6.12.111-rc1 review

This is the start of the stable review cycle for the 6.12.111 release. There are 1102 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 19 Sep 2026 15:13:49 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.111-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.12.111-rc1

Vincent Guittot <[email protected]>
sched/eevdf: Fix augmented max_slice

Ameer Hamza <[email protected]>
SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode

Mallesh Koujalagi <[email protected]>
workqueue: Update documentation as per system_percpu_wq naming

Kevin Hao <[email protected]>
net: cpsw: Execute ndo_set_rx_mode callback in a work queue

Oscar Salvador <[email protected]>
mm, hugetlb: increment the number of pages to be reset on HVO

Doruk Tan Ozturk <[email protected]>
ocfs2: validate directory-index entry counts when reading metadata

Joseph Qi <[email protected]>
ocfs2: validate dx_root extent list fields during block read

Tejun Heo <[email protected]>
sched_ext: Fix inverted ops.core_sched_before() invocation

Chris Mason <[email protected]>
svcrdma: Reject Write/Reply chunks with segcount 0

Chuck Lever <[email protected]>
svcrdma: Adjust the number of entries in svc_rdma_recv_ctxt::rc_pages

Chuck Lever <[email protected]>
sunrpc: Add a helper to derive maxpages from sv_max_mesg

Chuck Lever <[email protected]>
svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id

Chuck Lever <[email protected]>
svcrdma: Release transport resources synchronously

Chuck Lever <[email protected]>
rpcrdma: arm rn_done before publishing the notification

Luxiao Xu <[email protected]>
sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Al Viro <[email protected]>
rpc_pipe: don't overdo directory locking

Al Viro <[email protected]>
rpc_mkpipe_dentry(): saner calling conventions

Al Viro <[email protected]>
rpc_populate(): lift cleanup into callers

Chris Mason <[email protected]>
SUNRPC: fix gssx_dec_option_array error path bugs

Jeff Layton <[email protected]>
sunrpc: defer rq_argp and rq_resp free until after RCU grace period

Anna Schumaker <[email protected]>
SUNRPC: Update svcxdr_init_decode() to call xdr_set_scratch_folio()

Anna Schumaker <[email protected]>
SUNRPC: Introduce xdr_set_scratch_folio()

Zhiling Zou <[email protected]>
ip: orphan prefetched skbs before multicast forwarding

Eric Dumazet <[email protected]>
ipv6: ip6_mc_input() and ip6_mr_input() cleanups

Eric Dumazet <[email protected]>
ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers

Andrea Mayer <[email protected]>
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()

Yue Haibing <[email protected]>

    ipv6: annotate data-races around devconf->rpl_seg_enabled

Terry Bowman <[email protected]>
cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register

Rafael J. Wysocki <[email protected]>
ACPI: TAD: Add locking around AML evaluations

Rafael J. Wysocki <[email protected]>
ACPI: TAD: Split three functions to untangle runtime PM handling

Rafael J. Wysocki <[email protected]>
ACPI: TAD: Rearrange RT data validation checking

Jiri Olsa <[email protected]>
bpf: Disable preemption in bpf_get_stackid

Jiri Olsa <[email protected]>
bpf: Use stack id functions instead of __bpf_get_stackid

Jiri Olsa <[email protected]>
bpf: Factor stackid_new_bucket from __bpf_get_stackid

Jiri Olsa <[email protected]>
bpf: Factor stackid_fastpath function from __bpf_get_stackid

Jiri Olsa <[email protected]>
bpf: Factor stackid_init function from __bpf_get_stackid

Haoxiang Li <[email protected]>
cpufreq: apple-soc: Fix OPP table cleanup

Terry Bowman <[email protected]>
acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks

Smita Koralahalli <[email protected]>
efi/cper, cxl: Make definitions and structures global

Smita Koralahalli <[email protected]>
efi/cper, cxl: Prefix protocol error struct and function names with cxl_

Nikhil Gurudasani <[email protected]>
erofs: skip sufficiently large global buffers when resizing

Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during close_lru reaping

Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during blocked-lock reaping

Chuck Lever <[email protected]>
NFSD: Consolidate the revocation-path client unpin

Jiangshan Yi <[email protected]>
HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes

Florian Pradines <[email protected]>

    HID: mcp2221: fix OOB write in mcp2221_raw_event()

Doruk Tan Ozturk <[email protected]>
HID: sony: clean up device list on probe failure

Rosalie Wanders <[email protected]>
HID: sony: use guard() and scoped_guard()

Baul Lee <[email protected]>
HID: universal-pidff: stop the device when force-feedback init fails

Doruk Tan Ozturk <[email protected]>
HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind

Qu Wenruo <[email protected]>
btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag

Shuangpeng Bai <[email protected]>
btrfs: fix extent map leak in NOCOW direct I/O write

Filipe Manana <[email protected]>
btrfs: rename extent map functions to get block start, end and check if in tree

Filipe Manana <[email protected]>
btrfs: add btrfs prefix to main lock, try lock and unlock extent functions

David Sterba <[email protected]>
btrfs: use BTRFS_PATH_AUTO_FREE in can_nocow_extent()

Qu Wenruo <[email protected]>
btrfs: prepare btrfs_punch_hole_lock_range() for large data folios

David Sterba <[email protected]>
btrfs: pass struct btrfs_inode to btrfs_sync_inode_flags_to_i_flags()

David Sterba <[email protected]>
btrfs: parameter constification in ioctl.c

David Sterba <[email protected]>
btrfs: update include and forward declarations in headers

Qu Wenruo <[email protected]>
btrfs: expose per-inode stable writes flag

Filipe Manana <[email protected]>
btrfs: move btrfs_alloc_write_mask() into fs.h

Filipe Manana <[email protected]>
btrfs: move BTRFS_BYTES_TO_BLKS() into fs.h

Filipe Manana <[email protected]>
btrfs: move btrfs_is_empty_uuid() from ioctl.c into fs.c

Andre Eikmeyer <[email protected]>
HID: apple: preserve keyboard backlight across T2 resume

Sam Edwards <[email protected]>
ceph: properly decrypt filenames in vmalloc() buffers

Chuck Lever <[email protected]>
NFSD: Guard admin state-revocation walks with NFSD_NET_UP

Max Kellermann <[email protected]>
ceph: force a cap message when a deferred revoke can't be acked immediately

Dr. David Alan Gilbert <[email protected]>
ceph: Remove fs/ceph deadcode

Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during delegation revoke

Mike Snitzer <[email protected]>
nfsd: disallow file locking and delegations for NFSv4 reexport

Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during admin state revocation

Jeff Layton <[email protected]>
nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

Jeff Layton <[email protected]>
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

Olga Kornievskaia <[email protected]>
nfsd: update mtime/ctime on COPY in presence of delegated attributes

Jeff Layton <[email protected]>
nfsd: fix netlink dumpit error handling for rpc_status_get

Jeff Layton <[email protected]>
nfsd: fix clock domain mismatch in clients_still_reclaiming()

Jeff Layton <[email protected]>
nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

Jeff Layton <[email protected]>
nfsd: dedup nfs4_client_to_reclaim inserts

Jeff Layton <[email protected]>
nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

Chuck Lever <[email protected]>
Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"

Chuck Lever <[email protected]>
NFSD: Make nfsd_genl_rqstp::rq_ops array best-effort

Chuck Lever <[email protected]>
NFSD: Rename a function parameter

Jeff Layton <[email protected]>
nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()

Jeff Layton <[email protected]>
nfsd: validate sockaddr length per family in listener_set

Carolina Jubran <[email protected]>
netlink: introduce type-checking attribute iteration for nlmsg

Sergey Senozhatsky <[email protected]>
zram: set default primary compressor in zram_destroy_comps()

Sergey Senozhatsky <[email protected]>
zram: switch to guard() for init_lock

Longlong Xia <[email protected]>
zram: fix out-of-bounds access in writeback_store()

Sergey Senozhatsky <[email protected]>
zram: use zram_read_from_zspool() in writeback

Sergey Senozhatsky <[email protected]>
zram: remove entry element member

Longlong Xia <[email protected]>
zram: fix out-of-bounds access in read_block_state()

Sergey Senozhatsky <[email protected]>
zram: fixup read_block_state()

Neill Kapron <[email protected]>
usb: gadget: f_fs: Fix Use-After-Free in AIO error path

Gabriel Prostitis <[email protected]>
USB: gadget: ffs: fix mm lifetime handling

Terry Bowman <[email protected]>
cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read

Dave Jiang <[email protected]>
cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c

Terry Bowman <[email protected]>
cxl/pci: Remove unnecessary CXL RCH handling helper functions

Terry Bowman <[email protected]>
cxl/pci: Remove unnecessary CXL Endpoint handling helper functions

Roger Pau Monne <[email protected]>
x86/xen: fix init of balloon stats again

Roger Pau Monne <[email protected]>
xen/balloon: improve accuracy of initial balloon target for dom0

Yao Zi <[email protected]>
x86/locking: Use sfence for wmb() if SSE is available

Uros Bizjak <[email protected]>
x86/locking: Remove semicolon from "lock" prefix

Li Xiasong <[email protected]>
mm/slub: fix missing debugfs entries for caches created before sysfs init

Vlastimil Babka <[email protected]>
mm/slab: move and refactor __kmem_cache_alias()

Arvind Yadav <[email protected]>
mm/migrate_device: clear stale mapping after freeing swapcache

Kairui Song <[email protected]>
mm/mglru: fix and remove redundant unevictable folio handling

Kairui Song <[email protected]>
mm/mglru: use the common routine for dirty/writeback reactivation

Yu Zhao <[email protected]>
mm/mglru: optimize deactivation

Wei Xu <[email protected]>
mm/mglru: reset page lru tier bits when activating

Muchun Song <[email protected]>
mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier

Chen Linxuan <[email protected]>
pidfd: hold exec_update_lock around namespace ioctl

Christian Brauner <[email protected]>
nscommon: simplify initialization

David Hildenbrand (Arm) <[email protected]>
mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()

David Hildenbrand <[email protected]>
mm: move _pincount in folio to page[2] on 32bit

David Hildenbrand <[email protected]>
mm: move hugetlb specific things in folio to page[3]

Chengfeng Ye <[email protected]>
KEYS: trusted: Fix TPM teardown ordering

Breno Leitao <[email protected]>
mm, swap: ratelimit bad swap entry reports

gao xu <[email protected]>
mm: fix possible NULL pointer dereference in __swap_duplicate

Vinicius Costa Gomes <[email protected]>
crypto: iaa - unmap dst before software fallback on decompress

Thorsten Blum <[email protected]>
crypto: atmel-ecc - avoid stale fallback key after set_secret failure

Sean Christopherson <[email protected]>
KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests

Sean Christopherson <[email protected]>
KVM: SVM: Move SEV-ES VMSA allocation to a dedicated sev_vcpu_create() helper

Ashish Kalra <[email protected]>
KVM: SEV: Disable SEV-SNP support on initialization failure

Sean Christopherson <[email protected]>
KVM: SVM: Invalidate "next" SNP VMSA GPA even on failure

Sean Christopherson <[email protected]>
KVM: SVM: Use guard(mutex) to simplify SNP vCPU state updates

Sean Christopherson <[email protected]>
KVM: SVM: Mark VMCB dirty before processing incoming snp_vmsa_gpa

Jiayuan Chen <[email protected]>
net: advertise TCP MSS from the configured MTU, not the learned PMTU

Bryam Vargas <[email protected]>
crypto: virtio - bound the akcipher result length

Lukas Wunner <[email protected]>
crypto: virtio - Drop superfluous [as]kcipher_req pointer

Lukas Wunner <[email protected]>
crypto: virtio - Drop superfluous [as]kcipher_ctx pointer

Lukas Wunner <[email protected]>
crypto: virtio - Drop sign/verify operations

Eric Dumazet <[email protected]>
vlan: fix skb_under_panic and races when toggling HW VLAN offload

Kyle Zeng <[email protected]>
net/packet: defer vmalloc TX_RING free until skbs finish

Yong Wang <[email protected]>
tcp: clamp route advmss to TCP_MIN_MSS

Eric Dumazet <[email protected]>
ipv4: use dst4_mtu() instead of dst_mtu()

Eric Dumazet <[email protected]>
ipv6: use dst6_mtu() instead of dst_mtu()

Eric Dumazet <[email protected]>
inet: add dst4_mtu() and dst6_mtu() helpers

Eric Dumazet <[email protected]>
ipv6: add some unlikely()/likely() clauses in ip6_output.c

Eric Dumazet <[email protected]>
ipv6: pass proto by value to ipv6_push_nfrag_opts() and ipv6_push_frag_opts()

Sean Christopherson <[email protected]>
KVM: SEV: Add an anonymous "psc" struct to track current PSC metadata

Sean Christopherson <[email protected]>
KVM: SEV: Make it more obvious when KVM is writing back the current PSC index

Sean Christopherson <[email protected]>
KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y

Miklos Szeredi <[email protected]>
fuse: fix race between interrupt and resend

Breno Leitao <[email protected]>
usb: xhci: bail out of setup if the controller is inaccessible

Niklas Neronin <[email protected]>
usb: xhci: simplify handling of Structural Parameters 1 values

Niklas Neronin <[email protected]>
usb: xhci: use cached HCSPARAMS1 value

Niklas Neronin <[email protected]>
usb: xhci: add USB Port Register Set struct

Eric Biggers <[email protected]>
netfilter: nft_set_pipapo_avx2: add missing vzeroupper

Anton Protopopov <[email protected]>
bpf: fix the return value of push_stack

Javier Tia <[email protected]>

    xfs: initialise args->total for parent pointer updates

Xuanqiang Luo <[email protected]>
fou: Fix use-after-free in fou_create()

Weiming Shi <[email protected]>
net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

Weiming Shi <[email protected]>
i2c: smbus: reject oversized block transfers in the common path

Kazuki Hanai <[email protected]>
ALSA: us122l: Prevent write upgrades for read mappings

Gary Guo <[email protected]>
net: usb: pegasus: don't rely on id table pointer arithmetic

Gary Guo <[email protected]>
media: as102: do not rely on id table address comparison

Gary Guo <[email protected]>
usb: serial: spcp8x5: don't store usb_device_id

Gary Guo <[email protected]>
usb: usbtmc: don't store usb_device_id

Gary Guo <[email protected]>
wifi: ath9k_htc: don't store usb_device_id

Gary Guo <[email protected]>
usb: xusbatm: don't rely on id table pointer arithmetic

Chuck Lever <[email protected]>
xdrgen: Fix union declarations

Ian Rogers <[email protected]>
perf evsel: Add per-thread warning for EOPNOTSUPP open failues

Sasha Levin <[email protected]>
Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems"

Sasha Levin <[email protected]>

    Revert "slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL"

Sasha Levin <[email protected]>
Revert "selftests/mm: report unique test names for each cow test"

Sasha Levin <[email protected]>
Revert "selftests/mm: skip COW tmpfile cases when fallocate() is unsupported"

Sasha Levin <[email protected]>
Revert "selftests: harness: Mark test fixture objects __maybe_unused"

Sasha Levin <[email protected]>
Revert "nvme: apple: Add Apple A11 support"

Sasha Levin <[email protected]>
Revert "nvme-apple: Drop the PRP null check chicken bit"

Sasha Levin <[email protected]>
Revert "nvme-apple: Prevent shared tags across queues on Apple A11"

Sasha Levin <[email protected]>

    Revert "nvme-apple: Reset q->sq_tail during queue init"

Sasha Levin <[email protected]>

    Revert "arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries"

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized

Atish Patra <[email protected]>
crypto: ccp - Fix possible deadlock in SEV init failure path

Henrique Carvalho <[email protected]>
smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range

Darrick J. Wong <[email protected]>
xfs: actually recover intended file sizes in xfs_xmi_item_recover_intent

Darrick J. Wong <[email protected]>
xfs: advance the findparent inode scan cursor while holding ILOCK

Darrick J. Wong <[email protected]>
xfs: bail out on bitmap errors in xrep_agfl_fill

Darrick J. Wong <[email protected]>
xfs: compute dquot checksum after resetting dd_lsn in repair

Darrick J. Wong <[email protected]>
xfs: count escaped corruption errors in scrub stats

Darrick J. Wong <[email protected]>
xfs: destroy seen inode bitmap when we fail to add a dirpath

Darrick J. Wong <[email protected]>
xfs: don't leak dqacct if rhashtable insertion fails

Darrick J. Wong <[email protected]>
xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails

Darrick J. Wong <[email protected]>
xfs: don't modify file attributes or poke fsnotify for dry runs

Darrick J. Wong <[email protected]>
xfs: don't spin forever on zero-length dirents when salvaging them

Darrick J. Wong <[email protected]>
xfs: fix backwards skipping logic in xrep_quota_block

Darrick J. Wong <[email protected]>
xfs: fix bnobt repair space reservation disposal failure

Lin Jiapeng <[email protected]>
xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

Darrick J. Wong <[email protected]>
xfs: fix name string recording in slowpath pptr tracepoints

Darrick J. Wong <[email protected]>
xfs: fix replaying dirent removals into the temporary directory

Javier Tia <[email protected]>
xfs: initialise error in xfs_defer_finish_one()

Darrick J. Wong <[email protected]>
xfs: log the tempip after we convert it to extents format

Darrick J. Wong <[email protected]>
xfs: preserve owner on in-memory btree creation

Darrick J. Wong <[email protected]>
xfs: report nonexistent parents as a filesystem corruption

Darrick J. Wong <[email protected]>
xfs: reset parent pointer args before each dir tree unlink repair

Darrick J. Wong <[email protected]>
xfs: signal inode btree xref error if get_rec returns an error

Darrick J. Wong <[email protected]>
xfs: snapshot old AGFL before rewriting it

Darrick J. Wong <[email protected]>
xfs: snapshot scrub stats when rendering them

Darrick J. Wong <[email protected]>
xfs: truncate quota file correctly when repairing quota file

Bjoern Doebel <[email protected]>
smb: client: fix heap overflow in DACL owner/group rewrite

Bjoern Doebel <[email protected]>
smb: client: avoid leaking refcount when cifs_sb_tlink() fails

Bjoern Doebel <[email protected]>
smb: client: avoid leaking refcount in cifs_queue_oplock_break()

Paulo Alcantara <[email protected]>
smb: client: fix file type corruption in wsl_to_fattr()

Paulo Alcantara <[email protected]>
smb: client: fix file type corruption in cifs_reparse_point_to_fattr()

Paulo Alcantara <[email protected]>
smb: client: fix one-byte OOB read in smb2_parse_native_symlink()

Karl Mehltretter <[email protected]>
smb: client: pin DFS superblock in iterator callback

Aohan Mei <[email protected]>
smb: client: reject userspace cifs.idmap descriptions

Gang Yan <[email protected]>
selftests: mptcp: fix an UAF in mptcp_connect.c

Matthieu Baerts (NGI0) <[email protected]>
mptcp: syncookies: remember the request backup flag

Matthieu Baerts (NGI0) <[email protected]>
mptcp: subflow: no need to copy thmac during ulp_clone

Matthieu Baerts (NGI0) <[email protected]>
mptcp: options: handle MPC data + csum reqd + no csum

Joe Damato <[email protected]>
bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

Joe Damato <[email protected]>
bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()

Joe Damato <[email protected]>
bnxt_en: Only restore LRO if the device supports TPA

Michael Bommarito <[email protected]>
media: v4l2-ctrls: validate AV1 tile counts

Michael Bommarito <[email protected]>
media: v4l2-ctrls: validate HEVC tile counts

Michael Bommarito <[email protected]>
media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

Michael Bommarito <[email protected]>
media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer

Haotian Zhang <[email protected]>
media: v4l2-h264: Fix memcmp() size in B1 reference list comparison

Michael Bommarito <[email protected]>
media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity

Michael Bommarito <[email protected]>
media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity

Michael Bommarito <[email protected]>
media: hevc: add bounded tile-count helpers

Vishnu Razdan <[email protected]>
hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS

Fan Wu <[email protected]>
hwmon: (gpio-fan) Fix use-after-free in alarm work

Javier Carrasco <[email protected]>
hwmon: (chipcap2) fix channels in humidity alarm notifications

Cong Nguyen <[email protected]>
hwmon: (applesmc) fix key backlight workqueue leak on register failure

Chengfeng Ye <[email protected]>
afs: Clear stale peer app data after address list changes

David Howells <[email protected]>
afs: Fix incorrect free in candidate cleanup in afs_lookup_server()

Xixin Liu <[email protected]>
perf: RISC-V: use BIT_ULL for u64 overflow masks

Xixin Liu <[email protected]>
perf: RISC-V: store available counter mask as bitmap

Harald Freudenberger <[email protected]>
s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm

Harald Freudenberger <[email protected]>
s390/crypto: Fix use of mutex in atomic context

Harald Freudenberger <[email protected]>
s390/crypto: Fix skcipher_walk return code handling in aes_s390

Nagamani PV <[email protected]>
s390/qeth: allow bridgeport queries despite OS_MISMATCH

leixiang <[email protected]>

    KVM: PPC: Book3S HV: Set irqfd->producer only on success

Ibrahim Hashimov <[email protected]>
mac802154: fix use-after-free of sdata via queued RX frames

Kyle Zeng <[email protected]>
ipvs: reject invalid states in connection template sync records

Zihan Xi <[email protected]>
ipv4: fib: bound automatic table ID allocation

David Carlier <[email protected]>
ieee802154: hwsim: serialize pib updates to fix double-free

Fan Wu <[email protected]>

    ieee802154: cc2520: fix FIFOP work use-after-free

Zhiling Zou <[email protected]>
ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink

Yilin Zhang <[email protected]>
inet: frags: invalidate queues before flushing them

Weiming Shi <[email protected]>
fbdev: vfb: defer cleanup until the last reference

Nikhil Gurudasani <[email protected]>
erofs: preserve LZMA decoders on resize failure

Jeffin Philip <[email protected]>
fs: autofs: fix memory leak in autofs_fill_super()

Nathan Chancellor <[email protected]>
scripts/sorttable: Mark long_size as __maybe_unused

Xiong Weimin <[email protected]>
vdpa: solidrun: Free IRQs after request failure

Xiong Weimin <[email protected]>
vdpa: ifcvf: Put device on unsupported feature error

Ilya Maximets <[email protected]>
netfilter: report NLM_F_DUMP_FILTERED when all is filtered out

Chengfeng Ye <[email protected]>
netfilter: nf_log: unregister loggers before per-net teardown

Norbert Szetei <[email protected]>
net: openvswitch: fix use-after-free of the flow table mask array

Fourie Zhang <[email protected]>
net: mpls: clear inner_protocol when the last label is popped

Sahil Chandna <[email protected]>
net: mana: Reserve extra CQ slot for the fence completion CQE

Johan Hovold <[email protected]>
net: hso: fix TIOCMIWAIT race

Xuanqiang Luo <[email protected]>
net/sched: act_api: release all action references on NEWACTION failure

David Carlier <[email protected]>
ring-buffer: Check resize_disabled before publishing the new subbuf order

Sebastian Andrzej Siewior <[email protected]>
ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()

Gabriel Krisman Bertazi <[email protected]>
io_uring/net: let io_recv_buf_select return the length of the buffer region

Thorsten Blum <[email protected]>
drm/i915: Fix memory leak in query_perf_config_list()

Sunil Khatri <[email protected]>
drm/drm_exec: fix up contended obj when num_objects is 0

Moritz Tanner <[email protected]>
fs: don't return -EINVAL for successful nested thaw

Jann Horn <[email protected]>
exec: do_close_on_exec() before taking exec_update_lock

Runyu Xiao <[email protected]>
cpufreq: initialize policy rwsem before sysfs publication

Zhongqiu Han <[email protected]>
cpufreq: zero-initialize policy cpumask before sysfs publication

Rong Zhang <[email protected]>
Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

Xu Rao <[email protected]>
Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev

Runyu Xiao <[email protected]>
ASoC: sti: initialize IRQ lock before requesting IRQ

Tianchu Chen <[email protected]>
ASoC: sprd: validate compress buffer sizes against fixed allocations

Dawid Osuchowski <[email protected]>
accel/ivpu: Limit firmware log name prints to field size

Magdalena Schulfer <[email protected]>
accel/ivpu: Validate firmware log buffer metadata

Magdalena Schulfer <[email protected]>
accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr

Donggeun Yoo <[email protected]>
tracing: Keep the entry count when the histogram stats allocation fails

Donggeun Yoo <[email protected]>
tracing: Let histogram values keep the percent and graph modifiers

Donggeun Yoo <[email protected]>
tracing: Free histogram the field rejected for a bad modifier

Donggeun Yoo <[email protected]>
tracing: Free histogram var refs regardless of how often they are referenced

Donggeun Yoo <[email protected]>
tracing: Free histogram the var ref when its initialization fails

Henry Martin <[email protected]>
tracing/user_events: Don't destroy fields when event removal fails

Thomas Gleixner <[email protected]>
tick/broadcast: Plug clockevents replacement race

Ido Schimmel <[email protected]>
tunnels: Drop stale dst when building an ICMP error for PMTUD

Ali Ahmet Memis <[email protected]>
ufs: validate cylinder group metadata before caching it

Ali Ahmet Memis <[email protected]>
ufs: create the root dentry after loading cylinder metadata

James Hilliard <[email protected]>
watchdog: sunxi_wdt: preserve boot-enabled watchdog

Harry Wentland <[email protected]>
dm/amdgpu: fix malformed link_settings debugfs output

Tristan Madani <[email protected]>
ALSA: usbusx2y: validate URB actual_length in interrupt callback

Tristan Madani <[email protected]>
ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf

Roman Prucha <[email protected]>
ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough

Miguel Ojeda <[email protected]>
rust: allow unknown_lints in generated bindings for Rust < 1.88

Donggeun Yoo <[email protected]>
tracing: Fix memory corruption from the histogram stacktrace modifier

Zihan Xi <[email protected]>
ipv6: fix fib6 walker UAF on seq stop

Vernon Yang <[email protected]>
x86/mm: Fix user-space data loss with MADV_FREE and THP

Eric Biggers <[email protected]>
crypto: x86/aria - add missing vzeroupper in AVX-512 code

Eric Biggers <[email protected]>
crypto: x86/aria - add missing vzeroupper in AVX2 code

Shivaprasad G Bhat <[email protected]>
powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver

Thorsten Blum <[email protected]>
powerpc/ps3: Fix repository.c build failure

Namjae Jeon <[email protected]>
ksmbd: prevent out-of-bounds reads in share config responses

Maurizio Lombardi <[email protected]>
scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands

Lorenzo Stoakes (ARM) <[email protected]>
scripts/mksysmap: fix escape of '$' in the __pi_ pattern

Stian Halseth <[email protected]>
sunvdc: unmap LDC cookies when the descriptor send fails

Eelco Chaudron <[email protected]>
openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()

MD Danish Anwar <[email protected]>
net: hsr: enable promiscuous mode on interlink port with fwd offload

Lorenzo Bianconi <[email protected]>
net: stmmac: fix TX descriptor availability check for TSO traffic

Russell King (Oracle) <[email protected]>
net: stmmac: add TSO check for header length

Russell King (Oracle) <[email protected]>
net: stmmac: add stmmac_tso_header_size()

Russell King (Oracle) <[email protected]>
net: stmmac: fix TSO support when some channels have TBS available

Furong Xu <[email protected]>
net: stmmac: TSO: Simplify the code flow of DMA descriptor allocations

Greg Marsden <[email protected]>
net/rds: fix tcp stream corruption with large pages

Ratheesh Kannoth <[email protected]>
octeontx2-af: fix PF/CGX debugfs PCI bus lookup

Vladislav Karmanov <[email protected]>
net: phy: mediatek-ge: disable EEE on the MT7530 PHY

Heiner Kallweit <[email protected]>
net: phy: add phy_disable_eee

SkyLake.Huang <[email protected]>
net: phy: mediatek: Re-organize MediaTek ethernet phy drivers

Colin Ian King <[email protected]>

    cxgb4: clip_tbl: Fix spelling mistake "wont" -> "won't"

Aamir Ahmed <[email protected]>
net: hinic: fix mailbox segment buffer overflow

Li Youhong <[email protected]>
net: sun4i-emac: fix missing of_node_put() for phy_node

Kuniyuki Iwashima <[email protected]>
net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().

Victor Nogueira <[email protected]>
net/sched: cls_route: Fix in-place replace

Victor Nogueira <[email protected]>
net/sched: cls_route: Reject handle aliasing

Victor Nogueira <[email protected]>
net/sched: cls_route: free emptied bucket on filter move

Vincent Guittot <[email protected]>
sched/eevdf: Fix rb augmented with multi fields

Peter Zijlstra <[email protected]>
sched/fair: Fix lag clamp

Peter Zijlstra <[email protected]>
sched/fair: Fix EEVDF entity placement bug causing scheduling lag

Dapeng Mi <[email protected]>

    perf/x86/intel: Correct pt_regs->flags update for PEBS path

Dapeng Mi <[email protected]>
perf/x86/intel/ds: Factor out PEBS group processing code to functions

Changbin Du <[email protected]>
perf/x86/intel/ds: Remove redundant assignments to sample.period

Kan Liang <[email protected]>
perf/x86/intel/ds: Clarify adaptive PEBS processing

Yabin Cui <[email protected]>
perf/core: Check sample_type in perf_sample_save_callchain

Thomas Richter <[email protected]>
perf/core: Allow list_del during perf_event_overflow()

Kan Liang <[email protected]>
perf: Supply task information to sched_task()

Thibault Ferrante <[email protected]>
selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

Lorenzo Bianconi <[email protected]>
net: stmmac: initialize ptp_lock at probe time

Qingfang Deng <[email protected]>
ppp_synctty: ensure a writeable skb header

Eric Dumazet <[email protected]>
vxlan: initialize _md in vxlan_xmit_one()

Ratheesh Kannoth <[email protected]>
octeontx2-pf: reset HTB scheduler topology before freeing queues

Linmao Li <[email protected]>
hwmon: (corsair-cpro) Remove debugfs entries when probe fails

Pengpeng Hou <[email protected]>
hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors

Cong Nguyen <[email protected]>

    hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()

Linmao Li <[email protected]>
hwmon: (corsair-cpro) Create debugfs entries after hwmon registration

Marek Vasut <[email protected]>
net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down

Yicong Hui <[email protected]>
net/micrel: Fix typos in micrel driver code comments

Jan Havran (Advantech Czech) <[email protected]>
net: dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN value

Daniel Golle <[email protected]>
net: dsa: lantiq_gswip: move definitions to header

Daniel Golle <[email protected]>
net: dsa: lantiq_gswip: prepare for more CPU port options

Daniel Golle <[email protected]>
net: dsa: lantiq_gswip: deduplicate dsa_switch_ops

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Sync timeout value if WDT was running at boot

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Fix undefined behavior

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Fix spurious reset on suspend

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Enable clock before accessing hardware registers

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Fix clock leak and spurious timer in settimeout()

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Avoid division by zero

David Arcari <[email protected]>
watchdog: fix hrtimer start when pretimeout is zero

Paolo Abeni <[email protected]>
mptcp: remove unneeded READ_ONCE() annotation

Nicolai Buchwitz <[email protected]>
net: macb: destroy the phylink instance on the probe error path

Jiajia Liu <[email protected]>
Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset

Jiajia Liu <[email protected]>
Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset

Ivan Hu <[email protected]>
Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware

Kiran K <[email protected]>
Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one

Kiran K <[email protected]>
Bluetooth: btintel_pcie: validate packet_len before skb_put_data

Luiz Augusto von Dentz <[email protected]>
Bluetooth: btusb: Fix UAF of btusb_data by rx_work

Jakub Kicinski <[email protected]>
eth: ice: don't dereference pointers from TP_printk()

Jacob Keller <[email protected]>
ice: add missing xa_destroy for sched_node_ids

Joshua Hay <[email protected]>
idpf: account for VLAN header when parsing RSC packet header

HyeongJun An <[email protected]>
ALSA: hda: Report a change when only the channel status bytes move

Takashi Iwai <[email protected]>
ALSA: hda/common: Use guard() for mutex locks

Takashi Iwai <[email protected]>
ALSA: hda/common: Use cleanup macros for PM controls

Takashi Iwai <[email protected]>
ALSA: hda: Introduce auto cleanup macros for PM

Karl Mehltretter <[email protected]>
drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER

Linus Walleij <[email protected]>
net: ethernet: cortina: Count RX descriptors for freeq refill

Linus Walleij <[email protected]>
net: ethernet: cortina: Count RX drops once per frame

Linus Walleij <[email protected]>
net: ethernet: cortina: No mapping is a dropped rx

Linus Walleij <[email protected]>
net: ethernet: cortina: Count dropped frames as NAPI work

Linus Walleij <[email protected]>
net: ethernet: cortina: Finish RX updates before NAPI completion

Linus Walleij <[email protected]>
net: ethernet: cortina: Fix budget accounting

Alice Mikityanska <[email protected]>
net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward

Alice Mikityanska <[email protected]>
net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

Kuniyuki Iwashima <[email protected]>
af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.

Kuniyuki Iwashima <[email protected]>
af_unix: Update last skb marker in manage_oob().

Karl Mehltretter <[email protected]>
virtio_input: stop callbacks before unregistering input device

Xiong Weimin <[email protected]>
virtio_input: reset device if input_register_device() fails

Andrew Stellman <[email protected]>
virtio-pci: return IRQ_HANDLED after non-zero ISR

Linfeng Sun <[email protected]>
vdpa_sim_net: check TX pull result before RX copy

Linfeng Sun <[email protected]>
vdpa_sim_blk: reject out-of-range sector starts

Yu Zhang <[email protected]>
vhost-vdpa: protect config_ctx from being freed under the config callback

Yu Zhang <[email protected]>
vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx

Jia Jia <[email protected]>
vhost/vdpa: reject VRING_NUM larger than device max

Jia Jia <[email protected]>
virtio_console: do not free control-out buffers on remove

Karl Mehltretter <[email protected]>
virtio: fix use-after-free in unregister_virtio_device()

hpp.iscas <[email protected]>
ASoC: mt6351: Publish the OF module alias

Florian Westphal <[email protected]>
netfilter: ip6_tables: set F_PROTO when proto value is nonzero

Florian Westphal <[email protected]>
netfilter: nfnetlink_log: cope with concurrent instance destruction

hpp.iscas <[email protected]>
ASoC: Intel: SST: Publish the PCI module aliases

hpp.iscas <[email protected]>
ASoC: bcm: bcm63xx: Publish the OF module aliases

Jared Kangas <[email protected]>
hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read()

Guenter Roeck <[email protected]>
hwmon: Introduce 64-bit energy attribute support

Zijun Hu <[email protected]>
libnvdimm: Replace namespace_match() with device_find_child_by_name()

Geert Uytterhoeven <[email protected]>
hwmon: (ltc4282) Make sure clk_init_data is fully initialized

Edward Adam Davis <[email protected]>
ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Reject non-scalar bpf_loop iteration counts

Vineeth Karumanchi <[email protected]>
net: macb: fix NULL pointer dereference on unbind with fixed-link

Théo Lebrun <[email protected]>

    net: macb: rename bp->sgmii_phy field to bp->phy

Jamal Hadi Salim <[email protected]>
net/sched: ets: clamp quantum in parse and fallback paths

Jamal Hadi Salim <[email protected]>
net/sched: drr: clamp quantum in change class

Jamal Hadi Salim <[email protected]>
net/sched: pie: clamp psched_mtu in pie_drop_early

Jamal Hadi Salim <[email protected]>
net/sched: hhf: clamp quantum in change and init paths

Jamal Hadi Salim <[email protected]>
net/sched: sfq: clamp quantum in change path

Jamal Hadi Salim <[email protected]>
net/sched: fq_pie: clamp quantum in change path

Lama Kayal <[email protected]>
net/mlx5: E-Switch, prevent mc_list repopulation during vport disable

Yael Chemla <[email protected]>
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put

Carolina Jubran <[email protected]>
net/mlx5e: Fix use-after-free race in sample_restore_put()

Carolina Jubran <[email protected]>
net/mlx5e: Fix ETS zero BW reporting when one TC holds 100%

Shahar Shitrit <[email protected]>
net/mlx5e: Fix setting RS FEC after remapping

Weiming Shi <[email protected]>
net/sched: defer qdisc freeing after failed creation

XingWang Xiang <[email protected]>
net: mctp: i3c: serialize probe with bus removal

Thorsten Blum <[email protected]>
powerpc/kexec_file: Use inclusive range checks in add_usable_mem()

Nikhil P. Rao <[email protected]>
pds_core: don't release PCI regions for VFs on reset

Nikhil P. Rao <[email protected]>
pds_core: fix cmd_regs access racing BAR unmap on reset

Jamal Hadi Salim <[email protected]>
net: reject oversized tx_queue_len at netlink parse time

Jamal Hadi Salim <[email protected]>
net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations

Seungwon Bae <[email protected]>
vxlan: reject dynamic fdb entries that reference a nexthop id

Alexandra Winter <[email protected]>
s390/ism: folio_put() after error

Jason Winter <[email protected]>

    net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow

Nikhil P. Rao <[email protected]>
ionic: use netif_txq_maybe_stop() in ionic_tx()

Viswajith Murali <[email protected]>
octeontx2-af: mcs: Clear stale X2P calibration state before calibration

Nikolay Aleksandrov <[email protected]>
net: bridge: mcast: properly convert mglist to rcu

Jakub Kicinski <[email protected]>
net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size

Jakub Kicinski <[email protected]>
eth: nfp: drop the replaced rule from the list when reprogramming fails

Jakub Kicinski <[email protected]>
eth: nfp: bound the ntuple rule dump by the caller's buffer size

Jakub Kicinski <[email protected]>
eth: nfp: migrate to new RXFH callbacks

Jakub Kicinski <[email protected]>
net: ethtool: add dedicated callbacks for getting and setting rxfh fields

Jakub Kicinski <[email protected]>
net: ethtool: require drivers to opt into the per-RSS ctx RXFH

Jakub Kicinski <[email protected]>
net: ethtool: remove the duplicated handling from rxfh and rxnfc

Jakub Kicinski <[email protected]>
net: ethtool: copy the rxfh flow handling

Gal Pressman <[email protected]>
ethtool: Block setting of symmetric RSS when non-symmetric rx-flow-hash is requested

Gal Pressman <[email protected]>
ethtool: Symmetric OR-XOR RSS hash

Jakub Kicinski <[email protected]>
net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size

Eric Dumazet <[email protected]>
bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()

Ido Schimmel <[email protected]>
nexthop: Initialize extack in remove_nh_grp_entry()

Jiayuan Chen <[email protected]>
selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0

Ning Ding <[email protected]>
bpf: Reject untrusted allocated-object pointers

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Require MEM_PERCPU for percpu kptr stores

Andy Shevchenko <[email protected]>
thermal: sysfs: switch to use scnprintf() to suppress truncation warning

Eduard Zingerman <[email protected]>
bpf: Don't predict JMP32 pointer vs zero comparisons

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Mark faultable stack helpers as sleepable

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Mark bpf_btf_find_by_name_kind() as sleepable

Justin Chen <[email protected]>
net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times

Justin Chen <[email protected]>

    net: bcmasp: clear txcb->last before writing each descriptor

Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Fix unbalanced module reference count

Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology

Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Clean up streams if their initialization fails

Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Clean up the bus when fetching ML caps fails

Xixin Liu <[email protected]>
nvme-tcp: defer TLS inline send to io_work

Hannes Reinecke <[email protected]>
nvme-tcp: open-code nvme_tcp_queue_request() for R2T

Mohamed Khalfella <[email protected]>
nvme: remove stale namespaces by NSID range during scan

Steven Rostedt <[email protected]>
ring-buffer: Add checking nr_subbufs to persistent ring buffer validation

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Mark sched_process_wait argument as nullable

Jiayuan Chen <[email protected]>
bpf: Fix NULL-ptr-deref in btf_var_show()

Jiayuan Chen <[email protected]>
bpf: Fix NULL-ptr-deref when showing a void BTF type

Takashi Iwai <[email protected]>
ALSA: caiaq: Fix potential double-free at error path

HyeongJun An <[email protected]>
selftests/alsa: Fix the step check for INTEGER controls

Breno Leitao <[email protected]>
arm64: trans_pgd: clone only the linear map that exists at runtime

HW He <[email protected]>
net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()

Lorenzo Bianconi <[email protected]>
net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset

Allison Henderson <[email protected]>
net/rds: don't let rds_conn_shutdown() consume a concurrent drop

Håkon Bugge <[email protected]>
net/rds: acquire the fastpath locks in rds_conn_shutdown()

Allison Henderson <[email protected]>
net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

Gerd Rausch <[email protected]>
net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown

Allison Henderson <[email protected]>
net/rds: clear cp_flags bits individually in rds_conn_path_reset()

Allison Henderson <[email protected]>
net/rds: use clear_bit_unlock() in release_refill()

Allison Henderson <[email protected]>
net/rds: use wq_has_sleeper() in release_in_xmit()

Eric Dumazet <[email protected]>
bonding: do not clear curr_active_slave prematurely when releasing all slaves

Eduard Zingerman <[email protected]>
bpf: reject BPF_PSEUDO_FUNC reference to the main program

Henry Martin <[email protected]>
tracing/probes: Fix use-after-free on field name/type of events with multiple probes

Joas Antonio dos Santos <[email protected]>
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

Kyle Zeng <[email protected]>
ipvs: fix reversed sequence option serialization

Qu Wenruo <[email protected]>
btrfs: do not force reloc root creation during qgroup_account_snapshot()

Avi Weiss <[email protected]>
btrfs: send: fix lost error return value in will_overwrite_ref()

Johannes Thumshirn <[email protected]>
btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

Qu Wenruo <[email protected]>
btrfs: return proper negative error code for update_raid_extent_item()

Qu Wenruo <[email protected]>
btrfs: fix the possible bioc_list memory leak during error

Shuangpeng Bai <[email protected]>
btrfs: fix transaction use-after-free in raid stripe insertion

Linus Walleij <[email protected]>
ASoC: ux500: Program the MSP FIFO watermarks

Linus Walleij <[email protected]>
ASoC: ux500: Allow repeated MSP prepare calls

Linus Walleij <[email protected]>
ASoC: ux500: Remove obsolete PRCMU QoS calls

Linus Walleij <[email protected]>
ASoC: ux500: Request the MSP MMIO resource

Linus Walleij <[email protected]>
ASoC: ux500: Deassert the MSP reset during probe

Linus Walleij <[email protected]>

    mfd: db8500-prcmu: Fold dbx500 header into db8500

Kees Cook <[email protected]>
arm: Handle KCOV __init vs inline mismatches

Zijun Hu <[email protected]>
mfd: db8500-prcmu: Remove needless return in three void APIs

Linus Walleij <[email protected]>
ASoC: ux500: Validate MSP DAI configuration

Linus Walleij <[email protected]>
ASoC: ux500: Correct MSP frame and bit clock setup

Linus Walleij <[email protected]>
ASoC: ux500: Propagate MSP setup errors

Linus Walleij <[email protected]>
ASoC: ux500: Fix MSP stream lifecycle handling

John Ogness <[email protected]>
printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY

Qingyu Zhang <[email protected]>
ALSA: ump: do not touch legacy_rmidi before it exists

Takashi Iwai <[email protected]>
ALSA: ump: Update rawmidi name per EP name update

Takashi Iwai <[email protected]>
ALSA: ump: Copy safe string name to rawmidi

Takashi Iwai <[email protected]>
ALSA: ump: Copy FB name string more safely

Takashi Iwai <[email protected]>
ALSA: rawmidi: Show substream activity in info ioctl

Takashi Iwai <[email protected]>
ALSA: rawmidi: Expose the tied device number in info ioctl

Sunil Goutham <[email protected]>
octeontx2-af: Fix limiting SRIOV VF count logic

Eric Dumazet <[email protected]>
locking/lockdep: Invalidate stale class_cache entries for zapped classes

Leo Yan <[email protected]>
perf/core: Skip empty AUX records with only format flags

Ivy Lopez <[email protected]>
scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

Xixin Liu <[email protected]>
perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ

Eric Dumazet <[email protected]>
bonding: alb: fix uninitialized transport header access in alb_determine_nd()

Guanghui Yang <[email protected]>
btrfs: restore active device pointers after failed sprout

Guanghui Yang <[email protected]>
btrfs: detach failed sprout device from transaction update list

Lu Yao <[email protected]>
drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl()

wangdicheng <[email protected]>
ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()

wangdicheng <[email protected]>
ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits

Vasily Gorbik <[email protected]>
s390/boot: Avoid IPL parameter append past command line

Vasily Gorbik <[email protected]>
s390/boot: Fix physical memory search range

Xu Rao <[email protected]>
ALSA: hda: restore MFG widget enumeration after core split

Takashi Iwai <[email protected]>
ALSA: hda/core: Use guard() for mutex locks

Hui Su <[email protected]>
staging: fbtft: make dirty_lock IRQ-safe

Kuniyuki Iwashima <[email protected]>
af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().

Eric Dumazet <[email protected]>
ipv6: sr: restore network header before routing and forwarding

David Laight <[email protected]>
tipc: Dont send random pad bytes in RESET/ACTIVATE messages

Tung Nguyen <[email protected]>
tipc: fix NULL deref in tipc_named_node_up() on empty publication list

Eric Dumazet <[email protected]>
ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit

Eric Dumazet <[email protected]>
ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()

Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Don't hold RTNL for MCAST_ socket options.

Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP.

Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.

Eric Dumazet <[email protected]>
ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

Qingfang Deng <[email protected]>
ppp: ppp_synctty: simplify tty disc_data access

Qingfang Deng <[email protected]>
ppp: ppp_async: simplify tty disc_data access

Eric Dumazet <[email protected]>
igmp: convert struct ip_sf_list to RCU

Jamal Hadi Salim <[email protected]>
net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted

Selvamani Rajagopal <[email protected]>
net: ethernet: oa_tc6: Fix for the wrong data type

Selvamani Rajagopal <[email protected]>
net: ethernet: oa_tc6: Disable tx queues on fatal error

Selvamani Rajagopal <[email protected]>
net: ethernet: oa_tc6: Improve the error recovery

Selvamani Rajagopal <[email protected]>
net: ethernet: oa_tc6: Protect skb pointer used by two different kernel instances

Ciprian Regus <[email protected]>
net: ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registers

Ciprian Regus <[email protected]>
net: ethernet: oa_tc6: Export standard defined registers

Ciprian Regus <[email protected]>
net: ethernet: oa_tc6: Handle the OA TC6 SPI protected mode

Selvamani Rajagopal <[email protected]>
net: ethernet: oa_tc6: Interrupt is active low, level triggered.

Linus Walleij <[email protected]>
ASoC: ab8500: Validate and program TDM slots correctly

Linus Walleij <[email protected]>
ASoC: ab8500: Correct digital interface format setup

Linus Walleij <[email protected]>
ASoC: ab8500: Repair the DAPM capture graph

Linus Walleij <[email protected]>
ASoC: ab8500: Reset the audio block before configuring it

Gongwei Li <[email protected]>
Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()

Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM

Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect

Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

Aleksandr Nogikh <[email protected]>
Bluetooth: hci_core: Fix race condition during device registration

Laxman Acharya Padhya <[email protected]>
Bluetooth: btintel: bound firmware ID by TLV length

Laxman Acharya Padhya <[email protected]>
Bluetooth: btintel: validate version TLV value lengths

Jiacheng Xu <[email protected]>
workqueue: reject watchdog thresholds that overflow jiffies

Marco Crivellari <[email protected]>
workqueue: replace use of system_wq with system_percpu_wq

Kiran K <[email protected]>
Bluetooth: btintel_pcie: Clear automask on spurious interrupts

Wanwu Li <[email protected]>
sched_ext: Fix timer pinning and return value in scx_central

Vasily Gorbik <[email protected]>
s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block

Vasily Gorbik <[email protected]>
s390/ipl: Fix NULL deref in kdump without re-IPL parm block

Heiko Carstens <[email protected]>
s390/time: Use jiffies instead of jiffies_64

Heiko Carstens <[email protected]>

    s390/vtime: Use __this_cpu_read() / get rid of READ_ONCE()

Namjae Jeon <[email protected]>
ksmbd: rate limit unmapped SID errors

Namjae Jeon <[email protected]>
ksmbd: propagate DACL parsing errors

Yilin Zhang <[email protected]>
ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

Colin Ian King <[email protected]>
OPP: of: Fix potential multiplication overflow when calculating freq

Adrian Hunter <[email protected]>
perf symbol: Do not use debug file as the binary type

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Fix NULL pointer dereference in PM callbacks

Baul Lee <[email protected]>
vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()

James Nugraha <[email protected]>
net: amd-xgbe: discard rx packets with bad FCS

Xuanqiang Luo <[email protected]>

    raw: annotate disconnect-side IPv4 match writers

Henry Martin <[email protected]>
sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration

Andy Shevchenko <[email protected]>
smb: client: transport: Fix debug printing in __release_mid()

Huiwen He <[email protected]>
smb/client: fix integer truncation in collapse range

Huiwen He <[email protected]>
smb/client: fix data corruption in emulated insert range

ZhangGuoDong <[email protected]>
smb: move copychunk definitions to common/smb2pdu.h

Henrique Carvalho <[email protected]>
smb: client: batch SRV_COPYCHUNK entries to cut round trips

Huiwen He <[email protected]>
smb/client: mark file sparse before emulating insert range

Huiwen He <[email protected]>
smb/client: validate new EOF for zero range

Huiwen He <[email protected]>
smb/client: validate new EOF for insert range

Milan P. Gandhi <[email protected]>
scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()

Milan P. Gandhi <[email protected]>
scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()

Xin Long <[email protected]>
sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START

Victor Nogueira <[email protected]>
net/sched: act_api: fix skb sizing and action leak on reoffload delete

Victor Nogueira <[email protected]>
net/sched: act_api: size the RTM_GETACTION reply from the actions

Victor Nogueira <[email protected]>
net/sched: act_api: budget all shared attributes in notify skbs

Dong Chenchen <[email protected]>
net: iptunnel: fix stale transport header during tunnel decapsulation

Eric Dumazet <[email protected]>
tcp: use GFP_ATOMIC in tcp_send_active_reset()

Eric Dumazet <[email protected]>
net: icmp: avoid invalid transport header access in icmp_send tracepoint

Slawomir Stepien <[email protected]>
drm/cirrus-qemu: Validate BAR0 size during probe

Thomas Zimmermann <[email protected]>
drm/cirrus: Use video aperture helpers

Ali Ahmet Memis <[email protected]>
ufs: do not treat unreadable directory blocks as empty

Jiayuan Chen <[email protected]>
bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic

Hongfu Li <[email protected]>
selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter

Liang Luo <[email protected]>
sched_ext: Fix nonexistent field in sched-ext.rst example

Xixin Liu <[email protected]>
nvmet-rdma: fix queue leak when connect backlog is exceeded

Xixin Liu <[email protected]>
nvme-rdma: fix -EIO cleanup order in queue_rq

Youssef Samir <[email protected]>
accel/qaic: Address potential out-of-bounds read in resp_worker()

Dan Carpenter <[email protected]>
drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

Jad Keskes <[email protected]>
EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation

Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix channel address decode for non-hash mode

Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix channel selection hash

Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix interleave boundary condition

Yazen Ghannam <[email protected]>
RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed

Russell King (Oracle) <[email protected]>
ARM: ensure interrupts are enabled in __do_user_fault()

Xie Yuanbin <[email protected]>
ARM: 9484/1: enable interrupts when unhandled user faults are triggered

SJ Park <[email protected]>
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop

Max Chou <[email protected]>
Bluetooth: btrtl: Add the support for RTL8761CUV

Kuniyuki Iwashima <[email protected]>
af_unix: Unlink scc_entry in unix_del_edge().

Eric Dumazet <[email protected]>
l2tp: fix tunnel and session refcount leak on seq_file release

Namjae Jeon <[email protected]>
ksmbd: use memcmp() to compare ClientGUIDs

HyeongJun An <[email protected]>
ASoC: meson: aiu: Validate written enum values

Cássio Gabriel <[email protected]>
ASoC: topology: Check PCM and DAI name strings before use

Kuniyuki Iwashima <[email protected]>
ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().

Jiri Olsa <[email protected]>
bpf: Guard __get_user acesss with access_ok for uprobe_multi data

Selvin Xavier <[email protected]>
RDMA/bnxt_re: Proper rollback if the ioremap fails

Jie Gan <[email protected]>
coresight: platform: defer connection counter increment until alloc succeeds

Abd-Alrhman Masalkhi <[email protected]>
md/raid10: fix writes_pending and barrier reference leaks on discard failures

Xin Long <[email protected]>
sctp: fix err_chunk memory leaks in INIT handling

Nuoqi Gui <[email protected]>
bpf: Mask pseudo pointer values in verifier logs

Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix malformed ISO_END/CONT handling

Daniel Borkmann <[email protected]>
bpf: Reject redirect helpers without a bpf_net_context

Gregor Herburger <[email protected]>
drm/vc4: hvs/v3d: Fix null dereference in unbind

Cen Zhang (Microsoft) <[email protected]>
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

Yehyeong Lee <[email protected]>
net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD

Eric Dumazet <[email protected]>
drop_monitor: fix size calculations for 64-bit attributes

Eric Dumazet <[email protected]>
drop_monitor: perform u64_stats updates under IRQ-disabled section

Vlatko Kosturjak <[email protected]>
ppp_async: drop the errored frame instead of resetting its headroom

Saravana Kannan <[email protected]>
of: dynamic: Fix overlayed devices not probing because of fw_devlink

Ulf Hansson <[email protected]>
driver core: Export get_dev_from_fwnode()

Brahmajit Das <[email protected]>
drm/amd/display: clean-up dead code in dml2_mall_phantom

Zi Yan <[email protected]>
mm/huge_memory: use folio's memcg inside __folio_split()

Laxman Acharya Padhya <[email protected]>
wifi: mt76: mt7921: skip unknown CLC firmware records

Laxman Acharya Padhya <[email protected]>
wifi: mt76: mt7921: validate CLC firmware records

Sasha Levin <[email protected]>
Revert "ARM: 9481/2: breakpoint: CFI breakpoints only on demand"

Sasha Levin <[email protected]>
Revert "bpf, s390: Clear fetch destination on faulting arena atomic"

Gil Portnoy <[email protected]>
ksmbd: remove stale channels from all sessions on teardown

Andrii Nakryiko <[email protected]>
bpftool: Strip all -Wformat* flags from bootstrap libbpf build

Genevieve Chan <[email protected]>
firmware: stratix10-svc: fix FCS SMC call kernel-doc

Rafael J. Wysocki <[email protected]>
Revert "ACPI: processor: Update cpuidle driver check in __acpi_processor_start()"

Florian Westphal <[email protected]>
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state

Lin Xianglin <[email protected]>
ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx

Zizhi Wo <[email protected]>
scsi: core: Do not block on tag allocation in scsi_eh_lock_door()

Rudi Heitbaum <[email protected]>
ASoC: rt5645: Perform the initial jack detect at probe

Jisheng Zhang <[email protected]>
spi: dw: fix wrong RX_SAMPLE_DLY setting after resume

Niklas Cassel <[email protected]>
ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0

Guenter Roeck <[email protected]>
hwmon: (corsair-psu) Fix linear11 calculation

Jia Jia <[email protected]>
vhost-scsi: flush backend after device ioctls

Zhang Heng <[email protected]>
ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx

Hardik Garg <[email protected]>
Drivers: hv: vmbus: add VTL2 redirect connection ID

Niklas Cassel <[email protected]>
ata: libata-core: Disable LPM on WD Green 2.5 480GB

André Pragosa <[email protected]>

    ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED)

Niklas Cassel <[email protected]>
ata: libata-core: Disable LPM on some WD drives

Robert Abrahamse <[email protected]>
ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)

Jiale Yao <[email protected]>
Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame

Deepanshu Kartikey <[email protected]>

    wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()

Li Qiang <[email protected]>
cifs: validate idmap key payload length

Vaibhav Jain <[email protected]>
powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash

Michal Swiatkowski <[email protected]>
ice: pass the return value of skb_checksum_help()

Madhavender Singh <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx

Markus Lindner <[email protected]>
ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4

Minhong He <[email protected]>
phonet: check register_netdevice_notifier() error in phonet_device_init()

Pengpeng Hou <[email protected]>
drm/gma500: return errors from Oaktrail HDMI I2C reads

Namjae Jeon <[email protected]>
ksmbd: preserve VFS inherited POSIX ACL mask

Ibrahim Hashimov <[email protected]>
wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO

Kamal Wadhwa <[email protected]>
regulator: core: clamp voltage constraints before applying apply_uV

Jay Vadayath <[email protected]>
smb: client: bound dirent name against end of SMB response in cifs_filldir

Georgi Valkov <[email protected]>
wifi: mwifiex: replace one-element arrays with flexible array members

Zhang Heng <[email protected]>
ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: acpi: validate WGDS table revision index

Daniel C. Ribeiro <[email protected]>
ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: bound aligned TLV advance in FW parser

Takashi Iwai <[email protected]>
ALSA: hda/realtek: Add quirk for HP Pavilion x360

Timur Kristóf <[email protected]>
drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized

Pu Hu <[email protected]>
arm64: kprobes: Allow reentering kprobes while single-stepping

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: add a check on the tid coming from the firmware

Yu Peng <[email protected]>
arm64: fixmap: Allow 256K early_ioremap() at any offset

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix a possible underflow

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: validate TX_CMD response layout

Charles Keepax <[email protected]>
ASoC: Intel: sof_sdw: Add quirks for new Dell laptops

Huiwen He <[email protected]>
smb/client: flush dirty data before punching a hole

Tao Cui <[email protected]>
blk-cgroup: fix leaks and online flag on radix_tree_insert failure

Marcel Kłos <[email protected]>
ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: pcie: null RX pointers after free

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix sched scan IE sizing

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: parse beacon notif per layout

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix an off-by-1 boundary check

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: validate mac_link_id in session protect notif

Filipe Manana <[email protected]>
btrfs: fix reloc root cleanup in merge_reloc_roots()

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: validate sta_id in BA window status notif

Wang YuWei <[email protected]>
spi: dw-dma: Wait for controller idle before completing Tx

Filipe Manana <[email protected]>
btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()

Dave Chen <[email protected]>
btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr()

Pali Rohár <[email protected]>
cifs: Fix support for creating SFU fifo

Richard Fitzgerald <[email protected]>
ALSA: hda: cs35l56: Fail if wmfw file is missing

Rohit Sinha <[email protected]>

    ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50)

Chen Bowen <[email protected]>
ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series

ChenXiaoSong <[email protected]>
smb/client: zero-initialize stack-allocated cifs_open_info_data

Pali Rohár <[email protected]>
cifs: Fix support for creating SFU socket

Huiwen He <[email protected]>
smb/client: reduce fallocate zero buffer allocation

Tianze Shao <[email protected]>
ASoC: rt712-sdca: reset codec at io_init to fix silent headphone

Pengpeng Hou <[email protected]>
wifi: rsi: validate beacon length before fixed buffer copy

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: mark the rcu locked areas properly

Pengpeng Hou <[email protected]>
wifi: libipw: fix key index receive bound checks

Liang Hao <[email protected]>
gpio: dwapb: Mask interrupts at hardware initialization

Pagadala Yesu Anjaneyulu <[email protected]>
wifi: mac80211: ibss: wait for in-flight TX on disconnect

Zhao Li <[email protected]>
wifi: cfg80211: validate rx/tx MLME callback frame lengths before access

Namjae Jeon <[email protected]>
ksmbd: validate SID namespace before mapping IDs

Namjae Jeon <[email protected]>
ksmbd: mark invalid session responses as signed

Namjae Jeon <[email protected]>
ksmbd: find bound sessions during reauthentication

Zhao Li <[email protected]>
wifi: cfg80211: validate assoc response length before status and IE access

Pengpeng Hou <[email protected]>
wifi: libertas: reject short monitor TX frames

Pengpeng Hou <[email protected]>
wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers

Zhao Li <[email protected]>
wifi: mac80211: validate deauth frame length before reason access

Corentin Labbe <[email protected]>
wifi: ralink: RT2X00: init EEPROM properly

Pengpeng Hou <[email protected]>
ALSA: usb-audio: caiaq: validate EP1 reply lengths

Namjae Jeon <[email protected]>
ksmbd: fix credit charge calculation for SMB2 QUERY_INFO

Perry Yuan <[email protected]>
drm/amdgpu: flush pending RCU callbacks on module unload

Jetha Chan <[email protected]>
ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table

David Howells <[email protected]>
netfs: Fix decision whether to disallow write-streaming due to fscache use

David Howells <[email protected]>
cachefiles: Fix double fput

Yousef Alhouseen <[email protected]>
xen/gntalloc: validate grant count before allocation

Farhad Alemi <[email protected]>
freevxfs: don't BUG() on unknown typed-extent type

Yousef Alhouseen <[email protected]>
xen/front-pgdir-shbuf: free grant reference head on errors

Qiang Liu <[email protected]>
ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling

Qiang Liu <[email protected]>
ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr

Gustavo Kenji Mendonça Kaneko <[email protected]>
drm/arm/komeda: fix error handling for clk_prepare_enable() and callers

Shubham Nayak <[email protected]>

    ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED

Qiang Liu <[email protected]>
ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr

Florian Westphal <[email protected]>
netfilter: nf_conntrack_expect: zero at allocation time

Gustavo Kenji Mendonça Kaneko <[email protected]>
drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend

Weiming Shi <[email protected]>
btrfs: tree-checker: validate INODE_REF's namelen

Praveen Talari <[email protected]>
spi: core: Abort active target transfer on controller suspend

Baojun Xu <[email protected]>
ASoC: tas2781: Update default register address to TAS2563

Haoxiang Li <[email protected]>
fbdev: pm2fb: unwind WC setup on probe failure

Kamlesh Chhetty <[email protected]>
ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk

Arnd Bergmann <[email protected]>
eth: mlx5: fix macsec dependency

Adriana Stancu <[email protected]>
rtc: bq32000: add delay between RTC reads

Yu Kuai <[email protected]>

    blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat()

Runyu Xiao <[email protected]>
net: au1000: move free_irq out of the close-time spinlocked section

Pengpeng Hou <[email protected]>
regulator: da9121: Use subvariant ids in the I2C table

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Use kstrtobool() to parse the ROM attribute input

Krzysztof Wilczyński <[email protected]>
PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device()

Namjae Jeon <[email protected]>
ksmbd: treat read-control opens as stat opens only for leases

Namjae Jeon <[email protected]>
ksmbd: break RH leases before delete-on-close

Namjae Jeon <[email protected]>
ksmbd: start file id allocation at 1

Namjae Jeon <[email protected]>
ksmbd: deny renaming directory with open children

Namjae Jeon <[email protected]>
ksmbd: apply create security descriptor first

Namjae Jeon <[email protected]>
ksmbd: treat unnamed DATA stream as base file

Namjae Jeon <[email protected]>
ksmbd: use connection ClientGUID for lease lookup

Namjae Jeon <[email protected]>
ksmbd: align SMB2 oplock break ack handling

Namjae Jeon <[email protected]>
ksmbd: validate SMB2 lease create contexts

Namjae Jeon <[email protected]>
ksmbd: fix lease break and ack state handling

Alex Markuze <[email protected]>
ceph: harden send_mds_reconnect and handle active-MDS peer reset

Tommy Huang <[email protected]>
rtc: aspeed: add AST2700 compatible

Xue Lei <[email protected]>
rtc: mv: add suspend/resume support for wakeup

Samuel Moelius <[email protected]>
f2fs: validate inline dentry name lengths before conversion

Chris Aherin <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7

Chen Cheng <[email protected]>
md/raid5: let stripe batch bm_seq comparison wrap-safe

Sebastian Andrzej Siewior <[email protected]>
mailbox: imx: use devm_of_platform_populate()

Sebastian Andrzej Siewior <[email protected]>
mailbox: imx: Add a channel shutdown field

Yu Kuai <[email protected]>
md/raid5: account discard IO

Sebastian Andrzej Siewior <[email protected]>
mailbox: imx: Use devm_pm_runtime_enable()

Peter Zijlstra <[email protected]>
perf: Fix addr_filter_ranges lifetime

Hans Zhang <[email protected]>
PCI: plda: Protect root bus removal with rescan lock

Hans Zhang <[email protected]>
PCI: mediatek: Protect root bus removal with rescan lock

Hans Zhang <[email protected]>
PCI: rockchip: Protect root bus removal with rescan lock

Hans Zhang <[email protected]>
PCI: altera: Protect root bus removal with rescan lock

Hans Zhang <[email protected]>
PCI: iproc: Protect root bus removal with rescan lock

David Francis <[email protected]>
drm/amdkfd: Properly acquire queue buffers in CRIU restore

Jean-Louis Colaco <[email protected]>
ALSA: usb-audio: Add quirk for YAMAHA CDS3000

Timur Kristóf <[email protected]>
drm/amdgpu: Use system unbound workqueue for soft IH ring

Xiaogang Chen <[email protected]>

    drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap

Xiaogang Chen <[email protected]>
drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl

Matthew Bystrin <[email protected]>

    mfd: rsmu: Add 8a34002 support

Piotr Kubik <[email protected]>
leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE

Akashdeep Kaur <[email protected]>
mfd: tps65219: Make poweroff handler conditional on system-power-controller

Tobias Deiminger <[email protected]>
leds: pca9532: Don't stop blinking for non-zero brightness

Yousef Alhouseen <[email protected]>
leds: uleds: Return -EFAULT on copy_to_user() failure

Galen Hassen <[email protected]>
ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10

Jakub Kicinski <[email protected]>
tls: reject the combination of TLS and sockmap

Ai Chao <[email protected]>
ALSA: usb-audio: Add quirk flags for SC13A

guoqi0226 <[email protected]>
spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()

Rob Herring (Arm) <[email protected]>
gpio: pisosr: Read "ngpios" as u32

Arnd Bergmann <[email protected]>
scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()

Zhang Tianci <[email protected]>

    fuse: set ff->flock only on success

Jiri Kosina <[email protected]>
HID: hidpp: fix potential UAF in hidpp_connect_event()

Yung-Tse Cheng <[email protected]>
virtio-fs: avoid double-free on failed queue setup

Viktor Menshin <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT

David Timber <[email protected]>
exfat: fix handling of damaged volume in exfat_create_upcase_table()

Rosen Penev <[email protected]>
sparc: Disable compat support with LLD

Leo Yan <[email protected]>
bpftool: Pass host flags to bootstrap libbpf

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA

Fredric Cover <[email protected]>
smb: client: fix races in cifsd thread creation

Alice Mikityanska <[email protected]>
net/sched: act_csum: don't mangle UDP tunnel GSO packets

Maxime Bélair <[email protected]>
apparmor: propagate -ENOMEM correctly in unpack_table

Jijie Shao <[email protected]>
net: hns3: improve the unused_tuple parameter setting

Agalakov Daniil <[email protected]>
e1000e: limit endianness conversion to boundary words

Raf Dickson <[email protected]>
vsock: use sk_acceptq_is_full() helper in all transports

Ido Schimmel <[email protected]>
ipv6: Honor oif when choosing nexthop for locally generated traffic

Vadim Fedorenko <[email protected]>
ptp: ocp: add shutdown callback

Nazim Amirul <[email protected]>
net: stmmac: xgmac2: disable RBUE in default RX interrupt mask

Rosen Penev <[email protected]>
sparc64: uprobes: add missing break

Chen Zhang <[email protected]>
Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923

Nils Helmig <[email protected]>
Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV

bui duc phuc <[email protected]>
ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure

bui duc phuc <[email protected]>
ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence

bui duc phuc <[email protected]>
ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt

Kiran K <[email protected]>
Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW

Samuel Moelius <[email protected]>
Bluetooth: L2CAP: validate connectionless PSM length

Cris <[email protected]>
Bluetooth: btusb: Add support for TP-Link TL-UB250

Chris Lu <[email protected]>

    Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38

Rong Zhang <[email protected]>
Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925

Hrvoje Nuic <[email protected]>
Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV

Chen Zhang <[email protected]>
Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922

Ravindra <[email protected]>

    Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040)

Chris Lu <[email protected]>

    Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c

Vadim Fedorenko <[email protected]>
spi: xilinx: let transfers timeout in case of no IRQ

Potin Lai <[email protected]>

    hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i

Tze Yee Ng <[email protected]>
dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc

Adrian Ng Ho Yin <[email protected]>
dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes

Jose Ignacio Tornos Martinez <[email protected]>
PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems

Armin Wolf <[email protected]>
hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist

Dave Carey <[email protected]>
HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts

Yuho Choi <[email protected]>
sctp: Unwind address notifier registration on failure

Mohamed Khalfella <[email protected]>
nvme-fc: Do not cancel requests in io target before it is initialized

Nikolay Metchev <[email protected]>
platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table

Xu Rao <[email protected]>
ata: libata-pmp: add JMicron JMS562 quirk

Moritz Baron <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8

Furst Blumier <[email protected]>
ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC

Vamsi Attunuru <[email protected]>
vdpa/octeon_ep: Use 4 bytes for mailbox signature

Evgenii Burenchev <[email protected]>
vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add()

Guangshuo Li <[email protected]>
net: lan966x: restore RX state on reload failure

George Moussalem <[email protected]>
net: dsa: qca8k: Add support for force mode for fixed link topology

Ben Maurer <[email protected]>
btrfs: use lockless read in nr_cached_objects shrinker callback

Anand Jain <[email protected]>
btrfs: use on-disk uuid for s_uuid in temp_fsid mounts

Kory Maincent <[email protected]>
hwmon: (adt7462) Add of_match_table to support devicetree

Shubham Chakraborty <[email protected]>
hwmon: (raspberrypi) Fix delayed-work teardown race

Jose Ignacio Tornos Martinez <[email protected]>
PCI: Avoid FLR for MediaTek MT7925 WiFi

Lu Yao <[email protected]>
fbcon: don't suspend/resume when vc is graphics mode

KangNing Liao <[email protected]>
btrfs: protect sb_write_pointer() with invalidate lock

Breno Leitao <[email protected]>
netconsole: take target_cleanup_list_lock in drop_netconsole_target()

Jiajia Liu <[email protected]>
wifi: mt76: transform aspm_conf for pci_disable_link_state

Javier Tia <[email protected]>

    wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv

Javier Tia <[email protected]>
wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec

Devin Wittmayer <[email protected]>

    wifi: mt76: mt7925: add Netgear A8500 USB device ID

Luis de Carlos <[email protected]>
platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen

Javier Tia <[email protected]>
wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS

Gleb Sonichev <[email protected]>
platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table

Chuck Lever <[email protected]>
tls: Flush backlog before waiting for a new record

Rosen Penev <[email protected]>
net: ibm: emac: mal: fix potential system hang in mal_remove()

Nikhil P. Rao <[email protected]>
pds_core: quiesce DMA before freeing resources

Al Viro <[email protected]>
configfs_depend_prep(): pass configfs_dirent instead of dentry

Jason Gunthorpe <[email protected]>
RDMA/mlx5: Create ODP EQ for non-pinned dmabuf MRs

Chuck Lever <[email protected]>
xprtrdma: Add request-pool slack for delayed recycling

Aurelien DESBRIERES <[email protected]>
RDMA/rtrs-srv: Fix integer underflow in process_read and process_write

Tuo Li <[email protected]>
ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend()

Dai Ngo <[email protected]>
NFS: fix eof updates after NFSv4.2 fallocate/zero-range

Zhang Cen <[email protected]>
btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF

ZhengYuan Huang <[email protected]>
btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()

Osama Abdelkader <[email protected]>
riscv: panic if IRQ handler stacks cannot be allocated

Rosen Penev <[email protected]>
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

Ruoyu Wang <[email protected]>
ALSA: es18xx: check control allocation before private data setup

Haoxiang Li <[email protected]>
net: microchip: sparx5: clean up PSFP resources on flower setup failure

Maoyi Xie <[email protected]>
hsr: broadcast netlink notifications in the device's net namespace

Guangshuo Li <[email protected]>
net: cpsw_new: unregister devlink on port registration failure

Dawei Feng <[email protected]>
bpf: NUL-terminate replaced sysctl value

Li RongQing <[email protected]>
RDMA/mlx5: Fix state and counter desync on loopback enable failure

Jason Gunthorpe <[email protected]>
RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()

Thiyagarajan Pandiyan <[email protected]>
wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications

Runyu Xiao <[email protected]>
ipv6: use READ_ONCE() for bindv6only default in inet6_create()

Yongqiang Sun <[email protected]>
drm/amdkfd: Unwind debug trap enable on copy_to_user failure

Rosen Penev <[email protected]>
ipmi: si: Use platform_get_irq_optional() to retrieve interrupt

Andrei Faleichyk <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP

Michael Walle <[email protected]>
clk: keystone: don't cache clock rate

Shay Drory <[email protected]>
net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition

Cyrill Gorcunov <[email protected]>
RDMA/irdma: Fix typo in SQ completions generation

Shay Drory <[email protected]>
net/mlx5e: Verify unique vhca_id count instead of range

Shiwu Zhang <[email protected]>
drm/amdgpu: fix buffer overflow during vBIOS update

Asad Kamal <[email protected]>
drm/amd/pm: bound pp_dpm_set_pp_table() memcpy

Stanley.Yang <[email protected]>
drm/amdgpu: harden FRU PIA parsing with bounded helpers

Alysa Liu <[email protected]>
drm/amdkfd: fix UAF race in destroy_queue_cpsch

Samson Tam <[email protected]>
drm/amd/display: Check for sharpening case when calculating max vtaps for scaler

Mathias Nyman <[email protected]>
xhci: Prevent queuing new commands if xhci is inaccessible

Michal Pecio <[email protected]>
usb: xhci: Improve Soft Retries after short transfers

Priyansh Jain <[email protected]>
thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries

Ioana Ciornei <[email protected]>
dpaa2-switch: fix handling of NAPI on the remove path

David Yang <[email protected]>
net: dsa: sja1105: flower: reject cross-chip redirect

Ioana Ciornei <[email protected]>
dpaa2-switch: fix the error path in dpaa2_switch_rx()

Ioana Ciornei <[email protected]>
dpaa2-switch: rework FDB management on the bridge leave path

Cássio Gabriel <[email protected]>
ALSA: seq: oss: Reject reads that cannot fit the next event

Cássio Gabriel <[email protected]>
ASoC: codecs: rk3328: Use managed GPIO and clock helpers

Alessandro Schino <[email protected]>
ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()

ZhengYuan Huang <[email protected]>
fs/ntfs3: validate index entry key bounds

Yao Sang <[email protected]>
nvme: refresh multipath head zoned limits from path limits

ZhengYuan Huang <[email protected]>
fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib

Adriano Vero <[email protected]>
powerpc/fadump: Add timeout to RTAS busy-wait loops

Simon Xue <[email protected]>
iommu/rockchip: disable fetch dte time limit

Jose Ignacio Tornos Martinez <[email protected]>
net: wwan: t7xx: Add delay between MD and SAP suspend

Wentao Liang <[email protected]>
net: qrtr: fix node refcount leak on ctrl packet alloc failure

Chen Pei <[email protected]>
ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach

Chen Pei <[email protected]>
ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge

liyouhong <[email protected]>
ata: ahci: fail probe if BAR too small for claimed ports

Cezary Rojewski <[email protected]>
ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm: return error code to consumers on failures

Miaoqing Pan <[email protected]>
wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi

Rosen Penev <[email protected]>
net: ibm: emac: Reserve VLAN header in MJS limit

Daniel Borkmann <[email protected]>
libbpf: Also reset {insn,data}_cur on realloc failure

Sanjay Chitroda <[email protected]>
iio: accel: mma8452: switch to non-devm request_threaded_irq()

Rik van Riel <[email protected]>
perf/ftrace: Fix WARNING in __unregister_ftrace_function

Miao Li <[email protected]>
iio: light: stk3310: Deal with the ps interrupt issue in PM

Lad Prabhakar <[email protected]>
mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC

Karl Mehltretter <[email protected]>
tracing: Disable KCOV instrumentation for trace_irqsoff.o

Ion Agorria <[email protected]>
ARM: tegra: p880: Lower CPU thermal limit

Lad Prabhakar <[email protected]>
mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC

Osama Abdelkader <[email protected]>
mmc: davinci: fix mmc_add_host order in probe

Bard Liao <[email protected]>
soundwire: only handle alert events when the peripheral is attached

Andreas Gruenbacher <[email protected]>
gfs2: page poisoning fix

Charles Keepax <[email protected]>
soundwire: dmi-quirks: Disable ghost Realtek devices

Kartik Rajput <[email protected]>
soc/tegra: fuse: Register nvmem lookups at probe

Tiezhu Yang <[email protected]>
libbpf: Add __NR_bpf definition for LoongArch

Timur Tabi <[email protected]>
drm/nouveau/bios: skip the IFR header if present

Cezary Rojewski <[email protected]>
ASoC: Intel: catpt: Complete coredump handling

Alexandre Courbot <[email protected]>
scripts: modpost: detect and report truncated buf_printf() output

shayderrr <[email protected]>
host1x: bus: Fix missing ops null check in error teardown

Claudiu Beznea <[email protected]>
pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP

Wei Qisen <[email protected]>
net: sfp: add quirk for OEM 2.5G optical modules

Viacheslav Dubeyko <[email protected]>
hfs: rework hfsplus_readdir() logic

ikaros <[email protected]>
ACPICA: add boundary checks in two places

ikaros <[email protected]>
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()

Weiming Shi <[email protected]>
ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()

ikaros <[email protected]>
ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()

ikaros <[email protected]>
ACPICA: Add validation for node in acpi_ns_build_normalized_path()

ikaros <[email protected]>
ACPICA: Add package limit checks in parser functions

ikaros <[email protected]>
ACPICA: validate handler object type in two places

ikaros <[email protected]>
ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()

ikaros <[email protected]>
ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)

ikaros <[email protected]>
ACPICA: Prevent adding invalid references

ikaros <[email protected]>
ACPICA: validate byte_count in acpi_ps_get_next_package_length()

ikaros <[email protected]>
ACPICA: add boundary checks in acpi_ps_get_next_field()

ikaros <[email protected]>
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()

ikaros <[email protected]>
ACPICA: Fix condition check in acpi_ps_parse_loop()

Ivan Lipski <[email protected]>
drm/amd/display: Initialize dsc_caps to 0

Jeremy Klarenbeek <[email protected]>
drm/amd/pm/si: Fix updating clock limits from power states

Imre Deak <[email protected]>
drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device

Haoxiang Li <[email protected]>
net: thunderx: fix PTP device ref leak in nicvf_probe()

Fernando Fernandez Mancera <[email protected]>
ipv6: addrconf: fix temp address generation after prefix deprecation

Luka Gejak <[email protected]>
net: hsr: require valid EOT supervision TLV

Uwe Küchler <[email protected]>
ALSA: usb-audio: Add quirk for Novation Mininova

Mostafa Saleh <[email protected]>
irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed

Stepan Ionichev <[email protected]>
iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind

Rosen Penev <[email protected]>
mips: cps: Assemble jr.hb with an R2 ISA level

Dario Binacchi <[email protected]>

    drm/panel: simple: Add AM-1280800W8TZQW-T00H

Sumeet Pawnikar <[email protected]>
powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()

Daniel Lezcano <[email protected]>
thermal/drivers/tegra/soctherma: Switch to devm cooling device registration

Adrian Ng Ho Yin <[email protected]>
clk: socfpga: agilex: implement l3_main_free_clk

Heiko Carstens <[email protected]>
s390/zcore: Removed unused variables

Jiayuan Chen <[email protected]>
rds: annotate data-race around rs_seen_congestion

Maoyi Xie <[email protected]>
rds: filter RDS_INFO_* getsockopt by caller's netns

Cássio Gabriel <[email protected]>
ALSA: seq: Remove arbitrary prioq insertion limit

Chenguang Zhao <[email protected]>
netlabel: fix IPv6 unlabeled address add error handling

Dian-Syuan Yang <[email protected]>
wifi: rtw89: pci: enable LTR based on pcie control register

Zqiang <[email protected]>
rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks()

Venkat Rao Bagalkote <[email protected]>
char/nvram: Remove redundant nvram_mutex

Thorsten Blum <[email protected]>
crypto: atmel-sha204a - remove sysfs group before hwrng

Christian Marangi <[email protected]>
usb: host: add ARCH_AIROHA in XHCI MTK dependency

Marco Felsch <[email protected]>
serial: 8250: fix possible ISR soft lockup

Maoyi Xie <[email protected]>
usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue

Dave Carey <[email protected]>
USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set

Stepan Ionichev <[email protected]>

    usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log

Oliver Neukum <[email protected]>
usb: core: hcd: fix possible deadlock in rh control transfers

Adrian Wowk <[email protected]>
usbip: vhci_hcd: fix NULL deref in status_show_vhci

Nikhil Chatterjee <[email protected]>
HID: bpf: Add Huion Inspiroy Frego M button quirk

Christoph Hellwig <[email protected]>
isofs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
omfs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
hpfs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
jfs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
qnx4: handle set_blocksize failures

Christoph Hellwig <[email protected]>
minix: handle set_blocksize failures

Christoph Hellwig <[email protected]>
bfs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
affs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
ntfs3: handle set_blocksize failures

Christoph Hellwig <[email protected]>
befs: handle set_blocksize failures

Thomas Lin <[email protected]>
spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs

Allison Henderson <[email protected]>
net/rds: Don't sleep inside rds_ib_conn_path_shutdown

Eric Dumazet <[email protected]>

    net/sched: sch_drr: make cl->quantum lockless

Eric Dumazet <[email protected]>
net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()

Jan Volckaert <[email protected]>
net: usb: qmi_wwan: add MeiG SRM813Q

Maurizio Lombardi <[email protected]>
nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl

Yury Norov <[email protected]>
bitfield: wire __bf_shf to __builtin_ctzll

Gil Fine <[email protected]>
thunderbolt: Verify Router Ready bit is set after router enumeration

Miri Korenblit <[email protected]>
wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed

Gil Fine <[email protected]>
thunderbolt: Increase timeout for Configuration Ready bit

Sudeep Holla <[email protected]>
firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

Sudeep Holla <[email protected]>
firmware: arm_scmi: Validate SENSOR_UPDATE payload size

Alan Borzeszkowski <[email protected]>
thunderbolt: Improve multi-display DisplayPort tunnel allocation

Pooja Katiyar <[email protected]>
thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host()

Ido Schimmel <[email protected]>
bridge: Add missing READ_ONCE() annotations around FDB destination port

Candice Li <[email protected]>
drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw

Pierre Barre <[email protected]>
9p: use kvzalloc for readdir buffer

Brajesh Gupta <[email protected]>
drm/imagination: Populate FW common context ID before passing to the FW

Leonardo Bras <[email protected]>
arm64/daifflags: Make local_daif_*() helpers __always_inline

Pierre Barre <[email protected]>
9p: invalidate readdir buffer on seek

Anna Maniscalco <[email protected]>
iommu: arm-smmu-qcom: Ensure smmu is powered up in set_ttbr0_cfg

Andrea Righi <[email protected]>
sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity

Cássio Gabriel <[email protected]>
ALSA: usx2y: Drain pending US-428 pipe-4 output commands

David Francis <[email protected]>
drm/amdkfd: Check bounds on allocate_doorbell

Sunday Clement <[email protected]>
drm/amdkfd: Fix OOB memory exposure in get_wave_state()

David Francis <[email protected]>
drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

Bjorn Helgaas <[email protected]>

    PCI: Wait for device readiness after D3hot -> D0uninitialized transition

Joonwon Kang <[email protected]>
mailbox: Make mbox_send_message() return error code when tx fails

Christoph Hellwig <[email protected]>
iomap: don't make REQ_POLLED imply REQ_NOWAIT

Luca Leonardo Scorcia <[email protected]>
drm/mediatek: dsi: Add compatible for mt8167-dsi

Chenguang Zhao <[email protected]>
RDMA/mlx5: Use QP port when decoding responder CQEs

Alessandro Baldi <[email protected]>
media: imon: Add iMON VFD HID OEM v1.2 key mappings

Thorsten Blum <[email protected]>
crypto: atmel-ecc - add support for atecc608b

Bard Liao <[email protected]>
ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally

Lukas Wunner <[email protected]>
crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y

Kumar Meiyappan <[email protected]>
scsi: pm8001: Reject non-fatal dump when controller is crashed

Kumar Meiyappan <[email protected]>
scsi: pm8001: Reject firmware update in fatal error state

Alexey Klimov <[email protected]>
clk: samsung: exynos850: mark APM I3C clocks as critical

Peter Ujfalusi <[email protected]>
soundwire: intel: Move suspend tracking from trigger to pm suspend

Pengpeng Hou <[email protected]>
drivers/of: validate status properties in reconfig state changes

Stefan Berger <[email protected]>
integrity: Check for NULL returned by asymmetric_key_public_key

Mieczyslaw Nalewaj <[email protected]>
net: dsa: realtek: rtl8365mb: add support for RTL8367SB

Ping-Ke Shih <[email protected]>
wifi: rtw89: phy: check length before parsing PHY status IE

Dave Carey <[email protected]>
HID: multitouch: Fix Yoga Book 9 14IAH10 touchscreen misclassification

Arash Golgol <[email protected]>
media: video-i2c: use vb2_video_unregister_device on driver removal

Ricardo Ribalda <[email protected]>
media: chips-media: wave5: Add range checks for dec_output_info

Sophie D <[email protected]>
drm/gud: Add RCade Display Adapter VID/PID pair

chunzhi.lin <[email protected]>
net: phy: motorcomm: use device properties for firmware tuning

Viacheslav Dubeyko <[email protected]>
hfsplus: rework hfsplus_readdir() logic

Florian Eckert <[email protected]>
PCI: intel-gw: Enable clock before PHY init

Tom Chung <[email protected]>
drm/amd/display: Fix CRC open failure during active rendering

Brodie Abrew <[email protected]>
platform/x86: sel3350-platform: Retain LED state on load and unload

Stepan Ionichev <[email protected]>

    mmc: davinci: avoid NULL deref of host->data in IRQ handler

Shawn Lin <[email protected]>
mmc: core: Add validation for host-provided max_segs

Tzung-Bi Shih <[email protected]>
platform/chrome: Resolve kb_wake_angle visibility race

Yevgeny Kliteynik <[email protected]>
net/mlx5: HWS, Handle destroying table that has a miss table

Mark Pearson <[email protected]>
watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk

Ranjani Vaidyanathan <[email protected]>
watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94

Mark Pearson <[email protected]>
watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform

Ethan Nelson-Moore <[email protected]>
ASoC: ti: omap3pandora: update board check to use DT compatible

Arnd Bergmann <[email protected]>
media: qcom: camss: avoid format string warning

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()

Ziyi Guo <[email protected]>
dlm: add usercopy whitelist to dlm_cb cache

Parth Pancholi <[email protected]>
drm/bridge: tc358768: Set pre_enable_prev_first for reverse order

Geert Uytterhoeven <[email protected]>
clk: renesas: cpg-mssr: Add number of clock cells check

Thorsten Blum <[email protected]>
crypto: omap - add omap_des_unregister_algs helper

Ruoyu Wang <[email protected]>
crypto: ixp4xx - fix buffer chain unwind on allocation failure

Justin Lai <[email protected]>
rtase: Fix flow control configuration

Johannes Berg <[email protected]>
wifi: mac80211: explicitly disable FTM responder on AP stop

Haoxiang Li <[email protected]>
media: em28xx-video: fix missing res_free() on init_usb_xfer failure

Marek Behún <[email protected]>
net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family

Marek Behún <[email protected]>

    net: dsa: mv88e6xxx: define .pot_clear() for 6321

Ben Reed <[email protected]>
PCI: switchtec: Add Gen6 Device IDs

Marek Behún <[email protected]>
net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family

Zhaoyang Yu <[email protected]>
media: dm1105: fix missing error check for dma_alloc_coherent

David Heidelberg <[email protected]>
drm/panel: Enable GPIOLIB for panels which uses functions from it

Lijo Lazar <[email protected]>
drm/amdgpu: Prefer ROM BAR for default VGA device

Ovidiu Bunea <[email protected]>
drm/amd/display: Find link encoder for flexible DIG mapping cases

Alan Borzeszkowski <[email protected]>
thunderbolt: Don't create multiple DMA tunnels on firmware connection manager

Mika Westerberg <[email protected]>

    thunderbolt: Set tb->root_switch to NULL when domain is stopped

Mika Westerberg <[email protected]>
thunderbolt: Keep the domain reference while processing hotplug

Mika Westerberg <[email protected]>
thunderbolt: Keep XDomain reference during the lifetime of a service

Mika Westerberg <[email protected]>
thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()

Mika Westerberg <[email protected]>
thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible

Gil Fine <[email protected]>
thunderbolt: Avoid reserved fields in path config space for USB4 routers

Vineeth Vijayan <[email protected]>
s390/cio: Purge based on the cdev's online status

Erni Sri Satya Vennela <[email protected]>
net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG

Riccardo Boninsegna <[email protected]>
media: rc: mceusb: Add support for 04eb:e033

Viken Dadhaniya <[email protected]>
spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM

Brandon Brnich <[email protected]>
media: chips-media: wave5: Fix Reports from Kernel Lock Validator

Pengpeng Hou <[email protected]>
soundwire: validate DT compatible before parsing it

Charles Keepax <[email protected]>
soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list

Danielle Ratson <[email protected]>
bridge: Do not suppress ARP probes and DAD NS unconditionally

Siew Chin Lim <[email protected]>
firmware: stratix10-svc: change get provision data to async SMC call

Marco Elver <[email protected]>
kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access()

Shengjiu Wang <[email protected]>
ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit

Dian-Syuan Yang <[email protected]>
wifi: rtw89: disable CSI STBC for VHT 160MHz

Panagiotis Petrakopoulos <[email protected]>

    wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()

Johannes Berg <[email protected]>
wifi: mac80211: always allow transmitting null-data on TXQs

Johannes Berg <[email protected]>
wifi: nl80211: reject beacons with bad HE operation

Viacheslav Dubeyko <[email protected]>
hfsplus: fix issue of direct writes beyond end-of-file

Yuqi Xu <[email protected]>
wifi: cfg80211: reject duplicate wiphy cipher suite entries

Lukas Wunner <[email protected]>
PCI: Stop setting cached power state to 'unknown' on unbind

Thomas Weißschuh <[email protected]>
tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang

Hirokazu Honda <[email protected]>
tee: optee: Allow MT_NORMAL_TAGGED shared memory

Xu Yang <[email protected]>
usb: gadget: udc: skip pullup() if already connected

Goldwyn Rodrigues <[email protected]>
ima: return error early if file xattr cannot be changed

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate write errors in generic mixer put callbacks

Lad Prabhakar <[email protected]>
pinctrl: renesas: rzg2l: Handle RZ/V2H(P) IOLH configuration in PM cache

Kevin Tung <[email protected]>
iio: adc: rtq6056: add i2c_device_id support

Jie Wang <[email protected]>
gfs2: move quota_init qc iterator increment

Jie Wang <[email protected]>
gfs2: fix quota init duplicate scan

Lijo Lazar <[email protected]>
drm/amd/pm: Check SMUv13.0.6/12 metrics integrity

Dmitry Baryshkov <[email protected]>
drm/panel: jadard-jd9365da-h3: set prepare_prev_first

Dominik Kaszewski <[email protected]>
drm/amd/display: Fix DPMS using partially updated pipe context

Tommaso Merciai <[email protected]>
drm: rz-du: Ensure correct suspend/resume ordering with VSP

Ioana Ciornei <[email protected]>
bus: fsl-mc: wait for the MC firmware to complete its boot

Boris Brezillon <[email protected]>
drm/gem: Consider GEM object reclaimable if shrinking fails

Abdifatah Suruur <[email protected]>
ksmbd: fix use-after-free in oplock break notification

-------------

Diffstat:

 Documentation/filesystems/nfs/reexport.rst         |  10 +-
 Documentation/hwmon/hwmon-kernel-api.rst           |   3 +
 Documentation/netlink/specs/rt_link.yaml           |   2 +
 Documentation/networking/ethtool-netlink.rst       |   2 +-
 Documentation/networking/scaling.rst               |  15 +-
 Documentation/scheduler/sched-ext.rst              |   2 +-
 Documentation/sound/designs/midi-2.0.rst           |  11 +
 MAINTAINERS                                        |   4 +-
 Makefile                                           |   4 +-
 arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts       |  13 +
 arch/arm/kernel/hw_breakpoint.c                    |  11 +-
 arch/arm/mach-ux500/cpu-db8500.c                   |   6 +-
 arch/arm/mm/cache-feroceon-l2.c                    |   2 +-
 arch/arm/mm/cache-tauros2.c                        |   2 +-
 arch/arm/mm/fault.c                                |  12 +-
 arch/arm64/boot/dts/qcom/sc8180x.dtsi              |  16 +-
 arch/arm64/boot/dts/qcom/sdm845.dtsi               |  64 +--
 arch/arm64/boot/dts/qcom/sm8150.dtsi               |   8 +-
 arch/arm64/boot/dts/qcom/sm8250.dtsi               |  12 +-
 arch/arm64/boot/dts/qcom/sm8350.dtsi               |   8 +-
 arch/arm64/boot/dts/qcom/sm8450.dtsi               |   8 +-
 arch/arm64/boot/dts/qcom/sm8550.dtsi               |   8 +-
 arch/arm64/boot/dts/qcom/sm8650.dtsi               |   8 +-
 arch/arm64/include/asm/daifflags.h                 |  10 +-
 arch/arm64/include/asm/fixmap.h                    |   6 +-
 arch/arm64/include/asm/kprobes.h                   |   6 +
 arch/arm64/kernel/machine_kexec.c                  |   3 +-
 arch/arm64/kernel/probes/kprobes.c                 |  23 +-
 arch/mips/kernel/cps-vec.S                         |   6 +
 arch/powerpc/kernel/eeh_driver.c                   |   2 -
 arch/powerpc/kexec/file_load_64.c                  |   2 +-
 arch/powerpc/kvm/book3s_hv.c                       |   4 +-
 arch/powerpc/perf/core-book3s.c                    |   8 +-
 arch/powerpc/platforms/ps3/repository.c            |   5 +-
 arch/powerpc/platforms/pseries/kexec.c             |  13 +-
 arch/powerpc/platforms/pseries/rtas-fadump.c       |  80 +--
 arch/powerpc/platforms/pseries/rtas-fadump.h       |   6 +
 arch/riscv/kernel/irq.c                            |  22 +-
 arch/s390/boot/ipl_parm.c                          |  26 +-
 arch/s390/boot/physmem_info.c                      |   2 +-
 arch/s390/crypto/aes_s390.c                        |  87 ++--
 arch/s390/kernel/ipl.c                             |  12 +-
 arch/s390/kernel/perf_pai_crypto.c                 |   3 +-
 arch/s390/kernel/perf_pai_ext.c                    |   3 +-
 arch/s390/kernel/vtime.c                           |  25 +-
 arch/s390/net/bpf_jit_comp.c                       |  11 -
 arch/sparc/Kconfig                                 |   1 +
 arch/sparc/kernel/uprobes.c                        |   1 +
 arch/x86/crypto/aria-aesni-avx2-asm_64.S           |   6 +
 arch/x86/crypto/aria-gfni-avx512-asm_64.S          |   3 +
 arch/x86/events/amd/brs.c                          |   3 +-
 arch/x86/events/amd/ibs.c                          |   3 +-
 arch/x86/events/amd/lbr.c                          |   3 +-
 arch/x86/events/core.c                             |   5 +-
 arch/x86/events/intel/core.c                       |   4 +-
 arch/x86/events/intel/ds.c                         | 208 +++++---
 arch/x86/events/intel/lbr.c                        |   3 +-
 arch/x86/events/perf_event.h                       |  14 +-
 arch/x86/include/asm/alternative.h                 |   2 +-
 arch/x86/include/asm/barrier.h                     |  10 +-
 arch/x86/include/asm/cmpxchg.h                     |   4 +-
 arch/x86/include/asm/cmpxchg_32.h                  |   4 +-
 arch/x86/include/asm/edac.h                        |   2 +-
 arch/x86/include/asm/perf_event.h                  |  16 +-
 arch/x86/include/asm/pgtable.h                     |   2 +-
 arch/x86/include/asm/sync_bitops.h                 |  12 +-
 arch/x86/kvm/svm/sev.c                             | 243 +++++----
 arch/x86/kvm/svm/svm.c                             |  33 +-
 arch/x86/kvm/svm/svm.h                             |  23 +-
 block/blk-cgroup.c                                 |  13 +-
 crypto/Makefile                                    |   5 +
 drivers/accel/ivpu/ivpu_fw_log.c                   |  87 ++--
 drivers/accel/ivpu/ivpu_gem.h                      |  14 +-
 drivers/accel/ivpu/ivpu_ipc.c                      |   7 +-
 drivers/accel/qaic/qaic_control.c                  |  46 +-
 drivers/acpi/acpi_apd.c                            |   7 +
 drivers/acpi/acpi_tad.c                            | 188 ++++---
 drivers/acpi/acpica/dsmethod.c                     |  43 ++
 drivers/acpi/acpica/evhandler.c                    |  11 +
 drivers/acpi/acpica/exconfig.c                     |  26 +-
 drivers/acpi/acpica/exoparg3.c                     |   2 +-
 drivers/acpi/acpica/nsnames.c                      |   6 +
 drivers/acpi/acpica/nsprepkg.c                     |   7 +
 drivers/acpi/acpica/nsxfname.c                     |   4 +
 drivers/acpi/acpica/psargs.c                       | 134 ++++-
 drivers/acpi/acpica/psloop.c                       |  30 +-
 drivers/acpi/acpica/psparse.c                      |  14 +
 drivers/acpi/acpica/utcopy.c                       |  10 +-
 drivers/acpi/acpica/utresrc.c                      |  30 ++
 drivers/acpi/apei/ghes.c                           |  24 +-
 drivers/acpi/pci_root.c                            |   4 +
 drivers/acpi/processor_driver.c                    |   2 +-
 drivers/acpi/scan.c                                |   1 +
 drivers/ata/ahci.c                                 |  22 +
 drivers/ata/libata-core.c                          |  10 +
 drivers/ata/libata-pmp.c                           |   7 +-
 drivers/base/core.c                                |  91 +++-
 drivers/block/sunvdc.c                             |  17 +
 drivers/block/zram/zram_drv.c                      |  62 +--
 drivers/block/zram/zram_drv.h                      |   5 +-
 drivers/bluetooth/btintel.c                        |  39 +-
 drivers/bluetooth/btintel_pcie.c                   |  22 +-
 drivers/bluetooth/btmtk.c                          |  11 +
 drivers/bluetooth/btmtk.h                          |   1 +
 drivers/bluetooth/btqcomsmd.c                      |   6 +-
 drivers/bluetooth/btrtl.c                          |  21 +-
 drivers/bluetooth/btusb.c                          |  47 +-
 drivers/bluetooth/hci_mrvl.c                       |   3 +-
 drivers/bus/fsl-mc/fsl-mc-bus.c                    |  46 ++
 drivers/char/ipmi/ipmi_si_platform.c               |   5 +-
 drivers/char/nvram.c                               |  16 +-
 drivers/char/virtio_console.c                      |  21 +-
 drivers/clk/keystone/sci-clk.c                     |   8 +
 drivers/clk/renesas/renesas-cpg-mssr.c             |   3 +
 drivers/clk/samsung/clk-exynos850.c                |   5 +-
 drivers/clk/socfpga/clk-agilex.c                   |   2 +
 drivers/clk/ux500/clk-prcmu.c                      |  20 +-
 drivers/clk/ux500/u8500_of_clk.c                   |   2 +-
 drivers/clocksource/timer-orion.c                  |   2 +-
 drivers/cpufreq/apple-soc-cpufreq.c                |  36 +-
 drivers/cpufreq/cpufreq.c                          |   6 +-
 drivers/cpuidle/cpuidle-ux500.c                    |   6 +-
 drivers/crypto/atmel-ecc.c                         |  11 +-
 drivers/crypto/atmel-sha204a.c                     |   3 +-
 drivers/crypto/ccp/sev-dev.c                       |   2 +-
 drivers/crypto/intel/iaa/iaa_crypto_main.c         |  36 +-
 drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c        |  25 +-
 drivers/crypto/omap-des.c                          |  26 +-
 .../crypto/virtio/virtio_crypto_akcipher_algs.c    |  81 ++-
 .../crypto/virtio/virtio_crypto_skcipher_algs.c    |  13 +-
 drivers/cxl/core/Makefile                          |   2 +
 drivers/cxl/core/core.h                            |  12 +
 drivers/cxl/core/pci.c                             | 318 ------------
 drivers/cxl/core/ras.c                             | 186 +++++++
 drivers/cxl/core/ras_rch.c                         | 136 +++++
 drivers/cxl/pci.c                                  |   1 -
 drivers/dma/altera-msgdma.c                        |  24 +-
 drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c     |  11 +-
 drivers/edac/amd64_edac.c                          |   2 +
 drivers/edac/edac_device_sysfs.c                   |  11 +-
 drivers/edac/igen6_edac.c                          |  27 +-
 drivers/firmware/arm_scmi/base.c                   |  15 +-
 drivers/firmware/arm_scmi/sensors.c                |  10 +-
 drivers/firmware/efi/cper.c                        |   5 +-
 drivers/firmware/efi/cper_cxl.c                    |  38 +-
 drivers/firmware/efi/cper_cxl.h                    |  54 +-
 drivers/firmware/stratix10-svc.c                   |   4 +-
 drivers/gpio/gpio-dwapb.c                          |  17 +
 drivers/gpio/gpio-pisosr.c                         |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c         |  23 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h         |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c           |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |   8 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c     |  97 ++--
 drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c            |  34 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h            |   2 +-
 drivers/gpu/drm/amd/amdgpu/psp_v11_0.c             |   8 +-
 drivers/gpu/drm/amd/amdgpu/psp_v12_0.c             |   8 +-
 drivers/gpu/drm/amd/amdgpu/psp_v13_0.c             |  14 +-
 drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c           |  14 +-
 drivers/gpu/drm/amd/amdgpu/psp_v14_0.c             |  14 +-
 drivers/gpu/drm/amd/amdgpu/psp_v3_1.c              |   8 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |  10 +-
 drivers/gpu/drm/amd/amdkfd/kfd_debug.c             |   6 +
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c  |  17 +-
 drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c          |   8 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c    |  11 +-
 .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c |  12 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |   2 +-
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c  |   7 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  |  20 +-
 drivers/gpu/drm/amd/display/dc/core/dc.c           |  21 +-
 .../drm/amd/display/dc/dml2/dml2_mall_phantom.c    |   6 +-
 .../gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c |   8 +-
 .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c  |  12 +-
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c         |  31 +-
 drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c   |   3 +
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c   |   4 +
 drivers/gpu/drm/arm/display/komeda/komeda_dev.c    |   6 +-
 drivers/gpu/drm/arm/display/komeda/komeda_drv.c    |  14 +-
 drivers/gpu/drm/arm/malidp_drv.c                   |  22 +-
 drivers/gpu/drm/bridge/tc358768.c                  |   2 +
 drivers/gpu/drm/display/drm_dp_helper.c            |   2 +
 drivers/gpu/drm/drm_exec.c                         |  13 +
 drivers/gpu/drm/drm_gem.c                          |  10 +
 drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c         |  21 +-
 drivers/gpu/drm/gud/gud_drv.c                      |   1 +
 drivers/gpu/drm/i915/i915_query.c                  |   4 +-
 drivers/gpu/drm/imagination/pvr_context.c          |  32 +-
 drivers/gpu/drm/logicvc/Kconfig                    |   1 -
 drivers/gpu/drm/mediatek/mtk_dsi.c                 |   1 +
 .../gpu/drm/nouveau/nvkm/subdev/bios/shadowrom.c   | 110 +++-
 drivers/gpu/drm/panel/Kconfig                      |  11 +-
 drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c   |   2 +
 drivers/gpu/drm/panel/panel-simple.c               |  28 +
 drivers/gpu/drm/renesas/rz-du/rzg2l_du_vsp.c       |  16 +
 drivers/gpu/drm/renesas/rz-du/rzg2l_du_vsp.h       |   2 +
 drivers/gpu/drm/tiny/cirrus.c                      |   7 +-
 drivers/gpu/drm/vc4/vc4_hvs.c                      |   2 +-
 drivers/gpu/drm/vc4/vc4_v3d.c                      |   2 +-
 drivers/gpu/drm/virtio/virtgpu_display.c           |   2 +-
 drivers/gpu/drm/xe/xe_oa.c                         |   6 +-
 drivers/gpu/host1x/bus.c                           |   4 +-
 .../hid/bpf/progs/Huion__Inspiroy-Frego-M.bpf.c    |  87 ++++
 drivers/hid/hid-apple.c                            |  18 +-
 drivers/hid/hid-logitech-hidpp.c                   |   1 +
 drivers/hid/hid-mcp2221.c                          |  15 +-
 drivers/hid/hid-multitouch.c                       | 147 +++++-
 drivers/hid/hid-sony.c                             |  82 ++-
 drivers/hid/hid-universal-pidff.c                  |   4 +-
 drivers/hv/connection.c                            |  47 +-
 drivers/hv/hyperv_vmbus.h                          |   2 +
 drivers/hwmon/adt7462.c                            |   8 +
 drivers/hwmon/applesmc.c                           |   7 +-
 drivers/hwmon/aspeed-pwm-tacho.c                   |   4 +-
 drivers/hwmon/chipcap2.c                           |   9 +-
 drivers/hwmon/corsair-cpro.c                       |  24 +-
 drivers/hwmon/corsair-psu.c                        |  23 +-
 drivers/hwmon/dell-smm-hwmon.c                     |   8 +
 drivers/hwmon/gpio-fan.c                           |  13 +-
 drivers/hwmon/hwmon.c                              |  16 +-
 drivers/hwmon/ina2xx.c                             |  14 +-
 drivers/hwmon/ltc4282.c                            |   2 +-
 drivers/hwmon/pmbus/lm25066.c                      |  60 +--
 drivers/hwmon/pmbus/pmbus_core.c                   |   4 +-
 drivers/hwmon/raspberrypi-hwmon.c                  |  12 +-
 drivers/hwtracing/coresight/coresight-platform.c   |  12 +-
 drivers/i2c/i2c-core-smbus.c                       |  12 +
 drivers/i3c/master/mipi-i3c-hci/cmd_v1.c           |   4 +-
 drivers/i3c/master/mipi-i3c-hci/cmd_v2.c           |   4 +-
 drivers/iio/accel/mma8452.c                        |  19 +-
 drivers/iio/adc/qcom-spmi-iadc.c                   |  18 +-
 drivers/iio/adc/rtq6056.c                          |  10 +-
 drivers/iio/light/stk3310.c                        |  76 ++-
 drivers/infiniband/core/umem.c                     |  18 +-
 drivers/infiniband/hw/bnxt_re/qplib_res.c          |  11 +
 drivers/infiniband/hw/irdma/utils.c                |   2 +-
 drivers/infiniband/hw/mlx5/cq.c                    |   3 +-
 drivers/infiniband/hw/mlx5/main.c                  |  11 +
 drivers/infiniband/hw/mlx5/mr.c                    |   4 +
 drivers/infiniband/hw/mlx5/odp.c                   |   3 +
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             |  12 +-
 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c     |  21 +-
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c         |   9 +
 drivers/iommu/rockchip-iommu.c                     |   8 +
 drivers/irqchip/irq-gic-v3-its.c                   |   1 +
 drivers/leds/leds-pca9532.c                        |   8 +-
 drivers/leds/trigger/ledtrig-gpio.c                |   3 +-
 drivers/leds/uleds.c                               |  11 +-
 drivers/mailbox/imx-mailbox.c                      |  64 ++-
 drivers/mailbox/mailbox.c                          |   6 +-
 drivers/md/raid10.c                                |   5 +
 drivers/md/raid5.c                                 |  35 +-
 drivers/media/i2c/video-i2c.c                      |   2 +-
 drivers/media/pci/dm1105/dm1105.c                  |   7 +-
 .../platform/chips-media/wave5/wave5-vpu-dec.c     |  47 +-
 .../platform/chips-media/wave5/wave5-vpuapi.c      |  11 +-
 .../vcodec/decoder/vdec/vdec_av1_req_lat_if.c      |   5 +-
 drivers/media/platform/qcom/camss/camss-csiphy.c   |  10 +-
 .../platform/verisilicon/hantro_g2_hevc_dec.c      |   6 +-
 .../verisilicon/rockchip_vpu981_hw_av1_dec.c       |  57 +-
 drivers/media/rc/imon.c                            |   4 +
 drivers/media/rc/mceusb.c                          |   2 +
 drivers/media/usb/as102/as102_usb_drv.c            |  75 ++-
 drivers/media/usb/em28xx/em28xx-video.c            |   4 +-
 drivers/media/v4l2-core/v4l2-ctrls-core.c          |  32 ++
 drivers/media/v4l2-core/v4l2-h264.c                |   3 +-
 drivers/mfd/ab8500-core.c                          |   2 +-
 drivers/mfd/db8500-prcmu.c                         |   6 +-
 drivers/mfd/rsmu_i2c.c                             |   2 +
 drivers/mfd/rsmu_spi.c                             |   2 +
 drivers/mfd/tps65219.c                             |  14 +-
 drivers/mmc/core/queue.c                           |   8 +-
 drivers/mmc/host/davinci_mmc.c                     |  16 +-
 drivers/mmc/host/renesas_sdhi_internal_dmac.c      |   2 +
 drivers/net/bonding/bond_alb.c                     |  32 +-
 drivers/net/bonding/bond_main.c                    |   4 +-
 drivers/net/dsa/bcm_sf2_cfp.c                      |   2 +
 drivers/net/dsa/lantiq_gswip.c                     | 367 +++----------
 drivers/net/dsa/lantiq_gswip.h                     | 252 +++++++++
 drivers/net/dsa/mv88e6xxx/chip.c                   |  23 +-
 drivers/net/dsa/qca/qca8k-8xxx.c                   |  22 +-
 drivers/net/dsa/qca/qca8k.h                        |   1 +
 drivers/net/dsa/realtek/rtl8365mb.c                |  14 +
 drivers/net/dsa/sja1105/sja1105_flower.c           |   4 +-
 drivers/net/ethernet/allwinner/sun4i-emac.c        |   2 +
 drivers/net/ethernet/amd/au1000_eth.c              |   3 +-
 drivers/net/ethernet/amd/pds_core/core.c           |   4 +
 drivers/net/ethernet/amd/pds_core/fw.c             |  10 +-
 drivers/net/ethernet/amd/pds_core/main.c           |  10 +-
 drivers/net/ethernet/amd/xgbe/xgbe-dev.c           |   3 +-
 drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c   |   4 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |  19 +-
 drivers/net/ethernet/cadence/macb.h                |   2 +-
 drivers/net/ethernet/cadence/macb_main.c           |  39 +-
 drivers/net/ethernet/cavium/thunder/nicvf_main.c   |   8 +-
 drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c      |   4 +-
 drivers/net/ethernet/cortina/gemini.c              |  77 +--
 .../net/ethernet/freescale/dpaa2/dpaa2-switch.c    |  69 ++-
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    |  12 +
 drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c  |   4 +-
 drivers/net/ethernet/ibm/emac/core.c               |   3 +-
 drivers/net/ethernet/ibm/emac/mal.c                |   6 +-
 drivers/net/ethernet/intel/e1000e/ethtool.c        |  19 +-
 drivers/net/ethernet/intel/iavf/iavf_ethtool.c     |   2 +-
 drivers/net/ethernet/intel/ice/ice_common.c        |   9 +-
 drivers/net/ethernet/intel/ice/ice_ethtool.c       |   2 +-
 drivers/net/ethernet/intel/ice/ice_sched.c         |   4 +-
 drivers/net/ethernet/intel/ice/ice_trace.h         |  64 ++-
 drivers/net/ethernet/intel/ice/ice_txrx.c          |  20 +-
 drivers/net/ethernet/intel/ice/ice_type.h          |   2 +-
 drivers/net/ethernet/intel/idpf/idpf_txrx.c        |  10 +-
 drivers/net/ethernet/marvell/octeontx2/af/mcs.c    |  10 +
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c    |  33 +-
 .../ethernet/marvell/octeontx2/af/rvu_debugfs.c    |  10 +-
 drivers/net/ethernet/marvell/octeontx2/nic/qos.c   |  60 ++-
 drivers/net/ethernet/mellanox/mlx5/core/Kconfig    |   2 +-
 drivers/net/ethernet/mellanox/mlx5/core/en/port.c  |  15 +-
 drivers/net/ethernet/mellanox/mlx5/core/en/rqt.c   |  27 +-
 .../net/ethernet/mellanox/mlx5/core/en/tc/sample.c |   7 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c |   2 +-
 .../net/ethernet/mellanox/mlx5/core/en_ethtool.c   |   1 +
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c  |   8 +-
 .../mellanox/mlx5/core/eswitch_offloads_termtbl.c  |   7 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   3 +-
 .../mlx5/core/steering/hws/mlx5hws_table.c         |   3 +
 drivers/net/ethernet/micrel/ks8842.c               |   4 +-
 drivers/net/ethernet/micrel/ks8851_common.c        |  10 +-
 drivers/net/ethernet/micrel/ks8851_spi.c           |   4 +-
 drivers/net/ethernet/micrel/ksz884x.c              |   4 +-
 .../net/ethernet/microchip/lan966x/lan966x_fdma.c  |  20 +
 .../net/ethernet/microchip/sparx5/sparx5_psfp.c    |   5 +-
 .../ethernet/microchip/sparx5/sparx5_tc_flower.c   |  18 +-
 drivers/net/ethernet/microsoft/mana/mana_en.c      |  12 +-
 .../net/ethernet/netronome/nfp/nfp_net_ethtool.c   |  36 +-
 drivers/net/ethernet/oa_tc6.c                      | 514 +++++++++++-------
 drivers/net/ethernet/pensando/ionic/ionic_txrx.c   |  13 +-
 drivers/net/ethernet/realtek/rtase/rtase.h         |   4 +
 drivers/net/ethernet/realtek/rtase/rtase_main.c    |   3 +
 drivers/net/ethernet/sfc/ethtool.c                 |   1 +
 drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h     |   4 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  | 169 ++++--
 drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c   |   1 -
 drivers/net/ethernet/ti/cpsw.c                     |  41 +-
 drivers/net/ethernet/ti/cpsw_new.c                 |   4 +-
 drivers/net/gtp.c                                  |   5 +
 drivers/net/ieee802154/cc2520.c                    |   5 +-
 drivers/net/ieee802154/mac802154_hwsim.c           |  10 +-
 drivers/net/mctp/mctp-i3c.c                        |   9 +-
 drivers/net/netconsole.c                           |   2 +
 drivers/net/phy/Kconfig                            |  17 +-
 drivers/net/phy/Makefile                           |   3 +-
 drivers/net/phy/mediatek/Kconfig                   |  22 +
 drivers/net/phy/mediatek/Makefile                  |   3 +
 .../{mediatek-ge-soc.c => mediatek/mtk-ge-soc.c}   |   0
 .../net/phy/{mediatek-ge.c => mediatek/mtk-ge.c}   |  29 ++
 drivers/net/phy/motorcomm.c                        |  41 +-
 drivers/net/phy/phy_device.c                       |  16 +
 drivers/net/phy/sfp.c                              |   2 +
 drivers/net/ppp/ppp_async.c                        |  89 +---
 drivers/net/ppp/ppp_synctty.c                      |  97 +---
 drivers/net/usb/cx82310_eth.c                      |   1 +
 drivers/net/usb/hso.c                              |   2 +-
 drivers/net/usb/pegasus.c                          |  54 +-
 drivers/net/usb/pegasus.h                          |   3 -
 drivers/net/usb/qmi_wwan.c                         |   2 +
 drivers/net/vxlan/vxlan_core.c                     |  13 +-
 drivers/net/vxlan/vxlan_mdb.c                      |   8 +
 drivers/net/vxlan/vxlan_vnifilter.c                |  13 +-
 drivers/net/wireless/ath/ath11k/dp_rx.c            |  50 +-
 drivers/net/wireless/ath/ath9k/hif_usb.c           |  12 +-
 drivers/net/wireless/ath/ath9k/hif_usb.h           |   2 +-
 drivers/net/wireless/intel/ipw2x00/libipw_rx.c     |   4 +-
 drivers/net/wireless/intel/iwlwifi/fw/acpi.c       |   5 +
 drivers/net/wireless/intel/iwlwifi/iwl-drv.c       |  13 +-
 drivers/net/wireless/intel/iwlwifi/mvm/d3.c        |  19 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c  |  25 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |   7 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mvm.h       |   3 -
 drivers/net/wireless/intel/iwlwifi/mvm/rx.c        |   5 +
 drivers/net/wireless/intel/iwlwifi/mvm/scan.c      |   4 +-
 .../net/wireless/intel/iwlwifi/mvm/time-event.c    |   5 +
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c        |  45 +-
 drivers/net/wireless/intel/iwlwifi/pcie/rx.c       |   9 +-
 drivers/net/wireless/marvell/libertas/tx.c         |   7 +
 drivers/net/wireless/marvell/mwifiex/fw.h          |  18 +-
 drivers/net/wireless/marvell/mwifiex/join.c        |   8 +-
 drivers/net/wireless/marvell/mwifiex/sta_cmd.c     |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c    |  33 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mac.c    |   9 +
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c    |   5 +
 drivers/net/wireless/mediatek/mt76/mt7925/usb.c    |   3 +
 drivers/net/wireless/mediatek/mt76/pci.c           |   8 +-
 drivers/net/wireless/ralink/rt2x00/rt2400pci.c     |   2 +-
 drivers/net/wireless/ralink/rt2x00/rt2500pci.c     |   2 +-
 drivers/net/wireless/ralink/rt2x00/rt2800pci.c     |   2 +-
 drivers/net/wireless/ralink/rt2x00/rt61pci.c       |   2 +-
 drivers/net/wireless/realtek/rtw88/fw.c            |   3 +
 drivers/net/wireless/realtek/rtw89/core.c          |   4 +-
 drivers/net/wireless/realtek/rtw89/mac_be.c        |   4 +
 drivers/net/wireless/realtek/rtw89/pci.c           |  16 +-
 drivers/net/wireless/rsi/rsi_91x_hal.c             |   8 +
 drivers/net/wireless/rsi/rsi_91x_mgmt.c            |   6 +-
 drivers/net/wireless/virtual/mac80211_hwsim.c      |   6 +-
 drivers/net/wwan/t7xx/t7xx_pci.c                   |   3 +
 drivers/nvdimm/claim.c                             |   9 +-
 drivers/nvme/host/apple.c                          | 182 +++----
 drivers/nvme/host/core.c                           |  34 +-
 drivers/nvme/host/fc.c                             |   7 +-
 drivers/nvme/host/rdma.c                           |  18 +-
 drivers/nvme/host/tcp.c                            |  17 +-
 drivers/nvme/target/rdma.c                         |  15 +-
 drivers/of/dynamic.c                               |  20 +-
 drivers/of/overlay.c                               |  15 +
 drivers/opp/of.c                                   |   2 +-
 drivers/pci/controller/dwc/pcie-intel-gw.c         |  19 +-
 drivers/pci/controller/pcie-altera.c               |   2 +
 drivers/pci/controller/pcie-iproc.c                |   2 +
 drivers/pci/controller/pcie-mediatek.c             |   2 +
 drivers/pci/controller/pcie-rockchip-host.c        |   2 +
 drivers/pci/controller/plda/pcie-plda-host.c       |   2 +
 drivers/pci/pci-driver.c                           |  10 +-
 drivers/pci/pci-sysfs.c                            |  14 +-
 drivers/pci/pci.c                                  |  24 +-
 drivers/pci/proc.c                                 |  79 ++-
 drivers/pci/quirks.c                               |   5 +
 drivers/pci/switch/switchtec.c                     |  16 +
 drivers/perf/riscv_pmu_legacy.c                    |   5 +-
 drivers/perf/riscv_pmu_sbi.c                       |  98 ++--
 drivers/pinctrl/renesas/pinctrl-rzg2l.c            |   3 +-
 drivers/pinctrl/renesas/pinctrl-rzv2m.c            |   4 +-
 drivers/platform/chrome/cros_ec_sensorhub.c        |   6 +-
 drivers/platform/chrome/cros_ec_sysfs.c            |   5 +-
 drivers/platform/x86/dell/dell-laptop.c            |   9 +
 drivers/platform/x86/intel/hid.c                   |   7 +
 drivers/platform/x86/msi-ec.c                      |   1 +
 drivers/platform/x86/sel3350-platform.c            | 136 +++--
 drivers/powercap/intel_rapl_common.c               |   3 +-
 drivers/ptp/ptp_ocp.c                              |   1 +
 drivers/ras/amd/atl/core.c                         |   1 -
 drivers/regulator/core.c                           | 163 +++---
 drivers/regulator/da9121-regulator.c               |  18 +-
 drivers/regulator/db8500-prcmu.c                   |  12 +-
 drivers/rtc/rtc-aspeed.c                           |   1 +
 drivers/rtc/rtc-bq32k.c                            |   9 +
 drivers/rtc/rtc-mv.c                               |  23 +
 drivers/s390/char/zcore.c                          |   8 +-
 drivers/s390/cio/device.c                          |   2 +-
 drivers/s390/net/ism_drv.c                         |   4 +-
 drivers/s390/net/qeth_l2.h                         |   3 +-
 drivers/s390/net/qeth_l2_main.c                    |  26 +-
 drivers/s390/net/qeth_l2_sys.c                     |   7 +-
 drivers/scsi/bfa/bfa_fcs_lport.c                   |   2 +-
 drivers/scsi/mpi3mr/mpi3mr_transport.c             |   8 +
 drivers/scsi/mpt3sas/mpt3sas_base.c                |   5 +-
 drivers/scsi/pm8001/pm8001_ctl.c                   |   8 +
 drivers/scsi/pm8001/pm80xx_hwi.c                   |   7 +
 drivers/scsi/scsi_error.c                          |   2 +-
 drivers/soc/tegra/fuse/fuse-tegra.c                |  14 +-
 drivers/soc/ti/pm33xx.c                            |   2 +-
 drivers/soundwire/bus.c                            |   4 +
 drivers/soundwire/dmi-quirks.c                     |  35 ++
 drivers/soundwire/intel.c                          |  31 +-
 drivers/soundwire/intel_ace2x.c                    |  39 +-
 drivers/soundwire/intel_auxdevice.c                |   2 +
 drivers/soundwire/slave.c                          |   4 +-
 drivers/spi/spi-dw-dma.c                           |   3 +-
 drivers/spi/spi-dw-mmio.c                          |   7 +-
 drivers/spi/spi-dw.h                               |   1 +
 drivers/spi/spi-qcom-qspi.c                        |  44 +-
 drivers/spi/spi-xilinx.c                           |   6 +-
 drivers/spi/spi.c                                  |   9 +-
 drivers/staging/fbtft/fbtft-core.c                 |   9 +-
 drivers/target/iscsi/iscsi_target.c                |   4 +-
 drivers/tee/optee/call.c                           |   3 +-
 drivers/thermal/db8500_thermal.c                   |  10 +-
 drivers/thermal/qcom/tsens.c                       | 111 ++--
 drivers/thermal/qcom/tsens.h                       |   1 +
 drivers/thermal/tegra/soctherm.c                   |   6 +-
 drivers/thermal/thermal_sysfs.c                    |  12 +-
 drivers/thunderbolt/icm.c                          |  10 +
 drivers/thunderbolt/path.c                         |  31 +-
 drivers/thunderbolt/switch.c                       |   6 +
 drivers/thunderbolt/tb.c                           |   9 +-
 drivers/thunderbolt/tb_regs.h                      |   1 +
 drivers/thunderbolt/usb4.c                         |  11 +-
 drivers/thunderbolt/xdomain.c                      |  49 +-
 drivers/tty/serial/8250/8250_port.c                |   7 +
 drivers/usb/atm/xusbatm.c                          |   6 +-
 drivers/usb/class/cdc-acm.c                        |   6 +
 drivers/usb/class/usbtmc.c                         |   2 -
 drivers/usb/core/hcd.c                             |  14 +-
 drivers/usb/gadget/function/f_fs.c                 |  31 +-
 drivers/usb/gadget/udc/aspeed_udc.c                |   7 +-
 drivers/usb/gadget/udc/core.c                      |   7 +-
 drivers/usb/gadget/udc/goku_udc.c                  |   3 +-
 drivers/usb/host/Kconfig                           |   2 +-
 drivers/usb/host/xhci-debugfs.c                    |  10 +-
 drivers/usb/host/xhci-hub.c                        |   2 +-
 drivers/usb/host/xhci-mem.c                        |  34 +-
 drivers/usb/host/xhci-pci.c                        |   9 +-
 drivers/usb/host/xhci-ring.c                       |  13 +-
 drivers/usb/host/xhci.c                            |  31 +-
 drivers/usb/host/xhci.h                            |  39 +-
 drivers/usb/serial/spcp8x5.c                       |   6 +-
 drivers/usb/usbip/vhci_sysfs.c                     |  52 +-
 drivers/vdpa/ifcvf/ifcvf_main.c                    |  14 +-
 drivers/vdpa/octeon_ep/octep_vdpa_main.c           |   6 +-
 drivers/vdpa/solidrun/snet_main.c                  |   6 +-
 drivers/vdpa/vdpa_sim/vdpa_sim_blk.c               |   3 +-
 drivers/vdpa/vdpa_sim/vdpa_sim_net.c               |   7 +-
 drivers/vhost/scsi.c                               |   3 +-
 drivers/vhost/vdpa.c                               |  88 +++-
 drivers/video/fbdev/core/fbcon.c                   |   9 +-
 drivers/video/fbdev/pm2fb.c                        |   1 +
 drivers/video/fbdev/vfb.c                          |  11 +-
 drivers/virtio/virtio.c                            |   2 +-
 drivers/virtio/virtio_input.c                      |   9 +-
 drivers/virtio/virtio_pci_common.c                 |   4 +-
 drivers/watchdog/db8500_wdt.c                      |  22 +-
 drivers/watchdog/imx7ulp_wdt.c                     |  10 +-
 drivers/watchdog/lenovo_se10_wdt.c                 |  82 ++-
 drivers/watchdog/msc313e_wdt.c                     |  74 ++-
 drivers/watchdog/sunxi_wdt.c                       |  45 +-
 drivers/watchdog/watchdog_hrtimer_pretimeout.c     |   1 +
 drivers/xen/balloon.c                              |  56 +-
 drivers/xen/gntalloc.c                             |  13 +-
 drivers/xen/xen-front-pgdir-shbuf.c                |  12 +-
 fs/9p/vfs_dir.c                                    |  14 +-
 fs/affs/affs.h                                     |   5 -
 fs/affs/super.c                                    |   6 +-
 fs/afs/addr_list.c                                 |   5 +-
 fs/afs/fs_probe.c                                  |   1 +
 fs/afs/server.c                                    |   1 -
 fs/autofs/inode.c                                  |   4 +-
 fs/befs/linuxvfs.c                                 |   3 +-
 fs/bfs/inode.c                                     |   3 +-
 fs/btrfs/accessors.h                               |   1 +
 fs/btrfs/acl.h                                     |   2 +
 fs/btrfs/compression.c                             |  16 +-
 fs/btrfs/ctree.h                                   |  11 +-
 fs/btrfs/defrag.c                                  |  32 +-
 fs/btrfs/delayed-ref.h                             |   2 +
 fs/btrfs/dir-item.h                                |   1 +
 fs/btrfs/direct-io.c                               |  41 +-
 fs/btrfs/direct-io.h                               |   2 +
 fs/btrfs/discard.h                                 |   1 +
 fs/btrfs/disk-io.c                                 |  11 +-
 fs/btrfs/extent-io-tree.h                          |   6 +-
 fs/btrfs/extent-tree.h                             |   1 -
 fs/btrfs/extent_io.c                               |  53 +-
 fs/btrfs/extent_map.c                              |  94 ++--
 fs/btrfs/extent_map.h                              |   8 +-
 fs/btrfs/fiemap.c                                  |   4 +-
 fs/btrfs/file-item.h                               |   2 +
 fs/btrfs/file.c                                    | 136 +++--
 fs/btrfs/file.h                                    |   2 +
 fs/btrfs/free-space-cache.c                        |  10 +-
 fs/btrfs/fs.c                                      |  10 +-
 fs/btrfs/fs.h                                      |  10 +
 fs/btrfs/inode.c                                   | 181 +++----
 fs/btrfs/ioctl.c                                   | 171 +++---
 fs/btrfs/ioctl.h                                   |   5 +-
 fs/btrfs/locking.c                                 |   1 -
 fs/btrfs/ordered-data.c                            |   8 +-
 fs/btrfs/ordered-data.h                            |   1 +
 fs/btrfs/print-tree.h                              |   2 +
 fs/btrfs/props.h                                   |   1 +
 fs/btrfs/qgroup.h                                  |   3 +
 fs/btrfs/raid-stripe-tree.c                        |  25 +-
 fs/btrfs/raid-stripe-tree.h                        |   2 +
 fs/btrfs/reflink.c                                 |   8 +-
 fs/btrfs/relocation.c                              |  71 ++-
 fs/btrfs/send.c                                    |   3 +-
 fs/btrfs/space-info.c                              |   2 +-
 fs/btrfs/subpage.c                                 |   1 -
 fs/btrfs/super.c                                   |   2 +-
 fs/btrfs/sysfs.h                                   |   1 +
 fs/btrfs/tests/extent-io-tests.c                   |   6 +-
 fs/btrfs/tests/extent-map-tests.c                  |  56 +-
 fs/btrfs/tests/inode-tests.c                       |  67 +--
 fs/btrfs/transaction.c                             |  13 +-
 fs/btrfs/tree-checker.c                            |  41 ++
 fs/btrfs/tree-log.c                                |  12 +-
 fs/btrfs/verity.c                                  |   4 +-
 fs/btrfs/volumes.c                                 |  10 +-
 fs/btrfs/volumes.h                                 |   4 +
 fs/btrfs/xattr.h                                   |   2 +
 fs/btrfs/zoned.c                                   |  15 +-
 fs/cachefiles/namei.c                              |   1 -
 fs/ceph/caps.c                                     |  69 ++-
 fs/ceph/crypto.c                                   |  46 +-
 fs/ceph/mds_client.c                               | 196 ++++++-
 fs/ceph/mds_client.h                               |   2 -
 fs/ceph/super.h                                    |   5 +-
 fs/configfs/dir.c                                  |  12 +-
 fs/dlm/memory.c                                    |   4 +-
 fs/erofs/decompressor_lzma.c                       |  18 +-
 fs/erofs/zutil.c                                   |   2 +
 fs/exec.c                                          |  22 +-
 fs/exfat/nls.c                                     |  19 +-
 fs/f2fs/inline.c                                   |   7 +
 fs/freevxfs/vxfs_bmap.c                            |   3 +-
 fs/fuse/dev.c                                      |  27 +-
 fs/fuse/file.c                                     |   3 +-
 fs/fuse/virtio_fs.c                                |   2 +
 fs/gfs2/bmap.c                                     |  19 +
 fs/gfs2/bmap.h                                     |   1 +
 fs/gfs2/file.c                                     |  10 +
 fs/gfs2/quota.c                                    |  36 +-
 fs/hfs/catalog.c                                   |   9 -
 fs/hfs/dir.c                                       |  28 +-
 fs/hfs/hfs.h                                       |   3 +-
 fs/hfs/hfs_fs.h                                    |   2 -
 fs/hfs/inode.c                                     |   4 -
 fs/hfsplus/catalog.c                               |  11 -
 fs/hfsplus/dir.c                                   |  28 +-
 fs/hfsplus/hfsplus_fs.h                            |   5 +-
 fs/hfsplus/inode.c                                 |  40 +-
 fs/hfsplus/super.c                                 |   2 -
 fs/hpfs/super.c                                    |   3 +-
 fs/iomap/direct-io.c                               |   2 +-
 fs/isofs/inode.c                                   |   3 +-
 fs/jfs/super.c                                     |   3 +-
 fs/minix/inode.c                                   |   3 +-
 fs/netfs/buffered_read.c                           |   2 +-
 fs/netfs/buffered_write.c                          |   2 +-
 fs/netfs/internal.h                                |  12 +
 fs/nfs/blocklayout/rpc_pipefs.c                    |  41 +-
 fs/nfs/export.c                                    |   3 +-
 fs/nfs/nfs42proc.c                                 |  15 +-
 fs/nfs/nfs4idmap.c                                 |   8 +-
 fs/nfsd/filecache.c                                |  34 +-
 fs/nfsd/netns.h                                    |  14 +-
 fs/nfsd/nfs4callback.c                             |  78 ++-
 fs/nfsd/nfs4proc.c                                 |  32 +-
 fs/nfsd/nfs4recover.c                              |  76 +--
 fs/nfsd/nfs4state.c                                | 257 +++++++--
 fs/nfsd/nfsctl.c                                   | 199 ++++---
 fs/nfsd/nfsd.h                                     |  15 -
 fs/nfsd/state.h                                    |   5 +-
 fs/nfsd/trace.h                                    |  14 +-
 fs/nfsd/xdr4.h                                     |   1 +
 fs/ntfs3/dir.c                                     |   4 +-
 fs/ntfs3/fslog.c                                   |  28 +-
 fs/ntfs3/index.c                                   |  41 +-
 fs/ntfs3/super.c                                   |   8 +-
 fs/ntfs3/xattr.c                                   |   4 +-
 fs/ocfs2/dir.c                                     |  71 ++-
 fs/omfs/inode.c                                    |   6 +-
 fs/pidfs.c                                         |  65 ++-
 fs/qnx4/inode.c                                    |   3 +-
 fs/smb/client/cifsacl.c                            |  30 +-
 fs/smb/client/cifspdu.h                            |   8 -
 fs/smb/client/connect.c                            |  27 +-
 fs/smb/client/file.c                               |   5 +-
 fs/smb/client/link.c                               |   2 +-
 fs/smb/client/misc.c                               |  24 +-
 fs/smb/client/readdir.c                            |   9 +-
 fs/smb/client/reparse.c                            |   5 +-
 fs/smb/client/smb1ops.c                            |   2 +-
 fs/smb/client/smb2ops.c                            | 487 +++++++++++------
 fs/smb/client/smb2pdu.h                            |  20 -
 fs/smb/client/trace.h                              |   2 +-
 fs/smb/client/transport.c                          |  11 +-
 fs/smb/common/smb2pdu.h                            |  29 ++
 fs/smb/server/mgmt/share_config.c                  |  36 +-
 fs/smb/server/mgmt/user_session.c                  |  25 +-
 fs/smb/server/misc.c                               |  14 +-
 fs/smb/server/oplock.c                             | 221 ++++++--
 fs/smb/server/oplock.h                             |   2 +-
 fs/smb/server/server.c                             |   6 +
 fs/smb/server/smb2misc.c                           |   9 +-
 fs/smb/server/smb2pdu.c                            | 281 +++++-----
 fs/smb/server/smb2pdu.h                            |  20 -
 fs/smb/server/smbacl.c                             |  88 ++--
 fs/smb/server/transport_ipc.c                      |  21 +-
 fs/smb/server/vfs.c                                |  46 +-
 fs/smb/server/vfs_cache.c                          |  28 +-
 fs/smb/server/vfs_cache.h                          |   8 +-
 fs/super.c                                         |   9 +-
 fs/ufs/cylinder.c                                  |  10 +
 fs/ufs/dir.c                                       |   2 +-
 fs/ufs/super.c                                     |  17 +-
 fs/xfs/libxfs/xfs_btree_mem.c                      |   2 +
 fs/xfs/libxfs/xfs_btree_staging.c                  |   4 +-
 fs/xfs/libxfs/xfs_defer.c                          |   2 +-
 fs/xfs/libxfs/xfs_exchmaps.c                       |  10 +
 fs/xfs/libxfs/xfs_parent.c                         |  13 +-
 fs/xfs/scrub/agheader_repair.c                     |  39 +-
 fs/xfs/scrub/alloc_repair.c                        |  18 +-
 fs/xfs/scrub/dir_repair.c                          |  10 +-
 fs/xfs/scrub/dirtree.c                             |  31 +-
 fs/xfs/scrub/dirtree_repair.c                      |   2 +
 fs/xfs/scrub/findparent.c                          |  56 +-
 fs/xfs/scrub/ialloc.c                              |   4 +
 fs/xfs/scrub/quota_repair.c                        |  14 +-
 fs/xfs/scrub/quotacheck.c                          |   4 +-
 fs/xfs/scrub/scrub.c                               |   3 +-
 fs/xfs/scrub/stats.c                               |  60 ++-
 fs/xfs/scrub/stats.h                               |   4 +-
 fs/xfs/scrub/symlink_repair.c                      |   2 +-
 fs/xfs/scrub/trace.h                               |  35 +-
 fs/xfs/xfs_exchmaps_item.c                         |  19 +-
 fs/xfs/xfs_exchrange.c                             |  12 +-
 include/cxl/event.h                                |  80 +++
 include/linux/bio.h                                |  14 -
 include/linux/bitfield.h                           |   2 +-
 include/linux/bpf.h                                |   1 +
 include/linux/bpf_verifier.h                       |   4 +-
 include/linux/cper.h                               |   4 +
 include/linux/device.h                             |   1 +
 include/linux/ethtool.h                            |  28 +-
 include/linux/exportfs.h                           |   1 +
 include/linux/firmware/intel/stratix10-smc.h       |  18 +-
 include/linux/fwnode.h                             |   1 +
 include/linux/hugetlb.h                            |   5 +
 include/linux/hwmon.h                              |   1 +
 include/linux/igmp.h                               |   7 +-
 include/linux/kcsan-checks.h                       |   6 +-
 include/linux/mailbox_controller.h                 |   2 +
 include/linux/mfd/db8500-prcmu.h                   | 252 ++++++++-
 include/linux/mfd/dbx500-prcmu.h                   | 575 ---------------------
 include/linux/mm.h                                 |   2 +
 include/linux/mm_inline.h                          |  15 +-
 include/linux/mm_types.h                           |  27 +-
 include/linux/mmzone.h                             |   2 +
 include/linux/oa_tc6.h                             |  50 ++
 include/linux/perf/riscv_pmu.h                     |   2 +-
 include/linux/perf_event.h                         |   7 +-
 include/linux/phy.h                                |   1 +
 include/linux/platform_data/cros_ec_proto.h        |   2 +
 include/linux/rbtree_augmented.h                   |  35 +-
 include/linux/sched.h                              |   1 +
 include/linux/skbuff.h                             |   5 +
 include/linux/sunrpc/rpc_pipe_fs.h                 |   4 +-
 include/linux/sunrpc/svc.h                         |  21 +-
 include/linux/sunrpc/svc_rdma.h                    |   3 +-
 include/linux/sunrpc/xdr.h                         |  13 +
 include/linux/switchtec.h                          |   1 +
 include/linux/thunderbolt.h                        |   2 +
 include/linux/workqueue.h                          |  38 +-
 include/media/v4l2-hevc.h                          |  41 ++
 include/net/cfg80211.h                             |   2 +-
 include/net/cfg802154.h                            |   1 +
 include/net/dst.h                                  |   6 +
 include/net/if_inet6.h                             |   2 -
 include/net/inet6_hashtables.h                     |   2 +-
 include/net/ip.h                                   |  28 +-
 include/net/ip6_route.h                            |  45 ++
 include/net/ip6_tunnel.h                           |   2 +-
 include/net/ip_fib.h                               |   5 +
 include/net/ipv6.h                                 |  10 +-
 include/net/netlink.h                              |  14 +
 include/net/sch_generic.h                          |   2 +-
 include/net/tcp.h                                  |   8 +-
 include/rdma/ib_umem.h                             |   4 +-
 include/sound/hda_codec.h                          |  30 ++
 include/sound/rawmidi.h                            |   2 +
 include/sound/tas2781.h                            |   4 +-
 include/trace/events/hwmon.h                       |  10 +-
 include/trace/events/icmp.h                        |  13 +-
 include/uapi/linux/ethtool.h                       | 128 ++---
 include/uapi/linux/virtio_crypto.h                 |   1 +
 include/uapi/sound/asound.h                        |   6 +-
 io_uring/net.c                                     |  10 +-
 kernel/bpf/bpf_iter.c                              |   2 +-
 kernel/bpf/btf.c                                   |  24 +-
 kernel/bpf/cgroup.c                                |   1 +
 kernel/bpf/disasm.c                                |   5 +-
 kernel/bpf/stackmap.c                              | 175 +++++--
 kernel/bpf/verifier.c                              | 123 +++--
 kernel/events/core.c                               |  27 +-
 kernel/events/ring_buffer.c                        |   9 +-
 kernel/locking/lockdep.c                           |  50 +-
 kernel/printk/nbcon.c                              |   2 +-
 kernel/rcu/tasks.h                                 |   3 +-
 kernel/sched/ext.c                                 |  10 +-
 kernel/sched/fair.c                                | 209 +++-----
 kernel/time/clockevents.c                          |  35 +-
 kernel/time/tick-broadcast.c                       |  36 +-
 kernel/time/tick-internal.h                        |   2 +
 kernel/trace/Makefile                              |   5 +-
 kernel/trace/bpf_trace.c                           |  11 +
 kernel/trace/ring_buffer.c                         |  26 +-
 kernel/trace/trace_event_perf.c                    |  12 +-
 kernel/trace/trace_events_hist.c                   |  42 +-
 kernel/trace/trace_events_user.c                   |  26 +-
 kernel/trace/trace_probe.c                         |  48 +-
 kernel/trace/trace_probe.h                         |   2 +
 kernel/workqueue.c                                 |   5 +-
 mm/damon/core.c                                    |  13 +-
 mm/gup.c                                           |  10 +-
 mm/huge_memory.c                                   |  10 +
 mm/hugetlb.c                                       |   6 +-
 mm/hugetlb_vmemmap.c                               |   6 +-
 mm/migrate_device.c                                |   6 +
 mm/mm_init.c                                       |   2 +
 mm/page_alloc.c                                    |   5 +
 mm/slab.h                                          |   8 +-
 mm/slab_common.c                                   |  41 +-
 mm/slub.c                                          | 116 ++---
 mm/swap.c                                          |  49 +-
 mm/swapfile.c                                      |   8 +-
 mm/vmscan.c                                        |  78 ++-
 net/8021q/vlan.c                                   |   7 +-
 net/8021q/vlan_dev.c                               |  32 +-
 net/9p/client.c                                    |   2 +-
 net/appletalk/aarp.c                               |   5 +
 net/bluetooth/hci_core.c                           |   4 +-
 net/bluetooth/iso.c                                |  31 +-
 net/bluetooth/l2cap_core.c                         |  38 +-
 net/bluetooth/msft.c                               |   2 +-
 net/bluetooth/rfcomm/core.c                        |   5 +
 net/bridge/br_arp_nd_proxy.c                       |  16 +-
 net/bridge/br_device.c                             |   2 +-
 net/bridge/br_fdb.c                                |   7 +-
 net/bridge/br_input.c                              |   2 +-
 net/bridge/br_multicast.c                          |  11 +-
 net/core/dev.c                                     |   2 +-
 net/core/drop_monitor.c                            |  18 +-
 net/core/filter.c                                  |  17 +-
 net/core/gro_cells.c                               |   2 +
 net/core/rtnetlink.c                               |   7 +-
 net/core/skbuff.c                                  |   7 +
 net/ethtool/ioctl.c                                | 212 +++++++-
 net/hsr/hsr_forward.c                              |   2 +-
 net/hsr/hsr_netlink.c                              |   9 +-
 net/hsr/hsr_slave.c                                |  11 +-
 net/ieee802154/6lowpan/core.c                      |   2 +-
 net/ipv4/fib_rules.c                               |   4 +-
 net/ipv4/fib_trie.c                                |   4 +
 net/ipv4/fou_core.c                                |   2 +-
 net/ipv4/icmp.c                                    |   2 +-
 net/ipv4/igmp.c                                    | 210 +++++---
 net/ipv4/inet_fragment.c                           |   6 +
 net/ipv4/ip_output.c                               |   4 +-
 net/ipv4/ip_sockglue.c                             |   2 +-
 net/ipv4/ip_tunnel_core.c                          |   6 +
 net/ipv4/ipmr.c                                    |   5 +-
 net/ipv4/netfilter/nf_reject_ipv4.c                |   2 +-
 net/ipv4/nexthop.c                                 |   2 +-
 net/ipv4/route.c                                   |   4 +-
 net/ipv4/tcp.c                                     |  14 +-
 net/ipv4/tcp_ipv4.c                                |  15 +-
 net/ipv4/tcp_minisocks.c                           |   2 +-
 net/ipv4/tcp_offload.c                             |  22 +-
 net/ipv4/tcp_output.c                              |  10 +-
 net/ipv4/tcp_timer.c                               |   6 +-
 net/ipv4/udp.c                                     |   4 +-
 net/ipv6/addrconf.c                                |  10 +-
 net/ipv6/af_inet6.c                                |   2 +-
 net/ipv6/exthdrs.c                                 |  99 ++--
 net/ipv6/ioam6.c                                   |  17 +-
 net/ipv6/ip6_fib.c                                 |   4 +-
 net/ipv6/ip6_gre.c                                 |   8 +-
 net/ipv6/ip6_input.c                               |  34 +-
 net/ipv6/ip6_output.c                              |  54 +-
 net/ipv6/ip6_tunnel.c                              |   8 +-
 net/ipv6/ip6_vti.c                                 |   2 +-
 net/ipv6/ip6mr.c                                   |   9 +-
 net/ipv6/ipv6_sockglue.c                           |  13 +-
 net/ipv6/mcast.c                                   | 257 +++++----
 net/ipv6/netfilter.c                               |   4 +-
 net/ipv6/netfilter/ip6_tables.c                    |   5 +
 net/ipv6/netfilter/nf_reject_ipv6.c                |   2 +-
 net/ipv6/output_core.c                             |   2 +-
 net/ipv6/reassembly.c                              |  10 +-
 net/ipv6/route.c                                   |  19 +-
 net/ipv6/seg6_iptunnel.c                           |   6 +-
 net/ipv6/sit.c                                     |   2 +-
 net/ipv6/tcp_ipv6.c                                |  15 +-
 net/ipv6/tcpv6_offload.c                           |  15 +-
 net/ipv6/xfrm6_output.c                            |   2 +-
 net/l2tp/l2tp_debugfs.c                            |   4 +
 net/l2tp/l2tp_ppp.c                                |  56 +-
 net/mac80211/cfg.c                                 |   9 +-
 net/mac80211/ibss.c                                |   9 +-
 net/mac80211/mlme.c                                |   6 +-
 net/mac80211/tx.c                                  |   2 +-
 net/mac80211/util.c                                |   6 +-
 net/mac802154/ieee802154_i.h                       |   8 +
 net/mac802154/iface.c                              |   6 +
 net/mac802154/main.c                               |   1 +
 net/mac802154/rx.c                                 | 120 ++++-
 net/mac802154/scan.c                               |  10 +-
 net/mptcp/options.c                                |   7 +-
 net/mptcp/protocol.c                               |   5 +-
 net/mptcp/protocol.h                               |   2 +-
 net/mptcp/subflow.c                                |   1 -
 net/mptcp/syncookies.c                             |   5 +-
 net/netfilter/ipset/ip_set_hash_gen.h              |  13 +-
 net/netfilter/ipvs/ip_vs_sync.c                    |  20 +-
 net/netfilter/nf_conntrack_expect.c                |   3 +-
 net/netfilter/nf_conntrack_netlink.c               |  13 +-
 net/netfilter/nf_conntrack_proto_tcp.c             |  10 +-
 net/netfilter/nf_conntrack_sip.c                   |   2 +-
 net/netfilter/nf_log_syslog.c                      |   6 +-
 net/netfilter/nfnetlink_log.c                      |  28 +-
 net/netfilter/nft_set_pipapo_avx2.c                |   1 +
 net/netlabel/netlabel_unlabeled.c                  |   2 +-
 net/openvswitch/flow.c                             |   4 +-
 net/openvswitch/flow_table.c                       |   4 +-
 net/packet/af_packet.c                             | 101 +++-
 net/phonet/pn_dev.c                                |  30 +-
 net/qrtr/af_qrtr.c                                 |   4 +-
 net/rds/af_rds.c                                   |  63 ++-
 net/rds/connection.c                               | 102 +++-
 net/rds/ib_cm.c                                    |  25 +-
 net/rds/ib_recv.c                                  |   9 +-
 net/rds/message.c                                  |   4 +-
 net/rds/send.c                                     |  16 +-
 net/rds/tcp.c                                      | 164 ++++--
 net/rds/tcp_listen.c                               |   6 +-
 net/sched/act_api.c                                |  46 +-
 net/sched/act_csum.c                               |   8 +-
 net/sched/cls_api.c                                |   8 +-
 net/sched/cls_route.c                              |  76 +--
 net/sched/cls_u32.c                                |  32 +-
 net/sched/sch_api.c                                |   2 +-
 net/sched/sch_drr.c                                |  13 +-
 net/sched/sch_ets.c                                |  12 +-
 net/sched/sch_fq_pie.c                             |   3 +-
 net/sched/sch_generic.c                            |  24 +-
 net/sched/sch_hhf.c                                |   8 +-
 net/sched/sch_pie.c                                |   2 +-
 net/sched/sch_sfq.c                                |   7 +-
 net/sctp/ipv6.c                                    |  12 +-
 net/sctp/protocol.c                                |  10 +-
 net/sctp/sm_make_chunk.c                           |  14 +-
 net/sctp/sm_sideeffect.c                           |  11 +-
 net/sctp/sm_statefuns.c                            |   5 +
 net/sunrpc/auth_gss/auth_gss.c                     |   7 +-
 net/sunrpc/auth_gss/gss_rpc_xdr.c                  |   9 +-
 net/sunrpc/clnt.c                                  |  52 +-
 net/sunrpc/rpc_pipe.c                              |  80 +--
 net/sunrpc/svc.c                                   |  23 +-
 net/sunrpc/xprtrdma/ib_client.c                    |  26 +-
 net/sunrpc/xprtrdma/svc_rdma_pcl.c                 |   2 +-
 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c            |  15 +-
 net/sunrpc/xprtrdma/svc_rdma_transport.c           |  32 +-
 net/sunrpc/xprtrdma/verbs.c                        |  21 +-
 net/tipc/link.c                                    |   6 +-
 net/tipc/name_table.c                              |  32 +-
 net/tipc/socket.c                                  |   4 +-
 net/tls/tls_main.c                                 |  11 +
 net/tls/tls_sw.c                                   |  12 +
 net/unix/af_unix.c                                 |  12 +-
 net/unix/garbage.c                                 |   1 +
 net/vmw_vsock/hyperv_transport.c                   |   2 +-
 net/vmw_vsock/vmci_transport.c                     |   2 +-
 net/wireless/core.c                                |  21 +
 net/wireless/mlme.c                                | 105 ++--
 net/wireless/nl80211.c                             |   8 +-
 net/wireless/wext-sme.c                            |   9 +
 rust/bindings/lib.rs                               |   3 +-
 rust/uapi/lib.rs                                   |   3 +-
 scripts/mksysmap                                   |   2 +-
 scripts/mod/modpost.c                              |  11 +-
 scripts/sorttable.c                                |   2 +-
 security/apparmor/match.c                          |  22 +-
 security/integrity/digsig_asymmetric.c             |   4 +
 security/integrity/ima/ima_appraise.c              |   5 +
 security/keys/trusted-keys/trusted_tpm1.c          |   2 +-
 sound/core/pcm_native.c                            |  35 +-
 sound/core/rawmidi.c                               |   4 +
 sound/core/seq/oss/seq_oss_rw.c                    |   3 +-
 sound/core/seq/seq_prioq.c                         |  14 +-
 sound/core/ump.c                                   |  94 +++-
 sound/hda/ext/hdac_ext_controller.c                |   6 +-
 sound/hda/hdac_bus.c                               |   8 +-
 sound/hda/hdac_component.c                         |   6 +-
 sound/hda/hdac_device.c                            |  28 +-
 sound/hda/hdac_regmap.c                            |  35 +-
 sound/isa/es18xx.c                                 |   4 +
 sound/pci/ctxfi/cthw20k2.c                         |   1 +
 sound/pci/hda/cs35l41_hda_property.c               |   2 +
 sound/pci/hda/cs35l56_hda.c                        |  30 +-
 sound/pci/hda/hda_codec.c                          | 119 ++---
 sound/pci/hda/hda_controller.c                     |  24 +-
 sound/pci/hda/hda_proc.c                           |   4 +-
 sound/pci/hda/hda_sysfs.c                          |  77 ++-
 sound/pci/hda/patch_conexant.c                     |  12 +
 sound/pci/hda/patch_realtek.c                      |  40 ++
 sound/soc/amd/renoir/acp3x-pdm-dma.c               |   2 +-
 sound/soc/amd/yc/acp6x-mach.c                      |  21 +
 sound/soc/amd/yc/acp6x-pdm-dma.c                   |   2 +
 sound/soc/bcm/bcm63xx-i2s-whistler.c               |   1 +
 sound/soc/codecs/ab8500-codec.c                    | 543 ++++++++++---------
 sound/soc/codecs/mt6351.c                          |   1 +
 sound/soc/codecs/pcm3168a.c                        |  20 +-
 sound/soc/codecs/rk3328_codec.c                    |  54 +-
 sound/soc/codecs/rt5645.c                          |   4 +
 sound/soc/codecs/rt712-sdca.c                      |  11 +
 sound/soc/fsl/fsl-asoc-card.c                      |   8 +-
 sound/soc/intel/atom/sst/sst_pci.c                 |   1 +
 sound/soc/intel/avs/core.c                         |  29 +-
 sound/soc/intel/avs/debugfs.c                      |  12 +-
 sound/soc/intel/avs/pcm.c                          |  34 +-
 sound/soc/intel/avs/topology.c                     |   2 +-
 sound/soc/intel/avs/topology.h                     |   1 +
 sound/soc/intel/boards/sof_sdw.c                   |  25 +-
 sound/soc/intel/catpt/ipc.c                        |   8 +
 sound/soc/intel/catpt/loader.c                     |   3 +
 sound/soc/intel/catpt/registers.h                  |  12 +
 sound/soc/mediatek/mt8365/mt8365-afe-pcm.c         |  13 +-
 sound/soc/meson/aiu-acodec-ctrl.c                  |   3 +
 sound/soc/meson/aiu-codec-ctrl.c                   |   3 +
 sound/soc/qcom/qdsp6/q6apm.c                       |  10 +-
 sound/soc/rockchip/rockchip_pdm.c                  |  16 +-
 sound/soc/rockchip/rockchip_spdif.c                |   1 +
 sound/soc/soc-topology.c                           |  37 +-
 sound/soc/sprd/sprd-pcm-compress.c                 |  15 +-
 sound/soc/sti/uniperif_reader.c                    |   4 +-
 sound/soc/ti/omap3pandora.c                        |   5 +-
 sound/soc/ux500/ux500_msp_dai.c                    | 189 +++----
 sound/soc/ux500/ux500_msp_dai.h                    |  14 +-
 sound/soc/ux500/ux500_msp_i2s.c                    | 260 +++++++---
 sound/soc/ux500/ux500_msp_i2s.h                    |  12 +-
 sound/usb/caiaq/audio.c                            |  10 +-
 sound/usb/caiaq/device.c                           |  53 +-
 sound/usb/caiaq/device.h                           |   4 +-
 sound/usb/caiaq/input.c                            |   6 +
 sound/usb/caiaq/midi.c                             |   6 +-
 sound/usb/mixer.c                                  |  17 +-
 sound/usb/mixer_maps.c                             |  25 +
 sound/usb/quirks-table.h                           |  22 +
 sound/usb/quirks.c                                 |   4 +
 sound/usb/usx2y/us122l.c                           |   9 +-
 sound/usb/usx2y/usbusx2y.c                         |  49 +-
 sound/usb/usx2y/usbusx2y.h                         |   4 +-
 tools/bpf/bpftool/Makefile                         |   6 +-
 tools/build/feature/test-bpf.c                     |   2 +
 tools/include/nolibc/crt.h                         |   2 +-
 tools/lib/bpf/bpf.c                                |   2 +
 tools/lib/bpf/gen_loader.c                         |   2 +
 .../xdrgen/templates/C/union/declaration/close.j2  |   4 +
 tools/perf/tests/shell/stat_bpf_counters.sh        |  28 +-
 tools/perf/util/evsel.c                            |   4 +
 tools/perf/util/symbol.c                           |  11 +-
 tools/sched_ext/scx_central.bpf.c                  |   6 +-
 tools/sched_ext/scx_qmap.bpf.c                     |   2 +-
 tools/testing/cxl/Kbuild                           |   2 +
 tools/testing/selftests/alsa/mixer-test.c          |   4 +-
 tools/testing/selftests/bpf/progs/test_bpf_nf.c    |   8 +-
 tools/testing/selftests/cgroup/test_kmem.c         |   2 +-
 tools/testing/selftests/kselftest_harness.h        |   2 +-
 tools/testing/selftests/mm/cow.c                   | 338 +++++-------
 tools/testing/selftests/net/fib_nexthops.sh        |  28 +
 tools/testing/selftests/net/mptcp/mptcp_connect.c  |   4 +-
 tools/testing/selftests/net/pmtu.sh                |   2 +-
 tools/testing/selftests/net/test_vxlan_mdb.sh      |   6 +
 tools/testing/selftests/powerpc/tm/tm.h            |   8 +-
 1054 files changed, 15506 insertions(+), 8702 deletions(-)

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Abdifatah Suruur <[email protected]>

commit 0e753899627b5e28a9fea8bca98262a6f65a2452 upstream.

smb2_oplock_break_noti() reads opinfo->conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check() clears opinfo->conn and drops its conn reference under ci->m_lock, and the last ksmbd_conn_put() frees the connection. A break triggered by another connection that races with the teardown can then resurrect the freed connection: ksmbd_conn_get() is a plain atomic_inc, and the queued break work later dereferences the stale conn via ksmbd_conn_write(), a use-after-free reachable by any authenticated client holding a durable batch oplock.

Thread the caller's inode into the notification path instead of taking a new reference on it. Every caller of oplock_break() already holds a live ksmbd_file (or an explicit ksmbd_inode_lookup_lock() reference, in the parent lease break paths) on the inode that owns the break target's oplock list, so ci cannot be freed during the call, and its lock can be taken without dereferencing opinfo->o_fp, which a concurrent close may free. Select and pin the connection under ci->m_lock, the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update opinfo->conn, so a concurrent detach either loses the race to the clear or keeps the connection alive until the notification work releases it. Transfer the reference to the work item and release it on allocation failures.

[ This tree predates the deferred break machinery
(oplock_break_add()/oplock_break_drain_none()) that the original commit is layered on, so it is ported in the same patch: the three walks that hold ci->m_lock (smb_send_parent_lease_break_noti(), smb_lazy_parent_lease_break_close(), smb_break_all_levII_oplock()) collect the breaks and drain them after releasing the lock, and every oplock_break() call site runs outside ci->m_lock, so smb2_oplock_break_conn_get() takes the read lock itself, as in the 6.18.y backport. ]

---
 fs/smb/server/oplock.c | 118 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 104 insertions(+), 14 deletions(-)

index d83370f53d6f0..935e337a95b8e 100644
@@ -708,31 +708,67 @@ static void __smb2_oplock_break_noti(struct work_struct *wk)
 	ksmbd_conn_put(conn);
 }
 
+/*
+ * Select and pin the connection used for an oplock break before doing any
+ * allocations which may sleep.  The caller of oplock_break() holds a live
+ * reference on ci (a file being opened, a file being operated on, or an
+ * explicit ksmbd_inode_lookup_lock() reference in the parent lease break
+ * paths), so the inode cannot be freed during the call.
+ *
+ * opinfo->conn is cleared under ci->m_lock by session_fd_check() when the
+ * durable handle owning the oplock is disconnected, reassigned by
+ * ksmbd_reopen_durable_fd() under the same lock, and the last
+ * ksmbd_conn_put() of the old connection frees it.  Holding the read lock
+ * excludes both writers, so the connection cannot be freed while it is
+ * selected.
+ */
+static struct ksmbd_conn *smb2_oplock_break_conn_get(struct oplock_info *opinfo,
+						     struct ksmbd_inode *ci)
+{
+	struct ksmbd_conn *conn;
+
+	down_read(&ci->m_lock);
+	conn = READ_ONCE(opinfo->conn);
+	if (conn && !ksmbd_conn_releasing(conn))
+		conn = ksmbd_conn_get(conn);
+	else
+		conn = NULL;
+	up_read(&ci->m_lock);
+
+	return conn;
+}
+
 /**
  * smb2_oplock_break_noti() - send smb2 exclusive/batch to level2 oplock
  *		break command from server to client
  * @opinfo:		oplock info object
+ * @ci:		inode owning the break target's oplock list, pinned by
+ *		the caller
  *
  * Return:      0 on success, otherwise error
  */
-static int smb2_oplock_break_noti(struct oplock_info *opinfo)
+static int smb2_oplock_break_noti(struct oplock_info *opinfo,
+				  struct ksmbd_inode *ci)
 {
 	struct ksmbd_conn *conn;
 	struct oplock_break_info *br_info;
 	int ret = 0;
 	struct ksmbd_work *work;
 
-	conn = READ_ONCE(opinfo->conn);
+	conn = smb2_oplock_break_conn_get(opinfo, ci);
 	if (!conn)
 		return 0;
 
 	work = ksmbd_alloc_work_struct();
-	if (!work)
+	if (!work) {
+		ksmbd_conn_put(conn);
 		return -ENOMEM;
+	}
 
 	br_info = kmalloc(sizeof(struct oplock_break_info), KSMBD_DEFAULT_GFP);
 	if (!br_info) {
 		ksmbd_free_work_struct(work);
+		ksmbd_conn_put(conn);
 		return -ENOMEM;
 	}
 

@@ -741,7 +777,8 @@ static int smb2_oplock_break_noti(struct oplock_info *opinfo)
 	br_info->open_trunc = opinfo->open_trunc;
 
 	work->request_buf = (char *)br_info;
-	work->conn = ksmbd_conn_get(conn);
+	/* Transfer the reference acquired by smb2_oplock_break_conn_get(). */
+	work->conn = conn;
 	work->sess = opinfo->sess;
 
 	ksmbd_conn_r_count_inc(conn);

@@ -890,8 +927,8 @@ static void wait_lease_breaking(struct oplock_info *opinfo)
 	}
 }
 
-static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level,
-			struct ksmbd_work *in_work)
+static int oplock_break(struct oplock_info *brk_opinfo, struct ksmbd_inode *ci,
+			int req_op_level, struct ksmbd_work *in_work)
 {
 	int err = 0;
 

@@ -957,7 +994,7 @@ static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level,
 	if (brk_opinfo->is_lease)
 		err = smb2_lease_break_noti(brk_opinfo);
 	else
-		err = smb2_oplock_break_noti(brk_opinfo);
+		err = smb2_oplock_break_noti(brk_opinfo, ci);
 
 	ksmbd_debug(OPLOCK, "oplock granted = %d\n", brk_opinfo->level);
 	if (brk_opinfo->op_state == OPLOCK_CLOSING)

@@ -969,6 +1006,43 @@ static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level,
 	return err;
 }
 
+struct oplock_break_entry {
+	struct list_head	list;
+	struct oplock_info	*opinfo;
+};
+
+/*
+ * Collect an oplock for a deferred break.  oplock_break() may block for
+ * the client's break acknowledgment, and the close that wakes that wait
+ * needs ci->m_lock for write, so the walks that hold ci->m_lock defer the
+ * break until the lock is released.
+ */
+static int oplock_break_add(struct list_head *head, struct oplock_info *opinfo)
+{
+	struct oplock_break_entry *ent;
+
+	ent = kmalloc_obj(struct oplock_break_entry, KSMBD_DEFAULT_GFP);
+	if (!ent)
+		return -ENOMEM;
+
+	ent->opinfo = opinfo;
+	list_add_tail(&ent->list, head);
+	return 0;
+}
+
+static void oplock_break_drain_none(struct list_head *head,
+				    struct ksmbd_inode *ci)
+{
+	struct oplock_break_entry *ent, *tmp;
+
+	list_for_each_entry_safe(ent, tmp, head, list) {
+		oplock_break(ent->opinfo, ci, SMB2_OPLOCK_LEVEL_NONE, NULL);
+		list_del(&ent->list);
+		opinfo_put(ent->opinfo);
+		kfree(ent);
+	}
+}
+
 void destroy_lease_table(struct ksmbd_conn *conn)
 {
 	struct lease_table *lb, *lbtmp;

@@ -1112,6 +1186,7 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp,
 {
 	struct oplock_info *opinfo;
 	struct ksmbd_inode *p_ci = NULL;
+	LIST_HEAD(brk_list);
 
 	if (lctx->version != 2)
 		return;

@@ -1137,12 +1212,14 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp,
 				continue;
 			}
 
-			oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL);
-			opinfo_put(opinfo);
+			if (oplock_break_add(&brk_list, opinfo))
+				opinfo_put(opinfo);
 		}
 	}
 	up_read(&p_ci->m_lock);
 
+	oplock_break_drain_none(&brk_list, p_ci);
+
 	ksmbd_inode_put(p_ci);
 }
 

@@ -1150,6 +1227,7 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp)
 {
 	struct oplock_info *opinfo;
 	struct ksmbd_inode *p_ci = NULL;
+	LIST_HEAD(brk_list);
 
 	rcu_read_lock();
 	opinfo = rcu_dereference(fp->f_opinfo);

@@ -1178,12 +1256,14 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp)
 				continue;
 			}
 
-			oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL);
-			opinfo_put(opinfo);
+			if (oplock_break_add(&brk_list, opinfo))
+				opinfo_put(opinfo);
 		}
 	}
 	up_read(&p_ci->m_lock);
 
+	oplock_break_drain_none(&brk_list, p_ci);
+
 	ksmbd_inode_put(p_ci);
 }
 

@@ -1280,7 +1360,7 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid,
 		goto op_break_not_needed;
 	}
 
-	err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II, work);
+	err = oplock_break(prev_opinfo, fp->f_ci, SMB2_OPLOCK_LEVEL_II, work);
 	opinfo_put(prev_opinfo);
 	if (err == -ENOENT)
 		goto set_lev;

@@ -1366,7 +1446,7 @@ static void smb_break_all_write_oplock(struct ksmbd_work *work,
 	}
 
 	brk_opinfo->open_trunc = is_trunc;
-	oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II, work);
+	oplock_break(brk_opinfo, fp->f_ci, SMB2_OPLOCK_LEVEL_II, work);
 	opinfo_put(brk_opinfo);
 }
 

@@ -1383,6 +1463,7 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp,
 	struct oplock_info *op, *brk_op;
 	struct ksmbd_inode *ci;
 	struct ksmbd_conn *conn = work->conn;
+	LIST_HEAD(brk_list);
 
 	if (!test_share_config_flag(work->tcon->share_conf,
 				    KSMBD_SHARE_FLAG_OPLOCKS))

@@ -1430,12 +1511,21 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp,
 			    SMB2_LEASE_KEY_SIZE))
 			goto next;
 		brk_op->open_trunc = is_trunc;
-		oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE, NULL);
+
+		/*
+		 * Defer the break until ci->m_lock is released: oplock_break()
+		 * may block waiting for the break acknowledgment, and the
+		 * close that wakes that wait needs ci->m_lock for write.
+		 */
+		if (!oplock_break_add(&brk_list, brk_op))
+			continue;
 next:
 		opinfo_put(brk_op);
 	}
 	up_read(&ci->m_lock);
 
+	oplock_break_drain_none(&brk_list, ci);
+
 	if (op)
 		opinfo_put(op);
 }

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Boris Brezillon <[email protected]>

[ Upstream commit 71c8224a18825102ee1e5e70498f96f6c2d2a81d ]

If the object wasn't moved to a different LRU after the shrink callback returns, it means the buffer is still reclaimable. Update the remaining counter to reflect that.

v2:
- Collect R-b

v3:
- Collect R-b

v4:
- No changes

v5:
- No changes

v6:
- No changes

v7:
- No changes

---
 drivers/gpu/drm/drm_gem.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

index 9e8a4da313a0e..ee94cbb7e2c7d 100644
@@ -1546,6 +1546,16 @@ drm_gem_lru_scan(struct drm_gem_lru *lru,
 			 */
 			WARN_ON(obj->lru == &still_in_lru);
 			WARN_ON(obj->lru == lru);
+		} else if (obj->lru == &still_in_lru) {
+			/*
+			 * If the object wasn't moved and wasn't shrunk either,
+			 * it's still remaining as reclaimable. Note that
+			 * obj->lru is supposed to be checked with the LRU lock
+			 * held for an accurate result, but we don't care about
+			 * accuracy here. Worst thing that could happen is an
+			 * extra scan.
+			 */
+			*remaining += obj->size >> PAGE_SHIFT;
 		}
 
 		dma_resv_unlock(obj->resv);

2.53.0

On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:

Florian

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ioana Ciornei <[email protected]>

[ Upstream commit 208858b1b48eba83d073542372329cf8ed606526 ]

There are use cases in which the Management Complex firmware boot process is started by the bootloader which does not wait for the boot to complete. This is mainly done in order to reduce the overall boot time of a DPAA2 based SoC.

In this kind of circumstance, the fsl-mc bus driver needs to make sure that the MC firmware boot process is finished before proceeding to the usual operations such as interrogating the firmware to gather all existent DPAA2 objects, creating the fsl-mc devices on the bus etc.

Add this kind of check early in the boot process of the fsl-mc bus and defer the probe in case the firmware is still in its boot process.

---
 drivers/bus/fsl-mc/fsl-mc-bus.c | 46 +++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

index 2810f3b6e2f6c..2742647bff594 100644
@@ -66,6 +66,13 @@ struct fsl_mc_addr_translation_range {
 #define GCR1_P1_STOP	BIT(31)
 #define GCR1_P2_STOP	BIT(30)
 
+#define FSL_MC_GSR		0x8
+#define FSL_MC_GSR_BOOT_DONE	BIT(0)
+#define FSL_MC_GSR_MCS_MASK	GENMASK(7, 0)
+#define FSL_MC_GSR_MCS_ERR_MASK	GENMASK(7, 1)
+#define FSL_MC_GSR_BC_MASK	GENMASK(15, 8)
+#define FSL_MC_GSR_BC_SHIFT	8
+
 #define FSL_MC_FAPR	0x28
 #define MC_FAPR_PL	BIT(18)
 #define MC_FAPR_BMT	BIT(17)

@@ -1006,6 +1013,41 @@ static int get_mc_addr_translation_ranges(struct device *dev,
 	return 0;
 }
 
+static u32 fsl_mc_read_gsr(struct fsl_mc *mc)
+{
+	return readl(mc->fsl_mc_regs + FSL_MC_GSR);
+}
+
+static int fsl_mc_firmware_check(struct platform_device *pdev)
+{
+	struct fsl_mc *mc = platform_get_drvdata(pdev);
+	u32 gsr, boot_done, boot_code, mcs;
+
+	gsr = fsl_mc_read_gsr(mc);
+	boot_code = (gsr & FSL_MC_GSR_BC_MASK) >> FSL_MC_GSR_BC_SHIFT;
+	if (boot_code == 0xDD) {
+		dev_err(&pdev->dev,
+			"fsl-mc: DPL processing was not started, DPAA2 will not work!\n");
+		return -EOPNOTSUPP;
+	}
+
+	boot_done = gsr & FSL_MC_GSR_BOOT_DONE;
+	if (!boot_done) {
+		dev_dbg(&pdev->dev,
+			"fsl-mc: DPL processing in progress, defer probe\n");
+		return -EPROBE_DEFER;
+	}
+
+	mcs = gsr & FSL_MC_GSR_MCS_MASK;
+	if (mcs & FSL_MC_GSR_MCS_ERR_MASK) {
+		dev_err(&pdev->dev,
+			"fsl-mc: MC boot completed with error 0x%x\n", mcs);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 /*
  * fsl_mc_bus_probe - callback invoked when the root MC bus is being
  * added

@@ -1070,6 +1112,10 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
 		       mc->fsl_mc_regs + FSL_MC_GCR1);
 	}
 
+	error = fsl_mc_firmware_check(pdev);
+	if (error)
+		return error;
+
 	/*
 	 * Get physical address of MC portal for the root DPRC:
 	 */

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tommaso Merciai <[email protected]>

[ Upstream commit c94e765abb051df62b9f7c27116ef9307216c868 ]

The VSP serves as an interface to memory and a compositor to the DU. It therefore needs to be suspended after and resumed before the DU, to be properly stopped and restarted in a controlled fashion driven by the DU driver. This currently works by chance. Avoid relying on luck by enforcing the correct suspend/resume ordering with device links.

Based on similar work done by Laurent Pinchart for R-Car DU. commit db5be3a7d6bd ("drm: rcar-du: Ensure correct suspend/resume ordering with VSP")

---
 drivers/gpu/drm/renesas/rz-du/rzg2l_du_vsp.c | 16 ++++++++++++++++
 drivers/gpu/drm/renesas/rz-du/rzg2l_du_vsp.h |  2 ++
 2 files changed, 18 insertions(+)

index 8643ff2eec46e..ca7bfc7735f06 100644
@@ -20,6 +20,7 @@
 #include <drm/drm_vblank.h>
 
 #include <linux/bitops.h>
+#include <linux/device.h>
 #include <linux/dma-mapping.h>
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>

@@ -293,6 +294,9 @@ static void rzg2l_du_vsp_cleanup(struct drm_device *dev, void *res)
 {
 	struct rzg2l_du_vsp *vsp = res;
 
+	if (vsp->link)
+		device_link_del(vsp->link);
+
 	put_device(vsp->vsp);
 }
 

@@ -317,6 +321,18 @@ int rzg2l_du_vsp_init(struct rzg2l_du_vsp *vsp, struct device_node *np,
 	if (ret < 0)
 		return ret;
 
+	/*
+	 * Enforce suspend/resume ordering between the DU (consumer) and the
+	 * VSP (supplier). The DU will be suspended before and resume after the
+	 * VSP.
+	 */
+	vsp->link = device_link_add(rcdu->dev, vsp->vsp, DL_FLAG_STATELESS);
+	if (!vsp->link) {
+		dev_err(rcdu->dev, "Failed to create device link to VSP %s\n",
+			dev_name(vsp->vsp));
+		return -EINVAL;
+	}
+
 	ret = vsp1_du_init(vsp->vsp);
 	if (ret < 0)
 		return ret;

index 322eb80dcbaff..a22aaf0843ed7 100644
@@ -15,6 +15,7 @@
 #include <linux/scatterlist.h>
 
 struct device;
+struct device_link;
 struct drm_framebuffer;
 struct rzg2l_du_device;
 struct rzg2l_du_format_info;

@@ -29,6 +30,7 @@ struct rzg2l_du_vsp_plane {
 struct rzg2l_du_vsp {
 	unsigned int index;
 	struct device *vsp;
+	struct device_link *link;
 	struct rzg2l_du_device *dev;
 };
 

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dominik Kaszewski <[email protected]>

[ Upstream commit 6fd45b5d8955bbc362ac3dfe181529f7b1cfd224 ]

[Why & How]
DPMS functions should not use partially updated pipe context passed as argument of commit_planes_do_stream_update, and instead use the one in current_state, which is guaranteed to be the most recently programmed HW config.

---
 drivers/gpu/drm/amd/display/dc/core/dc.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

index edb7e957b4dd8..070cca8b521b6 100644
@@ -3411,27 +3411,34 @@ static void commit_planes_do_stream_update(struct dc *dc,
 				resource_build_test_pattern_params(&context->res_ctx, pipe_ctx);
 			}
 
+			// DPMS should not use partially updated pipe context
+			struct pipe_ctx *dpms_pipe_ctx = &dc->current_state->res_ctx.pipe_ctx[j];
+
 			if (stream_update->dpms_off) {
 				if (*stream_update->dpms_off) {
-					dc->link_srv->set_dpms_off(pipe_ctx);
+					dc->link_srv->set_dpms_off(dpms_pipe_ctx);
 					/* for dpms, keep acquired resources*/
-					if (pipe_ctx->stream_res.audio && !dc->debug.az_endpoint_mute_only)
-						pipe_ctx->stream_res.audio->funcs->az_disable(pipe_ctx->stream_res.audio);
+					if (dpms_pipe_ctx->stream_res.audio && !dc->debug.az_endpoint_mute_only) {
+						struct audio *audio = dpms_pipe_ctx->stream_res.audio;
+
+						audio->funcs->az_disable(audio);
+					}
 
 					dc->optimized_required = true;
 
 				} else {
 					if (get_seamless_boot_stream_count(context) == 0)
 						dc->hwss.prepare_bandwidth(dc, dc->current_state);
-					dc->link_srv->set_dpms_on(dc->current_state, pipe_ctx);
+					dc->link_srv->set_dpms_on(dc->current_state, dpms_pipe_ctx);
 				}
-			} else if (pipe_ctx->stream->link->wa_flags.blank_stream_on_ocs_change && stream_update->output_color_space
-					&& !stream->dpms_off && dc_is_dp_signal(pipe_ctx->stream->signal)) {
+			} else if (dpms_pipe_ctx->stream->link->wa_flags.blank_stream_on_ocs_change &&
+					stream_update->output_color_space &&
+					!stream->dpms_off && dc_is_dp_signal(dpms_pipe_ctx->stream->signal)) {
 				/*
 				 * Workaround for firmware issue in some receivers where they don't pick up
 				 * correct output color space unless DP link is disabled/re-enabled
 				 */
-				dc->link_srv->set_dpms_on(dc->current_state, pipe_ctx);
+				dc->link_srv->set_dpms_on(dc->current_state, dpms_pipe_ctx);
 			}
 
 			if (stream_update->abm_level && pipe_ctx->stream_res.abm) {

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dmitry Baryshkov <[email protected]>

[ Upstream commit b55a4b5d4769a650f52ea3f1ae680610169d125e ]

Sending DSI commands from the prepare() callback requires DSI link to be up at that point. For DSI hosts is guaranteed only if the panel driver sets the .prepare_prev_first flag. Set it to let these panels work with the DSI hosts which don't power on the link in their .mode_set callback.

---
 drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c | 2 ++
 1 file changed, 2 insertions(+)

index eb0f8373258c3..94597defaa2c9 100644
@@ -1159,6 +1159,8 @@ static int jadard_dsi_probe(struct mipi_dsi_device *dsi)
 	if (ret)
 		return ret;
 
+	jadard->panel.prepare_prev_first = true;
+
 	drm_panel_add(&jadard->panel);
 
 	mipi_dsi_set_drvdata(dsi, jadard);

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lijo Lazar <[email protected]>

[ Upstream commit 6fc63d80c01a480e3d2c98620f07d46e5bcfc85a ]

Check if data fetch is proper by matching the first few bytes against 0xFFs. If 0xFFs, that means data couldn't be read properly.

---
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 4 ++++
 1 file changed, 4 insertions(+)

index b79a2b66d30d0..c0348f9ca47a6 100644
@@ -537,6 +537,10 @@ static int smu_v13_0_6_get_metrics_table(struct smu_context *smu,
 		amdgpu_asic_invalidate_hdp(smu->adev, NULL);
 		memcpy(smu_table->metrics_table, table->cpu_addr, table_size);
 
+		if (!memchr_inv(smu_table->metrics_table, 0xff,
+				min(16, table_size)))
+			return -EHWPOISON;
+
 		smu_table->metrics_time = jiffies;
 	}
 

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jie Wang <[email protected]>

[ Upstream commit b99a1f0f18ee50445907f55069e88bcfd8947383 ]

gfs2_quota_init() checks for duplicate quota_change IDs while holding qd_lock and the quota hash bucket bitlock. That path used gfs2_qd_search_bucket(), which takes a lockref reference via lockref_get_not_dead().

On PREEMPT_RT this may sleep, which is not allowed under the bucket bitlock, triggering "sleeping function called from invalid context".

Use a no-ref bucket lookup in this path, then continue duplicate handling without taking a lockref there.

Refactor gfs2_qd_search_bucket() to build on top of the no-ref helper so lookup traversal stays in one place.

This patch fixes a bug reported by syzbot.

---
 fs/gfs2/quota.c | 33 +++++++++++++++++++++++----------
 1 file changed, 23 insertions(+), 10 deletions(-)

index 95b20e6a3fbc6..da62e0c5ee388 100644
@@ -255,9 +255,13 @@ static struct gfs2_quota_data *qd_alloc(unsigned hash, struct gfs2_sbd *sdp, str
 	return NULL;
 }
 
-static struct gfs2_quota_data *gfs2_qd_search_bucket(unsigned int hash,
-						     const struct gfs2_sbd *sdp,
-						     struct kqid qid)
+/*
+ * Lookup variant for callers which already hold qd_lock + bucket lock.
+ */
+static struct gfs2_quota_data *
+gfs2_qd_search_bucket_noref(unsigned int hash,
+			    const struct gfs2_sbd *sdp,
+			    struct kqid qid)
 {
 	struct gfs2_quota_data *qd;
 	struct hlist_bl_node *h;

@@ -265,12 +269,22 @@ static struct gfs2_quota_data *gfs2_qd_search_bucket(unsigned int hash,
 	hlist_bl_for_each_entry_rcu(qd, h, &qd_hash_table[hash], qd_hlist) {
 		if (!qid_eq(qd->qd_id, qid))
 			continue;
-		if (qd->qd_sbd != sdp)
-			continue;
-		if (lockref_get_not_dead(&qd->qd_lockref)) {
-			list_lru_del_obj(&gfs2_qd_lru, &qd->qd_lru);
+		if (qd->qd_sbd == sdp)
 			return qd;
-		}
+	}
+
+	return NULL;
+}
+
+static struct gfs2_quota_data *
+gfs2_qd_search_bucket(unsigned int hash, const struct gfs2_sbd *sdp, struct kqid qid)
+{
+	struct gfs2_quota_data *qd;
+
+	qd = gfs2_qd_search_bucket_noref(hash, sdp, qid);
+	if (qd && lockref_get_not_dead(&qd->qd_lockref)) {
+		list_lru_del_obj(&gfs2_qd_lru, &qd->qd_lru);
+		return qd;
 	}
 
 	return NULL;

@@ -1459,7 +1473,7 @@ int gfs2_quota_init(struct gfs2_sbd *sdp)
 
 			spin_lock(&qd_lock);
 			spin_lock_bucket(hash);
-			old_qd = gfs2_qd_search_bucket(hash, sdp, qc_id);
+			old_qd = gfs2_qd_search_bucket_noref(hash, sdp, qc_id);
 			if (old_qd) {
 				fs_err(sdp, "Corruption found in quota_change%u"
 					    "file: duplicate identifier in "

@@ -1468,7 +1482,6 @@ int gfs2_quota_init(struct gfs2_sbd *sdp)
 
 				spin_unlock_bucket(hash);
 				spin_unlock(&qd_lock);
-				qd_put(old_qd);
 
 				gfs2_glock_put(qd->qd_gl);
 				kmem_cache_free(gfs2_quotad_cachep, qd);

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jie Wang <[email protected]>

[ Upstream commit 942202677f8f2ee448a6a2feb06aeeaf520342e3 ]

Move qc++ from the loop body into the for-loop increment expression in gfs2_quota_init().

This keeps iterator progression explicit and avoids mixing pointer advance with duplicate-slot handling in the loop body.

---
 fs/gfs2/quota.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index da62e0c5ee388..def166bff5289 100644
@@ -1449,7 +1449,7 @@ int gfs2_quota_init(struct gfs2_sbd *sdp)
 
 		qc = (struct gfs2_quota_change *)(bh->b_data + sizeof(struct gfs2_meta_header));
 		for (y = 0; y < sdp->sd_qc_per_block && slot < sdp->sd_quota_slots;
-		     y++, slot++) {
+		     y++, slot++, qc++) {
 			struct gfs2_quota_data *old_qd, *qd;
 			s64 qc_change = be64_to_cpu(qc->qc_change);
 			u32 qc_flags = be32_to_cpu(qc->qc_flags);

@@ -1457,7 +1457,6 @@ int gfs2_quota_init(struct gfs2_sbd *sdp)
 						USRQUOTA : GRPQUOTA;
 			struct kqid qc_id = make_kqid(&init_user_ns, qtype,
 						      be32_to_cpu(qc->qc_id));
-			qc++;
 			if (!qc_change)
 				continue;
 

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kevin Tung <[email protected]>

[ Upstream commit ce80292ead5bb42b50a6b63e44fd95c0edf9d334 ]

Add i2c_device_id table to support legacy I2C instantiation. Update probe to use i2c_get_match_data() so device data can be retrieved consistently for both OF and legacy I2C instantiation.

---
 drivers/iio/adc/rtq6056.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

index 8172ea51c52ed..8297f4591b338 100644
@@ -719,7 +719,7 @@ static int rtq6056_probe(struct i2c_client *i2c)
 	if (!i2c_check_functionality(i2c->adapter, I2C_FUNC_SMBUS_WORD_DATA))
 		return -EOPNOTSUPP;
 
-	devdata = device_get_match_data(dev);
+	devdata = i2c_get_match_data(i2c);
 	if (!devdata)
 		return dev_err_probe(dev, -EINVAL, "Invalid dev data\n");
 

@@ -862,6 +862,13 @@ static const struct richtek_dev_data rtq6059_devdata = {
 	.set_average = rtq6059_adc_set_average,
 };
 
+static const struct i2c_device_id rtq6056_id[] = {
+	{ "rtq6056", (kernel_ulong_t)&rtq6056_devdata },
+	{ "rtq6059", (kernel_ulong_t)&rtq6059_devdata },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, rtq6056_id);
+
 static const struct of_device_id rtq6056_device_match[] = {
 	{ .compatible = "richtek,rtq6056", .data = &rtq6056_devdata },
 	{ .compatible = "richtek,rtq6059", .data = &rtq6059_devdata },

@@ -876,6 +883,7 @@ static struct i2c_driver rtq6056_driver = {
 		.pm = pm_ptr(&rtq6056_pm_ops),
 	},
 	.probe = rtq6056_probe,
+	.id_table = rtq6056_id,
 };
 module_i2c_driver(rtq6056_driver);
 

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lad Prabhakar <[email protected]>

[ Upstream commit d0fc9f8eb2ce55eb00dbfdc0f19c844df5aee5b8 ]

Include PIN_CFG_IOLH_RZV2H in the IOLH capability checks when saving and restoring pin configuration registers.

On RZ/V2H(P), RZ/V2N, and RZ/G3E, the IOLH configuration is defined by the PIN_CFG_IOLH_RZV2H capability. The previous implementation did not account for this, causing the IOLH registers to be skipped during PM save/restore.

---
 drivers/pinctrl/renesas/pinctrl-rzg2l.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 6fd79907f17e9..585d6ae7aac59 100644
@@ -2898,7 +2898,8 @@ static void rzg2l_pinctrl_pm_setup_dedicated_regs(struct rzg2l_pinctrl *pctrl, b
 		}
 
 		/* And apply them in a single shot. */
-		has_iolh = !!(caps & (PIN_CFG_IOLH_A | PIN_CFG_IOLH_B | PIN_CFG_IOLH_C));
+		has_iolh = !!(caps & (PIN_CFG_IOLH_A | PIN_CFG_IOLH_B |
+				      PIN_CFG_IOLH_C | PIN_CFG_IOLH_RZV2H));
 		has_ien = !!(caps & PIN_CFG_IEN);
 		pincnt = hweight8(FIELD_GET(RZG2L_SINGLE_PIN_BITS_MASK, cfg));
 

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Cássio Gabriel <[email protected]>

[ Upstream commit 87a6f2fa6e6c69bb649fa327635a0bd977724603 ]

mixer_ctl_feature_put(), mixer_ctl_procunit_put(), and mixer_ctl_selector_put() ignore failures from their SET_CUR helper routines and report the control as changed whenever the requested value differs from the current one.

If the device rejects the write, userspace still sees success although the hardware state did not change. Propagate write failures instead, using filter_error() so ignore_ctl_error keeps the same semantics as the existing get paths.

---
 sound/usb/mixer.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

index 0472451494b03..82c8596264047 100644
@@ -1463,7 +1463,10 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol,
 				return -EINVAL;
 			val = get_abs_value(cval, val);
 			if (oval != val) {
-				snd_usb_set_cur_mix_value(cval, c + 1, cnt, val);
+				err = snd_usb_set_cur_mix_value(cval, c + 1,
+								cnt, val);
+				if (err < 0)
+					return filter_error(cval, err);
 				changed = 1;
 			}
 			cnt++;

@@ -1478,7 +1481,9 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol,
 			return -EINVAL;
 		val = get_abs_value(cval, val);
 		if (val != oval) {
-			snd_usb_set_cur_mix_value(cval, 0, 0, val);
+			err = snd_usb_set_cur_mix_value(cval, 0, 0, val);
+			if (err < 0)
+				return filter_error(cval, err);
 			changed = 1;
 		}
 	}

@@ -2343,7 +2348,9 @@ static int mixer_ctl_procunit_put(struct snd_kcontrol *kcontrol,
 		return -EINVAL;
 	val = get_abs_value(cval, val);
 	if (val != oval) {
-		set_cur_ctl_value(cval, cval->control << 8, val);
+		err = set_cur_ctl_value(cval, cval->control << 8, val);
+		if (err < 0)
+			return filter_error(cval, err);
 		return 1;
 	}
 	return 0;

@@ -2707,7 +2714,9 @@ static int mixer_ctl_selector_put(struct snd_kcontrol *kcontrol,
 		return -EINVAL;
 	val = get_abs_value(cval, val);
 	if (val != oval) {
-		set_cur_ctl_value(cval, cval->control << 8, val);
+		err = set_cur_ctl_value(cval, cval->control << 8, val);
+		if (err < 0)
+			return filter_error(cval, err);
 		return 1;
 	}
 	return 0;

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Goldwyn Rodrigues <[email protected]>

[ Upstream commit 69fc6474236d9edda6983623e4282f2bdfd8e3d8 ]

During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning.

WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561
CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed  c2dfc3c9d9f6f1233251c5d4410574fe82a348ee
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022
RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4]
Call Trace:
  __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
  ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
  __vfs_setxattr+0x9a/0xd0
  __vfs_setxattr_noperm+0x76/0x1f0
  ima_appraise_measurement+0x23e/0xe40
  ima_d_path+0x5a/0xd0
  process_measurement+0xb29/0xc40
  ? copy_from_kernel_nofault+0x21/0xe0
  ? fscrypt_file_open+0xc0/0xe0
  ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
  ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126
  ? __bpf_prog_exit+0x23/0xd0
  ? __bpf_tramp_exit+0xd/0x50
  ? bpf_trampoline_6442530367+0x9f/0xea
  ima_file_check+0x57/0x80
  security_file_post_open+0x50/0xf0
  path_openat+0x493/0x1650
  do_filp_open+0xc7/0x170

Detect the state of the file early and return the error.

---
 security/integrity/ima/ima_appraise.c | 5 +++++
 1 file changed, 5 insertions(+)

index 7eb2c25076118..6787bf185f9f2 100644
@@ -89,6 +89,11 @@ static int ima_fix_xattr(struct dentry *dentry, struct ima_iint_cache *iint)
 	int rc, offset;
 	u8 algo = iint->ima_hash->algo;
 
+	if (IS_RDONLY(d_inode(dentry)))
+		return -EROFS;
+	if (IS_IMMUTABLE(d_inode(dentry)))
+		return -EPERM;
+
 	if (algo <= HASH_ALGO_SHA1) {
 		offset = 1;
 		iint->ima_hash->xattr.sha1.type = IMA_XATTR_DIGEST;

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xu Yang <[email protected]>

[ Upstream commit 62911bc82b0332aee7546156800d3516500fa1e1 ]

The device controller may update vbus status via usb_udc_vbus_handler(), which tries to connect the gadget even though gadget_bind_driver() has already called usb_udc_connect_control_locked(). This causes pullup() to be called twice. Avoid this by checking if gadget->connected is true.

This also set gadget->connected as false in usb_gadget_activate() if it became connected while it was being deactivated. Otherwise, usb_gadget_connect_locked will return early and pullup() won't be called.

---
 drivers/usb/gadget/udc/core.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

index ab1bcc5512b2c..fa49746d54036 100644
@@ -714,6 +714,9 @@ static int usb_gadget_connect_locked(struct usb_gadget *gadget)
 		goto out;
 	}
 
+	if (gadget->connected)
+		goto out;
+
 	if (gadget->deactivated || !gadget->udc->allow_connect || !gadget->udc->started) {
 		/*
 		 * If the gadget isn't usable (because it is deactivated,

@@ -887,8 +890,10 @@ int usb_gadget_activate(struct usb_gadget *gadget)
 	 * If gadget has been connected before deactivation, or became connected
 	 * while it was being deactivated, we call usb_gadget_connect().
 	 */
-	if (gadget->connected)
+	if (gadget->connected) {
+		gadget->connected = false;
 		ret = usb_gadget_connect_locked(gadget);
+	}
 
 unlock:
 	mutex_unlock(&gadget->udc->connect_lock);

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hirokazu Honda <[email protected]>

[ Upstream commit 1a6e94a8ff32e7879effd1e4a45bf112e506edc1 ]

On ARM64, shared memory can have MT_NORMAL_TAGGED attribute when using the Memory Tagging Extension (MTE). The OP-TEE driver needs to recognize this as normal memory to allow sharing such buffers with the Secure World.

---
 drivers/tee/optee/call.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 16eb953e14bb6..e422e77b06fb8 100644
@@ -602,7 +602,8 @@ static bool is_normal_memory(pgprot_t p)
 	return (((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC) ||
 		((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEBACK));
 #elif defined(CONFIG_ARM64)
-	return (pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL);
+	return ((pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL)) ||
+	       ((pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL_TAGGED));
 #else
 #error "Unsupported architecture"
 #endif

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Weißschuh <[email protected]>

[ Upstream commit 4c6826ee7d04f489ad6fcf46ae6dd595fe9c6295 ]

Clang may convert the loop to find _auxv into a call to wcslen() which is missing on nolibc. -fsanitize needs to be disabled for this to happen.

Use the same pattern as in the nolibc strlen() implementation to avoid the function call generation.

---
 tools/include/nolibc/crt.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index bbcd5fd09806b..90e29999d4d98 100644
@@ -64,7 +64,7 @@ void _start_c(long *sp)
 
 	/* find _auxv */
 	for (auxv = (void *)envp; *auxv++;)
-		;
+		__asm__("");
 	_auxv = auxv;
 
 	for (ctor_func = __preinit_array_start; ctor_func < __preinit_array_end; ctor_func++)

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lukas Wunner <[email protected]>

[ Upstream commit d462c8e89e84bfb6417e6b4c88e0cb7cc747ba41 ]

When a PCI device is unbound from its driver, pci_device_remove() sets the cached power state in pci_dev->current_state to PCI_UNKNOWN. This was introduced by commit 2449e06a5696 ("PCI: reset pci device state to unknown state for resume") to invalidate the cached power state in case the system is subsequently put to sleep.

For bound devices, the cached power state is set to PCI_UNKNOWN in pci_pm_suspend_noirq(), immediately before entering system sleep.

Extend to unbound devices for consistency.

This obviates the need to change the cached power state on unbind, so stop doing so.

---
 drivers/pci/pci-driver.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

index f0fbe45bfb9a1..0eb246a07c87a 100644
@@ -490,13 +490,6 @@ static void pci_device_remove(struct device *dev)
 	/* Undo the runtime PM settings in local_pci_probe() */
 	pm_runtime_put_sync(dev);
 
-	/*
-	 * If the device is still on, set the power state as "unknown",
-	 * since it might change by the next time we load the driver.
-	 */
-	if (pci_dev->current_state == PCI_D0)
-		pci_dev->current_state = PCI_UNKNOWN;
-
 	/*
 	 * We would love to complain here if pci_dev->is_enabled is set, that
 	 * the driver should have called pci_disable_device(), but the

@@ -874,7 +867,7 @@ static int pci_pm_suspend_noirq(struct device *dev)
 
 	if (!pm) {
 		pci_save_state(pci_dev);
-		goto Fixup;
+		goto set_unknown;
 	}
 
 	if (pm->suspend_noirq) {

@@ -926,6 +919,7 @@ static int pci_pm_suspend_noirq(struct device *dev)
 		goto Fixup;
 	}
 
+set_unknown:
 	pci_pm_set_unknown_state(pci_dev);
 
 	/*

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yuqi Xu <[email protected]>

[ Upstream commit 7187d145d9042b037e4f10538f70cf95e380219f ]

Duplicate entries in wiphy->cipher_suites do not describe any additional capability, but cfg80211 currently accepts them and leaves individual consumers to deal with them.

One such consumer is the WEXT compatibility code, which appends a WEP key length for each WEP cipher entry it sees. Repeated WEP entries can therefore overflow the fixed iw_range::encoding_size array returned by SIOCGIWRANGE.

Reject duplicate cipher suite entries in wiphy_register() instead. This keeps the cipher suite invariant in one place and makes malformed wiphy descriptions fail early with -EINVAL, rather than relying on a single cfg80211 user to handle duplicates correctly.

---
 net/wireless/core.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

index 5bc3e12e7b2de..8f7f84c5f440b 100644
@@ -729,6 +729,24 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)
 	return ret;
 }
 
+static bool wiphy_cipher_suites_valid(const struct wiphy *wiphy)
+{
+	int i, j;
+
+	if (wiphy->n_cipher_suites && !wiphy->cipher_suites)
+		return false;
+
+	for (i = 0; i < wiphy->n_cipher_suites; i++) {
+		for (j = 0; j < i; j++) {
+			if (wiphy->cipher_suites[i] ==
+			    wiphy->cipher_suites[j])
+				return false;
+		}
+	}
+
+	return true;
+}
+
 int wiphy_register(struct wiphy *wiphy)
 {
 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);

@@ -860,6 +878,9 @@ int wiphy_register(struct wiphy *wiphy)
 	if (res)
 		return res;
 
+	if (!wiphy_cipher_suites_valid(wiphy))
+		return -EINVAL;
+
 	/* sanity check supported bands/channels */
 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
 		const struct ieee80211_sband_iftype_data *iftd;

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Viacheslav Dubeyko <[email protected]>

[ Upstream commit 5f63ac80aef2ee6bb58eab62e98c264774872da6 ]

The xfstests' test-case generic/729 fails with error:

sudo ./check generic/729

FSTYP         -- hfsplus
PLATFORM      -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #36 SMP PREEMPT_DYNAMIC Fri Apr 17 12:40:51 PDT 2026
MKFS_OPTIONS  -- /dev/loop51

MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch

generic/729 23s ... [failed, exit status 1]- output mismatch

mmap-rw-fault: /mnt/test/mmap-rw-fault.tmp: Input/output error

The hfsplus_get_block() only allows creating the next sequential block. It returns -EIO for direct writes beyond EOF. This patch waits for any in-flight DIO on the inode to finish. Then, it extends the file by calling generic_cont_expand_simple() with the goal to guarantee that blockdev_direct_IO() finds all needed blocks already reachable sequentially. And, finally, it flushes and invalidates the DIO range again so the page cache is clean before the direct write begins.

sudo ./check generic/729

FSTYP         -- hfsplus
PLATFORM      -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #40 SMP PREEMPT_DYNAMIC Thu Apr 16 15:41:03 PDT 2026
MKFS_OPTIONS  -- /dev/loop51

MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch

generic/729 23s ... 32s
Ran: generic/729
Passed all 1 tests

---
 fs/hfsplus/inode.c | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

index 3f64f68d625c1..8184518f5cf4e 100644
@@ -123,9 +123,44 @@ static ssize_t hfsplus_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
 	struct file *file = iocb->ki_filp;
 	struct address_space *mapping = file->f_mapping;
 	struct inode *inode = mapping->host;
+	loff_t isize;
 	size_t count = iov_iter_count(iter);
+	loff_t end = iocb->ki_pos + count;
 	ssize_t ret;
 
+	/*
+	 * The hfsplus_get_block() only allows creating the next sequential block.
+	 * For direct writes beyond EOF, expand the file first.
+	 */
+	if (iov_iter_rw(iter) == WRITE && iocb->ki_pos > i_size_read(inode)) {
+		loff_t start_off, end_off;
+		loff_t start_page, end_page;
+
+		isize = i_size_read(inode);
+
+		/*
+		 * Wait for any in-flight DIO on this inode to finish before
+		 * calling generic_cont_expand_simple().
+		 */
+		inode_dio_wait(inode);
+
+		ret = generic_cont_expand_simple(inode, iocb->ki_pos);
+		if (ret)
+			return ret;
+
+		start_off = isize;
+		end_off = (end > 0) ? end - 1 : end;
+
+		ret = filemap_write_and_wait_range(mapping, start_off, end_off);
+		if (ret)
+			return ret;
+
+		start_page = start_off >> PAGE_SHIFT;
+		end_page = end_off >> PAGE_SHIFT;
+
+		invalidate_inode_pages2_range(mapping, start_page, end_page);
+	}
+
 	ret = blockdev_direct_IO(iocb, inode, iter, hfsplus_get_block);
 
 	/*

@@ -133,8 +168,7 @@ static ssize_t hfsplus_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
 	 * blocks outside i_size. Trim these off again.
 	 */
 	if (unlikely(iov_iter_rw(iter) == WRITE && ret < 0)) {
-		loff_t isize = i_size_read(inode);
-		loff_t end = iocb->ki_pos + count;
+		isize = i_size_read(inode);
 
 		if (end > isize)
 			hfsplus_write_failed(mapping, end);

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Berg <[email protected]>

[ Upstream commit 8b9a100e1a76c52988b31099b349fd95a58c8768 ]

The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this.

---
 net/wireless/nl80211.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

index 47e3bcba268af..d9fa7e8447877 100644
@@ -5896,8 +5896,12 @@ static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
 	if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
 		params->he_cap = (void *)(cap->data + 1);
 	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
-	if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
+	if (cap && cap->datalen >= sizeof(*params->he_oper) + 1) {
 		params->he_oper = (void *)(cap->data + 1);
+		/* takes extension ID into account */
+		if (cap->datalen < ieee80211_he_oper_size((void *)params->he_oper))
+			return -EINVAL;
+	}
 	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
 	if (cap) {
 		if (!cap->datalen)

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Berg <[email protected]>

[ Upstream commit 51129a2ca0482b006d0e12a0aa025ff1e1cad2cb ]

Jouni reported that certain sequences of tests caused some WDS tests to fail after applying the upcoming hwsim changes for NAN. I bisected that down to converting hwsim to TXQs, and after a long debug session found that the 4-addr NDP was getting dropped, because it goes out via a (management) TXQ and is a data frame.

It's unclear to me now why this only happens in some test sequences (e.g. "sigma_dut_sae_h2e_ap_loop ap_wds_sta" and "sigma_dut_eap_ttls_all_akm_suites ap_wds_sta_open"), maybe that affects timing and the frame is otherwise delayed in some way.

Correct the check to only drop frames that actually carry data, not NDPs.

---
 net/mac80211/tx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 8fc30a773c583..9bc1a80e80570 100644
@@ -3894,7 +3894,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
 		 * injected frames or EAPOL frames from the local station.
 		 */
 		if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) &&
-			     ieee80211_is_data(hdr->frame_control) &&
+			     ieee80211_is_data_present(hdr->frame_control) &&
 			     !ieee80211_vif_is_mesh(&tx.sdata->vif) &&
 			     tx.sdata->vif.type != NL80211_IFTYPE_OCB &&
 			     !is_multicast_ether_addr(hdr->addr1) &&

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Panagiotis Petrakopoulos <[email protected]>

[ Upstream commit d5e6f353ce1e1c25b8458ea390ed09d2377412c5 ]

It was recently reported that rtw_fw_adaptivity_result() in fw.c dereferences rtwdev->chip->edcca_th without a NULL check. The issue is that devices with the 8821CE chip don't define edcca_th in their chip info. As a result, when rtw_fw_adaptivity_result() tries to dereference it, the kernel triggers an oops.

Add a NULL check for edcca_th before dereferencing it in rtw_fw_adaptivity_result() in fw.c. Placing the check at the function entry avoids logging any garbage values.

This change does not address the root cause for this behavior, but it prevents the NULL dereference and the resulting oops while a more permanent solution is developed.

Tested on a 8822CE chip which defines edcca_th, so this issue is not present on it, but it still uses this driver and I can verify there are no regressions.

---
 drivers/net/wireless/realtek/rtw88/fw.c | 3 +++
 1 file changed, 3 insertions(+)

index b9b0114e253b4..43e3df6a48369 100644
@@ -270,6 +270,9 @@ static void rtw_fw_adaptivity_result(struct rtw_dev *rtwdev, u8 *payload,
 	struct rtw_hw_reg_offset *edcca_th = rtwdev->chip->edcca_th;
 	struct rtw_c2h_adaptivity *result = (struct rtw_c2h_adaptivity *)payload;
 
+	if (!edcca_th)
+		return;
+
 	rtw_dbg(rtwdev, RTW_DBG_ADAPTIVITY,
 		"Adaptivity: density %x igi %x l2h_th_init %x l2h %x h2l %x option %x\n",
 		result->density, result->igi, result->l2h_th_init, result->l2h,

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dian-Syuan Yang <[email protected]>

[ Upstream commit d1fba55228685a7a237681be739683eaf698b9bc ]

Fix interoperability problem where CSI feedback with STBC enabled at VHT 160MHz BW cannot be properly decoded by certain APs, causing CSI reports to be rejected. This problem is specific to Wi-Fi 7 chips, as Wi-Fi 6 defaults to 20MHz CSI BW. Therefore, disable STBC encoding for CSI transmission in VHT 160MHz mode to ensure CSI feedback is accepted by these APs and maintain smooth throughput.

---
 drivers/net/wireless/realtek/rtw89/mac_be.c | 4 ++++
 1 file changed, 4 insertions(+)

index 2896abce94a3c..4d180f7723d43 100644
@@ -2131,6 +2131,10 @@ static int rtw89_mac_set_csi_para_reg_be(struct rtw89_dev *rtwdev,
 		sound_dim = min(sound_dim, t);
 	}
 
+	/* Disable stbc_en in VHT 160MHz to avoid IOT issues with certain APs */
+	if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ)
+		stbc_en = 0;
+
 	nc = min(nc, sound_dim);
 	nr = min(nr, sound_dim);
 

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Shengjiu Wang <[email protected]>

[ Upstream commit 99b5316f08f390a5e1ea2239ecca8e2b4ef70ac6 ]

WM8904 has a 27 MHz PLL frequency limit. The current S24_LE PLL ratio of 384 exceeds this at high sample rates (96 kHz × 384 = 36.864 MHz).

Reduce the ratio to 192 for WM8904, keeping PLL within limits at all supported rates (96 kHz × 192 = 18.432 MHz).

Add codec-specific pll_ratio_s24 field, default 384, override to 192 for WM8904.

---
 sound/soc/fsl/fsl-asoc-card.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

index 5a69f9d255acb..4762e38922d76 100644
@@ -48,6 +48,9 @@
  * @mclk_id: MCLK (or main clock) id for set_sysclk()
  * @fll_id: FLL (or secordary clock) id for set_sysclk()
  * @pll_id: PLL id for set_pll()
+ * @pll_ratio_s24: PLL output ratio for S24_LE format (PLL_freq = sample_rate × ratio)
+ *                 Default is 384, but some codecs (e.g., WM8904) require lower values
+ *                 to stay within PLL frequency limits
  */
 struct codec_priv {
 	struct clk *mclk;

@@ -56,6 +59,7 @@ struct codec_priv {
 	u32 mclk_id;
 	int fll_id;
 	int pll_id;
+	int pll_ratio_s24;
 };
 
 /**

@@ -215,7 +219,7 @@ static int fsl_asoc_card_hw_params(struct snd_pcm_substream *substream,
 
 		if (codec_priv->pll_id >= 0 && codec_priv->fll_id >= 0) {
 			if (priv->sample_format == SNDRV_PCM_FORMAT_S24_LE)
-				pll_out = priv->sample_rate * 384;
+				pll_out = priv->sample_rate * codec_priv->pll_ratio_s24;
 			else
 				pll_out = priv->sample_rate * 256;
 

@@ -739,6 +743,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev)
 	for (codec_idx = 0; codec_idx < 2; codec_idx++) {
 		priv->codec_priv[codec_idx].fll_id = -1;
 		priv->codec_priv[codec_idx].pll_id = -1;
+		priv->codec_priv[codec_idx].pll_ratio_s24 = 384;
 	}
 
 	/* Diversify the card configurations */

@@ -830,6 +835,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev)
 		priv->codec_priv[0].mclk_id = WM8904_FLL_MCLK;
 		priv->codec_priv[0].fll_id = WM8904_CLK_FLL;
 		priv->codec_priv[0].pll_id = WM8904_FLL_MCLK;
+		priv->codec_priv[0].pll_ratio_s24 = 192;
 		priv->dai_fmt |= SND_SOC_DAIFMT_CBP_CFP;
 	} else if (of_device_is_compatible(np, "fsl,imx-audio-spdif")) {
 		ret = fsl_asoc_card_spdif_init(codec_np, cpu_np, codec_dai_name, priv);

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marco Elver <[email protected]>

[ Upstream commit 07a1a6562ce29e2e0c134a57882d6e52e8758492 ]

Some subsystems enable -Wmaybe-uninitialized [1], which can trigger false positives when KCSAN is enabled. Specifically, passing an uninitialized variable to functions that instrument accesses (e.g., copy_from_user()) results in calls to __kcsan_check_access().

Because __kcsan_check_access() takes a const volatile void *ptr, GCC infers that the function may only read the memory location, and thus warns if the passed variable is uninitialized.

However, KCSAN is a dynamic analysis tool for data race detection; while it does read the memory location to detect concurrent modifications, the "initialized'ness" of the memory location is irrelevant for its analysis.

Use absolute_pointer() in __kcsan_check_write(), kcsan_check_write(), and kcsan_check_atomic_write() to hide the pointer from the compiler, preventing it from concluding that the pointer passed points to uninitialized memory.

This fixes warnings like:

|   CC      fs/ntfs3/file.o
| In file included from include/asm-generic/rwonce.h:27,
|                  from arch/arm64/include/asm/rwonce.h:81,
|                  from include/linux/compiler.h:369,
|                  from include/linux/array_size.h:5,
|                  from include/linux/kernel.h:16,
|                  from include/linux/backing-dev.h:12,
|                  from fs/ntfs3/file.c:10:
| In function 'instrument_copy_from_user_before',
|     inlined from '_inline_copy_from_user' at include/linux/uaccess.h:184:2,
|     inlined from 'copy_from_user' at include/linux/uaccess.h:221:9,
|     inlined from 'ntfs_ioctl_fitrim' at fs/ntfs3/file.c:77:6,
|     inlined from 'ntfs_ioctl' at fs/ntfs3/file.c:164:10:
| include/linux/kcsan-checks.h:220:28: error: 'range' may be used uninitialized [-Werror=maybe-uninitialized]
|   220 | #define kcsan_check_access __kcsan_check_access
|       |                            ^
| include/linux/kcsan-checks.h:311:9: note: in expansion of macro 'kcsan_check_access'
|   311 |         kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE)
|       |         ^~~~~~~~~~~~~~~~~~
| include/linux/instrumented.h:147:9: note: in expansion of macro 'kcsan_check_write'
|   147 |         kcsan_check_write(to, n);
|       |         ^~~~~~~~~~~~~~~~~
| include/linux/kcsan-checks.h: In function 'ntfs_ioctl':
| include/linux/kcsan-checks.h:37:6: note: by argument 1 of type 'const volatile void *' to '__kcsan_check_access' declared here
|    37 | void __kcsan_check_access(const volatile void *ptr, size_t size, int type);
|       |      ^~~~~~~~~~~~~~~~~~~~
| fs/ntfs3/file.c:65:29: note: 'range' declared here
|    65 |         struct fstrim_range range;
|       |                             ^~~~~

---
 include/linux/kcsan-checks.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index 92f3843d9ebb8..e135dacaa90f3 100644
@@ -282,7 +282,7 @@ static inline void __kcsan_disable_current(void) { }
  * @size: size of access
  */
 #define __kcsan_check_write(ptr, size)                                         \
-	__kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE)
+	__kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_WRITE)
 
 /**
  * __kcsan_check_read_write - check regular read-write access for races

@@ -308,7 +308,7 @@ static inline void __kcsan_disable_current(void) { }
  * @size: size of access
  */
 #define kcsan_check_write(ptr, size)                                           \
-	kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE)
+	kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_WRITE)
 
 /**
  * kcsan_check_read_write - check regular read-write access for races

@@ -331,7 +331,7 @@ static inline void __kcsan_disable_current(void) { }
 #define kcsan_check_atomic_read(ptr, size)                                     \
 	kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC)
 #define kcsan_check_atomic_write(ptr, size)                                    \
-	kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE)
+	kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE)
 #define kcsan_check_atomic_read_write(ptr, size)                               \
 	kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE | KCSAN_ACCESS_COMPOUND)
 #endif

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Siew Chin Lim <[email protected]>

[ Upstream commit 4b0a32016347bfd6ae9849f21b1b767905f68d14 ]

Change INTEL_SIP_SMC_FCS_GET_PROVISION_DATA's SMC call to async from sync to avoid long runtime which may cause the watchdog timeout issue.

---
 drivers/firmware/stratix10-svc.c             |  4 ++--
 include/linux/firmware/intel/stratix10-smc.h | 12 ++++--------
 2 files changed, 6 insertions(+), 10 deletions(-)

index 2d02f3f0b9338..48379a4bb93ef 100644
@@ -340,6 +340,7 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data,
 	case COMMAND_FCS_SEND_CERTIFICATE:
 	case COMMAND_FCS_DATA_ENCRYPTION:
 	case COMMAND_FCS_DATA_DECRYPTION:
+	case COMMAND_FCS_GET_PROVISION_DATA:
 		cb_data->status = BIT(SVC_STATUS_OK);
 		break;
 	case COMMAND_RECONFIG_DATA_SUBMIT:

@@ -366,7 +367,6 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data,
 		cb_data->kaddr2 = &res.a2;
 		break;
 	case COMMAND_FCS_RANDOM_NUMBER_GEN:
-	case COMMAND_FCS_GET_PROVISION_DATA:
 	case COMMAND_POLL_SERVICE_STATUS:
 		cb_data->status = BIT(SVC_STATUS_OK);
 		cb_data->kaddr1 = &res.a1;

@@ -533,7 +533,7 @@ static int svc_normal_to_secure_thread(void *data)
 			break;
 		case COMMAND_FCS_GET_PROVISION_DATA:
 			a0 = INTEL_SIP_SMC_FCS_GET_PROVISION_DATA;
-			a1 = (unsigned long)pdata->paddr;
+			a1 = 0;
 			a2 = 0;
 			break;
 

index ee80ca4bb0d0c..1e60fd6210c3b 100644
@@ -600,24 +600,20 @@ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE)
 
 /**
  * Request INTEL_SIP_SMC_FCS_GET_PROVISION_DATA
- * Sync call to dump all the fuses and key hashes
+ * Async call to dump all the fuses and key hashes
  *
  * Call register usage:
  * a0 INTEL_SIP_SMC_FCS_GET_PROVISION_DATA
- * a1 the physical address for firmware to write structure of fuse and
- *    key hashes
- * a2-a7 not used
+ * a1-a7 not used
  *
  * Return status:
  * a0 INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_FCS_ERROR or
  *      INTEL_SIP_SMC_FCS_REJECTED
- * a1 mailbox error
- * a2 physical address for the structure of fuse and key hashes
- * a3 the size of structure
+ * a1-a3 not used
  *
  */
 #define INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA 94
 #define INTEL_SIP_SMC_FCS_GET_PROVISION_DATA \
-	INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA)
+	INTEL_SIP_SMC_STD_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA)
 
 #endif

2.53.0

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Danielle Ratson <[email protected]>

[ Upstream commit fee1fc1d5a5475f5516d406a03e443348cd0f06c ]

When neighbor suppression is enabled on a VXLAN port, the bridge is expected to reply to ARP/NS messages on behalf of remote hosts when both FDB and neighbor entries exist. This allows the bridge to suppress flooding of these messages to the VXLAN overlay.

According to RFC 9161 ("Operational Aspects of Proxy ARP/ND in Ethernet Virtual Private Networks"):
"A PE SHOULD reply to broadcast/multicast address resolution messages, i.e., ARP Requests, ARP probes, NS messages, as well as DAD NS messages. An ARP probe is an ARP Request constructed with an all-zero sender IP address that may be used by hosts for IPv4 Address Conflict Detection as specified in [RFC5227]".

However, the current implementation unconditionally suppresses ARP probes and DAD Neighbor Solicitations, which breaks Duplicate Address Detection (DAD) over EVPN.

For DAD to work correctly over the VXLAN fabric:
- When the bridge does not know the answer:
flood the probe/DAD packet to allow remote VTEPs to respond.
- When the bridge knows the answer:
reply to indicate the address is in use.

Fix by adjusting the early suppression checks to exclude ARP probes and DAD NS from unconditional suppression.

When replying to a DAD NS, br_nd_send() is adjusted to set the NA destination to the all-nodes multicast address (ff02::1) and clear the Solicited flag, in accordance with RFC 4861 section 7.2.4.

---
 net/bridge/br_arp_nd_proxy.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

index 985aaf7ff1564..f2d6643d2c0a1 100644
@@ -162,7 +162,7 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
 			return;
 		if (parp->ar_op != htons(ARPOP_RREQUEST) &&
 		    parp->ar_op != htons(ARPOP_RREPLY) &&
-		    (ipv4_is_zeronet(sip) || sip == tip)) {
+		    sip == tip) {
 			/* prevent flooding to neigh suppress ports */
 			BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
 			return;

@@ -260,6 +260,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
 	int ns_olen;
 	int i, len;
 	u8 *daddr;
+	bool dad;
 	u16 pvid;
 
 	if (!dev || skb_linearize(request))

@@ -298,8 +299,13 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
 		}
 	}
 
+	dad = ipv6_addr_any(&ipv6_hdr(request)->saddr);
+
 	/* Ethernet header */
-	ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
+	if (dad)
+		ipv6_eth_mc_map(&in6addr_linklocal_allnodes, eth_hdr(reply)->h_dest);
+	else
+		ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
 	ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
 	eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
 	reply->protocol = htons(ETH_P_IPV6);