6.6.157-rc1 review

This is the start of the stable review cycle for the 6.6.157 release. There are 1424 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Mon, 14 Sep 2026 06:54:17 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.157-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.157-rc1

Xixin Liu <[email protected]>
nvmet-rdma: fix queue leak when connect backlog is exceeded

Sandipan Das <[email protected]>
perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error

Eric Dumazet <[email protected]>
net: hsr: must allocate more bytes for RedBox support

Dan Carpenter <[email protected]>
pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()

Tomas Glozar <[email protected]>
tools/build: Use SYSTEM_BPFTOOL for system bpftool

Takashi Iwai <[email protected]>
ALSA: control: Fix unannotated kfree() cleanup

Eric Dumazet <[email protected]>
net: hsr: init prune_proxy_timer sooner

Sebastian Andrzej Siewior <[email protected]>
net: hsr: Use the seqnr lock for frames received via interlink port.

MD Danish Anwar <[email protected]>
net: hsr: enable promiscuous mode on interlink port with fwd offload

Christophe JAILLET <[email protected]>
wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event()

Matvey Kovalev <[email protected]>
wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()

Sudeep Holla <[email protected]>
firmware: arm_scmi: Roll back partial protocol table registration

Thomas Gleixner <[email protected]>
irqdomain: Make build work for CONFIG_GENERIC_IRQ_CHIP=n

Wentao Liang <[email protected]>
nvme: target: rdma: fix ndev refcount leak on queue connect

Catalin Marinas <[email protected]>
kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c

Catalin Marinas <[email protected]>
kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings

e.kubanski <[email protected]>
xsk: Fix offset calculation in unaligned mode

Nick Chan <[email protected]>

    nvme-apple: Reset q->sq_tail during queue init

Nick Chan <[email protected]>
nvme-apple: Prevent shared tags across queues on Apple A11

Rafael J. Wysocki <[email protected]>
ACPI: processor: Update cpuidle driver check in __acpi_processor_start()

Tony W Wang-oc <[email protected]>
ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()

Huisong Li <[email protected]>
ACPI: processor: idle: Remove redundant static variable and rename cstate check function

Huisong Li <[email protected]>
ACPI: processor: idle: Move max_cstate update out of the loop

Huisong Li <[email protected]>
ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init

Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers

Hao Chang <[email protected]>
pinctrl: mediatek: Fix new design debounce issue

Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask()

Jamal Hadi Salim <[email protected]>
net/sched: sch_htb: limit htb_classify inner-class filter hops

Jiayuan Chen <[email protected]>
tcp: fix corruption of urgent data on multi-segment retransmit

Deepanshu Kartikey <[email protected]>
usb: atm: usbatm: fix invalid ci_range initialization

bui duc phuc <[email protected]>
net: fec: only stop PTP if it was initialized

Eric Dumazet <[email protected]>
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

Jamal Hadi Salim <[email protected]>
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

Maxime Chevallier <[email protected]>
net: stmmac: selftests: Account for the UC filter list for filtering tests

Maxime Chevallier <[email protected]>
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering

Maxime Chevallier <[email protected]>
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering

Maxime Chevallier <[email protected]>
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering

Maxime Chevallier <[email protected]>
net: stmmac: selftests: Check multiple MMC counters

Muhammad Usama Anjum <[email protected]>
selftests/arm64: Treat KSM merge_across_nodes as optional

Muhammad Usama Anjum <[email protected]>
selftests/arm64: Print missing MTE TAP headers

Yang Shi <[email protected]>
selftests: arm64: add hugetlb mte tests

Pablo Neira Ayuso <[email protected]>
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()

Marino Dzalto <[email protected]>
netfilter: xt_HL: add pr_fmt and checkentry validation

Michal Koutný <[email protected]>
netfilter: xt_cgroup: Make it independent from net_cls

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: move hardware offload step after building the chain blob

Alice Mikityanska <[email protected]>
virtio-net: Ensure that TCP packets don't overflow gso_segs

Maxime Chevallier <[email protected]>
net: stmmac: selftests: Pass the IP proto mask in the TC selftest

bui duc phuc <[email protected]>
net: ethernet: sun4i-emac: Fix IRQ error handling

Haotian Zhang <[email protected]>
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

Haotian Zhang <[email protected]>
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify

Aleksandr Nogikh <[email protected]>
libceph: validate banner payload length

Xiubo Li <[email protected]>
ceph: revalidate ki_pos for O_APPEND writes after cap acquisition

HyeongJun An <[email protected]>
ASoC: dapm: Fix off-by-one check on the second enum channel

John Johansen <[email protected]>
apparmor: policy_int make sure list heads are initialized before fail path

Thorsten Blum <[email protected]>
apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init

Ruoyu Wang <[email protected]>
tpm: st33zp24: Validate locality read result

Ruoyu Wang <[email protected]>
tpm: st33zp24: Return zero on status read failure

Victor Nogueira <[email protected]>

    net/sched: sch_teql: restore skb->dev on the slave failure path

Jamal Hadi Salim <[email protected]>
net/sched: sfq: clamp quantum to avoid signed overflow soft lockup

Jamal Hadi Salim <[email protected]>
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow

Jamal Hadi Salim <[email protected]>
net/sched: fq_pie: clamp default quantum to avoid signed overflow

Jamal Hadi Salim <[email protected]>
net/sched: sch_codel: clamp default mtu to avoid disabling CoDel

Jamal Hadi Salim <[email protected]>
net/sched: fq_codel: clamp default quantum and mtu

Eric Dumazet <[email protected]>
net/sched: act_skbmod: fix length calculations and avoid invalid header warnings

Eric Dumazet <[email protected]>
net_sched: act_skbmod: use RCU in tcf_skbmod_dump()

Liam R. Howlett (Oracle) <[email protected]>
maple_tree: fix argument name in header

Muhammad Usama Anjum <[email protected]>
selftests/mm: skip COW tmpfile cases when fallocate() is unsupported

Mark Brown <[email protected]>
selftests/mm: report unique test names for each cow test

Hao Ge <[email protected]>
selftests/mm/cow: modify the incorrect checking parameters

David Hildenbrand <[email protected]>
selftests: mm: cow: flag vmsplice() hugetlb tests as XFAIL

Ryan Roberts <[email protected]>
selftests/mm/cow: generalize do_run_with_thp() helper

Frank Sorenson <[email protected]>
cifs: fix clearing stats for fastest execution of each smb2 command

Allison Henderson <[email protected]>
net/rds: use wq_has_sleeper() in rds_cong_map_updated()

Naveen Mamindlapalli <[email protected]>
octeontx2-af: Fix TL3/TL2 link config ENA clearing

Xiang Mei <[email protected]>

    net: qualcomm: rmnet: restore skb->dev on deaggregated frames

Cen Zhang (Microsoft) <[email protected]>
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

Hyunwoo Kim <[email protected]>
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

Chris Lu <[email protected]>
Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path

Chris Lu <[email protected]>
Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX

Ismail Tarim <[email protected]>
Bluetooth: btmtk: Do not discard the subsystem reset timeout

Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

Pavel Shpakovskiy <[email protected]>

    Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference

Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

Geert Uytterhoeven <[email protected]>
erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic

Dan Carpenter <[email protected]>
scsi: qla2xxx: Fix an loop timeout test

Cosmo Chou <[email protected]>
rtc: pcf85363: Add error checking to regmap calls in probe()

Junrui Luo <[email protected]>
NFSv4/pnfs: key the data server cache on the NFS version

Jeff Layton <[email protected]>
nfs: move the nfs4_data_server_cache into struct nfs_net

Junrui Luo <[email protected]>
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion

Mahanta Jambigi <[email protected]>
net/smc: free pending qentry in smc_llc_flow_stop() before memset

Mahanta Jambigi <[email protected]>
net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition

Eric Dumazet <[email protected]>
inetpeer: randomize RB-tree node comparison using SipHash

Tetsuo Handa <[email protected]>
net: add missing ref_tracker_dir_exit() to net_passive_dec()

Ruoyu Wang <[email protected]>
net: ipa: balance runtime PM reference on remove error

Uwe Kleine-König <[email protected]>
net: ipa: Convert to platform remove callback returning void

Marek Czernohous <[email protected]>
forcedeth: stop the tx_timeout register dump past the requested window

Fan Ye <[email protected]>
net: thunderbolt: Count delivered packets in rx_packets and rx_bytes

Ruoyu Wang <[email protected]>
net: bridge: Reject descending VLAN tunnel ranges

Cen Zhang (Microsoft) <[email protected]>
xsk: fix NULL pointer dereference in __xsk_rcv()

Maciej Fijalkowski <[email protected]>
xsk: avoid double checking against rx queue being full

Maciej Fijalkowski <[email protected]>
xsk: Get rid of xdp_buff_xsk::orig_addr

Serhat Kumral <[email protected]>
RDMA/ucma: Allow path records to exactly fit the output buffer

Haotian Zhang <[email protected]>
ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup

Cássio Gabriel <[email protected]>
ALSA: core: Add scoped cleanup helper for card references

Takashi Iwai <[email protected]>
ALSA: control: Use guard() for locking

Takashi Iwai <[email protected]>
ALSA: control: Use automatic cleanup of kfree()

Geert Uytterhoeven <[email protected]>
clk: visconti: Make sure clk_init_data is fully initialized

Geert Uytterhoeven <[email protected]>
clk: ti: Make sure clk_init_data is fully initialized

Bradley Morgan <[email protected]>
prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator

Linkai Gong <[email protected]>
rtc: gamecube: check return value of devm_rtc_register_device()

Ruoyu Wang <[email protected]>
i2c: ocores: Disable clock on failed resume

Biju Das <[email protected]>
irqchip/renesas-rzg2l: Fix loss of interrupt

Pengpeng Hou <[email protected]>
rtc: zynqmp: Return optional clock lookup errors

Christopher Lusk <[email protected]>
smb: client: fix request buffer leak in smb2_new_read_req()

Yi Ding <[email protected]>
rtc: pcf8563: fix clock provider leak on unbind

Li RongQing <[email protected]>
vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

Linfeng Sun  <[email protected]>
vdpa_sim: fix cleanup after worker creation failure

Michael S. Tsirkin <[email protected]>
virtio_balloon: disable indirect descriptors

Jian-Ming Liao <[email protected]>
i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Refactor PIO register initialization

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Quieten initialization messages

Jarkko Nikula <[email protected]>
i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1

Jarkko Nikula <[email protected]>
i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes

Ruoyu Wang <[email protected]>
bonding: initialize err for empty target lists

Nikolay Kulikov <[email protected]>
mlxbf-bootctl: fix the build error with FIELD_PREP()

Guangshuo Li <[email protected]>
platform/x86: hp-bioscfg: fix password encoding bounds check

Nguyen Dinh Phi <[email protected]>
vsock: use sock_error() to consume sk_err after a failed connect

HyeongJun An <[email protected]>
platform/x86: dell-wmi-sysman: Fix instance ID bounds

Mahanta Jambigi <[email protected]>
net/smc: hash socket only after full initialisation in smc_sk_init()

Karl Mehltretter <[email protected]>
8139cp: fix Rx and Tx not being disabled in cp_suspend

Baul Lee <[email protected]>
vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()

Ido Schimmel <[email protected]>
vxlan: mdb: Add MDB bulk deletion support

Ido Schimmel <[email protected]>
net: Add MDB bulk deletion device operation

Ido Schimmel <[email protected]>
bridge: add MDB state mask uAPI attribute

Ido Schimmel <[email protected]>
vxlan: mdb: Add MDB get support

Ido Schimmel <[email protected]>
net: Add MDB get device operation

Ido Schimmel <[email protected]>
bridge: add MDB get uAPI attributes

Ido Schimmel <[email protected]>
vxlan: mdb: Factor out a helper for remote entry size calculation

Ido Schimmel <[email protected]>
vxlan: mdb: Adjust function arguments

Xu Rao <[email protected]>
ALSA: hda: Fix connection list comparison in proc output

Baokun Li <[email protected]>
fuse: check for NULL root inode in fuse_fill_super_submount

Zhang Tianci <[email protected]>
fuse: check attributes staleness on fuse_iget()

Joanne Koong <[email protected]>
fuse: convert readdir to use folios

Joanne Koong <[email protected]>
fuse: support folios in struct fuse_args_pages and fuse_copy_pages()

Miklos Szeredi <[email protected]>
fuse: use FUSE_ROOT_ID in fuse_get_root_inode()

Jeff Layton <[email protected]>
fuse: convert to new timestamp accessors

Weiming Shi <[email protected]>

    fs/ntfs3: validate ef->size covers the record's name and value

Konstantin Komarov <[email protected]>
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

Baokun Li <[email protected]>
cuse: wait for pending RCU callbacks on module exit

Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: fix inverted default vlan notification

Maximilian Immanuel Brandtner <[email protected]>
tls: fix RX desync on overlapping skbs

Ruoyu Wang <[email protected]>
net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error

Xiang Mei <[email protected]>
vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

Joas Antonio dos Santos <[email protected]>
ipvs: fix integer overflow in ftp helper port/address parsing

Xin Xie <[email protected]>
net: hsr: free learned nodes on device setup failure

Lukasz Majewski <[email protected]>
net: hsr: Provide RedBox support (HSR-SAN)

Lukasz Majewski <[email protected]>
net: hsr: Use full string description when opening HSR network device

Qingfang Deng <[email protected]>
pppox: drain queued packets on channel handoff

Vladimir Oltean <[email protected]>
net: dsa: b53: fix error propagation from b53_fdb_dump()

Junseo Lim <[email protected]>
net: kcm: Hold RCU read lock while running BPF parser

Karl Mehltretter <[email protected]>
octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()

Mathieu Dubois-Briand <[email protected]>
clk: ti: mux: resolve parent clocks by DT index, not by name

Ethan Carter Edwards <[email protected]>
clk: ti: use kcalloc() instead of kzalloc()

Ruoyu Wang <[email protected]>
NFSv4: remove callback IDR entry on client allocation failure

Arnaud Bonnet <[email protected]>
nfs: refactor pNFS functions using clear_and_wake_up_bit

Arnaud Bonnet <[email protected]>
nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper

Hang Nan <[email protected]>
ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size

Namjae Jeon <[email protected]>
ksmbd: disconnect on SMB3 decryption failure

Junseo Lim <[email protected]>
bpf: Reject negative optlen in cgroup getsockopt hook

Andreas Schwab <[email protected]>
m68k: nfcon: Do not call console_is_registered() in nfcon_device()

Junseo Lim <[email protected]>
lwt_bpf: Restore reserved headroom after xmit program

ZhangGuoDong <[email protected]>
smb/server: preserve error status in smb2_handle_negotiate()

ZhangGuoDong <[email protected]>
smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

Namjae Jeon <[email protected]>
ksmbd: free preauth sessions on connection teardown

Namjae Jeon <[email protected]>
ksmbd: do not advertise unimplemented CA support

Yunseong Kim <[email protected]>
ksmbd: validate ipc response length before dereferencing its fields

Enzo Matsumiya <[email protected]>
smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer

Guangshuo Li <[email protected]>
ksmbd: Do not skip lock checks for single-byte ranges

Marius Cristea <[email protected]>
hwmon: (emc1403) Drop hysteresis for low limit temperature

Guenter Roeck <[email protected]>
hwmon: (emc1403) Rely on subsystem locking

Lars Petter Mostad <[email protected]>

    hwmon: (emc1403) Add support for EMC1428 and EMC1438.

Guenter Roeck <[email protected]>
hwmon: (emc1403) Support 11 bit accuracy

Guenter Roeck <[email protected]>
hwmon: (emc1403) Convert to with_info API

Delphine CC Chiu <[email protected]>

    hwmon: (emc1403) Add support for EMC1442

Hongyan Xu <[email protected]>
block: mtip32xx: synchronize ioctls with device removal

Niklas Cassel <[email protected]>
null_blk: serialize configfs attribute updates with device setup

Zizhi Wo <[email protected]>
null_blk: serialize configfs attribute stores with the lock

Zizhi Wo <[email protected]>
null_blk: reject per-device queue resize for shared tag set

Zizhi Wo <[email protected]>
null_blk: free global tag_set on init error path

Zizhi Wo <[email protected]>
null_blk: register configfs subsystem after creating default devices

Shin'ichiro Kawasaki <[email protected]>
null_blk: add configfs variable shared_tags

Zizhi Wo <[email protected]>
null_blk: use DEFINE_MUTEX for the file-scope mutex

Huisong Li <[email protected]>
mailbox: pcc: Fix command timeout due to missed interrupt

Sudeep Holla <[email protected]>
Revert "mailbox/pcc: support mailbox management of the shared buffer"

Adam Young <[email protected]>
mailbox/pcc: support mailbox management of the shared buffer

Sudeep Holla <[email protected]>
mailbox: pcc: Always map the shared memory communication address

Linmao Li <[email protected]>
mailbox: rockchip: disable pclk on probe failure and unbind

Arnaldo Carvalho de Melo <[email protected]>
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()

Arnaldo Carvalho de Melo <[email protected]>
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()

Zhushuai Yin <[email protected]>
crypto: hisilicon/sec2 - fix CCM algorithm long packet failure

Israel Téllez García <[email protected]>
bpf: Fix pending_pos walk on 32-bit ring position wrap

Hongyan Xu <[email protected]>
ACPI: scan: fix bus ID cleanup on device_add() failures

Pengpeng Hou <[email protected]>
ASoC: SOF: validate topology volume range before allocation

Steven Rostedt <[email protected]>
tracing: Have trace_event_update_all() only handle module that is loading

Masami Hiramatsu (Google) <[email protected]>
tracing: Remove "__attribute__()" from the type field of event format

Aleksandr Nogikh <[email protected]>
ALSA: core: Fix use-after-free in snd_card_do_free()

Zhan Xusheng <[email protected]>
fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

Zhan Xusheng <[email protected]>
fs/ntfs3: fix integer overflow in MFT cluster validation

Bart Van Assche <[email protected]>
scsi: ufs: core: Set task state before io_schedule_timeout()

Avri Altman <[email protected]>
scsi: ufs: core: Remove redundant host_lock calls around UTMRLDBR

Andrew Halaney <[email protected]>
scsi: ufs: core: Remove unnecessary wmb() after ringing doorbell

Chandrakanth Patil <[email protected]>
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers

Eduard Zingerman <[email protected]>
selftests/bpf: Fix for veristat file/prog filters processing

Phillip Lougher <[email protected]>
Squashfs: check block offset is not negative

Krystian Kaniewski <[email protected]>
ocfs2: fix circular locking dependency in ocfs2_init_acl()

Yuan Chen <[email protected]>
bpftool: Fix double close in map dump

Bijan Tabatabai <[email protected]>
x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported

John Keeping <[email protected]>
ALSA: seq: midi: Serialize input teardown with event_input

Takashi Iwai <[email protected]>
ALSA: seq: midi: Optimize event_input locking with RCU

Yuho Choi <[email protected]>
clocksource/drivers/armada: Unwind timer clock on init failure

Guangshuo Li <[email protected]>
clocksource/drivers/clps711x: Do not unmap clocksource MMIO

Peter Oberparleiter <[email protected]>
s390/debug: Fix deadlock during unregister

Yuho Choi <[email protected]>
xenbus: Unregister reboot notifier on init failure

Henrik Grimler <[email protected]>
power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address

Henrik Grimler <[email protected]>
power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address

Henrik Grimler <[email protected]>
power: supply: bq27xxx: bq27520g4: fix REG_TTES address

Matti Vaittinen <[email protected]>
power: supply: bd99954: Drop bad register fields

Felix Gu <[email protected]>
spi: img-spfi: don't disable runtime PM on DMA deferred probe

Vineet Gupta <[email protected]>
selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM

Pu Lehui <[email protected]>
selftests/bpf: Add description for running vmtest on RV64

Pu Lehui <[email protected]>
selftests/bpf: Support local rootfs image for vmtest

Pu Lehui <[email protected]>
selftests/bpf: Limit URLS parsing logic to actual scope in vmtest

Mohammad Abu-Khader <[email protected]>
kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix

Ran Hongyun <[email protected]>
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC

Rosen Penev <[email protected]>
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error

Yuho Choi <[email protected]>
ubi: Fix rollback for explicit UBI device numbers

Zhihao Cheng <[email protected]>
ubi: fastmap: Add module parameter to control reserving filling pool PEBs

Zhihao Cheng <[email protected]>
ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs

Zhihao Cheng <[email protected]>
ubi: fastmap: Wait until there are enough free PEBs before filling pools

Zhihao Cheng <[email protected]>
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs

Zhihao Cheng <[email protected]>
UBI: Preserve torture flag when rescheduling failed erasures

Zhihao Cheng <[email protected]>
ubi: Replace erase_block() with sync_erase()

Zhihao Cheng <[email protected]>
ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap

Zhihao Cheng <[email protected]>
ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash

Zhihao Cheng <[email protected]>
ubi: fastmap: Fix missed ec updating after erasing old fastmap data block

LiangCheng Wang <[email protected]>
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready

bui duc phuc <[email protected]>
ASoC: pxa: Use devm_clk_get_optional() for extclk clock

Petr Oros <[email protected]>
ice: clear the default forwarding VSI rule when releasing a VSI

Zhu Yanjun <[email protected]>
RDMA/cma: Fix WARNING in res_to_rt

Fan Wu <[email protected]>
RDMA/cxgb4: Free debugfs on registration failure

Guangshuo Li <[email protected]>
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal

Yun Zhou <[email protected]>
nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

Linmao Li <[email protected]>
nfc: digital: Do not dump a NULL response in command completion

Yinhao Hu <[email protected]>
nfc: pn533: hold a reference to the request skb during send_frame

Doruk Tan Ozturk <[email protected]>
nfc: llcp: bound SNL TLV parsing to the skb and add length checks

Zhenghang Xiao <[email protected]>
nfc: nci: fix double completion race in nci_data_exchange_complete

Breno Leitao <[email protected]>

    nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

Breno Leitao <[email protected]>
nfc: llcp: avoid userspace overflow on invalid optlen

Chao Shi <[email protected]>
nvme: reject passthrough of driver-managed Set Features

Yang Xiuwei <[email protected]>
nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

Guixin Liu <[email protected]>
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

Sven Peter <[email protected]>
nvme-apple: Drop the PRP null check chicken bit

Nick Chan <[email protected]>
nvme: apple: Add Apple A11 support

Sven Peter <[email protected]>
nvme-apple: Never set the opcode in the NVMMU TCB

Sven Peter <[email protected]>
nvme-apple: Don't set a DMA direction for commands without a data transfer

Sven Peter <[email protected]>
nvme-apple: Destroy the admin queue on removal

Guixin Liu <[email protected]>
nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

Alistair Francis <[email protected]>
nvme: Add the DHCHAP maximum HD IDs

Guixin Liu <[email protected]>
nvme: introduce change ptpl and iekey definition

Guixin Liu <[email protected]>
nvme: add reservation command's defines

Jorijn van der Graaf <[email protected]>
ASoC: qcom: q6apm: keep the graph start count in sync with the DSP

Babanpreet Singh <[email protected]>
spi: sprd-adi: Fix probe succeeding without registering the controller

Esteban Urrutia <[email protected]>
phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs

Michael Walle <[email protected]>
powerpc/configs: enable CONFIG_RAS to fix EDAC support

Runyu Xiao <[email protected]>
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

Weiming Shi <[email protected]>
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

Marco Elver <[email protected]>
arm64: Disable KCSAN instrumentation in delay.o

Karl Mehltretter <[email protected]>
m68k: Fix backtraces for non-running tasks

Desnes Nunes <[email protected]>
iommu/vt-d: Fix UCTP context table slot when copying root entries

Danila Chernetsov <[email protected]>
fbdev: kyro: Validate overlay viewport coordinates

Myeonghun Pak <[email protected]>
fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()

Ian Rogers <[email protected]>
perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads

Ian Rogers <[email protected]>
perf synthetic-events: Fix uninitialized pthread_join

Ian Rogers <[email protected]>
perf stat: Fix evsel_list leak in cmd_stat

Rosen Penev <[email protected]>
ARM: dts: helios4: add SATA regulator supplies

Rosen Penev <[email protected]>
ARM: dts: helios4: add vcc-supply to GPIO expander

Rosen Penev <[email protected]>
ARM: dts: helios4: add vcc-supply to EEPROM

Tomáš Macholda <[email protected]>
arm64: dts: turris-mox: fix usb3 phys

Guodong Xu <[email protected]>
riscv: cpufeature: Clarify ISA spec version for canonical order

Victor Nogueira <[email protected]>
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss

Nikhil Gautam <[email protected]>
iio: light: gp2ap002: re-enable irq if runtime suspend fails

Nikhil Gautam <[email protected]>
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes

Ali Ahmet Memis <[email protected]>
Bluetooth: MSFT: validate evt_prefix_len against the response length

Linmao Li <[email protected]>
Bluetooth: MGMT: free the mesh send cancel command when it is cancelled

Linmao Li <[email protected]>
Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths

Linmao Li <[email protected]>
Bluetooth: hci_conn: fix the SCO setup context lifetime

Zijun Hu <[email protected]>
Bluetooth: btintel: Fix diagnostics event detection

HyeongJun An <[email protected]>
Bluetooth: virtio_bt: avoid OOB read of build info string

Yichong Chen <[email protected]>
btrfs: retry verity reads for not-uptodate Merkle folios

Yang Xiuwei <[email protected]>
scsi: sd: Fix sd_done() sense handling condition

Tanushree Shah <[email protected]>
perf trace-event: Fix integer truncation in do_read() and skip()

Zijun Hu <[email protected]>
Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices

Zijun Hu <[email protected]>
Bluetooth: btusb: Record matched usb_device_id into btusb_data

Johan Hovold <[email protected]>
Bluetooth: btusb: refactor endpoint lookup

Zijun Hu <[email protected]>
Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()

Zijun Hu <[email protected]>
Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event

Ricardo Neri <[email protected]>
sched/fair: Check CPU capacity before comparing group types during load balance

Yuho Choi <[email protected]>
ACPI: video: Release PCI device reference after lookup

Kamal Wadhwa <[email protected]>
regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling

Yeoreum Yun <[email protected]>
coresight: etm4x: fix leaked trace id

Yeoreum Yun <[email protected]>
coresight: etm4x: fix underflow for usage of (nrseqstate - 1)

James Clark <[email protected]>
coresight: Change syncfreq to be a u8

Yeoreum Yun <[email protected]>
coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()

Bruce Johnston <[email protected]>
md/raid1: don't set array_frozen in raid1_takeover()

Yu Kuai <[email protected]>
md: avoid stale clone I/O accounting timestamps

Yu Kuai <[email protected]>
md/raid5: round bitmap stripes with sector division

Loic Poulain <[email protected]>
phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend

Loic Poulain <[email protected]>
phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend

Loic Poulain <[email protected]>
phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend

Mohd Ayaan Anwar <[email protected]>
phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads

Russell King (Oracle) <[email protected]>
phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()

Linkai Gong <[email protected]>
soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()

Yichong Chen <[email protected]>
hugetlbfs: release subpool on fill_super failure

Simon Glass <[email protected]>
pinctrl: rockchip: Reset the pin count when recalculating SoC data

Mukesh Ojha <[email protected]>
firmware_loader: do not queue completed sysfs fallback requests

Manish Rangankar <[email protected]>
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Use PFP on the compute queues too

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets

Tanushree Shah <[email protected]>
perf trace-event: Fix buffer overflow in read_string()

Gerald Loacker <[email protected]>
phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table

Felix Gu <[email protected]>
phy: sunplus: fix error handling in sp_uphy_init()

Meghana Malladi <[email protected]>
arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node

Jan Kara <[email protected]>
ext4: fix spurious message about orphan cleanup on RO fs

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Fixup emit_cntxcntl()

Pengpeng Hou <[email protected]>
mfd: iqs62x: Reject zero-length firmware records

Pengpeng Hou <[email protected]>
mfd: rave-sp: validate received frame payload lengths

Vladimir Murzin <[email protected]>
arm64: hibernate: Restore DAIF state on error

Ada Couprie Diaz <[email protected]>
arm64: hibernate: mask DAIF before restoring hibernated kernel

Felix Fietkau <[email protected]>
wifi: mac80211: skip default WMM setup for AP_VLAN links

Leon Romanovsky <[email protected]>
RDMA/erdma: restrict the driver to little-endian systems

Shuangpeng Bai <[email protected]>
RDMA/siw: Fix use-after-free in siw_accept()

Guoqing Jiang <[email protected]>
RDMA/siw: Introduce siw_free_cm_id

Yehyeong Lee <[email protected]>
IB/isert: post the full-feature receive buffers after session registration

Yehyeong Lee <[email protected]>
IB/isert: delay the final Login Response until the session is registered

Karl Mehltretter <[email protected]>
cpufreq: imx6q: fix out-of-bounds write when probed more than once

Karl Mehltretter <[email protected]>
cpufreq: imx6q: fix devres accumulation across driver rebind

Jernej Skrabec <[email protected]>
drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz

Jernej Skrabec <[email protected]>
drm/sun4i: dw-hdmi: Drop TCON TOP port reference

Jernej Skrabec <[email protected]>
drm/sun4i: tcon: Drop remote endpoint reference

Jernej Skrabec <[email protected]>
drm/sun4i: crtc: Propagate layer initialization error

Jernej Skrabec <[email protected]>
drm/sun4i: tcon: Drop TCON TOP device reference

Jernej Skrabec <[email protected]>
drm/sun4i: tcon: Set output mux for DSI and LVDS

Kuninori Morimoto <[email protected]>
of: property: add of_graph_get_next_port_endpoint()

Kuninori Morimoto <[email protected]>
of: property: add of_graph_get_next_port()

Kuninori Morimoto <[email protected]>
of: property: use unsigned int return on of_graph_get_endpoint_count()

Kuninori Morimoto <[email protected]>
of: property: add missing kerneldoc for of_graph_get_endpoint_count()

Jernej Skrabec <[email protected]>
drm/sun4i: vi scaler: Fix coefficient selection

Cen Zhang <[email protected]>
ocfs2: synchronize heartbeat callbacks with o2net teardown

Xie Yuanbin <[email protected]>
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults

Yehyeong Lee <[email protected]>
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ

Cheng Xu <[email protected]>
RDMA/erdma: Hold CQ references when processing EQ events

Robertus Diawan Chris <[email protected]>
modpost: prevent leak when early return no suffix .o in read_symbols()

Sergei Litvin <[email protected]>
scripts/tags.sh: Prevent binary files appearing in cscope.files

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies

Sayali Patil <[email protected]>
selftests/mm: fix ternary operator precedence in ksm_tests

Sayali Patil <[email protected]>
selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes

Mike Rapoport (Microsoft) <[email protected]>
selftests/mm: ksm_tests: use kselftest framework

Li Wang <[email protected]>
ksm_tests: skip hugepage test when Transparent Hugepages are disabled

Donet Tom <[email protected]>
selftests/mm: add new test cases to the migration test

Baolin Wang <[email protected]>
selftests: mm: support shmem mTHP collapse testing

Ryan Roberts <[email protected]>
selftests/mm/khugepaged: enlighten for multi-size THP

Ryan Roberts <[email protected]>
selftests/mm: support multi-size THP interface in thp_settings

Ryan Roberts <[email protected]>
selftests/mm: factor out thp settings management

Ryan Roberts <[email protected]>
selftests/mm/kugepaged: restore thp settings at exit

Pu Lehui <[email protected]>
bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed

Mukesh Ojha <[email protected]>
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

Mukesh Ojha <[email protected]>
remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()

Mukesh Ojha <[email protected]>
remoteproc: Move resource table data structure to its own header

Andreas Kemnade <[email protected]>
drm/omap: dsi: Do not copy isr table

Yichong Chen <[email protected]>
fat: release buffer head after rebuilding parent

Guangshuo Li <[email protected]>

    rapidio: clear mport->net when rio_add_net() fails

Calvin Owens <[email protected]>
pps-gpio: remove dead capture_clear code

Michael Byczkowski <[email protected]>
pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler

Bastien Curutchet <[email protected]>
pps: clients: gpio: Bypass edge's direction check when not needed

Calvin Owens <[email protected]>
pps: don't try to wait for negative timeouts in PPS_FETCH

Bradley Morgan <[email protected]>
lib/string: fix memchr_inv() for large ranges

Caleb Sander Mateos <[email protected]>
ublk: check for ublk_unmap_io() returning 0

Tao Cui <[email protected]>
block/kyber-iosched: flush per-cpu latency buckets over possible CPUs

Tao Cui <[email protected]>
block/blk-iocost: collect per-cpu latency stats over possible CPUs

Tao Cui <[email protected]>
block/blk-stat: drain per-cpu callback stats over possible CPUs

Zheng Qixing <[email protected]>
blk-cgroup: skip dying blkg in blkcg_activate_policy()

Breno Leitao <[email protected]>
phonet: pep: do not write beyond optlen in getsockopt

Sang-Heon Jeon <[email protected]>
iio: light: tsl2583: return zero in write_raw() on success

Sang-Heon Jeon <[email protected]>
iio: light: isl29028: return zero in write_raw() on success

Yuanshen Cao <[email protected]>
iio: light: tsl2772: fix ALS calibscale readback

Arnaldo Carvalho de Melo <[email protected]>
perf intel-bts: Fix off-by-one in auxtrace_info minimum size check

Arnaldo Carvalho de Melo <[email protected]>
perf intel-pt: Fix off-by-one in auxtrace_info minimum size check

Arnaldo Carvalho de Melo <[email protected]>
perf auxtrace: Fix queue grow overflow and old array leak

Arnaldo Carvalho de Melo <[email protected]>
perf thread-stack: Fix heap buffer overflow on branch stack wrap copy

Jiancheng Huang <[email protected]>
HID: lg4ff: validate report length before fixed offsets

Chao Huang <[email protected]>
HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure

Ai Chao <[email protected]>
HID: i2c-hid: Fix "(null)" output when reading report descriptor fails

Kenny Levinsen <[email protected]>
HID: i2c-hid: Revert to await reset ACK before reading report descriptor

Hans de Goede <[email protected]>
HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor

Hans de Goede <[email protected]>
HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling

Hans de Goede <[email protected]>
HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions

Hans de Goede <[email protected]>
HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset()

Yousef Alhouseen <[email protected]>
HID: synchronize input before cleaning up a failed probe

谢致邦 (XIE Zhibang) <[email protected]>
HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver

Karl Mehltretter <[email protected]>
tty: clear cdev pointer after cdev_add() failure

Karl Mehltretter <[email protected]>
serial: amba-pl011: unprepare console clock on unregister

Thomas Bogendoerfer <[email protected]>
MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL

Saket Kumar Bhaskar <[email protected]>
powerpc/irq: Fix missing r2 clobber in PCREL inline assembly

Gou Hao <[email protected]>
powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass

Laxman Acharya Padhya <[email protected]>
firmware: coreboot: Validate table bounds

Titouan Ameline de Cadeville <[email protected]>
firmware: google: Add bounds checks in coreboot_table_populate()

Zhao Li <[email protected]>
wifi: mac80211: skip unused probe response countdown offsets

Slawomir Stepien <[email protected]>
wifi: zd1211rw: reject secondary interfaces to prevent conflicts

Zhao Li <[email protected]>
wifi: mac80211: send TWT teardown to peer after setup TX failure

Davidlohr Bueso <[email protected]>
perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register

Pranjal Shrivastava <[email protected]>
iommu/arm-smmu-v3: Convert to use atomic poll timeout

Linghui Wu <[email protected]>
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: report RX chain signal for all RX paths

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1

StanleyYP Wang <[email protected]>
wifi: mt76: mt7996: fix reg addr remap when addr is 0

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: release hif2 reference on probe IRQ failure

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: fix ext PHY use-after-free on register error path

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: fix double hif2 init on the non-WED path

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Check snprintf truncation for guest kallsyms path

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Free scandir entries in guest kernel map creation

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Reset errno before strtol in guest kernel map creation

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Don't abort guest map creation on first inaccessible dir

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Check snprintf truncation in machines__findnew()

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Use snprintf() for guestmount path construction

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Guard against NULL strlist in machines__findnew()

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Fix NULL parent dereference in fork event processing

Joy Zou <[email protected]>
regulator: core: use system_freezable_wq for init complete work

Jeff Johnson <[email protected]>
wifi: ath11k: fix leak in ath11k_service_ready_ext_event()

Konrad Dybcio <[email protected]>
drm/msm/dsi: Drop dev_pm_opp_set_rate(0)

Konrad Dybcio <[email protected]>
drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)

Leo Yan <[email protected]>
perf: arm_spe: Make wakeup range check overflow safe

Can Peng <[email protected]>
ACPI: processor: Unregister cpufreq notifier on init failure

Huisong Li <[email protected]>
ACPI: processor: idle: Optimize ACPI idle driver registration

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields

Felix Fietkau <[email protected]>
wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV

Felix Fietkau <[email protected]>

    wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie

Felix Fietkau <[email protected]>
wifi: mt76: mt7996: don't report a zero TX bitrate

Felix Fietkau <[email protected]>

    wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss

Felix Fietkau <[email protected]>
wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset

Eason Lai <[email protected]>
wifi: mt76: mt792x: Fix memory leak in SDIO TX path

Zhi-Jun You <[email protected]>

    wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986

Laxman Acharya Padhya <[email protected]>
wifi: mt76: mt7921: validate CLC firmware records

Devin Wittmayer <[email protected]>
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length

Yichong Chen <[email protected]>
fanotify: report full event length for FIONREAD

Abdun Nihaal <[email protected]>
misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()

Naveen Kumar Chaudhary <[email protected]>
locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

Adrian Hunter <[email protected]>
i3c: master: Fix device_register() error path

Jakub Kicinski <[email protected]>
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices

Aneesh Kumar K.V (Arm) <[email protected]>
swiotlb: Preserve allocation virtual address for dynamic pools

Aneesh Kumar K.V (Arm) <[email protected]>
iommu/dma: Check atomic pool allocation result directly

Vladimir Zapolskiy <[email protected]>
clk: qcom: Return expected ENOMEM error on dynamic allocation failure

Stanislav Kinsburskii <[email protected]>
lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone

Pu Lehui <[email protected]>
bpf: Fix potential UAF when reading bpf link info

Pu Lehui <[email protected]>
bpf: Fix potential UAF in bpf_netns_link_update_prog

Hongyan Xu <[email protected]>
power: supply: sc2731_charger: cancel work on remove

Uwe Kleine-König <[email protected]>
power: supply: sc2731_charger: Convert to platform remove callback returning void

Hongyan Xu <[email protected]>
power: supply: isp1704_charger: cancel work on remove

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8550: Fix the msi-map entries

Neil Armstrong <[email protected]>
arm64: dts: qcom: sm8550: Use GIC-ITS for PCIe0 and PCIe1

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries

Manivannan Sadhasivam <[email protected]>

    arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries

Krzysztof Kozlowski <[email protected]>

    arm64: dts: qcom: sc8180x: drop duplicated PCI iommus property

Dawid Wróbel <[email protected]>
arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID

Konrad Dybcio <[email protected]>

    arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en

Dmitry Baryshkov <[email protected]>
clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property

Konrad Dybcio <[email protected]>
arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep

Itai Handler <[email protected]>

    rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs

Valentin Schneider <[email protected]>
rcu: Rename rcu_momentary_dyntick_idle() into rcu_momentary_eqs()

Yue Haibing <[email protected]>
rcu: Remove unused function declaration rcu_eqs_special_set()

Cheng-Han Wu <[email protected]>
selftests/zram: fix kernel_gte() for POSIX sh

Thomas Weißschuh <[email protected]>
tools/nolibc/powerpc: mark ctr and xer as clobbered by system call

Sajal Gupta <[email protected]>
md/raid5-ppl: fix use-after-free in ppl_do_flush()

Chen Cheng <[email protected]>
md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency

Manivannan Sadhasivam <[email protected]>
bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET

Abdun Nihaal <[email protected]>
wifi: rtlwifi: pci: fix error path in rtl_pci_probe()

Hongyan Xu <[email protected]>
platform/chrome: cros_ec_debugfs: Unregister panic notifier

Hongyan Xu <[email protected]>
platform/chrome: cros_ec_debugfs: Clean up console log on probe failure

Jeff Johnson <[email protected]>
wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()

Kang Yang <[email protected]>
wifi: ath11k: implement handling of P2P NoA event

Dmitry Antipov <[email protected]>
wifi: ath11k: refactor ath11k_wmi_tlv_parse_alloc()

Anilkumar Kolli <[email protected]>
wifi: ath11k: add firmware-2.bin support

Kalle Valo <[email protected]>

    wifi: ath11k: qmi: refactor ath11k_qmi_m3_load()

Fan Wu <[email protected]>
spi: davinci: switch to managed controller allocation

Bastien Curutchet <[email protected]>
spi: davinci: Unset POWERDOWN bit when releasing resources

Li Zetao <[email protected]>
spi: davinci: Use helper function devm_clk_get_enabled()

Guixin Liu <[email protected]>
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request

Yehyeong Lee <[email protected]>
IB/isert: reject login PDUs declaring more data than was received

Yehyeong Lee <[email protected]>
IB/isert: reject PDUs declaring more data than was received

Leon Romanovsky <[email protected]>
RDMA/cxgb4: free STAG index when TPT entry write fails

Leon Romanovsky <[email protected]>
RDMA/mlx5: Send cong param changes to the resolved port mdev

Leon Romanovsky <[email protected]>
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

David Strahan <[email protected]>
scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.

Ryusuke Konishi <[email protected]>
nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

Matthew Wilcox (Oracle) <[email protected]>
nilfs2: convert nilfs_page_bug() to nilfs_folio_bug()

Matthew Wilcox (Oracle) <[email protected]>
nilfs2: convert nilfs_btnode_commit_change_key to use a folio

Matthew Wilcox (Oracle) <[email protected]>
nilfs2: convert nilfs_btnode_prepare_change_key to use a folio

Matthew Wilcox (Oracle) <[email protected]>
nilfs2: convert to nilfs_folio_buffers_clean()

Matthew Wilcox (Oracle) <[email protected]>
nilfs2: convert nilfs_forget_buffer to use a folio

Matthew Wilcox (Oracle) <[email protected]>
nilfs2: add nilfs_end_folio_io()

David Lee <[email protected]>
nilfs2: prevent out-of-bounds read in super root block parsing

Joshua Crofts <[email protected]>
nilfs2: fix infinite loop in nilfs_clean_segments()

Alexey Charkov <[email protected]>
clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs

Akari Tsuyukusa <[email protected]>
clk: mediatek: mt8135: Fix inverted gate control for devapc_ck

longlong yan <[email protected]>
clk/x86: pmc_atom: add kasprintf return value check

Myeonghun Pak <[email protected]>
clk: palmas: Manage external-control prepare with devm

Guangshuo Li <[email protected]>
clk: tegra: tegra124-emc: put EMC node on register failure

Ondrej Jirman <[email protected]>
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix

Yonatan Nachum <[email protected]>
RDMA/efa: Fix PBL chunk length computation

Weiming Shi <[email protected]>
fs/ntfs3: reject restart table growth beyond U16_MAX entries

Ivy Lopez <[email protected]>
staging: rtl8723bs: use kfree_sensitive() for key material

Bjorn Andersson <[email protected]>
remoteproc: Prevent crash handling to race with rproc_del()

Jingyi Wang <[email protected]>
remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()

Bjorn Andersson <[email protected]>
remoteproc: Allow shutdown of crashed processors

Peng Fan <[email protected]>
remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()

Babanpreet Singh <[email protected]>

    w1: ds2482: Fix signedness bug in ds2482_w1_triplet()

Yichong Chen <[email protected]>
isofs: release zisofs block pointer buffer head

Maher Sanalla <[email protected]>
RDMA/mlx5: Fix integer overflow of user QP buffer size

Can Peng <[email protected]>
crypto: keembay - publish OF module alias for OCS AES/SM4

Linmao Li <[email protected]>
crypto: keembay - Initialize completion before requesting IRQ

Li Qiang <[email protected]>
scsi: ufs: debugfs: Reserve space for a string terminator

Babanpreet Singh <[email protected]>
power: supply: sbs-battery: Use a per-device serial number buffer

James Clark <[email protected]>
tools/build: Allow versioning of all LLVM tools defined in Makefile.include

Tomas Glozar <[email protected]>
tools/build: Add bpftool-skeletons feature test

Justin Yeh <[email protected]>
pinctrl: mediatek: free EINT resources on unbind

Nícolas F. R. A. Prado <[email protected]>
pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms

Hao Chang <[email protected]>
pinctrl: mediatek: Fix the invalid conditions

Hao Chang <[email protected]>
pinctrl: mediatek: Add EINT support for multiple addresses

Andy Shevchenko <[email protected]>
pinctrl: mediatek: Use C99 initializers in PINCTRL_PIN_GROUP()

Alison Schofield <[email protected]>
cxl/region: Fix use-after-free in find_pos_and_ways() error path

Feng Yang <[email protected]>
selftests/bpf: Fix memory leak on subtest_states reallocation

Feng Yang <[email protected]>
selftests/bpf: Fix incorrect error checking for pthread_create

Karl Mehltretter <[email protected]>
ARM: lpc32xx: only run SoC init on LPC32xx hardware

Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt

Weiming Wu <[email protected]>
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init

Florian Westphal <[email protected]>
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet

Can Peng <[email protected]>
drm/tve200: add OF module alias for autoloading

Cosmo Chou <[email protected]>
leds: pca9532: Fix phantom device registration on missing hardware

Malaya Kumar Rout <[email protected]>
PM: hibernate: Fix memory leak in snapshot_write_next() error path

Sanghyun Park <[email protected]>
xfrm: Fix skb double-free in xfrm_dev_direct_output()

Leo Yan <[email protected]>
perf cs-etm: Avoid truncating AUX buffer sizes to int

Leo Yan <[email protected]>
perf cs-etm: Flush thread stacks after decoder reset

Sudeep Holla <[email protected]>
firmware: arm_scmi: Unrequest devices if driver registration fails

Cristian Marussi <[email protected]>
firmware: arm_scmi: Add multiple protocols registration support

Andre Przywara <[email protected]>
ARM: dts: allwinner: a10: Fix PMU interrupt

Xiang Mei <[email protected]>
ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

Guanghui Yang <[email protected]>
ext4: fix buffer_head leak in ext4_init_orphan_info

Selvin Xavier <[email protected]>
RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap

Jeff Johnson <[email protected]>
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

Jeff Johnson <[email protected]>
wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()

Jeff Johnson <[email protected]>
wifi: ath11k: Correctly copy the hint BSSID in WMI scan request

Jeff Johnson <[email protected]>
wifi: ath12k: Correctly copy the hint BSSID in WMI scan request

Jeff Johnson <[email protected]>
wifi: ath6kl: avoid buffer overreads in WMI event handlers

Baokun Li <[email protected]>
ext4: drain in-flight DIO before buffered write fallback

Gerald Yang <[email protected]>
ext4: clear stale xarray tags on folios skipped during writeback

Pengpeng Hou <[email protected]>
thermal: intel: int3400: clean up ODVP on probe failures

Mukesh Ojha <[email protected]>
iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()

Haoxiang Li <[email protected]>
iommu/qcom: Remove sysfs device on probe failure path

Sudeep Holla <[email protected]>
firmware: arm_scmi: Fix requested device removal race

Patrisious Haddad <[email protected]>
RDMA/core: Fix potential use after free in ib_dealloc_pd_user()

Patrisious Haddad <[email protected]>
RDMA/core: Fix potential use after free in ib_free_cq()

Mark Zhang <[email protected]>
RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq()

Patrisious Haddad <[email protected]>
RDMA/core: Fix potential use after free in counter_release()

Patrisious Haddad <[email protected]>
RDMA/core: Fix potential use after free in ib_destroy_srq_user()

Patrisious Haddad <[email protected]>
RDMA/core: Fix potential use after free in ib_destroy_cq_user()

Patrisious Haddad <[email protected]>
RDMA/core: Fix use after free in ib_query_qp()

Patrisious Haddad <[email protected]>
RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations

Jason Gunthorpe <[email protected]>

    RDMA/nldev: Fix locking when accessing mr->pd

Kalesh AP <[email protected]>
RDMA/restrack: Fix typos in the comments

Chiara Meiohas <[email protected]>
RDMA/core: Add an option to display driver-specific QPs in the rdmatool

Patrisious Haddad <[email protected]>
RDMA/core: Add support to set privileged QKEY parameter

Myeonghun Pak <[email protected]>
RDMA/erdma: Fix CEQ tasklet use-after-free on removal

Takuma Fujiwara <[email protected]>
PCI: j721e: Fix incorrect max_lanes for J7200

Leon Romanovsky <[email protected]>
RDMA/srpt: Pass the mapped task attribute to target_init_cmd()

Ricardo B. Marlière <[email protected]>
libbpf: Search /lib64 and /lib in resolve_full_path()

Yun Zhou <[email protected]>
ext4: skip extra isize expansion during mount to prevent deadlock

Xiang Mei <[email protected]>
ext4: fix out-of-bounds read in ext4_read_inline_dir()

Yun Zhou <[email protected]>
ext4: fix circular lock dependency in ext4_ext_migrate

Chen Pei <[email protected]>
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root

Pengpeng Hou <[email protected]>
ACPI: processor: validate MADT IOAPIC entry bounds

Zhu Ling <[email protected]>
ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer

Pengpeng Hou <[email protected]>
RDMA/nldev: validate dynamic counter attribute length

Kemeng Shi <[email protected]>
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()

Viktor Malik <[email protected]>
selftests/bpf: Silence array bounds warning in global_map_resize

Marco Elver <[email protected]>
kcsan: avoid unintended access checking in NMIs

TanZheng <[email protected]>
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

Ibrahim Hashimov <[email protected]>

    RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]

Danila Chernetsov <[email protected]>
RDMA/hfi1: Propagate sdma_txinit_ahg() errors

Jun Yan <[email protected]>
arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe

Can Peng <[email protected]>
phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe

Linmao Li <[email protected]>
ASoC: meson: Keep link pointers valid on realloc failure

Koichiro Den <[email protected]>
dmaengine: dw-edma: Clear stale requests on termination

Koichiro Den <[email protected]>
dmaengine: dw-edma: Serialize channel state checks

Koichiro Den <[email protected]>
dmaengine: dw-edma: Serialize abort state updates

Koichiro Den <[email protected]>
dmaengine: dw-edma: Terminate all descriptors without callbacks

Yuho Choi <[email protected]>
driver core: soc: Unregister bus on early device registration failure

Alban Bedel <[email protected]>
software node: Fix software_node_get_reference_args() with index -1

Ian Rogers <[email protected]>
perf ui hists: Fix uninitialized stack memory free on pstack allocation failure

zhouminqiang <[email protected]>
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

Ruoyu Wang <[email protected]>
mtd: mtdswap: Avoid freeing registered blktrans device twice

Pengpeng Hou <[email protected]>
soc: ti: knav_qmss: Remove debugfs file on teardown

Md Shofiqul Islam <[email protected]>
soc: ti: knav_qmss_queue: Implement resource cleanup in remove()

Xiang Mei <[email protected]>

    vfio/pci: clear vdev->msi_perm after freeing it on init failure

Myeonghun Pak <[email protected]>
char: xilinx_hwicap: unregister class on init errors

Pei Xiao <[email protected]>
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove

Jiri Slaby (SUSE) <[email protected]>
tty: ipoctal: convert to u8 and size_t

Linmao Li <[email protected]>
ppdev: prevent overflow when setting port timeout

Breno Leitao <[email protected]>
cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)

Pengpeng Hou <[email protected]>
misc: ad525x_dpot: use driver core groups for sysfs files

Gleb Markov <[email protected]>
misc: rtsx: add missing write register handling

Gui-Dong Han <[email protected]>
misc: bcm-vk: Use acquire/release for msgq_inited

Pavel Zhigulin <[email protected]>
speakup: keyhelp: guard letter_offsets possible out-of-range indexing

Christophe JAILLET <[email protected]>
accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()

Yuho Choi <[email protected]>
uio: Fix stale info pointer in failed registration path

David Lee <[email protected]>
UDF symlink pathComponent header OOB read

Karl Mehltretter <[email protected]>
tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64

Xu Yang <[email protected]>
usb: gadget: f_uac1_legacy: remove broken string configfs attributes

Rafael J. Wysocki <[email protected]>
ACPI: processor: idle: Expand _LPI package sanity checks

Thorsten Blum <[email protected]>
crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping

Pu Lehui <[email protected]>
bpf: Sync tail_call_reachable with callee state on entry

Shivam Rawat <[email protected]>
drm/msm/a6xx: Fix stale rpmh votes after suspend

Mikko Perttunen <[email protected]>
gpu: host1x: Avoid stack over-read in debug output helpers

Mikko Perttunen <[email protected]>
gpu: host1x: Fix offset calculation in trace_write_gather

Avraham Stern <[email protected]>
wifi: iwlwifi: mei: pass correct argument to function

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments

Avraham Stern <[email protected]>
wifi: iwlwifi: mei: check SAP message length before reading it

Avraham Stern <[email protected]>
wifi: iwlwifi: mei: add support for SAP version 4

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs

Ian Rogers <[email protected]>
perf jevents: Add more components to the metric sorting order

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8250: sort out Iris power domains

Konrad Dybcio <[email protected]>
arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO

Maoyi Xie <[email protected]>
drm/bridge: tc358767: clamp the reported AUX read size to the request

Uday Khare <[email protected]>

    remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev

Zhongqiu Han <[email protected]>
cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()

Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Fix setting minimum P-state at init time

Biren Pandya <[email protected]>
media: i2c: rdacm21: Fix missing media_entity_cleanup()

Qingshuang Fu <[email protected]>
irqchip/renesas-irqc: Fix generic interrupt chip leak on remove

Herve Codina <[email protected]>
irqdomain: Add support for generic irq chips creation before publishing a domain

Herve Codina <[email protected]>
genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips()

Herve Codina <[email protected]>
irqdomain: Introduce init() and exit() hooks

Herve Codina <[email protected]>
irqdomain: Handle domain hierarchy parent in irq_domain_instantiate()

Herve Codina <[email protected]>
irqdomain: Handle additional domain flags in irq_domain_instantiate()

Herve Codina <[email protected]>
irqdomain: Introduce irq_domain_instantiate()

Herve Codina <[email protected]>
irqdomain: Introduce irq_domain_free()

Yuho Choi <[email protected]>
PCI: xgene: Drop unnecessary OF node reference

Marc Zyngier <[email protected]>
PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN

Dan Carpenter <[email protected]>
cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()

John Groves <[email protected]>
dax: read holder_ops once in dax_holder_notify_failure()

Bryam Vargas <[email protected]>
libnvdimm/labels: Bound the on-media label size before the shift

Sudeep Holla <[email protected]>
firmware: arm_scmi: Drop handle on protocol bind failures

Sudeep Holla <[email protected]>
firmware: arm_scmi: Protect device request lookup with RCU

Sudeep Holla <[email protected]>
firmware: arm_scmi: Use channel ID for transport teardown

Sudeep Holla <[email protected]>
firmware: arm_scmi: Reject out of range DT protocol IDs

Sudeep Holla <[email protected]>
firmware: arm_scmi: Avoid IDR updates while cleaning channels

Sudeep Holla <[email protected]>
firmware: arm_scmi: Free transport channel on IDR failure

Sudeep Holla <[email protected]>
firmware: arm_scmi: Unregister device notifier before IDR teardown

Baochen Qiang <[email protected]>
wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate

Kyle Zeng <[email protected]>
hfsplus: validate thread record before delete key rebuild

HE WEI（ギカク） <[email protected]>
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

Nirbhay Sharma <[email protected]>
fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list

Konstantin Komarov <[email protected]>
fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Konstantin Komarov <[email protected]>
fs/ntfs3: Add more checks in mi_enum_attr (part 2)

Dave Jiang <[email protected]>
cxl/pci: Honor -EPROBE_DEFER from component register setup

Robert Richter <[email protected]>
cxl/pci: Store the endpoint's Component Register mappings in struct cxl_dev_state

Dave Jiang <[email protected]>
cxl/mbox: Break poison list loop on an empty payload

Vishnu Santhosh <[email protected]>
rpmsg: glink: fix deadlock in endpoint destroy during driver detach

Srinivas Kandagatla <[email protected]>
rpmsg: glink: remove duplicate code for rpmsg device remove

Hans Verkuil <[email protected]>
media: v4l2-async: Unregister sub-device if asc_list is empty

Sebastian Reichel <[email protected]>
media: v4l: async: Drop useless list move operation

Xiang Mei <[email protected]>
isofs: fix out-of-bounds page array access on empty zisofs block

James Calligeros <[email protected]>
ASoC: apple: mca: increase SERDES reset delay

Leon Romanovsky <[email protected]>
RDMA/hfi1: Initialize debugfs after probe completes

Leon Romanovsky <[email protected]>
RDMA/hfi1: Stop flushing the global IB workqueue

Leon Romanovsky <[email protected]>
RDMA/hfi1: Create workqueues before device initialization

Leon Romanovsky <[email protected]>
RDMA/hfi1: Remove redundant PCI device ID validation

Leon Romanovsky <[email protected]>
RDMA/hfi1: Free RX data on late probe failure

Leon Romanovsky <[email protected]>
RDMA/hfi1: Preserve unit 0 on allocation failure

Sean Rhodes <[email protected]>
misc: rtsx_usb: avoid USB I/O in runtime autosuspend

Pengpeng Hou <[email protected]>
pmdomain: bcm: bcm2835: handle genpd provider registration errors

Evgenii Burenchev <[email protected]>
ALSA: hpi: Check transport errors during HPI6000 adapter initialization

Xiang Mei <[email protected]>
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

Yuho Choi <[email protected]>
hwrng: ks-sa - Fix runtime PM cleanup on registration failure

Martin Kaiser <[email protected]>
hwrng: ks-sa - access private data via struct hwrng

Allison Henderson <[email protected]>
RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

Leon Romanovsky <[email protected]>
RDMA/ipoib: Drain RCU callbacks during module teardown

Leon Romanovsky <[email protected]>
RDMA/mlx5: Drain RCU callbacks during module teardown

Leon Romanovsky <[email protected]>
RDMA/core: Wait for RCU callbacks before unloading ib_core

Mert Seftali <[email protected]>
iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE

Pengpeng Hou <[email protected]>
bus: qcom-ebi2: use managed resources for clocks and children

Pengpeng Hou <[email protected]>
soc: qcom: rpmh-rsc: manage PM notifiers with devres

Yu Peng <[email protected]>
perf metricgroup: Fix metric expression copy leaks

Laxman Acharya Padhya <[email protected]>
drm/panel: samsung-s6d16d0: Power off on prepare failure

Biju Das <[email protected]>
usb: renesas_usbhs: Fix power-off ordering on unbind

Fei Shao <[email protected]>
usb: mtu3: allow system suspend during active gadget connection

Linmao Li <[email protected]>
platform/surface: acpi-notify: Check ACPI companion before use

Linmao Li <[email protected]>
platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL

Gary Guo <[email protected]>
usb: fix UAF when probe runs concurrent to dyn ID removal

Greg Kroah-Hartman <[email protected]>
USB: make to_usb_driver() use container_of_const()

Greg Kroah-Hartman <[email protected]>
USB: make single lock for all usb dynamic id lists

Yajun Deng <[email protected]>
USB: core: Use device_driver directly in struct usb_driver and usb_device_driver

Ruoyu Wang <[email protected]>
usb: gadget: aspeed_udc: check endpoint DMA allocation

Uwe Kleine-König <[email protected]>
usb: gadget: aspeed_udc: Convert to platform remove callback returning void

Michael Bommarito <[email protected]>
usb: gadget: configfs: fix out-of-bounds read of qw_sign

Yuho Choi <[email protected]>
serial: ma35d1: Fix OF node reference leaks in console init

Wolfram Sang <[email protected]>
hwspinlock: propagate errno when registering single lock

Felix Gu <[email protected]>
remoteproc: qcom_q6v5_adsp: Fix reference leak for device node

Armin Wolf <[email protected]>
platform/x86: dell-wmi-base: Fix resource leak on module load failure

Armin Wolf <[email protected]>
platform/x86: dell-privacy: Fix race condition

Cosmo Chou <[email protected]>
leds: pca9532: Fix inverted GPIO output polarity

Wei Wang <[email protected]>
iommu/amd: Fix false positive in SB IOAPIC IVRS validation

Fu Hao <[email protected]>
iommu/amd: Add support for Hygon family 18h model 4h IOAPIC

Wei Wang <[email protected]>
iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors

Vladimir Zapolskiy <[email protected]>
iommu/msm: Return -ENOMEM on memory allocation failure in probe

Akari Tsuyukusa <[email protected]>
iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX

Yuho Choi <[email protected]>
bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation

Sanghyun Park <[email protected]>
bpf: Fix use-after-free on mm_struct in bpf_find_vma()

Breno Leitao <[email protected]>
efi: fix stale reference to efi_recover_from_page_fault()

Daniel Borkmann <[email protected]>
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux

Aleksandr Nogikh <[email protected]>
udf: Mark LVID buffer as uptodate before marking it dirty

Hongyan Xu <[email protected]>
usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

Bjorn Andersson <[email protected]>
usb: typec: ucsi: unregister debugfs entries on teardown

Dan Carpenter <[email protected]>
thermal/drivers/rcar: Fix error checking in probe()

Tanushree Shah <[email protected]>
perf data convert json: Fix trace_seq memory leak in process_sample_event()

Konrad Dybcio <[email protected]>

    arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes

Bjorn Andersson <[email protected]>

    arm64: dts: qcom: sc8180x: Enable the power key

Anton Bambura <[email protected]>

    arm64: dts: qcom: sc8180x-lenovo-flex-5g: move pinctrl to appropriate nodes

Konrad Dybcio <[email protected]>

    arm64: dts: qcom: sc8180x-primus: Rename regulator nodes

Herman van Hazendonk <[email protected]>
clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()

Herman van Hazendonk <[email protected]>
clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains

Herman van Hazendonk <[email protected]>
clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status

David Woodhouse <[email protected]>
timekeeping: Account for monotonicity adjustment in ntp_error

Thomas Weißschuh <[email protected]>

    y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32

Yuho Choi <[email protected]>
clocksource: Unregister subsystem on device registration failure

Jiangshan Yi <[email protected]>
selftests: timers: leap-a-day: Fix -w option and update usage comment

Kemeng Shi <[email protected]>
irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()

Kemeng Shi <[email protected]>
irqchip/gic-v3-its: Fix memleak in its_probe_one()

Feng Yang <[email protected]>
selftests/bpf: Fix memory leak in msg_alloc_iov

Malaya Kumar Rout <[email protected]>
selftests/bpf: Fix memory leak in msg_alloc_iov error path

Evgenii Burenchev <[email protected]>
ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()

Dawei Feng <[email protected]>
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()

Ayush Mukkanwar <[email protected]>
staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown

Ayush Mukkanwar <[email protected]>
staging: octeon: replace pr_warn with dev_warn in fill and rx paths

Ayush Mukkanwar <[email protected]>
staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions

Yuvraj Singh Chauhan <[email protected]>
staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown

Ayush Mukkanwar <[email protected]>
staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown

Dan Carpenter <[email protected]>
staging: fbtft: Use sysfs_emit_at() to print to sysfs file

Bryam Vargas <[email protected]>
greybus: audio: bound the topology section sizes against the fetched size

Ahmet Sezgin Duran <[email protected]>
staging: sm750fb: gate dualview dataflow using g_dualview

Alexander A. Klimov <[email protected]>
staging: greybus: audio: correct sscanf() return value check

Cen Zhang <[email protected]>
wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

Ruoyu Wang <[email protected]>
bus: qcom-ebi2: Fix clock leak on probe failure

Krzysztof Kozlowski <[email protected]>
bus: qcom-ebi2: Simplify with scoped for each OF child loop

Luca Weiss <[email protected]>
arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name

Haowen Tu <[email protected]>
PM: sleep: Fix off-by-one in wakelocks number limit check

Yuho Choi <[email protected]>
bus: ti-sysc: Fix /chosen node reference leak

Shin'ichiro Kawasaki <[email protected]>
nvmet-rdma: fix response resource leak on queue teardown

Shin'ichiro Kawasaki <[email protected]>
nvmet-rdma: factor out response resource cleanup

Guixin Liu <[email protected]>
nvmet-rdma: use sbitmap to replace rsp free list

Hannes Reinecke <[email protected]>
nvmet-rdma: avoid circular locking dependency on install_queue()

Gui-Dong Han <[email protected]>
nvme-apple: Use acquire/release for queue enabled state

Myeonghun Pak <[email protected]>
crypto: keembay - Fix AEAD unregister count in error path

Pengpeng Hou <[email protected]>
crypto: rk3288 - fail ahash requests on HASH idle timeout

Pengpeng Hou <[email protected]>
crypto: sa2ul - stop probe if context pool creation fails

Lothar Rubusch <[email protected]>
crypto: atmel-sha204a - fix heap info leak on I2C transfer failure

Thorsten Blum <[email protected]>
crypto: atmel-ecc - reject hardware ECDH without a public key

Thorsten Blum <[email protected]>
crypto: atmel-ecc - clean up and improve ECDH comments

Thorsten Blum <[email protected]>
crypto: atmel-ecc - replace min_t with min

Giovanni Cabiddu <[email protected]>
crypto: qat - clear AES key schedule from stack

Sandipan Das <[email protected]>
perf/x86/amd/uncore: Add group validation

Sandipan Das <[email protected]>
perf/x86/amd/uncore: Refactor uncore management

Leo Yan <[email protected]>
perf cs-etm: Fix thread leaks on trace queue init failure

James Clark <[email protected]>
perf cs-etm: Queue context packets for frontend

James Clark <[email protected]>
perf cs-etm: Create decoders after both AUX and HW_ID search passes

Besar Wicaksono <[email protected]>
perf cs-etm: Fix incorrect or missing decoder for raw trace

Pengpeng Hou <[email protected]>
wifi: rtw89: fix HE extended capability length check

Tzung-Bi Shih <[email protected]>
platform/chrome: sensorhub: Fix memory overread in ring handler

Hisam Mehboob <[email protected]>
selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check

Hanlin Song <[email protected]>
csky: Fix a4/a5 restoration in syscall trace path

Sanjay Chitroda <[email protected]>
iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure

Srinivas Kandagatla <[email protected]>
soundwire: qcom: Fix port exhaustion check in stream_alloc_ports

Vladimir Zapolskiy <[email protected]>
dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe

Suraj Gupta <[email protected]>
dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers

Vladimir Zapolskiy <[email protected]>
dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure

Leon Hwang <[email protected]>
bpf: Copy per-CPU map value padding in copy_map_value_long()

Yichong Chen <[email protected]>
tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands

Yichong Chen <[email protected]>
tools/bpf/bpftool: Reset vmlinux BTF after map commands

Asad Kamal <[email protected]>
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

Asad Kamal <[email protected]>
drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup

Uday Khare <[email protected]>
regulator: tps6594: Fix device node reference leaks in multiphase loop

Michael Walle <[email protected]>
regulator: tps6594-regulator: refactor variant descriptions

Michael Walle <[email protected]>
regulator: tps6594-regulator: remove hardcoded buck config

Michael Walle <[email protected]>
regulator: tps6594-regulator: remove interrupt_count

Christophe JAILLET <[email protected]>
regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type

Thomas Richard <[email protected]>
regulator: tps6594-regulator: Fix the number of irqs for TPS65224 and TPS6594

Nirmala Devi Mal Nadar <[email protected]>
regulator: tps6594-regulator: Add TI TPS65224 PMIC regulators

Nirmala Devi Mal Nadar <[email protected]>
mfd: tps6594: Add register definitions for TI TPS65224 PMIC

Ian Rogers <[email protected]>
perf tests: Fix flakiness in BPF counters test on hybrid systems

Namhyung Kim <[email protected]>
perf test: Fix perf stat --bpf-counters on hybrid machines

Tengda Wu <[email protected]>
perf test: Use sqrtloop workload to test bperf event

Veronika Molnarova <[email protected]>
perf test stat_bpf_counter.sh: Stabilize the test results

Ian Rogers <[email protected]>
perf test bpf-counters: Add test for BPF event modifier

Thomas Richter <[email protected]>
perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test

Ian Rogers <[email protected]>
perf tests: Skip metrics validation if system-wide recording lacks permission

Namhyung Kim <[email protected]>
perf test: Do not skip when some metrics tests succeeded

Ian Rogers <[email protected]>
perf test all metrics: Fully ignore Default metric failures

Ian Rogers <[email protected]>
perf test metrics: Update all metrics for possibly failing default metrics

Ian Rogers <[email protected]>
perf tests metrics: Permission related fixes

Ian Rogers <[email protected]>
perf test stat_all_metrics: Ensure missing events fail test

Namhyung Kim <[email protected]>
perf test: Update all metrics test like metricgroups test

Weilin Wang <[email protected]>
perf test: Simplify metric value validation test final report

Sean Young <[email protected]>
media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define

Sean Young <[email protected]>
media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define

Daniel McCarthy <[email protected]>
pinctrl: bcm2835: Don't remove an unregistered GPIO chip

Zide Chen <[email protected]>
perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails

Chen, Yu C <[email protected]>
sched/fair: Fix overflow in update_tg_cfs_runnable()

Wei Yang <[email protected]>
mm/mm_init: fix incorrect node_spanned_pages

Henrik Grimler <[email protected]>
drm/lima: call drm_mm_init() with a valid allocation range

Brian Masney <[email protected]>
clk: imx: scu: drop redundant init.ops variable assignment

Weigang He <[email protected]>
ARM: imx: fix device_node refcount leaks in imx7_src_init()

Weigang He <[email protected]>
ARM: imx: fix device_node refcount leak in imx_src_init()

Min zhang <[email protected]>
clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller

Shengjiu Wang <[email protected]>
ASoC: fsl_audmix: rework runtime PM handling in probe

Runyu Xiao <[email protected]>
ASoC: rt700-sdw: always drain jack work on remove

Joey Lu <[email protected]>
clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic

Brian Masney <[email protected]>
clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate()

Joey Lu <[email protected]>
clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc

Joey Lu <[email protected]>
clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation

Alexander A. Klimov <[email protected]>
clk: moxart: remove unused variables, fix refcount leak

Myeonghun Pak <[email protected]>
clk: versaclock7: Fix APLL clock leak on probe failure

Gui-Dong Han <[email protected]>
media: cec-pin: Fix event FIFO ordering

Weigang He <[email protected]>
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()

Michael Bommarito <[email protected]>
HID: roccat: bound device-supplied profile index

Christos Maragkos <[email protected]>
HID: nintendo: Fix imu_timestamp_us double increment per report

Philipp Weber <[email protected]>
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

Maoyi Xie <[email protected]>
platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count

Jens Remus <[email protected]>
x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()

Konstantin Andreev <[email protected]>
smack: restrict smackfs/{direct,mapped} values to 0-255

Konstantin Andreev <[email protected]>
smack: deduplicate smackfs/{direct,mapped} file_operations

Dmitry Antipov <[email protected]>
smack: simplify write handlers of sysfs entries

Konstantin Andreev <[email protected]>
smack: fix incorrect task context in smack_msg_queue_msgrcv

Maxime Ripard <[email protected]>
drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure

Nicolas Frattaroli <[email protected]>
drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format

Paul Kocialkowski <[email protected]>
drm: lcdif: Wait for vblank before disabling DMA

Yicong Hui <[email protected]>
drm: Remove unused header in drm_dumb_buffers.c

SJ Park <[email protected]>
mm/damon/core: skip aging from repeated aggressive merging

Huang Wei <[email protected]>
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion

Martin Blumenstingl <[email protected]>
clk: meson: align gxbb_32k_clk_sel number of parents with actual count

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

Sven Eckelmann <[email protected]>
batman-adv: bla: avoid CRC corruption due to parallel claim add

Sven Eckelmann <[email protected]>
batman-adv: dat: atomically update mac addresses

Viacheslav Dubeyko <[email protected]>
ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size

Junyi Liu <[email protected]>
ksmbd: fix durable reconnect error path file lifetime

Akif <[email protected]>
ksmbd: fix use-after-free in smb2_open during durable reconnect

Jiayuan Chen <[email protected]>
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops

Xiang Mei <[email protected]>
bridge: mrp: reject zero test interval to avoid OOM panic

Brian Witte <[email protected]>
netfilter: nft_counter: serialize reset with spinlock

Paul Chaignon <[email protected]>
bpf: Reject narrower access to pointer ctx fields

Daniel Vogelbacher <[email protected]>
ceph: fix oops due to invalid pointer for kfree() in parse_longname()

Al Viro <[email protected]>
parse_longname(): strrchr() expects NUL-terminated string

Jonathan Currier <[email protected]>
net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads

Namjae Jeon <[email protected]>
ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"

Norbert Szetei <[email protected]>
ksmbd: fix overflow in dacloffset bounds check

Jiawen Wu <[email protected]>
net: libwx: fix Tx L4 checksum

Su Yue <[email protected]>
md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb

Manivannan Sadhasivam <[email protected]>
wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path

Jie Wang <[email protected]>
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices

Jian Shen <[email protected]>
net: hns3: don't auto enable misc vector

SJ Park <[email protected]>
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()

SJ Park <[email protected]>
mm/damon/core-kunit: handle region split failure in filter_out()

SJ Park <[email protected]>
mm/damon/vaddr-kunit: check region count in three_regions test

SJ Park <[email protected]>
mm/damon/paddr: drop last same folio access check reuse optimization

SJ Park <[email protected]>
mm/damon/vaddr: drop last same folio access check optimization

SJ Park <[email protected]>
mm/damon/core-kunit: check region count before testing in split_at()

Kazuki Hanai <[email protected]>
nvmet-auth: Synchronize timeout work during SQ teardown

Dragos Tatulea <[email protected]>
net/mlx5e: xsk: Fix unlocked writing to ICOSQ

Sechang Lim <[email protected]>
tcp: clear sock_ops cb flags before force-closing a child socket

Arthur Gautier <[email protected]>
xhci: fix lost bounce buffers on TDs spanning several ring segments

Zhenhao Wan <[email protected]>
drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE

Zhenhao Wan <[email protected]>
drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE

Faith Ekstrand <[email protected]>
drm/nouveau: Use write-combined maps for coherent

Sunday Clement <[email protected]>
drm/amdkfd: Reject zero-sized AQL queue allocations after size halving

Sunil Khatri <[email protected]>
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT

Guangshuo Li <[email protected]>
drm/amdgpu: fix autosuspend cleanup during removal

Yang Wang <[email protected]>
drm/amdgpu: check thunderbolt before switcheroo registration

Thadeu Lima de Souza Cascardo <[email protected]>
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

Kavan Smith <[email protected]>
drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value

Tao Yu <[email protected]>
drm/gud: validate TV mode names before creating enum property

Deepanshu Kartikey <[email protected]>
drm/gud: NUL-terminate TV mode names read from the device

David (Ming Qiang) Wu <[email protected]>
drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

Harry Wentland <[email protected]>
drm/amd/display: avoid divide-by-zero in __is_lut_linear()

Thomas Zimmermann <[email protected]>
drm/hibmc: Use drm_atomic_helper_check_plane_state()

Thomas Zimmermann <[email protected]>
drm/hibmc: Fix list of formats on the primary plane

Wentao Liang <[email protected]>
drm/sun4i: fix refcount leak in sun4i_backend_init_sat()

Deepanshu Kartikey <[email protected]>
drm/i915: Guard against NULL driver_data in i915_pci_probe()

Danilo Krummrich <[email protected]>
drm: fix race between partial drm_dev_register() failure and ioctl

Johan Hovold <[email protected]>
drm/panel-edp: fix i2c adapter leak on probe failure

Johan Hovold <[email protected]>
drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure

Chao Yu <[email protected]>
f2fs: fix to zero post-EOF data when extending file size

Chao Yu <[email protected]>
f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()

Zhan Xusheng <[email protected]>
f2fs: fix i_size when pinned fallocate partially fails

Wenjie Qi <[email protected]>
f2fs: return writeback error from collapse range

Zhan Xusheng <[email protected]>
f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()

Hao-Qun Huang <[email protected]>
f2fs: reject overlapping move range after len expansion

Wenjie Qi <[email protected]>
f2fs: return symlink writeback errors

Nilesh Javali <[email protected]>
scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started

Nilesh Javali <[email protected]>
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak

Nilesh Javali <[email protected]>
scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics

Nilesh Javali <[email protected]>
scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition

Nilesh Javali <[email protected]>
scsi: qla2xxx: Drop vport reference under lock in report ID acquisition

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort

Nilesh Javali <[email protected]>
scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

Nilesh Javali <[email protected]>
scsi: qla2xxx: Avoid double completion in async IOCB timeout

Nilesh Javali <[email protected]>
scsi: qla2xxx: Quiesce response IRQ before freeing request queue

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path

Nilesh Javali <[email protected]>
scsi: qla2xxx: Don't query firmware state while chip is down

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix FCE trace enable parsing in debugfs

Nilesh Javali <[email protected]>
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown

Nilesh Javali <[email protected]>
scsi: qla2xxx: Serialize flash version read in reset handler

Nilesh Javali <[email protected]>
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation

Nilesh Javali <[email protected]>
scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject

Nilesh Javali <[email protected]>
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Initialize NVMe abort_work once at submission

Nilesh Javali <[email protected]>
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters

Nilesh Javali <[email protected]>
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

Nilesh Javali <[email protected]>

    scsi: qla2xxx: Bound i2c->length in I2C bsg handlers

Nilesh Javali <[email protected]>
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers

Ruoyu Wang <[email protected]>
media: zoran: Avoid freeing a registered video_device twice

Arash Golgol <[email protected]>
media: vimc: fix pixel format lookup in enum_framesizes

Uday Khare <[email protected]>
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure

Mohammed EL Kadiri <[email protected]>
media: venus: fix payload size calculation in parse_raw_formats()

Mohammed EL Kadiri <[email protected]>
media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()

Biren Pandya <[email protected]>
media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link

Ming Qian <[email protected]>
media: v4l2-ctrls: Allow unknown HDR10 white point and luminance

Xu Rao <[email protected]>
media: v4l2-async: avoid deleting unlinked ASC entry on link error

Ilya Krutskih <[email protected]>
media: tda18250: fix possible integer overflow

Guangshuo Li <[email protected]>
media: saa7164: fix cleanup on resource allocation failure

Lei Huang <[email protected]>
media: s2255: check firmware size before reading trailing marker

HyeongJun An <[email protected]>
media: s2255: bound JPEG frame size before copying into the buffer

Valery Borovsky <[email protected]>
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure

Valery Borovsky <[email protected]>
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

Myeonghun Pak <[email protected]>
media: rc: sunxi-cir: Unregister rc device on probe failure

Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks

Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Correct color map between V4L2 and ISI

Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing

Christian Hewitt <[email protected]>
media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common

Biren Pandya <[email protected]>
media: i2c: ov7740: fix use-after-destroy in remove

Biren Pandya <[email protected]>
media: i2c: ov02a10: fix endpoint parsing use-after-free

Shuangpeng Bai <[email protected]>
media: go7007: defer the ALSA v4l2 put until card release

Jiangong.Han <[email protected]>

    media: em28xx: fix use-after-free of dev_next->devlist on disconnect

Diego Fernando Mancera Gomez <[email protected]>
media: em28xx: defer audio-only extension registration

Fan Wu <[email protected]>
media: cx23885: cancel NetUP CI work before teardown

Bryam Vargas <[email protected]>
media: cx231xx: reject geometry changes while the VBI queue is busy

Ruoyu Wang <[email protected]>
media: cobalt: Avoid freeing ALSA private data twice

Dawei Feng <[email protected]>
media: cedrus: fix memory leak in cedrus_init_ctrls()

Ruoyu Wang <[email protected]>
media: cec: Serialize exclusive follower delivery

Yi Ding <[email protected]>
media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash

Jonas Karlman <[email protected]>
media: cec: core: Fix kmemleak due to missed rc_free_device() call

Valery Borovsky <[email protected]>
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref

Jérémy Jean <[email protected]>
LoongArch: Avoid preempt count underflow without probe

Wentao Guan <[email protected]>
LoongArch: Do not save/restore percpu base register in rethook trampoline

Christian Borntraeger <[email protected]>
KVM: s390: Restore sigset on error path

Christian Borntraeger <[email protected]>
KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP

Christian Borntraeger <[email protected]>
KVM: s390: Zero initialize irq in reinject_machine_check

Christian Borntraeger <[email protected]>
KVM: s390: Take srcu when importing watchpoint data

Christian Borntraeger <[email protected]>
KVM: s390: Free guest debug data on vcpu destroy

Christian Borntraeger <[email protected]>
KVM: s390: Fix old_data leak in guest debug error path

Christian Borntraeger <[email protected]>
KVM: s390: Fix memory leak in guest debug handling

Christian Borntraeger <[email protected]>
KVM: s390: Fix length check __import_wp_info()

Carlos López <[email protected]>
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock

Yosry Ahmed <[email protected]>
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Yosry Ahmed <[email protected]>
KVM: nVMX: Always flush vpid02 on first use

Nikhil Gautam <[email protected]>
iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask

Nikhil Gautam <[email protected]>
iio: light: opt4001: Reject integration times with a non-zero seconds part

Nikhil Gautam <[email protected]>
iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()

Nikhil Gautam <[email protected]>
iio: light: opt4001: Fix power down clearing bits of the wrong register

Sanjay Chitroda <[email protected]>
iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()

Cong Nguyen <[email protected]>
iio: srf04: fix pm_runtime handling on probe error path

Can Peng <[email protected]>
iio: pressure: mpl115: Fix runtime PM cleanup

Rupesh Majhi <[email protected]>
iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

Laxman Acharya Padhya <[email protected]>
iio: light: gp2ap002: Disable regulators on resume failure

Giorgi Tchankvetadze <[email protected]>
iio: light: cm32181: return zero after writing calibscale

Cong Nguyen <[email protected]>
iio: gyro: mpu3050: fix sign of raw angular velocity readings

Erick Henrique <[email protected]>
iio: dac: m62332: Fix regulator reference count imbalance

Linmao Li <[email protected]>
iio: chemical: sgp30: Handle IAQ thread creation failure

Fan Wu <[email protected]>
iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF

Moksh Panicker <[email protected]>
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable

WenTao Liang <[email protected]>
ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get

Haoxiang Li <[email protected]>
AsoC: intel: sst: fix PCI device reference leak on probe failure

Haoxiang Li <[email protected]>
ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure

Runyu Xiao <[email protected]>
ASoC: cs35l34: drain threaded IRQ before runtime suspend

Runyu Xiao <[email protected]>
ASoC: cs35l33: drain threaded IRQ before runtime suspend

Linkai Gong <[email protected]>
i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src

Heiko Stuebner <[email protected]>
clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src

Stephan Gerhold <[email protected]>
clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk

Stephan Gerhold <[email protected]>
clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk

Sven Eckelmann <[email protected]>
batman-adv: bla: prevent CRC corruptions after claim flush

Sven Eckelmann <[email protected]>
batman-adv: bla: fix freeing of claims on meshif deletion

Sven Eckelmann <[email protected]>
batman-adv: dat: avoid unaligned fault in IP extraction

Zhiling Zou <[email protected]>
batman-adv: fix stale receive device on merged fragments

Pengpeng Hou <[email protected]>
mtd: rawnand: validate ONFI extended parameter page sections

Xu Rao <[email protected]>
mtd: mtdoops: free page bitmap when the backing MTD is removed

Pengpeng Hou <[email protected]>
mtd: afs: validate v2 image info bounds

Anthony Krowiak <[email protected]>
s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object

Anthony Krowiak <[email protected]>
s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap

Anthony Krowiak <[email protected]>
s390/vfio-ap: Fix NULL deref in status_show() during queue probe

Anthony Krowiak <[email protected]>
s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed

Anthony Krowiak <[email protected]>

    s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL

Anthony Krowiak <[email protected]>
s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove

Anthony Krowiak <[email protected]>
s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove

Anthony Krowiak <[email protected]>
s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()

Sourabh Jain <[email protected]>
powerpc/crash: stop watchdogs before booting kdump kernel

Sourabh Jain <[email protected]>
powerpc/pseries: Move H_WATCHDOG definitions to a common header

Sourabh Jain <[email protected]>
powerpc/pseries: Handle and log pseries-wdt registration failures

Muchun Song <[email protected]>
powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population

Helge Deller <[email protected]>
parisc: Fix alignment of asm statements in head.S

Pei Xiao <[email protected]>
parisc: eisa: Fix infinite loop when parsing invalid IRQ value

Bryam Vargas <[email protected]>
nvdimm/btt: reject an arena whose nfree is below the lane count

Wupeng Ma <[email protected]>
mm/hugetlb: fix missing migratable flag on same-node hugetlb migration

caina <[email protected]>
Revert "irqchip/mbigen: Fix mbigen node address layout"

Shivam Kumar <[email protected]>
nvmet-tcp: reject unsolicited H2CData PDUs

Shivam Kumar <[email protected]>
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

Yehyeong Lee <[email protected]>
nvme-tcp: check the data direction of a C2HData PDU

Takashi Iwai <[email protected]>
ALSA: pcm: Fix race between non-atomic ops and trigger-start

Runyu Xiao <[email protected]>
ALSA: harmony: initialize locks before requesting IRQ

Karl Mehltretter <[email protected]>
arm64: mm: Fix the lockless page-table walk in show_pte()

Ahmad Byagowi <[email protected]>
i2c: mux: Fix channel node leak on adapter add failure

Vasileios Almpanis <[email protected]>
i2c: core: fix debugfs UAF on adapter removal

Sizhe Liu <[email protected]>
perf hisi-ptt: Fix PTT trace TLP header parsing

Dapeng Mi <[email protected]>
perf/x86/intel: Fix kernel address leakages in LBR stack

Lad Prabhakar <[email protected]>
rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers

Lad Prabhakar <[email protected]>
rtc: rzn1: Fix weekday underflow when alarm crosses month boundary

Pengpeng Hou <[email protected]>
Input: aiptek - validate raw macro indices before updating state

Masami Hiramatsu (Google) <[email protected]>
kprobes: Protect kprobe_blacklist with RCU

Bradley Morgan <[email protected]>
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()

Hajo Noerenberg <[email protected]>
ata: ahci: work around lost interrupts on Marvell 88SE61xx

Damien Le Moal <[email protected]>
block: flag zoned disks with GENHD_FL_NO_PART

Linkai Gong <[email protected]>
cpuidle: dt_idle_genpd: kfree() the original name allocation

Koichiro Den <[email protected]>
dmaengine: dw-edma: Initialize IRQ data before requesting IRQs

Koichiro Den <[email protected]>
dmaengine: dw-edma: Complete descriptors before pausing

Koichiro Den <[email protected]>
dmaengine: dw-edma: Fix HDMA channel status register access

Mikulas Patocka <[email protected]>
dm: fix resume-vs-remove race

Mikulas Patocka <[email protected]>
dm: fix race when loading and unloading a table

Ibrahim Hashimov <[email protected]>
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq

Wei Jie Law <[email protected]>
HID: rmi: fix OOB access with undersized RMI reports

Yao Kai <[email protected]>
futex: Prevent rcuwait use-after-free during requeue PI

SJ Park <[email protected]>
mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs

SJ Park <[email protected]>
mm/damon/sysfs: kobject_del() region and target (error) dirs

SJ Park <[email protected]>
mm/damon/sysfs-schemes: kobject_del() scheme region dirs

SJ Park <[email protected]>
mm/damon/sysfs-schemes: kobject_del() scheme filter dirs

SJ Park <[email protected]>
mm/damon/sysfs-schemes: kobject_del() scheme dirs

Runyu Xiao <[email protected]>
scsi: pm8001: Use rollback index when freeing MSI-X vectors

Sujal Tuladhar <[email protected]>
scsi: target: iscsi: Reserve a terminator byte for the login payload

Can Peng <[email protected]>
spi: bcmbca-hsspi: disable clocks on resume failure

Can Peng <[email protected]>
spi: bcm63xx: disable clock on resume failure

Can Peng <[email protected]>
spi: bcm63xx-hsspi: disable clocks on resume failure

Kanishka De Silva <[email protected]>
ublk: clear VM_MAYWRITE on read-only ublk char device mmap

Can Peng <[email protected]>
thermal/drivers/qoriq: Disable clock on resume failure

Can Peng <[email protected]>
thermal/drivers/imx: Disable clock on runtime resume failure

Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()

Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()

Jeffin Philip <[email protected]>
usb: gadget: fix null pointer dereference in usb_put_function_instance()

Lovekesh Solanki <[email protected]>
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

Ivy Lopez <[email protected]>
usb: gadget: f_midi2: fix use-after-free in string attribute show path

Aleksandr Nogikh <[email protected]>
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs

Jameson Thies <[email protected]>
usb: typec: ucsi: displayport: Fix OOB altmode array index

Fan Wu <[email protected]>
usb: typec: qcom-pmic: cancel reset_work on stop

Andy Shevchenko <[email protected]>
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()

Liu Qi <[email protected]>
usb-storage: ene_ub6250: fix race between scan work and probe

Shuangpeng Bai <[email protected]>
media: usbtv: keep device alive while ALSA card exists

Stephan Gerhold <[email protected]>
clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset

HyeongJun An <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()

Griffin Kroah-Hartman <[email protected]>
usb: image: mdc800: change kmalloc() to kzalloc()

Hari Mishal <[email protected]>
drm/amd/display: fix division by zero in get_estimated_bw()

Petr Vaganov <[email protected]>
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()

Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions

Steven Rostedt <[email protected]>
tracing/mmiotrace: Remove reference to unused per CPU data pointer

Koichiro Den <[email protected]>
net: ntb_netdev: Fix TX busy and drop handling

Jinjie Ruan <[email protected]>
entry: Fix seccomp bypass after ptrace with TSYNC

Eric Dumazet <[email protected]>
tcp: fix potential race in tcp_v6_syn_recv_sock()

Youngjae Kwon <[email protected]>
fsnotify: Fix stale object mask after concurrent mark updates

Laxman Acharya Padhya <[email protected]>
wifi: mt76: mt7996: validate default EEPROM firmware size

Günther Noack <[email protected]>
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation

Yuqi Xu <[email protected]>
openvswitch: Fix CT limit teardown use-after-free

Ilya Maximets <[email protected]>
net: openvswitch: fix kernel-doc warnings in internal headers

Norbert Szetei <[email protected]>
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

Tzung-Bi Shih <[email protected]>
platform/chrome: sensorhub: Fix dropped timestamp events and log spam

Zhan Xusheng <[email protected]>
udf: Fix i_lenExtents truncation on 32-bit kernels

Thomas Gleixner <[email protected]>
timer: Keep debugobjects state consistent in migrate_timer_list()

Bradley Morgan <[email protected]>
taskstats: fix cpumask parsing cutting off the last character

Jann Horn <[email protected]>
smack: fix cred UAF in smack_file_send_sigiotask()

Bradley Morgan <[email protected]>
signal: avoid shared siginfo namespace rewrites

Helge Deller <[email protected]>
sticon/parisc: Detect default STI graphics card for console output

Myeonghun Pak <[email protected]>
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

Zi Yan <[email protected]>
xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()

Maoyi Xie <[email protected]>
w1: ds28e17: reject an oversize length on an I2C block read

Chengfeng Ye <[email protected]>
vsock/virtio: flush works in dependency order

Runyu Xiao <[email protected]>
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex

Abdun Nihaal <[email protected]>
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()

Stanislaw Gruszka <[email protected]>
wifi: rtl818x: initialize eeprom_93cx6 struct to zero

Fabio Estevam <[email protected]>
wifi: mwifiex: Detach sync cmd buffer on interrupted wait

Abdun Nihaal <[email protected]>
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()

Maoyi Xie <[email protected]>
i3c: master: svc: bound IBI payload to the requested max_payload_len

Adrian Hunter <[email protected]>
i3c: master: Fix info leak and UAF in device unregister path

Haotian Zhang <[email protected]>
dm-switch: use WRITE_ONCE() in switch_region_table_write()

Mikulas Patocka <[email protected]>
dm-stats: fix a crash if allocation of per-cpu data fails

Nathan Chancellor <[email protected]>
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()

Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix zero-extension for 32-bit port I/O

Naman Jain <[email protected]>
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip

Karl Mehltretter <[email protected]>
cgroup/cpuset: Fix misplaced DL migration reset

Takashi Iwai <[email protected]>
ALSA: virmidi: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: serial-u16550: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: portman2x4: Check card index validity at probe

Runyu Xiao <[email protected]>
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ

Takashi Iwai <[email protected]>
ALSA: mts64: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: mpu401: Check card index validity at probe

Baul Lee <[email protected]>
ALSA: bcd2000: clear the URB pointers on disconnect

Takashi Iwai <[email protected]>
ALSA: aloop: Check card index validity at probe

Baul Lee <[email protected]>
ALSA: 6fire: bound the MIDI event length from the device

Zhiling Zou <[email protected]>
seg6: reset IP6CB after IPv6 decapsulation

Norbert Szetei <[email protected]>
net: skbuff: don't touch shared zerocopy state in skb_tx_error()

Breno Leitao <[email protected]>
net: fix spurious TX timeout after dev_activate()

Zhiling Zou <[email protected]>
net: cap advertised IP tunnel headroom

Bryam Vargas <[email protected]>
net/smc: unregister the connection before draining the rx tasklet

Hidayath Khan <[email protected]>
net/smc: fix use-after-free in smc_rx_pipe_buf_release()

Hidayath Khan <[email protected]>
net/smc: fix socket refcount leak in smc_switch_conns()

Bryam Vargas <[email protected]>
net/smc: do not dereference an unset send buffer on the SMC-D teardown path

Koichiro Den <[email protected]>
net: ntb_netdev: Count packets dropped on RX refill failure

Koichiro Den <[email protected]>
net: ntb_netdev: Avoid double-accounting netif_rx() drops

Koichiro Den <[email protected]>
NTB: ntb_transport: Reject oversized TX buffers

Koichiro Den <[email protected]>
NTB: ntb_transport: Fail TX enqueue when the QP link is down

Koichiro Den <[email protected]>
NTB: ntb_transport: Recycle TX entries before client callbacks

Fan Ye <[email protected]>
net: thunderbolt: Mark the connection down when bringing it up fails

Fan Ye <[email protected]>
net: thunderbolt: Release the Rx HopID that was handed out on mismatch

Xuanqiang Luo <[email protected]>
net: ravb: avoid dereferencing an invalid PTP clock

Ruoyu Wang <[email protected]>
net: openvswitch: fix nf_connlabels leak in ovs_ct_init

Ilya Maximets <[email protected]>
net: openvswitch: fix flow mask use-after-free on flow deletion

Asim Viladi Oglu Manizada <[email protected]>
net: tun: bound receive headroom

Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition

Aleksandr Khromov <[email protected]>
slip: fix use-after-free in sl_sync()

Weiming Shi <[email protected]>
xdp: fix zero-copy frame layout

Alexandra Winter <[email protected]>
net/iucv: filter frames in afiucv_hs_rcv() by ingress device

Seiji Nishikawa <[email protected]>
ipmi: si: Fix NULL pointer dereference after failed registration

Yousef Alhouseen <[email protected]>
ipmi: ipmb: validate write message length

Kuan-Wei Chiu <[email protected]>
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: warn on element type mismatch instead of failing

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: pass validated element count to package parsers

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read on empty password write

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: bound ordered-list parsing by the package count

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: advance elem past consumed array elements

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS

Bryam Vargas <[email protected]>
platform/chrome: sensorhub: Bound the EC-reported sensor number

Ma Ke <[email protected]>
platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate logical CPU id and clos id

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Just allow 2 bits for SST feature enable

Fan Wu <[email protected]>
mmc: via-sdmmc: stop card-detect handling on probe failure

HyeongJun An <[email protected]>
platform/x86: ISST: Validate socket ID in clos_assoc ioctl

HyeongJun An <[email protected]>
platform/x86: ISST: Validate level in perf mask ioctls

HyeongJun An <[email protected]>
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

Kevin Tian <[email protected]>
iommu/vt-d: Force requesting ACS when tboot is enabled

Kevin Tian <[email protected]>
iommu/vt-d: Fix no_iommu to disable platform opt-in

Krzysztof Wilczyński <[email protected]>
PCI/proc: Warn on writes to kernel-exclusive config space regions

Krzysztof Wilczyński <[email protected]>
PCI/proc: Use file_ns_capable() when checking config space read access

Krzysztof Wilczyński <[email protected]>
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses

Farhan Ali <[email protected]>
PCI/MSI: Enable memory decoding before restoring MSI-X messages

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses

Tim Harvey <[email protected]>

    PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]

Ronald Claveau <[email protected]>
PCI: meson: Fix GPIO state while requesting PERST#

Mohamad Raizudeen <[email protected]>
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk

Stefan Haberland <[email protected]>
s390/dasd: Propagate partial completion length across ERP recovery

Stefan Haberland <[email protected]>
s390/dasd: Guard sysfs discipline callbacks against unallocated private data

Stefan Haberland <[email protected]>
s390/dasd: Do not complete a failed ESE read as successful

Thomas Richter <[email protected]>
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks

Jianing Li <[email protected]>
power: supply: max17040: synchronize work cancellation on suspend

Jianing Li <[email protected]>
power: supply: max17040: drop incorrect I2C functionality check

Fan Wu <[email protected]>
power: supply: ucs1002: fix use-after-free on remove

Maoyi Xie <[email protected]>
power: supply: twl4030_charger: cancel workers via devm

Fan Wu <[email protected]>
power: supply: rt9455: quiesce delayed work before teardown

HyeongJun An <[email protected]>
power: supply: qcom_battmgr: terminate the strings from firmware

Fan Wu <[email protected]>

    power: supply: lp8727: fix use-after-free in lp8727_release_irq()

Jameson Thies <[email protected]>
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

Bryam Vargas <[email protected]>
power: supply: cros_usbpd-charger: bound the EC-reported port count

Ma Ke <[email protected]>
power: supply: bq25890: Fix power_supply reference leak

Fan Wu <[email protected]>
power: supply: bq256xx: drain usb_work before freeing the charger

Fan Wu <[email protected]>
power: supply: bq24257: fix use-after-free on remove

Jun Yang <[email protected]>

    sctp: fix stream->outcnt underflow on duplicate RECONF responses

Jun Yang <[email protected]>
sctp: distinguish sequence zero from wildcard in reconf lookup

Weiming Shi <[email protected]>
sctp: fix NULL deref on untransmitted RECONF completion

Hyunwoo Kim <[email protected]>
sctp: drop a chunk if its transport was removed

Hyunwoo Kim <[email protected]>
sctp: stop processing a packet once its association is deleted

Yehyeong Lee <[email protected]>
nvme-tcp: reject a read that transferred too few bytes

Yehyeong Lee <[email protected]>
nvme-tcp: fix host memory disclosure on R2T for a read command

Yehyeong Lee <[email protected]>
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

Myeonghun Pak <[email protected]>
nvme-pci: disable controller on admin queue IRQ setup failure

Yehyeong Lee <[email protected]>
nvme: zero the discard fallback page

Ewan D. Milne <[email protected]>
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path

Michael Bommarito <[email protected]>
lockd: pin next file across nlm_inspect_file lock-drop

Cong Nguyen <[email protected]>
hwmon: (max6621) fix temperature clamp range

Cong Nguyen <[email protected]>
hwmon: (max6621) fix negative temperature offset and crit readings

Christopher Tolang <[email protected]>
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC

Karl Mehltretter <[email protected]>
arm64: compat: Fix decrementing LDM/STM alignment emulation

HyeongJun An <[email protected]>
ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion

Norbert Szetei <[email protected]>
openvswitch: only skb_tx_error() a packet we are about to drop

Ali Ahmet Memis <[email protected]>
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall

Zhan Xusheng <[email protected]>
ocfs2: fix readdir position truncation on 32-bit kernels

Joseph Qi <[email protected]>
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure

Joseph Qi <[email protected]>
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item

Joseph Qi <[email protected]>
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

Ibrahim Hashimov <[email protected]>
ocfs2: validate rl_used against rl_count in refcount block validator

Bryam Vargas <[email protected]>
ocfs2: validate lengths in dlm_mig_lockres_handler

Bryam Vargas <[email protected]>
ocfs2: bound namelen in dlm_migrate_request_handler

Dmitry Antipov <[email protected]>
ocfs2: always run deallocs on copy-on-write completion

Zhiling Zou <[email protected]>
orangefs: skip leading spaces before parsing client debug masks

Yifei Gao <[email protected]>
orangefs: fix double-free of trailer_buf on readdir copy failure

Kathiravan Thirumoorthy <[email protected]>
regulator: qcom-refgen: correct the regulator type to CURRENT

WenTao Liang <[email protected]>
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata

WenTao Liang <[email protected]>
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer

Norbert Szetei <[email protected]>
RDMA/ucma: Lock the handler in ucma_set_ib_path()

Fan Wu <[email protected]>
RDMA/cxgb4: Cancel reg_work before freeing device on remove

Vaibhav Nagare <[email protected]>
qede: Fix NULL pointer dereference in TPA fragment processing

Johan Hovold <[email protected]>
remoteproc: scp: Fix device reference leak on failed lookup

Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio

Quentin Schulz <[email protected]>
arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck

Chunkai Deng <[email protected]>
rpmsg: glink: smem: order FIFO read after availability check

Hao-Qun Huang <[email protected]>
staging: media: tegra-video: vi: fix probe failure on skipped last port

Hao-Qun Huang <[email protected]>
staging: media: tegra-video: fix of_node_put() on VIP parse errors

Doruk Tan Ozturk <[email protected]>
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

David Lee <[email protected]>
udf: reject VAT indexes equal to the entry count

Chris Mason <[email protected]>
svcrdma: Fix pcl_for_each_segment for empty chunks

Chris Mason <[email protected]>
svcrdma: Fix offset arithmetic in read_chunk_range

Jérémy Jean <[email protected]>
SUNRPC: wait for in-flight client TLS handshake callback

Chuck Lever <[email protected]>
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field

Chris Mason <[email protected]>
sunrpc: init gssp_lock before publishing proc entry

Chris Mason <[email protected]>
SUNRPC: harden gss_unwrap_resp_priv length checks

Chris Mason <[email protected]>
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens

Chris Mason <[email protected]>
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat

Chuck Lever <[email protected]>
SUNRPC: Check svc pool percpu counter allocation

Jeff Layton <[email protected]>
SUNRPC: always drain cache_cleaner before destroying a cache_detail

Jeff Layton <[email protected]>
sunrpc: route to a populated pool in svc_pool_for_cpu()

Chris Mason <[email protected]>
SUNRPC: svcauth_gss: enforce krb5 token minimum length

Chris Mason <[email protected]>
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

Chris Mason <[email protected]>

    SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

Dave Airlie <[email protected]>
nouveau/gem: reserve the bo in the info ioctl around the vma lookup

Harshit Varu <[email protected]>
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

Qing Ming <[email protected]>
mpls: reload header after pskb_may_pull()

Coly Li <[email protected]>

    md: do overflow check for sb->bblog_shift in super_1_load()

Anup Vishwakarma <[email protected]>
mailbox: qcom-ipcc: fix duplicate channel allocation across holes

Bryam Vargas <[email protected]>
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()

Yuyang Huang <[email protected]>
ipv6: use RCU iterator to dump route exceptions

Zhiling Zou <[email protected]>
ip6_gre: fix hardware header length for NBMA tunnels

Zhiling Zou <[email protected]>
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

Anton Danilov <[email protected]>
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails

Hui Su <[email protected]>
kasan: fix cache shrink race with CPU hotplug

Ibrahim Abdelkader <[email protected]>
Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request

Guangshuo Li <[email protected]>
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative

Guangshuo Li <[email protected]>
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative

Valentin Kindschi <[email protected]>
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection

Xin Chen <[email protected]>
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb

Valentin Kindschi <[email protected]>
Bluetooth: hci_conn: re-enable advertising only for peripheral role

Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: serialize security confirmation handling

Hang Nan <[email protected]>
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

Gongwei Li <[email protected]>
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()

Guangshuo Li <[email protected]>
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative

Alison Schofield <[email protected]>
cxl/pmem: Format the nvdimm serial number as unsigned decimal

Hui Su <[email protected]>
cpufreq: schedutil: Fix rate limit overflow

Bryam Vargas <[email protected]>
dm array: reject an array block whose value size is not the caller's

Ilya Krutskih <[email protected]>
dm raid1: reserve space for NUL-terminator in build_constructor_string()

liyouhong <[email protected]>
dm-era: fix shadowed superblock leak on take-snap failure

Jérémy Jean <[email protected]>
bpf: Harden bloom filter sizing and indexing on 32-bit kernels

Jiangshan Yi <[email protected]>
bnx2x: fix double free in bnx2x_init_firmware() error path

HyeongJun An <[email protected]>
Bluetooth: eir: Fix OOB read in eir_get_service_data()

Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU

Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU

胡连勤 <[email protected]>
block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()

Hongyan Xu <[email protected]>
auxdisplay: charlcd: cancel backlight work on registration failure

Niklas Cassel <[email protected]>
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes

Ethan Nelson-Moore <[email protected]>
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC

Matt Turner <[email protected]>
alpha: marvel: Fix lock ordering in init_io7_irqs()

Matt Turner <[email protected]>
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()

Anirudh Prasad <[email protected]>
ACPI: pfr_update: fix stack buffer overflow in query_capability()

Ivaylo Dimitrov <[email protected]>
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device

Tien Sung Ang <[email protected]>
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration

Marek Czernohous <[email protected]>
forcedeth: fix off-by-one when saving/restoring non-PCI config space

Myeonghun Pak <[email protected]>
fbdev: uvesafb: unregister connector callback on init failure

Hui Su <[email protected]>
fbdev: ssd1307fb: defer I2C transfers from damage callbacks

Florian Fuchs <[email protected]>
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer

Runyu Xiao <[email protected]>
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

Yemu Lu <[email protected]>
fat: restore original value when fat_ent_write failed

Ard Biesheuvel <[email protected]>
efivarfs: Rate limit statfs() handler

Yichong Chen <[email protected]>
ecryptfs: show filename encryption options

Yichong Chen <[email protected]>
ecryptfs: release message context on send failure

Yichong Chen <[email protected]>
ecryptfs: reject too-small tag 70 packets

HanQuan <[email protected]>
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet

Yichong Chen <[email protected]>
ecryptfs: pass packet set buffer size to parser

Yichong Chen <[email protected]>
ecryptfs: hold msg ctx list lock when cleaning daemon queue

Yichong Chen <[email protected]>
ecryptfs: fix tag 11 packet exact-fit size check

Pengpeng Hou <[email protected]>
eCryptfs: bound the packet-length peek to the user buffer

Konstantin Komarov <[email protected]>

    fs/ntfs3: bound page_lcns[] index by the log record

Samuel Page <[email protected]>
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

Xiang Mei <[email protected]>
fs/ntfs3: validate dirty page table on log replay

Deepanshu Kartikey <[email protected]>

    eventfs: Initialize ei->children and ei->list in init_ei()

Jiangshan Yi <[email protected]>
HID: mcp2221: validate report size in mcp2221_raw_event()

Jiangshan Yi <[email protected]>
HID: mcp2221: stop device IO before hid_hw_stop

Haoxiang Li <[email protected]>
HID: sensor: custom: Fix field sysfs group cleanup on failure

Xu Rao <[email protected]>
HID: roccat: free buffered reports when destroying device

Ibrahim Hashimov <[email protected]>
HID: picolcd: clamp eeprom debugfs read to bytes actually received

Fredric Cover <[email protected]>
smb: client: harden DFS cache against invalid target hints

Frank Sorenson <[email protected]>
smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV

Frank Sorenson <[email protected]>
smb: client: fix ALIGN() overflow in symlink_data() error context loop

Fredric Cover <[email protected]>

    smb: client: clear ce->tgthint in free_tgts()

Frank Sorenson <[email protected]>

    cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0

Jérémy Jean <[email protected]>
audit: avoid dropping live tree ref on fsnotify rule autoremove

Michael Bommarito <[email protected]>
ceph: bound xattr value length in __build_xattrs()

Michael Bommarito <[email protected]>
ceph: bound num_export_targets array for mds info v2/v3

Michael Bommarito <[email protected]>
ceph: bound copied dentry name length in NFS export get_name

Jérémy Jean <[email protected]>
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode

Xiubo Li <[email protected]>
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock

Jérémy Jean <[email protected]>
libceph: reject buckets with mismatched CRUSH ids

Michael Bommarito <[email protected]>
libceph: validate OSD extent maps before cursor advance

Chuck Lever <[email protected]>
NFSD: Prevent lock owner use-after-free during client teardown

Jeff Layton <[email protected]>
nfsd: revoke copy-notify stateids before dropping their reference

Jeff Layton <[email protected]>
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE

Robbie Ko <[email protected]>
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

Jeff Layton <[email protected]>
nfsd: initialize copy-notify stateid before publishing it

Chris Mason <[email protected]>

    nfsd: gate nfs3 setacl by argp->mask

Chuck Lever <[email protected]>

    nfsd: gate nfs2 setacl by argp->mask

Jeff Layton <[email protected]>
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

Jeff Layton <[email protected]>
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

Jeff Layton <[email protected]>
nfsd: fix version mismatch loops in nfsd_acl_init_request()

Chris Mason <[email protected]>
nfsd: fix cpntf publish race in nfs4_init_cp_state

Jeff Layton <[email protected]>
nfsd: check client ownership when cancelling a copy-notify stateid

Jeff Layton <[email protected]>
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

Jeff Layton <[email protected]>
nfsd: add filehandle match check to nfsd4_delegreturn()

Jeff Layton <[email protected]>
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

Jeff Layton <[email protected]>
nfsd: validate symlink target length in NFSv4 CREATE

Chuck Lever <[email protected]>
nfsd: sample writeback error cursor before async COPY loop

Jeff Layton <[email protected]>
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types

Chuck Lever <[email protected]>
nfsd: Reset write verifier when async COPY writeback fails

Chris Mason <[email protected]>
nfsd: release path refs on follow_down() error

Junrui Luo <[email protected]>
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path

Mike Snitzer <[email protected]>
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

Michael Bommarito <[email protected]>
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

Chuck Lever <[email protected]>
NFSD: Fix off-by-one in DRC bucket pruning limit

Chuck Lever <[email protected]>
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies

Ibrahim Hashimov <[email protected]>
ubifs: fix out-of-bounds read in signature length check

Abdurrahman Hussain <[email protected]>
of: fix out-of-bounds read in of_alias_scan() stem parser

Ryusuke Konishi <[email protected]>
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

Junrui Luo <[email protected]>
media: vicodec: fix out-of-bounds write in FWHT encoder

Weigang He <[email protected]>
media: cec: stm32: prevent out-of-bounds write on RX overflow

Vincent Mailhol <[email protected]>
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

Xingrui Li <[email protected]>
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature

Daisuke Matsuda <[email protected]>
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write

Neill Kapron <[email protected]>
usb: gadget: f_fs: Prevent deadlock during ep0 read loop

Jeffin Philip <[email protected]>
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

Yun Zhou <[email protected]>
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()

Joshua Crofts <[email protected]>
usb: gadget: midi2: remove default configfs groups on teardown

Myeonghun Pak <[email protected]>
usb: gadget: snps_udc_plat: clean up PHY on probe deferral

Sonali Pradhan <[email protected]>
usb: gadget: u_audio: Fix use-after-free on sound card disconnect

Johan Hovold <[email protected]>
USB: phy: fsl-usb: fix missing static keywords

Francesco Lavra <[email protected]>
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up

Hao-Qun Huang <[email protected]>
staging: greybus: hid: fix SET_REPORT return value

Hans Verkuil <[email protected]>
Revert "media: v4l2-dev: fix error handling in __video_register_device()"

James Kim <[email protected]>
rapidio: mport_cdev: fix use-after-free in dma_req_free()

Bartosz Golaszewski <[email protected]>
powerpc/powermac: fix OF node refcount

Xu Yang <[email protected]>
device property: fix infinite loop in fwnode_for_each_child_node()

Hui Su <[email protected]>
tracing: Fix use-after-free with same-name named triggers

Hui Su <[email protected]>
tracing: Fix crash passing ERR_PTR to kthread_stop()

Jérémy Jean <[email protected]>
tracing/user_events: Clear copied tracing state before fork duplication

Sanman Pradhan <[email protected]>
hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()

Kiryl Shutsemau (Meta) <[email protected]>
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()

Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix off-by-one in port I/O handling

Joy H.J. Lee <[email protected]>
tools/compiler: match glibc 2.42 definition of __attribute_const__

Guopeng Zhang <[email protected]>
mm: memcg: stop reclaim when a limit update is superseded

Breno Leitao <[email protected]>
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()

Breno Leitao <[email protected]>
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

Jordan R Abrahams-Whitehead <[email protected]>
include/linux/list.h: mark list_add and __list_add as __always_inline

Jérémy Jean <[email protected]>
timers/itimer: Zero-init old itimerval before copy to userspace

Gaurav Batra <[email protected]>
powerpc/pseries/iommu: switch to Default DMA window during kdump

Felix Yan <[email protected]>
clocksource/drivers/timer-sun4i: Advertise a real minimum delta

Matt Turner <[email protected]>
alpha: don't leak hardware-fabricated FP exception bits to user space

Matt Turner <[email protected]>
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally

Zide Chen <[email protected]>
perf/x86/intel/uncore: Fix die ID init and look up bugs

Cássio Gabriel <[email protected]>
ALSA: aloop: Fix peer runtime UAF during format-change stop

Takashi Iwai <[email protected]>
ALSA: aloop: Fix racy access at PCM trigger

Eric Dumazet <[email protected]>
ipv4: start using dst_dev_rcu()

Eric Dumazet <[email protected]>

    net: dst: introduce dst->dev_rcu

Eric Dumazet <[email protected]>
ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]

Eric Dumazet <[email protected]>

    net: dst: add four helpers to annotate data-races around dst->dev

Karl Mehltretter <[email protected]>
Revert "arm64: mm: Don't remap pgtables for allocate vs populate"

-------------

Diffstat:

 .../ABI/testing/configfs-usb-gadget-uac1_legacy    |   3 -
 Documentation/ABI/testing/sysfs-bus-nvdimm         |   3 +-
 Documentation/hwmon/emc1403.rst                    |  25 +-
 Documentation/trace/hisi-ptt.rst                   |  28 +-
 Documentation/usb/gadget-testing.rst               |   3 -
 .../media/v4l/ext-ctrls-colorimetry.rst            |  12 +-
 Makefile                                           |   4 +-
 arch/alpha/include/uapi/asm/fpu.h                  |   8 +-
 arch/alpha/kernel/pci-sysfs.c                      |   6 +-
 arch/alpha/kernel/sys_marvel.c                     |  25 +-
 arch/alpha/kernel/traps.c                          |   6 +-
 arch/alpha/math-emu/math.c                         |  88 ++-
 arch/arm/Kconfig                                   |   2 +-
 arch/arm/boot/dts/allwinner/sun4i-a10.dtsi         |   2 +-
 arch/arm/boot/dts/marvell/armada-388-helios4.dts   |  13 +
 arch/arm/mach-imx/src.c                            |   3 +
 arch/arm/mach-lpc32xx/common.c                     |   5 +-
 arch/arm/mach-lpc32xx/common.h                     |   2 +
 arch/arm/mach-lpc32xx/phy3250.c                    |   2 +
 arch/arm/mach-lpc32xx/pm.c                         |   5 +-
 arch/arm/mm/fault.c                                |  16 +-
 .../boot/dts/allwinner/sun50i-a64-pinephone.dtsi   |   4 +-
 arch/arm64/boot/dts/amlogic/meson-axg-s400.dts     |   4 +
 .../boot/dts/marvell/armada-3720-turris-mox.dts    |   3 +-
 arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts |   2 +-
 .../boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi |   4 -
 arch/arm64/boot/dts/qcom/msm8998-xiaomi-sagit.dts  |   5 -
 arch/arm64/boot/dts/qcom/msm8998.dtsi              |  24 +-
 .../arm64/boot/dts/qcom/sc8180x-lenovo-flex-5g.dts |  61 +-
 arch/arm64/boot/dts/qcom/sc8180x-pmics.dtsi        |   2 +-
 arch/arm64/boot/dts/qcom/sc8180x-primus.dts        |  12 +-
 arch/arm64/boot/dts/qcom/sc8180x.dtsi              |  20 +-
 arch/arm64/boot/dts/qcom/sc8280xp-crd.dts          |   4 +-
 arch/arm64/boot/dts/qcom/sdm632-motorola-ocean.dts |   2 +-
 arch/arm64/boot/dts/qcom/sdm845.dtsi               |  64 +-
 arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts  |   6 +-
 arch/arm64/boot/dts/qcom/sm8150.dtsi               |   8 +-
 .../boot/dts/qcom/sm8250-xiaomi-elish-common.dtsi  |   2 +-
 arch/arm64/boot/dts/qcom/sm8250.dtsi               |  48 +-
 arch/arm64/boot/dts/qcom/sm8350.dtsi               |   8 +-
 arch/arm64/boot/dts/qcom/sm8450.dtsi               |   8 +-
 arch/arm64/boot/dts/qcom/sm8550.dtsi               |  12 +-
 arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi    |   2 +-
 .../boot/dts/rockchip/rk3399-gru-chromebook.dtsi   |   3 +-
 .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts |  12 +
 arch/arm64/boot/dts/ti/k3-am64-main.dtsi           |   2 +-
 arch/arm64/kernel/compat_alignment.c               |   4 +-
 arch/arm64/kernel/hibernate.c                      |  16 +-
 arch/arm64/lib/Makefile                            |   4 +
 arch/arm64/mm/fault.c                              |  12 +-
 arch/arm64/mm/mmu.c                                |  58 +-
 arch/csky/kernel/entry.S                           |   6 +-
 arch/loongarch/kernel/kprobes.c                    |   3 +
 arch/loongarch/kernel/rethook_trampoline.S         |   2 -
 arch/m68k/emu/nfcon.c                              |   2 +-
 arch/m68k/kernel/traps.c                           |   4 +-
 arch/mips/kernel/ptrace.c                          |   6 +-
 arch/openrisc/kernel/entry.S                       |  43 +-
 arch/parisc/kernel/head.S                          |   1 +
 arch/powerpc/configs/85xx-hw.config                |   1 +
 arch/powerpc/include/asm/papr-watchdog.h           |  64 ++
 arch/powerpc/kernel/irq.c                          |  16 +-
 arch/powerpc/kernel/smp.c                          |   3 +
 arch/powerpc/mm/book3s64/radix_pgtable.c           |   7 +-
 arch/powerpc/platforms/powermac/low_i2c.c          |   2 +-
 arch/powerpc/platforms/pseries/iommu.c             |  23 +-
 arch/powerpc/platforms/pseries/setup.c             |  28 +-
 arch/riscv/kernel/cpufeature.c                     |   3 +-
 arch/s390/kernel/debug.c                           |  10 +-
 arch/s390/kernel/perf_cpum_cf.c                    | 221 ++++--
 arch/s390/kvm/guestdbg.c                           |   9 +-
 arch/s390/kvm/interrupt.c                          |   2 +-
 arch/s390/kvm/kvm-s390.c                           |  15 +-
 arch/x86/coco/tdx/tdx.c                            |  10 +-
 arch/x86/events/amd/uncore.c                       | 781 +++++++++++----------
 arch/x86/events/intel/lbr.c                        |  12 +-
 arch/x86/events/intel/uncore.c                     |   3 +-
 arch/x86/events/intel/uncore_snbep.c               |  13 +-
 arch/x86/include/asm/insn-eval.h                   |  36 +
 arch/x86/include/asm/linkage.h                     |   2 +-
 arch/x86/include/asm/pkeys.h                       |   3 +
 arch/x86/kvm/emulate.c                             |  26 +-
 arch/x86/kvm/hyperv.c                              |  25 +-
 arch/x86/kvm/vmx/nested.c                          |  18 +
 block/blk-cgroup.c                                 |   2 +
 block/blk-iocost.c                                 |   2 +-
 block/blk-stat.c                                   |   2 +-
 block/genhd.c                                      |   8 +
 block/kyber-iosched.c                              |   2 +-
 drivers/accessibility/speakup/keyhelp.c            |  17 +-
 drivers/accessibility/speakup/kobjects.c           |   6 +-
 drivers/acpi/ec.c                                  |  40 +-
 drivers/acpi/pci_root.c                            |   3 +-
 drivers/acpi/pfr_update.c                          |  45 +-
 drivers/acpi/processor_core.c                      |  31 +-
 drivers/acpi/processor_driver.c                    |  18 +-
 drivers/acpi/processor_idle.c                      | 116 +--
 drivers/acpi/scan.c                                |  13 +-
 drivers/acpi/video_detect.c                        |   4 +-
 drivers/ata/ahci.c                                 |  49 ++
 drivers/ata/libata-scsi.c                          |  28 +-
 drivers/auxdisplay/charlcd.c                       |  21 +-
 drivers/base/arch_numa.c                           |  12 +
 drivers/base/cacheinfo.c                           |   9 +-
 drivers/base/firmware_loader/fallback.c            |  10 +
 drivers/base/property.c                            |  19 +-
 drivers/base/soc.c                                 |  15 +-
 drivers/base/swnode.c                              |   2 +-
 drivers/block/mtip32xx/mtip32xx.c                  |   7 +
 drivers/block/mtip32xx/mtip32xx.h                  |   2 +
 drivers/block/null_blk/main.c                      |  96 +--
 drivers/block/null_blk/null_blk.h                  |   1 +
 drivers/block/ublk_drv.c                           |  14 +-
 drivers/bluetooth/btintel.c                        |   2 +-
 drivers/bluetooth/btmtk.c                          |   7 +-
 drivers/bluetooth/btmtksdio.c                      |  37 +-
 drivers/bluetooth/btqca.c                          |   3 +-
 drivers/bluetooth/btusb.c                          |  80 +--
 drivers/bluetooth/hci_bcm.c                        |   1 +
 drivers/bluetooth/hci_h5.c                         |   4 +-
 drivers/bluetooth/hci_intel.c                      |   1 +
 drivers/bluetooth/hci_ldisc.c                      |   2 +-
 drivers/bluetooth/hci_serdev.c                     |   2 +-
 drivers/bluetooth/virtio_bt.c                      |   8 +-
 drivers/bus/mhi/ep/main.c                          |  15 +-
 drivers/bus/mhi/host/main.c                        |   6 +
 drivers/bus/qcom-ebi2.c                            |  51 +-
 drivers/bus/ti-sysc.c                              |  12 +-
 drivers/char/hw_random/ks-sa-rng.c                 |  22 +-
 drivers/char/ipmi/ipmb_dev_int.c                   |   5 +-
 drivers/char/ipmi/ipmi_msghandler.c                |   1 +
 drivers/char/ppdev.c                               |  10 +-
 drivers/char/tpm/st33zp24/st33zp24.c               |   8 +-
 drivers/char/tpm/tpm_i2c_nuvoton.c                 |   6 +-
 drivers/char/xilinx_hwicap/xilinx_hwicap.c         |   5 +-
 drivers/clk/clk-moxart.c                           |  14 -
 drivers/clk/clk-palmas.c                           |  14 +-
 drivers/clk/clk-versaclock7.c                      |   2 +-
 drivers/clk/hisilicon/reset.c                      |   2 +-
 drivers/clk/imx/clk-scu.c                          |   1 -
 drivers/clk/mediatek/clk-mt8135.c                  |   5 +-
 drivers/clk/meson/gxbb.c                           |   2 +-
 drivers/clk/nuvoton/clk-ma35d1-pll.c               |  52 +-
 drivers/clk/qcom/common.c                          |   4 +-
 drivers/clk/qcom/gcc-mdm9607.c                     | 182 +----
 drivers/clk/qcom/gcc-msm8916.c                     |   5 +-
 drivers/clk/qcom/gcc-msm8939.c                     |   5 +-
 drivers/clk/qcom/gcc-qcm2290.c                     |  12 +-
 drivers/clk/qcom/gdsc.c                            |  25 +-
 drivers/clk/rockchip/clk-pll.c                     |   9 +-
 drivers/clk/rockchip/clk-rk3588.c                  |   2 +-
 drivers/clk/tegra/clk-tegra124-emc.c               |   1 +
 drivers/clk/ti/adpll.c                             |   4 +-
 drivers/clk/ti/divider.c                           |   2 +-
 drivers/clk/ti/mux.c                               |  22 +-
 drivers/clk/visconti/clkc.c                        |   2 +-
 drivers/clk/x86/clk-pmc-atom.c                     |   3 +
 drivers/clocksource/clps711x-timer.c               |   2 +-
 drivers/clocksource/timer-armada-370-xp.c          |  18 +-
 drivers/clocksource/timer-sun4i.c                  |   2 +-
 drivers/cpufreq/imx6q-cpufreq.c                    |   6 +-
 drivers/cpufreq/intel_pstate.c                     |  19 +-
 drivers/cpufreq/spear-cpufreq.c                    |   4 +-
 drivers/cpuidle/dt_idle_genpd.c                    |   3 +-
 drivers/crypto/atmel-ecc.c                         |  45 +-
 drivers/crypto/atmel-sha204a.c                     |   6 +-
 drivers/crypto/gemini/sl3516-ce-cipher.c           |   8 -
 drivers/crypto/hisilicon/sec2/sec_crypto.c         |  12 +-
 .../crypto/intel/keembay/keembay-ocs-aes-core.c    |   9 +-
 drivers/crypto/intel/qat/qat_common/qat_algs.c     |   1 +
 drivers/crypto/rockchip/rk3288_crypto_ahash.c      |   7 +-
 drivers/crypto/sa2ul.c                             |   6 +-
 drivers/cxl/core/mbox.c                            |   7 +
 drivers/cxl/core/pmem.c                            |  10 +-
 drivers/cxl/core/region.c                          |   7 +-
 drivers/cxl/cxl.h                                  |   3 +-
 drivers/cxl/cxlmem.h                               |   2 +
 drivers/cxl/pci.c                                  |  14 +-
 drivers/cxl/pmem.c                                 |   2 +-
 drivers/dax/super.c                                |  12 +-
 drivers/dma/dw-edma/dw-edma-core.c                 | 127 +++-
 drivers/dma/dw-edma/dw-hdma-v0-core.c              |   2 +-
 drivers/dma/hisi_dma.c                             |   2 +-
 drivers/dma/mediatek/mtk-uart-apdma.c              |   2 +-
 drivers/dma/qcom/bam_dma.c                         |   1 +
 drivers/dma/xilinx/xilinx_dma.c                    |  12 +-
 drivers/firmware/arm_scmi/bus.c                    |  69 +-
 drivers/firmware/arm_scmi/driver.c                 |  54 +-
 drivers/firmware/google/coreboot_table.c           |  26 +-
 drivers/fpga/altera-cvp.c                          |  10 +-
 drivers/fpga/stratix10-soc.c                       |  21 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c   |   7 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |  14 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |   1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |   2 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c              |  74 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c              |  10 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c              |  10 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |   3 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c    |   6 +
 .../display/dc/link/protocols/link_dp_dpia_bw.c    |   5 +
 .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c    |  24 +
 .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c  |  35 +-
 .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c    |   2 +-
 drivers/gpu/drm/bridge/synopsys/dw-hdmi.c          |   3 +-
 drivers/gpu/drm/bridge/tc358767.c                  |   2 +-
 drivers/gpu/drm/drm_atomic_uapi.c                  |   2 +
 drivers/gpu/drm/drm_drv.c                          |  34 +-
 drivers/gpu/drm/drm_dumb_buffers.c                 |   1 -
 drivers/gpu/drm/gud/gud_connector.c                |  12 +-
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c     |  54 +-
 drivers/gpu/drm/i915/i915_pci.c                    |   3 +
 drivers/gpu/drm/lima/lima_device.c                 |  12 +-
 drivers/gpu/drm/msm/adreno/a6xx_gmu.c              |   5 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c      |   4 +
 drivers/gpu/drm/msm/dsi/dsi_host.c                 |  14 +-
 drivers/gpu/drm/mxsfb/lcdif_kms.c                  |  15 +-
 drivers/gpu/drm/nouveau/nouveau_gem.c              |  11 +-
 drivers/gpu/drm/nouveau/nouveau_sgdma.c            |   4 +-
 drivers/gpu/drm/nouveau/nouveau_uvmm.c             |   3 +
 drivers/gpu/drm/omapdrm/dss/dsi.c                  |   7 +-
 drivers/gpu/drm/omapdrm/dss/dsi.h                  |   2 -
 drivers/gpu/drm/panel/panel-edp.c                  |  19 +-
 drivers/gpu/drm/panel/panel-samsung-s6d16d0.c      |  10 +-
 drivers/gpu/drm/rockchip/rockchip_drm_vop2.c       |   2 +
 drivers/gpu/drm/sun4i/sun4i_backend.c              |   2 +-
 drivers/gpu/drm/sun4i/sun4i_crtc.c                 |   2 +-
 drivers/gpu/drm/sun4i/sun4i_tcon.c                 |  22 +-
 drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c              |   2 +
 drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c             |   2 +-
 drivers/gpu/drm/sun4i/sun8i_vi_scaler.c            |  18 +-
 drivers/gpu/drm/tve200/tve200_drv.c                |   1 +
 drivers/gpu/host1x/debug.c                         |   4 +-
 drivers/gpu/host1x/hw/channel_hw.c                 |   5 +-
 drivers/hid/hid-core.c                             |   9 +
 drivers/hid/hid-lg4ff.c                            |   8 +
 drivers/hid/hid-mcp2221.c                          |   9 +
 drivers/hid/hid-nintendo.c                         |   1 -
 drivers/hid/hid-picolcd_debugfs.c                  |   9 +
 drivers/hid/hid-rmi.c                              |  46 +-
 drivers/hid/hid-roccat-kone.c                      |   8 +-
 drivers/hid/hid-roccat.c                           |  13 +-
 drivers/hid/hid-sensor-custom.c                    |   9 +-
 drivers/hid/hid-sensor-hub.c                       |  46 +-
 drivers/hid/i2c-hid/Makefile                       |   2 +-
 drivers/hid/i2c-hid/i2c-hid-acpi-prp0001.c         | 104 +++
 drivers/hid/i2c-hid/i2c-hid-acpi.c                 |  54 +-
 drivers/hid/i2c-hid/i2c-hid-acpi.h                 |  33 +
 drivers/hid/i2c-hid/i2c-hid-core.c                 | 119 ++--
 drivers/hid/i2c-hid/i2c-hid-of-goodix.c            |   4 +-
 drivers/hid/wacom_wac.c                            |  13 +
 drivers/hsi/controllers/omap_ssi_core.c            |   6 +
 drivers/hwmon/emc1403.c                            | 756 ++++++++++++--------
 drivers/hwmon/max6621.c                            |   8 +-
 drivers/hwspinlock/hwspinlock_core.c               |   2 +-
 drivers/hwtracing/coresight/coresight-etm4x-cfg.c  |   2 +-
 drivers/hwtracing/coresight/coresight-etm4x-core.c |  15 +-
 .../hwtracing/coresight/coresight-etm4x-sysfs.c    |   6 +-
 drivers/hwtracing/coresight/coresight-etm4x.h      |   9 +-
 drivers/hwtracing/ptt/hisi_ptt.c                   |  20 +-
 drivers/i2c/busses/i2c-ocores.c                    |   6 +-
 drivers/i2c/i2c-core-base.c                        |   6 +
 drivers/i2c/i2c-mux.c                              |   1 +
 drivers/i2c/muxes/i2c-demux-pinctrl.c              |   1 +
 drivers/i3c/master.c                               |  11 +-
 drivers/i3c/master/dw-i3c-master.c                 |  10 +-
 drivers/i3c/master/mipi-i3c-hci/core.c             |  30 +-
 drivers/i3c/master/mipi-i3c-hci/dma.c              |   4 +-
 drivers/i3c/master/mipi-i3c-hci/ext_caps.c         |  55 +-
 drivers/i3c/master/mipi-i3c-hci/pio.c              |  54 +-
 drivers/i3c/master/svc-i3c-master.c                |  10 +-
 drivers/iio/accel/dmard09.c                        |   7 +
 drivers/iio/chemical/atlas-sensor.c                |  19 +-
 drivers/iio/chemical/sgp30.c                       |   3 +
 drivers/iio/dac/m62332.c                           |  17 +-
 drivers/iio/gyro/mpu3050-core.c                    |   2 +-
 drivers/iio/light/cm32181.c                        |   2 +-
 drivers/iio/light/gp2ap002.c                       |  24 +-
 drivers/iio/light/isl29028.c                       |   2 +-
 drivers/iio/light/opt4001.c                        |  37 +-
 drivers/iio/light/tsl2583.c                        |   2 +-
 drivers/iio/light/tsl2772.c                        |   2 +-
 drivers/iio/orientation/hid-sensor-rotation.c      |  20 +-
 drivers/iio/pressure/dps310.c                      |   3 +-
 drivers/iio/pressure/mpl115.c                      |  11 +-
 drivers/iio/proximity/srf04.c                      |   1 +
 drivers/iio/temperature/hid-sensor-temperature.c   |   3 +-
 drivers/infiniband/core/cma.c                      |   6 +-
 drivers/infiniband/core/core_priv.h                |   1 +
 drivers/infiniband/core/counters.c                 |   5 +-
 drivers/infiniband/core/cq.c                       |  14 +-
 drivers/infiniband/core/device.c                   |   3 +
 drivers/infiniband/core/nldev.c                    | 106 ++-
 drivers/infiniband/core/restrack.c                 | 186 ++++-
 drivers/infiniband/core/restrack.h                 |   4 +
 drivers/infiniband/core/ucma.c                     |   7 +-
 drivers/infiniband/core/uverbs_cmd.c               |  13 +-
 drivers/infiniband/core/verbs.c                    |  32 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   6 +-
 drivers/infiniband/hw/cxgb4/device.c               |   8 +-
 drivers/infiniband/hw/cxgb4/mem.c                  |   4 +-
 drivers/infiniband/hw/efa/efa_verbs.c              |  15 +-
 drivers/infiniband/hw/erdma/Kconfig                |   2 +-
 drivers/infiniband/hw/erdma/erdma_eq.c             |   7 +-
 drivers/infiniband/hw/erdma/erdma_verbs.c          |  12 +-
 drivers/infiniband/hw/erdma/erdma_verbs.h          |  25 +-
 drivers/infiniband/hw/hfi1/chip.c                  |   4 +-
 drivers/infiniband/hw/hfi1/hfi.h                   |   2 -
 drivers/infiniband/hw/hfi1/init.c                  |  44 +-
 drivers/infiniband/hw/hfi1/user_sdma.c             |  13 +-
 drivers/infiniband/hw/mlx5/cong.c                  |   8 +-
 drivers/infiniband/hw/mlx5/main.c                  |   2 +
 drivers/infiniband/hw/mlx5/qp.c                    |  25 +-
 drivers/infiniband/sw/rxe/rxe_req.c                |  15 +
 drivers/infiniband/sw/rxe/rxe_resp.c               |   9 +-
 drivers/infiniband/sw/siw/siw_cm.c                 |  32 +-
 drivers/infiniband/ulp/ipoib/ipoib_main.c          |   2 +
 drivers/infiniband/ulp/isert/ib_isert.c            |  85 ++-
 drivers/infiniband/ulp/isert/ib_isert.h            |   1 +
 drivers/infiniband/ulp/srp/ib_srp.c                |  45 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |   9 +-
 drivers/input/tablet/aiptek.c                      |  13 +-
 drivers/interconnect/core.c                        |   7 +-
 drivers/iommu/amd/init.c                           |  42 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c        |   5 +-
 drivers/iommu/arm/arm-smmu/qcom_iommu.c            |   6 +-
 drivers/iommu/dma-iommu.c                          |  13 +-
 drivers/iommu/intel/dmar.c                         |  15 +-
 drivers/iommu/intel/iommu.c                        |  18 +-
 drivers/iommu/intel/iommu.h                        |   2 +
 drivers/iommu/msm_iommu.c                          |   2 +-
 drivers/iommu/mtk_iommu_v1.c                       |   2 +-
 drivers/ipack/devices/ipoctal.c                    |  70 +-
 drivers/irqchip/irq-gic-v3-its.c                   |  23 +-
 drivers/irqchip/irq-mbigen.c                       |  20 +-
 drivers/irqchip/irq-renesas-irqc.c                 |   1 +
 drivers/irqchip/irq-renesas-rzg2l.c                |   4 +-
 drivers/leds/leds-pca9532.c                        |  18 +-
 drivers/mailbox/pcc.c                              |  70 +-
 drivers/mailbox/qcom-ipcc.c                        |  17 +-
 drivers/mailbox/rockchip-mailbox.c                 |  17 +-
 drivers/md/dm-era-target.c                         |   5 +
 drivers/md/dm-log-userspace-base.c                 |   1 +
 drivers/md/dm-stats.c                              |   6 +-
 drivers/md/dm-switch.c                             |   2 +-
 drivers/md/dm.c                                    |  14 +-
 drivers/md/md-bitmap.c                             |   6 +-
 drivers/md/md.c                                    |   9 +
 drivers/md/persistent-data/dm-array.c              |  16 +
 drivers/md/raid1.c                                 |   2 -
 drivers/md/raid5-ppl.c                             |   4 +-
 drivers/md/raid5.c                                 |  23 +-
 drivers/media/cec/core/cec-adap.c                  |   8 +-
 drivers/media/cec/core/cec-core.c                  |   2 -
 drivers/media/cec/core/cec-pin.c                   |   8 +-
 drivers/media/cec/platform/meson/ao-cec-g12a.c     |   1 +
 drivers/media/cec/platform/stm32/stm32-cec.c       |   3 +-
 drivers/media/dvb-frontends/rtl2832_sdr.c          |  23 +-
 drivers/media/i2c/ov02a10.c                        |  12 +-
 drivers/media/i2c/ov7740.c                         |   4 +-
 drivers/media/i2c/rdacm21.c                        |   5 +-
 drivers/media/i2c/video-i2c.c                      |   8 +-
 drivers/media/pci/cobalt/cobalt-alsa-main.c        |   1 -
 drivers/media/pci/cx23885/cimax2.c                 |   1 +
 drivers/media/pci/saa7164/saa7164-core.c           |   8 +-
 drivers/media/pci/zoran/zoran_card.c               |   2 +-
 .../platform/nxp/imx8-isi/imx8-isi-crossbar.c      |   6 +-
 .../media/platform/nxp/imx8-isi/imx8-isi-video.c   |   2 +-
 drivers/media/platform/qcom/venus/hfi_parser.c     |   9 +-
 drivers/media/rc/sunxi-cir.c                       |   9 +-
 drivers/media/test-drivers/vicodec/vicodec-core.c  |   4 +-
 drivers/media/test-drivers/vimc/vimc-capture.c     |   4 +-
 drivers/media/tuners/tda18250.c                    |   4 +-
 drivers/media/usb/airspy/airspy.c                  |  19 +-
 drivers/media/usb/cx231xx/cx231xx-video.c          |   4 +-
 drivers/media/usb/em28xx/em28xx-cards.c            |   3 +-
 drivers/media/usb/em28xx/em28xx-core.c             |   2 +
 drivers/media/usb/go7007/snd-go7007.c              |  10 +-
 drivers/media/usb/s2255/s2255drv.c                 |  11 +
 drivers/media/usb/usbtv/usbtv-audio.c              |  11 +
 drivers/media/v4l2-core/v4l2-async.c               |  19 +-
 drivers/media/v4l2-core/v4l2-ctrls-core.c          |  49 +-
 drivers/media/v4l2-core/v4l2-dev.c                 |  14 +-
 drivers/media/v4l2-core/v4l2-fwnode.c              |   2 +
 drivers/mfd/iqs62x.c                               |   2 +-
 drivers/mfd/rave-sp.c                              |  64 +-
 drivers/misc/ad525x_dpot-i2c.c                     |   1 +
 drivers/misc/ad525x_dpot-spi.c                     |   1 +
 drivers/misc/ad525x_dpot.c                         | 177 +++--
 drivers/misc/ad525x_dpot.h                         |   3 +
 drivers/misc/bcm-vk/bcm_vk_msg.c                   |   6 +-
 drivers/misc/cardreader/rtsx_pcr.c                 |   2 +
 drivers/misc/cardreader/rtsx_usb.c                 |  23 +-
 drivers/misc/vmw_vmci/vmci_event.c                 |   4 +-
 drivers/mmc/host/via-sdmmc.c                       |   8 +-
 drivers/mtd/mtdoops.c                              |   3 +
 drivers/mtd/mtdpart.c                              |   3 +-
 drivers/mtd/mtdswap.c                              |   1 +
 drivers/mtd/nand/raw/nand_onfi.c                   |  27 +-
 drivers/mtd/parsers/afs.c                          |   7 +
 drivers/mtd/ubi/attach.c                           |   4 +-
 drivers/mtd/ubi/build.c                            |  35 +-
 drivers/mtd/ubi/cdev.c                             |   3 +-
 drivers/mtd/ubi/eba.c                              |   3 -
 drivers/mtd/ubi/fastmap-wl.c                       |  53 +-
 drivers/mtd/ubi/fastmap.c                          |  68 +-
 drivers/mtd/ubi/io.c                               |  11 +-
 drivers/mtd/ubi/ubi.h                              |  12 +-
 drivers/mtd/ubi/wl.c                               |  32 +-
 drivers/mtd/ubi/wl.h                               |   6 +-
 drivers/net/bonding/bond_netlink.c                 |   2 +-
 drivers/net/can/usb/peak_usb/pcan_usb_core.c       |   2 +-
 drivers/net/dsa/b53/b53_common.c                   |   2 +-
 drivers/net/dsa/mv88e6xxx/pcs-6352.c               |   5 +-
 drivers/net/ethernet/allwinner/sun4i-emac.c        |   4 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c   |   3 +
 drivers/net/ethernet/freescale/fec_main.c          |   6 +-
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    |  12 +-
 .../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c |   3 +
 drivers/net/ethernet/intel/ice/ice_lib.c           |   3 +
 .../net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c |   2 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_nix.c    |  11 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c  |   2 +-
 drivers/net/ethernet/nvidia/forcedeth.c            |   6 +-
 drivers/net/ethernet/qlogic/qede/qede.h            |   8 +-
 drivers/net/ethernet/qlogic/qede/qede_fp.c         |   1 +
 .../net/ethernet/qualcomm/rmnet/rmnet_map_data.c   |   1 +
 drivers/net/ethernet/realtek/8139cp.c              |   2 +-
 drivers/net/ethernet/renesas/ravb.h                |   1 +
 drivers/net/ethernet/renesas/ravb_main.c           |   3 +-
 drivers/net/ethernet/renesas/ravb_ptp.c            |  15 +-
 .../net/ethernet/stmicro/stmmac/dwmac1000_core.c   |   2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c  |   2 +-
 .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c    |   2 +-
 .../net/ethernet/stmicro/stmmac/stmmac_selftests.c |  41 +-
 drivers/net/ethernet/sun/niu.c                     |   2 +
 drivers/net/ethernet/wangxun/libwx/wx_lib.c        |   4 +-
 drivers/net/gtp.c                                  |   2 +
 drivers/net/ipa/ipa_main.c                         |  29 +-
 drivers/net/ntb_netdev.c                           |  38 +-
 drivers/net/ppp/pppox.c                            |  17 +
 drivers/net/slip/slip.c                            |  19 +-
 drivers/net/thunderbolt/main.c                     |  18 +-
 drivers/net/tun.c                                  |  21 +-
 drivers/net/usb/qmi_wwan.c                         |   1 +
 drivers/net/vxlan/vxlan_core.c                     |   2 +
 drivers/net/vxlan/vxlan_mdb.c                      | 365 +++++++++-
 drivers/net/vxlan/vxlan_private.h                  |   4 +
 drivers/net/vxlan/vxlan_vnifilter.c                |   6 +-
 drivers/net/wireless/ath/ath10k/snoc.c             |   9 +-
 drivers/net/wireless/ath/ath11k/Makefile           |   4 +-
 drivers/net/wireless/ath/ath11k/core.c             |   8 +
 drivers/net/wireless/ath/ath11k/core.h             |  15 +
 drivers/net/wireless/ath/ath11k/dp_rx.c            |  32 +-
 drivers/net/wireless/ath/ath11k/fw.c               | 168 +++++
 drivers/net/wireless/ath/ath11k/fw.h               |  27 +
 drivers/net/wireless/ath/ath11k/mhi.c              |  18 +-
 drivers/net/wireless/ath/ath11k/p2p.c              | 149 ++++
 drivers/net/wireless/ath/ath11k/p2p.h              |  22 +
 drivers/net/wireless/ath/ath11k/pci.c              |   2 +
 drivers/net/wireless/ath/ath11k/qmi.c              |  56 +-
 drivers/net/wireless/ath/ath11k/testmode.c         |   2 +-
 drivers/net/wireless/ath/ath11k/wmi.c              | 167 +++--
 drivers/net/wireless/ath/ath11k/wmi.h              |  35 +-
 drivers/net/wireless/ath/ath12k/wmi.c              |  12 +-
 drivers/net/wireless/ath/ath6kl/cfg80211.c         |   5 +
 drivers/net/wireless/ath/ath6kl/wmi.c              |  17 +-
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |   3 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |   2 +-
 drivers/net/wireless/intel/iwlwifi/fw/dump.c       |   2 +-
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c   |   8 +-
 drivers/net/wireless/intel/iwlwifi/mei/iwl-mei.h   |  10 +
 drivers/net/wireless/intel/iwlwifi/mei/main.c      |  66 +-
 drivers/net/wireless/intel/iwlwifi/mvm/ops.c       |   2 +-
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c   |  12 +
 drivers/net/wireless/marvell/mwifiex/usb.c         |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7615/main.c   |   5 +-
 drivers/net/wireless/mediatek/mt76/mt76x02_mac.c   |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7915/init.c   |   9 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mac.c    |   6 +-
 drivers/net/wireless/mediatek/mt76/mt7915/main.c   |   8 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |  10 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.h    |   6 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h |  18 +
 drivers/net/wireless/mediatek/mt76/mt7915/pci.c    |   9 +-
 drivers/net/wireless/mediatek/mt76/mt7915/soc.c    |   2 +-
 .../net/wireless/mediatek/mt76/mt7915/testmode.c   |   5 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c    |  28 +-
 drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c |   6 +
 drivers/net/wireless/mediatek/mt76/mt7996/mac.c    |   1 +
 drivers/net/wireless/mediatek/mt76/mt7996/main.c   |   2 -
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c    |  16 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.h    |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mmio.c   |  12 +-
 drivers/net/wireless/mediatek/mt76/sdio.c          |  11 +-
 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c |   2 +-
 drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c |   2 +-
 drivers/net/wireless/realtek/rtlwifi/pci.c         |   6 +-
 drivers/net/wireless/realtek/rtw88/tx.c            |   1 +
 drivers/net/wireless/realtek/rtw89/mac.c           |   2 +-
 drivers/net/wireless/virtual/mac80211_hwsim.c      |   5 +-
 drivers/net/wireless/zydas/zd1211rw/zd_usb.c       |   8 +
 drivers/nfc/pn533/pn533.c                          |  21 +-
 drivers/ntb/ntb_transport.c                        |  38 +-
 drivers/nvdimm/btt.c                               |   8 +
 drivers/nvdimm/label.c                             |  17 +-
 drivers/nvme/host/apple.c                          | 227 ++++--
 drivers/nvme/host/core.c                           |   2 +-
 drivers/nvme/host/fc.c                             |   8 +-
 drivers/nvme/host/ioctl.c                          | 117 +--
 drivers/nvme/host/pci.c                            |   1 +
 drivers/nvme/host/tcp.c                            |  52 +-
 drivers/nvme/target/auth.c                         |   6 +
 drivers/nvme/target/core.c                         |   2 +-
 drivers/nvme/target/fabrics-cmd-auth.c             |  12 +-
 drivers/nvme/target/nvmet.h                        |   2 +
 drivers/nvme/target/rdma.c                         | 121 ++--
 drivers/nvme/target/tcp.c                          |  10 +
 drivers/nvme/target/zns.c                          |   2 +-
 drivers/of/base.c                                  |   2 +-
 drivers/of/property.c                              |  91 ++-
 drivers/parisc/eisa.c                              |   5 +
 drivers/pci/controller/cadence/pci-j721e.c         |   4 +-
 drivers/pci/controller/dwc/pci-meson.c             |   2 +-
 drivers/pci/controller/pci-hyperv.c                |   1 +
 drivers/pci/controller/pci-xgene.c                 |  11 +-
 drivers/pci/msi/msi.c                              |  10 +
 drivers/pci/pci-sysfs.c                            |   4 +-
 drivers/pci/proc.c                                 |  16 +-
 drivers/pci/quirks.c                               |   6 +-
 drivers/perf/arm_spe_pmu.c                         |   2 +-
 drivers/perf/cxl_pmu.c                             |   2 +-
 drivers/phy/qualcomm/phy-qcom-qmp-combo.c          |   2 +-
 drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c     |  12 +-
 drivers/phy/qualcomm/phy-qcom-qmp-usb.c            |  12 +-
 drivers/phy/qualcomm/phy-qcom-sgmii-eth.c          |  43 +-
 drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c      |  26 +-
 drivers/phy/rockchip/phy-rockchip-inno-csidphy.c   |   2 +-
 drivers/phy/starfive/phy-jh7110-dphy-rx.c          |   5 +-
 drivers/phy/sunplus/phy-sunplus-usb2.c             |   6 +-
 drivers/pinctrl/bcm/pinctrl-bcm2835.c              |   1 -
 drivers/pinctrl/mediatek/mtk-eint.c                | 340 +++++----
 drivers/pinctrl/mediatek/mtk-eint.h                |  28 +-
 drivers/pinctrl/mediatek/pinctrl-moore.h           |  12 +-
 drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c   |  40 +-
 drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h   |   1 +
 drivers/pinctrl/mediatek/pinctrl-mtk-common.c      |  14 +-
 drivers/pinctrl/mediatek/pinctrl-paris.h           |  19 +-
 drivers/pinctrl/pinctrl-rockchip.c                 |  10 +
 drivers/platform/chrome/cros_ec_debugfs.c          |   6 +-
 drivers/platform/chrome/cros_ec_sensorhub_ring.c   |  28 +-
 drivers/platform/chrome/cros_ec_typec.c            |   6 +
 drivers/platform/mellanox/mlxbf-bootctl.c          |   1 +
 drivers/platform/mellanox/mlxbf-pmc.c              |  10 +-
 drivers/platform/surface/surface_acpi_notify.c     |   6 +-
 drivers/platform/x86/dell/dell-wmi-base.c          |  17 +-
 drivers/platform/x86/dell/dell-wmi-privacy.c       |   4 +-
 .../x86/dell/dell-wmi-sysman/biosattr-interface.c  |   1 -
 .../x86/dell/dell-wmi-sysman/dell-wmi-sysman.h     |   2 +-
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.c       |  18 +-
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.h       |   8 +
 .../platform/x86/hp/hp-bioscfg/enum-attributes.c   |  15 +-
 .../platform/x86/hp/hp-bioscfg/int-attributes.c    |   6 +-
 .../x86/hp/hp-bioscfg/order-list-attributes.c      |  14 +-
 .../x86/hp/hp-bioscfg/passwdobj-attributes.c       |  19 +-
 .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c |   4 +-
 .../platform/x86/hp/hp-bioscfg/string-attributes.c |   6 +-
 drivers/platform/x86/intel/ishtp_eclite.c          |   5 +-
 .../x86/intel/speed_select_if/isst_tpmi_core.c     |  30 +-
 drivers/pmdomain/bcm/bcm2835-power.c               |   7 +-
 drivers/power/supply/bd99954-charger.h             |  23 +-
 drivers/power/supply/bq24257_charger.c             |  16 +-
 drivers/power/supply/bq256xx_charger.c             |  29 +-
 drivers/power/supply/bq25890_charger.c             |  12 +
 drivers/power/supply/bq27xxx_battery.c             |   6 +-
 drivers/power/supply/cros_usbpd-charger.c          |  17 +-
 drivers/power/supply/isp1704_charger.c             |   1 +
 drivers/power/supply/lp8727_charger.c              |   4 +-
 drivers/power/supply/max17040_battery.c            |   6 +-
 drivers/power/supply/qcom_battmgr.c                |   2 +-
 drivers/power/supply/rt9455_charger.c              |  21 +-
 drivers/power/supply/sbs-battery.c                 |   7 +-
 drivers/power/supply/sc2731_charger.c              |   8 +-
 drivers/power/supply/twl4030_charger.c             |  12 +-
 drivers/power/supply/ucs1002_power.c               |   6 +-
 drivers/pps/clients/pps-gpio.c                     |  62 +-
 drivers/pps/pps.c                                  |  10 +-
 drivers/rapidio/devices/rio_mport_cdev.c           |  10 +-
 drivers/rapidio/rio-scan.c                         |   1 +
 drivers/regulator/Kconfig                          |   4 +-
 drivers/regulator/as3722-regulator.c               |   1 -
 drivers/regulator/core.c                           |   6 +-
 drivers/regulator/max8998.c                        |   1 -
 drivers/regulator/qcom-refgen-regulator.c          |   4 +-
 drivers/regulator/qcom-rpmh-regulator.c            |   6 +-
 drivers/regulator/tps6594-regulator.c              | 445 +++++++++---
 drivers/remoteproc/mtk_scp.c                       |   9 +-
 drivers/remoteproc/qcom_common.c                   |   4 +-
 drivers/remoteproc/qcom_q6v5_adsp.c                |   1 +
 drivers/remoteproc/remoteproc_core.c               | 156 ++--
 drivers/remoteproc/remoteproc_sysfs.c              |   1 -
 drivers/rpmsg/qcom_glink_native.c                  |  44 +-
 drivers/rpmsg/qcom_glink_smem.c                    |   7 +
 drivers/rtc/rtc-gamecube.c                         |   4 +-
 drivers/rtc/rtc-pcf85363.c                         |  17 +-
 drivers/rtc/rtc-pcf8563.c                          |   4 +-
 drivers/rtc/rtc-rzn1.c                             |  10 +-
 drivers/rtc/rtc-zynqmp.c                           |   7 +-
 drivers/s390/block/dasd.c                          |   6 +-
 drivers/s390/block/dasd_eckd.c                     |  40 +-
 drivers/s390/block/dasd_erp.c                      |   3 +
 drivers/s390/crypto/vfio_ap_ops.c                  | 176 +++--
 drivers/scsi/mpt3sas/mpt3sas_base.c                |   2 +
 drivers/scsi/pm8001/pm8001_init.c                  |   4 +-
 drivers/scsi/qla2xxx/qla_attr.c                    |   7 +-
 drivers/scsi/qla2xxx/qla_bsg.c                     |  39 +-
 drivers/scsi/qla2xxx/qla_dbg.c                     |   2 +-
 drivers/scsi/qla2xxx/qla_dfs.c                     |   4 +-
 drivers/scsi/qla2xxx/qla_edif.c                    |   3 +
 drivers/scsi/qla2xxx/qla_gs.c                      |   4 +-
 drivers/scsi/qla2xxx/qla_init.c                    |  61 +-
 drivers/scsi/qla2xxx/qla_inline.h                  |  13 +
 drivers/scsi/qla2xxx/qla_isr.c                     |  39 +-
 drivers/scsi/qla2xxx/qla_mbx.c                     |  28 +-
 drivers/scsi/qla2xxx/qla_nvme.c                    |  31 +-
 drivers/scsi/qla2xxx/qla_nx2.c                     |   2 +-
 drivers/scsi/qla2xxx/qla_os.c                      |  14 +-
 drivers/scsi/scsi_lib.c                            |   2 +
 drivers/scsi/sd.c                                  |   4 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |  18 +
 drivers/soc/fsl/qe/qe_ic.c                         |   3 +-
 drivers/soc/qcom/rpmh-rsc.c                        |  37 +-
 drivers/soc/samsung/exynos-pmu.c                   |   4 +-
 drivers/soc/ti/knav_qmss.h                         |   1 +
 drivers/soc/ti/knav_qmss_queue.c                   |  14 +-
 drivers/soundwire/qcom.c                           |   2 +-
 drivers/spi/spi-bcm63xx-hsspi.c                    |   8 +-
 drivers/spi/spi-bcm63xx.c                          |   6 +-
 drivers/spi/spi-bcmbca-hsspi.c                     |   8 +-
 drivers/spi/spi-davinci.c                          |  22 +-
 drivers/spi/spi-img-spfi.c                         |   5 +-
 drivers/spi/spi-sprd-adi.c                         |   6 +
 drivers/staging/fbtft/fbtft-sysfs.c                |   2 +-
 drivers/staging/greybus/audio_gb.c                 |  13 +
 drivers/staging/greybus/audio_manager_sysfs.c      |   2 +-
 drivers/staging/greybus/hid.c                      |   2 +-
 drivers/staging/media/meson/vdec/vdec.c            |   4 +-
 drivers/staging/media/sunxi/cedrus/cedrus.c        |   4 +-
 drivers/staging/media/tegra-video/vi.c             |   9 +-
 drivers/staging/media/tegra-video/vip.c            |  10 +-
 drivers/staging/octeon/ethernet-mem.c              |  43 +-
 drivers/staging/octeon/ethernet-mem.h              |   8 +-
 drivers/staging/octeon/ethernet-rx.c               |  53 +-
 drivers/staging/octeon/ethernet-rx.h               |  13 +-
 drivers/staging/octeon/ethernet-tx.c               |   2 +
 drivers/staging/octeon/ethernet.c                  |  43 +-
 drivers/staging/octeon/octeon-ethernet.h           |  14 +
 drivers/staging/rtl8723bs/core/rtw_cmd.c           |   8 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |   7 +
 drivers/staging/rtl8723bs/os_dep/sdio_intf.c       |   4 +-
 drivers/staging/sm750fb/sm750.c                    |   4 +-
 drivers/target/iscsi/iscsi_target_login.c          |   2 +-
 drivers/thermal/imx_thermal.c                      |   9 +-
 .../intel/int340x_thermal/int3400_thermal.c        |   4 +-
 drivers/thermal/qoriq_thermal.c                    |  13 +-
 drivers/thermal/rcar_thermal.c                     |  15 +-
 drivers/tty/hvc/Kconfig                            |   2 +-
 drivers/tty/serial/amba-pl011.c                    |  10 +
 drivers/tty/serial/ma35d1_serial.c                 |  12 +-
 drivers/tty/tty_io.c                               |   4 +-
 drivers/ufs/core/ufs-debugfs.c                     |   2 +-
 drivers/ufs/core/ufshcd.c                          |  18 +-
 drivers/uio/uio.c                                  |   5 +
 drivers/usb/atm/usbatm.c                           |   4 +-
 drivers/usb/common/common.c                        |   3 +
 drivers/usb/core/driver.c                          |  88 +--
 drivers/usb/core/usb.c                             |   2 +-
 drivers/usb/core/usb.h                             |   8 +-
 drivers/usb/dwc2/gadget.c                          |  11 +-
 drivers/usb/gadget/configfs.c                      |   4 +-
 drivers/usb/gadget/function/f_fs.c                 |  14 +-
 drivers/usb/gadget/function/f_mass_storage.c       |   2 +-
 drivers/usb/gadget/function/f_midi2.c              |  19 +-
 drivers/usb/gadget/function/f_tcm.c                |  23 +-
 drivers/usb/gadget/function/f_uac1_legacy.c        |  56 --
 drivers/usb/gadget/function/f_uvc.c                |   7 +-
 drivers/usb/gadget/function/u_audio.c              |  24 +-
 drivers/usb/gadget/function/u_uac1_legacy.h        |   3 -
 drivers/usb/gadget/functions.c                     |   2 +-
 drivers/usb/gadget/legacy/inode.c                  |   3 +-
 drivers/usb/gadget/udc/aspeed_udc.c                |  43 +-
 drivers/usb/gadget/udc/r8a66597-udc.c              |   1 -
 drivers/usb/gadget/udc/snps_udc_plat.c             |   5 +-
 drivers/usb/host/xhci-ring.c                       |  32 +-
 drivers/usb/image/mdc800.c                         |   4 +-
 drivers/usb/misc/onboard_usb_hub.c                 |   2 +-
 drivers/usb/mtu3/mtu3_core.c                       |  11 +-
 drivers/usb/phy/phy-fsl-usb.c                      |  52 +-
 drivers/usb/phy/phy-fsl-usb.h                      |   6 +-
 drivers/usb/renesas_usbhs/common.c                 |   6 +-
 drivers/usb/serial/bus.c                           |   6 +-
 drivers/usb/serial/usb-serial.c                    |   6 +-
 drivers/usb/storage/ene_ub6250.c                   |   2 +
 drivers/usb/storage/uas.c                          |   2 +-
 .../usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c    |   2 +
 drivers/usb/typec/ucsi/debugfs.c                   |   1 +
 drivers/usb/typec/ucsi/displayport.c               |   2 +-
 drivers/usb/typec/ucsi/ucsi.c                      |  12 +-
 drivers/usb/typec/ucsi/ucsi.h                      |   3 +
 drivers/usb/typec/ucsi/ucsi_acpi.c                 |   3 +-
 drivers/usb/usbip/stub_main.c                      |   8 +-
 drivers/vdpa/mlx5/core/mr.c                        |   2 +-
 drivers/vdpa/vdpa_sim/vdpa_sim.c                   |  25 +-
 drivers/vfio/pci/vfio_pci_config.c                 |   1 +
 drivers/video/fbdev/kyro/fbdev.c                   |  24 +-
 .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c     |   4 +-
 drivers/video/fbdev/pvr2fb.c                       |   4 +-
 drivers/video/fbdev/ssd1307fb.c                    |  72 +-
 drivers/video/fbdev/tdfxfb.c                       |   2 +-
 drivers/video/fbdev/uvesafb.c                      |   2 +
 drivers/video/sticore.c                            |  22 +-
 drivers/virtio/virtio_balloon.c                    |   6 +
 drivers/w1/masters/ds2482.c                        |   4 +
 drivers/w1/slaves/w1_ds28e17.c                     |   8 +
 drivers/watchdog/pseries-wdt.c                     |  53 +-
 drivers/xen/xenbus/xenbus_xs.c                     |  16 +-
 fs/btrfs/verity.c                                  |  16 +-
 fs/ceph/caps.c                                     |  11 +-
 fs/ceph/crypto.c                                   |  34 +-
 fs/ceph/export.c                                   |  26 +-
 fs/ceph/file.c                                     |  48 ++
 fs/ceph/mdsmap.c                                   |  11 +-
 fs/ceph/xattr.c                                    |  17 +
 fs/ecryptfs/crypto.c                               |   2 +-
 fs/ecryptfs/ecryptfs_kernel.h                      |   3 +-
 fs/ecryptfs/keystore.c                             |  45 +-
 fs/ecryptfs/messaging.c                            |  11 +-
 fs/ecryptfs/miscdev.c                              |   5 +-
 fs/ecryptfs/super.c                                |   7 +
 fs/efivarfs/super.c                                |  30 +-
 fs/erofs/Kconfig                                   |   8 +-
 fs/ext4/file.c                                     |   7 +
 fs/ext4/inline.c                                   |  11 +-
 fs/ext4/inode.c                                    |  28 +-
 fs/ext4/migrate.c                                  |   3 +-
 fs/ext4/namei.c                                    |   2 +
 fs/ext4/orphan.c                                   |  10 +-
 fs/f2fs/file.c                                     | 116 ++-
 fs/f2fs/namei.c                                    |  11 +-
 fs/f2fs/xattr.c                                    |   2 +-
 fs/fat/misc.c                                      |   4 +
 fs/fat/nfs.c                                       |   4 +-
 fs/fuse/control.c                                  |   2 +-
 fs/fuse/cuse.c                                     |   5 +
 fs/fuse/dev.c                                      |  40 +-
 fs/fuse/dir.c                                      |  21 +-
 fs/fuse/fuse_i.h                                   |  36 +-
 fs/fuse/inode.c                                    |  87 ++-
 fs/fuse/readdir.c                                  |  42 +-
 fs/hfsplus/catalog.c                               |  25 +-
 fs/hfsplus/hfsplus_fs.h                            |   6 +
 fs/hugetlbfs/inode.c                               |   3 +-
 fs/isofs/compress.c                                |   7 +-
 fs/lockd/svcsubs.c                                 |  53 +-
 fs/nfs/client.c                                    |  21 +-
 fs/nfs/filelayout/filelayoutdev.c                  |   3 +-
 fs/nfs/flexfilelayout/flexfilelayoutdev.c          |   3 +-
 fs/nfs/inode.c                                     |   4 +-
 fs/nfs/internal.h                                  |   1 +
 fs/nfs/netns.h                                     |   6 +-
 fs/nfs/nfs4client.c                                |   1 +
 fs/nfs/pnfs.c                                      |  36 +-
 fs/nfs/pnfs.h                                      |   3 +-
 fs/nfs/pnfs_nfs.c                                  |  39 +-
 fs/nfsd/flexfilelayoutxdr.c                        |  20 +-
 fs/nfsd/nfs2acl.c                                  |  52 +-
 fs/nfsd/nfs3acl.c                                  |  17 +-
 fs/nfsd/nfs4proc.c                                 |  39 +-
 fs/nfsd/nfs4state.c                                | 206 ++++--
 fs/nfsd/nfs4xdr.c                                  |  17 +
 fs/nfsd/nfscache.c                                 |   2 +-
 fs/nfsd/nfsfh.c                                    |   4 +-
 fs/nfsd/nfsproc.c                                  |   7 +
 fs/nfsd/nfssvc.c                                   |   4 +-
 fs/nfsd/nfsxdr.c                                   |  32 +-
 fs/nfsd/vfs.c                                      |   4 +-
 fs/nilfs2/bmap.c                                   |   2 +-
 fs/nilfs2/bmap.h                                   |   2 +-
 fs/nilfs2/btnode.c                                 |  30 +-
 fs/nilfs2/btree.c                                  |  39 +-
 fs/nilfs2/direct.c                                 |   4 +-
 fs/nilfs2/page.c                                   |  66 +-
 fs/nilfs2/page.h                                   |   8 +-
 fs/nilfs2/segment.c                                |  40 +-
 fs/nilfs2/the_nilfs.c                              |   6 +
 fs/notify/fanotify/fanotify_user.c                 |  17 +-
 fs/notify/inotify/inotify_user.c                   |  15 +-
 fs/ntfs3/attrib.c                                  |  11 +-
 fs/ntfs3/frecord.c                                 |  88 ++-
 fs/ntfs3/fslog.c                                   |  47 +-
 fs/ntfs3/fsntfs.c                                  |   8 +-
 fs/ntfs3/ntfs_fs.h                                 |  21 +-
 fs/ntfs3/record.c                                  | 125 ++--
 fs/ntfs3/super.c                                   |  13 +-
 fs/ntfs3/xattr.c                                   |  25 +-
 fs/ocfs2/acl.c                                     | 141 ++--
 fs/ocfs2/acl.h                                     |  19 +-
 fs/ocfs2/cluster/heartbeat.c                       | 193 +++--
 fs/ocfs2/cluster/heartbeat.h                       |   5 +
 fs/ocfs2/cluster/nodemanager.c                     |  10 +
 fs/ocfs2/cluster/nodemanager.h                     |   1 +
 fs/ocfs2/cluster/tcp.c                             |  83 ++-
 fs/ocfs2/cluster/tcp.h                             |   1 +
 fs/ocfs2/dir.c                                     |   2 +-
 fs/ocfs2/dlm/dlmmaster.c                           |   6 +
 fs/ocfs2/dlm/dlmrecovery.c                         |   9 +
 fs/ocfs2/namei.c                                   |  17 +-
 fs/ocfs2/refcounttree.c                            |  47 +-
 fs/ocfs2/xattr.c                                   |  91 ++-
 fs/ocfs2/xattr.h                                   |   9 +-
 fs/orangefs/devorangefs-req.c                      |   1 +
 fs/orangefs/orangefs-debugfs.c                     |   1 +
 fs/smb/client/cifs_debug.c                         |   2 +-
 fs/smb/client/cifsfs.c                             |  15 +-
 fs/smb/client/dfs_cache.c                          |  33 +-
 fs/smb/client/smb1ops.c                            |   2 +-
 fs/smb/client/smb2file.c                           |   5 +-
 fs/smb/client/smb2pdu.c                            |  16 +-
 fs/smb/server/auth.c                               |   1 +
 fs/smb/server/connection.c                         |  19 +
 fs/smb/server/connection.h                         |   1 +
 fs/smb/server/mgmt/user_config.c                   |   1 +
 fs/smb/server/mgmt/user_session.c                  |  11 +
 fs/smb/server/mgmt/user_session.h                  |   1 +
 fs/smb/server/server.c                             |   4 +-
 fs/smb/server/smb2ops.c                            |  11 +-
 fs/smb/server/smb2pdu.c                            |  39 +-
 fs/smb/server/smbacl.c                             |  20 +-
 fs/smb/server/transport_ipc.c                      |  12 +
 fs/smb/server/transport_tcp.c                      |   6 +
 fs/smb/server/vfs.c                                |   3 -
 fs/smb/server/vfs_cache.c                          |  13 +-
 fs/squashfs/cache.c                                |   2 +-
 fs/tracefs/event_inode.c                           |   7 +-
 fs/ubifs/auth.c                                    |   2 +-
 fs/udf/inode.c                                     |   2 +-
 fs/udf/partition.c                                 |   2 +-
 fs/udf/super.c                                     |  23 +-
 fs/udf/symlink.c                                   |   2 +
 include/acpi/pcc.h                                 |   5 -
 include/acpi/processor.h                           |   2 +
 include/linux/bpf.h                                |   4 +-
 include/linux/efi.h                                |   4 +-
 include/linux/irq.h                                |  35 +
 include/linux/irqdomain.h                          |  46 ++
 include/linux/kprobes.h                            |   1 +
 include/linux/list.h                               |  15 +-
 include/linux/maple_tree.h                         |   2 +-
 include/linux/mfd/tps6594.h                        | 347 ++++++++-
 include/linux/netdevice.h                          |  10 +
 include/linux/nfs_xdr.h                            |   2 +-
 include/linux/nvme.h                               |  81 +++
 include/linux/of_graph.h                           |  53 +-
 include/linux/rcutiny.h                            |   2 +-
 include/linux/rcutree.h                            |   3 +-
 include/linux/remoteproc.h                         | 284 +-------
 include/linux/rsc_table.h                          | 364 ++++++++++
 include/linux/rtsx_usb.h                           |   3 +
 include/linux/sunrpc/svc_rdma_pcl.h                |   2 +-
 include/linux/usb.h                                |  29 +-
 include/linux/virtio_net.h                         |   4 +
 include/media/rc-map.h                             |   2 -
 include/net/bluetooth/hci_core.h                   |   2 +-
 include/net/bluetooth/l2cap.h                      |   5 +
 include/net/dst.h                                  |  34 +-
 include/net/inet_connection_sock.h                 |  12 +-
 include/net/inet_hashtables.h                      |   2 +-
 include/net/inetpeer.h                             |   4 +
 include/net/ip.h                                   |  11 +-
 include/net/ip_tunnels.h                           |  11 +-
 include/net/pkt_sched.h                            |   1 +
 include/net/route.h                                |   2 +-
 include/net/sctp/structs.h                         |   2 +-
 include/net/tc_act/tc_skbmod.h                     |   1 +
 include/net/tcp.h                                  |  13 +-
 include/net/xsk_buff_pool.h                        |  19 +-
 include/rdma/ib_verbs.h                            |  14 +
 include/rdma/restrack.h                            |   7 +-
 include/sound/core.h                               |   2 +
 include/uapi/linux/if_bridge.h                     |  19 +
 include/uapi/linux/if_link.h                       |   1 +
 include/uapi/linux/landlock.h                      |   1 +
 include/uapi/linux/time_types.h                    |   2 +-
 include/uapi/rdma/rdma_netlink.h                   |   8 +
 kernel/auditfilter.c                               |   6 +-
 kernel/bpf/bloom_filter.c                          |  19 +-
 kernel/bpf/cgroup.c                                |  18 +-
 kernel/bpf/net_namespace.c                         |  17 +-
 kernel/bpf/ringbuf.c                               |   2 +-
 kernel/bpf/syscall.c                               |  21 +-
 kernel/bpf/task_iter.c                             |  36 +-
 kernel/bpf/verifier.c                              |  24 +-
 kernel/cgroup/cpuset.c                             |   4 +-
 kernel/dma/swiotlb.c                               |  31 +-
 kernel/entry/common.c                              |   3 +
 kernel/futex/requeue.c                             |  12 +-
 kernel/irq/generic-chip.c                          | 147 ++--
 kernel/irq/irqdomain.c                             |  91 ++-
 kernel/kcsan/core.c                                |  12 +-
 kernel/kprobes.c                                   |  14 +-
 kernel/locking/lockdep.c                           |   2 +
 kernel/power/snapshot.c                            |   5 +-
 kernel/power/wakelock.c                            |   2 +-
 kernel/rcu/rcutorture.c                            |   4 +-
 kernel/rcu/tree.c                                  |   4 +-
 kernel/rcu/tree_nocb.h                             |   2 +-
 kernel/rcu/tree_plugin.h                           |  16 +-
 kernel/sched/cpufreq_schedutil.c                   |  17 +-
 kernel/sched/fair.c                                |  27 +-
 kernel/signal.c                                    |   4 +
 kernel/stop_machine.c                              |   2 +-
 kernel/sys.c                                       |   2 +-
 kernel/taskstats.c                                 |   3 +-
 kernel/time/clocksource.c                          |   8 +-
 kernel/time/itimer.c                               |   2 +-
 kernel/time/timekeeping.c                          |   6 +
 kernel/time/timer.c                                |   1 +
 kernel/trace/trace.c                               |  28 +-
 kernel/trace/trace.h                               |   4 +-
 kernel/trace/trace_events.c                        | 136 +++-
 kernel/trace/trace_events_hist.c                   |   4 +-
 kernel/trace/trace_events_user.c                   |   3 +
 kernel/trace/trace_mmiotrace.c                     |  24 +-
 kernel/trace/trace_osnoise.c                       |   4 +-
 lib/string.c                                       |   3 +-
 lib/test_hmm.c                                     |   2 +-
 lib/ucs2_string.c                                  |   2 +-
 lib/xarray.c                                       |   3 +
 mm/damon/core-test.h                               |  15 +-
 mm/damon/core.c                                    |  17 +-
 mm/damon/paddr.c                                   |  21 +-
 mm/damon/sysfs-schemes.c                           |  10 +-
 mm/damon/sysfs.c                                   |  19 +-
 mm/damon/vaddr-test.h                              |   5 +
 mm/damon/vaddr.c                                   |  34 +-
 mm/hugetlb.c                                       |  14 +-
 mm/kasan/quarantine.c                              |   7 +-
 mm/memcontrol.c                                    |   6 +
 mm/migrate.c                                       |   2 +-
 mm/mm_init.c                                       |   5 +-
 mm/vmscan.c                                        |   2 +-
 net/batman-adv/bridge_loop_avoidance.c             |  80 ++-
 net/batman-adv/distributed-arp-table.c             |  66 +-
 net/batman-adv/main.c                              |   4 +
 net/batman-adv/types.h                             |   2 +-
 net/bluetooth/eir.c                                |   3 +-
 net/bluetooth/hci_conn.c                           |  23 +-
 net/bluetooth/hci_core.c                           |   2 +-
 net/bluetooth/hci_event.c                          |   7 +-
 net/bluetooth/hci_sync.c                           |  14 +-
 net/bluetooth/iso.c                                |   8 +
 net/bluetooth/l2cap_sock.c                         |  36 +-
 net/bluetooth/mgmt.c                               |  27 +-
 net/bluetooth/msft.c                               |   5 +
 net/bluetooth/rfcomm/core.c                        |  12 +-
 net/bridge/br_mrp_netlink.c                        |   4 +-
 net/bridge/br_netlink_tunnel.c                     |   3 +-
 net/bridge/br_vlan.c                               |   4 +-
 net/ceph/messenger_v2.c                            |   5 +
 net/ceph/osd_client.c                              |  30 +
 net/ceph/osdmap.c                                  |   2 +
 net/core/dst.c                                     |   4 +-
 net/core/filter.c                                  |  26 +-
 net/core/lwt_bpf.c                                 |  15 +-
 net/core/net_namespace.c                           |   4 +
 net/core/skbuff.c                                  |  10 +-
 net/core/sock.c                                    |   8 +-
 net/core/xdp.c                                     |   4 +-
 net/dccp/dccp.h                                    |   4 +-
 net/dccp/ipv4.c                                    |   4 +-
 net/dccp/ipv6.c                                    |   7 +-
 net/dccp/minisocks.c                               |   2 +-
 net/hsr/hsr_device.c                               |  70 +-
 net/hsr/hsr_device.h                               |   4 +-
 net/hsr/hsr_forward.c                              |  85 ++-
 net/hsr/hsr_framereg.c                             |  52 ++
 net/hsr/hsr_framereg.h                             |   4 +
 net/hsr/hsr_main.h                                 |   7 +
 net/hsr/hsr_netlink.c                              |  30 +-
 net/hsr/hsr_slave.c                                |  23 +-
 net/ipv4/icmp.c                                    |  28 +-
 net/ipv4/igmp.c                                    |   2 +-
 net/ipv4/inet_connection_sock.c                    |   9 +
 net/ipv4/inetpeer.c                                |  38 +-
 net/ipv4/ip_fragment.c                             |   6 +-
 net/ipv4/ip_output.c                               |   4 +-
 net/ipv4/ip_tunnel.c                               |   2 +-
 net/ipv4/ip_vti.c                                  |   4 +-
 net/ipv4/ipip.c                                    |   2 +-
 net/ipv4/ipmr.c                                    |   2 +-
 net/ipv4/netfilter.c                               |   4 +-
 net/ipv4/route.c                                   |  10 +-
 net/ipv4/syncookies.c                              |   2 +-
 net/ipv4/tcp_fastopen.c                            |   6 +-
 net/ipv4/tcp_ipv4.c                                |  11 +-
 net/ipv4/tcp_metrics.c                             |   8 +-
 net/ipv4/tcp_minisocks.c                           |   2 +-
 net/ipv4/tcp_output.c                              |   2 +-
 net/ipv4/xfrm4_output.c                            |   2 +-
 net/ipv6/ip6_gre.c                                 |  14 +-
 net/ipv6/ip6_tunnel.c                              |  22 +-
 net/ipv6/route.c                                   |   2 +-
 net/ipv6/seg6_local.c                              |   9 +
 net/ipv6/sit.c                                     |   2 +-
 net/ipv6/tcp_ipv6.c                                |  97 ++-
 net/ipv6/xfrm6_input.c                             |   2 +-
 net/iucv/af_iucv.c                                 |   2 +
 net/kcm/kcmsock.c                                  |   3 +
 net/mac80211/link.c                                |   3 +-
 net/mac80211/s1g.c                                 |   2 +-
 net/mac80211/tx.c                                  |   3 +-
 net/mpls/af_mpls.c                                 |   2 +
 net/mptcp/subflow.c                                |   6 +-
 net/mptcp/syncookies.c                             |   1 +
 net/netfilter/Kconfig                              |   2 +-
 net/netfilter/ipvs/ip_vs_ftp.c                     |  10 +-
 net/netfilter/nf_nat_sip.c                         |   5 +
 net/netfilter/nf_tables_api.c                      |  14 +-
 net/netfilter/nft_counter.c                        |  20 +-
 net/netfilter/xt_cgroup.c                          |  21 +-
 net/netfilter/xt_hl.c                              |  27 +
 net/nfc/digital_core.c                             |   2 +-
 net/nfc/llcp_core.c                                |  29 +-
 net/nfc/llcp_sock.c                                |  14 +-
 net/nfc/nci/data.c                                 |  10 +-
 net/nfc/nci/rsp.c                                  |  41 +-
 net/openvswitch/conntrack.c                        | 130 ++--
 net/openvswitch/conntrack.h                        |   6 +-
 net/openvswitch/datapath.c                         |  60 +-
 net/openvswitch/datapath.h                         |  26 +-
 net/openvswitch/vport.h                            |   9 +
 net/phonet/pep.c                                   |   2 +-
 net/rds/cong.c                                     |   4 +-
 net/sched/act_skbmod.c                             |  38 +-
 net/sched/cls_api.c                                |  18 +-
 net/sched/sch_api.c                                |   7 +-
 net/sched/sch_codel.c                              |   2 +-
 net/sched/sch_fq_codel.c                           |   6 +-
 net/sched/sch_fq_pie.c                             |   3 +-
 net/sched/sch_generic.c                            |   2 +-
 net/sched/sch_hhf.c                                |   4 +
 net/sched/sch_htb.c                                |   7 +-
 net/sched/sch_sfq.c                                |   3 +-
 net/sched/sch_teql.c                               |   1 +
 net/sctp/inqueue.c                                 |   7 +-
 net/sctp/sm_sideeffect.c                           |   4 +
 net/sctp/stream.c                                  |  48 +-
 net/smc/af_smc.c                                   |  11 +-
 net/smc/smc_core.c                                 |  27 +-
 net/smc/smc_llc.c                                  |   3 +
 net/smc/smc_rx.c                                   |  11 +-
 net/smc/smc_tx.h                                   |   6 +-
 net/sunrpc/auth_gss/auth_gss.c                     |   6 +-
 net/sunrpc/auth_gss/gss_krb5_wrap.c                |  13 +-
 net/sunrpc/auth_gss/gss_rpc_upcall.c               |   6 -
 net/sunrpc/auth_gss/gss_rpc_upcall.h               |   1 -
 net/sunrpc/auth_gss/svcauth_gss.c                  |   8 +-
 net/sunrpc/cache.c                                 |   7 +-
 net/sunrpc/rpcb_clnt.c                             |   4 +
 net/sunrpc/sunrpc_syms.c                           |   1 +
 net/sunrpc/svc.c                                   |  74 +-
 net/sunrpc/xdr.c                                   |   2 +-
 net/sunrpc/xprtrdma/svc_rdma_rw.c                  |   9 +-
 net/sunrpc/xprtsock.c                              |  32 +-
 net/tls/tls_strp.c                                 |  16 +-
 net/vmw_vsock/af_vsock.c                           |   6 +-
 net/vmw_vsock/virtio_transport.c                   |   2 +-
 net/xdp/xsk.c                                      |  46 +-
 net/xdp/xsk_buff_pool.c                            |   4 +-
 net/xdp/xsk_queue.h                                |  16 +-
 net/xfrm/xfrm_output.c                             |   4 +-
 samples/ftrace/ftrace-direct-modify.c              |  12 +-
 samples/ftrace/ftrace-direct-multi-modify.c        |  12 +-
 scripts/mod/modpost.c                              |   6 +-
 scripts/tags.sh                                    |   2 +-
 security/apparmor/lib.c                            |  20 +-
 security/integrity/ima/ima_appraise.c              |   2 +
 security/landlock/errata/abi-1.h                   |  23 +
 security/landlock/fs.c                             |  40 +-
 security/smack/smack.h                             |   5 +-
 security/smack/smack_lsm.c                         |  67 +-
 security/smack/smackfs.c                           | 222 ++----
 sound/core/control.c                               | 464 +++++-------
 sound/core/control_compat.c                        |  87 +--
 sound/core/control_led.c                           |   9 +-
 sound/core/init.c                                  |   4 +-
 sound/core/pcm_native.c                            |   2 +
 sound/core/seq/seq_midi.c                          |  61 +-
 sound/core/ump_convert.c                           |   1 +
 sound/drivers/aloop.c                              | 104 ++-
 sound/drivers/mpu401/mpu401.c                      |   6 +
 sound/drivers/mts64.c                              |   6 +
 sound/drivers/portman2x4.c                         |   6 +
 sound/drivers/serial-u16550.c                      |   6 +
 sound/drivers/virmidi.c                            |   6 +
 sound/parisc/harmony.c                             |   6 +-
 sound/pci/asihpi/hpi6000.c                         |   5 +
 sound/pci/hda/hda_proc.c                           |   2 +-
 sound/pci/ice1712/ice1712.c                        |   7 +-
 sound/pci/pcxhr/pcxhr.c                            |  14 +-
 sound/pci/via82xx_modem.c                          |  26 +-
 sound/soc/amd/yc/acp6x-mach.c                      |   7 +
 sound/soc/apple/mca.c                              |   6 +-
 sound/soc/codecs/cs35l33.c                         |  14 +-
 sound/soc/codecs/cs35l34.c                         |  14 +-
 sound/soc/codecs/rt700-sdw.c                       |   6 +-
 sound/soc/fsl/fsl-asoc-card.c                      |   4 +-
 sound/soc/fsl/fsl_audmix.c                         |  24 +-
 sound/soc/fsl/mpc5200_psc_i2s.c                    |   1 +
 sound/soc/intel/atom/sst/sst_pci.c                 |   4 +-
 sound/soc/meson/meson-card-utils.c                 |  17 +-
 sound/soc/pxa/pxa-ssp.c                            |   7 +-
 sound/soc/qcom/qdsp6/q6apm.c                       |  12 +-
 sound/soc/samsung/aries_wm8994.c                   |   1 +
 sound/soc/soc-dapm.c                               |   2 +-
 sound/soc/sof/topology.c                           |  18 +-
 sound/soc/xilinx/xlnx_formatter_pcm.c              |  14 +-
 sound/usb/6fire/comm.c                             |   9 +-
 sound/usb/bcd2000/bcd2000.c                        |  11 +-
 sound/usb/midi.c                                   |   2 +
 tools/bpf/bpftool/map.c                            |  16 +-
 tools/bpf/bpftool/struct_ops.c                     |   4 +
 tools/build/Makefile.feature                       |   3 +-
 tools/build/feature/Makefile                       |   3 +
 tools/include/linux/compiler.h                     |   2 +-
 tools/include/nolibc/arch-powerpc.h                |   2 +-
 tools/lib/bpf/libbpf.c                             |   3 +-
 tools/perf/builtin-sched.c                         |  40 +-
 tools/perf/builtin-stat.c                          |   9 +-
 tools/perf/pmu-events/jevents.py                   |   5 +-
 tools/perf/pmu-events/metric.py                    |   6 +-
 .../perf/tests/shell/lib/perf_metric_validation.py | 236 ++++---
 tools/perf/tests/shell/stat_all_metrics.sh         | 167 ++++-
 tools/perf/tests/shell/stat_bpf_counters.sh        |  97 ++-
 tools/perf/tests/shell/stat_metrics_values.sh      |  11 +-
 tools/perf/ui/browsers/hists.c                     |   6 +-
 tools/perf/util/auxtrace.c                         |  15 +-
 tools/perf/util/cs-etm-decoder/cs-etm-decoder.c    |  21 +-
 tools/perf/util/cs-etm.c                           | 595 ++++++++++------
 tools/perf/util/cs-etm.h                           |   8 +-
 tools/perf/util/data-convert-json.c                |   1 +
 tools/perf/util/dso.c                              |  19 +-
 .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.c   |  47 +-
 .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.h   |  12 +
 tools/perf/util/intel-bts.c                        |   2 +-
 tools/perf/util/intel-pt.c                         |   2 +-
 tools/perf/util/machine.c                          |  37 +-
 tools/perf/util/metricgroup.c                      |   7 +-
 tools/perf/util/synthetic-events.c                 |   6 +-
 tools/perf/util/thread-stack.c                     |   2 +-
 tools/perf/util/trace-event-read.c                 |  33 +-
 tools/scripts/Makefile.include                     |  38 +-
 tools/testing/kunit/kunit.py                       |   2 +-
 tools/testing/kunit/kunit_tool_test.py             |  12 +
 .../selftests/arm64/mte/check_buffer_fill.c        |   2 +
 .../selftests/arm64/mte/check_child_memory.c       |   2 +
 .../selftests/arm64/mte/check_gcr_el1_cswitch.c    |   1 +
 .../selftests/arm64/mte/check_hugetlb_options.c    | 298 ++++++++
 .../selftests/arm64/mte/check_ksm_options.c        |  31 +-
 .../selftests/arm64/mte/check_mmap_options.c       |   2 +
 .../selftests/arm64/mte/check_tags_inclusion.c     |   2 +
 tools/testing/selftests/arm64/mte/check_user_mem.c |   2 +
 tools/testing/selftests/bpf/README.rst             |  32 +-
 .../selftests/bpf/prog_tests/global_map_resize.c   |   8 +-
 tools/testing/selftests/bpf/test_progs.c           |  11 +-
 tools/testing/selftests/bpf/test_sockmap.c         |   3 +-
 tools/testing/selftests/bpf/veristat.c             |  76 +-
 tools/testing/selftests/bpf/vmtest.sh              |  71 +-
 tools/testing/selftests/mm/Makefile                |   4 +-
 tools/testing/selftests/mm/cow.c                   | 549 +++++++++------
 tools/testing/selftests/mm/khugepaged.c            | 417 ++---------
 tools/testing/selftests/mm/ksm_tests.c             | 210 +++---
 tools/testing/selftests/mm/migration.c             | 107 +++
 tools/testing/selftests/mm/run_vmtests.sh          |   2 +
 tools/testing/selftests/mm/soft-dirty.c            |   9 +-
 tools/testing/selftests/mm/thp_settings.c          | 394 +++++++++++
 tools/testing/selftests/mm/thp_settings.h          |  89 +++
 .../selftests/rseq/rseq-x86-thread-pointer.h       |   4 +-
 tools/testing/selftests/timers/leap-a-day.c        |  19 +-
 tools/testing/selftests/zram/zram_lib.sh           |   2 +-
 1191 files changed, 17852 insertions(+), 8450 deletions(-)

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Karl Mehltretter <[email protected]>

This reverts commit 54322d95309d9aa4cb77b34ee4b6c8b541f3e21f.

The 6.6.y backport removes the clearing performed by early_pgtable_alloc(). Its replacement clears allocations made by the generic page-table walkers, but 6.6's create_idmap() still allocates an extra root level directly when a sub-48-bit VA kernel is loaded sufficiently high in physical memory.

memblock_phys_alloc_range() does not zero the returned memory. The direct caller can therefore publish an uncleared root page. A stale entry can trip the bad-descriptor BUG_ON or be followed as a page-table descriptor, preventing the kernel from booting.

Mainline is not affected because commit e6128a8e523c ("arm64: mm: Use 48-bit virtual addressing for the permanent ID map") removed the dynamic extra level before commit 0e9df1c905d8 ("arm64: mm: Don't remap pgtables for allocate vs populate") moved page-table initialization out of the allocator.

Revert the optimization in 6.6.y to restore allocation-time clearing for all callers.

---
 arch/arm64/mm/mmu.c | 58 ++++++++++++++++++++++-----------------------
 1 file changed, 29 insertions(+), 29 deletions(-)

index e075792d72257..c49cf99161881 100644
@@ -106,12 +106,28 @@ EXPORT_SYMBOL(phys_mem_access_prot);
 static phys_addr_t __init early_pgtable_alloc(int shift)
 {
 	phys_addr_t phys;
+	void *ptr;
 
 	phys = memblock_phys_alloc_range(PAGE_SIZE, PAGE_SIZE, 0,
 					 MEMBLOCK_ALLOC_NOLEAKTRACE);
 	if (!phys)
 		panic("Failed to allocate page table page\n");
 
+	/*
+	 * The FIX_{PGD,PUD,PMD} slots may be in active use, but the FIX_PTE
+	 * slot will be free, so we can (ab)use the FIX_PTE slot to initialise
+	 * any level of table.
+	 */
+	ptr = pte_set_fixmap(phys);
+
+	memset(ptr, 0, PAGE_SIZE);
+
+	/*
+	 * Implicit barriers also ensure the zeroed page is visible to the page
+	 * table walker
+	 */
+	pte_clear_fixmap();
+
 	return phys;
 }
 

@@ -153,14 +169,6 @@ bool pgattr_change_is_safe(u64 old, u64 new)
 	return ((old ^ new) & ~mask) == 0;
 }
 
-static void init_clear_pgtable(void *table)
-{
-	clear_page(table);
-
-	/* Ensure the zeroing is observed by page table walks. */
-	dsb(ishst);
-}
-
 static void init_pte(pte_t *ptep, unsigned long addr, unsigned long end,
 		     phys_addr_t phys, pgprot_t prot)
 {

@@ -203,15 +211,12 @@ static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr,
 			pmdval |= PMD_TABLE_PXN;
 		BUG_ON(!pgtable_alloc);
 		pte_phys = pgtable_alloc(PAGE_SHIFT);
-		ptep = pte_set_fixmap(pte_phys);
-		init_clear_pgtable(ptep);
-		ptep += pte_index(addr);
 		__pmd_populate(pmdp, pte_phys, pmdval);
-	} else {
-		BUG_ON(pmd_bad(pmd));
-		ptep = pte_set_fixmap_offset(pmdp, addr);
+		pmd = READ_ONCE(*pmdp);
 	}
+	BUG_ON(pmd_bad(pmd));
 
+	ptep = pte_set_fixmap_offset(pmdp, addr);
 	do {
 		pgprot_t __prot = prot;
 

@@ -290,15 +295,12 @@ static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr,
 			pudval |= PUD_TABLE_PXN;
 		BUG_ON(!pgtable_alloc);
 		pmd_phys = pgtable_alloc(PMD_SHIFT);
-		pmdp = pmd_set_fixmap(pmd_phys);
-		init_clear_pgtable(pmdp);
-		pmdp += pmd_index(addr);
 		__pud_populate(pudp, pmd_phys, pudval);
-	} else {
-		BUG_ON(pud_bad(pud));
-		pmdp = pmd_set_fixmap_offset(pudp, addr);
+		pud = READ_ONCE(*pudp);
 	}
+	BUG_ON(pud_bad(pud));
 
+	pmdp = pmd_set_fixmap_offset(pudp, addr);
 	do {
 		pgprot_t __prot = prot;
 

@@ -336,15 +338,12 @@ static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end,
 			p4dval |= P4D_TABLE_PXN;
 		BUG_ON(!pgtable_alloc);
 		pud_phys = pgtable_alloc(PUD_SHIFT);
-		pudp = pud_set_fixmap(pud_phys);
-		init_clear_pgtable(pudp);
-		pudp += pud_index(addr);
 		__p4d_populate(p4dp, pud_phys, p4dval);
-	} else {
-		BUG_ON(p4d_bad(p4d));
-		pudp = pud_set_fixmap_offset(p4dp, addr);
+		p4d = READ_ONCE(*p4dp);
 	}
+	BUG_ON(p4d_bad(p4d));
 
+	pudp = pud_set_fixmap_offset(p4dp, addr);
 	do {
 		pud_t old_pud = READ_ONCE(*pudp);
 

@@ -426,10 +425,11 @@ void create_kpti_ng_temp_pgd(pgd_t *pgdir, phys_addr_t phys, unsigned long virt,
 
 static phys_addr_t __pgd_pgtable_alloc(int shift)
 {
-	/* Page is zeroed by init_clear_pgtable() so don't duplicate effort. */
-	void *ptr = (void *)__get_free_page(GFP_PGTABLE_KERNEL & ~__GFP_ZERO);
-
+	void *ptr = (void *)__get_free_page(GFP_PGTABLE_KERNEL);
 	BUG_ON(!ptr);
+
+	/* Ensure the zeroed page is visible to the page table walker */
+	dsb(ishst);
 	return __pa(ptr);
 }
 

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 88fe14253e181878c2ddb51a298ae8c468a63010 ]

dst->dev is read locklessly in many contexts,
and written in dst_dev_put().

Fixing all the races is going to need many changes.

We probably will have to add full RCU protection.

Add three helpers to ease this painful process.

static inline struct net_device *dst_dev(const struct dst_entry *dst)

{
       return READ_ONCE(dst->dev);
}

static inline struct net_device *skb_dst_dev(const struct sk_buff *skb)

{
       return dst_dev(skb_dst(skb));
}

static inline struct net *skb_dst_dev_net(const struct sk_buff *skb)

{
       return dev_net(skb_dst_dev(skb));
}

static inline struct net *skb_dst_dev_net_rcu(const struct sk_buff *skb)

{
       return dev_net_rcu(skb_dst_dev(skb));
}

---
 include/net/dst.h | 20 ++++++++++++++++++++
 net/core/dst.c    |  4 ++--
 net/core/sock.c   |  8 ++++----
 3 files changed, 26 insertions(+), 6 deletions(-)

index 55d1be268d243..1983945dfcdf1 100644
@@ -569,6 +569,11 @@ static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu)
 		dst->ops->update_pmtu(dst, NULL, skb, mtu, false);
 }
 
+static inline struct net_device *dst_dev(const struct dst_entry *dst)
+{
+	return READ_ONCE(dst->dev);
+}
+
 static inline struct net_device *dst_dev_rcu(const struct dst_entry *dst)
 {
 	/* In the future, use rcu_dereference(dst->dev) */

@@ -576,11 +581,26 @@ static inline struct net_device *dst_dev_rcu(const struct dst_entry *dst)
 	return READ_ONCE(dst->dev);
 }
 
+static inline struct net_device *skb_dst_dev(const struct sk_buff *skb)
+{
+	return dst_dev(skb_dst(skb));
+}
+
 static inline struct net_device *skb_dst_dev_rcu(const struct sk_buff *skb)
 {
 	return dst_dev_rcu(skb_dst(skb));
 }
 
+static inline struct net *skb_dst_dev_net(const struct sk_buff *skb)
+{
+	return dev_net(skb_dst_dev(skb));
+}
+
+static inline struct net *skb_dst_dev_net_rcu(const struct sk_buff *skb)
+{
+	return dev_net_rcu(skb_dst_dev(skb));
+}
+
 struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie);
 void dst_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
 			       struct sk_buff *skb, u32 mtu, bool confirm_neigh);

index 5ed8cb10748f5..f65e6be7e2571 100644
@@ -153,7 +153,7 @@ void dst_dev_put(struct dst_entry *dst)
 		dst->ops->ifdown(dst, dev);
 	WRITE_ONCE(dst->input, dst_discard);
 	WRITE_ONCE(dst->output, dst_discard_out);
-	dst->dev = blackhole_netdev;
+	WRITE_ONCE(dst->dev, blackhole_netdev);
 	netdev_ref_replace(dev, blackhole_netdev, &dst->dev_tracker,
 			   GFP_ATOMIC);
 }

@@ -266,7 +266,7 @@ unsigned int dst_blackhole_mtu(const struct dst_entry *dst)
 {
 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
 
-	return mtu ? : dst->dev->mtu;
+	return mtu ? : dst_dev(dst)->mtu;
 }
 EXPORT_SYMBOL_GPL(dst_blackhole_mtu);
 

index 846e95805c199..2f82dc45f93ec 100644
@@ -2454,8 +2454,8 @@ static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst)
 		   !ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr));
 #endif
 	/* pairs with the WRITE_ONCE() in netif_set_gso(_ipv4)_max_size() */
-	max_size = is_ipv6 ? READ_ONCE(dst->dev->gso_max_size) :
-			READ_ONCE(dst->dev->gso_ipv4_max_size);
+	max_size = is_ipv6 ? READ_ONCE(dst_dev(dst)->gso_max_size) :
+			READ_ONCE(dst_dev(dst)->gso_ipv4_max_size);
 	if (max_size > GSO_LEGACY_MAX_SIZE && !sk_is_tcp(sk))
 		max_size = GSO_LEGACY_MAX_SIZE;
 

@@ -2466,7 +2466,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
 {
 	u32 max_segs = 1;
 
-	sk->sk_route_caps = dst->dev->features;
+	sk->sk_route_caps = dst_dev(dst)->features;
 	if (sk_is_tcp(sk))
 		sk->sk_route_caps |= NETIF_F_GSO;
 	if (sk->sk_route_caps & NETIF_F_GSO)

@@ -2480,7 +2480,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
 			sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
 			sk->sk_gso_max_size = sk_dst_gso_max_size(sk, dst);
 			/* pairs with the WRITE_ONCE() in netif_set_gso_max_segs() */
-			max_segs = max_t(u32, READ_ONCE(dst->dev->gso_max_segs), 1);
+			max_segs = max_t(u32, READ_ONCE(dst_dev(dst)->gso_max_segs), 1);
 		}
 	}
 	sk->sk_gso_max_segs = max_segs;

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit a74fc62eec155ca5a6da8ff3856f3dc87fe24558 ]

Use the new helpers as a first step to deal with
potential dst->dev races.

---
 include/net/inet_hashtables.h |  2 +-
 include/net/ip.h              | 11 ++++++-----
 include/net/route.h           |  2 +-
 net/ipv4/icmp.c               | 24 +++++++++++++-----------
 net/ipv4/igmp.c               |  2 +-
 net/ipv4/ip_fragment.c        |  2 +-
 net/ipv4/ip_output.c          |  4 ++--
 net/ipv4/ip_vti.c             |  4 ++--
 net/ipv4/netfilter.c          |  4 ++--
 net/ipv4/route.c              |  8 ++++----
 net/ipv4/tcp_fastopen.c       |  4 +++-
 net/ipv4/tcp_ipv4.c           |  3 ++-
 net/ipv4/tcp_metrics.c        |  8 ++++----
 net/ipv4/xfrm4_output.c       |  2 +-
 14 files changed, 43 insertions(+), 37 deletions(-)

index 8eeb3708f20ba..21119e962f00f 100644
@@ -511,7 +511,7 @@ static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo,
 					     const int sdif,
 					     bool *refcounted)
 {
-	struct net *net = dev_net(skb_dst(skb)->dev);
+	struct net *net = skb_dst_dev_net(skb);
 	const struct iphdr *iph = ip_hdr(skb);
 	struct sock *sk;
 

index bacdb4fecc89b..f66dd581ba839 100644
@@ -458,7 +458,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
 						    bool forwarding)
 {
 	const struct rtable *rt = container_of(dst, struct rtable, dst);
-	struct net *net = dev_net(dst->dev);
+	struct net *net = dev_net(dst_dev(dst));
 	unsigned int mtu;
 
 	if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) ||

@@ -474,7 +474,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
 	if (mtu)
 		goto out;
 
-	mtu = READ_ONCE(dst->dev->mtu);
+	mtu = READ_ONCE(dst_dev(dst)->mtu);
 
 	if (unlikely(ip_mtu_locked(dst))) {
 		if (rt->rt_uses_gateway && mtu > 576)

@@ -490,16 +490,17 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
 static inline unsigned int ip_skb_dst_mtu(struct sock *sk,
 					  const struct sk_buff *skb)
 {
+	const struct dst_entry *dst = skb_dst(skb);
 	unsigned int mtu;
 
 	if (!sk || !sk_fullsock(sk) || ip_sk_use_pmtu(sk)) {
 		bool forwarding = IPCB(skb)->flags & IPSKB_FORWARDED;
 
-		return ip_dst_mtu_maybe_forward(skb_dst(skb), forwarding);
+		return ip_dst_mtu_maybe_forward(dst, forwarding);
 	}
 
-	mtu = min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU);
-	return mtu - lwtunnel_headroom(skb_dst(skb)->lwtstate, mtu);
+	mtu = min(READ_ONCE(dst_dev(dst)->mtu), IP_MAX_MTU);
+	return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
 }
 
 struct dst_metrics *ip_fib_metrics_init(struct nlattr *fc_mx, int fc_mx_len,

index 1d5d975c1707f..d443de683628e 100644
@@ -359,7 +359,7 @@ static inline int ip4_dst_hoplimit(const struct dst_entry *dst)
 		const struct net *net;
 
 		rcu_read_lock();
-		net = dev_net_rcu(dst->dev);
+		net = dev_net_rcu(dst_dev(dst));
 		hoplimit = READ_ONCE(net->ipv4.sysctl_ip_default_ttl);
 		rcu_read_unlock();
 	}

index 7c4c7b7fe3846..f0c8c3366740a 100644
@@ -313,18 +313,20 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
 {
 	struct dst_entry *dst = &rt->dst;
 	struct inet_peer *peer;
+	struct net_device *dev;
 	bool rc = true;
 
 	if (!apply_ratelimit)
 		return true;
 
 	/* No rate limit on loopback */
-	if (dst->dev && (dst->dev->flags&IFF_LOOPBACK))
+	dev = dst_dev(dst);
+	if (dev && (dev->flags & IFF_LOOPBACK))
 		goto out;
 
 	rcu_read_lock();
 	peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr,
-			       l3mdev_master_ifindex_rcu(dst->dev));
+			       l3mdev_master_ifindex_rcu(dev));
 	rc = inet_peer_xrlim_allow(peer,
 				   READ_ONCE(net->ipv4.sysctl_icmp_ratelimit));
 	rcu_read_unlock();

@@ -472,13 +474,13 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
  */
 static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb)
 {
-	struct net_device *route_lookup_dev = NULL;
+	struct net_device *dev = skb->dev;
+	const struct dst_entry *dst;
 
-	if (skb->dev)
-		route_lookup_dev = skb->dev;
-	else if (skb_dst(skb))
-		route_lookup_dev = skb_dst(skb)->dev;
-	return route_lookup_dev;
+	if (dev)
+		return dev;
+	dst = skb_dst(skb);
+	return dst ? dst_dev(dst) : NULL;
 }
 
 static struct rtable *icmp_route_lookup(struct net *net, struct flowi4 *fl4,

@@ -911,7 +913,7 @@ static enum skb_drop_reason icmp_unreach(struct sk_buff *skb)
 	struct net *net;
 	u32 info = 0;
 
-	net = dev_net_rcu(skb_dst(skb)->dev);
+	net = skb_dst_dev_net_rcu(skb);
 
 	/*
 	 *	Incomplete header ?

@@ -1054,7 +1056,7 @@ static enum skb_drop_reason icmp_echo(struct sk_buff *skb)
 	struct icmp_bxm icmp_param;
 	struct net *net;
 
-	net = dev_net_rcu(skb_dst(skb)->dev);
+	net = skb_dst_dev_net_rcu(skb);
 	/* should there be an ICMP stat for ignored echos? */
 	if (READ_ONCE(net->ipv4.sysctl_icmp_echo_ignore_all))
 		return SKB_NOT_DROPPED_YET;

@@ -1231,7 +1233,7 @@ static enum skb_drop_reason icmp_timestamp(struct sk_buff *skb)
 	return SKB_NOT_DROPPED_YET;
 
 out_err:
-	__ICMP_INC_STATS(dev_net_rcu(skb_dst(skb)->dev), ICMP_MIB_INERRORS);
+	__ICMP_INC_STATS(skb_dst_dev_net_rcu(skb), ICMP_MIB_INERRORS);
 	return SKB_DROP_REASON_PKT_TOO_SMALL;
 }
 

index 732804f3a0aa3..8509e94738344 100644
@@ -428,7 +428,7 @@ static int igmpv3_sendpack(struct sk_buff *skb)
 
 	pig->csum = ip_compute_csum(igmp_hdr(skb), igmplen);
 
-	return ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb);
+	return ip_local_out(skb_dst_dev_net(skb), skb->sk, skb);
 }
 
 static int grec_size(struct ip_mc_list *pmc, int type, int gdel, int sdel)

index 8524f2ac2cf3a..46b84d029205b 100644
@@ -470,7 +470,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
 /* Process an incoming IP datagram fragment. */
 int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)
 {
-	struct net_device *dev = skb->dev ? : skb_dst(skb)->dev;
+	struct net_device *dev = skb->dev ? : skb_dst_dev(skb);
 	int vif = l3mdev_master_ifindex_rcu(dev);
 	struct ipq *qp;
 

index 150cdea8aacbe..3bb198b2c101c 100644
@@ -116,7 +116,7 @@ int __ip_local_out(struct net *net, struct sock *sk, struct sk_buff *skb)
 	skb->protocol = htons(ETH_P_IP);
 
 	return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT,
-		       net, sk, skb, NULL, skb_dst(skb)->dev,
+		       net, sk, skb, NULL, skb_dst_dev(skb),
 		       dst_output);
 }
 

@@ -199,7 +199,7 @@ static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *s
 {
 	struct dst_entry *dst = skb_dst(skb);
 	struct rtable *rt = (struct rtable *)dst;
-	struct net_device *dev = dst->dev;
+	struct net_device *dev = dst_dev(dst);
 	unsigned int hh_len = LL_RESERVED_SPACE(dev);
 	struct neighbour *neigh;
 	bool is_v6gw = false;

index 02744447e4355..cd61a417c44d9 100644
@@ -226,7 +226,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
 		goto tx_error_icmp;
 	}
 
-	tdev = dst->dev;
+	tdev = dst_dev(dst);
 
 	if (tdev == dev) {
 		dst_release(dst);

@@ -256,7 +256,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
 xmit:
 	skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
 	skb_dst_set(skb, dst);
-	skb->dev = skb_dst(skb)->dev;
+	skb->dev = skb_dst_dev(skb);
 
 	err = dst_output(tunnel->net, skb->sk, skb);
 	if (net_xmit_eval(err) == 0)

index bd135165482aa..c450509d6efde 100644
@@ -19,12 +19,12 @@
 /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
 int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb, unsigned int addr_type)
 {
+	struct net_device *dev = skb_dst_dev(skb);
 	const struct iphdr *iph = ip_hdr(skb);
 	struct rtable *rt;
 	struct flowi4 fl4 = {};
 	__be32 saddr = iph->saddr;
 	__u8 flags;
-	struct net_device *dev = skb_dst(skb)->dev;
 	struct flow_keys flkeys;
 	unsigned int hh_len;
 

@@ -73,7 +73,7 @@ int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb, un
 #endif
 
 	/* Change in oif may mean change in hh_len. */
-	hh_len = skb_dst(skb)->dev->hard_header_len;
+	hh_len = skb_dst_dev(skb)->hard_header_len;
 	if (skb_headroom(skb) < hh_len &&
 	    pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
 				0, GFP_ATOMIC))

index 789953096c80d..5010a9a754187 100644
@@ -416,7 +416,7 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
 					   const void *daddr)
 {
 	const struct rtable *rt = container_of(dst, struct rtable, dst);
-	struct net_device *dev = dst->dev;
+	struct net_device *dev = dst_dev(dst);
 	struct neighbour *n;
 
 	rcu_read_lock();

@@ -443,7 +443,7 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
 static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *daddr)
 {
 	const struct rtable *rt = container_of(dst, struct rtable, dst);
-	struct net_device *dev = dst->dev;
+	struct net_device *dev = dst_dev(dst);
 	const __be32 *pkey = daddr;
 
 	if (rt->rt_gw_family == AF_INET) {

@@ -1069,7 +1069,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
 		return;
 
 	rcu_read_lock();
-	net = dev_net_rcu(dst->dev);
+	net = dev_net_rcu(dst_dev(dst));
 	if (mtu < net->ipv4.ip_rt_min_pmtu) {
 		lock = true;
 		mtu = min(old_mtu, net->ipv4.ip_rt_min_pmtu);

@@ -1367,7 +1367,7 @@ static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
 	struct net *net;
 
 	rcu_read_lock();
-	net = dev_net_rcu(dst->dev);
+	net = dev_net_rcu(dst_dev(dst));
 	advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
 				   net->ipv4.ip_rt_min_advmss);
 	rcu_read_unlock();

index 408985eb74eef..86c995dc1c5e5 100644
@@ -558,6 +558,7 @@ bool tcp_fastopen_active_should_disable(struct sock *sk)
 void tcp_fastopen_active_disable_ofo_check(struct sock *sk)
 {
 	struct tcp_sock *tp = tcp_sk(sk);
+	struct net_device *dev;
 	struct dst_entry *dst;
 	struct sk_buff *skb;
 

@@ -575,7 +576,8 @@ void tcp_fastopen_active_disable_ofo_check(struct sock *sk)
 	} else if (tp->syn_fastopen_ch &&
 		   atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times)) {
 		dst = sk_dst_get(sk);
-		if (!(dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK)))
+		dev = dst ? dst_dev(dst) : NULL;
+		if (!(dev && (dev->flags & IFF_LOOPBACK)))
 			atomic_set(&sock_net(sk)->ipv4.tfo_active_disable_times, 0);
 		dst_release(dst);
 	}

index 3f9e1cfde0083..3055478860c19 100644
@@ -732,7 +732,8 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)
 	arg.iov[0].iov_base = (unsigned char *)&rep;
 	arg.iov[0].iov_len  = sizeof(rep.th);
 
-	net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
+	net = sk ? sock_net(sk) : skb_dst_dev_net(skb);
+
 #ifdef CONFIG_TCP_MD5SIG
 	rcu_read_lock();
 	hash_location = tcp_parse_md5sig_option(th);

index e0883ba709b0b..49983d864e4f3 100644
@@ -166,11 +166,11 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
 					  unsigned int hash)
 {
 	struct tcp_metrics_block *tm;
-	struct net *net;
 	bool reclaim = false;
+	struct net *net;
 
 	spin_lock_bh(&tcp_metrics_lock);
-	net = dev_net(dst->dev);
+	net = dev_net(dst_dev(dst));
 
 	/* While waiting for the spin-lock the cache might have been populated
 	 * with this entry and so we have to check again.

@@ -273,7 +273,7 @@ static struct tcp_metrics_block *__tcp_get_metrics_req(struct request_sock *req,
 		return NULL;
 	}
 
-	net = dev_net(dst->dev);
+	net = dev_net(dst_dev(dst));
 	hash ^= net_hash_mix(net);
 	hash = hash_32(hash, tcp_metrics_hash_log);
 

@@ -318,7 +318,7 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
 	else
 		return NULL;
 
-	net = dev_net(dst->dev);
+	net = dev_net(dst_dev(dst));
 	hash ^= net_hash_mix(net);
 	hash = hash_32(hash, tcp_metrics_hash_log);
 

index 3cff51ba72bb0..0ae67d537499a 100644
@@ -31,7 +31,7 @@ static int __xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
 	return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
-			    net, sk, skb, skb->dev, skb_dst(skb)->dev,
+			    net, sk, skb, skb->dev, skb_dst_dev(skb),
 			    __xfrm4_output,
 			    !(IPCB(skb)->flags & IPSKB_REROUTED));
 }

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit caedcc5b6df1b2e2b5f39079e3369c1d4d5c5f50 ]

Followup of commit 88fe14253e18 ("net: dst: add four helpers to annotate data-races around dst->dev").

We want to gradually add explicit RCU protection to dst->dev, including lockdep support.

Add an union to alias dst->dev_rcu and dst->dev.

Add dst_dev_net_rcu() helper.

---
 include/net/dst.h | 16 +++++++++++-----
 net/core/dst.c    |  2 +-
 net/ipv4/route.c  |  4 ++--
 3 files changed, 14 insertions(+), 8 deletions(-)

index 1983945dfcdf1..4b54b2f6730ef 100644
@@ -24,7 +24,10 @@
 struct sk_buff;
 
 struct dst_entry {
-	struct net_device       *dev;
+	union {
+		struct net_device       *dev;
+		struct net_device __rcu *dev_rcu;
+	};
 	struct  dst_ops	        *ops;
 	unsigned long		_metrics;
 	unsigned long           expires;

@@ -576,9 +579,12 @@ static inline struct net_device *dst_dev(const struct dst_entry *dst)
 
 static inline struct net_device *dst_dev_rcu(const struct dst_entry *dst)
 {
-	/* In the future, use rcu_dereference(dst->dev) */
-	WARN_ON_ONCE(!rcu_read_lock_held());
-	return READ_ONCE(dst->dev);
+	return rcu_dereference(dst->dev_rcu);
+}
+
+static inline struct net *dst_dev_net_rcu(const struct dst_entry *dst)
+{
+	return dev_net_rcu(dst_dev_rcu(dst));
 }
 
 static inline struct net_device *skb_dst_dev(const struct sk_buff *skb)

@@ -598,7 +604,7 @@ static inline struct net *skb_dst_dev_net(const struct sk_buff *skb)
 
 static inline struct net *skb_dst_dev_net_rcu(const struct sk_buff *skb)
 {
-	return dev_net_rcu(skb_dst_dev(skb));
+	return dev_net_rcu(skb_dst_dev_rcu(skb));
 }
 
 struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie);

index f65e6be7e2571..46cafba29991c 100644
@@ -153,7 +153,7 @@ void dst_dev_put(struct dst_entry *dst)
 		dst->ops->ifdown(dst, dev);
 	WRITE_ONCE(dst->input, dst_discard);
 	WRITE_ONCE(dst->output, dst_discard_out);
-	WRITE_ONCE(dst->dev, blackhole_netdev);
+	rcu_assign_pointer(dst->dev_rcu, blackhole_netdev);
 	netdev_ref_replace(dev, blackhole_netdev, &dst->dev_tracker,
 			   GFP_ATOMIC);
 }

index 5010a9a754187..ce3397583b8fe 100644
@@ -1069,7 +1069,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
 		return;
 
 	rcu_read_lock();
-	net = dev_net_rcu(dst_dev(dst));
+	net = dst_dev_net_rcu(dst);
 	if (mtu < net->ipv4.ip_rt_min_pmtu) {
 		lock = true;
 		mtu = min(old_mtu, net->ipv4.ip_rt_min_pmtu);

@@ -1367,7 +1367,7 @@ static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
 	struct net *net;
 
 	rcu_read_lock();
-	net = dev_net_rcu(dst_dev(dst));
+	net = dst_dev_net_rcu(dst);
 	advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
 				   net->ipv4.ip_rt_min_advmss);
 	rcu_read_unlock();

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8 ]

Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.

Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(), ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().

---
 net/ipv4/icmp.c        | 6 +++---
 net/ipv4/ip_fragment.c | 6 ++++--
 net/ipv4/ipmr.c        | 2 +-
 net/ipv4/route.c       | 4 ++--
 4 files changed, 10 insertions(+), 8 deletions(-)

index f0c8c3366740a..5c38af80bc14e 100644
@@ -320,17 +320,17 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
 		return true;
 
 	/* No rate limit on loopback */
-	dev = dst_dev(dst);
+	rcu_read_lock();
+	dev = dst_dev_rcu(dst);
 	if (dev && (dev->flags & IFF_LOOPBACK))
 		goto out;
 
-	rcu_read_lock();
 	peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr,
 			       l3mdev_master_ifindex_rcu(dev));
 	rc = inet_peer_xrlim_allow(peer,
 				   READ_ONCE(net->ipv4.sysctl_icmp_ratelimit));
-	rcu_read_unlock();
 out:
+	rcu_read_unlock();
 	if (!rc)
 		__ICMP_INC_STATS(net, ICMP_MIB_RATELIMITHOST);
 	else

index 46b84d029205b..e79ebe911548a 100644
@@ -470,14 +470,16 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
 /* Process an incoming IP datagram fragment. */
 int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)
 {
-	struct net_device *dev = skb->dev ? : skb_dst_dev(skb);
-	int vif = l3mdev_master_ifindex_rcu(dev);
+	struct net_device *dev;
 	struct ipq *qp;
+	int vif;
 
 	__IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS);
 
 	/* Lookup (or create) queue header */
 	rcu_read_lock();
+	dev = skb->dev ? : skb_dst_dev_rcu(skb);
+	vif = l3mdev_master_ifindex_rcu(dev);
 	qp = ip_find(net, ip_hdr(skb), user, vif);
 	if (qp) {
 		int ret, refs = 0;

index af9412a507cf3..f39cd565569a5 100644
@@ -1893,7 +1893,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
 			goto out_free;
 	}
 
-	dev = rt->dst.dev;
+	dev = dst_dev_rcu(&rt->dst);
 
 	if (skb->len+encap > dst_mtu(&rt->dst) && (ntohs(iph->frag_off) & IP_DF)) {
 		/* Do not fragment multicasts. Alas, IPv4 does not

index ce3397583b8fe..b175a8292eb3a 100644
@@ -416,11 +416,11 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
 					   const void *daddr)
 {
 	const struct rtable *rt = container_of(dst, struct rtable, dst);
-	struct net_device *dev = dst_dev(dst);
+	struct net_device *dev;
 	struct neighbour *n;
 
 	rcu_read_lock();
-
+	dev = dst_dev_rcu(dst);
 	if (likely(rt->rt_gw_family == AF_INET)) {
 		n = ip_neigh_gw4(dev, rt->rt_gw4);
 	} else if (rt->rt_gw_family == AF_INET6) {

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

[ Upstream commit 826af7fa62e347464b1b4e0ba2fe19a92438084f ]

The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are performed outside the cable lock, this may result in UAF when a program attempts to trigger frequently while opening/closing the tied stream, as spotted by fuzzers.

For addressing the UAF, this patch changes two things:
- It covers the most of code in loopback_check_format() with cable->lock spinlock, and add the proper NULL checks. This avoids already some racy accesses.
- In addition, now we try to check the state of the capture PCM stream that may be stopped in this function, which was the major pain point leading to UAF.

[ Karl Mehltretter: dropped the access-mode comparison and notification
(462494565c27, e299a9fd433f, cdac6e1f7164). ]

---
 sound/drivers/aloop.c | 58 +++++++++++++++++++++++++------------------
 1 file changed, 34 insertions(+), 24 deletions(-)

index a38e602b4fc60..67bbadcec02b0 100644
@@ -319,35 +319,41 @@ static int loopback_snd_timer_close_cable(struct loopback_pcm *dpcm)
 
 static int loopback_check_format(struct loopback_cable *cable, int stream)
 {
+	struct loopback_pcm *dpcm_play, *dpcm_capt;
 	struct snd_pcm_runtime *runtime, *cruntime;
 	struct loopback_setup *setup;
 	struct snd_card *card;
+	bool stop_capture = false;
 	int check;
 
-	if (cable->valid != CABLE_VALID_BOTH) {
-		if (stream == SNDRV_PCM_STREAM_PLAYBACK)
-			goto __notify;
-		return 0;
-	}
-	runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->
-							substream->runtime;
-	cruntime = cable->streams[SNDRV_PCM_STREAM_CAPTURE]->
-							substream->runtime;
-	check = runtime->format != cruntime->format ||
-		runtime->rate != cruntime->rate ||
-		runtime->channels != cruntime->channels;
-	if (!check)
-		return 0;
-	if (stream == SNDRV_PCM_STREAM_CAPTURE) {
-		return -EIO;
-	} else {
-		snd_pcm_stop(cable->streams[SNDRV_PCM_STREAM_CAPTURE]->
-					substream, SNDRV_PCM_STATE_DRAINING);
-	      __notify:
-		runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->
-							substream->runtime;
-		setup = get_setup(cable->streams[SNDRV_PCM_STREAM_PLAYBACK]);
-		card = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->loopback->card;
+	scoped_guard(spinlock_irqsave, &cable->lock) {
+		dpcm_play = cable->streams[SNDRV_PCM_STREAM_PLAYBACK];
+		dpcm_capt = cable->streams[SNDRV_PCM_STREAM_CAPTURE];
+
+		if (cable->valid != CABLE_VALID_BOTH) {
+			if (stream == SNDRV_PCM_STREAM_CAPTURE || !dpcm_play)
+				return 0;
+		} else {
+			if (!dpcm_play || !dpcm_capt)
+				return -EIO;
+			runtime = dpcm_play->substream->runtime;
+			cruntime = dpcm_capt->substream->runtime;
+			if (!runtime || !cruntime)
+				return -EIO;
+			check = runtime->format != cruntime->format ||
+				runtime->rate != cruntime->rate ||
+				runtime->channels != cruntime->channels;
+			if (!check)
+				return 0;
+			if (stream == SNDRV_PCM_STREAM_CAPTURE)
+				return -EIO;
+			else if (cruntime->state == SNDRV_PCM_STATE_RUNNING)
+				stop_capture = true;
+		}
+
+		setup = get_setup(dpcm_play);
+		card = dpcm_play->loopback->card;
+		runtime = dpcm_play->substream->runtime;
 		if (setup->format != runtime->format) {
 			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
 							&setup->format_id);

@@ -364,6 +370,10 @@ static int loopback_check_format(struct loopback_cable *cable, int stream)
 			setup->channels = runtime->channels;
 		}
 	}
+
+	if (stop_capture)
+		snd_pcm_stop(dpcm_capt->substream, SNDRV_PCM_STATE_DRAINING);
+
 	return 0;
 }
 

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Cássio Gabriel <[email protected]>

[ Upstream commit e5c33cdc6f402eab8abd36ecf436b22c9d3a8aff ]

loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved the peer lookup under cable->lock, but the actual snd_pcm_stop() still runs after dropping that lock.

A concurrent close can clear the capture entry from cable->streams[] and detach or free its runtime while the playback trigger path still holds a stale peer substream pointer.

Keep a per-cable count of in-flight peer stops before dropping cable->lock, and make free_cable() wait for those stops before detaching the runtime. This preserves the existing behavior while making the peer runtime lifetime explicit.

[ Karl Mehltretter: 6.12.y commit 03f52a9c1704 applies to 6.1.y/6.6.y
unchanged; identical patch-id. ]

---
 sound/drivers/aloop.c | 44 +++++++++++++++++++++++++++++--------------
 1 file changed, 30 insertions(+), 14 deletions(-)

index 67bbadcec02b0..64870381d66ec 100644
@@ -98,6 +98,9 @@ struct loopback_ops {
 struct loopback_cable {
 	spinlock_t lock;
 	struct loopback_pcm *streams[2];
+	/* in-flight peer stops running outside cable->lock */
+	atomic_t stop_count;
+	wait_queue_head_t stop_wait;
 	struct snd_pcm_hardware hw;
 	/* flags */
 	unsigned int valid;

@@ -347,8 +350,11 @@ static int loopback_check_format(struct loopback_cable *cable, int stream)
 				return 0;
 			if (stream == SNDRV_PCM_STREAM_CAPTURE)
 				return -EIO;
-			else if (cruntime->state == SNDRV_PCM_STATE_RUNNING)
+			else if (cruntime->state == SNDRV_PCM_STATE_RUNNING) {
+				/* close must not free the peer runtime below */
+				atomic_inc(&cable->stop_count);
 				stop_capture = true;
+			}
 		}
 
 		setup = get_setup(dpcm_play);

@@ -371,8 +377,11 @@ static int loopback_check_format(struct loopback_cable *cable, int stream)
 		}
 	}
 
-	if (stop_capture)
+	if (stop_capture) {
 		snd_pcm_stop(dpcm_capt->substream, SNDRV_PCM_STATE_DRAINING);
+		if (atomic_dec_and_test(&cable->stop_count))
+			wake_up(&cable->stop_wait);
+	}
 
 	return 0;
 }

@@ -1004,24 +1013,29 @@ static void free_cable(struct snd_pcm_substream *substream)
 	struct loopback *loopback = substream->private_data;
 	int dev = get_cable_index(substream);
 	struct loopback_cable *cable;
+	struct loopback_pcm *dpcm;
+	bool other_alive;
 
 	cable = loopback->cables[substream->number][dev];
 	if (!cable)
 		return;
-	if (cable->streams[!substream->stream]) {
-		/* other stream is still alive */
-		spin_lock_irq(&cable->lock);
-		cable->streams[substream->stream] = NULL;
-		spin_unlock_irq(&cable->lock);
-	} else {
-		struct loopback_pcm *dpcm = substream->runtime->private_data;
 
-		if (cable->ops && cable->ops->close_cable && dpcm)
-			cable->ops->close_cable(dpcm);
-		/* free the cable */
-		loopback->cables[substream->number][dev] = NULL;
-		kfree(cable);
+	scoped_guard(spinlock_irq, &cable->lock) {
+		cable->streams[substream->stream] = NULL;
+		other_alive = cable->streams[!substream->stream];
 	}
+
+	/* Pair with the stop_count increment in loopback_check_format(). */
+	wait_event(cable->stop_wait, !atomic_read(&cable->stop_count));
+	if (other_alive)
+		return;
+
+	dpcm = substream->runtime->private_data;
+	if (cable->ops && cable->ops->close_cable && dpcm)
+		cable->ops->close_cable(dpcm);
+	/* free the cable */
+	loopback->cables[substream->number][dev] = NULL;
+	kfree(cable);
 }
 
 static int loopback_jiffies_timer_open(struct loopback_pcm *dpcm)

@@ -1216,6 +1230,8 @@ static int loopback_open(struct snd_pcm_substream *substream)
 			goto unlock;
 		}
 		spin_lock_init(&cable->lock);
+		atomic_set(&cable->stop_count, 0);
+		init_waitqueue_head(&cable->stop_wait);
 		cable->hw = loopback_pcm_hardware;
 		if (loopback->timer_source)
 			cable->ops = &loopback_snd_timer_ops;

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zide Chen <[email protected]>

[ Upstream commit a16d1ec4dd0cdcf689f324adde6067083bce9099 ]

In snbep_pci2phy_map_init(), in the nr_node_ids > 8 path, uncore_device_to_die() may return -1 when all CPUs associated with the UBOX device are offline.

Remove the WARN_ON_ONCE(die_id == -1) check for two reasons:

- The current code breaks out of the loop. This is incorrect because pci_get_device() does not guarantee iteration in domain or bus order, so additional UBOX devices may be skipped during the scan.

- Returning -EINVAL is incorrect, since marking offline buses with die_id == -1 is expected and should not be treated as an error.

Separately, when NUMA is disabled on a NUMA-capable platform, pcibus_to_node() returns NUMA_NO_NODE, causing uncore_device_to_die() to return -1 for all PCI devices. As a result, spr_update_device_location(), used on Intel SPR and EMR, ignores the corresponding PMON units and does not add them to the RB tree.

Fix this by using uncore_pcibus_to_dieid(), which retrieves topology from the UBOX GIDNIDMAP register and works regardless of whether NUMA is enabled in Linux. This requires snbep_pci2phy_map_init() to be added in spr_uncore_pci_init().

Keep uncore_device_to_die() only for the nr_node_ids > 8 case, where NUMA is expected to be enabled.

---
 arch/x86/events/intel/uncore.c       |  1 +
 arch/x86/events/intel/uncore_snbep.c | 13 ++++++-------
 2 files changed, 7 insertions(+), 7 deletions(-)

index 69043e02e8a7d..42dba09461dae 100644
@@ -65,6 +65,7 @@ int uncore_die_to_segment(int die)
 	return bus ? pci_domain_nr(bus) : -EINVAL;
 }
 
+/* Note: This API can only be used when NUMA information is available. */
 int uncore_device_to_die(struct pci_dev *dev)
 {
 	int node = pcibus_to_node(dev->bus);

index 091ed4651471e..f6e42926b3f29 100644
@@ -1465,13 +1465,7 @@ static int snbep_pci2phy_map_init(int devid, int nodeid_loc, int idmap_loc, bool
 			}
 
 			map->pbus_to_dieid[bus] = die_id = uncore_device_to_die(ubox_dev);
-
 			raw_spin_unlock(&pci2phy_map_lock);
-
-			if (WARN_ON_ONCE(die_id == -1)) {
-				err = -EINVAL;
-				break;
-			}
 		}
 	}
 

@@ -6445,7 +6439,7 @@ static void spr_update_device_location(int type_id)
 		if (devfn != dev->devfn)
 			continue;
 
-		die = uncore_device_to_die(dev);
+		die = uncore_pcibus_to_dieid(dev->bus);
 		if (die < 0)
 			continue;
 

@@ -6460,6 +6454,11 @@ static void spr_update_device_location(int type_id)
 
 int spr_uncore_pci_init(void)
 {
+	int ret = snbep_pci2phy_map_init(0x3250, SKX_CPUNODEID, SKX_GIDNIDMAP, true);
+
+	if (ret)
+		return ret;
+
 	/*
 	 * The discovery table of UPI on some SPR variant is broken,
 	 * which impacts the detection of both UPI and M3UPI uncore PMON.

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Matt Turner <[email protected]>

commit 49672d026cc4773608e1222b69b29fd70f41336b upstream.

ieee_swcr_to_fpcr() converts the software IEEE trap-enable and status bits kept in thread_info.ieee_state into the hardware FPCR format. It contained:

	fp |= (~sw & IEEE_TRAP_ENABLE_DNO) << 41;

FPCR_DNOD (bit 47) disables denormal operand traps: with it set the hardware handles a denormal operand itself, treating it as zero, instead of trapping for software completion. The intent was to set DNOD when the user has not asked for SIGFPE on denormal operands, but IEEE_TRAP_ENABLE_DNO is clear by default, so ieee_swcr_to_fpcr(0) always set DNOD.

Instructions built with the software completion suffix therefore never trapped on a denormal operand. The hardware silently substituted zero and produced wrong results, affecting every program compiled with -mieee and default FPU settings, glibc included.

Set FPCR_DNOD only when IEEE_MAP_DMZ is requested, which is exactly the case where flushing denormal inputs to zero is what the user asked for. DNOD then encodes MAP_DMZ, which ieee_fpcr_to_swcr() already recovers from FPCR_DNZ, so drop its attempt to recover IEEE_TRAP_ENABLE_DNO from DNOD; the DNO trap enable lives solely in ieee_state.

Both functions are in a uapi header, so the encoding change is visible to userspace, but nothing outside the kernel is known to depend on DNOD carrying the DNO trap enable, and the kernel is the only writer of the FPCR.

This must not be backported on its own. Re-enabling denormal operand traps exposes a second bug, fixed in the following patch: those traps usually find an exact result, and for an exact result the emulator did not write the FPCR back, leaving hardware-fabricated exception bits visible to user space. Taken alone this change would make spurious exception flags more common.

The bug predates the git history, so there is no commit to reference in a Fixes tag.

---
 arch/alpha/include/uapi/asm/fpu.h |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

@@ -101,7 +101,12 @@ ieee_swcr_to_fpcr(unsigned long sw)
 		      | IEEE_TRAP_ENABLE_OVF)) << 48;
 	fp |= (~sw & (IEEE_TRAP_ENABLE_UNF | IEEE_TRAP_ENABLE_INE)) << 57;
 	fp |= (sw & IEEE_MAP_UMZ ? FPCR_UNDZ | FPCR_UNFD : 0);
-	fp |= (~sw & IEEE_TRAP_ENABLE_DNO) << 41;
+	/*
+	 * Disable denormal operand traps only when denormal inputs are to be
+	 * flushed to zero.  Otherwise they must keep trapping, so that /S
+	 * instructions reach the kernel emulation handler.
+	 */
+	fp |= (sw & IEEE_MAP_DMZ ? FPCR_DNOD : 0);
 	return fp;
 }
 

@@ -116,7 +121,6 @@ ieee_fpcr_to_swcr(unsigned long fp)
 			     | IEEE_TRAP_ENABLE_OVF);
 	sw |= (~fp >> 57) & (IEEE_TRAP_ENABLE_UNF | IEEE_TRAP_ENABLE_INE);
 	sw |= (fp >> 47) & IEEE_MAP_UMZ;
-	sw |= (~fp >> 41) & IEEE_TRAP_ENABLE_DNO;
 	return sw;
 }