field state across nested structs

Rafael J. Wysocki <[email protected]>
ACPI: battery: Adjust charging status validation check

Pu Lehui <[email protected]>
riscv, bpf: Fix memory leak in bpf_jit_free

Ricardo B. Marlière <[email protected]>
libbpf: Search /lib64 and /lib in resolve_full_path()

Yun Zhou <[email protected]>
ext4: skip extra isize expansion during mount to prevent deadlock

Xiang Mei <[email protected]>
ext4: fix out-of-bounds read in ext4_read_inline_dir()

Yun Zhou <[email protected]>
ext4: fix circular lock dependency in ext4_ext_migrate

Chen Pei <[email protected]>
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root

Pengpeng Hou <[email protected]>
ACPI: processor: validate MADT IOAPIC entry bounds

Zhu Ling <[email protected]>
ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer

Pengpeng Hou <[email protected]>
RDMA/nldev: validate dynamic counter attribute length

Kemeng Shi <[email protected]>
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()

Viktor Malik <[email protected]>
selftests/bpf: Silence array bounds warning in global_map_resize

Frank Li <[email protected]>
arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0

Marco Elver <[email protected]>
kcsan: avoid unintended access checking in NMIs

TanZheng <[email protected]>
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

Ibrahim Hashimov <[email protected]>

    RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]

Danila Chernetsov <[email protected]>
RDMA/hfi1: Propagate sdma_txinit_ahg() errors

Jun Yan <[email protected]>
arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe

Jun Yan <[email protected]>
arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins

Can Peng <[email protected]>
phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe

Can Peng <[email protected]>
phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe

Linmao Li <[email protected]>
ASoC: meson: Keep link pointers valid on realloc failure

Koichiro Den <[email protected]>
dmaengine: dw-edma: Clear stale requests on termination

Koichiro Den <[email protected]>
dmaengine: dw-edma: Serialize channel state checks

Koichiro Den <[email protected]>
dmaengine: dw-edma: Serialize abort state updates

Koichiro Den <[email protected]>
dmaengine: dw-edma: Terminate all descriptors without callbacks

Yiyang Chen <[email protected]>
bpf: Reject arena frees below the arena base

Puranam V G Tejaswi <[email protected]>
drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg

Yuho Choi <[email protected]>
driver core: soc: Unregister bus on early device registration failure

Alban Bedel <[email protected]>
software node: Fix software_node_get_reference_args() with index -1

Ian Rogers <[email protected]>
perf ui hists: Fix uninitialized stack memory free on pstack allocation failure

zhouminqiang <[email protected]>
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

Ruoyu Wang <[email protected]>
mtd: mtdswap: Avoid freeing registered blktrans device twice

Pengpeng Hou <[email protected]>
soc: ti: knav_qmss: Remove debugfs file on teardown

Md Shofiqul Islam <[email protected]>
soc: ti: knav_qmss_queue: Implement resource cleanup in remove()

Xiang Mei <[email protected]>

    vfio/pci: clear vdev->msi_perm after freeing it on init failure

Myeonghun Pak <[email protected]>
char: xilinx_hwicap: unregister class on init errors

Pei Xiao <[email protected]>
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove

Linmao Li <[email protected]>
ppdev: prevent overflow when setting port timeout

Breno Leitao <[email protected]>
cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)

Pengpeng Hou <[email protected]>
misc: ad525x_dpot: use driver core groups for sysfs files

Gleb Markov <[email protected]>
misc: rtsx: add missing write register handling

Gui-Dong Han <[email protected]>
misc: bcm-vk: Use acquire/release for msgq_inited

Pavel Zhigulin <[email protected]>
speakup: keyhelp: guard letter_offsets possible out-of-range indexing

Christophe JAILLET <[email protected]>
accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()

Yuho Choi <[email protected]>
uio: Fix stale info pointer in failed registration path

David Lee <[email protected]>
UDF symlink pathComponent header OOB read

Karl Mehltretter <[email protected]>
tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64

Xu Yang <[email protected]>
usb: gadget: f_uac1_legacy: remove broken string configfs attributes

Rafael J. Wysocki <[email protected]>
ACPI: processor: idle: Expand _LPI package sanity checks

Thorsten Blum <[email protected]>
crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping

Pu Lehui <[email protected]>
bpf: Sync tail_call_reachable with callee state on entry

Shivam Rawat <[email protected]>
drm/msm/a6xx: Fix stale rpmh votes after suspend

Mikko Perttunen <[email protected]>
gpu: host1x: Avoid stack over-read in debug output helpers

Mikko Perttunen <[email protected]>
gpu: host1x: Fix offset calculation in trace_write_gather

Avraham Stern <[email protected]>
wifi: iwlwifi: mei: pass correct argument to function

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments

Avraham Stern <[email protected]>
wifi: iwlwifi: mei: check SAP message length before reading it

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs

Ian Rogers <[email protected]>
perf jevents: Add more components to the metric sorting order

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8250: sort out Iris power domains

Pengyu Luo <[email protected]>

    arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin

Konrad Dybcio <[email protected]>
arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO

Maoyi Xie <[email protected]>
drm/bridge: tc358767: clamp the reported AUX read size to the request

Uday Khare <[email protected]>

    remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev

Zhongqiu Han <[email protected]>
cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()

Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Fix setting minimum P-state at init time

Gleb Markov <[email protected]>
drm/amd/display: Remove unused-but-set variable hubp from

Ruoyu Wang <[email protected]>
media: ipu6: Do not free aux device pdata after init

Eugen Hristev <[email protected]>
media: bcm2835-unicam: Fix asc leaked in error/remove path

Biren Pandya <[email protected]>
media: i2c: rdacm21: Fix missing media_entity_cleanup()

Qingshuang Fu <[email protected]>
irqchip/renesas-irqc: Fix generic interrupt chip leak on remove

Yuho Choi <[email protected]>
PCI: xgene: Drop unnecessary OF node reference

Marc Zyngier <[email protected]>
PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN

Dan Carpenter <[email protected]>
cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()

John Groves <[email protected]>
dax: read holder_ops once in dax_holder_notify_failure()

Bryam Vargas <[email protected]>
libnvdimm/labels: Bound the on-media label size before the shift

Sudeep Holla <[email protected]>
firmware: arm_scmi: Unwind P2A receiver mailbox setup failure

Sudeep Holla <[email protected]>
firmware: arm_scmi: Unwind TX receiver mailbox setup failure

Sudeep Holla <[email protected]>
firmware: arm_scmi: Drop handle on protocol bind failures

Sudeep Holla <[email protected]>
firmware: arm_scmi: Protect device request lookup with RCU

Sudeep Holla <[email protected]>
firmware: arm_scmi: Use channel ID for transport teardown

Sudeep Holla <[email protected]>
firmware: arm_scmi: Reject out of range DT protocol IDs

Sudeep Holla <[email protected]>
firmware: arm_scmi: Avoid IDR updates while cleaning channels

Sudeep Holla <[email protected]>
firmware: arm_scmi: Free transport channel on IDR failure

Sudeep Holla <[email protected]>
firmware: arm_scmi: Clean up channels on setup failure

Sudeep Holla <[email protected]>
firmware: arm_scmi: Quiesce notifications before teardown

Sudeep Holla <[email protected]>
firmware: arm_scmi: Unregister device notifier before IDR teardown

Sudeep Holla <[email protected]>
firmware: arm_scmi: Publish channel state before callbacks

David Stevens <[email protected]>
x86/entry/fred: Encode frame pointer on entry

Baochen Qiang <[email protected]>
wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate

Kyle Zeng <[email protected]>
hfsplus: validate thread record before delete key rebuild

HE WEI（ギカク） <[email protected]>
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

Nirbhay Sharma <[email protected]>
fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list

Konstantin Komarov <[email protected]>
fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Konstantin Komarov <[email protected]>
fs/ntfs3: Add more checks in mi_enum_attr (part 2)

Dave Jiang <[email protected]>
cxl/pci: Honor -EPROBE_DEFER from component register setup

Dave Jiang <[email protected]>
cxl/mbox: Break poison list loop on an empty payload

Guzebing <[email protected]>
cxl/memdev: Fix firmware upload exact-fit handling

Vishnu Santhosh <[email protected]>
rpmsg: glink: fix deadlock in endpoint destroy during driver detach

Srinivas Kandagatla <[email protected]>
rpmsg: glink: remove duplicate code for rpmsg device remove

Hans Verkuil <[email protected]>
media: v4l2-async: Unregister sub-device if asc_list is empty

Samuel Moelius <[email protected]>
iommufd/selftest: Avoid selftest dirty bitmap size wrap

Xiang Mei <[email protected]>
isofs: fix out-of-bounds page array access on empty zisofs block

James Calligeros <[email protected]>
ASoC: apple: mca: increase SERDES reset delay

Leon Romanovsky <[email protected]>
RDMA/hfi1: Initialize debugfs after probe completes

Leon Romanovsky <[email protected]>
RDMA/hfi1: Stop flushing the global IB workqueue

Leon Romanovsky <[email protected]>
RDMA/hfi1: Create workqueues before device initialization

Leon Romanovsky <[email protected]>
RDMA/hfi1: Remove redundant PCI device ID validation

Leon Romanovsky <[email protected]>
RDMA/hfi1: Free RX data on late probe failure

Leon Romanovsky <[email protected]>
RDMA/hfi1: Preserve unit 0 on allocation failure

Sean Rhodes <[email protected]>
misc: rtsx_usb: avoid USB I/O in runtime autosuspend

Pengpeng Hou <[email protected]>
pmdomain: bcm: bcm2835: handle genpd provider registration errors

Evgenii Burenchev <[email protected]>
ALSA: hpi: Check transport errors during HPI6000 adapter initialization

Xiang Mei <[email protected]>
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

Yuho Choi <[email protected]>
hwrng: ks-sa - Fix runtime PM cleanup on registration failure

Atish Patra <[email protected]>
crypto: ccp - Fix memory leak in SEV INIT_EX path

Allison Henderson <[email protected]>
RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

Leon Romanovsky <[email protected]>
RDMA/ipoib: Drain RCU callbacks during module teardown

Leon Romanovsky <[email protected]>
RDMA/mlx5: Drain RCU callbacks during module teardown

Leon Romanovsky <[email protected]>
RDMA/core: Wait for RCU callbacks before unloading ib_core

Mert Seftali <[email protected]>
iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE

Brian Masney <[email protected]>

    clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK

Pengpeng Hou <[email protected]>
bus: qcom-ebi2: use managed resources for clocks and children

Pengpeng Hou <[email protected]>
soc: qcom: rpmh-rsc: manage PM notifiers with devres

Yu Peng <[email protected]>
perf metricgroup: Fix metric expression copy leaks

Laxman Acharya Padhya <[email protected]>
drm/panel: samsung-s6d16d0: Power off on prepare failure

Biju Das <[email protected]>
usb: renesas_usbhs: Fix power-off ordering on unbind

Fei Shao <[email protected]>
usb: mtu3: allow system suspend during active gadget connection

Linmao Li <[email protected]>
platform/surface: acpi-notify: Check ACPI companion before use

Linmao Li <[email protected]>
platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL

Gary Guo <[email protected]>
usb: fix UAF when probe runs concurrent to dyn ID removal

Greg Kroah-Hartman <[email protected]>
USB: make to_usb_driver() use container_of_const()

Greg Kroah-Hartman <[email protected]>
USB: make single lock for all usb dynamic id lists

Ruoyu Wang <[email protected]>
usb: gadget: aspeed_udc: check endpoint DMA allocation

Maoyi Xie <[email protected]>
usb: ljca: bound bank_num in ljca_enumerate_gpio()

Michael Bommarito <[email protected]>
usb: gadget: configfs: fix out-of-bounds read of qw_sign

Nuno Sá <[email protected]>
usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths

Guangshuo Li <[email protected]>
serial: qcom-geni: do not advance stale DMA completions

Yuho Choi <[email protected]>
serial: ma35d1: Fix OF node reference leaks in console init

Liang Luo <[email protected]>
selftests/sched_ext: Fix bpf_link leak on early return in prog_run

Wolfram Sang <[email protected]>
hwspinlock: propagate errno when registering single lock

Felix Gu <[email protected]>
remoteproc: qcom_q6v5_adsp: Fix reference leak for device node

Armin Wolf <[email protected]>
platform/x86: lg-laptop: Fix LED resource handling

Rafael J. Wysocki <[email protected]>
platform/x86: lg-laptop: Convert ACPI driver to a platform one

Rafael J. Wysocki <[email protected]>
platform/x86: lg-laptop: Drop debug-only ACPI notify handler

Armin Wolf <[email protected]>
platform/x86: dell-wmi-base: Fix resource leak on module load failure

Armin Wolf <[email protected]>
platform/x86: dell-privacy: Fix race condition

Lorenzo Pieralisi <[email protected]>
ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling

Lorenzo Pieralisi <[email protected]>
ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()

Lorenzo Pieralisi <[email protected]>
ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination

John Ogness <[email protected]>
printk: Fix possible console use-after-free

Andrew Murray <[email protected]>
printk: Introduce console_flush_one_record

Jinchao Wang <[email protected]>
panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu()

Jinchao Wang <[email protected]>
panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu()

Jinchao Wang <[email protected]>
panic: introduce helper functions for panic state

Donghyeok Choe <[email protected]>
printk/panic: Add option to allow non-panic CPUs to write to the ring buffer.

Cosmo Chou <[email protected]>
leds: pca9532: Fix inverted GPIO output polarity

Wei Wang <[email protected]>
iommu/amd: Fix false positive in SB IOAPIC IVRS validation

Fu Hao <[email protected]>
iommu/amd: Add support for Hygon family 18h model 4h IOAPIC

Wei Wang <[email protected]>
iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors

Vladimir Zapolskiy <[email protected]>
iommu/msm: Return -ENOMEM on memory allocation failure in probe

Akari Tsuyukusa <[email protected]>
iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX

Yuho Choi <[email protected]>
bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation

Sanghyun Park <[email protected]>
bpf: Fix use-after-free on mm_struct in bpf_find_vma()

Breno Leitao <[email protected]>
efi: fix stale reference to efi_recover_from_page_fault()

Daniel Borkmann <[email protected]>
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux

Tanushree Shah <[email protected]>
perf dso: Fix kallsyms DSO detection with fallback logic

Sandipan Das <[email protected]>
perf vendor events amd: Reintroduce deprecated Zen 5 core events

Aleksandr Nogikh <[email protected]>
udf: Mark LVID buffer as uptodate before marking it dirty

Hongyan Xu <[email protected]>
usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

Bjorn Andersson <[email protected]>
usb: typec: ucsi: unregister debugfs entries on teardown

Dan Carpenter <[email protected]>
thermal/drivers/rcar: Fix error checking in probe()

Tanushree Shah <[email protected]>
perf data convert json: Fix trace_seq memory leak in process_sample_event()

Konrad Dybcio <[email protected]>

    arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net

Konrad Dybcio <[email protected]>

    arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes

Konrad Dybcio <[email protected]>

    arm64: dts: qcom: sc8180x-primus: Describe the display power net

Konrad Dybcio <[email protected]>

    arm64: dts: qcom: sc8180x-primus: Rename regulator nodes

Herman van Hazendonk <[email protected]>
clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()

Herman van Hazendonk <[email protected]>
clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains

Herman van Hazendonk <[email protected]>
clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status

David Woodhouse <[email protected]>
timekeeping: Account for monotonicity adjustment in ntp_error

Thomas Weißschuh <[email protected]>

    y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32

Yuho Choi <[email protected]>
clocksource: Unregister subsystem on device registration failure

Jiangshan Yi <[email protected]>
selftests: timers: leap-a-day: Fix -w option and update usage comment

Kemeng Shi <[email protected]>
irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()

Kemeng Shi <[email protected]>
irqchip/gic-v3-its: Fix memleak in its_probe_one()

Wang Yan <[email protected]>
selftests/lsm: Fix memory leak in attr_lsm_count

Feng Yang <[email protected]>
selftests/bpf: Fix memory leak in msg_alloc_iov

Malaya Kumar Rout <[email protected]>
selftests/bpf: Fix memory leak in msg_alloc_iov error path

Evgenii Burenchev <[email protected]>
ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()

Dawei Feng <[email protected]>
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()

Ayush Mukkanwar <[email protected]>
staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown

Ayush Mukkanwar <[email protected]>
staging: octeon: replace pr_warn with dev_warn in fill and rx paths

Ayush Mukkanwar <[email protected]>
staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions

Yuvraj Singh Chauhan <[email protected]>
staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown

Ayush Mukkanwar <[email protected]>
staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown

Dan Carpenter <[email protected]>
staging: fbtft: Use sysfs_emit_at() to print to sysfs file

Bryam Vargas <[email protected]>
greybus: audio: bound the topology section sizes against the fetched size

Rong Zhang <[email protected]>
staging: sm750fb: Add missing Kconfig dependency

Ahmet Sezgin Duran <[email protected]>
staging: sm750fb: gate dualview dataflow using g_dualview

Alexander A. Klimov <[email protected]>
staging: greybus: audio: correct sscanf() return value check

Cen Zhang <[email protected]>
wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

Ruoyu Wang <[email protected]>
bus: qcom-ebi2: Fix clock leak on probe failure

Krzysztof Kozlowski <[email protected]>
bus: qcom-ebi2: Simplify with scoped for each OF child loop

Konrad Dybcio <[email protected]>
arm64: dts: qcom: hamoa: Fix clocks for HSPHYs

Luca Weiss <[email protected]>
arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name

Waiman Long <[email protected]>
cgroup/cpuset: Make nr_deadline_tasks an atomic_t

Haowen Tu <[email protected]>
PM: sleep: Fix off-by-one in wakelocks number limit check

Yuho Choi <[email protected]>
bus: ti-sysc: Fix /chosen node reference leak

Shin'ichiro Kawasaki <[email protected]>
nvmet-rdma: fix response resource leak on queue teardown

Shin'ichiro Kawasaki <[email protected]>
nvmet-rdma: factor out response resource cleanup

Gui-Dong Han <[email protected]>
nvme-apple: Use acquire/release for queue enabled state

Myeonghun Pak <[email protected]>
crypto: keembay - Fix AEAD unregister count in error path

Pengpeng Hou <[email protected]>
crypto: rk3288 - fail ahash requests on HASH idle timeout

Pengpeng Hou <[email protected]>
crypto: sa2ul - stop probe if context pool creation fails

Lothar Rubusch <[email protected]>
crypto: atmel-sha204a - fix heap info leak on I2C transfer failure

Thorsten Blum <[email protected]>
crypto: atmel-ecc - reject hardware ECDH without a public key

Thorsten Blum <[email protected]>
crypto: atmel-ecc - clean up and improve ECDH comments

Thorsten Blum <[email protected]>
crypto: atmel-ecc - replace min_t with min

Giovanni Cabiddu <[email protected]>
crypto: qat - clear AES key schedule from stack

Giovanni Cabiddu <[email protected]>
crypto: qat - cancel work on re-enable SR-IOV timeout

Manos Pitsidianakis <[email protected]>
hwrng: core - fix rng list on registration error

Sandipan Das <[email protected]>
perf vendor events amd: Update Zen 5 core events

Sandipan Das <[email protected]>
perf/x86/amd/uncore: Add group validation

Leo Yan <[email protected]>
perf cs-etm: Fix thread leaks on trace queue init failure

James Clark <[email protected]>
perf cs-etm: Queue context packets for frontend

Pengpeng Hou <[email protected]>
wifi: rtw89: fix HE extended capability length check

Tzung-Bi Shih <[email protected]>
platform/chrome: sensorhub: Fix memory overread in ring handler

Hisam Mehboob <[email protected]>
selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check

Hanlin Song <[email protected]>
csky: Fix a4/a5 restoration in syscall trace path

Sanjay Chitroda <[email protected]>
iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure

Srinivas Kandagatla <[email protected]>
soundwire: qcom: Fix port exhaustion check in stream_alloc_ports

Vladimir Zapolskiy <[email protected]>
dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe

Suraj Gupta <[email protected]>
dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers

Vladimir Zapolskiy <[email protected]>
dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure

Gregory Price <[email protected]>
mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug

Gregory Price <[email protected]>
mm: name the anonymous MMOP enum as enum mmop

Israel Batista <[email protected]>
mm: change type of state in struct memory_block

Israel Batista <[email protected]>
mm: convert memory block states (MEM_*) macros to enum

Gregory Price <[email protected]>
mm: add build-time option for hotplug memory default online type

Sechang Lim <[email protected]>
bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks

Guillaume Maudoux <[email protected]>
selftests/bpf: Mask socket type flags in mptcpify prog

Alexis Lothoré (eBPF Foundation) <[email protected]>
selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr

Leon Hwang <[email protected]>
bpf: Copy per-CPU map value padding in copy_map_value_long()

Yichong Chen <[email protected]>
tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands

Yichong Chen <[email protected]>
tools/bpf/bpftool: Reset vmlinux BTF after map commands

Asad Kamal <[email protected]>
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

Asad Kamal <[email protected]>
drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup

Uday Khare <[email protected]>
regulator: tps6594: Fix device node reference leaks in multiphase loop

Michael Walle <[email protected]>
regulator: tps6594-regulator: refactor variant descriptions

Michael Walle <[email protected]>
regulator: tps6594-regulator: remove hardcoded buck config

Michael Walle <[email protected]>
regulator: tps6594-regulator: remove interrupt_count

Christophe JAILLET <[email protected]>
regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type

Ian Rogers <[email protected]>
perf tests: Fix flakiness in branch stack sampling tests

Ian Rogers <[email protected]>
perf test: Fixes for check branch stack sampling

James Clark <[email protected]>
perf test: Extend branch stack sampling test for Arm64 BRBE

James Clark <[email protected]>
perf test: Add syscall and address tests to brstack test

James Clark <[email protected]>
perf test: Refactor brstack test

Ian Rogers <[email protected]>
perf tests: Harden branch stack sampling test

James Clark <[email protected]>
perf test brstack: Speed up running test by using tr -s instead of xargs

Ian Rogers <[email protected]>
perf tests: Fix flakiness in BPF counters test on hybrid systems

Namhyung Kim <[email protected]>
perf test: Fix perf stat --bpf-counters on hybrid machines

Tengda Wu <[email protected]>
perf test: Use sqrtloop workload to test bperf event

Ian Rogers <[email protected]>
perf tests: Skip metrics validation if system-wide recording lacks permission

Namhyung Kim <[email protected]>
perf test: Do not skip when some metrics tests succeeded

Ian Rogers <[email protected]>
perf test all metrics: Fully ignore Default metric failures

Ian Rogers <[email protected]>
perf test metrics: Update all metrics for possibly failing default metrics

Ian Rogers <[email protected]>
perf tests metrics: Permission related fixes

Ian Rogers <[email protected]>
perf test stat_all_metrics: Ensure missing events fail test

Namhyung Kim <[email protected]>
perf test: Update all metrics test like metricgroups test

Sean Young <[email protected]>
media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define

Sean Young <[email protected]>
media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define

Jinjie Ruan <[email protected]>
riscv: kexec_file: Fix crashk_low_res not exclude bug

Song Shuai <[email protected]>
riscv: kexec_file: Split the loading of kernel and others

Daniel McCarthy <[email protected]>
pinctrl: bcm2835: Don't remove an unregistered GPIO chip

Zide Chen <[email protected]>
perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails

Chen, Yu C <[email protected]>
sched/fair: Fix overflow in update_tg_cfs_runnable()

Wei Yang <[email protected]>
mm/mm_init: fix incorrect node_spanned_pages

Henrik Grimler <[email protected]>
drm/lima: call drm_mm_init() with a valid allocation range

Brian Masney <[email protected]>
clk: imx: scu: drop redundant init.ops variable assignment

Frieder Schrempf <[email protected]>

    arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB

Weigang He <[email protected]>
ARM: imx: fix device_node refcount leaks in imx7_src_init()

Weigang He <[email protected]>
ARM: imx: fix device_node refcount leak in imx_src_init()

Min zhang <[email protected]>
clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller

Shengjiu Wang <[email protected]>
ASoC: fsl_audmix: rework runtime PM handling in probe

Runyu Xiao <[email protected]>
ASoC: rt700-sdw: always drain jack work on remove

Joey Lu <[email protected]>
clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic

Brian Masney <[email protected]>
clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate()

Joey Lu <[email protected]>
clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc

Joey Lu <[email protected]>
clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation

Alexander A. Klimov <[email protected]>
clk: moxart: remove unused variables, fix refcount leak

Myeonghun Pak <[email protected]>
clk: versaclock7: Fix APLL clock leak on probe failure

Wei Hou <[email protected]>
cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox()

Richard Cheng <[email protected]>
cxl/mbox: Clamp mailbox output allocation to the payload size

Dave Jiang <[email protected]>
cxl: Refactor user ioctl command path from mds to mailbox

Gui-Dong Han <[email protected]>
media: cec-pin: Fix event FIFO ordering

Weigang He <[email protected]>
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()

Michael Bommarito <[email protected]>
HID: roccat: bound device-supplied profile index

Christos Maragkos <[email protected]>
HID: nintendo: Fix imu_timestamp_us double increment per report

Philipp Weber <[email protected]>
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

Maoyi Xie <[email protected]>
platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count

Jens Remus <[email protected]>
x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()

Wanwu Li <[email protected]>
sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging

Konstantin Andreev <[email protected]>
smack: restrict smackfs/{direct,mapped} values to 0-255

Konstantin Andreev <[email protected]>
smack: deduplicate smackfs/{direct,mapped} file_operations

Dmitry Antipov <[email protected]>
smack: simplify write handlers of sysfs entries

Konstantin Andreev <[email protected]>
smack: fix incorrect task context in smack_msg_queue_msgrcv

Maxime Ripard <[email protected]>
drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure

Nicolas Frattaroli <[email protected]>
drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format

Maíra Canal <[email protected]>

    drm/v3d: Clear queue->active_job when v3d_fence_create() fails

Maíra Canal <[email protected]>
drm/v3d: Replace a global spinlock with a per-queue spinlock

Paul Kocialkowski <[email protected]>
drm: lcdif: Wait for vblank before disabling DMA

Yicong Hui <[email protected]>
drm: Remove unused header in drm_dumb_buffers.c

Casey Schaufler <[email protected]>
Smack: Fix error in capability bypass

SJ Park <[email protected]>
mm/damon/core: skip aging from repeated aggressive merging

Sven Eckelmann <[email protected]>
batman-adv: fix TX priority extraction for BATADV_FORW_MCAST

Martin Blumenstingl <[email protected]>
clk: meson: align gxbb_32k_clk_sel number of parents with actual count

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

Sven Eckelmann <[email protected]>
batman-adv: bla: avoid CRC corruption due to parallel claim add

Sven Eckelmann <[email protected]>
batman-adv: dat: atomically update mac addresses

Sean Shen <[email protected]>
ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

Junyi Liu <[email protected]>
ksmbd: fix durable reconnect error path file lifetime

Akif <[email protected]>
ksmbd: fix use-after-free in smb2_open during durable reconnect

Zilin Guan <[email protected]>
of: unittest: Fix memory leak in unittest_data_add()

SJ Park <[email protected]>
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()

SJ Park <[email protected]>
mm/damon/core-kunit: handle region split failure in filter_out()

SJ Park <[email protected]>
mm/damon/vaddr-kunit: check region count in three_regions test

SJ Park <[email protected]>
mm/damon/paddr: drop last same folio access check reuse optimization

SJ Park <[email protected]>
mm/damon/ops-common: use nr_accesses moving sum for quota score

SJ Park <[email protected]>
mm/damon/vaddr: drop last same folio access check optimization

Kazuki Hanai <[email protected]>
nvmet-auth: Synchronize timeout work during SQ teardown

Dragos Tatulea <[email protected]>
net/mlx5e: xsk: Fix unlocked writing to ICOSQ

Namjae Jeon <[email protected]>
ksmbd: zero pipe read compound padding

Arthur Gautier <[email protected]>
xhci: fix lost bounce buffers on TDs spanning several ring segments

David Howells <[email protected]>
afs: Fix leak of ungot volume

Zhenhao Wan <[email protected]>
drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE

Zhenhao Wan <[email protected]>
drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE

Zhenhao Wan <[email protected]>
drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op

Faith Ekstrand <[email protected]>
drm/nouveau: Use write-combined maps for coherent

Marek Czernohous <[email protected]>
drm/nouveau: unsubscribe the channel-kill event before the fence context

Sunday Clement <[email protected]>
drm/amdkfd: Reject zero-sized AQL queue allocations after size halving

Vladimir Marioukhine <[email protected]>
drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

Sunil Khatri <[email protected]>
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT

Kanala Ramalingeswara Reddy <[email protected]>
drm/amdgpu: Skip accessing psp rum time db for APUs

Guangshuo Li <[email protected]>
drm/amdgpu: fix autosuspend cleanup during removal

Yang Wang <[email protected]>
drm/amdgpu: check thunderbolt before switcheroo registration

Thadeu Lima de Souza Cascardo <[email protected]>
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

Kavan Smith <[email protected]>
drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value

Tao Yu <[email protected]>
drm/gud: validate TV mode names before creating enum property

Deepanshu Kartikey <[email protected]>
drm/gud: NUL-terminate TV mode names read from the device

David (Ming Qiang) Wu <[email protected]>
drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

Harry Wentland <[email protected]>
drm/amd/display: validate plane degamma LUT size for private color prop

Harry Wentland <[email protected]>
drm/amd/display: avoid divide-by-zero in __is_lut_linear()

Thomas Zimmermann <[email protected]>
drm/hibmc: Use drm_atomic_helper_check_plane_state()

Thomas Zimmermann <[email protected]>
drm/hibmc: Fix list of formats on the primary plane

Amit Barzilai <[email protected]>

    drm/ssd130x: fix column and row end address in partial updates in ssd133x

Wentao Liang <[email protected]>
drm/sun4i: fix refcount leak in sun4i_backend_init_sat()

Amit Barzilai <[email protected]>

    drm/ssd130x: fix column and row end address in partial updates for ssd132x

Deepanshu Kartikey <[email protected]>
drm/i915: Guard against NULL driver_data in i915_pci_probe()

Danilo Krummrich <[email protected]>
drm: fix race between partial drm_dev_register() failure and ioctl

Johan Hovold <[email protected]>
drm/panel-edp: fix i2c adapter leak on probe failure

Johan Hovold <[email protected]>
drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure

Osama Abdelkader <[email protected]>
drm/panthor: fix firmware control interface bounds checks

Chao Yu <[email protected]>
f2fs: fix to zero post-EOF data when extending file size

Chen Changcheng <[email protected]>
f2fs: fix valid block count leak on data block allocation failure

Chao Yu <[email protected]>
f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()

Zhan Xusheng <[email protected]>
f2fs: fix i_size when pinned fallocate partially fails

Daeho Jeong <[email protected]>
f2fs: fix to migrate all curseg types during free_segment_range

Wenjie Qi <[email protected]>
f2fs: avoid NULL checkpoint thread access in sysfs

Wenjie Qi <[email protected]>
f2fs: return writeback error from collapse range

Zhan Xusheng <[email protected]>
f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()

Hao-Qun Huang <[email protected]>
f2fs: reject overlapping move range after len expansion

Wenjie Qi <[email protected]>
f2fs: return symlink writeback errors

Nilesh Javali <[email protected]>
scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started

Nilesh Javali <[email protected]>
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak

Nilesh Javali <[email protected]>
scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics

Nilesh Javali <[email protected]>
scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition

Nilesh Javali <[email protected]>
scsi: qla2xxx: Drop vport reference under lock in report ID acquisition

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort

Nilesh Javali <[email protected]>
scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

Nilesh Javali <[email protected]>
scsi: qla2xxx: Avoid double completion in async IOCB timeout

Nilesh Javali <[email protected]>
scsi: qla2xxx: Quiesce response IRQ before freeing request queue

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path

Nilesh Javali <[email protected]>
scsi: qla2xxx: Don't query firmware state while chip is down

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix FCE trace enable parsing in debugfs

Nilesh Javali <[email protected]>
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown

Nilesh Javali <[email protected]>
scsi: qla2xxx: Serialize flash version read in reset handler

Nilesh Javali <[email protected]>
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation

Nilesh Javali <[email protected]>
scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject

Nilesh Javali <[email protected]>
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Initialize NVMe abort_work once at submission

Nilesh Javali <[email protected]>
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters

Nilesh Javali <[email protected]>
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

Nilesh Javali <[email protected]>

    scsi: qla2xxx: Bound i2c->length in I2C bsg handlers

Nilesh Javali <[email protected]>
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers

Jackson Lee <[email protected]>
media: chips-media: wave5: Guard bit depth check with initial_info_obtained

Ruoyu Wang <[email protected]>
media: zoran: Avoid freeing a registered video_device twice

Arash Golgol <[email protected]>
media: vimc: fix pixel format lookup in enum_framesizes

Uday Khare <[email protected]>
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure

Mohammed EL Kadiri <[email protected]>
media: venus: fix payload size calculation in parse_raw_formats()

Mohammed EL Kadiri <[email protected]>
media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()

Biren Pandya <[email protected]>
media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link

Ming Qian <[email protected]>
media: v4l2-ctrls: Allow unknown HDR10 white point and luminance

Xu Rao <[email protected]>
media: v4l2-async: avoid deleting unlinked ASC entry on link error

Ilya Krutskih <[email protected]>
media: tda18250: fix possible integer overflow

Guangshuo Li <[email protected]>
media: saa7164: fix cleanup on resource allocation failure

Lei Huang <[email protected]>
media: s2255: check firmware size before reading trailing marker

HyeongJun An <[email protected]>
media: s2255: bound JPEG frame size before copying into the buffer

Valery Borovsky <[email protected]>
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure

Valery Borovsky <[email protected]>
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

Myeonghun Pak <[email protected]>
media: rc: sunxi-cir: Unregister rc device on probe failure

Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks

Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Correct color map between V4L2 and ISI

Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing

Johan Hovold <[email protected]>
media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup

Guangshuo Li <[email protected]>
media: platform: mtk-mdp3: Fix SCP device refcounting

Christian Hewitt <[email protected]>
media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common

Cong Nguyen <[email protected]>
media: intel/ipu6: fix async notifier cleanup leak on parse error

Biren Pandya <[email protected]>
media: i2c: ov7740: fix use-after-destroy in remove

Biren Pandya <[email protected]>
media: i2c: ov02a10: fix endpoint parsing use-after-free

Narasimharao Vadlamudi <[email protected]>
media: i2c: imx415: Return test pattern write errors

Martin Hecht <[email protected]>
media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure

Shuangpeng Bai <[email protected]>
media: go7007: defer the ALSA v4l2 put until card release

Jiangong.Han <[email protected]>

    media: em28xx: fix use-after-free of dev_next->devlist on disconnect

Diego Fernando Mancera Gomez <[email protected]>
media: em28xx: defer audio-only extension registration

Fan Wu <[email protected]>
media: cx23885: cancel NetUP CI work before teardown

Bryam Vargas <[email protected]>
media: cx231xx: reject geometry changes while the VBI queue is busy

Ruoyu Wang <[email protected]>
media: cobalt: Avoid freeing ALSA private data twice

Dawei Feng <[email protected]>
media: cedrus: fix memory leak in cedrus_init_ctrls()

Ruoyu Wang <[email protected]>
media: cec: Serialize exclusive follower delivery

Yi Ding <[email protected]>
media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash

Hans Verkuil <[email protected]>
media: cec: extron-da-hd-4k-plus: add sanity check

Biren Pandya <[email protected]>
media: cec: disable delayed work before freeing an interrupted transmit

Jonas Karlman <[email protected]>
media: cec: core: Fix kmemleak due to missed rc_free_device() call

Ming Qian <[email protected]>
media: amphion: Remove obsolete frame_count check in venc_start_session

Valery Borovsky <[email protected]>
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref

Jérémy Jean <[email protected]>
LoongArch: Avoid preempt count underflow without probe

Wentao Guan <[email protected]>
LoongArch: Do not save/restore percpu base register in rethook trampoline

Nathan Chancellor <[email protected]>
LoongArch: Do not select HAVE_RUST when KASAN is enabled

Bibo Mao <[email protected]>

    LoongArch: Fix acpi_package_ids[] array overflow

Zeng Chi <[email protected]>
LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY

Chaithanya Lagisetty <[email protected]>
LoongArch: KVM: Free init resources if kvm_init() fails

Tao Cui <[email protected]>
LoongArch: KVM: Fix TOCTOU race on pv_features

Christian Borntraeger <[email protected]>
KVM: s390: Restore sigset on error path

Christian Borntraeger <[email protected]>
KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP

Christian Borntraeger <[email protected]>
KVM: s390: Zero initialize irq in reinject_machine_check

Christian Borntraeger <[email protected]>
KVM: s390: Take srcu when importing watchpoint data

Christian Borntraeger <[email protected]>
KVM: s390: Free guest debug data on vcpu destroy

Christian Borntraeger <[email protected]>
KVM: s390: Fix old_data leak in guest debug error path

Christian Borntraeger <[email protected]>
KVM: s390: Fix memory leak in guest debug handling

Christian Borntraeger <[email protected]>
KVM: s390: Fix length check __import_wp_info()

Sean Christopherson <[email protected]>
KVM: x86: Ensure runtime reads of disabled_quirks are resolved once

Sean Christopherson <[email protected]>

    KVM: x86: Serialize writes to disabled_quirks using kvm->lock

Carlos López <[email protected]>
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock

Sean Christopherson <[email protected]>
KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()

Yosry Ahmed <[email protected]>
KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU

Yosry Ahmed <[email protected]>
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Sean Christopherson <[email protected]>
KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit

Sean Christopherson <[email protected]>
KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02

Yosry Ahmed <[email protected]>
KVM: nVMX: Always flush vpid02 on first use

Nikhil Gautam <[email protected]>
iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask

Nikhil Gautam <[email protected]>
iio: light: opt4001: Reject integration times with a non-zero seconds part

Nikhil Gautam <[email protected]>
iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()

Nikhil Gautam <[email protected]>
iio: light: opt4001: Fix power down clearing bits of the wrong register

Sanjay Chitroda <[email protected]>
iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()

Cong Nguyen <[email protected]>
iio: srf04: fix pm_runtime handling on probe error path

Can Peng <[email protected]>
iio: pressure: mpl115: Fix runtime PM cleanup

Rupesh Majhi <[email protected]>
iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

Vidhu Sarwal <[email protected]>
iio: light: ltrf216a: fix runtime PM reference leak in error path

Laxman Acharya Padhya <[email protected]>
iio: light: gp2ap002: Disable regulators on resume failure

Giorgi Tchankvetadze <[email protected]>
iio: light: cm32181: return zero after writing calibscale

Cong Nguyen <[email protected]>
iio: gyro: mpu3050: fix sign of raw angular velocity readings

Erick Henrique <[email protected]>
iio: dac: m62332: Fix regulator reference count imbalance

Linmao Li <[email protected]>
iio: chemical: sgp30: Handle IAQ thread creation failure

Fan Wu <[email protected]>
iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF

Moksh Panicker <[email protected]>
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable

Lars-Peter Clausen <[email protected]>
iio: buffer: Tie IIO dma fence lock lifetime to the fence

Lars-Peter Clausen <[email protected]>
iio: buffer: Make IIO DMA fence release RCU-safe

Lars-Peter Clausen <[email protected]>
iio: buffer: Fix potential use-after-free in anonymous buffer release

Cong Nguyen <[email protected]>
iio: adc: pac1921: fix wrong channel used in trigger handler read

Joshua Crofts <[email protected]>
iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig

WenTao Liang <[email protected]>
ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get

Binbin Zhou <[email protected]>
ASoC: loongson: Fix error handling in ACPI property parsing

Haoxiang Li <[email protected]>
AsoC: intel: sst: fix PCI device reference leak on probe failure

Haoxiang Li <[email protected]>
ASoC: hdac_hda: Fix hlink refcount leak on component registration failure

Haoxiang Li <[email protected]>
ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure

Runyu Xiao <[email protected]>
ASoC: cs35l34: drain threaded IRQ before runtime suspend

Runyu Xiao <[email protected]>
ASoC: cs35l33: drain threaded IRQ before runtime suspend

Linkai Gong <[email protected]>
i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src

Heiko Stuebner <[email protected]>
clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src

Stephan Gerhold <[email protected]>
clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk

Stephan Gerhold <[email protected]>
clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk

Sven Eckelmann <[email protected]>
batman-adv: bla: prevent CRC corruptions after claim flush

Sven Eckelmann <[email protected]>
batman-adv: bla: fix freeing of claims on meshif deletion

Sven Eckelmann <[email protected]>
batman-adv: dat: avoid unaligned fault in IP extraction

Sven Eckelmann <[email protected]>
batman-adv: mcast: linearize skbuff for packet generation

Sven Eckelmann <[email protected]>
batman-adv: mcast: ensure unshared skb for multicast packets

Zhiling Zou <[email protected]>
batman-adv: fix stale receive device on merged fragments

Pengpeng Hou <[email protected]>
mtd: rawnand: validate ONFI extended parameter page sections

Xu Rao <[email protected]>
mtd: mtdoops: free page bitmap when the backing MTD is removed

Pengpeng Hou <[email protected]>
mtd: afs: validate v2 image info bounds

Anthony Krowiak <[email protected]>
s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object

Anthony Krowiak <[email protected]>
s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap

Anthony Krowiak <[email protected]>
s390/vfio-ap: Fix NULL deref in status_show() during queue probe

Anthony Krowiak <[email protected]>
s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed

Anthony Krowiak <[email protected]>

    s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL

Anthony Krowiak <[email protected]>
s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove

Anthony Krowiak <[email protected]>
s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove

Anthony Krowiak <[email protected]>
s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()

Sourabh Jain <[email protected]>
powerpc/crash: stop watchdogs before booting kdump kernel

Sourabh Jain <[email protected]>
powerpc/pseries: Move H_WATCHDOG definitions to a common header

Sourabh Jain <[email protected]>
powerpc/pseries: Handle and log pseries-wdt registration failures

Muchun Song <[email protected]>
powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population

Jinjie Ruan <[email protected]>
powerpc/kexec_file: Prevent kexec range truncation

Jinjie Ruan <[email protected]>
powerpc/kexec_file: Fix null-ptr-def in extra size calculation

Helge Deller <[email protected]>
parisc: Fix alignment of asm statements in head.S

Pei Xiao <[email protected]>
parisc: eisa: Fix infinite loop when parsing invalid IRQ value

Bryam Vargas <[email protected]>
nvdimm/btt: reject an arena whose nfree is below the lane count

Wupeng Ma <[email protected]>
mm/hugetlb: fix missing migratable flag on same-node hugetlb migration

caina <[email protected]>
Revert "irqchip/mbigen: Fix mbigen node address layout"

Shivam Kumar <[email protected]>
nvmet-tcp: reject unsolicited H2CData PDUs

Shivam Kumar <[email protected]>
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

Yehyeong Lee <[email protected]>
nvme-tcp: check the data direction of a C2HData PDU

Niklas Cassel <[email protected]>
nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails

Xu Rao <[email protected]>
nvme-fabrics: fix DHCHAP secret leak on parse failure

Takashi Iwai <[email protected]>
ALSA: pcm: Fix race between non-atomic ops and trigger-start

Runyu Xiao <[email protected]>
ALSA: harmony: initialize locks before requesting IRQ

HyeongJun An <[email protected]>
ALSA: rawmidi: Return the error from snd_rawmidi_input_params()

Karl Mehltretter <[email protected]>
arm64: mm: Fix the lockless page-table walk in show_pte()

Ahmad Byagowi <[email protected]>
i2c: mux: Fix channel node leak on adapter add failure

Vasileios Almpanis <[email protected]>
i2c: core: fix debugfs UAF on adapter removal

Sizhe Liu <[email protected]>
perf hisi-ptt: Fix PTT trace TLP header parsing

Viktor Malik <[email protected]>
perf trace: Refactor augmented_raw_syscalls using bpf_for

Viktor Malik <[email protected]>
perf trace: Factor out BPF loop body

Dapeng Mi <[email protected]>
perf/x86/intel: Fix kernel address leakages in LBR stack

Lad Prabhakar <[email protected]>
rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers

Lad Prabhakar <[email protected]>
rtc: rzn1: Fix weekday underflow when alarm crosses month boundary

Shakeel Butt <[email protected]>
memcg: make the v1 soft limit knob inert

Pengpeng Hou <[email protected]>
Input: aiptek - validate raw macro indices before updating state

Sechang Lim <[email protected]>
tcp: clear sock_ops cb flags before force-closing a child socket

Eric Dumazet <[email protected]>
mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()

Masami Hiramatsu (Google) <[email protected]>
kprobes: Protect kprobe_blacklist with RCU

Ju Nan <[email protected]>
irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout

Bradley Morgan <[email protected]>
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()

Hajo Noerenberg <[email protected]>
ata: ahci: work around lost interrupts on Marvell 88SE61xx

Max Kellermann <[email protected]>
ceph: lock mutex in ceph_mds_check_access()

Damien Le Moal <[email protected]>
block: flag zoned disks with GENHD_FL_NO_PART

Linkai Gong <[email protected]>
cpuidle: dt_idle_genpd: kfree() the original name allocation

Koichiro Den <[email protected]>
dmaengine: dw-edma: Initialize IRQ data before requesting IRQs

Koichiro Den <[email protected]>
dmaengine: dw-edma: Complete descriptors before pausing

Koichiro Den <[email protected]>
dmaengine: dw-edma: Fix HDMA channel status register access

Martin Kaiser <[email protected]>
dmaengine: fsl-edma: tracing: no ptr dereference during log output

Aneesh Kumar K.V (Arm) <[email protected]>
dma-direct: return struct page from dma_direct_alloc_from_pool()

Mikulas Patocka <[email protected]>
dm: fix resume-vs-remove race

Mikulas Patocka <[email protected]>
dm: fix race when loading and unloading a table

Ibrahim Hashimov <[email protected]>
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq

Wei Jie Law <[email protected]>
HID: rmi: fix OOB access with undersized RMI reports

Shen Yongchao <[email protected]>
HID: bpf: serialize device reference release in struct_ops destroy path

Steven Rostedt <[email protected]>
ftrace: Synchronize the initialization of ftrace_ops

Yao Kai <[email protected]>
futex: Prevent rcuwait use-after-free during requeue PI

SJ Park <[email protected]>
mm/damon/core-kunit: check region count before testing in split_at()

SJ Park <[email protected]>
mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs

SJ Park <[email protected]>
mm/damon/sysfs: kobject_del() region and target (error) dirs

SJ Park <[email protected]>
mm/damon/sysfs-schemes: kobject_del() scheme region dirs

SJ Park <[email protected]>
mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs

SJ Park <[email protected]>
mm/damon/sysfs-schemes: kobject_del() scheme filter dirs

SJ Park <[email protected]>
mm/damon/sysfs-schemes: kobject_del() scheme dirs

Runyu Xiao <[email protected]>
scsi: pm8001: Use rollback index when freeing MSI-X vectors

Sujal Tuladhar <[email protected]>
scsi: target: iscsi: Reserve a terminator byte for the login payload

Honghui Jiang <[email protected]>
spi: Fix DMA mapping ownership on partial map failure

Can Peng <[email protected]>
spi: bcmbca-hsspi: disable clocks on resume failure

Can Peng <[email protected]>
spi: bcm63xx: disable clock on resume failure

Can Peng <[email protected]>
spi: bcm63xx-hsspi: disable clocks on resume failure

Kanishka De Silva <[email protected]>
ublk: clear VM_MAYWRITE on read-only ublk char device mmap

Can Peng <[email protected]>
thermal/drivers/qoriq: Disable clock on resume failure

Can Peng <[email protected]>
thermal/drivers/imx: Disable clock on runtime resume failure

Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()

Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()

Jeffin Philip <[email protected]>
usb: gadget: fix null pointer dereference in usb_put_function_instance()

Lovekesh Solanki <[email protected]>
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

Jeffin Philip <[email protected]>
usb: gadget: f_midi: initialize work in f_midi_alloc()

Ivy Lopez <[email protected]>
usb: gadget: f_midi2: fix use-after-free in string attribute show path

Aleksandr Nogikh <[email protected]>
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs

Jameson Thies <[email protected]>
usb: typec: ucsi: displayport: Fix OOB altmode array index

Fan Wu <[email protected]>
usb: typec: qcom-pmic: cancel reset_work on stop

Fan Wu <[email protected]>
usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails

Fan Wu <[email protected]>
usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

Andy Shevchenko <[email protected]>
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()

Liu Qi <[email protected]>
usb-storage: ene_ub6250: fix race between scan work and probe

Shuangpeng Bai <[email protected]>
media: usbtv: keep device alive while ALSA card exists

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset

HyeongJun An <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()

Griffin Kroah-Hartman <[email protected]>
usb: image: mdc800: change kmalloc() to kzalloc()

Hari Mishal <[email protected]>
drm/amd/display: fix division by zero in get_estimated_bw()

Koichiro Den <[email protected]>
net: ntb_netdev: Fix TX busy and drop handling

Sun Jian <[email protected]>
fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()

FUJITA Tomonori <[email protected]>
objtool/rust: add one more noreturn Rust function

Jinjie Ruan <[email protected]>
entry: Fix seccomp bypass after ptrace with TSYNC

Eric Dumazet <[email protected]>
tcp: fix potential race in tcp_v6_syn_recv_sock()

Youngjae Kwon <[email protected]>
fsnotify: Fix stale object mask after concurrent mark updates

Guillaume Morin <[email protected]>
hugetlb: only adjust reservation during unmapping if mapcount is 0

Laxman Acharya Padhya <[email protected]>
wifi: mt76: mt7996: validate default EEPROM firmware size

Dev Jain <[email protected]>
mm/page_vma_mapped: use huge_ptep_get() for hugetlb

David Howells <[email protected]>
netfs: Fix netfs_read_folio() to wait on writeback

Jason Xing <[email protected]>
xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()

Günther Noack <[email protected]>
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation

Yuqi Xu <[email protected]>
openvswitch: Fix CT limit teardown use-after-free

Ilya Maximets <[email protected]>
net: openvswitch: fix kernel-doc warnings in internal headers

Norbert Szetei <[email protected]>
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

-------------

Diffstat:

 .../ABI/testing/configfs-usb-gadget-uac1_legacy    |    3 -
 Documentation/admin-guide/cgroup-v1/memory.rst     |   49 +-
 Documentation/admin-guide/kernel-parameters.txt    |   12 +-
 Documentation/admin-guide/mm/memory-hotplug.rst    |    4 +-
 Documentation/admin-guide/pm/amd-pstate.rst        |    4 +-
 Documentation/hwmon/emc1403.rst                    |    8 +-
 Documentation/trace/hisi-ptt.rst                   |   28 +-
 Documentation/usb/gadget-testing.rst               |    3 -
 .../media/v4l/ext-ctrls-colorimetry.rst            |   12 +-
 MAINTAINERS                                        |    1 +
 Makefile                                           |    4 +-
 arch/Kconfig                                       |    3 +
 arch/arm/boot/dts/allwinner/sun4i-a10.dtsi         |    2 +-
 arch/arm/boot/dts/marvell/armada-388-helios4.dts   |   13 +
 arch/arm/kernel/hw_breakpoint.c                    |   11 +-
 arch/arm/mach-imx/src.c                            |    3 +
 arch/arm/mach-lpc32xx/common.c                     |    5 +-
 arch/arm/mach-lpc32xx/common.h                     |    2 +
 arch/arm/mach-lpc32xx/phy3250.c                    |    2 +
 arch/arm/mach-lpc32xx/pm.c                         |    5 +-
 arch/arm/mm/fault.c                                |   16 +-
 arch/arm64/Kconfig                                 |    3 +-
 .../boot/dts/allwinner/sun50i-a64-pinephone.dtsi   |    4 +-
 arch/arm64/boot/dts/amlogic/meson-axg-s400.dts     |    4 +
 arch/arm64/boot/dts/amlogic/meson-axg.dtsi         |    3 +-
 arch/arm64/boot/dts/freescale/imx8-ss-audio.dtsi   |    8 +-
 .../boot/dts/freescale/imx93-kontron-osm-s.dtsi    |    4 +-
 .../boot/dts/marvell/armada-3720-turris-mox.dts    |    3 +-
 arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts |    2 +-
 .../boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi |    4 -
 arch/arm64/boot/dts/qcom/msm8998-xiaomi-sagit.dts  |    5 -
 arch/arm64/boot/dts/qcom/msm8998.dtsi              |   24 +-
 arch/arm64/boot/dts/qcom/qcm2290.dtsi              |    1 +
 arch/arm64/boot/dts/qcom/qcs404.dtsi               |   16 +-
 arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi       |    4 +-
 .../arm64/boot/dts/qcom/sc8180x-lenovo-flex-5g.dts |   57 +-
 arch/arm64/boot/dts/qcom/sc8180x-primus.dts        |   56 +-
 arch/arm64/boot/dts/qcom/sc8180x.dtsi              |   16 +-
 arch/arm64/boot/dts/qcom/sc8280xp-crd.dts          |    4 +-
 .../dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts     |    2 +-
 arch/arm64/boot/dts/qcom/sdm632-motorola-ocean.dts |    2 +-
 arch/arm64/boot/dts/qcom/sdm845.dtsi               |   64 +-
 arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts  |    6 +-
 arch/arm64/boot/dts/qcom/sm8150.dtsi               |    8 +-
 .../boot/dts/qcom/sm8250-xiaomi-elish-common.dtsi  |    2 +-
 arch/arm64/boot/dts/qcom/sm8250.dtsi               |   48 +-
 arch/arm64/boot/dts/qcom/sm8350.dtsi               |    8 +-
 arch/arm64/boot/dts/qcom/sm8450.dtsi               |    8 +-
 arch/arm64/boot/dts/qcom/sm8550.dtsi               |    8 +-
 arch/arm64/boot/dts/qcom/sm8650.dtsi               |   97 +-
 arch/arm64/boot/dts/qcom/x1e80100.dtsi             |    4 +-
 .../boot/dts/rockchip/rk3399-gru-chromebook.dtsi   |    3 +-
 arch/arm64/boot/dts/ti/k3-am64-main.dtsi           |    2 +-
 arch/arm64/include/asm/pgtable.h                   |    8 +-
 arch/arm64/include/asm/ptdump.h                    |   22 +-
 arch/arm64/kernel/hibernate.c                      |   16 +-
 arch/arm64/kvm/Kconfig                             |    4 +-
 arch/arm64/lib/Makefile                            |    4 +
 arch/arm64/mm/Makefile                             |    2 +-
 arch/arm64/mm/fault.c                              |   12 +-
 arch/arm64/mm/ptdump.c                             |   60 +-
 arch/csky/kernel/entry.S                           |    6 +-
 arch/loongarch/Kconfig                             |    2 +-
 arch/loongarch/configs/loongson3_defconfig         |    5 +-
 arch/loongarch/include/asm/kvm_host.h              |    1 +
 arch/loongarch/kernel/acpi.c                       |    3 +-
 arch/loongarch/kernel/kprobes.c                    |    3 +
 arch/loongarch/kernel/rethook_trampoline.S         |    2 -
 arch/loongarch/kvm/main.c                          |    6 +-
 arch/loongarch/kvm/mmu.c                           |   10 +
 arch/loongarch/kvm/vcpu.c                          |    6 +-
 arch/loongarch/kvm/vm.c                            |    1 +
 arch/m68k/emu/nfcon.c                              |    2 +-
 arch/m68k/kernel/traps.c                           |    4 +-
 arch/mips/kernel/ptrace.c                          |    6 +-
 arch/parisc/kernel/head.S                          |    1 +
 arch/powerpc/Kconfig                               |    4 +-
 arch/powerpc/configs/85xx-hw.config                |    1 +
 arch/powerpc/include/asm/papr-watchdog.h           |   64 ++
 arch/powerpc/include/asm/thread_info.h             |    9 +-
 arch/powerpc/include/asm/vdso_datapage.h           |   24 +-
 arch/powerpc/kernel/asm-offsets.c                  |    2 -
 arch/powerpc/kernel/ima_arch.c                     |    5 -
 arch/powerpc/kernel/interrupt.c                    |    4 +-
 arch/powerpc/kernel/irq.c                          |   16 +-
 arch/powerpc/kernel/secure_boot.c                  |   11 +-
 arch/powerpc/kernel/smp.c                          |    3 +
 arch/powerpc/kernel/vdso.c                         |   16 +-
 arch/powerpc/kernel/vdso/cacheflush.S              |    2 +-
 arch/powerpc/kernel/vdso/datapage.S                |    4 +-
 arch/powerpc/kernel/vdso/getrandom.S               |    3 +-
 arch/powerpc/kernel/vdso/gettimeofday.S            |    5 +-
 arch/powerpc/kernel/vdso/vdso32.lds.S              |    2 +-
 arch/powerpc/kernel/vdso/vdso64.lds.S              |    2 +-
 arch/powerpc/kexec/crash.c                         |    2 +-
 arch/powerpc/kexec/file_load_64.c                  |    2 +-
 arch/powerpc/kexec/ranges.c                        |   12 +-
 arch/powerpc/mm/Makefile                           |    2 +-
 arch/powerpc/mm/book3s64/radix_pgtable.c           |    7 +-
 arch/powerpc/mm/ptdump/ptdump.c                    |   46 +-
 arch/powerpc/platforms/pseries/setup.c             |   28 +-
 arch/riscv/Kconfig                                 |    2 +-
 arch/riscv/boot/dts/sophgo/cv18xx.dtsi             |    2 +-
 arch/riscv/include/asm/kexec.h                     |    5 +
 arch/riscv/kernel/Makefile                         |    2 +-
 arch/riscv/kernel/cpufeature.c                     |    3 +-
 arch/riscv/kernel/elf_kexec.c                      |  485 ---------
 arch/riscv/kernel/kexec_elf.c                      |  144 +++
 arch/riscv/kernel/machine_kexec_file.c             |  368 +++++++
 arch/riscv/mm/Makefile                             |    2 +-
 arch/riscv/mm/ptdump.c                             |   46 +-
 arch/riscv/net/bpf_jit_comp64.c                    |    5 +-
 arch/riscv/net/bpf_jit_core.c                      |    1 +
 arch/s390/Kconfig                                  |    5 +-
 arch/s390/include/asm/irqflags.h                   |   20 +-
 arch/s390/include/asm/thread_info.h                |   21 +-
 arch/s390/kernel/Makefile                          |    2 +-
 arch/s390/kernel/debug.c                           |   10 +-
 arch/s390/kernel/ima_arch.c                        |   14 -
 arch/s390/kernel/ipl.c                             |    6 +
 arch/s390/kernel/irqflags.c                        |   28 +
 arch/s390/kvm/guestdbg.c                           |    9 +-
 arch/s390/kvm/interrupt.c                          |    2 +-
 arch/s390/kvm/kvm-s390.c                           |   15 +-
 arch/s390/mm/Makefile                              |    2 +-
 arch/s390/mm/dump_pagetables.c                     |   46 +-
 arch/s390/net/bpf_jit_comp.c                       |   11 +
 arch/x86/Kconfig                                   |    2 +-
 arch/x86/Kconfig.debug                             |    2 +-
 arch/x86/entry/entry_64_fred.S                     |    2 +
 arch/x86/events/amd/uncore.c                       |   31 +
 arch/x86/events/intel/lbr.c                        |   12 +-
 arch/x86/events/intel/pt.c                         |  137 ++-
 arch/x86/events/intel/pt.h                         |    4 +
 arch/x86/events/intel/uncore.c                     |    2 -
 arch/x86/include/asm/efi.h                         |    4 +-
 arch/x86/include/asm/linkage.h                     |    2 +-
 arch/x86/include/asm/pkeys.h                       |    3 +
 arch/x86/kvm/hyperv.c                              |   25 +-
 arch/x86/kvm/mmu/mmu.c                             |   35 +-
 arch/x86/kvm/vmx/nested.c                          |   75 +-
 arch/x86/kvm/x86.c                                 |    5 +-
 arch/x86/kvm/x86.h                                 |    2 +-
 arch/x86/mm/Makefile                               |    2 +-
 arch/x86/mm/dump_pagetables.c                      |   39 +-
 arch/x86/net/bpf_jit_comp.c                        |    7 +-
 arch/x86/platform/efi/efi.c                        |    2 +-
 block/bdev.c                                       |    3 +-
 block/blk-cgroup.c                                 |    2 +
 block/blk-iocost.c                                 |    2 +-
 block/blk-stat.c                                   |    2 +-
 block/genhd.c                                      |    7 +
 block/kyber-iosched.c                              |    2 +-
 crypto/lskcipher.c                                 |    1 -
 drivers/accessibility/speakup/keyhelp.c            |   17 +-
 drivers/accessibility/speakup/kobjects.c           |    6 +-
 drivers/acpi/battery.c                             |   44 +-
 drivers/acpi/cppc_acpi.c                           |  228 ++---
 drivers/acpi/ec.c                                  |   40 +-
 drivers/acpi/pci_root.c                            |    3 +-
 drivers/acpi/processor_core.c                      |   31 +-
 drivers/acpi/processor_driver.c                    |   18 +-
 drivers/acpi/processor_idle.c                      |  103 +-
 drivers/acpi/riscv/irq.c                           |   33 +-
 drivers/acpi/scan.c                                |   13 +-
 drivers/acpi/video_detect.c                        |    4 +-
 drivers/ata/ahci.c                                 |   49 +
 drivers/base/cacheinfo.c                           |    9 +-
 drivers/base/firmware_loader/fallback.c            |   10 +
 drivers/base/memory.c                              |    8 +-
 drivers/base/soc.c                                 |   15 +-
 drivers/base/swnode.c                              |    2 +-
 drivers/block/mtip32xx/mtip32xx.c                  |    7 +
 drivers/block/mtip32xx/mtip32xx.h                  |    2 +
 drivers/block/null_blk/main.c                      |   78 +-
 drivers/block/ublk_drv.c                           |   16 +-
 drivers/bluetooth/btintel.c                        |    2 +-
 drivers/bluetooth/btmtk.c                          |  104 +-
 drivers/bluetooth/btmtk.h                          |    8 +-
 drivers/bluetooth/btmtksdio.c                      |   84 +-
 drivers/bluetooth/btqca.c                          |    3 +-
 drivers/bluetooth/btusb.c                          |   68 +-
 drivers/bluetooth/virtio_bt.c                      |    8 +-
 drivers/bus/mhi/ep/main.c                          |   15 +-
 drivers/bus/mhi/host/init.c                        |    4 +-
 drivers/bus/mhi/host/main.c                        |    6 +
 drivers/bus/qcom-ebi2.c                            |   51 +-
 drivers/bus/ti-sysc.c                              |   12 +-
 drivers/char/hw_random/core.c                      |    4 +-
 drivers/char/hw_random/ks-sa-rng.c                 |    9 +-
 drivers/char/ppdev.c                               |   10 +-
 drivers/char/tpm/st33zp24/st33zp24.c               |    8 +-
 drivers/char/xilinx_hwicap/xilinx_hwicap.c         |    5 +-
 drivers/clk/clk-devres.c                           |   12 +-
 drivers/clk/clk-moxart.c                           |   14 -
 drivers/clk/clk-palmas.c                           |   14 +-
 drivers/clk/clk-versaclock7.c                      |    2 +-
 drivers/clk/hisilicon/reset.c                      |    2 +-
 drivers/clk/imx/clk-scu.c                          |    1 -
 drivers/clk/mediatek/clk-mt8135.c                  |    5 +-
 drivers/clk/meson/gxbb.c                           |    2 +-
 drivers/clk/nuvoton/clk-ma35d1-pll.c               |   52 +-
 drivers/clk/qcom/camcc-sc8280xp.c                  |   19 -
 drivers/clk/qcom/common.c                          |    4 +-
 drivers/clk/qcom/gcc-mdm9607.c                     |  182 +---
 drivers/clk/qcom/gcc-msm8916.c                     |    5 +-
 drivers/clk/qcom/gcc-msm8939.c                     |    5 +-
 drivers/clk/qcom/gcc-qcm2290.c                     |   12 +-
 drivers/clk/qcom/gdsc.c                            |   25 +-
 drivers/clk/qcom/gpucc-qcm2290.c                   |    2 +-
 drivers/clk/rockchip/clk-pll.c                     |    9 +-
 drivers/clk/rockchip/clk-rk3576.c                  |   11 +-
 drivers/clk/rockchip/clk-rk3588.c                  |    2 +-
 drivers/clk/tegra/clk-tegra124-emc.c               |    1 +
 drivers/clk/ti/adpll.c                             |    4 +-
 drivers/clk/ti/divider.c                           |    2 +-
 drivers/clk/ti/mux.c                               |   22 +-
 drivers/clk/visconti/clkc.c                        |    2 +-
 drivers/clk/x86/clk-pmc-atom.c                     |    3 +
 drivers/clocksource/clps711x-timer.c               |    2 +-
 drivers/clocksource/timer-armada-370-xp.c          |   18 +-
 drivers/cpufreq/amd-pstate.c                       |   33 +-
 drivers/cpufreq/imx6q-cpufreq.c                    |    6 +-
 drivers/cpufreq/intel_pstate.c                     |   19 +-
 drivers/cpufreq/spear-cpufreq.c                    |    4 +-
 drivers/cpuidle/dt_idle_genpd.c                    |    3 +-
 drivers/crypto/atmel-ecc.c                         |   45 +-
 drivers/crypto/atmel-sha204a.c                     |    6 +-
 drivers/crypto/ccp/sev-dev.c                       |   17 +-
 drivers/crypto/gemini/sl3516-ce-cipher.c           |    8 -
 drivers/crypto/hisilicon/sec2/sec_crypto.c         |   12 +-
 .../crypto/intel/keembay/keembay-ocs-aes-core.c    |    9 +-
 drivers/crypto/intel/qat/qat_common/adf_aer.c      |    2 +
 drivers/crypto/intel/qat/qat_common/qat_algs.c     |    1 +
 drivers/crypto/rockchip/rk3288_crypto_ahash.c      |    7 +-
 drivers/crypto/sa2ul.c                             |    6 +-
 drivers/cxl/core/core.h                            |    6 +-
 drivers/cxl/core/mbox.c                            |   95 +-
 drivers/cxl/core/memdev.c                          |   24 +-
 drivers/cxl/core/region.c                          |    7 +-
 drivers/cxl/cxlmem.h                               |   40 -
 drivers/cxl/pci.c                                  |   13 +-
 drivers/dax/super.c                                |   12 +-
 drivers/dma/dw-edma/dw-edma-core.c                 |  127 ++-
 drivers/dma/dw-edma/dw-hdma-v0-core.c              |    2 +-
 drivers/dma/fsl-edma-trace.h                       |    4 +-
 drivers/dma/hisi_dma.c                             |    2 +-
 drivers/dma/mediatek/mtk-uart-apdma.c              |    2 +-
 drivers/dma/qcom/bam_dma.c                         |    1 +
 drivers/dma/xilinx/xilinx_dma.c                    |   12 +-
 drivers/firewire/.kunitconfig                      |    1 +
 drivers/firewire/Kconfig                           |   15 +
 drivers/firewire/core-topology.c                   |   62 +-
 drivers/firewire/node-tree-test.c                  |  607 +++++++++++
 drivers/firmware/arm_scmi/bus.c                    |   67 +-
 drivers/firmware/arm_scmi/driver.c                 |   72 +-
 drivers/firmware/arm_scmi/notify.c                 |   21 +
 drivers/firmware/arm_scmi/notify.h                 |    1 +
 drivers/firmware/arm_scmi/transports/mailbox.c     |   26 +-
 drivers/firmware/arm_scmi/transports/smc.c         |   15 +-
 drivers/firmware/google/coreboot_table.c           |   26 +-
 drivers/firmware/qcom/Makefile                     |    1 +
 drivers/firmware/qcom/qcom_scm-smc.c               |   12 +-
 drivers/firmware/qcom/qcom_scm.c                   |  140 ++-
 drivers/firmware/qcom/qcom_scm.h                   |    3 +-
 drivers/firmware/qcom/qcom_scm_trace.h             |  143 +++
 drivers/firmware/qcom/qcom_tzmem.c                 |   13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c   |    7 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |   14 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |    1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c            |    6 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |    2 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c              |   74 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c              |   10 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c              |   10 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |    3 +-
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c  |   10 +
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c    |   13 +
 .../gpu/drm/amd/display/dc/hubp/dcn10/dcn10_hubp.c |    3 +-
 .../display/dc/link/protocols/link_dp_dpia_bw.c    |    5 +
 .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c    |   24 +
 .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c  |   35 +-
 .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c    |    2 +-
 drivers/gpu/drm/bridge/synopsys/dw-hdmi.c          |    3 +-
 drivers/gpu/drm/bridge/tc358767.c                  |    2 +-
 drivers/gpu/drm/drm_atomic_uapi.c                  |    2 +
 drivers/gpu/drm/drm_drv.c                          |   34 +-
 drivers/gpu/drm/drm_dumb_buffers.c                 |    1 -
 drivers/gpu/drm/gud/gud_connector.c                |   12 +-
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c     |   54 +-
 drivers/gpu/drm/i915/i915_pci.c                    |    3 +
 drivers/gpu/drm/lima/lima_device.c                 |   12 +-
 drivers/gpu/drm/msm/adreno/a6xx_catalog.c          |    2 +-
 drivers/gpu/drm/msm/adreno/a6xx_gmu.c              |    5 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c      |    4 +
 drivers/gpu/drm/msm/dsi/dsi_host.c                 |   14 +-
 drivers/gpu/drm/mxsfb/lcdif_kms.c                  |   15 +-
 drivers/gpu/drm/nouveau/nouveau_chan.c             |    9 +-
 drivers/gpu/drm/nouveau/nouveau_sgdma.c            |    4 +-
 drivers/gpu/drm/nouveau/nouveau_uvmm.c             |    6 +-
 drivers/gpu/drm/omapdrm/dss/dsi.c                  |    7 +-
 drivers/gpu/drm/omapdrm/dss/dsi.h                  |    2 -
 drivers/gpu/drm/panel/panel-edp.c                  |   19 +-
 drivers/gpu/drm/panel/panel-samsung-s6d16d0.c      |   10 +-
 drivers/gpu/drm/panthor/panthor_drv.c              |    2 +-
 drivers/gpu/drm/panthor/panthor_fw.c               |   19 +-
 drivers/gpu/drm/rockchip/rockchip_drm_vop2.c       |    2 +
 drivers/gpu/drm/solomon/ssd130x.c                  |    9 +-
 drivers/gpu/drm/sun4i/sun4i_backend.c              |    2 +-
 drivers/gpu/drm/sun4i/sun4i_crtc.c                 |    2 +-
 drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c             |    2 +-
 drivers/gpu/drm/sun4i/sun4i_tcon.c                 |   22 +-
 drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c              |    2 +
 drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c             |    2 +-
 drivers/gpu/drm/sun4i/sun8i_vi_scaler.c            |   18 +-
 drivers/gpu/drm/tve200/tve200_drv.c                |    1 +
 drivers/gpu/drm/v3d/v3d_drv.h                      |    8 +-
 drivers/gpu/drm/v3d/v3d_fence.c                    |   11 +-
 drivers/gpu/drm/v3d/v3d_gem.c                      |    3 +-
 drivers/gpu/drm/v3d/v3d_irq.c                      |    6 +-
 drivers/gpu/drm/v3d/v3d_sched.c                    |   67 +-
 drivers/gpu/drm/xe/tests/xe_migrate.c              |    3 +-
 drivers/gpu/host1x/debug.c                         |    4 +-
 drivers/gpu/host1x/hw/channel_hw.c                 |    5 +-
 drivers/hid/bpf/hid_bpf_struct_ops.c               |   17 +-
 drivers/hid/hid-core.c                             |    9 +
 drivers/hid/hid-lg4ff.c                            |    8 +
 drivers/hid/hid-multitouch.c                       |    2 +-
 drivers/hid/hid-nintendo.c                         |    1 -
 drivers/hid/hid-rmi.c                              |   46 +-
 drivers/hid/hid-roccat-kone.c                      |    8 +-
 drivers/hid/i2c-hid/Makefile                       |    2 +-
 drivers/hid/i2c-hid/i2c-hid-acpi-prp0001.c         |  104 ++
 drivers/hid/i2c-hid/i2c-hid-acpi.c                 |   54 +-
 drivers/hid/i2c-hid/i2c-hid-acpi.h                 |   33 +
 drivers/hid/i2c-hid/i2c-hid-core.c                 |    2 +-
 drivers/hid/i2c-hid/i2c-hid-of-goodix.c            |    4 +-
 drivers/hid/wacom_wac.c                            |   13 +
 drivers/hwmon/coretemp.c                           |    1 +
 drivers/hwmon/emc1403.c                            |   73 +-
 drivers/hwspinlock/hwspinlock_core.c               |    2 +-
 drivers/hwtracing/coresight/coresight-etm4x-cfg.c  |    2 +-
 drivers/hwtracing/coresight/coresight-etm4x-core.c |   15 +-
 .../hwtracing/coresight/coresight-etm4x-sysfs.c    |    6 +-
 drivers/hwtracing/coresight/coresight-etm4x.h      |    9 +-
 drivers/i2c/busses/i2c-ocores.c                    |    6 +-
 drivers/i2c/i2c-core-base.c                        |    6 +
 drivers/i2c/i2c-mux.c                              |    1 +
 drivers/i2c/muxes/i2c-demux-pinctrl.c              |    1 +
 drivers/i3c/master.c                               |    2 +
 drivers/i3c/master/dw-i3c-master.c                 |   10 +-
 drivers/i3c/master/mipi-i3c-hci/core.c             |   18 +-
 drivers/i3c/master/mipi-i3c-hci/dma.c              |    4 +-
 drivers/i3c/master/mipi-i3c-hci/ext_caps.c         |   55 +-
 drivers/i3c/master/mipi-i3c-hci/pio.c              |   54 +-
 drivers/iio/accel/dmard09.c                        |    7 +
 drivers/iio/adc/Kconfig                            |    1 +
 drivers/iio/adc/pac1921.c                          |    2 +-
 drivers/iio/chemical/atlas-sensor.c                |   19 +-
 drivers/iio/chemical/sgp30.c                       |    3 +
 drivers/iio/dac/m62332.c                           |   17 +-
 drivers/iio/gyro/mpu3050-core.c                    |    2 +-
 drivers/iio/industrialio-buffer.c                  |   38 +-
 drivers/iio/light/cm32181.c                        |    2 +-
 drivers/iio/light/gp2ap002.c                       |   24 +-
 drivers/iio/light/isl29028.c                       |    2 +-
 drivers/iio/light/ltrf216a.c                       |    3 +-
 drivers/iio/light/opt4001.c                        |   37 +-
 drivers/iio/light/tsl2583.c                        |    2 +-
 drivers/iio/light/tsl2772.c                        |    2 +-
 drivers/iio/orientation/hid-sensor-rotation.c      |   20 +-
 drivers/iio/pressure/dps310.c                      |    3 +-
 drivers/iio/pressure/mpl115.c                      |   11 +-
 drivers/iio/proximity/srf04.c                      |    1 +
 drivers/iio/temperature/hid-sensor-temperature.c   |    3 +-
 drivers/infiniband/core/cma.c                      |    6 +-
 drivers/infiniband/core/counters.c                 |    5 +-
 drivers/infiniband/core/cq.c                       |   14 +-
 drivers/infiniband/core/device.c                   |    3 +
 drivers/infiniband/core/nldev.c                    |   20 +-
 drivers/infiniband/core/restrack.c                 |  174 +++-
 drivers/infiniband/core/restrack.h                 |    4 +
 drivers/infiniband/core/ucma.c                     |    2 +-
 drivers/infiniband/core/uverbs_cmd.c               |   10 +-
 drivers/infiniband/core/verbs.c                    |   32 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |    6 +-
 drivers/infiniband/hw/cxgb4/device.c               |    2 +-
 drivers/infiniband/hw/cxgb4/mem.c                  |    4 +-
 drivers/infiniband/hw/efa/efa_verbs.c              |   15 +-
 drivers/infiniband/hw/erdma/Kconfig                |    4 +-
 drivers/infiniband/hw/erdma/erdma.h                |   12 +-
 drivers/infiniband/hw/erdma/erdma_cm.c             |   77 +-
 drivers/infiniband/hw/erdma/erdma_cmdq.c           |   26 +-
 drivers/infiniband/hw/erdma/erdma_cq.c             |   45 +
 drivers/infiniband/hw/erdma/erdma_eq.c             |   16 +-
 drivers/infiniband/hw/erdma/erdma_hw.h             |   98 +-
 drivers/infiniband/hw/erdma/erdma_main.c           |   51 +-
 drivers/infiniband/hw/erdma/erdma_qp.c             |  230 +++--
 drivers/infiniband/hw/erdma/erdma_verbs.c          |  572 +++++++++--
 drivers/infiniband/hw/erdma/erdma_verbs.h          |  206 +++-
 drivers/infiniband/hw/hfi1/chip.c                  |    4 +-
 drivers/infiniband/hw/hfi1/hfi.h                   |    2 -
 drivers/infiniband/hw/hfi1/init.c                  |   44 +-
 drivers/infiniband/hw/hfi1/user_sdma.c             |   13 +-
 drivers/infiniband/hw/mlx5/cong.c                  |    8 +-
 drivers/infiniband/hw/mlx5/main.c                  |    2 +
 drivers/infiniband/hw/mlx5/qp.c                    |   25 +-
 drivers/infiniband/sw/rxe/rxe_req.c                |   15 +
 drivers/infiniband/sw/rxe/rxe_resp.c               |    9 +-
 drivers/infiniband/sw/siw/siw_cm.c                 |    2 +-
 drivers/infiniband/ulp/ipoib/ipoib_main.c          |    2 +
 drivers/infiniband/ulp/isert/ib_isert.c            |   85 +-
 drivers/infiniband/ulp/isert/ib_isert.h            |    1 +
 drivers/infiniband/ulp/srp/ib_srp.c                |   45 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |    9 +-
 drivers/input/tablet/aiptek.c                      |   13 +-
 drivers/iommu/amd/init.c                           |   42 +-
 drivers/iommu/amd/ppr.c                            |    2 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c        |    5 +-
 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c     |   43 +-
 drivers/iommu/arm/arm-smmu/qcom_iommu.c            |    6 +-
 drivers/iommu/dma-iommu.c                          |   13 +-
 drivers/iommu/intel/iommu.c                        |   17 +-
 drivers/iommu/iommufd/selftest.c                   |    5 +-
 drivers/iommu/msm_iommu.c                          |    2 +-
 drivers/iommu/mtk_iommu_v1.c                       |    2 +-
 drivers/ipack/devices/ipoctal.c                    |   56 +-
 drivers/irqchip/irq-gic-v3-its.c                   |   23 +-
 drivers/irqchip/irq-mbigen.c                       |   20 +-
 drivers/irqchip/irq-renesas-irqc.c                 |    1 +
 drivers/irqchip/irq-renesas-rzg2l.c                |    4 +-
 drivers/irqchip/irq-stm32mp-exti.c                 |    4 +-
 drivers/leds/leds-pca9532.c                        |   18 +-
 drivers/mailbox/pcc.c                              |   70 +-
 drivers/mailbox/qcom-cpucp-mbox.c                  |   25 +-
 drivers/mailbox/rockchip-mailbox.c                 |   17 +-
 drivers/md/dm-raid.c                               |   42 +-
 drivers/md/dm.c                                    |   14 +-
 drivers/md/md-bitmap.c                             |   17 +-
 drivers/md/md-cluster.c                            |   16 +-
 drivers/md/md.c                                    |  334 +++++--
 drivers/md/md.h                                    |   15 +-
 drivers/md/raid0.c                                 |   10 +-
 drivers/md/raid1-10.c                              |    2 +-
 drivers/md/raid1.c                                 |   20 +-
 drivers/md/raid10.c                                |   20 +-
 drivers/md/raid5-ppl.c                             |   10 +-
 drivers/md/raid5.c                                 |  138 +--
 drivers/media/cec/core/cec-adap.c                  |   10 +-
 drivers/media/cec/core/cec-core.c                  |    2 -
 drivers/media/cec/core/cec-pin.c                   |    8 +-
 drivers/media/cec/platform/meson/ao-cec-g12a.c     |    1 +
 .../extron-da-hd-4k-plus/extron-da-hd-4k-plus.c    |    3 +-
 drivers/media/dvb-frontends/rtl2832_sdr.c          |   23 +-
 drivers/media/i2c/alvium-csi2.c                    |    2 +-
 drivers/media/i2c/imx415.c                         |    2 +-
 drivers/media/i2c/ov02a10.c                        |   12 +-
 drivers/media/i2c/ov7740.c                         |    4 +-
 drivers/media/i2c/rdacm21.c                        |    5 +-
 drivers/media/i2c/video-i2c.c                      |    8 +-
 drivers/media/pci/cobalt/cobalt-alsa-main.c        |    1 -
 drivers/media/pci/cx23885/cimax2.c                 |    1 +
 drivers/media/pci/intel/ipu6/ipu6-isys.c           |    1 +
 drivers/media/pci/intel/ipu6/ipu6.c                |   10 +-
 drivers/media/pci/saa7164/saa7164-core.c           |    8 +-
 drivers/media/pci/zoran/zoran_card.c               |    2 +-
 drivers/media/platform/amphion/venc.c              |    2 -
 drivers/media/platform/broadcom/bcm2835-unicam.c   |    2 +
 .../platform/chips-media/wave5/wave5-vpu-dec.c     |    3 +-
 .../media/platform/mediatek/mdp3/mtk-mdp3-core.c   |    6 +-
 .../platform/nxp/imx8-isi/imx8-isi-crossbar.c      |    6 +-
 .../media/platform/nxp/imx8-isi/imx8-isi-video.c   |    2 +-
 drivers/media/platform/qcom/venus/hfi_parser.c     |    9 +-
 drivers/media/rc/sunxi-cir.c                       |    9 +-
 drivers/media/test-drivers/vimc/vimc-capture.c     |    4 +-
 drivers/media/tuners/tda18250.c                    |    4 +-
 drivers/media/usb/airspy/airspy.c                  |   19 +-
 drivers/media/usb/cx231xx/cx231xx-video.c          |    4 +-
 drivers/media/usb/em28xx/em28xx-cards.c            |    3 +-
 drivers/media/usb/em28xx/em28xx-core.c             |    2 +
 drivers/media/usb/go7007/snd-go7007.c              |   10 +-
 drivers/media/usb/s2255/s2255drv.c                 |   11 +
 drivers/media/usb/usbtv/usbtv-audio.c              |   11 +
 drivers/media/v4l2-core/v4l2-async.c               |   16 +-
 drivers/media/v4l2-core/v4l2-ctrls-core.c          |   49 +-
 drivers/media/v4l2-core/v4l2-fwnode.c              |    2 +
 drivers/mfd/iqs62x.c                               |    2 +-
 drivers/mfd/rave-sp.c                              |   64 +-
 drivers/misc/ad525x_dpot-i2c.c                     |    1 +
 drivers/misc/ad525x_dpot-spi.c                     |    1 +
 drivers/misc/ad525x_dpot.c                         |  177 ++--
 drivers/misc/ad525x_dpot.h                         |    3 +
 drivers/misc/bcm-vk/bcm_vk_msg.c                   |    6 +-
 drivers/misc/cardreader/rtsx_pcr.c                 |    2 +
 drivers/misc/cardreader/rtsx_usb.c                 |   23 +-
 drivers/misc/sgi-gru/grufault.c                    |  101 +-
 drivers/misc/sgi-gru/gruprocfs.c                   |    1 -
 drivers/misc/sgi-gru/grutables.h                   |    1 -
 drivers/misc/vmw_vmci/vmci_event.c                 |    4 +-
 drivers/mtd/mtdoops.c                              |    3 +
 drivers/mtd/mtdpart.c                              |    3 +-
 drivers/mtd/mtdswap.c                              |    1 +
 drivers/mtd/nand/raw/nand_onfi.c                   |   27 +-
 drivers/mtd/parsers/afs.c                          |    7 +
 drivers/mtd/ubi/attach.c                           |    4 +-
 drivers/mtd/ubi/build.c                            |   11 +-
 drivers/mtd/ubi/fastmap.c                          |    6 +-
 drivers/mtd/ubi/io.c                               |   11 +-
 drivers/mtd/ubi/ubi.h                              |    4 +-
 drivers/mtd/ubi/wl.c                               |   15 +-
 drivers/net/bonding/bond_netlink.c                 |    2 +-
 drivers/net/dsa/b53/b53_common.c                   |    2 +-
 drivers/net/dsa/mv88e6xxx/pcs-6352.c               |    5 +-
 drivers/net/ethernet/allwinner/sun4i-emac.c        |    4 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_hwmon.c    |    2 +-
 drivers/net/ethernet/freescale/fec_main.c          |    6 +-
 drivers/net/ethernet/intel/ice/ice_lib.c           |    3 +
 .../net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c |    2 +-
 .../ethernet/marvell/octeontx2/af/rvu_debugfs.c    |    6 +
 .../net/ethernet/marvell/octeontx2/af/rvu_nix.c    |   11 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c  |    2 +-
 drivers/net/ethernet/nvidia/forcedeth.c            |    2 +-
 drivers/net/ethernet/pensando/ionic/ionic_txrx.c   |   27 +-
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c   |  467 +++++----
 .../net/ethernet/qualcomm/rmnet/rmnet_map_data.c   |    1 +
 drivers/net/ethernet/realtek/8139cp.c              |    2 +-
 .../net/ethernet/stmicro/stmmac/dwmac1000_core.c   |    2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c  |    2 +-
 .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c    |    2 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |    4 +
 .../net/ethernet/stmicro/stmmac/stmmac_selftests.c |   41 +-
 drivers/net/ethernet/wangxun/libwx/wx_type.h       |    2 +-
 drivers/net/ethernet/wangxun/txgbe/txgbe_type.h    |    2 +-
 drivers/net/gtp.c                                  |    2 +
 drivers/net/ipa/ipa_main.c                         |    6 +-
 drivers/net/ntb_netdev.c                           |   27 +-
 drivers/net/ppp/pppox.c                            |   17 +
 drivers/net/slip/slip.c                            |    8 -
 drivers/net/thunderbolt/main.c                     |    6 +-
 drivers/net/vxlan/vxlan_mdb.c                      |    9 +-
 drivers/net/vxlan/vxlan_vnifilter.c                |    6 +-
 drivers/net/wireless/ath/ath10k/snoc.c             |    9 +-
 drivers/net/wireless/ath/ath11k/dp_rx.c            |   32 +-
 drivers/net/wireless/ath/ath11k/wmi.c              |   40 +-
 drivers/net/wireless/ath/ath12k/wmi.c              |   20 +-
 drivers/net/wireless/ath/ath6kl/wmi.c              |   17 +-
 drivers/net/wireless/intel/iwlwifi/fw/dump.c       |    2 +-
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c   |    8 +-
 drivers/net/wireless/intel/iwlwifi/mei/main.c      |    8 +-
 drivers/net/wireless/intel/iwlwifi/mvm/ops.c       |    2 +-
 drivers/net/wireless/mediatek/mt76/dma.c           |   16 +-
 drivers/net/wireless/mediatek/mt76/dma.h           |    2 +-
 drivers/net/wireless/mediatek/mt76/mac80211.c      |    7 +
 drivers/net/wireless/mediatek/mt76/mt76.h          |    3 +
 drivers/net/wireless/mediatek/mt76/mt76_connac.h   |    5 +
 drivers/net/wireless/mediatek/mt76/mt76x02_mac.c   |    2 +-
 drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c |    2 +-
 drivers/net/wireless/mediatek/mt76/mt7915/init.c   |    9 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mac.c    |    6 +-
 drivers/net/wireless/mediatek/mt76/mt7915/main.c   |   24 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |   10 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.h    |    6 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h |   18 +
 drivers/net/wireless/mediatek/mt76/mt7915/pci.c    |    9 +-
 drivers/net/wireless/mediatek/mt76/mt7915/soc.c    |    2 +-
 .../net/wireless/mediatek/mt76/mt7915/testmode.c   |    5 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c    |   28 +-
 drivers/net/wireless/mediatek/mt76/mt7925/main.c   |   66 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c    |    2 +-
 drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c |    6 +
 drivers/net/wireless/mediatek/mt76/mt7996/init.c   |   16 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mac.c    |    7 +
 drivers/net/wireless/mediatek/mt76/mt7996/main.c   |    2 -
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c    |   16 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.h    |    2 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mmio.c   |   12 +-
 drivers/net/wireless/mediatek/mt76/sdio.c          |   11 +-
 drivers/net/wireless/mediatek/mt76/tx.c            |    8 +-
 drivers/net/wireless/realtek/rtlwifi/pci.c         |    6 +-
 drivers/net/wireless/realtek/rtw89/mac.c           |    2 +-
 drivers/net/wireless/virtual/mac80211_hwsim.c      |    5 +-
 drivers/net/wireless/zydas/zd1211rw/zd_usb.c       |    8 +
 drivers/nfc/pn533/pn533.c                          |   21 +-
 drivers/nvdimm/btt.c                               |    8 +
 drivers/nvdimm/label.c                             |   15 +-
 drivers/nvme/host/apple.c                          |  227 +++--
 drivers/nvme/host/fabrics.c                        |    2 +
 drivers/nvme/host/fc.c                             |   32 +-
 drivers/nvme/host/ioctl.c                          |  117 ++-
 drivers/nvme/host/tcp.c                            |    7 +
 drivers/nvme/target/auth.c                         |    6 +
 drivers/nvme/target/core.c                         |    2 +-
 drivers/nvme/target/fabrics-cmd-auth.c             |   12 +-
 drivers/nvme/target/nvmet.h                        |    2 +
 drivers/nvme/target/rdma.c                         |   31 +-
 drivers/nvme/target/tcp.c                          |   10 +
 drivers/nvme/target/zns.c                          |    2 +-
 drivers/of/property.c                              |   81 ++
 drivers/of/unittest.c                              |    8 +-
 drivers/parisc/eisa.c                              |    5 +
 drivers/pci/controller/cadence/pci-j721e.c         |    4 +-
 drivers/pci/controller/pci-xgene.c                 |   11 +-
 drivers/pci/controller/plda/pcie-starfive.c        |   10 +-
 drivers/pci/pcie/aspm.c                            |   31 +-
 drivers/pci/probe.c                                |    7 +
 drivers/perf/arm_spe_pmu.c                         |    2 +-
 drivers/perf/cxl_pmu.c                             |    2 +-
 drivers/phy/qualcomm/phy-qcom-qmp-combo.c          | 1056 ++++++++++++++++++--
 drivers/phy/qualcomm/phy-qcom-qmp-dp-phy-v8.h      |   25 +
 .../phy/qualcomm/phy-qcom-qmp-dp-qserdes-com-v8.h  |   52 +
 drivers/phy/qualcomm/phy-qcom-qmp-pcs-aon-v6.h     |   12 +
 drivers/phy/qualcomm/phy-qcom-qmp-pcs-aon-v8.h     |   17 +
 drivers/phy/qualcomm/phy-qcom-qmp-pcs-misc-v5.h    |   12 +
 drivers/phy/qualcomm/phy-qcom-qmp-pcs-misc-v8.h    |   12 +
 drivers/phy/qualcomm/phy-qcom-qmp-pcs-usb-v8.h     |   38 +
 drivers/phy/qualcomm/phy-qcom-qmp-pcs-v8.h         |   32 +
 drivers/phy/qualcomm/phy-qcom-qmp-qserdes-com-v8.h |   64 ++
 .../phy/qualcomm/phy-qcom-qmp-qserdes-lalb-v8.h    |  639 ++++++++++++
 .../phy/qualcomm/phy-qcom-qmp-qserdes-txrx-v8.h    |   68 ++
 drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c     |   12 +-
 drivers/phy/qualcomm/phy-qcom-qmp-usb.c            |   12 +-
 drivers/phy/qualcomm/phy-qcom-qmp-usb43-pcs-v8.h   |   33 +
 .../qualcomm/phy-qcom-qmp-usb43-qserdes-com-v8.h   |  224 +++++
 drivers/phy/qualcomm/phy-qcom-qmp.h                |    7 +
 drivers/phy/qualcomm/phy-qcom-sgmii-eth.c          |   43 +-
 drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c      |   26 +-
 drivers/phy/rockchip/phy-rockchip-inno-csidphy.c   |    2 +-
 drivers/phy/starfive/phy-jh7110-dphy-rx.c          |    5 +-
 drivers/phy/starfive/phy-jh7110-dphy-tx.c          |    5 +-
 drivers/phy/sunplus/phy-sunplus-usb2.c             |    6 +-
 drivers/pinctrl/bcm/pinctrl-bcm2835.c              |    1 -
 drivers/pinctrl/mediatek/mtk-eint.c                |  340 ++++---
 drivers/pinctrl/mediatek/mtk-eint.h                |   28 +-
 drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c   |   40 +-
 drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h   |    1 +
 drivers/pinctrl/mediatek/pinctrl-mtk-common.c      |   14 +-
 drivers/pinctrl/mediatek/pinctrl-paris.h           |    7 +
 drivers/pinctrl/pinctrl-rockchip.c                 |   10 +
 drivers/platform/chrome/cros_ec_debugfs.c          |    6 +-
 drivers/platform/chrome/cros_ec_sensorhub_ring.c   |    9 +-
 drivers/platform/chrome/cros_ec_typec.c            |    6 +
 drivers/platform/mellanox/mlxbf-bootctl.c          |    1 +
 drivers/platform/mellanox/mlxbf-pmc.c              |   10 +-
 drivers/platform/surface/surface_acpi_notify.c     |    6 +-
 drivers/platform/x86/dell/dell-wmi-base.c          |   17 +-
 drivers/platform/x86/dell/dell-wmi-privacy.c       |    4 +-
 .../x86/dell/dell-wmi-sysman/dell-wmi-sysman.h     |    2 +-
 .../x86/hp/hp-bioscfg/passwdobj-attributes.c       |    5 +
 drivers/platform/x86/lg-laptop.c                   |   79 +-
 drivers/pmdomain/bcm/bcm2835-power.c               |    7 +-
 drivers/power/supply/bd99954-charger.h             |   23 +-
 drivers/power/supply/bq27xxx_battery.c             |    6 +-
 drivers/power/supply/isp1704_charger.c             |    1 +
 drivers/power/supply/sbs-battery.c                 |    7 +-
 drivers/power/supply/sc2731_charger.c              |    2 +
 drivers/powercap/intel_rapl_tpmi.c                 |    5 +-
 drivers/pps/clients/pps-gpio.c                     |   62 +-
 drivers/pps/pps.c                                  |   10 +-
 drivers/rapidio/rio-scan.c                         |    1 +
 drivers/regulator/core.c                           |    6 +-
 drivers/regulator/qcom-rpmh-regulator.c            |    6 +-
 drivers/regulator/tps6594-regulator.c              |  271 ++---
 drivers/remoteproc/qcom_common.c                   |    4 +-
 drivers/remoteproc/qcom_q6v5_adsp.c                |    1 +
 drivers/remoteproc/remoteproc_core.c               |  156 +--
 drivers/remoteproc/remoteproc_sysfs.c              |    1 -
 drivers/rpmsg/qcom_glink_native.c                  |   44 +-
 drivers/rtc/rtc-gamecube.c                         |    4 +-
 drivers/rtc/rtc-pcf85363.c                         |   17 +-
 drivers/rtc/rtc-pcf8563.c                          |    4 +-
 drivers/rtc/rtc-rzn1.c                             |   10 +-
 drivers/rtc/rtc-zynqmp.c                           |    7 +-
 drivers/s390/crypto/vfio_ap_ops.c                  |  176 ++--
 drivers/scsi/ch.c                                  |    4 +-
 drivers/scsi/mpt3sas/mpt3sas_base.c                |    2 +
 drivers/scsi/pm8001/pm8001_init.c                  |    4 +-
 drivers/scsi/qla2xxx/qla_attr.c                    |    7 +-
 drivers/scsi/qla2xxx/qla_bsg.c                     |   39 +-
 drivers/scsi/qla2xxx/qla_dbg.c                     |    2 +-
 drivers/scsi/qla2xxx/qla_dfs.c                     |    4 +-
 drivers/scsi/qla2xxx/qla_edif.c                    |    3 +
 drivers/scsi/qla2xxx/qla_gs.c                      |    4 +-
 drivers/scsi/qla2xxx/qla_init.c                    |   61 +-
 drivers/scsi/qla2xxx/qla_inline.h                  |   13 +
 drivers/scsi/qla2xxx/qla_isr.c                     |   39 +-
 drivers/scsi/qla2xxx/qla_mbx.c                     |   28 +-
 drivers/scsi/qla2xxx/qla_nvme.c                    |   31 +-
 drivers/scsi/qla2xxx/qla_nx2.c                     |    2 +-
 drivers/scsi/qla2xxx/qla_os.c                      |   14 +-
 drivers/scsi/scsi_sysfs.c                          |   77 +-
 drivers/scsi/sd.c                                  |  297 +++---
 drivers/scsi/ses.c                                 |    4 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |   18 +
 drivers/scsi/sr.c                                  |    4 +-
 drivers/scsi/st.c                                  |    4 +-
 drivers/soc/fsl/qe/qe_ic.c                         |    3 +-
 drivers/soc/qcom/rpmh-rsc.c                        |   37 +-
 drivers/soc/samsung/exynos-pmu.c                   |    4 +-
 drivers/soc/ti/knav_qmss.h                         |    1 +
 drivers/soc/ti/knav_qmss_queue.c                   |   14 +-
 drivers/soundwire/qcom.c                           |    2 +-
 drivers/spi/spi-bcm63xx-hsspi.c                    |    8 +-
 drivers/spi/spi-bcm63xx.c                          |    6 +-
 drivers/spi/spi-bcmbca-hsspi.c                     |    8 +-
 drivers/spi/spi-davinci.c                          |    7 +-
 drivers/spi/spi-img-spfi.c                         |    5 +-
 drivers/spi/spi-oc-tiny.c                          |   24 +-
 drivers/spi/spi-sprd-adi.c                         |    6 +
 drivers/spi/spi.c                                  |   34 +-
 drivers/staging/fbtft/fbtft-sysfs.c                |    2 +-
 drivers/staging/greybus/audio_gb.c                 |   13 +
 drivers/staging/greybus/audio_manager_sysfs.c      |    2 +-
 drivers/staging/media/meson/vdec/vdec.c            |    4 +-
 drivers/staging/media/sunxi/cedrus/cedrus.c        |    4 +-
 drivers/staging/octeon/ethernet-mem.c              |   43 +-
 drivers/staging/octeon/ethernet-mem.h              |    8 +-
 drivers/staging/octeon/ethernet-rx.c               |   53 +-
 drivers/staging/octeon/ethernet-rx.h               |   13 +-
 drivers/staging/octeon/ethernet-tx.c               |    2 +
 drivers/staging/octeon/ethernet.c                  |   43 +-
 drivers/staging/octeon/octeon-ethernet.h           |   14 +
 drivers/staging/rtl8723bs/core/rtw_cmd.c           |    8 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |    7 +
 drivers/staging/rtl8723bs/os_dep/sdio_intf.c       |    4 +-
 drivers/staging/sm750fb/Kconfig                    |    1 +
 drivers/staging/sm750fb/sm750.c                    |    4 +-
 drivers/target/iscsi/iscsi_target_login.c          |    2 +-
 drivers/thermal/imx_thermal.c                      |    9 +-
 .../intel/int340x_thermal/int3400_thermal.c        |    4 +-
 drivers/thermal/qoriq_thermal.c                    |   13 +-
 drivers/thermal/renesas/rcar_thermal.c             |   15 +-
 drivers/tty/hvc/Kconfig                            |    2 +-
 drivers/tty/serial/amba-pl011.c                    |   10 +
 drivers/tty/serial/ma35d1_serial.c                 |   12 +-
 drivers/tty/serial/qcom_geni_serial.c              |   10 +-
 drivers/tty/tty_io.c                               |    4 +-
 drivers/ufs/core/ufs-debugfs.c                     |    2 +-
 drivers/ufs/core/ufshcd.c                          |   19 +-
 drivers/uio/uio.c                                  |    5 +
 drivers/usb/atm/usbatm.c                           |    4 +-
 drivers/usb/common/common.c                        |    3 +
 drivers/usb/core/driver.c                          |   29 +-
 drivers/usb/gadget/configfs.c                      |    4 +-
 drivers/usb/gadget/function/f_fs.c                 |    8 +-
 drivers/usb/gadget/function/f_mass_storage.c       |    2 +-
 drivers/usb/gadget/function/f_midi.c               |    2 +-
 drivers/usb/gadget/function/f_midi2.c              |   17 +-
 drivers/usb/gadget/function/f_uac1_legacy.c        |   56 --
 drivers/usb/gadget/function/u_uac1_legacy.h        |    3 -
 drivers/usb/gadget/functions.c                     |    2 +-
 drivers/usb/gadget/legacy/inode.c                  |    3 +-
 drivers/usb/gadget/udc/aspeed_udc.c                |   50 +-
 drivers/usb/gadget/udc/r8a66597-udc.c              |    1 -
 drivers/usb/host/xhci-ring.c                       |   32 +-
 drivers/usb/image/mdc800.c                         |    4 +-
 drivers/usb/misc/usb-ljca.c                        |    3 +
 drivers/usb/mtu3/mtu3_core.c                       |   11 +-
 drivers/usb/renesas_usbhs/common.c                 |    6 +-
 drivers/usb/serial/bus.c                           |    4 +-
 drivers/usb/serial/usb-serial.c                    |    4 +-
 drivers/usb/storage/ene_ub6250.c                   |    2 +
 .../usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c    |    2 +
 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c |    5 +
 drivers/usb/typec/ucsi/debugfs.c                   |    1 +
 drivers/usb/typec/ucsi/displayport.c               |    2 +-
 drivers/usb/typec/ucsi/ucsi.c                      |    2 +
 drivers/vdpa/mlx5/core/mr.c                        |    2 +-
 drivers/vdpa/vdpa_sim/vdpa_sim.c                   |   25 +-
 drivers/vfio/pci/vfio_pci_config.c                 |    1 +
 drivers/video/fbdev/kyro/fbdev.c                   |   24 +-
 drivers/video/fbdev/tdfxfb.c                       |    2 +-
 drivers/virtio/virtio_balloon.c                    |    6 +
 drivers/virtio/virtio_pci_common.c                 |    2 +-
 drivers/w1/masters/ds2482.c                        |    4 +
 drivers/watchdog/pseries-wdt.c                     |   53 +-
 drivers/xen/xenbus/xenbus_xs.c                     |   16 +-
 fs/afs/callback.c                                  |    1 +
 fs/btrfs/verity.c                                  |   16 +-
 fs/ceph/file.c                                     |   48 +
 fs/ceph/mds_client.c                               |    4 +
 fs/ceph/mds_client.h                               |    1 +
 fs/crypto/inline_crypt.c                           |    3 +-
 fs/erofs/Kconfig                                   |    8 +-
 fs/erofs/compress.h                                |   23 +-
 fs/erofs/decompressor.c                            |    2 +-
 fs/erofs/zdata.c                                   |  162 ++-
 fs/ext4/file.c                                     |    7 +
 fs/ext4/inline.c                                   |   11 +-
 fs/ext4/inode.c                                    |   28 +-
 fs/ext4/migrate.c                                  |    3 +-
 fs/ext4/namei.c                                    |    2 +
 fs/ext4/orphan.c                                   |   10 +-
 fs/f2fs/data.c                                     |    5 +-
 fs/f2fs/f2fs.h                                     |   27 +-
 fs/f2fs/file.c                                     |  120 ++-
 fs/f2fs/gc.c                                       |    7 +-
 fs/f2fs/namei.c                                    |   11 +-
 fs/f2fs/segment.c                                  |   41 +-
 fs/f2fs/segment.h                                  |    4 -
 fs/f2fs/super.c                                    |    4 +-
 fs/f2fs/sysfs.c                                    |    7 +-
 fs/f2fs/xattr.c                                    |    2 +-
 fs/fat/nfs.c                                       |    4 +-
 fs/fuse/cuse.c                                     |    5 +
 fs/fuse/dev.c                                      |   40 +-
 fs/fuse/dir.c                                      |   11 +-
 fs/fuse/fuse_i.h                                   |   36 +-
 fs/fuse/inode.c                                    |   58 +-
 fs/fuse/readdir.c                                  |   36 +-
 fs/hfsplus/catalog.c                               |   25 +-
 fs/hfsplus/hfsplus_fs.h                            |    6 +
 fs/hugetlbfs/inode.c                               |    3 +-
 fs/isofs/compress.c                                |    7 +-
 fs/netfs/buffered_read.c                           |    2 +
 fs/nfs/blocklayout/dev.c                           |   21 +-
 fs/nfs/client.c                                    |   21 +-
 fs/nfs/dir.c                                       |    7 +
 fs/nfs/filelayout/filelayoutdev.c                  |    3 +-
 fs/nfs/flexfilelayout/flexfilelayoutdev.c          |    3 +-
 fs/nfs/inode.c                                     |    4 +-
 fs/nfs/internal.h                                  |    1 +
 fs/nfs/netns.h                                     |    6 +-
 fs/nfs/nfs4client.c                                |    1 +
 fs/nfs/nfs4proc.c                                  |    4 +-
 fs/nfs/pnfs.c                                      |   35 +-
 fs/nfs/pnfs.h                                      |    3 +-
 fs/nfs/pnfs_nfs.c                                  |   39 +-
 fs/nilfs2/page.c                                   |   17 +-
 fs/nilfs2/segment.c                                |    4 +
 fs/nilfs2/the_nilfs.c                              |    6 +
 fs/notify/fanotify/fanotify_user.c                 |   17 +-
 fs/notify/inotify/inotify_user.c                   |   15 +-
 fs/ntfs3/attrib.c                                  |   11 +-
 fs/ntfs3/frecord.c                                 |   79 +-
 fs/ntfs3/fslog.c                                   |   13 +-
 fs/ntfs3/fsntfs.c                                  |    8 +-
 fs/ntfs3/ntfs_fs.h                                 |   21 +-
 fs/ntfs3/record.c                                  |  125 ++-
 fs/ntfs3/super.c                                   |   13 +-
 fs/ntfs3/xattr.c                                   |   25 +-
 fs/ocfs2/acl.c                                     |  141 ++-
 fs/ocfs2/acl.h                                     |   19 +-
 fs/ocfs2/cluster/heartbeat.c                       |   97 +-
 fs/ocfs2/cluster/heartbeat.h                       |    5 +
 fs/ocfs2/cluster/nodemanager.c                     |   23 +-
 fs/ocfs2/cluster/nodemanager.h                     |    2 +
 fs/ocfs2/cluster/tcp.c                             |   83 +-
 fs/ocfs2/cluster/tcp.h                             |    1 +
 fs/ocfs2/namei.c                                   |   17 +-
 fs/ocfs2/xattr.c                                   |   86 +-
 fs/ocfs2/xattr.h                                   |    9 +-
 fs/smb/client/cifs_debug.c                         |    2 +-
 fs/smb/client/smb2pdu.c                            |   16 +-
 fs/smb/server/auth.c                               |    1 +
 fs/smb/server/connection.c                         |   19 +
 fs/smb/server/connection.h                         |    1 +
 fs/smb/server/mgmt/share_config.c                  |    7 +-
 fs/smb/server/mgmt/user_config.c                   |    1 +
 fs/smb/server/mgmt/user_session.c                  |   24 +-
 fs/smb/server/mgmt/user_session.h                  |    1 +
 fs/smb/server/server.c                             |    4 +-
 fs/smb/server/smb2ops.c                            |   11 +-
 fs/smb/server/smb2pdu.c                            |   57 +-
 fs/smb/server/smbacl.c                             |    4 +-
 fs/smb/server/transport_ipc.c                      |   12 +
 fs/smb/server/transport_tcp.c                      |    6 +
 fs/smb/server/vfs.c                                |    3 -
 fs/smb/server/vfs_cache.c                          |    5 +-
 fs/squashfs/cache.c                                |    2 +-
 fs/super.c                                         |    4 +-
 fs/udf/super.c                                     |   23 +-
 fs/udf/symlink.c                                   |    2 +
 include/acpi/cppc_acpi.h                           |    6 +-
 include/acpi/pcc.h                                 |    5 -
 include/acpi/processor.h                           |    2 +
 include/cxl/mailbox.h                              |   41 +-
 include/linux/blkdev.h                             |   13 +-
 include/linux/bpf-cgroup-defs.h                    |    1 +
 include/linux/bpf-cgroup.h                         |    5 +-
 include/linux/bpf.h                                |    4 +-
 include/linux/efi.h                                |    4 +-
 include/linux/ima.h                                |    7 +-
 include/linux/kprobes.h                            |    1 +
 include/linux/maple_tree.h                         |    2 +-
 include/linux/memcontrol.h                         |   10 +-
 include/linux/memory.h                             |   27 +-
 include/linux/memory_hotplug.h                     |   19 +-
 include/linux/mmc/sdio_ids.h                       |    1 +
 include/linux/nfs_xdr.h                            |    2 +-
 include/linux/nvme.h                               |   81 ++
 include/linux/of_graph.h                           |   49 +
 include/linux/panic.h                              |    6 +
 include/linux/pci.h                                |    2 +
 include/linux/printk.h                             |    2 -
 include/linux/ptdump.h                             |    9 +-
 include/linux/remoteproc.h                         |  284 +-----
 include/linux/rsc_table.h                          |  364 +++++++
 include/linux/rtsx_usb.h                           |    3 +
 include/linux/secure_boot.h                        |   23 +
 include/linux/sunrpc/xdr.h                         |   21 +
 include/linux/usb.h                                |    7 +-
 include/linux/virtio_net.h                         |    4 +
 include/media/rc-map.h                             |    2 -
 include/net/bluetooth/hci_core.h                   |    2 +-
 include/net/bluetooth/l2cap.h                      |    5 +
 include/net/inet_connection_sock.h                 |   12 +-
 include/net/inetpeer.h                             |    4 +
 include/net/pkt_sched.h                            |    1 +
 include/net/tc_act/tc_ct.h                         |    2 +-
 include/net/tc_act/tc_ctinfo.h                     |    1 +
 include/net/tc_act/tc_skbedit.h                    |    1 +
 include/net/tc_act/tc_skbmod.h                     |    1 +
 include/net/tc_act/tc_tunnel_key.h                 |    1 +
 include/net/tc_act/tc_vlan.h                       |    1 +
 include/net/tcp.h                                  |   13 +-
 include/net/xsk_buff_pool.h                        |   19 +-
 include/rdma/ib_verbs.h                            |   14 +
 include/scsi/scsi_driver.h                         |    7 +-
 include/sound/core.h                               |    2 +
 include/uapi/linux/bpf.h                           |    7 +
 include/uapi/linux/landlock.h                      |    1 +
 include/uapi/linux/raid/md_p.h                     |    2 +-
 include/uapi/linux/time_types.h                    |    2 +-
 kernel/bpf/arena.c                                 |    2 +
 kernel/bpf/bpf_lsm.c                               |    1 -
 kernel/bpf/btf.c                                   |   26 +-
 kernel/bpf/cgroup.c                                |  220 +++-
 kernel/bpf/net_namespace.c                         |   17 +-
 kernel/bpf/ringbuf.c                               |    2 +-
 kernel/bpf/syscall.c                               |   73 +-
 kernel/bpf/task_iter.c                             |   36 +-
 kernel/bpf/verifier.c                              |   24 +-
 kernel/cgroup/cgroup.c                             |    5 +
 kernel/cgroup/cpuset-internal.h                    |    2 +-
 kernel/cgroup/cpuset.c                             |  305 +++---
 kernel/dma/direct.c                                |   18 +-
 kernel/dma/swiotlb.c                               |   31 +-
 kernel/entry/common.c                              |    3 +
 kernel/futex/requeue.c                             |   12 +-
 kernel/kcsan/core.c                                |   12 +-
 kernel/kprobes.c                                   |   14 +-
 kernel/locking/lockdep.c                           |    2 +
 kernel/module/dups.c                               |   99 +-
 kernel/module/stats.c                              |    2 +-
 kernel/panic.c                                     |   53 +
 kernel/power/snapshot.c                            |    5 +-
 kernel/power/wakelock.c                            |    2 +-
 kernel/printk/internal.h                           |    2 +-
 kernel/printk/nbcon.c                              |   10 +-
 kernel/printk/printk.c                             |  218 ++--
 kernel/printk/printk_ringbuffer.c                  |   13 +-
 kernel/rcu/tree_plugin.h                           |   10 +-
 kernel/sched/cpufreq_schedutil.c                   |    2 +-
 kernel/sched/fair.c                                |   27 +-
 kernel/sys.c                                       |    2 +-
 kernel/time/clocksource.c                          |    8 +-
 kernel/time/timekeeping.c                          |    6 +
 kernel/trace/ftrace.c                              |   13 +-
 kernel/trace/ring_buffer.c                         |    2 -
 kernel/trace/trace.c                               |   28 +-
 kernel/trace/trace.h                               |    4 +-
 kernel/trace/trace_events.c                        |  134 ++-
 lib/dump_stack.c                                   |    2 +-
 lib/maple_tree.c                                   |   43 +-
 lib/string.c                                       |    3 +-
 lib/test_hmm.c                                     |    2 +-
 mm/Kconfig                                         |   57 +-
 mm/Kconfig.debug                                   |   11 +-
 mm/Makefile                                        |    2 +-
 mm/damon/core.c                                    |   17 +-
 mm/damon/ops-common.c                              |    5 +-
 mm/damon/paddr.c                                   |   20 +-
 mm/damon/sysfs-schemes.c                           |   14 +-
 mm/damon/sysfs.c                                   |   19 +-
 mm/damon/tests/core-kunit.h                        |   15 +-
 mm/damon/tests/vaddr-kunit.h                       |    5 +
 mm/damon/vaddr.c                                   |   34 +-
 mm/hugetlb.c                                       |   22 +-
 mm/memcontrol-v1.c                                 |   43 +-
 mm/memory_hotplug.c                                |   42 +-
 mm/mempolicy.c                                     |    2 +-
 mm/mm_init.c                                       |   19 +-
 mm/page_vma_mapped.c                               |    8 +-
 mm/ptdump.c                                        |   40 +-
 mm/slab.h                                          |    1 +
 mm/slub.c                                          |   36 +-
 net/batman-adv/bridge_loop_avoidance.c             |   80 +-
 net/batman-adv/distributed-arp-table.c             |   66 +-
 net/batman-adv/main.c                              |    4 +
 net/batman-adv/multicast_forw.c                    |    7 +-
 net/batman-adv/soft-interface.c                    |    7 +-
 net/batman-adv/types.h                             |    2 +-
 net/bluetooth/hci_conn.c                           |   20 +-
 net/bluetooth/hci_sync.c                           |   12 +-
 net/bluetooth/l2cap_sock.c                         |   36 +-
 net/bluetooth/mgmt.c                               |   27 +-
 net/bluetooth/msft.c                               |    5 +
 net/bluetooth/rfcomm/core.c                        |    4 +
 net/bridge/br_netlink_tunnel.c                     |    3 +-
 net/bridge/br_vlan.c                               |    4 +-
 net/ceph/messenger_v2.c                            |    5 +
 net/core/dev.c                                     |    1 +
 net/core/filter.c                                  |    4 -
 net/core/lwt_bpf.c                                 |   15 +-
 net/core/net_namespace.c                           |    4 +
 net/core/page_pool.c                               |   77 +-
 net/core/skbuff.c                                  |   11 +-
 net/dccp/dccp.h                                    |    4 +-
 net/dccp/ipv4.c                                    |    4 +-
 net/dccp/ipv6.c                                    |    7 +-
 net/dccp/minisocks.c                               |    2 +-
 net/hsr/hsr_device.c                               |    2 +
 net/ipv4/inet_connection_sock.c                    |    9 +
 net/ipv4/inetpeer.c                                |   38 +-
 net/ipv4/syncookies.c                              |    2 +-
 net/ipv4/tcp_fastopen.c                            |    2 +-
 net/ipv4/tcp_ipv4.c                                |    8 +-
 net/ipv4/tcp_minisocks.c                           |    2 +-
 net/ipv4/tcp_output.c                              |    2 +-
 net/ipv6/tcp_ipv6.c                                |   97 +-
 net/ipv6/xfrm6_input.c                             |    2 +-
 net/kcm/kcmsock.c                                  |    3 +
 net/mac80211/link.c                                |    3 +-
 net/mac80211/mlme.c                                |    2 +-
 net/mac80211/s1g.c                                 |    2 +-
 net/mac80211/spectmgmt.c                           |   11 +-
 net/mac80211/tx.c                                  |    3 +-
 net/mptcp/subflow.c                                |    6 +-
 net/netfilter/Kconfig                              |    2 +-
 net/netfilter/ipvs/ip_vs_ftp.c                     |   10 +-
 net/netfilter/nf_nat_sip.c                         |    5 +
 net/netfilter/nf_tables_api.c                      |   14 +-
 net/netfilter/xt_cgroup.c                          |   21 +-
 net/netfilter/xt_hl.c                              |   27 +
 net/nfc/digital_core.c                             |    2 +-
 net/nfc/llcp_core.c                                |   29 +-
 net/nfc/llcp_sock.c                                |   14 +-
 net/nfc/nci/data.c                                 |   10 +-
 net/nfc/nci/rsp.c                                  |   41 +-
 net/openvswitch/conntrack.c                        |  121 ++-
 net/openvswitch/conntrack.h                        |    6 +-
 net/openvswitch/datapath.c                         |   10 +-
 net/openvswitch/datapath.h                         |   26 +-
 net/openvswitch/vport.h                            |    9 +
 net/phonet/pep.c                                   |    2 +-
 net/rds/cong.c                                     |    4 +-
 net/sched/act_api.c                                |    5 +-
 net/sched/act_bpf.c                                |   26 +
 net/sched/act_ct.c                                 |   76 +-
 net/sched/act_ctinfo.c                             |   34 +-
 net/sched/act_ife.c                                |   23 +
 net/sched/act_pedit.c                              |   24 +
 net/sched/act_police.c                             |   12 +
 net/sched/act_sample.c                             |    9 +
 net/sched/act_skbedit.c                            |   20 +-
 net/sched/act_skbmod.c                             |   34 +-
 net/sched/act_tunnel_key.c                         |   96 +-
 net/sched/act_vlan.c                               |   16 +-
 net/sched/cls_api.c                                |   18 +-
 net/sched/sch_api.c                                |    7 +-
 net/sched/sch_codel.c                              |    2 +-
 net/sched/sch_fifo.c                               |    2 +-
 net/sched/sch_fq.c                                 |   18 +-
 net/sched/sch_fq_codel.c                           |    6 +-
 net/sched/sch_fq_pie.c                             |    3 +-
 net/sched/sch_gred.c                               |    4 +-
 net/sched/sch_hhf.c                                |    4 +
 net/sched/sch_htb.c                                |    7 +-
 net/sched/sch_plug.c                               |    2 +-
 net/sched/sch_sfq.c                                |    3 +-
 net/sched/sch_teql.c                               |    1 +
 net/smc/af_smc.c                                   |    8 +-
 net/smc/smc_inet.c                                 |   16 +
 net/smc/smc_llc.c                                  |    3 +
 net/sunrpc/rpcb_clnt.c                             |    4 +
 net/sunrpc/xprtsock.c                              |   20 +-
 net/tls/tls_strp.c                                 |   16 +-
 net/vmw_vsock/af_vsock.c                           |   23 +-
 net/xdp/xsk.c                                      |   57 +-
 net/xdp/xsk_buff_pool.c                            |    4 +-
 net/xdp/xsk_queue.h                                |   16 +-
 net/xfrm/xfrm_output.c                             |    4 +-
 samples/ftrace/ftrace-direct-modify.c              |   12 +-
 samples/ftrace/ftrace-direct-multi-modify.c        |   12 +-
 scripts/mod/modpost.c                              |    6 +-
 scripts/tags.sh                                    |    2 +-
 security/apparmor/lib.c                            |   20 +-
 security/integrity/Makefile                        |    1 +
 security/integrity/efi_secureboot.c                |   56 ++
 security/integrity/ima/ima_appraise.c              |    4 +-
 security/integrity/ima/ima_efi.c                   |   47 +-
 security/integrity/ima/ima_main.c                  |    3 +-
 security/integrity/integrity.h                     |    1 +
 security/integrity/platform_certs/load_uefi.c      |    2 +-
 security/landlock/errata/abi-1.h                   |   23 +
 security/landlock/fs.c                             |   40 +-
 security/smack/smack.h                             |    5 +-
 security/smack/smack_lsm.c                         |   67 +-
 security/smack/smackfs.c                           |  222 ++--
 sound/core/control.c                               |    6 +-
 sound/core/control_led.c                           |   13 +-
 sound/core/init.c                                  |    4 +-
 sound/core/pcm_native.c                            |    2 +
 sound/core/rawmidi.c                               |    2 +-
 sound/core/seq/seq_clientmgr.c                     |   16 +-
 sound/core/seq/seq_midi.c                          |   61 +-
 sound/parisc/harmony.c                             |    6 +-
 sound/pci/asihpi/hpi6000.c                         |    5 +
 sound/pci/hda/hda_proc.c                           |    2 +-
 sound/pci/ice1712/ice1712.c                        |    7 +-
 sound/pci/via82xx_modem.c                          |   26 +-
 sound/soc/apple/mca.c                              |    6 +-
 sound/soc/codecs/cs35l33.c                         |   14 +-
 sound/soc/codecs/cs35l34.c                         |   14 +-
 sound/soc/codecs/hdac_hda.c                        |    4 +-
 sound/soc/codecs/rt700-sdw.c                       |    6 +-
 sound/soc/fsl/fsl-asoc-card.c                      |    4 +-
 sound/soc/fsl/fsl_audmix.c                         |   24 +-
 sound/soc/fsl/mpc5200_psc_i2s.c                    |    1 +
 sound/soc/intel/atom/sst/sst_pci.c                 |    4 +-
 sound/soc/loongson/loongson_card.c                 |    6 +-
 sound/soc/meson/meson-card-utils.c                 |   17 +-
 sound/soc/pxa/pxa-ssp.c                            |    7 +-
 sound/soc/qcom/qdsp6/q6apm.c                       |   12 +-
 sound/soc/samsung/aries_wm8994.c                   |    1 +
 sound/soc/soc-dapm.c                               |    2 +-
 sound/soc/sof/topology.c                           |   18 +-
 sound/soc/xilinx/xlnx_formatter_pcm.c              |   14 +-
 sound/usb/midi.c                                   |    2 +
 tools/bpf/bpftool/map.c                            |   16 +-
 tools/bpf/bpftool/struct_ops.c                     |    4 +
 tools/build/Makefile.feature                       |    3 +-
 tools/build/feature/Makefile                       |    3 +
 tools/include/nolibc/arch-powerpc.h                |    2 +-
 tools/include/uapi/linux/bpf.h                     |    7 +
 tools/lib/bpf/libbpf.c                             |    3 +-
 tools/net/sunrpc/xdrgen/README                     |   17 +
 tools/net/sunrpc/xdrgen/generators/enum.py         |   17 +-
 tools/net/sunrpc/xdrgen/generators/union.py        |   34 +-
 tools/net/sunrpc/xdrgen/grammars/xdr.lark          |    4 +-
 .../xdrgen/templates/C/enum/declaration/close.j2   |    5 +-
 .../sunrpc/xdrgen/templates/C/enum/decoder/enum.j2 |    2 +-
 .../xdrgen/templates/C/enum/decoder/enum_be.j2     |   14 +
 .../xdrgen/templates/C/enum/definition/close.j2    |    2 +
 .../xdrgen/templates/C/enum/definition/close_be.j2 |    4 +
 .../sunrpc/xdrgen/templates/C/enum/encoder/enum.j2 |    2 +-
 .../xdrgen/templates/C/enum/encoder/enum_be.j2     |   14 +
 .../C/pointer/encoder/variable_length_opaque.j2    |    2 +
 .../C/pointer/encoder/variable_length_string.j2    |    2 +
 .../C/struct/encoder/variable_length_opaque.j2     |    2 +
 .../C/struct/encoder/variable_length_string.j2     |    2 +
 .../templates/C/union/decoder/case_spec_be.j2      |    2 +
 .../xdrgen/templates/C/union/definition/close.j2   |    5 -
 .../templates/C/union/encoder/case_spec_be.j2      |    2 +
 tools/net/sunrpc/xdrgen/xdr_ast.py                 |    7 +-
 tools/objtool/check.c                              |    3 +-
 tools/perf/builtin-sched.c                         |   40 +-
 tools/perf/builtin-stat.c                          |    9 +-
 .../arch/x86/amdzen5/floating-point.json           |  160 ++-
 .../pmu-events/arch/x86/amdzen5/load-store.json    |    8 +-
 tools/perf/pmu-events/jevents.py                   |    5 +-
 tools/perf/pmu-events/metric.py                    |    6 +-
 .../perf/scripts/python/Perf-Trace-Util/Context.c  |   18 -
 tools/perf/tests/builtin-test.c                    |  511 ++++++----
 .../perf/tests/shell/lib/perf_metric_validation.py |   11 +-
 tools/perf/tests/shell/stat_all_metrics.sh         |  167 +++-
 tools/perf/tests/shell/stat_bpf_counters.sh        |   44 +-
 tools/perf/tests/shell/stat_metrics_values.sh      |    7 +
 tools/perf/tests/shell/test_brstack.sh             |  237 ++++-
 tools/perf/tests/task-exit.c                       |    9 +-
 tools/perf/tests/tests-scripts.c                   |    7 +-
 tools/perf/tests/tests.h                           |   12 +
 tools/perf/tests/workloads/Build                   |    2 +
 tools/perf/tests/workloads/traploop.c              |   31 +
 tools/perf/ui/browsers/hists.c                     |    6 +-
 tools/perf/util/auxtrace.c                         |   15 +-
 .../util/bpf_skel/augmented_raw_syscalls.bpf.c     |  155 +--
 tools/perf/util/color.h                            |    1 +
 tools/perf/util/cs-etm-decoder/cs-etm-decoder.c    |   21 +-
 tools/perf/util/cs-etm.c                           |  321 ++++--
 tools/perf/util/cs-etm.h                           |    8 +-
 tools/perf/util/data-convert-json.c                |    1 +
 tools/perf/util/dso.c                              |   23 +-
 tools/perf/util/dso.h                              |   57 +-
 .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.c   |   47 +-
 .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.h   |   12 +
 tools/perf/util/intel-bts.c                        |    2 +-
 tools/perf/util/intel-pt.c                         |    2 +-
 tools/perf/util/machine.c                          |   37 +-
 tools/perf/util/metricgroup.c                      |    7 +-
 tools/perf/util/python.c                           |  187 ++--
 .../util/scripting-engines/trace-event-python.c    |   63 +-
 tools/perf/util/synthetic-events.c                 |    6 +-
 tools/perf/util/thread-stack.c                     |    2 +-
 tools/perf/util/trace-event-read.c                 |   33 +-
 tools/sched_ext/scx_flatcg.bpf.c                   |   19 +-
 tools/scripts/Makefile.include                     |   38 +-
 tools/testing/kunit/kunit.py                       |    2 +-
 tools/testing/kunit/kunit_tool_test.py             |   12 +
 .../selftests/arm64/mte/check_buffer_fill.c        |    2 +
 .../selftests/arm64/mte/check_child_memory.c       |    2 +
 .../selftests/arm64/mte/check_gcr_el1_cswitch.c    |    1 +
 .../selftests/arm64/mte/check_hugetlb_options.c    |  298 ++++++
 .../selftests/arm64/mte/check_ksm_options.c        |   31 +-
 .../selftests/arm64/mte/check_mmap_options.c       |    2 +
 .../selftests/arm64/mte/check_tags_inclusion.c     |    2 +
 tools/testing/selftests/arm64/mte/check_user_mem.c |    2 +
 tools/testing/selftests/bpf/README.rst             |    4 +-
 tools/testing/selftests/bpf/network_helpers.c      |   10 +-
 tools/testing/selftests/bpf/network_helpers.h      |    5 +
 .../selftests/bpf/prog_tests/bpf_attr_size.c       |   69 ++
 .../selftests/bpf/prog_tests/global_map_resize.c   |    8 +-
 tools/testing/selftests/bpf/prog_tests/mptcp.c     |   13 +-
 .../testing/selftests/bpf/progs/bpf_tracing_net.h  |    3 +
 tools/testing/selftests/bpf/progs/mptcpify.c       |    2 +-
 tools/testing/selftests/bpf/test_progs.c           |   11 +-
 tools/testing/selftests/bpf/test_sockmap.c         |    3 +-
 tools/testing/selftests/bpf/veristat.c             |   76 +-
 tools/testing/selftests/bpf/vmtest.sh              |   13 +-
 tools/testing/selftests/cgroup/test_cpuset_prs.sh  |  494 +++++----
 tools/testing/selftests/kselftest_harness.h        |   14 +-
 tools/testing/selftests/lsm/common.c               |    4 +-
 tools/testing/selftests/mm/cow.c                   |  350 ++++---
 tools/testing/selftests/mm/khugepaged.c            |    5 +
 tools/testing/selftests/mm/ksm_tests.c             |  210 ++--
 tools/testing/selftests/mm/migration.c             |  107 ++
 tools/testing/selftests/mm/soft-dirty.c            |    9 +-
 tools/testing/selftests/mm/thp_settings.c          |   11 +
 tools/testing/selftests/mm/thp_settings.h          |    2 +
 .../selftests/rseq/rseq-x86-thread-pointer.h       |    4 +-
 tools/testing/selftests/sched_ext/prog_run.c       |   36 +-
 tools/testing/selftests/timers/leap-a-day.c        |   19 +-
 tools/testing/selftests/zram/zram_lib.sh           |    2 +-
 1233 files changed, 21147 insertions(+), 8982 deletions(-)

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Norbert Szetei <[email protected]>

[ Upstream commit 8ece906150128d5ec2462aabcc978c568433eca4 ]

skb_zerocopy() copies frags from @from into @to. On an skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive operation on the source skb the copy helper does not own. That completes @from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the SKBFL_SHARED_FRAG page-ownership marker.

Both callers already report the failure on their own drop path. nfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in the flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by dropping it here.

On Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on this error: do_execute_actions() ignores output_userspace()'s return value and, unless the upcall was the last action, keeps forwarding the same skb through the flow's remaining actions. The uarg is completed while that skb is still in flight, telling the producer its buffers are free, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack still handles. That flag is what makes esp_input() call skb_cow_data() instead of decrypting in place, so a later local ESP delivery can decrypt over frags the skb does not own privately.

Leave error reporting to the callers.

---
 net/core/skbuff.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

index a3d329b2ccfd0..ca861bd6db148 100644
@@ -3847,10 +3847,9 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
 
 	skb_len_add(to, len + plen);
 
-	if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) {
-		skb_tx_error(from);
+	if (unlikely(skb_orphan_frags(from, GFP_ATOMIC)))
 		return -ENOMEM;
-	}
+
 	skb_zerocopy_clone(to, from, GFP_ATOMIC);
 
 	for (i = 0; i < skb_shinfo(from)->nr_frags; i++) {

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ilya Maximets <[email protected]>

[ Upstream commit 6bb0dcb3d321c14be7ca33b71a149034d6a2cde8 ]

Some field descriptions were missing, some were not very accurate. Not touching the uAPI header or .c files for now.

Formatting of those comments isn't great in general, but at least they are not missing anything now.

Before:

  $ ./scripts/kernel-doc -none -Wall net/openvswitch/*.h 2>&1 | wc -l
  16

After:

  $ ./scripts/kernel-doc -none -Wall net/openvswitch/*.h 2>&1 | wc -l
  0

---
 net/openvswitch/datapath.h | 20 ++++++++++++++------
 net/openvswitch/vport.h    |  9 +++++++++
 2 files changed, 23 insertions(+), 6 deletions(-)

index 8453da5507e11..67250d7df1ab2 100644
@@ -29,8 +29,8 @@
  * datapath.
  * @n_hit: Number of received packets for which a matching flow was found in
  * the flow table.
- * @n_miss: Number of received packets that had no matching flow in the flow
- * table.  The sum of @n_hit and @n_miss is the number of packets that have
+ * @n_missed: Number of received packets that had no matching flow in the flow
+ * table.  The sum of @n_hit and @n_missed is the number of packets that have
  * been received by the datapath.
  * @n_lost: Number of received packets that had no matching flow in the flow
  * table that could not be sent to userspace (normally due to an overflow in

@@ -40,6 +40,7 @@
  *   up per packet.
  * @n_cache_hit: The number of received packets that had their mask found using
  * the mask cache.
+ * @syncp: Synchronization point for 64bit counters.
  */
 struct dp_stats_percpu {
 	u64 n_hit;

@@ -74,8 +75,10 @@ struct dp_nlsk_pids {
  * ovs_mutex and RCU.
  * @stats_percpu: Per-CPU datapath statistics.
  * @net: Reference to net namespace.
- * @max_headroom: the maximum headroom of all vports in this datapath; it will
+ * @user_features: Bitmap of enabled %OVS_DP_F_* features.
+ * @max_headroom: The maximum headroom of all vports in this datapath; it will
  * be used by all the internal vports in this dp.
+ * @meter_tbl: Meter table.
  * @upcall_portids: RCU protected 'struct dp_nlsk_pids'.
  *
  * Context: See the comment on locking at the top of datapath.c for additional

@@ -128,10 +131,13 @@ struct ovs_skb_cb {
 #define OVS_CB(skb) ((struct ovs_skb_cb *)(skb)->cb)
 
 /**
- * struct dp_upcall - metadata to include with a packet to send to userspace
+ * struct dp_upcall_info - metadata to include with a packet sent to userspace
  * @cmd: One of %OVS_PACKET_CMD_*.
  * @userdata: If nonnull, its variable-length value is passed to userspace as
  * %OVS_PACKET_ATTR_USERDATA.
+ * @actions: If nonnull, its variable-length value is passed to userspace as
+ * %OVS_PACKET_ATTR_ACTIONS.
+ * @actions_len: The length of the @actions.
  * @portid: Netlink portid to which packet should be sent.  If @portid is 0
  * then no packet is sent and the packet is accounted in the datapath's @n_lost
  * counter.

@@ -152,6 +158,10 @@ struct dp_upcall_info {
  * struct ovs_net - Per net-namespace data for ovs.
  * @dps: List of datapaths to enable dumping them all out.
  * Protected by genl_mutex.
+ * @dp_notify_work: A work notifier to handle port unregistering.
+ * @masks_rebalance: A work to periodically optimize flow table caches.
+ * @ct_limit_info: A hash table of conntrack zone connection limits.
+ * @xt_label: Whether connlables are configured for the network or not.
  */
 struct ovs_net {
 	struct list_head dps;

@@ -160,8 +170,6 @@ struct ovs_net {
 #if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
 	struct ovs_ct_limit_info *ct_limit_info;
 #endif
-
-	/* Module reference for configuring conntrack. */
 	bool xt_label;
 };
 

index 3e71ca8ad8a78..9f67b9dd49f98 100644
@@ -97,6 +97,8 @@ struct vport {
  * @desired_ifindex: New vport's ifindex.
  * @dp: New vport's datapath.
  * @port_no: New vport's port number.
+ * @upcall_portids: %OVS_VPORT_ATTR_UPCALL_PID attribute from Netlink message,
+ * %NULL if none was supplied.
  */
 struct vport_parms {
 	const char *name;

@@ -125,6 +127,8 @@ struct vport_parms {
  * have any configuration.
  * @send: Send a packet on the device.
  * zero for dropped packets or negative for error.
+ * @owner: Module that implements this vport type.
+ * @list: List entry in the global list of vport types.
  */
 struct vport_ops {
 	enum ovs_vport_type type;

@@ -144,6 +148,7 @@ struct vport_ops {
 /**
  * struct vport_upcall_stats_percpu - per-cpu packet upcall statistics for
  * a given vport.
+ * @syncp:     Synchronization point for 64bit counters.
  * @n_success: Number of packets that upcall to userspace succeed.
  * @n_fail:    Number of packets that upcall to userspace failed.
  */

@@ -164,6 +169,8 @@ void ovs_vport_free(struct vport *);
  *
  * @vport: vport to access
  *
+ * Returns: A void pointer to a private data allocated in the @vport.
+ *
  * If a nonzero size was passed in priv_size of vport_alloc() a private data
  * area was allocated on creation.  This allows that area to be accessed and
  * used for any purpose needed by the vport implementer.

@@ -178,6 +185,8 @@ static inline void *vport_priv(const struct vport *vport)
  *
  * @priv: Start of private data area.
  *
+ * Returns: A reference to a vport structure that contains @priv.
+ *
  * It is sometimes useful to translate from a pointer to the private data
  * area to the vport, such as in the case where the private data pointer is
  * the result of a hash table lookup.  @priv must point to the start of the

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yuqi Xu <[email protected]>

[ Upstream commit 403f96c32c9e24600093d7d0c61c17daeedca957 ]

Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs_mutex. The CT limit pointer was neither removed from readers nor protected by a grace period, allowing packet processing to dereference the freed state.

An unprivileged user can trigger this bug from a user and network namespace, causing a slab-use-after-free in ovs_ct_execute() when the netns is torn down.

Publish the CT limit pointer through RCU, remove it before teardown, and wait for readers before freeing its contents. Keep ovs_mutex around individual CT limit updates, and use the RCU read-side lock while GET traverses the RCU-protected limit lists.

Netns teardown detaches the RCU-protected CT limit state in the pernet .pre_exit callback while holding ovs_mutex. The pernet core guarantees an RCU grace period between the .pre_exit and .exit callbacks, so the .exit callback completes the teardown without adding any extra synchronization.

The netlink command handlers do not need NULL checks because the userspace netlink socket holds an active reference to its network namespace while a request is processed. The per-netns exit path therefore cannot run concurrently with SET, DEL, or GET for that socket's namespace.

---
 net/openvswitch/conntrack.c | 121 +++++++++++++++++++++++-------------
 net/openvswitch/conntrack.h |   6 +-
 net/openvswitch/datapath.c  |  10 ++-
 net/openvswitch/datapath.h  |   8 ++-
 4 files changed, 98 insertions(+), 47 deletions(-)

index fb68aa17e479d..3f51f19686541 100644
@@ -932,10 +932,14 @@ static int ovs_ct_check_limit(struct net *net,
 			      const struct ovs_conntrack_info *info)
 {
 	struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
-	const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
+	const struct ovs_ct_limit_info *ct_limit_info;
 	u32 per_zone_limit, connections;
 	u32 conncount_key;
 
+	ct_limit_info = rcu_dereference(ovs_net->ct_limit_info);
+	if (!ct_limit_info)
+		return 0;
+
 	conncount_key = info->zone.id;
 
 	per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id);

@@ -1584,42 +1588,56 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
 #if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
 static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net)
 {
+	struct ovs_ct_limit_info *info;
 	int i, err;
 
-	ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info),
-					 GFP_KERNEL);
-	if (!ovs_net->ct_limit_info)
+	info = kmalloc(sizeof(*info), GFP_KERNEL);
+	if (!info)
 		return -ENOMEM;
 
-	ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT;
-	ovs_net->ct_limit_info->limits =
+	info->default_limit = OVS_CT_LIMIT_DEFAULT;
+	info->limits =
 		kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head),
 			      GFP_KERNEL);
-	if (!ovs_net->ct_limit_info->limits) {
-		kfree(ovs_net->ct_limit_info);
+	if (!info->limits) {
+		kfree(info);
 		return -ENOMEM;
 	}
 
 	for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++)
-		INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]);
+		INIT_HLIST_HEAD(&info->limits[i]);
 
-	ovs_net->ct_limit_info->data = nf_conncount_init(net, sizeof(u32));
+	info->data = nf_conncount_init(net, sizeof(u32));
 
-	if (IS_ERR(ovs_net->ct_limit_info->data)) {
-		err = PTR_ERR(ovs_net->ct_limit_info->data);
-		kfree(ovs_net->ct_limit_info->limits);
-		kfree(ovs_net->ct_limit_info);
+	if (IS_ERR(info->data)) {
+		err = PTR_ERR(info->data);
+		kfree(info->limits);
+		kfree(info);
 		pr_err("openvswitch: failed to init nf_conncount %d\n", err);
 		return err;
 	}
+	rcu_assign_pointer(ovs_net->ct_limit_info, info);
 	return 0;
 }
 
-static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
+static void *ovs_ct_limit_exit_start(struct ovs_net *ovs_net)
+{
+	return rcu_replace_pointer(ovs_net->ct_limit_info, NULL,
+				   lockdep_ovsl_is_held());
+}
+
+/* The CT limit state must be detached by ovs_ct_limit_exit_start() and an
+ * RCU grace period must elapse before this function runs.  The pernet core
+ * guarantees the grace period between the .pre_exit and .exit callbacks.
+ */
+static void ovs_ct_limit_exit_finish(struct net *net, void *data)
 {
-	const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info;
+	const struct ovs_ct_limit_info *info = data;
 	int i;
 
+	if (!info)
+		return;
+
 	nf_conncount_destroy(net, info->data);
 	for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
 		struct hlist_head *head = &info->limits[i];

@@ -1627,7 +1645,7 @@ static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
 		struct hlist_node *next;
 
 		hlist_for_each_entry_safe(ct_limit, next, head, hlist_node)
-			kfree_rcu(ct_limit, rcu);
+			kfree(ct_limit);
 	}
 	kfree(info->limits);
 	kfree(info);

@@ -1666,12 +1684,13 @@ static bool check_zone_id(int zone_id, u16 *pzone)
 	return false;
 }
 
-static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
-				       struct ovs_ct_limit_info *info)
+static int ovs_ct_limit_set_zone_limit(struct ovs_net *ovs_net,
+				       struct nlattr *nla_zone_limit)
 {
 	struct ovs_zone_limit *zone_limit;
-	int rem;
+	struct ovs_ct_limit_info *info;
 	u16 zone;
+	int rem;
 
 	rem = NLA_ALIGN(nla_len(nla_zone_limit));
 	zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);

@@ -1680,6 +1699,7 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
 		if (unlikely(zone_limit->zone_id ==
 				OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
 			ovs_lock();
+			info = ovsl_dereference(ovs_net->ct_limit_info);
 			info->default_limit = zone_limit->limit;
 			ovs_unlock();
 		} else if (unlikely(!check_zone_id(

@@ -1697,6 +1717,7 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
 			ct_limit->limit = zone_limit->limit;
 
 			ovs_lock();
+			info = ovsl_dereference(ovs_net->ct_limit_info);
 			ct_limit_set(info, ct_limit);
 			ovs_unlock();
 		}

@@ -1711,12 +1732,13 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
 	return 0;
 }
 
-static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
-				       struct ovs_ct_limit_info *info)
+static int ovs_ct_limit_del_zone_limit(struct ovs_net *ovs_net,
+				       struct nlattr *nla_zone_limit)
 {
 	struct ovs_zone_limit *zone_limit;
-	int rem;
+	struct ovs_ct_limit_info *info;
 	u16 zone;
+	int rem;
 
 	rem = NLA_ALIGN(nla_len(nla_zone_limit));
 	zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);

@@ -1725,6 +1747,7 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
 		if (unlikely(zone_limit->zone_id ==
 				OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
 			ovs_lock();
+			info = ovsl_dereference(ovs_net->ct_limit_info);
 			info->default_limit = OVS_CT_LIMIT_DEFAULT;
 			ovs_unlock();
 		} else if (unlikely(!check_zone_id(

@@ -1732,6 +1755,7 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
 			OVS_NLERR(true, "zone id is out of range");
 		} else {
 			ovs_lock();
+			info = ovsl_dereference(ovs_net->ct_limit_info);
 			ct_limit_del(info, zone);
 			ovs_unlock();
 		}

@@ -1775,6 +1799,7 @@ static int __ovs_ct_limit_get_zone_limit(struct net *net,
 	return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
 }
 
+/* Called with RCU read lock held. */
 static int ovs_ct_limit_get_zone_limit(struct net *net,
 				       struct nlattr *nla_zone_limit,
 				       struct ovs_ct_limit_info *info,

@@ -1798,12 +1823,10 @@ static int ovs_ct_limit_get_zone_limit(struct net *net,
 							&zone))) {
 			OVS_NLERR(true, "zone id is out of range");
 		} else {
-			rcu_read_lock();
 			limit = ct_limit_get(info, zone);
 
 			err = __ovs_ct_limit_get_zone_limit(
 				net, info->data, zone, limit, reply);
-			rcu_read_unlock();
 			if (err)
 				return err;
 		}

@@ -1818,6 +1841,7 @@ static int ovs_ct_limit_get_zone_limit(struct net *net,
 	return 0;
 }
 
+/* Called with RCU read lock held. */
 static int ovs_ct_limit_get_all_zone_limit(struct net *net,
 					   struct ovs_ct_limit_info *info,
 					   struct sk_buff *reply)

@@ -1830,19 +1854,16 @@ static int ovs_ct_limit_get_all_zone_limit(struct net *net,
 	if (err)
 		return err;
 
-	rcu_read_lock();
 	for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
 		head = &info->limits[i];
 		hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
 			err = __ovs_ct_limit_get_zone_limit(net, info->data,
 				ct_limit->zone, ct_limit->limit, reply);
 			if (err)
-				goto exit_err;
+				return err;
 		}
 	}
 
-exit_err:
-	rcu_read_unlock();
 	return err;
 }
 

@@ -1852,7 +1873,6 @@ static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info)
 	struct sk_buff *reply;
 	struct ovs_header *ovs_reply_header;
 	struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
-	struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
 	int err;
 
 	reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET,

@@ -1865,8 +1885,8 @@ static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info)
 		goto exit_err;
 	}
 
-	err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
-					  ct_limit_info);
+	err = ovs_ct_limit_set_zone_limit(ovs_net,
+					  a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]);
 	if (err)
 		goto exit_err;
 

@@ -1886,7 +1906,6 @@ static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info)
 	struct sk_buff *reply;
 	struct ovs_header *ovs_reply_header;
 	struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
-	struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
 	int err;
 
 	reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL,

@@ -1899,8 +1918,8 @@ static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info)
 		goto exit_err;
 	}
 
-	err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
-					  ct_limit_info);
+	err = ovs_ct_limit_del_zone_limit(ovs_net,
+					  a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]);
 	if (err)
 		goto exit_err;
 

@@ -1920,7 +1939,7 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
 	struct ovs_header *ovs_reply_header;
 	struct net *net = sock_net(skb->sk);
 	struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
-	struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
+	struct ovs_ct_limit_info *ct_limit_info;
 	int err;
 
 	reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET,

@@ -1934,18 +1953,19 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
 		goto exit_err;
 	}
 
+	rcu_read_lock();
+	ct_limit_info = rcu_dereference(ovs_net->ct_limit_info);
 	if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
 		err = ovs_ct_limit_get_zone_limit(
 			net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info,
 			reply);
-		if (err)
-			goto exit_err;
 	} else {
 		err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info,
 						      reply);
-		if (err)
-			goto exit_err;
 	}
+	rcu_read_unlock();
+	if (err)
+		goto exit_err;
 
 	nla_nest_end(reply, nla_reply);
 	genlmsg_end(reply, ovs_reply_header);

@@ -2020,12 +2040,29 @@ int ovs_ct_init(struct net *net)
 	return err;
 }
 
-void ovs_ct_exit(struct net *net)
+/* Must be called with ovs_mutex held.  Detaches the RCU-protected
+ * ct_limit_info and stores it in ovs_net->ct_limit_exit_data for
+ * ovs_ct_exit_finish() to complete the teardown after an RCU grace period.
+ */
+void ovs_ct_exit_start(struct net *net __maybe_unused)
+{
+#if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
+	struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
+
+	ovs_net->ct_limit_exit_data = ovs_ct_limit_exit_start(ovs_net);
+#endif
+}
+
+/* Completes the CT limit teardown.  The pernet core guarantees an RCU
+ * grace period between detaching the state in ovs_ct_exit_start() and
+ * this call, so no RCU readers remain.
+ */
+void ovs_ct_exit_finish(struct net *net)
 {
 	struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
 
 #if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
-	ovs_ct_limit_exit(net, ovs_net);
+	ovs_ct_limit_exit_finish(net, ovs_net->ct_limit_exit_data);
 #endif
 
 	if (ovs_net->xt_label)

index 317e525c8a113..ab21d032fde3d 100644
@@ -14,7 +14,8 @@ enum ovs_key_attr;
 
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 int ovs_ct_init(struct net *);
-void ovs_ct_exit(struct net *);
+void ovs_ct_exit_start(struct net *net);
+void ovs_ct_exit_finish(struct net *net);
 bool ovs_ct_verify(struct net *, enum ovs_key_attr attr);
 int ovs_ct_copy_action(struct net *, const struct nlattr *,
 		       const struct sw_flow_key *, struct sw_flow_actions **,

@@ -40,7 +41,8 @@ void ovs_ct_free_action(const struct nlattr *a);
 
 static inline int ovs_ct_init(struct net *net) { return 0; }
 
-static inline void ovs_ct_exit(struct net *net) { }
+static inline void ovs_ct_exit_start(struct net *net) { }
+static inline void ovs_ct_exit_finish(struct net *net) { }
 
 static inline bool ovs_ct_verify(struct net *net, int attr)
 {

index 7d15be7784747..1d11e72cf08db 100644
@@ -2730,6 +2730,13 @@ static void __net_exit list_vports_from_net(struct net *net, struct net *dnet,
 	}
 }
 
+static void __net_exit ovs_pre_exit_net(struct net *dnet)
+{
+	ovs_lock();
+	ovs_ct_exit_start(dnet);
+	ovs_unlock();
+}
+
 static void __net_exit ovs_exit_net(struct net *dnet)
 {
 	struct datapath *dp, *dp_next;

@@ -2740,7 +2747,7 @@ static void __net_exit ovs_exit_net(struct net *dnet)
 
 	ovs_lock();
 
-	ovs_ct_exit(dnet);
+	ovs_ct_exit_finish(dnet);
 
 	list_for_each_entry_safe(dp, dp_next, &ovs_net->dps, list_node)
 		__dp_destroy(dp);

@@ -2764,6 +2771,7 @@ static void __net_exit ovs_exit_net(struct net *dnet)
 
 static struct pernet_operations ovs_net_ops = {
 	.init = ovs_init_net,
+	.pre_exit = ovs_pre_exit_net,
 	.exit = ovs_exit_net,
 	.id   = &ovs_net_id,
 	.size = sizeof(struct ovs_net),

index 67250d7df1ab2..285c578dc30a3 100644
@@ -160,7 +160,10 @@ struct dp_upcall_info {
  * Protected by genl_mutex.
  * @dp_notify_work: A work notifier to handle port unregistering.
  * @masks_rebalance: A work to periodically optimize flow table caches.
- * @ct_limit_info: A hash table of conntrack zone connection limits.
+ * @ct_limit_info: Hash table of conntrack zone connection limits. Protected
+ * by RCU; updates and teardown are serialized by ovs_mutex. May be NULL during
+ * netns teardown.
+ * @ct_limit_exit_data: CT limit state detached at .pre_exit, freed at .exit.
  * @xt_label: Whether connlables are configured for the network or not.
  */
 struct ovs_net {

@@ -168,7 +171,8 @@ struct ovs_net {
 	struct work_struct dp_notify_work;
 	struct delayed_work masks_rebalance;
 #if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
-	struct ovs_ct_limit_info *ct_limit_info;
+	struct ovs_ct_limit_info __rcu *ct_limit_info;
+	struct ovs_ct_limit_info *ct_limit_exit_data;
 #endif
 	bool xt_label;
 };

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Günther Noack <[email protected]>

[ Upstream commit 672fa082d48b21e1fb62cdb184fee41513e53421 ]

Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in one of the lower layer file systems.

For the userspace implementations of OverlayFS (fuse-overlayfs), whiteout objects can be created from userspace as well:

* mknod(2) with S_IFCHR and makedev(0, 0)
* renameat2(2) with RENAME_WHITEOUT,
creating the whiteout in the old place of the moved file.

This commit guards whiteout creation in both of these cases with LANDLOCK_ACCESS_FS_MAKE_REG. Whiteout objects are *not* considered character devices and are not bound to a driver.

LANDLOCK_ACCESS_FS_MAKE_REG describes the same permission class as a whiteout object: creating one is the only S_IFCHR creation that the VFS exempts from CAP_MKNOD, so it is as unprivileged as creating a regular file, while LANDLOCK_ACCESS_FS_MAKE_CHAR and LANDLOCK_ACCESS_FS_MAKE_BLOCK keep meaning the creation of devices that expose a kernel interface [1].

For the mknod(2) case, introduce a Landlock erratum. The creation of whiteout objects through mknod(2) was previously guarded using LANDLOCK_ACCESS_FS_MAKE_CHAR, and it is now guarded using LANDLOCK_ACCESS_FS_MAKE_REG.

For the renameat2(2) case, fix a bug: Before this commit, renameat2(2) with RENAME_WHITEOUT would create a directory entry even when all LANDLOCK_ACCESS_FS_MAKE_* rights were denied.

This does not affect normal renames within layered OverlayFS mounts:
When doing a regular rename() on a mounted fuse-overlayfs, it is the fuse-overlayfs daemon that exercises renameat2() with RENAME_WHITEOUT, and only the Landlock domain of that daemon is checked there.

Depends-on: 49c9e09d9610 ("landlock: Fix handling of disconnected directories")
Depends-on: fe72ce6710cb ("landlock: Add errata documentation section")

[mic: Record why LANDLOCK_ACCESS_FS_MAKE_REG is the matching right, and add link(2) to the user doc]

---
 include/uapi/linux/landlock.h    |  1 +
 security/landlock/errata/abi-1.h | 23 ++++++++++++++++++
 security/landlock/fs.c           | 40 +++++++++++++++++++++++++-------
 3 files changed, 55 insertions(+), 9 deletions(-)

index c223572f82296..94cfad88082f3 100644
@@ -177,6 +177,7 @@ struct landlock_net_port_attr {
  *   device.
  * - %LANDLOCK_ACCESS_FS_MAKE_DIR: Create (or rename) a directory.
  * - %LANDLOCK_ACCESS_FS_MAKE_REG: Create (or rename or link) a regular file.
+ *   This also guards the creation of whiteout objects as used in OverlayFS.
  * - %LANDLOCK_ACCESS_FS_MAKE_SOCK: Create (or rename or link) a UNIX domain
  *   socket.
  * - %LANDLOCK_ACCESS_FS_MAKE_FIFO: Create (or rename or link) a named pipe.

index e8a2bff2e5b6a..80930957e84d2 100644
@@ -14,3 +14,26 @@
  * actions.
  */
 LANDLOCK_ERRATUM(3)
+
+/**
+ * DOC: erratum_4
+ *
+ * Erratum 4: Creation of whiteout objects
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * This fix changes the access rights required for the creation of whiteout
+ * objects through :manpage:`mknod(2)`, :manpage:`renameat2(2)`, or
+ * :manpage:`link(2)`.  Creating whiteout objects is now guarded by
+ * ``LANDLOCK_ACCESS_FS_MAKE_REG`` instead of ``LANDLOCK_ACCESS_FS_MAKE_CHAR``.
+ *
+ * Whiteout objects are used in OverlayFS to mark the absence of a file in an
+ * upper file system.  Despite being created with ``S_IFCHR``, whiteout objects
+ * do not count as character devices.
+ *
+ * Impact:
+ *
+ * Sandboxed programs that create OverlayFS whiteouts (such as fuse-overlayfs)
+ * now require ``LANDLOCK_ACCESS_FS_MAKE_REG`` instead of
+ * ``LANDLOCK_ACCESS_FS_MAKE_CHAR``.
+ */
+LANDLOCK_ERRATUM(4)

index bb4a9e82156a6..b96a4daa5b2a2 100644
@@ -20,6 +20,7 @@
 #include <linux/falloc.h>
 #include <linux/fs.h>
 #include <linux/init.h>
+#include <linux/kdev_t.h>
 #include <linux/kernel.h>
 #include <linux/limits.h>
 #include <linux/list.h>

@@ -954,7 +955,7 @@ static int current_check_access_path(const struct path *const path,
 	return check_access_path(dom, path, access_request);
 }
 
-static access_mask_t get_mode_access(const umode_t mode)
+static access_mask_t get_mode_access(const umode_t mode, const dev_t dev)
 {
 	switch (mode & S_IFMT) {
 	case S_IFLNK:

@@ -962,6 +963,9 @@ static access_mask_t get_mode_access(const umode_t mode)
 	case S_IFDIR:
 		return LANDLOCK_ACCESS_FS_MAKE_DIR;
 	case S_IFCHR:
+		/* Whiteout objects are guarded with MAKE_REG. */
+		if (dev == WHITEOUT_DEV)
+			return LANDLOCK_ACCESS_FS_MAKE_REG;
 		return LANDLOCK_ACCESS_FS_MAKE_CHAR;
 	case S_IFBLK:
 		return LANDLOCK_ACCESS_FS_MAKE_BLOCK;

@@ -978,6 +982,13 @@ static access_mask_t get_mode_access(const umode_t mode)
 	}
 }
 
+static access_mask_t get_dentry_access(const struct dentry *const dentry)
+{
+	const struct inode *const inode = d_backing_inode(dentry);
+
+	return get_mode_access(inode->i_mode, inode->i_rdev);
+}
+
 static access_mask_t maybe_remove(const struct dentry *const dentry)
 {
 	if (d_is_negative(dentry))

@@ -1067,6 +1078,7 @@ static bool collect_domain_accesses(
  * @new_dentry: Destination file or directory.
  * @removable: Sets to true if it is a rename operation.
  * @exchange: Sets to true if it is a rename operation with RENAME_EXCHANGE.
+ * @whiteout: Sets to true if it is a rename operation with RENAME_WHITEOUT.
  *
  * Because of its unprivileged constraints, Landlock relies on file hierarchies
  * (and not only inodes) to tie access rights to files.  Being able to link or

@@ -1115,7 +1127,8 @@ static bool collect_domain_accesses(
 static int current_check_refer_path(struct dentry *const old_dentry,
 				    const struct path *const new_dir,
 				    struct dentry *const new_dentry,
-				    const bool removable, const bool exchange)
+				    const bool removable, const bool exchange,
+				    const bool whiteout)
 {
 	const struct landlock_ruleset *const dom = get_current_fs_domain();
 	bool allow_parent1, allow_parent2;

@@ -1134,18 +1147,25 @@ static int current_check_refer_path(struct dentry *const old_dentry,
 	if (exchange) {
 		if (unlikely(d_is_negative(new_dentry)))
 			return -ENOENT;
-		access_request_parent1 =
-			get_mode_access(d_backing_inode(new_dentry)->i_mode);
+		access_request_parent1 = get_dentry_access(new_dentry);
 	} else {
 		access_request_parent1 = 0;
 	}
-	access_request_parent2 =
-		get_mode_access(d_backing_inode(old_dentry)->i_mode);
+	access_request_parent2 = get_dentry_access(old_dentry);
 	if (removable) {
 		access_request_parent1 |= maybe_remove(old_dentry);
 		access_request_parent2 |= maybe_remove(new_dentry);
 	}
 
+	/*
+	 * In case of renameat2(2) with RENAME_WHITEOUT, a whiteout object is
+	 * created in the source location, so we require an additional access
+	 * right there.
+	 */
+	if (whiteout)
+		access_request_parent1 |=
+			get_mode_access(S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV);
+
 	/* The mount points are the same for old and new paths, cf. EXDEV. */
 	if (old_dentry->d_parent == new_dir->dentry) {
 		/*

@@ -1417,7 +1437,7 @@ static int hook_path_link(struct dentry *const old_dentry,
 			  struct dentry *const new_dentry)
 {
 	return current_check_refer_path(old_dentry, new_dir, new_dentry, false,
-					false);
+					false, false);
 }
 
 static int hook_path_rename(const struct path *const old_dir,

@@ -1428,7 +1448,8 @@ static int hook_path_rename(const struct path *const old_dir,
 {
 	/* old_dir refers to old_dentry->d_parent and new_dir->mnt */
 	return current_check_refer_path(old_dentry, new_dir, new_dentry, true,
-					!!(flags & RENAME_EXCHANGE));
+					!!(flags & RENAME_EXCHANGE),
+					!!(flags & RENAME_WHITEOUT));
 }
 
 static int hook_path_mkdir(const struct path *const dir,

@@ -1445,7 +1466,8 @@ static int hook_path_mknod(const struct path *const dir,
 
 	if (!dom)
 		return 0;
-	return check_access_path(dom, dir, get_mode_access(mode));
+	return check_access_path(dom, dir,
+				 get_mode_access(mode, new_decode_dev(dev)));
 }
 
 static int hook_path_symlink(const struct path *const dir,

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jason Xing <[email protected]>

commit 22ba97ea9cc1f63a0d0244fae38057ed452b6ac7 upstream.

The TX metadata area resides in the UMEM buffer which is memory-mapped and concurrently writable by userspace. In xsk_skb_metadata(), csum_start and csum_offset are read from shared memory for bounds validation, then read again for skb assignment. A malicious userspace application can race to overwrite these values between the two reads, bypassing the bounds check and causing out-of-bounds memory access during checksum computation in the transmit path.

Fix this by reading csum_start and csum_offset into local variables once, then using the local copies for both validation and assignment.

Note that other metadata fields (flags, launch_time) and the cached csum fields may be mutually inconsistent due to concurrent userspace writes, but this is benign: the only security-critical invariant is that each field's validated value is the same one used, which local caching guarantees.

[ 6.12: Apply fix in xsk_build_skb() since missing patch
30c3055f9c0d ("xsk: wrap generic metadata handling onto separate function") added in v6.18 which moves handling to separate function xsk_skb_metadata(). ]

---
 net/xdp/xsk.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

index da7e11e3bfad2..76675ce70f03d 100644
@@ -665,6 +665,7 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,
 	struct xsk_tx_metadata *meta = NULL;
 	struct net_device *dev = xs->dev;
 	struct sk_buff *skb = xs->skb;
+	u16 csum_start, csum_offset;
 	bool first_frag = false;
 	int err;
 

@@ -733,15 +734,17 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,
 			}
 
 			if (meta->flags & XDP_TXMD_FLAGS_CHECKSUM) {
-				if (unlikely(meta->request.csum_start +
-					     meta->request.csum_offset +
+				csum_start = READ_ONCE(meta->request.csum_start);
+				csum_offset = READ_ONCE(meta->request.csum_offset);
+
+				if (unlikely(csum_start + csum_offset +
 					     sizeof(__sum16) > len)) {
 					err = -EINVAL;
 					goto free_err;
 				}
 
-				skb->csum_start = hr + meta->request.csum_start;
-				skb->csum_offset = meta->request.csum_offset;
+				skb->csum_start = hr + csum_start;
+				skb->csum_offset = csum_offset;
 				skb->ip_summed = CHECKSUM_PARTIAL;
 
 				if (unlikely(xs->pool->tx_sw_csum)) {

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Howells <[email protected]>

commit ded0c6f1606061148c202825f7e53d711f9f84cf upstream.

Fix netfs_read_folio() to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever is attached to folio->private (folio->private may get cleaned up by the collector before it clears the writeback flag).

---
 fs/netfs/buffered_read.c | 2 ++
 1 file changed, 2 insertions(+)

index d99284e35126c..fd41e38aedb75 100644
@@ -565,6 +565,8 @@ int netfs_read_folio(struct file *file, struct folio *folio)
 	struct netfs_inode *ctx = netfs_inode(mapping->host);
 	int ret;
 
+	folio_wait_writeback(folio);
+
 	if (folio_test_dirty(folio)) {
 		trace_netfs_folio(folio, netfs_folio_trace_read_gaps);
 		return netfs_read_gaps(file, folio);

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dev Jain <[email protected]>

[ Upstream commit e87df0d5d6962bde50f55f6d02b779daa394f894 ]

check_pte() is the final validation step in page_vma_mapped_walk(). It reads pvmw->pte with ptep_get() to decide whether the entry maps the PFN range being walked. For hugetlb VMAs, that pointer refers to a hugetlb entry.

On arches which provide their own huge_ptep_get() to dereference a huge pte pointer, accessing via ptep_get() would cause pte_pfn(), pte_present() etc to misbehave.

It is not clear whether this has a trivially visible effect to userspace.

Use huge_ptep_get() to dereference a huge pte pointer.

---
 mm/page_vma_mapped.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

index 585a53f7b06f0..1cc8fd382cd13 100644
@@ -97,7 +97,13 @@ static bool map_pte(struct page_vma_mapped_walk *pvmw, spinlock_t **ptlp)
 static bool check_pte(struct page_vma_mapped_walk *pvmw, unsigned long pte_nr)
 {
 	unsigned long pfn;
-	pte_t ptent = ptep_get(pvmw->pte);
+	pte_t ptent;
+
+	if (is_vm_hugetlb_page(pvmw->vma))
+		ptent = huge_ptep_get(pvmw->vma->vm_mm, pvmw->address,
+				      pvmw->pte);
+	else
+		ptent = ptep_get(pvmw->pte);
 
 	if (pvmw->flags & PVMW_MIGRATION) {
 		swp_entry_t entry;

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Laxman Acharya Padhya <[email protected]>

[ Upstream commit 653c6e289b13cc6942f3e8f8e3c568e70fa42d1f ]

The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy.

Reject files shorter than MT7996_EEPROM_SIZE before parsing or copying the firmware.

---
 drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 ++++++
 1 file changed, 6 insertions(+)

index 4c4ab0d4065d2..a14d1d2849b64 100644
@@ -51,6 +51,12 @@ mt7996_eeprom_load_default(struct mt7996_dev *dev)
 		goto out;
 	}
 
+	if (fw->size < MT7996_EEPROM_SIZE) {
+		dev_err(dev->mt76.dev, "Invalid default bin size\n");
+		ret = -EINVAL;
+		goto out;
+	}
+
 	memcpy(eeprom, fw->data, MT7996_EEPROM_SIZE);
 	dev->flash_mode = true;
 

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guillaume Morin <[email protected]>

[ Upstream commit 5120b1e048d48596ffaec1a8412012a91adba73b ]

Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In the case of folio mapped in both a parent and a child, if the parent unmaps the range first, the reservation adjustment will result in an underflow of the reserved count. Once the child unmaps the range, the count is restored. Change __unmap_hugepage_range() to check the mapcount before adjusting the reservation.

---
 mm/hugetlb.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

index e910ed0c43d0b..185faeaf5c08e 100644
@@ -5523,6 +5523,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
 	bool adjust_reservation;
 	unsigned long last_addr_mask;
 
+	i_mmap_assert_write_locked(vma->vm_file->f_mapping);
 	WARN_ON(!is_vm_hugetlb_page(vma));
 	BUG_ON(start & ~huge_page_mask(h));
 	BUG_ON(end & ~huge_page_mask(h));

@@ -5613,7 +5614,10 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
 
 		/*
 		 * Restore the reservation for anonymous page, otherwise the
-		 * backing page could be stolen by someone.
+		 * backing page could be stolen by someone. Restore only on the
+		 * last unmap, otherwise the owner could empty its resv map
+		 * while the folio is still mapped by a child. Note that holding
+		 * i_mmap_lock_write is needed to check the number of mappings.
 		 * If there we are freeing a surplus, do not set the restore
 		 * reservation bit.
 		 */

@@ -5621,7 +5625,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
 
 		spin_lock_irq(&hugetlb_lock);
 		if (!h->surplus_huge_pages && __vma_private_lock(vma) &&
-		    folio_test_anon(page_folio(page))) {
+		    !folio_mapped(page_folio(page)) && folio_test_anon(page_folio(page))) {
 			folio_set_hugetlb_restore_reserve(page_folio(page));
 			/* Reservation to be adjusted after the spin lock */
 			adjust_reservation = true;

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Youngjae Kwon <[email protected]>

[ Upstream commit e422777fdd4746de1109575c51e65038d4c5c1be ]

When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if the cached aggregate already contains that bit. This is racy with a recalculation triggered by a concurrent update to another mark on the same connector.

The concurrent scan can read the mark before the new bit is added, while the updater reads the old aggregate before that scan publishes its result. The updater then skips recalculation and the scan publishes a mask without the bit, leaving the object mask stale after both updates complete.

This can be reproduced with two fanotify groups watching the same inode:
one thread removes FAN_MODIFY from one existing mark while another thread adds FAN_MODIFY to the other mark. After both fanotify_mark() calls return, writes can fail to produce FAN_MODIFY for the group whose mark now contains the bit. This was reproduced on an unmodified v6.12.95 kernel. The equivalent inotify interleaving loses IN_MODIFY events.

For normal fanotify additions, recalculate whenever the raw mark mask changes. The normal mask is not cleared asynchronously, so an unchanged addition cannot introduce missing interest. Always recalculate ignore-mask updates because FS_MODIFY handling may clear the ignore mask without taking mark->lock, making snapshot comparisons unreliable.

Always recalculate after updating an existing inotify watch. Its replace path temporarily sets mark->mask to zero, so a concurrent scan can observe zero even when the old and final masks are equal. Assigning the replacement mask directly would avoid the transient zero, but existing-watch updates are infrequent, so unconditional recalculation is simpler.

[yjkwon0026: Resolve the inotify conflict by retaining the branch-native inode->i_fsnotify_marks argument to fsnotify_recalc_mask(). This tree lacks 4520b96b8136 ("fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()"). The surrounding conditional is deleted by this patch, so that commit is not a prerequisite for this fix.]

---
 fs/notify/fanotify/fanotify_user.c | 12 +++++++-----
 fs/notify/inotify/inotify_user.c   | 15 +--------------
 2 files changed, 8 insertions(+), 19 deletions(-)

index b89ad128bf09c..93472a48ceb3c 100644
@@ -1141,16 +1141,18 @@ static bool fanotify_mark_update_flags(struct fsnotify_mark *fsn_mark,
 static bool fanotify_mark_add_to_mask(struct fsnotify_mark *fsn_mark,
 				      __u32 mask, unsigned int fan_flags)
 {
+	__u32 old_mask;
 	bool recalc;
 
 	spin_lock(&fsn_mark->lock);
-	if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS))
+	if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS)) {
+		old_mask = fsn_mark->mask;
 		fsn_mark->mask |= mask;
-	else
+		recalc = old_mask != fsn_mark->mask;
+	} else {
 		fsn_mark->ignore_mask |= mask;
-
-	recalc = fsnotify_calc_mask(fsn_mark) &
-		~fsnotify_conn_mask(fsn_mark->connector);
+		recalc = true;
+	}
 
 	recalc |= fanotify_mark_update_flags(fsn_mark, fan_flags);
 	spin_unlock(&fsn_mark->lock);

index 0ea4e99dc449c..e5ccd5572beb6 100644
@@ -539,7 +539,6 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
 {
 	struct fsnotify_mark *fsn_mark;
 	struct inotify_inode_mark *i_mark;
-	__u32 old_mask, new_mask;
 	int replace = !(arg & IN_MASK_ADD);
 	int create = (arg & IN_MASK_CREATE);
 	int ret;

@@ -555,27 +554,15 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
 	i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
 
 	spin_lock(&fsn_mark->lock);
-	old_mask = fsn_mark->mask;
 	if (replace) {
 		fsn_mark->mask = 0;
 		fsn_mark->flags &= ~INOTIFY_MARK_FLAGS;
 	}
 	fsn_mark->mask |= inotify_arg_to_mask(inode, arg);
 	fsn_mark->flags |= inotify_arg_to_flags(arg);
-	new_mask = fsn_mark->mask;
 	spin_unlock(&fsn_mark->lock);
 
-	if (old_mask != new_mask) {
-		/* more bits in old than in new? */
-		int dropped = (old_mask & ~new_mask);
-		/* more bits in this fsn_mark than the inode's mask? */
-		int do_inode = (new_mask & ~READ_ONCE(inode->i_fsnotify_mask));
-
-		/* update the inode with this new fsn_mark */
-		if (dropped || do_inode)
-			fsnotify_recalc_mask(inode->i_fsnotify_marks);
-
-	}
+	fsnotify_recalc_mask(inode->i_fsnotify_marks);
 
 	/* return the wd */
 	ret = i_mark->wd;

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 858d2a4f67ff69e645a43487ef7ea7f28f06deae ]

Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late.

After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it.

Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found.

Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion.

This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.

[florian:
- net/ipv6/tcp_ipv6.c:
- Set newnp->ipv6_fl_list = NULL instead of newinet->ipv6_fl_list = NULL, as ipv6_fl_list is in struct ipv6_pinfo.
- net/dccp/:
- Updated syn_recv_sock implementations and call sites for DCCP, which was removed in upstream kernels prior to this commit.]