6.6.158-rc1 review

This is the start of the stable review cycle for the 6.6.158 release. There are 1193 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 02 Oct 2026 15:23:04 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.158-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.158-rc1

Breno Leitao <[email protected]>
net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling

Thorsten Blum <[email protected]>
crypto: atmel-ecc - avoid stale fallback key after set_secret failure

Fourie Zhang <[email protected]>
netfilter: nf_tables: don't queue packet path object notifications

Florian Westphal <[email protected]>
netfilter: nf_tables: place base_seq in struct net

Yang Li <[email protected]>
netfilter: nft_set_rbtree: Remove unused variable nft_net

Bryam Vargas <[email protected]>
crypto: virtio - bound the akcipher result length

Lukas Wunner <[email protected]>
crypto: virtio - Drop superfluous [as]kcipher_req pointer

Lukas Wunner <[email protected]>
crypto: virtio - Drop superfluous [as]kcipher_ctx pointer

Lukas Wunner <[email protected]>
crypto: virtio - Drop sign/verify operations

Markus Elfring <[email protected]>
crypto: virtio - Less function calls in __virtio_crypto_akcipher_do_req() after error detection

Eric Dumazet <[email protected]>
vlan: fix skb_under_panic and races when toggling HW VLAN offload

Jakub Kicinski <[email protected]>
vlan: defer real device state propagation to netdev_work

Kyle Zeng <[email protected]>
net/packet: defer vmalloc TX_RING free until skbs finish

Qing Ming <[email protected]>
gtp: serialize PDP context updates

Breno Leitao <[email protected]>
usb: xhci: bail out of setup if the controller is inaccessible

Niklas Neronin <[email protected]>
usb: xhci: simplify handling of Structural Parameters 1 values

Niklas Neronin <[email protected]>
usb: xhci: use cached HCSPARAMS1 value

Niklas Neronin <[email protected]>
usb: xhci: implement USB Port Register Set struct

Niklas Neronin <[email protected]>
usb: xhci: add USB Port Register Set struct

Niklas Neronin <[email protected]>
usb: xhci: add helper to read PORTSC register

Niklas Neronin <[email protected]>
usb: xhci: add tracing for PORTSC register writes

Denis Arefev <[email protected]>
ALSA: hda: Fix missing pointer check in hda_component_manager_init function

Guangshuo Li <[email protected]>
drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()

Rengarajan S <[email protected]>
lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected

Rengarajan S <[email protected]>
lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected

Florian Eckert <[email protected]>
tools/thermal/tmon: Fix compilation warning for wrong format

Chunguang Xu <[email protected]>
nvme-fabrics: use reserved tag for reg read/write command

James Clark <[email protected]>
perf test: Change all remaining #!/bin/sh to #!/bin/bash

Dan Carpenter <[email protected]>
drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()

Alex Hung <[email protected]>
drm/amd/display: Validate function returns

Alex Hung <[email protected]>
drm/amd/display: Check null pointers before using them

Alex Hung <[email protected]>
drm/amd/display: Ensure array index tg_inst won't be -1

Allen Pan <[email protected]>
drm/amd/display: Add a dc_state NULL check in dc_state_release

Baochen Qiang <[email protected]>
wifi: ath12k: check M3 buffer size as well whey trying to reuse it

Baochen Qiang <[email protected]>
wifi: ath12k: fix kernel crash during resume

Jakub Kicinski <[email protected]>
net: tls: fix silent data drop under pipe back-pressure

Li Ming <[email protected]>
cxl/mem: Fix no cxl_nvd during pmem region auto-assembling

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Defer work in bpf_timer_cancel_and_free

Yonghong Song <[email protected]>
bpf: Fail verification for sign-extension of packet data/data_end/data_meta

Darrick J. Wong <[email protected]>
xfs: fix blockgc group quota scanning when usrquota isn't enforced

Zihan Xi <[email protected]>
smb: client: validate POSIX create context length

Zihan Xi <[email protected]>
smb: client: fix create context out-of-bounds reads

Hui Peng <[email protected]>

    Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

Aldo Ariel Panzardo <[email protected]>
Bluetooth: mgmt: fix race in read_unconf_index_list()

Aldo Ariel Panzardo <[email protected]>
Bluetooth: L2CAP: validate frame length before control and FCS access

Aldo Ariel Panzardo <[email protected]>
Bluetooth: ISO: balance the parent hold in hci_bind_bis()

Aldo Ariel Panzardo <[email protected]>
Bluetooth: hci_sock: reject out-of-range OCF values

Aldo Ariel Panzardo <[email protected]>
Bluetooth: hci_sock: validate event length before filtering

Aldo Ariel Panzardo <[email protected]>
Bluetooth: hci_conn: fix CIS hold ownership on reuse

Tan Chi <[email protected]>
RISC-V: KVM: Fix HSM hart status error propagation

Myeonghun Pak <[email protected]>
RISC-V: KVM: Synchronize hrtimer callback during teardown

Vineeth Vijayan <[email protected]>
s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()

Myeonghun Pak <[email protected]>
pinctrl: single: free the IRQ on domain creation failure

Yehyeong Lee <[email protected]>
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

Doruk Tan Ozturk <[email protected]>
nfc: port100: reject frames whose declared length exceeds the received data

Aamir Ahmed <[email protected]>
nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

Luxiao Xu <[email protected]>
nfc: fix use-after-free in nfc_get_local_general_bytes

Luxiao Xu <[email protected]>
netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

Weiming Shi <[email protected]>
netfilter: ip6t_rpfilter: reject routes without inet6_dev

Wentao Liang <[email protected]>
net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()

Ming Wang <[email protected]>
net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist

Gajdos Tamás <[email protected]>
net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read

Gajdos Tamás <[email protected]>
net: atl1c: fix soft lockup on out-of-range tpd_cons read

Ilya Maximets <[email protected]>
net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

Wentao Liang <[email protected]>
net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()

Gajdos Tamás <[email protected]>
net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read

Zijie Huang <[email protected]>
net: arp: terminate device name before lookup

Weiming Shi <[email protected]>
net/sched: reject IDR error pointers when deleting actions

Ralf Lici <[email protected]>
net/mlx5e: advertise MACsec offload only when supported

Wentao Liang <[email protected]>
net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()

Wei Jie LAW <[email protected]>
HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

Junjie Cao <[email protected]>
HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard

Chen Changcheng <[email protected]>
HID: alps: fix use-after-free on input2 registration failure

Angel J <[email protected]>
PCI: of_property: Omit bus properties without a subordinate bus

Karl Mehltretter <[email protected]>
gpio: tps65219: Fix GPIO input value reads

Peiyang He <[email protected]>
drm/virtio: fix NULL pointer dereference on fence allocation failure

Peiyang He <[email protected]>
drm/virtio: fix memory leak of fence event on execbuffer failure

Peiyang He <[email protected]>
drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()

Wentao Liang <[email protected]>
drm/nouveau: Fix gem reference leak in validate_init()

Peiyang He <[email protected]>
drm/nouveau: fix double-free in nvif_vmm_dtor

Wentao Liang <[email protected]>
drm/nouveau: Fix bridge reference leak in nv1a_ram_new()

Guangshuo Li <[email protected]>
drm/nouveau: fix autosuspend cleanup during teardown

Wentao Liang <[email protected]>
drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()

Wentao Liang <[email protected]>
drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()

Wentao Liang <[email protected]>
drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()

Wentao Liang <[email protected]>
drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()

Christian König <[email protected]>
drm/i915: fix incorrect RCU teardown order

Dongliang Qin <[email protected]>
rds: ib: Clear the sg list when mapping an MR fails

Zixuan Chai <[email protected]>
llc: reserve device headroom for allocated frames

Ridham Khurana <[email protected]>
gpio: zynq: fix runtime PM leak on request error path

Wentao Liang <[email protected]>
gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()

Hui Peng <[email protected]>
ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

Norbert Szetei <[email protected]>
ipv6: do not let ipv6_find_hdr() return an offset past the packet end

Wentao Liang <[email protected]>
fsl/fman: Fix clk reference leak in read_dts_node()

Josef Bacik <[email protected]>
writeback: report a Tasks-RCU quiescent state per cgwb drain pass

Pavankumar Kondeti <[email protected]>
workqueue: Fix NULL current_pwq deref in flush dependency check

Patrick Lu (Anthropic) <[email protected]>
writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes

Hui Peng <[email protected]>
fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

Matthias Goergens <[email protected]>
ata: libata-scsi: bound the ATA passthru sense descriptor writes

Dairui Zhang <[email protected]>
af_packet: fix integer overflow in prb_calc_retire_blk_tmo()

Aohan Mei <[email protected]>
sctp: discard the rest of the packet on a stale-cookie error

Eric Dumazet <[email protected]>
tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

Mario Limonciello <[email protected]>
x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11

Kuniyuki Iwashima <[email protected]>
af_unix: Drop all SCM attributes for SOCKMAP.

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase

Pablo Neira Ayuso <[email protected]>
rculist: add list_splice_rcu() for private lists

Mark Amirkan <[email protected]>
mptcp: return sk_wait_data() errors from recvmsg()

Sean Christopherson <[email protected]>
perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs()

Sean Christopherson <[email protected]>
perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused

Sean Christopherson <[email protected]>
perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED

Sean Christopherson <[email protected]>
perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits

Hui Peng <[email protected]>

    autofs: fix sbi->pipe file reference leak in autofs_kill_sb()

Eric Dumazet <[email protected]>
vlan: ensure sufficient headroom in vlan_dev_hard_header()

Eric Dumazet <[email protected]>
net/sched: sch_teql: fix shadowed err in __teql_resolve()

Eric Dumazet <[email protected]>
bridge: check llc_mac_hdr_init() return value in br_send_bpdu()

Eric Dumazet <[email protected]>
llc: fix skb UAF and leaks on llc_mac_hdr_init() failure

Coia Prant <[email protected]>
net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails

Ginger Li <[email protected]>

    tipc: Fix a data race on mon->peer_cnt in mon_timeout()

Sidraya Jayagond <[email protected]>
net/smc: fix UAF on lgr list traversal in smcr_port_err()

Sang-Hoon Choi <[email protected]>
nfp: hold IPsec RX state under the XArray lock

Yilin Zhang <[email protected]>
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

Aleksei Sviridkin <[email protected]>
net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621

David Dai <[email protected]>
bonding: crypto offload enabled, non-offload slave failover, rekey failed

Norbert Szetei <[email protected]>
net: xps: reject an out of range traffic class

Sanghyun Park <[email protected]>
vxlan: use one headroom snapshot for neighbour replies

Xuanqiang Luo <[email protected]>
ip_gre: Reject enabling collect metadata through changelink

Florian Fainelli <[email protected]>
net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT

Florian Fainelli <[email protected]>
net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr

Florian Fainelli <[email protected]>
net: bcmgenet: do not skip WoL power up on GENET V1

Doug Berger <[email protected]>
net: bcmgenet: allow return of power up status

Doug Berger <[email protected]>
net: bcmgenet: move bcmgenet_power_up into resume_noirq

Florian Fainelli <[email protected]>
net: bcmgenet: initialize u64 stats seq counter for all queues

Florian Fainelli <[email protected]>
net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems

Ivan Delalande <[email protected]>
tg3: use random MAC address when tg3_get_device_address fails

Dragan Simic <[email protected]>
driver core: Add device probe log helper dev_warn_probe()

Uwe Kleine-König <[email protected]>
driver core: Make dev_err_probe() silent for -ENOMEM

Uwe Kleine-König <[email protected]>
driver core: Better advertise dev_err_probe()

Johan Almbladh <[email protected]>
bpf: Fix BSWAP 32 and 16 on MIPS64

Johan Almbladh <[email protected]>
bpf: Fix immediate JMP JEQ/JNE on MIPS32

Ido Schimmel <[email protected]>

    vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets

Shihuang Liu <[email protected]>
net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()

Jakub Kicinski <[email protected]>
veth: manage XDP program pointers during channel resize

Victor Nogueira <[email protected]>
net/sched: act_gate: budget the per-entry list in get_fill_size

Deepanshu Kartikey <[email protected]>

    nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

Ömer Mete Kaya <[email protected]>
nfc: llcp: fix slab-out-of-bounds reads when logging service names

Ömer Mete Kaya <[email protected]>
nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()

Ömer Mete Kaya <[email protected]>
nfc: llcp: fix -ENOMEM on connect with zero-length service name

Pengpeng Hou <[email protected]>
nfc: st21nfca: validate ISO15693 inventory length

Cong Nguyen <[email protected]>
nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

Chris Gellermann <[email protected]>
nfc: virtual_ncidev: Add missing ioctl compat handler

Chris Gellermann <[email protected]>
selftests/nci: Fix out-of-bounds store on thread join

Chaithanya Lagisetty <[email protected]>
selftests: nci: Fix uninitialized family ID on missing attribute

Lee Jones <[email protected]>
nfc: llcp: Fix race condition in accept_queue lifecycle

Lei Zhu <[email protected]>
selftests: nci: Correct pthread_create return value check

Aldo Ariel Panzardo <[email protected]>
nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()

Pengpeng Hou <[email protected]>
nfc: st21nfca: validate received frame size

Pengpeng Hou <[email protected]>
nfc: nfcmrvl: validate helper command length before pull

Weiming Shi <[email protected]>
bpf: Reject dev-bound-only programs on other devices

Maxime Chevallier <[email protected]>
net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K

Maxime Chevallier <[email protected]>
net: stmmac: selftests: Capture all packets for vlan checks

Maxime Chevallier <[email protected]>

    net: stmmac: selftests: Check the dev->features for S-TAG offload testing

Maxime Chevallier <[email protected]>
net: stmmac: selftests: Support running selftests on DSA conduits

Xin Long <[email protected]>
sctp: hold asoc or transport before mod_timer() in timer handlers

Bernardo Soares <[email protected]>
net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports

Bernardo Soares <[email protected]>
net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports

Zhao Gongyi <[email protected]>
bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc

Emil Tsalapatis <[email protected]>
bpf: Fix bpf_sock context code generation

Emil Tsalapatis <[email protected]>
bpf: Fix bounds check for skb-backed dynptrs

Jakub Kicinski <[email protected]>
genetlink: report the real command id for dump-only ops in policy dumps

bui duc phuc <[email protected]>
net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error

Mikhail Zaslonko <[email protected]>
s390/debug: Fix NULL pointer dereference in debug_info_copy()

Mikhail Zaslonko <[email protected]>
s390/debug: Do not register views for failed static debug areas

Myeonghun Pak <[email protected]>
tg3: clean up PHYLIB resources on probe failure

Pengpeng Hou <[email protected]>
net: usb: sr9700: include receive overhead in the length check

Hui Peng <[email protected]>
Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()

Hui Peng <[email protected]>
Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough

Li Youhong <[email protected]>
drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

Junrui Luo <[email protected]>
drm/virtio: release the GEM object on virtio_gpu_vram_create() errors

Junrui Luo <[email protected]>
drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()

Junrui Luo <[email protected]>
drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()

Junrui Luo <[email protected]>
drm/virtio: fix object leak when drm_gem_handle_create() fails

Jamal Hadi Salim <[email protected]>
net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget

Aamir Ahmed <[email protected]>
net: usb: catc: bound the RX packet length in catc_rx_done()

Yiqi Sun <[email protected]>
sctp: avoid livelock while updating retransmit path

Kuniyuki Iwashima <[email protected]>
ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().

Lorenzo Bianconi <[email protected]>
net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure

Breno Leitao <[email protected]>
net: mediatek: mtk_eth_sock: allocate dummy net_device dynamically

Breno Leitao <[email protected]>
net: create a dummy net_device allocator

Breno Leitao <[email protected]>
net: core: Fix documentation

Amit Cohen <[email protected]>
net: Do not return value from init_dummy_netdev()

Jérémy Jean <[email protected]>
net: gue: reject invalid REMCSUM offsets

Nguyen Ngoc Thang <[email protected]>
net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure

Francesco Magazzu <[email protected]>
drm/nouveau/clk: don't clobber reclock status when restoring volt/fan

Dan Carpenter <[email protected]>
drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update

Joseph Qi <[email protected]>
ocfs2: make ocfs2_calc_xattr_init() return void

Zeng Heng <[email protected]>
arm64: io: Reject non-user protection in ioremap_prot()

Naman Gulati <[email protected]>
netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name

Julian Anastasov <[email protected]>
ipvs: revalidate ihl before icmp_send

Karl Mehltretter <[email protected]>
netfilter: nft_synproxy: use the family-aware checksum helper

Florian Westphal <[email protected]>
netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

Scott Mitchell <[email protected]>

    netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation

Jérémy Jean <[email protected]>
netfilter: flowtable: publish HW_DEAD after worker is done

Kumar Kartikeya Dwivedi <[email protected]>
libbpf: Reject truncated ldimm64 CO-RE relocations

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Restrict CO-RE poisoning to relocatable instructions

Jamal Hadi Salim <[email protected]>
net/sched: cls_u32: fix manual hash table handle IDR aliasing

Weiming Shi <[email protected]>
bpf: Skip unsettled links in link iterator

Zhiling Zou <[email protected]>
xsk: Use a 32-bit compare in xsk_map_gen_lookup

Julian Sun <[email protected]>
fs: avoid repeated scans in evict_inodes()

Vineeth Vijayan <[email protected]>
s390/cio: Guard PMCW field accesses with dnv check

Vineeth Vijayan <[email protected]>
s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points

Vineeth Vijayan <[email protected]>
s390/cio: Fix cio_update_schib() to not cache invalid schib

Karl Mehltretter <[email protected]>
s390/pci/docs: Fix sriov_numvfs attribute name

Niklas Schnelle <[email protected]>
docs: s390/pci: Improve and update PCI documentation

Bart Van Assche <[email protected]>
scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()

Eva Kurchatova <[email protected]>
selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode

Sean Christopherson <[email protected]>
cgroup: selftests: Move memcontrol specific helpers out of common cgroup_util.c

Lee Jones <[email protected]>
Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

Christiano Amora <[email protected]>
Bluetooth: SMP: reject Security Request over BR/EDR

Ran Hongyun <[email protected]>
squashfs: Add dictionary size range check to prevent shift-out-of-bounds

Karl Mehltretter <[email protected]>
KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0

Fuad Tabba <[email protected]>
KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save

Marc Zyngier <[email protected]>
KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry sizes

Slawomir Stepien <[email protected]>
HID: amd_sfh: Validate PCI BAR size before mapping

Sean Anderson <[email protected]>
pinctrl: meson: Fix typo in s4 group name

Geliang Tang <[email protected]>
bpf, sockmap: Fix self-redirect copied_seq double-counting

Jiayuan Chen <[email protected]>
bpf: Fix out-of-bounds read of rtt_min in sock_ops

Jose Fernandez (Anthropic) <[email protected]>
bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()

Oscar Priego Verdugo <[email protected]>
HID: elecom: fix bus type for M-XGL20DLBK

Jiayuan Chen <[email protected]>
tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context

Jiayuan Chen <[email protected]>
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()

Jiayuan Chen <[email protected]>
bpf: Fix divide-by-zero in btf_struct_walk()

Sven Schnelle <[email protected]>
selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc

Weiming Shi <[email protected]>
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

Daniel Borkmann <[email protected]>
bpf: Fix bpf_skb_change_tail wrt csum partial skbs

Claudio Imbrenda <[email protected]>
KVM: s390: Fix IRQ injection with SIGP Stop and Store Status

Mostafa Saleh <[email protected]>
remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage

Phil Sutter <[email protected]>
netfilter: nf_tables: Simplify chain netdev notifier

Phil Sutter <[email protected]>
netfilter: nf_tables: Tolerate chains with no remaining hooks

Helge Deller <[email protected]>
apparmor: Fix 8-byte alignment for initial dfa blob streams

Gaosheng Cui <[email protected]>
apparmor: Fix memory leak in unpack_profile()

Fedor Pchelkin <[email protected]>
apparmor: free the allocated pdb objects

Wenwu Hou <[email protected]>
erofs: fix large folio race in erofs_fscache_req_complete

Jinjie Ruan <[email protected]>
spi: zynqmp-gqspi: Use devm_spi_alloc_host()

Mickaël Salaün <[email protected]>
selftests/landlock: Add layout1.refer_mount_root

Itai Handler <[email protected]>
spi: spi-zynqmp-gqspi: stop the controller on shutdown

Namjae Jeon <[email protected]>
ksmbd: fix partial normalized name responses

Eric Dumazet <[email protected]>
ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

Eric Dumazet <[email protected]>
ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()

Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Don't hold RTNL for MCAST_ socket options.

Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP.

Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.

Kuniyuki Iwashima <[email protected]>

    ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec().

Frank Sorenson <[email protected]>
smb: client: fix missing iov bounds check in parse_posix_sids()

Frank Sorenson <[email protected]>
smb: client: fix missing lower-bound check on DFS referral string offsets

Frank Sorenson <[email protected]>

    smb: client: fix server->total_read for compound encrypted PDUs

Frank Sorenson <[email protected]>
smb: client: fix potential OOB read in smb3_enum_snapshots()

Frank Sorenson <[email protected]>
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

Paulo Alcantara <[email protected]>
smb: client: fix smbd_connection leak on cifs_get_tcp_session() error

Frank Sorenson <[email protected]>
smb: client: reject short Next offsets in parse_server_interfaces()

Paulo Alcantara <[email protected]>
smb: client: fix rlist race and missing initialization

Paulo Alcantara <[email protected]>
smb: client: cancel reconnect work in clean_demultiplex_info()

Guangshuo Li <[email protected]>
drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure

Guangshuo Li <[email protected]>
drm/msm/adreno: fix autosuspend cleanup during teardown

Sajal Gupta <[email protected]>
drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

Rik van Riel <[email protected]>
wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

Zhao Li <[email protected]>
wifi: mwifiex: validate action frame fixed fields

Pengpeng Hou <[email protected]>
wifi: mwifiex: validate scan response extents

Doruk Tan Ozturk <[email protected]>
wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length

Shengzhuo Wei <[email protected]>
wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

Shengzhuo Wei <[email protected]>
wifi: p54: validate curve data length in the calibration curve converters

Tianchu Chen <[email protected]>
wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()

Ali Ahmet Memis <[email protected]>
wifi: wilc1000: fix out-of-bounds read in P2P public action frames

Runyu Xiao <[email protected]>
wifi: wlcore: release runtime PM ref on regdomain config failure

Tianchu Chen <[email protected]>
wifi: rsi: fix heap OOB write on key removal

Jiangshan Yi <[email protected]>
wifi: libertas_tf: fix UAF in lbtf_free_adapter()

Stanislaw Gruszka <[email protected]>
wifi: iwlegacy: fix broadcast stations deallocation

Jiangshan Yi <[email protected]>
wifi: brcmsmac: fix UAF in brcms_free_timer()

Wentao Liang <[email protected]>
watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start()

Wentao Liang <[email protected]>
watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()

Tzung-Bi Shih <[email protected]>
watchdog: rtd119x: Avoid division by zero

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Propagate error code in resume()

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Fix premature reset during timeout update

Tzung-Bi Shih <[email protected]>
watchdog: digicolor: Avoid division by zero

Li Jun <[email protected]>
watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog

Guangshuo Li <[email protected]>
hwmon: (w83793) release probe data through kref

Guangshuo Li <[email protected]>
hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove

Sanman Pradhan <[email protected]>

    hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676

Sanman Pradhan <[email protected]>
hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding

Nuno Sá <[email protected]>
hwmon: (pmbus/core) increase number of phases and add new mask

Muhammad Bilal <[email protected]>
hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()

Iván Ezequiel Rodriguez <[email protected]>
Input: zero ff_effect before compat copy in input_ff_effect_from_user

Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound

Raphaël Larocque <[email protected]>
Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)

Hans de Goede <[email protected]>

    Input: soc_button_array - check btns_desc->package.count

Hans de Goede <[email protected]>
Input: soc_button_array - fix MS Surface Pro 11 probe failure

Dmitry Torokhov <[email protected]>
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

Chris Sommers <[email protected]>
Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P

Iván Ezequiel Rodriguez <[email protected]>
Input: evdev - zero absinfo before partial copy in EVIOCSABS

Linkai Gong <[email protected]>
Input: cyttsp5 - clamp the HID report size before memcpy

Alexei Turtanov <[email protected]>
Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026

Alvin Šipraga <[email protected]>
Input: adp5588-keys - cache GPIO state before registering the gpiochip

Diogo Ivo (Schneider Electric) <[email protected]>
mmc: sdhci_am654: Reset command and data lines on failed tuning

Xu Rao <[email protected]>
mmc: spi: reset bytes_xfered before retrying CRC failures

Runyu Xiao <[email protected]>
mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt

Felix Gu <[email protected]>
mmc: sdio_uart: fix xmit_fifo leak when the port table is full

Myeonghun Pak <[email protected]>
mmc: sdhci-of-aspeed: Remove children before releasing SDC resources

Florian Maillard <[email protected]>
mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260

Fan Wu <[email protected]>
mmc: mxcmmc: cancel data work and watchdog on remove

Fan Wu <[email protected]>
mmc: hsq: Fix use-after-free in retry work

Zhu Ling <[email protected]>
mmc: core: Fix OF node reference leak on card add failure

Fan Wu <[email protected]>
mmc: core: Cancel SDIO IRQ work before freeing host

Christian Göttsche <[email protected]>
selinux: always fill AVC decision in avc_has_perm_noaudit()

Karl Mehltretter <[email protected]>
selinux: recheck intermediate backing files on mprotect()

Karl Mehltretter <[email protected]>
selinux: preserve user SID across nested backing files

Shuhei Takeshita <[email protected]>
IB/hfi1: Fix the PIO_CRED credit-return mmap

Shuhei Takeshita <[email protected]>
IB/hfi1: Resolve the credit-return buffer through the send context's node

Shuangpeng Bai <[email protected]>
IB/mlx4: Fix use-after-free on pkey sysfs registration failure

Guangshuo Li <[email protected]>
i2c: imx: disable autosuspend on remove

Shengzhuo Wei <[email protected]>
i2c: imx: release DMA channels on probe error

Linkai Gong <[email protected]>
i2c: atr: fix dangling adapter pointer on add failure

Shengzhuo Wei <[email protected]>
i2c: at91: release DMA channels on remove and probe error

Jarkko Sakkinen <[email protected]>
KEYS: trusted: Fix tpm2_load_cmd() boundary check

Maoyi Xie <[email protected]>
keys: translate request_key_auth pid for the reading procfs instance

Shakeel Butt <[email protected]>
mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()

Yifei Gao <[email protected]>
memstick: ms_block: destroy io_queue workqueue on removal

Chengfeng Ye <[email protected]>
xfrm: serialize state GC with device state flush

Alberto Carboneri <[email protected]>
scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()

Mark Amirkan <[email protected]>
net/packet: avoid truncating TPACKET_V3 private size

Mark Amirkan <[email protected]>
net/packet: clear RX owner on VNET header error

Jamal Hadi Salim <[email protected]>
net/sched: hhf: cap hh_flows_limit at change time

Guanglei Zhu <[email protected]>
net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value

Guanglei Zhu <[email protected]>
net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain

Guanglei Zhu <[email protected]>
net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()

Mark Amirkan <[email protected]>
net: lan743x: fix RX checksum use-after-free

Zhiling Zou <[email protected]>
ipv6: xfrm: use full sockets in local error paths

Alexander Chesnokov <[email protected]>
dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

Christian Lugnberg <[email protected]>
dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status

Christian Lugnberg <[email protected]>
dmaengine: sun6i: fix non-atomic read of DMA position registers

Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Serialize local codec list cleanup

Laxman Acharya Padhya <[email protected]>
Bluetooth: hci_codec: validate vendor codec count length

Aamir Ahmed <[email protected]>
Bluetooth: eir: validate service data length before reading UUID

Nicolas Thibert <[email protected]>
Bluetooth: btusb: fix NXP IW610 composite device handling

Mark Rutland <[email protected]>
arm64: percpu: Fix this_cpu_and() mask generation

Mark Rutland <[email protected]>
arm64: percpu: Fix this_cpu_write() casting

Koichiro Den <[email protected]>
arm64: dts: renesas: r8a779f0: Set UFS lane count

Bradley Morgan <[email protected]>
arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc

Thomas Huth <[email protected]>
kselftest/arm64: Fix size of thread_data values for pthread_join()

Benoît Sevens <[email protected]>
HID: logitech-hidpp: fix race condition when accessing stale stack pointer

Wyatt Feng <[email protected]>
net: xfrm: reject unrepresentable espintcp transport headers

Zhiling Zou <[email protected]>
openvswitch: avoid reallocating confirmed conntrack labels

Jeffin Philip <[email protected]>
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

Quanye Yang <[email protected]>
RDMA/ucma: Serialize join and leave on copy_to_user failure

Inbal Schussheim <[email protected]>
tcp: exclude old ACKs from tcp fast path

Aohan Mei <[email protected]>
rds: ib: use rds_conn_drop() on protocol version mismatch

Hyunwoo Kim <[email protected]>
exec: Cleanup POSIX timers right after de_thread()

Wentao Liang <[email protected]>
cifs: Fix server use-after-free in cifs_chan_skip_or_disable()

Niklas Cassel <[email protected]>
ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY

Jiangshan Yi <[email protected]>

    ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type

Yuho Choi <[email protected]>
ALSA: virtio: reset device before deleting virtqueues

Jeremy Nyberg <[email protected]>
Input: xpad - fix PDP Marvel Xbox 360 controller

Roberts Kursitis <[email protected]>
Input: xpad - add support for Azeron devices

Erich Sartison <[email protected]>
Input: xpad - add support for Victrix Pro BFG Controller

Bitterblue Smith <[email protected]>
wifi: rtw88: Fix the random "error beacon valid" messages for USB

Bitterblue Smith <[email protected]>
wifi: rtw88: TX QOS Null data the same way as Null data

Kevin Hao <[email protected]>
net: cpsw: Execute ndo_set_rx_mode callback in a work queue

Kevin Hao <[email protected]>
net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue

Zi Yan <[email protected]>
mm/huge_memory: use folio's memcg inside __folio_split()

Filipe Manana <[email protected]>
btrfs: abort transaction on failure to update inode for hole punching and reflinking

Filipe Manana <[email protected]>
btrfs: remove redundant root argument from btrfs_update_inode()

Filipe Manana <[email protected]>
btrfs: simplify error check condition at btrfs_dirty_inode()

Dmitriy Chumachenko <[email protected]>
drm/amdgpu: check ras and obj before dereference

Dmitriy Okunev <[email protected]>
net: mvpp2: prevent buffer overflow in page_pool allocation

James Clark <[email protected]>
net: macb: fix ordering around PTP timestamp read

Linus Walleij <[email protected]>
net: ethernet: cortina: Ack RX overrun interrupt correctly

Eric Dumazet <[email protected]>
net: lock the socket in sock_gettstamp()

Yige Jiang <[email protected]>
net: netsec: fix device_node reference leak on phy_np

HyeongJun An <[email protected]>
ASoC: hdmi-codec: Report a change when the channel status moves

Sasha Levin <[email protected]>
ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments

Shivaprasad G Bhat <[email protected]>
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba

Amit Machhiwal <[email protected]>
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

Amit Machhiwal <[email protected]>
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()

Eric Dumazet <[email protected]>
drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

Eric Dumazet <[email protected]>
drop_monitor: synchronize tracepoint unregistration on error path

Eric Dumazet <[email protected]>
pppoatm: ensure a writable skb header and linear data

Juan Perdomo <[email protected]>
Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

Tzung-Bi Shih <[email protected]>
Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown

Chris Lu <[email protected]>
Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events

Luiz Augusto von Dentz <[email protected]>
Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()

Baineng Shou <[email protected]>
dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

Namjae Jeon <[email protected]>
ksmbd: keep compound responses on query info errors

Namjae Jeon <[email protected]>
ksmbd: fix partial file information responses

Namjae Jeon <[email protected]>
ksmbd: return buffer overflow for partial filesystem info

Eric Dumazet <[email protected]>
tcp: do not let tcp_rmem be set below 4096

Kuniyuki Iwashima <[email protected]>
tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().

Nikolay Aleksandrov <[email protected]>
net: bridge: mst: move switchdev call outside rcu

Karl Mehltretter <[email protected]>
wifi: brcmfmac: fix lost 802.1x TX completion wakeup

Hohyun Sim <[email protected]>
net: fddi: skfp: fix NULL deref when setting the MAC address while down

Dong Chenchen <[email protected]>
ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

Andrea Mayer <[email protected]>
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation

Dmitry Baryshkov <[email protected]>
drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL

Filipe Manana <[email protected]>
btrfs: tree-checker: print dev extent offset in error message

Slavin Liu <[email protected]>
ALSA: hda: trace PCM open only after assigning a stream

Karl Mehltretter <[email protected]>
drm/vc4: Use managed KMS polling to fix UAF on unbind

Thomas Zimmermann <[email protected]>
drm/ast: Automatically clean up poll helper

Zihan Xi <[email protected]>
wifi: virt_wifi: don't transfer operstate before register

Xiang Mei <[email protected]>
ALSA: 6fire: fix OOB write from device-reported iso length

Takashi Iwai <[email protected]>
ALSA: usb: 6fire: Avoid embedded URBs

Takashi Iwai <[email protected]>
ALSA: 6fire: Clean ups with guard()

Karl Mehltretter <[email protected]>
Input: trackpoint - fix the inertia attribute name in the ABI document

Nguyen Ngoc Thang <[email protected]>

    ALSA: pcm: set timer->private_data before registering the PCM timer

AngeloGioacchino Del Regno <[email protected]>
phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting

AngeloGioacchino Del Regno <[email protected]>
phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow

Takashi Iwai <[email protected]>
ALSA: bcd2000: Fix race between rawmidi and disconnect

Karl Mehltretter <[email protected]>
keys: fix lost wakeup when reaping a dead key type

Thadeu Lima de Souza Cascardo <[email protected]>
drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr

Shouping Wang <[email protected]>
perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations

Pablo Neira Ayuso <[email protected]>
netfilter: flowtable: hold reference on ct until flow is released

Theodor Arsenij Larionov Trichkine <[email protected]>
netfilter: nft_nat: fully initialise new_addr in netmap setup

Jérémy Jean <[email protected]>
RDMA/siw: Bound fragmented header copies by the remaining length

Leon Romanovsky <[email protected]>
RDMA/efa: Keep EQ resources alive while IRQ is registered

Leon Romanovsky <[email protected]>
RDMA/efa: Keep admin queues alive while IRQ is registered

Alex Bereza <[email protected]>
dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA

Alex Bereza <[email protected]>
dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order

Karl Mehltretter <[email protected]>
scsi: qla2xxx: Fix the ql2xfc2target parameter description

Meijing Zhao <[email protected]>
mm: memblock: show all region flags in debugfs

Johannes Berg <[email protected]>
wifi: mac80211: set up the TX info early to fix failure paths

Johannes Berg <[email protected]>
wifi: mac80211: rework ack_frame_id handling a bit

Johannes Berg <[email protected]>
wifi: mac80211: mesh: release the channel if start fails

Johannes Berg <[email protected]>
wifi: mac80211: add HE 6 GHz capability in the scan elems len

Johannes Berg <[email protected]>
wifi: mac80211: don't access the TSF of a down interface

Johannes Berg <[email protected]>
wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set

Johannes Berg <[email protected]>
wifi: mac80211: don't allow link changes when iface is down

Johannes Berg <[email protected]>
wifi: mac80211: require a peer station for TDLS setup confirm

Johannes Berg <[email protected]>
wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown

Johannes Berg <[email protected]>
wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping

Johannes Berg <[email protected]>
wifi: mac80211: unlist vifs when their netdev is unregistered

Johannes Berg <[email protected]>
wifi: mac80211: suppress chanctx warning for debugfs reset

Johannes Berg <[email protected]>
wifi: mac80211: don't offload TC setup on AP_VLAN interfaces

Johannes Berg <[email protected]>
wifi: cfg80211: don't filter by BSS type when removing stale entries

Johannes Berg <[email protected]>
wifi: cfg80211: only group hidden BSSes with beacon entries

Shivank Garg <[email protected]>
dmaengine: wait for RCU readers before releasing dma_device

Shivank Garg <[email protected]>
dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()

Shivank Garg <[email protected]>
dmaengine: Fix device kref underflow in dma_chan_put()

Donggeun Yoo <[email protected]>
dma-coherent: report a failed reserved memory assignment

Chen-Yu Tsai <[email protected]>
dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask

Orgad Shaneh <[email protected]>
MIPS: Octeon: apply USB FDT fixups also when USB is modular

Bard Liao <[email protected]>

    soundwire: cadence_master: wait and cancel cdns->work before clock stop

Johannes Berg <[email protected]>

    wifi: cfg80211: check IP header size in cfg80211_classify8021d()

Carolina Jubran <[email protected]>
IB/IPoIB: Avoid restoring OPER_UP after multicast flush

Shmulik Cohen <[email protected]>
wifi: libipw: reject too-short association responses

Shmulik Cohen <[email protected]>
wifi: libipw: reject too-short beacon and probe responses

Peng Hao <[email protected]>
wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path

Mariano Baragiola <[email protected]>
wifi: virt_wifi: free skb when disconnected

Ruoyu Wang <[email protected]>
dmaengine: sprd: Fix runtime PM reference leak in probe

Quanye Yang <[email protected]>
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted

Jacob Moroni <[email protected]>
RDMA/irdma: Enforce local fence for IB_WR_REG_MR

Li RongQing <[email protected]>
RDMA/mad: Fix receive buffer leak when PKey enforcement fails

Yehyeong Lee <[email protected]>
IB/isert: wait for deferred control PDU completions before releasing the connection

Yehyeong Lee <[email protected]>
IB/iser: reject a remote invalidation of an unregistered direction

Krystian Kaniewski <[email protected]>
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed

Eric Dumazet <[email protected]>

    net: convert dev->reg_state to u8

Michael Bommarito <[email protected]>
RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds

Xixin Liu <[email protected]>
clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate

Xixin Liu <[email protected]>
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS

Gang Yan <[email protected]>
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

Norbert Szetei <[email protected]>
RDMA/rxe: validate access flags before swapping the MR's PD

Guoqing Jiang <[email protected]>
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept

Guoqing Jiang <[email protected]>
RDMA/siw: Cleanup siw_accept

Guoqing Jiang <[email protected]>
RDMA/siw: Introduce siw_cep_set_free_and_put

Pengpeng Hou <[email protected]>
ARM: socfpga: select the PL310 erratum 753970 workaround

Maher Azzouzi <[email protected]>
esp: downgrade zerocopy managed frags before mutating skb frags

Eric Dumazet <[email protected]>
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

Kyle Zeng <[email protected]>
xfrm: fix compat ALLOCSPI request use-after-free

Sabrina Dubroca <[email protected]>
xfrm: avoid RCU warnings around the per-netns netlink socket

Ido Schimmel <[email protected]>
ipv6: Honor oif when choosing nexthop for locally generated traffic

Ido Schimmel <[email protected]>
ipv6: Select best matching nexthop object in fib6_table_lookup()

Arash Golgol <[email protected]>
media: video-i2c: fix buffer queue ordering

Jens Axboe <[email protected]>
sunvdc: fix -EIO issue due to lack of retries

Günther Noack <[email protected]>
selftests/landlock: Add tests for whiteout object creation

Sasha Levin <[email protected]>
Revert "alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally"

Sasha Levin <[email protected]>
Revert "alpha: don't leak hardware-fabricated FP exception bits to user space"

Mickaël Salaün <[email protected]>
selftests/landlock: Add disconnected leafs and branch test suites

Tingmao Wang <[email protected]>
selftests/landlock: Add tests for access through disconnected paths

Sasha Levin <[email protected]>
Revert "hwmon: (emc1403) Rely on subsystem locking"

Sasha Levin <[email protected]>
Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature"

Paolo Abeni <[email protected]>
mptcp: close race between scheduler and state change

Paolo Abeni <[email protected]>
mptcp: avoid unneeded actions on subflow reset

Paolo Abeni <[email protected]>
mptcp: fix bad accounting in __mptcp_subflow_push_pending()

Kiran K <[email protected]>
Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config

Mallesh Koujalagi <[email protected]>
workqueue: Update documentation as per system_percpu_wq naming

Eric Biggers <[email protected]>
netfilter: nft_set_pipapo_avx2: add missing vzeroupper

Eric Biggers <[email protected]>
crypto: sun8i-ce - Remove crypto_rng interface

Eric Biggers <[email protected]>
crypto: sun8i-ss - Remove crypto_rng interface

Xuanqiang Luo <[email protected]>
fou: Fix use-after-free in fou_create()

Weiming Shi <[email protected]>
net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

Weiming Shi <[email protected]>
i2c: smbus: reject oversized block transfers in the common path

Kazuki Hanai <[email protected]>
ALSA: us122l: Prevent write upgrades for read mappings

Gary Guo <[email protected]>
net: usb: pegasus: don't rely on id table pointer arithmetic

Gary Guo <[email protected]>
media: as102: do not rely on id table address comparison

Gary Guo <[email protected]>
usb: serial: spcp8x5: don't store usb_device_id

Gary Guo <[email protected]>
usb: usbtmc: don't store usb_device_id

Gary Guo <[email protected]>
wifi: ath9k_htc: don't store usb_device_id

Gary Guo <[email protected]>
usb: xusbatm: don't rely on id table pointer arithmetic

Ian Rogers <[email protected]>
perf evsel: Add per-thread warning for EOPNOTSUPP open failues

Sasha Levin <[email protected]>
Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems"

Sasha Levin <[email protected]>
Revert "selftests/mm: report unique test names for each cow test"

Sasha Levin <[email protected]>
Revert "selftests/mm: skip COW tmpfile cases when fallocate() is unsupported"

Sasha Levin <[email protected]>
Revert "nvme: apple: Add Apple A11 support"

Sasha Levin <[email protected]>
Revert "nvme-apple: Drop the PRP null check chicken bit"

Sasha Levin <[email protected]>
Revert "nvme-apple: Prevent shared tags across queues on Apple A11"

Sasha Levin <[email protected]>

    Revert "nvme-apple: Reset q->sq_tail during queue init"

Sasha Levin <[email protected]>

    Revert "arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries"

Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries"

Darrick J. Wong <[email protected]>
xfs: bail out on bitmap errors in xrep_agfl_fill

Darrick J. Wong <[email protected]>
xfs: count escaped corruption errors in scrub stats

Darrick J. Wong <[email protected]>
xfs: signal inode btree xref error if get_rec returns an error

Darrick J. Wong <[email protected]>
xfs: snapshot old AGFL before rewriting it

Darrick J. Wong <[email protected]>
xfs: snapshot scrub stats when rendering them

Bjoern Doebel <[email protected]>
smb: client: fix heap overflow in DACL owner/group rewrite

Bjoern Doebel <[email protected]>
smb: client: avoid leaking refcount when cifs_sb_tlink() fails

Bjoern Doebel <[email protected]>
smb: client: avoid leaking refcount in cifs_queue_oplock_break()

Paulo Alcantara <[email protected]>
smb: client: fix file type corruption in wsl_to_fattr()

Paulo Alcantara <[email protected]>
smb: client: fix file type corruption in cifs_reparse_point_to_fattr()

Paulo Alcantara <[email protected]>
smb: client: fix one-byte OOB read in smb2_parse_native_symlink()

Karl Mehltretter <[email protected]>
smb: client: pin DFS superblock in iterator callback

Aohan Mei <[email protected]>
smb: client: reject userspace cifs.idmap descriptions

Gang Yan <[email protected]>
selftests: mptcp: fix an UAF in mptcp_connect.c

Matthieu Baerts (NGI0) <[email protected]>
mptcp: syncookies: remember the request backup flag

Matthieu Baerts (NGI0) <[email protected]>
mptcp: subflow: no need to copy thmac during ulp_clone

Matthieu Baerts (NGI0) <[email protected]>
mptcp: options: handle MPC data + csum reqd + no csum

Joe Damato <[email protected]>
bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

Joe Damato <[email protected]>
bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()

Joe Damato <[email protected]>
bnxt_en: Only restore LRO if the device supports TPA

Michael Bommarito <[email protected]>
media: v4l2-ctrls: validate AV1 tile counts

Michael Bommarito <[email protected]>
media: v4l2-ctrls: validate HEVC tile counts

Michael Bommarito <[email protected]>
media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

Michael Bommarito <[email protected]>
media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer

Haotian Zhang <[email protected]>
media: v4l2-h264: Fix memcmp() size in B1 reference list comparison

Michael Bommarito <[email protected]>
media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity

Michael Bommarito <[email protected]>
media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity

Michael Bommarito <[email protected]>
media: hevc: add bounded tile-count helpers

Vishnu Razdan <[email protected]>
hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS

Fan Wu <[email protected]>
hwmon: (gpio-fan) Fix use-after-free in alarm work

Cong Nguyen <[email protected]>
hwmon: (applesmc) fix key backlight workqueue leak on register failure

Harald Freudenberger <[email protected]>
s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm

Nagamani PV <[email protected]>
s390/qeth: allow bridgeport queries despite OS_MISMATCH

leixiang <[email protected]>

    KVM: PPC: Book3S HV: Set irqfd->producer only on success

Ibrahim Hashimov <[email protected]>
mac802154: fix use-after-free of sdata via queued RX frames

Kyle Zeng <[email protected]>
ipvs: reject invalid states in connection template sync records

Zihan Xi <[email protected]>
ipv4: fib: bound automatic table ID allocation

David Carlier <[email protected]>
ieee802154: hwsim: serialize pib updates to fix double-free

Zhiling Zou <[email protected]>
ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink

Yilin Zhang <[email protected]>
inet: frags: invalidate queues before flushing them

Weiming Shi <[email protected]>
fbdev: vfb: defer cleanup until the last reference

Nathan Chancellor <[email protected]>
scripts/sorttable: Mark long_size as __maybe_unused

Xiong Weimin <[email protected]>
vdpa: solidrun: Free IRQs after request failure

Xiong Weimin <[email protected]>
vdpa: ifcvf: Put device on unsupported feature error

Ilya Maximets <[email protected]>
netfilter: report NLM_F_DUMP_FILTERED when all is filtered out

Chengfeng Ye <[email protected]>
netfilter: nf_log: unregister loggers before per-net teardown

Norbert Szetei <[email protected]>
net: openvswitch: fix use-after-free of the flow table mask array

Fourie Zhang <[email protected]>
net: mpls: clear inner_protocol when the last label is popped

Sahil Chandna <[email protected]>
net: mana: Reserve extra CQ slot for the fence completion CQE

Johan Hovold <[email protected]>
net: hso: fix TIOCMIWAIT race

Sebastian Andrzej Siewior <[email protected]>
ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()

Thorsten Blum <[email protected]>
drm/i915: Fix memory leak in query_perf_config_list()

Sunil Khatri <[email protected]>
drm/drm_exec: fix up contended obj when num_objects is 0

Jann Horn <[email protected]>
exec: do_close_on_exec() before taking exec_update_lock

Runyu Xiao <[email protected]>
cpufreq: initialize policy rwsem before sysfs publication

Zhongqiu Han <[email protected]>
cpufreq: zero-initialize policy cpumask before sysfs publication

Rong Zhang <[email protected]>
Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

Runyu Xiao <[email protected]>
ASoC: sti: initialize IRQ lock before requesting IRQ

Tianchu Chen <[email protected]>
ASoC: sprd: validate compress buffer sizes against fixed allocations

Donggeun Yoo <[email protected]>
tracing: Keep the entry count when the histogram stats allocation fails

Donggeun Yoo <[email protected]>
tracing: Let histogram values keep the percent and graph modifiers

Donggeun Yoo <[email protected]>
tracing: Free histogram the field rejected for a bad modifier

Donggeun Yoo <[email protected]>
tracing: Free histogram var refs regardless of how often they are referenced

Donggeun Yoo <[email protected]>
tracing: Free histogram the var ref when its initialization fails

Henry Martin <[email protected]>
tracing/user_events: Don't destroy fields when event removal fails

Thomas Gleixner <[email protected]>
tick/broadcast: Plug clockevents replacement race

Ido Schimmel <[email protected]>
tunnels: Drop stale dst when building an ICMP error for PMTUD

Ali Ahmet Memis <[email protected]>
ufs: validate cylinder group metadata before caching it

Ali Ahmet Memis <[email protected]>
ufs: create the root dentry after loading cylinder metadata

James Hilliard <[email protected]>
watchdog: sunxi_wdt: preserve boot-enabled watchdog

Harry Wentland <[email protected]>
dm/amdgpu: fix malformed link_settings debugfs output

Tristan Madani <[email protected]>
ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf

Roman Prucha <[email protected]>
ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough

Donggeun Yoo <[email protected]>
tracing: Fix memory corruption from the histogram stacktrace modifier

Zihan Xi <[email protected]>
ipv6: fix fib6 walker UAF on seq stop

Vernon Yang <[email protected]>
x86/mm: Fix user-space data loss with MADV_FREE and THP

Eric Biggers <[email protected]>
crypto: x86/aria - add missing vzeroupper in AVX-512 code

Eric Biggers <[email protected]>
crypto: x86/aria - add missing vzeroupper in AVX2 code

Shivaprasad G Bhat <[email protected]>
powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver

Thorsten Blum <[email protected]>
powerpc/ps3: Fix repository.c build failure

Namjae Jeon <[email protected]>
ksmbd: prevent out-of-bounds reads in share config responses

Maurizio Lombardi <[email protected]>
scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands

Stian Halseth <[email protected]>
sunvdc: unmap LDC cookies when the descriptor send fails

Eelco Chaudron <[email protected]>
openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()

Greg Marsden <[email protected]>
net/rds: fix tcp stream corruption with large pages

Ratheesh Kannoth <[email protected]>
octeontx2-af: fix PF/CGX debugfs PCI bus lookup

Aamir Ahmed <[email protected]>
net: hinic: fix mailbox segment buffer overflow

Li Youhong <[email protected]>
net: sun4i-emac: fix missing of_node_put() for phy_node

Kuniyuki Iwashima <[email protected]>
net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().

Victor Nogueira <[email protected]>
net/sched: cls_route: Fix in-place replace

Pedro Tammela <[email protected]>
net/sched: cls_route: make netlink errors meaningful

Victor Nogueira <[email protected]>
net/sched: cls_route: Reject handle aliasing

Victor Nogueira <[email protected]>
net/sched: cls_route: free emptied bucket on filter move

Dapeng Mi <[email protected]>

    perf/x86/intel: Correct pt_regs->flags update for PEBS path

Dapeng Mi <[email protected]>
perf/x86/intel/ds: Factor out PEBS group processing code to functions

Changbin Du <[email protected]>
perf/x86/intel/ds: Remove redundant assignments to sample.period

Kan Liang <[email protected]>
perf/x86/intel/ds: Clarify adaptive PEBS processing

Yabin Cui <[email protected]>
perf/core: Check sample_type in perf_sample_save_callchain

Thibault Ferrante <[email protected]>
selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

Lorenzo Bianconi <[email protected]>
net: stmmac: initialize ptp_lock at probe time

Qingfang Deng <[email protected]>
ppp_synctty: ensure a writeable skb header

Eric Dumazet <[email protected]>
vxlan: initialize _md in vxlan_xmit_one()

Guillaume Nault <[email protected]>
vxlan: Pull inner IP header in vxlan_xmit_one().

Beniamino Galvani <[email protected]>
vxlan: use generic function for tunnel IPv6 route lookup

Beniamino Galvani <[email protected]>
ipv6: add new arguments to udp_tunnel6_dst_lookup()

Beniamino Galvani <[email protected]>
ipv6: remove "proto" argument from udp_tunnel6_dst_lookup()

Beniamino Galvani <[email protected]>
vxlan: use generic function for tunnel IPv4 route lookup

Ratheesh Kannoth <[email protected]>
octeontx2-pf: reset HTB scheduler topology before freeing queues

Pengpeng Hou <[email protected]>
hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors

Cong Nguyen <[email protected]>

    hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()

Marek Vasut <[email protected]>
net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down

Yicong Hui <[email protected]>
net/micrel: Fix typos in micrel driver code comments

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Sync timeout value if WDT was running at boot

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Fix undefined behavior

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Fix spurious reset on suspend

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Enable clock before accessing hardware registers

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Fix clock leak and spurious timer in settimeout()

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Avoid division by zero

David Arcari <[email protected]>
watchdog: fix hrtimer start when pretimeout is zero

Nicolai Buchwitz <[email protected]>
net: macb: destroy the phylink instance on the probe error path

Luiz Augusto von Dentz <[email protected]>
Bluetooth: btusb: Fix UAF of btusb_data by rx_work

Jacob Keller <[email protected]>
ice: add missing xa_destroy for sched_node_ids

HyeongJun An <[email protected]>
ALSA: hda: Report a change when only the channel status bytes move

Takashi Iwai <[email protected]>
ALSA: hda/common: Use guard() for mutex locks

Takashi Iwai <[email protected]>
ALSA: hda/common: Use cleanup macros for PM controls

Takashi Iwai <[email protected]>
ALSA: hda: Introduce auto cleanup macros for PM

Karl Mehltretter <[email protected]>
drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER

Linus Walleij <[email protected]>
net: ethernet: cortina: Count RX descriptors for freeq refill

Linus Walleij <[email protected]>
net: ethernet: cortina: Count RX drops once per frame

Linus Walleij <[email protected]>
net: ethernet: cortina: No mapping is a dropped rx

Linus Walleij <[email protected]>
net: ethernet: cortina: Count dropped frames as NAPI work

Linus Walleij <[email protected]>
net: ethernet: cortina: Finish RX updates before NAPI completion

Linus Walleij <[email protected]>
net: ethernet: cortina: Fix budget accounting

Alice Mikityanska <[email protected]>
net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward

Alice Mikityanska <[email protected]>
net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

Eric Dumazet <[email protected]>
ipv6: lockless IPV6_MTU implementation

Eric Dumazet <[email protected]>
ipv6: lockless IPV6_MULTICAST_HOPS implementation

Eric Dumazet <[email protected]>
ipv6: lockless IPV6_MULTICAST_LOOP implementation

Eric Dumazet <[email protected]>
ipv6: lockless IPV6_UNICAST_HOPS implementation

Karl Mehltretter <[email protected]>
virtio_input: stop callbacks before unregistering input device

Xiong Weimin <[email protected]>
virtio_input: reset device if input_register_device() fails

Andrew Stellman <[email protected]>
virtio-pci: return IRQ_HANDLED after non-zero ISR

Linfeng Sun <[email protected]>
vdpa_sim_net: check TX pull result before RX copy

Linfeng Sun <[email protected]>
vdpa_sim_blk: reject out-of-range sector starts

Yu Zhang <[email protected]>
vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx

Jia Jia <[email protected]>
vhost/vdpa: reject VRING_NUM larger than device max

Si-Wei Liu <[email protected]>
vhost-vdpa: clean iotlb map during reset for older userspace

Si-Wei Liu <[email protected]>
vdpa: introduce .compat_reset operation callback

Si-Wei Liu <[email protected]>
vhost-vdpa: introduce IOTLB_PERSIST backend feature bit

Si-Wei Liu <[email protected]>
vdpa: introduce .reset_map operation callback

Si-Wei Liu <[email protected]>
vhost-vdpa: introduce descriptor group backend feature

Si-Wei Liu <[email protected]>
vdpa: introduce dedicated descriptor group for virtqueue

Jia Jia <[email protected]>
virtio_console: do not free control-out buffers on remove

hpp.iscas <[email protected]>
ASoC: mt6351: Publish the OF module alias

Florian Westphal <[email protected]>
netfilter: ip6_tables: set F_PROTO when proto value is nonzero

Florian Westphal <[email protected]>
netfilter: nfnetlink_log: cope with concurrent instance destruction

hpp.iscas <[email protected]>
ASoC: Intel: SST: Publish the PCI module aliases

hpp.iscas <[email protected]>
ASoC: bcm: bcm63xx: Publish the OF module aliases

Edward Adam Davis <[email protected]>
ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Reject non-scalar bpf_loop iteration counts

Vineeth Karumanchi <[email protected]>
net: macb: fix NULL pointer dereference on unbind with fixed-link

Théo Lebrun <[email protected]>

    net: macb: rename bp->sgmii_phy field to bp->phy

Allen Pais <[email protected]>
workqueue: Introduce from_work() helper for cleaner callback declarations

Jamal Hadi Salim <[email protected]>
net/sched: ets: clamp quantum in parse and fallback paths

Jamal Hadi Salim <[email protected]>
net/sched: drr: clamp quantum in change class

Jamal Hadi Salim <[email protected]>
net/sched: pie: clamp psched_mtu in pie_drop_early

Jamal Hadi Salim <[email protected]>
net/sched: hhf: clamp quantum in change and init paths

Jamal Hadi Salim <[email protected]>
net/sched: sfq: clamp quantum in change path

Jamal Hadi Salim <[email protected]>
net/sched: fq_pie: clamp quantum in change path

Eric Dumazet <[email protected]>
net_sched: sch_fq_pie: implement lockless fq_pie_dump()

Lama Kayal <[email protected]>
net/mlx5: E-Switch, prevent mc_list repopulation during vport disable

Yael Chemla <[email protected]>
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put

Carolina Jubran <[email protected]>
net/mlx5e: Fix use-after-free race in sample_restore_put()

Carolina Jubran <[email protected]>
net/mlx5e: Fix ETS zero BW reporting when one TC holds 100%

Shahar Shitrit <[email protected]>
net/mlx5e: Fix setting RS FEC after remapping

Weiming Shi <[email protected]>
net/sched: defer qdisc freeing after failed creation

Thorsten Blum <[email protected]>
powerpc/kexec_file: Use inclusive range checks in add_usable_mem()

Nikhil P. Rao <[email protected]>
pds_core: fix cmd_regs access racing BAR unmap on reset

Jamal Hadi Salim <[email protected]>
net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations

Seungwon Bae <[email protected]>
vxlan: reject dynamic fdb entries that reference a nexthop id

Alexandra Winter <[email protected]>
s390/ism: folio_put() after error

Jason Winter <[email protected]>

    net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow

Viswajith Murali <[email protected]>
octeontx2-af: mcs: Clear stale X2P calibration state before calibration

Nikolay Aleksandrov <[email protected]>
net: bridge: mcast: properly convert mglist to rcu

Jakub Kicinski <[email protected]>
net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size

Jakub Kicinski <[email protected]>
net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size

Eric Dumazet <[email protected]>
bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()

Ido Schimmel <[email protected]>
nexthop: Initialize extack in remove_nh_grp_entry()

Jiayuan Chen <[email protected]>
selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0

Brad Cowie <[email protected]>
selftests/bpf: Update tests for new ct zone opts for nf_conntrack kfuncs

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Mark bpf_btf_find_by_name_kind() as sleepable

Justin Chen <[email protected]>
net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times

Justin Chen <[email protected]>

    net: bcmasp: clear txcb->last before writing each descriptor

Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Clean up the bus when fetching ML caps fails

Mohamed Khalfella <[email protected]>
nvme: remove stale namespaces by NSID range during scan

Stuart Hayes <[email protected]>
nvme_core: scan namespaces asynchronously

Jiayuan Chen <[email protected]>
bpf: Fix NULL-ptr-deref in btf_var_show()

Jiayuan Chen <[email protected]>
bpf: Fix NULL-ptr-deref when showing a void BTF type

Takashi Iwai <[email protected]>
ALSA: caiaq: Fix potential double-free at error path

HyeongJun An <[email protected]>
selftests/alsa: Fix the step check for INTEGER controls

Lorenzo Bianconi <[email protected]>
net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset

Allison Henderson <[email protected]>
net/rds: don't let rds_conn_shutdown() consume a concurrent drop

Håkon Bugge <[email protected]>
net/rds: acquire the fastpath locks in rds_conn_shutdown()

Allison Henderson <[email protected]>
net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

Gerd Rausch <[email protected]>
net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown

Allison Henderson <[email protected]>
net/rds: clear cp_flags bits individually in rds_conn_path_reset()

Allison Henderson <[email protected]>
net/rds: use clear_bit_unlock() in release_refill()

Allison Henderson <[email protected]>
net/rds: use wq_has_sleeper() in release_in_xmit()

Eric Dumazet <[email protected]>
bonding: do not clear curr_active_slave prematurely when releasing all slaves

Eduard Zingerman <[email protected]>
bpf: reject BPF_PSEUDO_FUNC reference to the main program

Henry Martin <[email protected]>
tracing/probes: Fix use-after-free on field name/type of events with multiple probes

Joas Antonio dos Santos <[email protected]>
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

Kyle Zeng <[email protected]>
ipvs: fix reversed sequence option serialization

Qu Wenruo <[email protected]>
btrfs: do not force reloc root creation during qgroup_account_snapshot()

Avi Weiss <[email protected]>
btrfs: send: fix lost error return value in will_overwrite_ref()

Qu Wenruo <[email protected]>
btrfs: fix the possible bioc_list memory leak during error

Dan Carpenter <[email protected]>
btrfs: directly return 0 on no error code in btrfs_insert_raid_extent()

Shuangpeng Bai <[email protected]>
btrfs: fix transaction use-after-free in raid stripe insertion

Linus Walleij <[email protected]>
ASoC: ux500: Program the MSP FIFO watermarks

Linus Walleij <[email protected]>
ASoC: ux500: Request the MSP MMIO resource

Linus Walleij <[email protected]>

    mfd: db8500-prcmu: Fold dbx500 header into db8500

Kees Cook <[email protected]>
arm: Handle KCOV __init vs inline mismatches

Zijun Hu <[email protected]>
mfd: db8500-prcmu: Remove needless return in three void APIs

Linus Walleij <[email protected]>
ASoC: ux500: Validate MSP DAI configuration

Linus Walleij <[email protected]>
ASoC: ux500: Correct MSP frame and bit clock setup

Linus Walleij <[email protected]>
ASoC: ux500: Propagate MSP setup errors

Linus Walleij <[email protected]>
ASoC: ux500: Fix MSP stream lifecycle handling

Qingyu Zhang <[email protected]>
ALSA: ump: do not touch legacy_rmidi before it exists

Takashi Iwai <[email protected]>
ALSA: ump: Update rawmidi name per EP name update

Takashi Iwai <[email protected]>
ALSA: ump: Copy safe string name to rawmidi

Takashi Iwai <[email protected]>
ALSA: ump: Copy FB name string more safely

Takashi Iwai <[email protected]>
ALSA: rawmidi: Show substream activity in info ioctl

Takashi Iwai <[email protected]>
ALSA: rawmidi: Expose the tied device number in info ioctl

Eric Dumazet <[email protected]>
locking/lockdep: Invalidate stale class_cache entries for zapped classes

Leo Yan <[email protected]>
perf/core: Skip empty AUX records with only format flags

Ivy Lopez <[email protected]>
scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

Eric Dumazet <[email protected]>
bonding: alb: fix uninitialized transport header access in alb_determine_nd()

Guanghui Yang <[email protected]>
btrfs: restore active device pointers after failed sprout

Guanghui Yang <[email protected]>
btrfs: detach failed sprout device from transaction update list

wangdicheng <[email protected]>
ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()

wangdicheng <[email protected]>
ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits

Vasily Gorbik <[email protected]>
s390/boot: Fix physical memory search range

Xu Rao <[email protected]>
ALSA: hda: restore MFG widget enumeration after core split

Takashi Iwai <[email protected]>
ALSA: hda/core: Use guard() for mutex locks

Hui Su <[email protected]>
staging: fbtft: make dirty_lock IRQ-safe

Kuniyuki Iwashima <[email protected]>
af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().

Eric Dumazet <[email protected]>
ipv6: sr: restore network header before routing and forwarding

Tung Nguyen <[email protected]>
tipc: fix NULL deref in tipc_named_node_up() on empty publication list

Eric Dumazet <[email protected]>
ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit

Qingfang Deng <[email protected]>
ppp: ppp_async: simplify tty disc_data access

Jamal Hadi Salim <[email protected]>
net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted

Linus Walleij <[email protected]>
ASoC: ab8500: Validate and program TDM slots correctly

Linus Walleij <[email protected]>
ASoC: ab8500: Correct digital interface format setup

Linus Walleij <[email protected]>
ASoC: ab8500: Repair the DAPM capture graph

Linus Walleij <[email protected]>
ASoC: ab8500: Reset the audio block before configuring it

Gongwei Li <[email protected]>
Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()

Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM

Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

Aleksandr Nogikh <[email protected]>
Bluetooth: hci_core: Fix race condition during device registration

Laxman Acharya Padhya <[email protected]>
Bluetooth: btintel: validate version TLV value lengths

Kiran K <[email protected]>
Bluetooth: btintel: Export few static functions

Kiran K <[email protected]>
Bluetooth: btintel: Print firmware SHA1

Jiacheng Xu <[email protected]>
workqueue: reject watchdog thresholds that overflow jiffies

Marco Crivellari <[email protected]>
workqueue: replace use of system_wq with system_percpu_wq

Vasily Gorbik <[email protected]>
s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block

Vasily Gorbik <[email protected]>
s390/ipl: Fix NULL deref in kdump without re-IPL parm block

Alexander Gordeev <[email protected]>
s390/os_info: Introduce value entries

Heiko Carstens <[email protected]>
s390/checksum: provide and use cksm() inline assembly

Heiko Carstens <[email protected]>
s390/checksum: call instrument_read() instead of kasan_check_read()

Namjae Jeon <[email protected]>
ksmbd: rate limit unmapped SID errors

Yilin Zhang <[email protected]>
ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

Colin Ian King <[email protected]>
OPP: of: Fix potential multiplication overflow when calculating freq

Tzung-Bi Shih <[email protected]>
watchdog: msc313e: Fix NULL pointer dereference in PM callbacks

Baul Lee <[email protected]>
vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()

James Nugraha <[email protected]>
net: amd-xgbe: discard rx packets with bad FCS

Xuanqiang Luo <[email protected]>

    raw: annotate disconnect-side IPv4 match writers

Henry Martin <[email protected]>
sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration

Andy Shevchenko <[email protected]>
smb: client: transport: Fix debug printing in __release_mid()

Huiwen He <[email protected]>
smb/client: mark file sparse before emulating insert range

Milan P. Gandhi <[email protected]>
scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()

Milan P. Gandhi <[email protected]>
scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()

Xin Long <[email protected]>
sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START

Victor Nogueira <[email protected]>
net/sched: act_api: fix skb sizing and action leak on reoffload delete

Pedro Tammela <[email protected]>
net/sched: act_api: conditional notification of events

Pedro Tammela <[email protected]>
net/sched: act_api: don't open code max()

Pedro Tammela <[email protected]>
rtnl: add helper to send if skb is not null

Victor Nogueira <[email protected]>
net/sched: act_api: size the RTM_GETACTION reply from the actions

Victor Nogueira <[email protected]>
net/sched: act_api: budget all shared attributes in notify skbs

Eric Dumazet <[email protected]>
net: icmp: avoid invalid transport header access in icmp_send tracepoint

Slawomir Stepien <[email protected]>
drm/cirrus-qemu: Validate BAR0 size during probe

Thomas Zimmermann <[email protected]>
drm/cirrus: Use video aperture helpers

Ali Ahmet Memis <[email protected]>
ufs: do not treat unreadable directory blocks as empty

Matthew Wilcox (Oracle) <[email protected]>
ufs: Convert ufs_get_page() to ufs_get_folio()

Matthew Wilcox (Oracle) <[email protected]>
ufs: Convert ufs_get_page() to use a folio

Jeff Layton <[email protected]>
ufs: convert to new timestamp accessors

Hongfu Li <[email protected]>
selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter

Xixin Liu <[email protected]>
nvme-rdma: fix -EIO cleanup order in queue_rq

Youssef Samir <[email protected]>
accel/qaic: Address potential out-of-bounds read in resp_worker()

Dan Carpenter <[email protected]>
drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

Jad Keskes <[email protected]>
EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation

Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix channel address decode for non-hash mode

Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix channel selection hash

Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix interleave boundary condition

Russell King (Oracle) <[email protected]>
ARM: ensure interrupts are enabled in __do_user_fault()

Xie Yuanbin <[email protected]>
ARM: 9484/1: enable interrupts when unhandled user faults are triggered

Sasha Levin <[email protected]>
Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU"

Sasha Levin <[email protected]>
Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU"

SJ Park <[email protected]>
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop

Saravana Kannan <[email protected]>
of: dynamic: Fix overlayed devices not probing because of fw_devlink

Kuniyuki Iwashima <[email protected]>
af_unix: Unlink scc_entry in unix_del_edge().

Namjae Jeon <[email protected]>
ksmbd: use memcmp() to compare ClientGUIDs

HyeongJun An <[email protected]>
ASoC: meson: aiu: Validate written enum values

Cássio Gabriel <[email protected]>
ASoC: topology: Check PCM and DAI name strings before use

Kuniyuki Iwashima <[email protected]>
ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().

Jiri Olsa <[email protected]>
bpf: Guard __get_user acesss with access_ok for uprobe_multi data

Selvin Xavier <[email protected]>
RDMA/bnxt_re: Proper rollback if the ioremap fails

Jie Gan <[email protected]>
coresight: platform: defer connection counter increment until alloc succeeds

Xin Long <[email protected]>
sctp: fix err_chunk memory leaks in INIT handling

Nuoqi Gui <[email protected]>
bpf: Mask pseudo pointer values in verifier logs

Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix malformed ISO_END/CONT handling

Cen Zhang (Microsoft) <[email protected]>
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

Yehyeong Lee <[email protected]>
net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD

Eric Dumazet <[email protected]>
drop_monitor: fix size calculations for 64-bit attributes

Eric Dumazet <[email protected]>
drop_monitor: perform u64_stats updates under IRQ-disabled section

Vlatko Kosturjak <[email protected]>
ppp_async: drop the errored frame instead of resetting its headroom

Laxman Acharya Padhya <[email protected]>
wifi: mt76: mt7921: skip unknown CLC firmware records

Laxman Acharya Padhya <[email protected]>
wifi: mt76: mt7921: validate CLC firmware records

Christophe JAILLET <[email protected]>
tracing/histograms: Simplify last_cmd_set()

Gil Portnoy <[email protected]>
ksmbd: remove stale channels from all sessions on teardown

Genevieve Chan <[email protected]>
firmware: stratix10-svc: fix FCS SMC call kernel-doc

Florian Westphal <[email protected]>
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state

Lin Xianglin <[email protected]>
ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx

Zizhi Wo <[email protected]>
scsi: core: Do not block on tag allocation in scsi_eh_lock_door()

Rudi Heitbaum <[email protected]>
ASoC: rt5645: Perform the initial jack detect at probe

Jisheng Zhang <[email protected]>
spi: dw: fix wrong RX_SAMPLE_DLY setting after resume

Guenter Roeck <[email protected]>
hwmon: (corsair-psu) Fix linear11 calculation

Jia Jia <[email protected]>
vhost-scsi: flush backend after device ioctls

Zhang Heng <[email protected]>
ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx

Hardik Garg <[email protected]>
Drivers: hv: vmbus: add VTL2 redirect connection ID

Robert Abrahamse <[email protected]>
ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)

Jiale Yao <[email protected]>
Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame

Deepanshu Kartikey <[email protected]>

    wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()

Li Qiang <[email protected]>
cifs: validate idmap key payload length

Vaibhav Jain <[email protected]>
powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash

Michal Swiatkowski <[email protected]>
ice: pass the return value of skb_checksum_help()

Madhavender Singh <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx

Markus Lindner <[email protected]>
ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4

Minhong He <[email protected]>
phonet: check register_netdevice_notifier() error in phonet_device_init()

Pengpeng Hou <[email protected]>
drm/gma500: return errors from Oaktrail HDMI I2C reads

Namjae Jeon <[email protected]>
ksmbd: preserve VFS inherited POSIX ACL mask

Ibrahim Hashimov <[email protected]>
wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO

Kamal Wadhwa <[email protected]>
regulator: core: clamp voltage constraints before applying apply_uV

Jay Vadayath <[email protected]>
smb: client: bound dirent name against end of SMB response in cifs_filldir

Georgi Valkov <[email protected]>
wifi: mwifiex: replace one-element arrays with flexible array members

Zhang Heng <[email protected]>
ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: acpi: validate WGDS table revision index

Daniel C. Ribeiro <[email protected]>
ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: bound aligned TLV advance in FW parser

Takashi Iwai <[email protected]>
ALSA: hda/realtek: Add quirk for HP Pavilion x360

Timur Kristóf <[email protected]>
drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized

Pu Hu <[email protected]>
arm64: kprobes: Allow reentering kprobes while single-stepping

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: add a check on the tid coming from the firmware

Yu Peng <[email protected]>
arm64: fixmap: Allow 256K early_ioremap() at any offset

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix a possible underflow

Huiwen He <[email protected]>
smb/client: flush dirty data before punching a hole

Tao Cui <[email protected]>
blk-cgroup: fix leaks and online flag on radix_tree_insert failure

Marcel Kłos <[email protected]>
ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix sched scan IE sizing

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix an off-by-1 boundary check

Filipe Manana <[email protected]>
btrfs: fix reloc root cleanup in merge_reloc_roots()

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: validate sta_id in BA window status notif

Wang YuWei <[email protected]>
spi: dw-dma: Wait for controller idle before completing Tx

Filipe Manana <[email protected]>
btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()

Dave Chen <[email protected]>
btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr()

Chen Bowen <[email protected]>
ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series

Huiwen He <[email protected]>
smb/client: reduce fallocate zero buffer allocation

Pengpeng Hou <[email protected]>
wifi: rsi: validate beacon length before fixed buffer copy

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: mark the rcu locked areas properly

Pengpeng Hou <[email protected]>
wifi: libipw: fix key index receive bound checks

Liang Hao <[email protected]>
gpio: dwapb: Mask interrupts at hardware initialization

Zhao Li <[email protected]>
wifi: cfg80211: validate rx/tx MLME callback frame lengths before access

Namjae Jeon <[email protected]>
ksmbd: validate SID namespace before mapping IDs

Namjae Jeon <[email protected]>
ksmbd: mark invalid session responses as signed

Namjae Jeon <[email protected]>
ksmbd: find bound sessions during reauthentication

Zhao Li <[email protected]>
wifi: cfg80211: validate assoc response length before status and IE access

Pengpeng Hou <[email protected]>
wifi: libertas: reject short monitor TX frames

Pengpeng Hou <[email protected]>
wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers

Zhao Li <[email protected]>
wifi: mac80211: validate deauth frame length before reason access

Corentin Labbe <[email protected]>
wifi: ralink: RT2X00: init EEPROM properly

Pengpeng Hou <[email protected]>
ALSA: usb-audio: caiaq: validate EP1 reply lengths

Namjae Jeon <[email protected]>
ksmbd: fix credit charge calculation for SMB2 QUERY_INFO

Perry Yuan <[email protected]>
drm/amdgpu: flush pending RCU callbacks on module unload

Jetha Chan <[email protected]>
ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table

David Howells <[email protected]>
cachefiles: Fix double fput

Yousef Alhouseen <[email protected]>
xen/gntalloc: validate grant count before allocation

Farhad Alemi <[email protected]>
freevxfs: don't BUG() on unknown typed-extent type

Yousef Alhouseen <[email protected]>
xen/front-pgdir-shbuf: free grant reference head on errors

Qiang Liu <[email protected]>
ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling

Qiang Liu <[email protected]>
ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr

Gustavo Kenji Mendonça Kaneko <[email protected]>
drm/arm/komeda: fix error handling for clk_prepare_enable() and callers

Qiang Liu <[email protected]>
ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr

Florian Westphal <[email protected]>
netfilter: nf_conntrack_expect: zero at allocation time

Gustavo Kenji Mendonça Kaneko <[email protected]>
drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend

Weiming Shi <[email protected]>
btrfs: tree-checker: validate INODE_REF's namelen

Praveen Talari <[email protected]>
spi: core: Abort active target transfer on controller suspend

Haoxiang Li <[email protected]>
fbdev: pm2fb: unwind WC setup on probe failure

Arnd Bergmann <[email protected]>
eth: mlx5: fix macsec dependency

Adriana Stancu <[email protected]>
rtc: bq32000: add delay between RTC reads

Yu Kuai <[email protected]>

    blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat()

Runyu Xiao <[email protected]>
net: au1000: move free_irq out of the close-time spinlocked section

Pengpeng Hou <[email protected]>
regulator: da9121: Use subvariant ids in the I2C table

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Use kstrtobool() to parse the ROM attribute input

Krzysztof Wilczyński <[email protected]>
PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device()

Namjae Jeon <[email protected]>
ksmbd: treat read-control opens as stat opens only for leases

Namjae Jeon <[email protected]>
ksmbd: break RH leases before delete-on-close

Namjae Jeon <[email protected]>
ksmbd: start file id allocation at 1

Namjae Jeon <[email protected]>
ksmbd: deny renaming directory with open children

Namjae Jeon <[email protected]>
ksmbd: apply create security descriptor first

Namjae Jeon <[email protected]>
ksmbd: treat unnamed DATA stream as base file

Namjae Jeon <[email protected]>
ksmbd: use connection ClientGUID for lease lookup

Namjae Jeon <[email protected]>
ksmbd: align SMB2 oplock break ack handling

Namjae Jeon <[email protected]>
ksmbd: validate SMB2 lease create contexts

Namjae Jeon <[email protected]>
ksmbd: fix lease break and ack state handling

Tommy Huang <[email protected]>
rtc: aspeed: add AST2700 compatible

Samuel Moelius <[email protected]>
f2fs: validate inline dentry name lengths before conversion

Chen Cheng <[email protected]>
md/raid5: let stripe batch bm_seq comparison wrap-safe

Yu Kuai <[email protected]>
md/raid5: account discard IO

Hans Zhang <[email protected]>
PCI: mediatek: Protect root bus removal with rescan lock

Hans Zhang <[email protected]>
PCI: rockchip: Protect root bus removal with rescan lock

Hans Zhang <[email protected]>
PCI: altera: Protect root bus removal with rescan lock

Hans Zhang <[email protected]>
PCI: iproc: Protect root bus removal with rescan lock

Jean-Louis Colaco <[email protected]>
ALSA: usb-audio: Add quirk for YAMAHA CDS3000

Timur Kristóf <[email protected]>
drm/amdgpu: Use system unbound workqueue for soft IH ring

Xiaogang Chen <[email protected]>

    drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap

Xiaogang Chen <[email protected]>
drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl

Matthew Bystrin <[email protected]>

    mfd: rsmu: Add 8a34002 support

Akashdeep Kaur <[email protected]>
mfd: tps65219: Make poweroff handler conditional on system-power-controller

Tobias Deiminger <[email protected]>
leds: pca9532: Don't stop blinking for non-zero brightness

Yousef Alhouseen <[email protected]>
leds: uleds: Return -EFAULT on copy_to_user() failure

Galen Hassen <[email protected]>
ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10

Jakub Kicinski <[email protected]>
tls: reject the combination of TLS and sockmap

Ai Chao <[email protected]>
ALSA: usb-audio: Add quirk flags for SC13A

guoqi0226 <[email protected]>
spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()

Rob Herring (Arm) <[email protected]>
gpio: pisosr: Read "ngpios" as u32

Arnd Bergmann <[email protected]>
scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()

Zhang Tianci <[email protected]>

    fuse: set ff->flock only on success

Jiri Kosina <[email protected]>
HID: hidpp: fix potential UAF in hidpp_connect_event()

Viktor Menshin <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT

Rosen Penev <[email protected]>
sparc: Disable compat support with LLD

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA

Fredric Cover <[email protected]>
smb: client: fix races in cifsd thread creation

Alice Mikityanska <[email protected]>
net/sched: act_csum: don't mangle UDP tunnel GSO packets

Agalakov Daniil <[email protected]>
e1000e: limit endianness conversion to boundary words

Raf Dickson <[email protected]>
vsock: use sk_acceptq_is_full() helper in all transports

Vadim Fedorenko <[email protected]>
ptp: ocp: add shutdown callback

Nazim Amirul <[email protected]>
net: stmmac: xgmac2: disable RBUE in default RX interrupt mask

Rosen Penev <[email protected]>
sparc64: uprobes: add missing break

Nils Helmig <[email protected]>
Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV

bui duc phuc <[email protected]>
ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure

bui duc phuc <[email protected]>
ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence

bui duc phuc <[email protected]>
ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt

Samuel Moelius <[email protected]>
Bluetooth: L2CAP: validate connectionless PSM length

Cris <[email protected]>
Bluetooth: btusb: Add support for TP-Link TL-UB250

Hrvoje Nuic <[email protected]>
Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV

Vadim Fedorenko <[email protected]>
spi: xilinx: let transfers timeout in case of no IRQ

Potin Lai <[email protected]>

    hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i

Tze Yee Ng <[email protected]>
dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc

Jose Ignacio Tornos Martinez <[email protected]>
PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems

Yuho Choi <[email protected]>
sctp: Unwind address notifier registration on failure

Mohamed Khalfella <[email protected]>
nvme-fc: Do not cancel requests in io target before it is initialized

Nikolay Metchev <[email protected]>
platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table

Xu Rao <[email protected]>
ata: libata-pmp: add JMicron JMS562 quirk

Moritz Baron <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8

Furst Blumier <[email protected]>
ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC

Evgenii Burenchev <[email protected]>
vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add()

George Moussalem <[email protected]>
net: dsa: qca8k: Add support for force mode for fixed link topology

Kory Maincent <[email protected]>
hwmon: (adt7462) Add of_match_table to support devicetree

KangNing Liao <[email protected]>
btrfs: protect sb_write_pointer() with invalidate lock

Jiajia Liu <[email protected]>
wifi: mt76: transform aspm_conf for pci_disable_link_state

Gleb Sonichev <[email protected]>
platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table

Chuck Lever <[email protected]>
tls: Flush backlog before waiting for a new record

Rosen Penev <[email protected]>
net: ibm: emac: mal: fix potential system hang in mal_remove()

Al Viro <[email protected]>
configfs_depend_prep(): pass configfs_dirent instead of dentry

Chuck Lever <[email protected]>
xprtrdma: Add request-pool slack for delayed recycling

Aurelien DESBRIERES <[email protected]>
RDMA/rtrs-srv: Fix integer underflow in process_read and process_write

Dai Ngo <[email protected]>
NFS: fix eof updates after NFSv4.2 fallocate/zero-range

Zhang Cen <[email protected]>
btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF

ZhengYuan Huang <[email protected]>
btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()

Rosen Penev <[email protected]>
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

Ruoyu Wang <[email protected]>
ALSA: es18xx: check control allocation before private data setup

Haoxiang Li <[email protected]>
net: microchip: sparx5: clean up PSFP resources on flower setup failure

Maoyi Xie <[email protected]>
hsr: broadcast netlink notifications in the device's net namespace

Guangshuo Li <[email protected]>
net: cpsw_new: unregister devlink on port registration failure

Dawei Feng <[email protected]>
bpf: NUL-terminate replaced sysctl value

Li RongQing <[email protected]>
RDMA/mlx5: Fix state and counter desync on loopback enable failure

Jason Gunthorpe <[email protected]>
RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()

Thiyagarajan Pandiyan <[email protected]>
wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications

Yongqiang Sun <[email protected]>
drm/amdkfd: Unwind debug trap enable on copy_to_user failure

Rosen Penev <[email protected]>
ipmi: si: Use platform_get_irq_optional() to retrieve interrupt

Andrei Faleichyk <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP

Michael Walle <[email protected]>
clk: keystone: don't cache clock rate

Shay Drory <[email protected]>
net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition

Cyrill Gorcunov <[email protected]>
RDMA/irdma: Fix typo in SQ completions generation

Shiwu Zhang <[email protected]>
drm/amdgpu: fix buffer overflow during vBIOS update

Asad Kamal <[email protected]>
drm/amd/pm: bound pp_dpm_set_pp_table() memcpy

Alysa Liu <[email protected]>
drm/amdkfd: fix UAF race in destroy_queue_cpsch

Mathias Nyman <[email protected]>
xhci: Prevent queuing new commands if xhci is inaccessible

Priyansh Jain <[email protected]>
thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries

Ioana Ciornei <[email protected]>
dpaa2-switch: fix handling of NAPI on the remove path

David Yang <[email protected]>
net: dsa: sja1105: flower: reject cross-chip redirect

Ioana Ciornei <[email protected]>
dpaa2-switch: fix the error path in dpaa2_switch_rx()

Ioana Ciornei <[email protected]>
dpaa2-switch: rework FDB management on the bridge leave path

Cássio Gabriel <[email protected]>
ALSA: seq: oss: Reject reads that cannot fit the next event

Cássio Gabriel <[email protected]>
ASoC: codecs: rk3328: Use managed GPIO and clock helpers

Alessandro Schino <[email protected]>
ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()

ZhengYuan Huang <[email protected]>
fs/ntfs3: validate index entry key bounds

ZhengYuan Huang <[email protected]>
fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib

Simon Xue <[email protected]>
iommu/rockchip: disable fetch dte time limit

Jose Ignacio Tornos Martinez <[email protected]>
net: wwan: t7xx: Add delay between MD and SAP suspend

Wentao Liang <[email protected]>
net: qrtr: fix node refcount leak on ctrl packet alloc failure

Chen Pei <[email protected]>
ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach

liyouhong <[email protected]>
ata: ahci: fail probe if BAR too small for claimed ports

Cezary Rojewski <[email protected]>
ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm: return error code to consumers on failures

Miaoqing Pan <[email protected]>
wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi

Rosen Penev <[email protected]>
net: ibm: emac: Reserve VLAN header in MJS limit

Daniel Borkmann <[email protected]>
libbpf: Also reset {insn,data}_cur on realloc failure

Sanjay Chitroda <[email protected]>
iio: accel: mma8452: switch to non-devm request_threaded_irq()

Rik van Riel <[email protected]>
perf/ftrace: Fix WARNING in __unregister_ftrace_function

Miao Li <[email protected]>
iio: light: stk3310: Deal with the ps interrupt issue in PM

Lad Prabhakar <[email protected]>
mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC

Karl Mehltretter <[email protected]>
tracing: Disable KCOV instrumentation for trace_irqsoff.o

Lad Prabhakar <[email protected]>
mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC

Osama Abdelkader <[email protected]>
mmc: davinci: fix mmc_add_host order in probe

Bard Liao <[email protected]>
soundwire: only handle alert events when the peripheral is attached

Andreas Gruenbacher <[email protected]>
gfs2: page poisoning fix

Charles Keepax <[email protected]>
soundwire: dmi-quirks: Disable ghost Realtek devices

Tiezhu Yang <[email protected]>
libbpf: Add __NR_bpf definition for LoongArch

Cezary Rojewski <[email protected]>
ASoC: Intel: catpt: Complete coredump handling

Timur Tabi <[email protected]>
drm/nouveau/gsp: add SEC2 to GA100 chip table

Alexandre Courbot <[email protected]>
scripts: modpost: detect and report truncated buf_printf() output

shayderrr <[email protected]>
host1x: bus: Fix missing ops null check in error teardown

Claudiu Beznea <[email protected]>
pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP

Viacheslav Dubeyko <[email protected]>
hfs: rework hfsplus_readdir() logic

ikaros <[email protected]>
ACPICA: add boundary checks in two places

ikaros <[email protected]>
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()

Weiming Shi <[email protected]>
ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()

ikaros <[email protected]>
ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()

ikaros <[email protected]>
ACPICA: Add validation for node in acpi_ns_build_normalized_path()

ikaros <[email protected]>
ACPICA: Add package limit checks in parser functions

ikaros <[email protected]>
ACPICA: validate handler object type in two places

ikaros <[email protected]>
ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()

ikaros <[email protected]>
ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)

ikaros <[email protected]>
ACPICA: Prevent adding invalid references

ikaros <[email protected]>
ACPICA: validate byte_count in acpi_ps_get_next_package_length()

ikaros <[email protected]>
ACPICA: add boundary checks in acpi_ps_get_next_field()

ikaros <[email protected]>
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()

ikaros <[email protected]>
ACPICA: Fix condition check in acpi_ps_parse_loop()

Jeremy Klarenbeek <[email protected]>
drm/amd/pm/si: Fix updating clock limits from power states

Haoxiang Li <[email protected]>
net: thunderx: fix PTP device ref leak in nicvf_probe()

Fernando Fernandez Mancera <[email protected]>
ipv6: addrconf: fix temp address generation after prefix deprecation

Luka Gejak <[email protected]>
net: hsr: require valid EOT supervision TLV

Uwe Küchler <[email protected]>
ALSA: usb-audio: Add quirk for Novation Mininova

Mostafa Saleh <[email protected]>
irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed

Stepan Ionichev <[email protected]>
iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind

Rosen Penev <[email protected]>
mips: cps: Assemble jr.hb with an R2 ISA level

Dario Binacchi <[email protected]>

    drm/panel: simple: Add AM-1280800W8TZQW-T00H

Daniel Lezcano <[email protected]>
thermal/drivers/tegra/soctherma: Switch to devm cooling device registration

Adrian Ng Ho Yin <[email protected]>
clk: socfpga: agilex: implement l3_main_free_clk

Heiko Carstens <[email protected]>
s390/zcore: Removed unused variables

Jiayuan Chen <[email protected]>
rds: annotate data-race around rs_seen_congestion

Maoyi Xie <[email protected]>
rds: filter RDS_INFO_* getsockopt by caller's netns

Chenguang Zhao <[email protected]>
netlabel: fix IPv6 unlabeled address add error handling

Dian-Syuan Yang <[email protected]>
wifi: rtw89: pci: enable LTR based on pcie control register

Zqiang <[email protected]>
rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks()

Venkat Rao Bagalkote <[email protected]>
char/nvram: Remove redundant nvram_mutex

Christian Marangi <[email protected]>
usb: host: add ARCH_AIROHA in XHCI MTK dependency

Marco Felsch <[email protected]>
serial: 8250: fix possible ISR soft lockup

Maoyi Xie <[email protected]>
usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue

Dave Carey <[email protected]>
USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set

Stepan Ionichev <[email protected]>

    usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log

Oliver Neukum <[email protected]>
usb: core: hcd: fix possible deadlock in rh control transfers

Adrian Wowk <[email protected]>
usbip: vhci_hcd: fix NULL deref in status_show_vhci

Christoph Hellwig <[email protected]>
isofs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
omfs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
hpfs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
jfs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
qnx4: handle set_blocksize failures

Christoph Hellwig <[email protected]>
minix: handle set_blocksize failures

Christoph Hellwig <[email protected]>
bfs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
affs: handle set_blocksize failures

Christoph Hellwig <[email protected]>
ntfs3: handle set_blocksize failures

Christoph Hellwig <[email protected]>
befs: handle set_blocksize failures

Allison Henderson <[email protected]>
net/rds: Don't sleep inside rds_ib_conn_path_shutdown

Eric Dumazet <[email protected]>

    net/sched: sch_drr: make cl->quantum lockless

Eric Dumazet <[email protected]>
net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()

Jan Volckaert <[email protected]>
net: usb: qmi_wwan: add MeiG SRM813Q

Maurizio Lombardi <[email protected]>
nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl

Yury Norov <[email protected]>
bitfield: wire __bf_shf to __builtin_ctzll

Gil Fine <[email protected]>
thunderbolt: Verify Router Ready bit is set after router enumeration

Gil Fine <[email protected]>
thunderbolt: Increase timeout for Configuration Ready bit

Sudeep Holla <[email protected]>
firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

Sudeep Holla <[email protected]>
firmware: arm_scmi: Validate SENSOR_UPDATE payload size

Alan Borzeszkowski <[email protected]>
thunderbolt: Improve multi-display DisplayPort tunnel allocation

Pooja Katiyar <[email protected]>
thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host()

Ido Schimmel <[email protected]>
bridge: Add missing READ_ONCE() annotations around FDB destination port

Pierre Barre <[email protected]>
9p: use kvzalloc for readdir buffer

Leonardo Bras <[email protected]>
arm64/daifflags: Make local_daif_*() helpers __always_inline

Pierre Barre <[email protected]>
9p: invalidate readdir buffer on seek

Andrea Righi <[email protected]>
sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity

Cássio Gabriel <[email protected]>
ALSA: usx2y: Drain pending US-428 pipe-4 output commands

David Francis <[email protected]>
drm/amdkfd: Check bounds on allocate_doorbell

Sunday Clement <[email protected]>
drm/amdkfd: Fix OOB memory exposure in get_wave_state()

David Francis <[email protected]>
drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

Bjorn Helgaas <[email protected]>

    PCI: Wait for device readiness after D3hot -> D0uninitialized transition

Joonwon Kang <[email protected]>
mailbox: Make mbox_send_message() return error code when tx fails

Chenguang Zhao <[email protected]>
RDMA/mlx5: Use QP port when decoding responder CQEs

Alessandro Baldi <[email protected]>
media: imon: Add iMON VFD HID OEM v1.2 key mappings

Thorsten Blum <[email protected]>
crypto: atmel-ecc - add support for atecc608b

Lukas Wunner <[email protected]>
crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y

Kumar Meiyappan <[email protected]>
scsi: pm8001: Reject non-fatal dump when controller is crashed

Kumar Meiyappan <[email protected]>
scsi: pm8001: Reject firmware update in fatal error state

Alexey Klimov <[email protected]>
clk: samsung: exynos850: mark APM I3C clocks as critical

Peter Ujfalusi <[email protected]>
soundwire: intel: Move suspend tracking from trigger to pm suspend

Pengpeng Hou <[email protected]>
drivers/of: validate status properties in reconfig state changes

Stefan Berger <[email protected]>
integrity: Check for NULL returned by asymmetric_key_public_key

Mieczyslaw Nalewaj <[email protected]>
net: dsa: realtek: rtl8365mb: add support for RTL8367SB

Ping-Ke Shih <[email protected]>
wifi: rtw89: phy: check length before parsing PHY status IE

Arash Golgol <[email protected]>
media: video-i2c: use vb2_video_unregister_device on driver removal

Sophie D <[email protected]>
drm/gud: Add RCade Display Adapter VID/PID pair

chunzhi.lin <[email protected]>
net: phy: motorcomm: use device properties for firmware tuning

Viacheslav Dubeyko <[email protected]>
hfsplus: rework hfsplus_readdir() logic

Florian Eckert <[email protected]>
PCI: intel-gw: Enable clock before PHY init

Tom Chung <[email protected]>
drm/amd/display: Fix CRC open failure during active rendering

Stepan Ionichev <[email protected]>

    mmc: davinci: avoid NULL deref of host->data in IRQ handler

Shawn Lin <[email protected]>
mmc: core: Add validation for host-provided max_segs

Ethan Nelson-Moore <[email protected]>
ASoC: ti: omap3pandora: update board check to use DT compatible

Parth Pancholi <[email protected]>
drm/bridge: tc358768: Set pre_enable_prev_first for reverse order

Geert Uytterhoeven <[email protected]>
clk: renesas: cpg-mssr: Add number of clock cells check

Thorsten Blum <[email protected]>
crypto: omap - add omap_des_unregister_algs helper

Ruoyu Wang <[email protected]>
crypto: ixp4xx - fix buffer chain unwind on allocation failure

Haoxiang Li <[email protected]>
media: em28xx-video: fix missing res_free() on init_usb_xfer failure

Marek Behún <[email protected]>
net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family

Marek Behún <[email protected]>

    net: dsa: mv88e6xxx: define .pot_clear() for 6321

Ben Reed <[email protected]>
PCI: switchtec: Add Gen6 Device IDs

Marek Behún <[email protected]>
net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family

Zhaoyang Yu <[email protected]>
media: dm1105: fix missing error check for dma_alloc_coherent

Alan Borzeszkowski <[email protected]>
thunderbolt: Don't create multiple DMA tunnels on firmware connection manager

Mika Westerberg <[email protected]>

    thunderbolt: Set tb->root_switch to NULL when domain is stopped

Mika Westerberg <[email protected]>
thunderbolt: Keep the domain reference while processing hotplug

Mika Westerberg <[email protected]>
thunderbolt: Keep XDomain reference during the lifetime of a service

Mika Westerberg <[email protected]>
thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()

Riccardo Boninsegna <[email protected]>
media: rc: mceusb: Add support for 04eb:e033

Viken Dadhaniya <[email protected]>
spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM

Pengpeng Hou <[email protected]>
soundwire: validate DT compatible before parsing it

Danielle Ratson <[email protected]>
bridge: Do not suppress ARP probes and DAD NS unconditionally

Siew Chin Lim <[email protected]>
firmware: stratix10-svc: change get provision data to async SMC call

Marco Elver <[email protected]>
kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access()

Panagiotis Petrakopoulos <[email protected]>

    wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()

Johannes Berg <[email protected]>
wifi: mac80211: always allow transmitting null-data on TXQs

Johannes Berg <[email protected]>
wifi: nl80211: reject beacons with bad HE operation

Viacheslav Dubeyko <[email protected]>
hfsplus: fix issue of direct writes beyond end-of-file

Lukas Wunner <[email protected]>
PCI: Stop setting cached power state to 'unknown' on unbind

Thomas Weißschuh <[email protected]>
tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang

Hirokazu Honda <[email protected]>
tee: optee: Allow MT_NORMAL_TAGGED shared memory

Xu Yang <[email protected]>
usb: gadget: udc: skip pullup() if already connected

Goldwyn Rodrigues <[email protected]>
ima: return error early if file xattr cannot be changed

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate write errors in generic mixer put callbacks

Lijo Lazar <[email protected]>
drm/amd/pm: Check SMUv13.0.6/12 metrics integrity

Dmitry Baryshkov <[email protected]>
drm/panel: jadard-jd9365da-h3: set prepare_prev_first

Dominik Kaszewski <[email protected]>
drm/amd/display: Fix DPMS using partially updated pipe context

Ioana Ciornei <[email protected]>
bus: fsl-mc: wait for the MC firmware to complete its boot

Boris Brezillon <[email protected]>
drm/gem: Consider GEM object reclaimable if shrinking fails

Abdifatah Suruur <[email protected]>
ksmbd: fix use-after-free in oplock break notification

-------------

Diffstat:

 .../ABI/testing/sysfs-devices-platform-trackpoint  |    2 +-
 Documentation/arch/s390/pci.rst                    |  144 +-
 Documentation/hwmon/emc1403.rst                    |    8 +-
 Documentation/networking/ip-sysctl.rst             |    2 +
 Documentation/sound/designs/midi-2.0.rst           |   11 +
 Makefile                                           |    4 +-
 arch/alpha/include/uapi/asm/fpu.h                  |    8 +-
 arch/alpha/kernel/traps.c                          |    6 +-
 arch/alpha/math-emu/math.c                         |   88 +-
 arch/arm/mach-socfpga/Kconfig                      |    2 +-
 arch/arm/mach-ux500/cpu-db8500.c                   |    6 +-
 arch/arm/mm/cache-feroceon-l2.c                    |    2 +-
 arch/arm/mm/cache-tauros2.c                        |    2 +-
 arch/arm/mm/fault.c                                |   12 +-
 arch/arm64/boot/dts/qcom/sc8180x.dtsi              |   16 +-
 arch/arm64/boot/dts/qcom/sdm845.dtsi               |   64 +-
 arch/arm64/boot/dts/qcom/sm8150.dtsi               |    8 +-
 arch/arm64/boot/dts/qcom/sm8250.dtsi               |   12 +-
 arch/arm64/boot/dts/qcom/sm8350.dtsi               |    8 +-
 arch/arm64/boot/dts/qcom/sm8450.dtsi               |    8 +-
 arch/arm64/boot/dts/qcom/sm8550.dtsi               |    8 +-
 arch/arm64/boot/dts/renesas/r8a779f0.dtsi          |    1 +
 arch/arm64/include/asm/daifflags.h                 |   10 +-
 arch/arm64/include/asm/fixmap.h                    |    6 +-
 arch/arm64/include/asm/io.h                        |    3 +-
 arch/arm64/include/asm/kprobes.h                   |    6 +
 arch/arm64/include/asm/percpu.h                    |   16 +-
 arch/arm64/kernel/hibernate-asm.S                  |    2 +
 arch/arm64/kernel/probes/kprobes.c                 |   23 +-
 arch/arm64/kvm/hypercalls.c                        |    3 +-
 arch/arm64/kvm/vgic/vgic-its.c                     |   96 +-
 arch/arm64/kvm/vgic/vgic.h                         |   23 -
 arch/mips/cavium-octeon/octeon-platform.c          |    4 +-
 arch/mips/kernel/cps-vec.S                         |    6 +
 arch/mips/net/bpf_jit_comp32.c                     |    2 +-
 arch/mips/net/bpf_jit_comp64.c                     |    3 +-
 arch/powerpc/kernel/eeh_driver.c                   |    2 -
 arch/powerpc/kernel/iommu.c                        |    2 +-
 arch/powerpc/kexec/file_load_64.c                  |    2 +-
 arch/powerpc/kvm/book3s_hv.c                       |    4 +-
 arch/powerpc/kvm/book3s_hv_nested.c                |    2 +
 arch/powerpc/kvm/book3s_hv_uvmem.c                 |    5 +-
 arch/powerpc/platforms/ps3/repository.c            |    5 +-
 arch/powerpc/platforms/pseries/kexec.c             |   13 +-
 arch/riscv/kvm/vcpu_sbi_hsm.c                      |    4 +-
 arch/riscv/kvm/vcpu_timer.c                        |    5 +-
 arch/s390/boot/physmem_info.c                      |    2 +-
 arch/s390/crypto/aes_s390.c                        |   16 +-
 arch/s390/include/asm/checksum.h                   |   29 +-
 arch/s390/include/asm/debug.h                      |    8 +-
 arch/s390/include/asm/os_info.h                    |   19 +-
 arch/s390/kernel/debug.c                           |   15 +-
 arch/s390/kernel/ipl.c                             |   19 +-
 arch/s390/kernel/os_info.c                         |   21 +-
 arch/s390/kvm/interrupt.c                          |   72 +-
 arch/sparc/Kconfig                                 |    1 +
 arch/sparc/kernel/uprobes.c                        |    1 +
 arch/x86/crypto/aria-aesni-avx2-asm_64.S           |    6 +
 arch/x86/crypto/aria-gfni-avx512-asm_64.S          |    3 +
 arch/x86/events/amd/ibs.c                          |    3 +-
 arch/x86/events/intel/core.c                       |   76 +-
 arch/x86/events/intel/ds.c                         |  208 ++-
 arch/x86/include/asm/perf_event.h                  |   16 +-
 arch/x86/include/asm/pgtable.h                     |    2 +-
 arch/x86/pci/fixup.c                               |   99 ++
 block/blk-cgroup.c                                 |   13 +-
 crypto/Makefile                                    |    5 +
 drivers/accel/qaic/qaic_control.c                  |   46 +-
 drivers/acpi/acpica/dsmethod.c                     |   43 +
 drivers/acpi/acpica/evhandler.c                    |   11 +
 drivers/acpi/acpica/exconfig.c                     |   26 +-
 drivers/acpi/acpica/exoparg3.c                     |    2 +-
 drivers/acpi/acpica/nsnames.c                      |    6 +
 drivers/acpi/acpica/nsprepkg.c                     |    7 +
 drivers/acpi/acpica/nsxfname.c                     |    4 +
 drivers/acpi/acpica/psargs.c                       |  134 +-
 drivers/acpi/acpica/psloop.c                       |   30 +-
 drivers/acpi/acpica/psparse.c                      |   14 +
 drivers/acpi/acpica/utcopy.c                       |   10 +-
 drivers/acpi/acpica/utresrc.c                      |   30 +
 drivers/acpi/pci_root.c                            |    4 +
 drivers/ata/ahci.c                                 |   22 +
 drivers/ata/libahci.c                              |   15 +-
 drivers/ata/libata-pmp.c                           |    7 +-
 drivers/ata/libata-scsi.c                          |   10 +-
 drivers/base/core.c                                |  200 ++-
 drivers/block/sunvdc.c                             |   26 +-
 drivers/bluetooth/btintel.c                        |   68 +-
 drivers/bluetooth/btintel.h                        |   47 +-
 drivers/bluetooth/btmtk.c                          |    7 +-
 drivers/bluetooth/btmtksdio.c                      |    4 +-
 drivers/bluetooth/btrtl.c                          |    5 +-
 drivers/bluetooth/btusb.c                          |   41 +-
 drivers/bluetooth/hci_mrvl.c                       |    3 +-
 drivers/bus/fsl-mc/fsl-mc-bus.c                    |   46 +
 drivers/char/ipmi/ipmi_si_platform.c               |    5 +-
 drivers/char/nvram.c                               |   16 +-
 drivers/char/virtio_console.c                      |   21 +-
 drivers/clk/clk-scpi.c                             |    2 +-
 drivers/clk/keystone/sci-clk.c                     |    8 +
 drivers/clk/renesas/renesas-cpg-mssr.c             |    3 +
 drivers/clk/samsung/clk-exynos850.c                |    5 +-
 drivers/clk/socfpga/clk-agilex.c                   |    2 +
 drivers/clk/ux500/clk-prcmu.c                      |   20 +-
 drivers/clk/ux500/u8500_of_clk.c                   |    2 +-
 drivers/clocksource/timer-orion.c                  |    2 +-
 drivers/cpufreq/cpufreq.c                          |    6 +-
 drivers/cpuidle/cpuidle-ux500.c                    |    6 +-
 drivers/crypto/allwinner/Kconfig                   |   16 -
 drivers/crypto/allwinner/sun8i-ce/Makefile         |    1 -
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c  |   55 -
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c  |  159 --
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h       |   29 -
 drivers/crypto/allwinner/sun8i-ss/Makefile         |    1 -
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c  |   39 -
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c  |  177 --
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h       |   23 -
 drivers/crypto/atmel-ecc.c                         |   11 +-
 drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c        |   25 +-
 drivers/crypto/omap-des.c                          |   26 +-
 .../crypto/virtio/virtio_crypto_akcipher_algs.c    |   91 +-
 .../crypto/virtio/virtio_crypto_skcipher_algs.c    |   13 +-
 drivers/cxl/core/pmem.c                            |   21 +-
 drivers/cxl/core/region.c                          |    2 +-
 drivers/cxl/cxl.h                                  |    4 +-
 drivers/cxl/mem.c                                  |   18 +-
 drivers/dma/dmaengine.c                            |   10 +-
 drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c     |   11 +-
 drivers/dma/mmp_pdma.c                             |    2 +-
 drivers/dma/sprd-dma.c                             |    3 +-
 drivers/dma/sun6i-dma.c                            |    9 +-
 drivers/dma/ti/k3-udma-glue.c                      |    5 +-
 drivers/dma/xilinx/xilinx_dma.c                    |   26 +-
 drivers/edac/edac_device_sysfs.c                   |   11 +-
 drivers/edac/igen6_edac.c                          |   27 +-
 drivers/firmware/arm_scmi/base.c                   |   15 +-
 drivers/firmware/arm_scmi/sensors.c                |   10 +-
 drivers/firmware/arm_scpi.c                        |    4 +-
 drivers/firmware/stratix10-svc.c                   |    4 +-
 drivers/gpio/gpio-arizona.c                        |    8 +-
 drivers/gpio/gpio-dwapb.c                          |   17 +
 drivers/gpio/gpio-pisosr.c                         |    4 +-
 drivers/gpio/gpio-tps65219.c                       |    2 +-
 drivers/gpio/gpio-zynq.c                           |   10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c         |   23 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h         |    2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c        |    4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |    8 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c            |    2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c            |    2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c           |    2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |    1 +
 drivers/gpu/drm/amd/amdgpu/atom.c                  |    9 +-
 drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c             |    2 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |   10 +-
 drivers/gpu/drm/amd/amdkfd/kfd_debug.c             |    6 +
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c  |   17 +-
 drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c          |    8 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c    |   11 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |   17 +-
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c  |    7 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  |   20 +-
 drivers/gpu/drm/amd/display/dc/core/dc.c           |   24 +-
 drivers/gpu/drm/amd/display/dc/core/dc_resource.c  |    3 +-
 drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c       |    7 +-
 .../gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c    |    3 +-
 .../display/dc/link/protocols/link_dp_training.c   |    4 +-
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c         |   31 +-
 drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c   |    3 +
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c   |    4 +
 drivers/gpu/drm/arm/display/komeda/komeda_dev.c    |    6 +-
 drivers/gpu/drm/arm/display/komeda/komeda_drv.c    |   14 +-
 drivers/gpu/drm/arm/malidp_drv.c                   |   22 +-
 drivers/gpu/drm/ast/ast_mode.c                     |    4 +-
 drivers/gpu/drm/bridge/samsung-dsim.c              |    2 +-
 drivers/gpu/drm/bridge/tc358768.c                  |    2 +
 drivers/gpu/drm/drm_atomic_uapi.c                  |   13 +-
 drivers/gpu/drm/drm_exec.c                         |   13 +
 drivers/gpu/drm/drm_gem.c                          |   10 +
 drivers/gpu/drm/drm_probe_helper.c                 |   27 +
 drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c         |   21 +-
 drivers/gpu/drm/gud/gud_drv.c                      |    1 +
 drivers/gpu/drm/gud/gud_pipe.c                     |    4 +-
 drivers/gpu/drm/i915/gem/i915_gem_object.c         |    2 +-
 drivers/gpu/drm/i915/i915_query.c                  |    4 +-
 drivers/gpu/drm/logicvc/Kconfig                    |    1 -
 drivers/gpu/drm/mediatek/mtk_drm_crtc.c            |    3 +-
 drivers/gpu/drm/msm/adreno/adreno_gpu.c            |    2 +
 drivers/gpu/drm/msm/dsi/dsi_host.c                 |   36 +-
 drivers/gpu/drm/msm/hdmi/hdmi_phy.c                |    8 +-
 drivers/gpu/drm/nouveau/nouveau_bo.c               |    3 +-
 drivers/gpu/drm/nouveau/nouveau_drm.c              |    5 +-
 drivers/gpu/drm/nouveau/nouveau_gem.c              |    2 +
 drivers/gpu/drm/nouveau/nvif/vmm.c                 |    1 +
 drivers/gpu/drm/nouveau/nvkm/engine/device/base.c  |    1 +
 drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c     |   23 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramnv1a.c   |    2 +
 drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c   |    2 +
 drivers/gpu/drm/panel/panel-simple.c               |   28 +
 drivers/gpu/drm/tiny/cirrus.c                      |    7 +-
 drivers/gpu/drm/vc4/vc4_kms.c                      |    2 +-
 drivers/gpu/drm/virtio/virtgpu_display.c           |    2 +-
 drivers/gpu/drm/virtio/virtgpu_gem.c               |    2 +-
 drivers/gpu/drm/virtio/virtgpu_ioctl.c             |    6 +-
 drivers/gpu/drm/virtio/virtgpu_submit.c            |   11 +-
 drivers/gpu/drm/virtio/virtgpu_vram.c              |   17 +-
 drivers/gpu/host1x/bus.c                           |    4 +-
 drivers/hid/amd-sfh-hid/amd_sfh_common.h           |    4 +
 drivers/hid/amd-sfh-hid/amd_sfh_pcie.c             |   10 +
 drivers/hid/hid-alps.c                             |    6 +-
 drivers/hid/hid-ids.h                              |    3 +
 drivers/hid/hid-logitech-hidpp.c                   |   25 +-
 drivers/hid/hid-quirks.c                           |    3 +-
 drivers/hid/wacom_sys.c                            |    5 +-
 drivers/hv/connection.c                            |   47 +-
 drivers/hv/hyperv_vmbus.h                          |    2 +
 drivers/hwmon/adt7462.c                            |    8 +
 drivers/hwmon/applesmc.c                           |    7 +-
 drivers/hwmon/aspeed-pwm-tacho.c                   |    4 +-
 drivers/hwmon/corsair-psu.c                        |   23 +-
 drivers/hwmon/emc1403.c                            |   73 +-
 drivers/hwmon/gpio-fan.c                           |   13 +-
 drivers/hwmon/hp-wmi-sensors.c                     |    2 +
 drivers/hwmon/pmbus/lm25066.c                      |   60 +-
 drivers/hwmon/pmbus/pmbus.h                        |    3 +-
 drivers/hwmon/pmbus/pmbus_core.c                   |    4 +-
 drivers/hwmon/pmbus/tps53679.c                     |   11 +-
 drivers/hwmon/w83791d.c                            |    1 +
 drivers/hwmon/w83793.c                             |    4 +-
 drivers/hwtracing/coresight/coresight-platform.c   |   12 +-
 drivers/i2c/busses/i2c-at91-core.c                 |    3 +
 drivers/i2c/busses/i2c-at91-master.c               |   12 +-
 drivers/i2c/busses/i2c-at91.h                      |    1 +
 drivers/i2c/busses/i2c-imx.c                       |    3 +
 drivers/i2c/i2c-atr.c                              |    1 +
 drivers/i2c/i2c-core-smbus.c                       |   12 +
 drivers/i3c/master/mipi-i3c-hci/cmd_v1.c           |    4 +-
 drivers/i3c/master/mipi-i3c-hci/cmd_v2.c           |    4 +-
 drivers/iio/accel/mma8452.c                        |   19 +-
 drivers/iio/adc/qcom-spmi-iadc.c                   |   18 +-
 drivers/iio/light/stk3310.c                        |   76 +-
 drivers/infiniband/core/iwpm_util.c                |    9 +-
 drivers/infiniband/core/mad.c                      |    3 +-
 drivers/infiniband/core/ucma.c                     |    7 +-
 drivers/infiniband/core/umem.c                     |   18 +-
 drivers/infiniband/core/verbs.c                    |   12 +-
 drivers/infiniband/hw/bnxt_re/qplib_res.c          |   11 +
 drivers/infiniband/hw/efa/efa_com.c                |    7 +-
 drivers/infiniband/hw/efa/efa_com.h                |    1 +
 drivers/infiniband/hw/efa/efa_main.c               |   35 +-
 drivers/infiniband/hw/hfi1/file_ops.c              |   23 +-
 drivers/infiniband/hw/irdma/utils.c                |    2 +-
 drivers/infiniband/hw/irdma/verbs.c                |    2 +-
 drivers/infiniband/hw/mlx4/sysfs.c                 |    4 +
 drivers/infiniband/hw/mlx5/cq.c                    |    3 +-
 drivers/infiniband/hw/mlx5/main.c                  |   11 +
 drivers/infiniband/sw/rxe/rxe_mcast.c              |   50 +-
 drivers/infiniband/sw/rxe/rxe_mr.c                 |    3 +-
 drivers/infiniband/sw/rxe/rxe_verbs.c              |   13 +-
 drivers/infiniband/sw/siw/siw_cm.c                 |   75 +-
 drivers/infiniband/sw/siw/siw_qp_rx.c              |    2 +-
 drivers/infiniband/ulp/ipoib/ipoib.h               |    7 +
 drivers/infiniband/ulp/ipoib/ipoib_ib.c            |   12 +-
 drivers/infiniband/ulp/ipoib/ipoib_multicast.c     |   16 +-
 drivers/infiniband/ulp/iser/iser_initiator.c       |   16 +-
 drivers/infiniband/ulp/isert/ib_isert.c            |   22 +
 drivers/infiniband/ulp/isert/ib_isert.h            |    2 +
 drivers/infiniband/ulp/rtrs/rtrs-clt.c             |    8 +
 drivers/infiniband/ulp/rtrs/rtrs-clt.h             |    2 +
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             |   12 +-
 drivers/input/evdev.c                              |    2 +
 drivers/input/input-compat.c                       |    2 +
 drivers/input/joystick/xpad.c                      |   10 +-
 drivers/input/keyboard/adp5588-keys.c              |   12 +-
 drivers/input/keyboard/atkbd.c                     |    8 +
 drivers/input/misc/soc_button_array.c              |   16 +-
 drivers/input/mouse/synaptics.c                    |    8 +
 drivers/input/rmi4/rmi_driver.c                    |   13 +
 drivers/input/rmi4/rmi_smbus.c                     |   10 +-
 drivers/input/serio/i8042-acpipnpio.h              |    7 +
 drivers/input/touchscreen/cyttsp5.c                |    1 +
 drivers/iommu/rockchip-iommu.c                     |    8 +
 drivers/irqchip/irq-gic-v3-its.c                   |    1 +
 drivers/leds/leds-pca9532.c                        |    8 +-
 drivers/leds/uleds.c                               |   11 +-
 drivers/mailbox/mailbox.c                          |    6 +-
 drivers/md/raid5.c                                 |   35 +-
 drivers/media/i2c/video-i2c.c                      |    7 +-
 drivers/media/pci/dm1105/dm1105.c                  |    7 +-
 .../vcodec/decoder/vdec/vdec_av1_req_lat_if.c      |    5 +-
 .../platform/verisilicon/hantro_g2_hevc_dec.c      |    6 +-
 .../verisilicon/rockchip_vpu981_hw_av1_dec.c       |   57 +-
 drivers/media/rc/imon.c                            |    4 +
 drivers/media/rc/mceusb.c                          |    2 +
 drivers/media/usb/as102/as102_usb_drv.c            |   75 +-
 drivers/media/usb/em28xx/em28xx-video.c            |    4 +-
 drivers/media/v4l2-core/v4l2-ctrls-core.c          |   32 +
 drivers/media/v4l2-core/v4l2-h264.c                |    3 +-
 drivers/memstick/core/ms_block.c                   |    2 +
 drivers/mfd/ab8500-core.c                          |    2 +-
 drivers/mfd/db8500-prcmu.c                         |    6 +-
 drivers/mfd/rsmu_i2c.c                             |    2 +
 drivers/mfd/rsmu_spi.c                             |    2 +
 drivers/mfd/tps65219.c                             |   14 +-
 drivers/mmc/core/bus.c                             |    2 +-
 drivers/mmc/core/host.c                            |    1 +
 drivers/mmc/core/queue.c                           |    8 +-
 drivers/mmc/core/sdio_uart.c                       |    3 +
 drivers/mmc/host/davinci_mmc.c                     |   16 +-
 drivers/mmc/host/mmc_hsq.c                         |    8 +-
 drivers/mmc/host/mmc_spi.c                         |    1 +
 drivers/mmc/host/mxcmmc.c                          |    4 +
 drivers/mmc/host/renesas_sdhi_internal_dmac.c      |    2 +
 drivers/mmc/host/rtsx_pci_sdmmc.c                  |    5 +
 drivers/mmc/host/sdhci-of-aspeed.c                 |    5 +-
 drivers/mmc/host/sdhci_am654.c                     |    4 +-
 drivers/mmc/host/sh_mmcif.c                        |    3 +-
 drivers/net/bareudp.c                              |   11 +-
 drivers/net/bonding/bond_alb.c                     |   32 +-
 drivers/net/bonding/bond_main.c                    |    6 +-
 drivers/net/dsa/bcm_sf2_cfp.c                      |    2 +
 drivers/net/dsa/mt7530-mdio.c                      |   18 +-
 drivers/net/dsa/mv88e6xxx/chip.c                   |   23 +-
 drivers/net/dsa/qca/qca8k-8xxx.c                   |   22 +-
 drivers/net/dsa/qca/qca8k.h                        |    1 +
 drivers/net/dsa/realtek/rtl8365mb.c                |   14 +
 drivers/net/dsa/sja1105/sja1105_flower.c           |    4 +-
 drivers/net/ethernet/allwinner/sun4i-emac.c        |    2 +
 drivers/net/ethernet/amd/au1000_eth.c              |    3 +-
 drivers/net/ethernet/amd/pds_core/fw.c             |   10 +-
 drivers/net/ethernet/amd/pds_core/main.c           |    8 +-
 drivers/net/ethernet/amd/xgbe/xgbe-dev.c           |    3 +-
 drivers/net/ethernet/atheros/atl1c/atl1c_main.c    |    3 +
 drivers/net/ethernet/atheros/atl1e/atl1e_main.c    |    3 +
 drivers/net/ethernet/atheros/atlx/atl1.c           |    3 +
 drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c   |    4 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   19 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |   63 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.h     |    5 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c |   20 +-
 drivers/net/ethernet/broadcom/tg3.c                |   15 +-
 drivers/net/ethernet/cadence/macb.h                |    2 +-
 drivers/net/ethernet/cadence/macb_main.c           |   39 +-
 drivers/net/ethernet/cadence/macb_ptp.c            |    9 +
 drivers/net/ethernet/cavium/thunder/nicvf_main.c   |    8 +-
 drivers/net/ethernet/cortina/gemini.c              |   79 +-
 .../net/ethernet/freescale/dpaa2/dpaa2-switch.c    |   69 +-
 drivers/net/ethernet/freescale/fman/fman.c         |    1 +
 drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c  |    3 +
 drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c  |    4 +-
 drivers/net/ethernet/ibm/emac/core.c               |    3 +-
 drivers/net/ethernet/ibm/emac/mal.c                |    6 +-
 drivers/net/ethernet/intel/e1000e/ethtool.c        |   19 +-
 drivers/net/ethernet/intel/ice/ice_common.c        |    9 +-
 drivers/net/ethernet/intel/ice/ice_sched.c         |    4 +-
 drivers/net/ethernet/intel/ice/ice_txrx.c          |   20 +-
 drivers/net/ethernet/intel/ice/ice_type.h          |    2 +-
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c    |    3 +-
 drivers/net/ethernet/marvell/octeontx2/af/mcs.c    |   10 +
 .../ethernet/marvell/octeontx2/af/rvu_debugfs.c    |   10 +-
 drivers/net/ethernet/marvell/octeontx2/nic/qos.c   |   60 +-
 drivers/net/ethernet/mediatek/mtk_eth_soc.c        |   22 +-
 drivers/net/ethernet/mediatek/mtk_eth_soc.h        |    2 +-
 drivers/net/ethernet/mellanox/mlx5/core/Kconfig    |    2 +-
 drivers/net/ethernet/mellanox/mlx5/core/en/port.c  |   15 +-
 .../ethernet/mellanox/mlx5/core/en/rep/bridge.c    |   45 +-
 .../net/ethernet/mellanox/mlx5/core/en/tc/sample.c |    7 +-
 drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c |    3 +
 .../ethernet/mellanox/mlx5/core/en_accel/macsec.c  |    2 +
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c |    2 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |    1 -
 .../net/ethernet/mellanox/mlx5/core/esw/bridge.c   |   15 +-
 .../net/ethernet/mellanox/mlx5/core/esw/bridge.h   |    2 +
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c  |    8 +-
 .../mellanox/mlx5/core/eswitch_offloads_termtbl.c  |    7 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |    2 +
 drivers/net/ethernet/micrel/ks8842.c               |    4 +-
 drivers/net/ethernet/micrel/ks8851_common.c        |   10 +-
 drivers/net/ethernet/micrel/ks8851_spi.c           |    4 +-
 drivers/net/ethernet/micrel/ksz884x.c              |    4 +-
 drivers/net/ethernet/microchip/lan743x_main.c      |    2 +-
 .../net/ethernet/microchip/sparx5/sparx5_psfp.c    |    5 +-
 .../ethernet/microchip/sparx5/sparx5_tc_flower.c   |   18 +-
 drivers/net/ethernet/microsoft/mana/mana_en.c      |    6 +-
 drivers/net/ethernet/netronome/nfp/crypto/ipsec.c  |    3 +-
 drivers/net/ethernet/socionext/netsec.c            |    2 +
 drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c     |    5 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c |    4 +-
 drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h     |    4 +-
 drivers/net/ethernet/stmicro/stmmac/hwif.h         |    2 +-
 drivers/net/ethernet/stmicro/stmmac/ring_mode.c    |    4 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |    9 +
 drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c   |    1 -
 .../net/ethernet/stmicro/stmmac/stmmac_selftests.c |  106 +-
 drivers/net/ethernet/ti/cpsw.c                     |   41 +-
 drivers/net/ethernet/ti/cpsw_new.c                 |   39 +-
 drivers/net/ethernet/ti/cpsw_priv.h                |    1 +
 drivers/net/ethernet/ti/netcp_core.c               |    2 +-
 drivers/net/fddi/skfp/skfddi.c                     |    3 +-
 drivers/net/gtp.c                                  |   18 +-
 drivers/net/ieee802154/mac802154_hwsim.c           |   10 +-
 drivers/net/phy/motorcomm.c                        |   41 +-
 drivers/net/ppp/ppp_async.c                        |   89 +-
 drivers/net/ppp/ppp_synctty.c                      |   14 +-
 drivers/net/usb/catc.c                             |   15 +-
 drivers/net/usb/cdc_mbim.c                         |    5 +
 drivers/net/usb/cx82310_eth.c                      |    1 +
 drivers/net/usb/hso.c                              |    2 +-
 drivers/net/usb/lan78xx.c                          |    9 +-
 drivers/net/usb/pegasus.c                          |   54 +-
 drivers/net/usb/pegasus.h                          |    3 -
 drivers/net/usb/qmi_wwan.c                         |    2 +
 drivers/net/usb/sr9700.c                           |    3 +-
 drivers/net/veth.c                                 |    2 +
 drivers/net/vrf.c                                  |    2 -
 drivers/net/vxlan/vxlan_core.c                     |  266 +--
 drivers/net/vxlan/vxlan_mdb.c                      |    8 +
 drivers/net/wireless/ath/ath11k/dp_rx.c            |   50 +-
 drivers/net/wireless/ath/ath12k/qmi.c              |   59 +-
 drivers/net/wireless/ath/ath12k/qmi.h              |    2 +
 drivers/net/wireless/ath/ath9k/hif_usb.c           |   12 +-
 drivers/net/wireless/ath/ath9k/hif_usb.h           |    2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.c    |    2 +
 .../broadcom/brcm80211/brcmsmac/mac80211_if.c      |    4 +
 drivers/net/wireless/intel/ipw2x00/libipw_rx.c     |   10 +-
 drivers/net/wireless/intel/iwlegacy/common.c       |    2 +-
 drivers/net/wireless/intel/iwlwifi/fw/acpi.c       |    5 +
 drivers/net/wireless/intel/iwlwifi/iwl-drv.c       |   13 +-
 drivers/net/wireless/intel/iwlwifi/mvm/d3.c        |   19 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |    6 +-
 drivers/net/wireless/intel/iwlwifi/mvm/rx.c        |    5 +
 drivers/net/wireless/intel/iwlwifi/mvm/scan.c      |    4 +-
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c        |   11 +-
 drivers/net/wireless/intersil/p54/eeprom.c         |   22 +-
 drivers/net/wireless/marvell/libertas/tx.c         |    7 +
 drivers/net/wireless/marvell/libertas_tf/main.c    |    2 +-
 drivers/net/wireless/marvell/mwifiex/fw.h          |   18 +-
 drivers/net/wireless/marvell/mwifiex/join.c        |    8 +-
 drivers/net/wireless/marvell/mwifiex/pcie.c        |    2 +-
 drivers/net/wireless/marvell/mwifiex/scan.c        |   54 +-
 drivers/net/wireless/marvell/mwifiex/sta_cmd.c     |    2 +-
 drivers/net/wireless/marvell/mwifiex/util.c        |   10 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c    |   33 +-
 drivers/net/wireless/mediatek/mt76/pci.c           |    8 +-
 drivers/net/wireless/microchip/wilc1000/cfg80211.c |   14 +
 drivers/net/wireless/microchip/wilc1000/wlan.c     |    9 +
 drivers/net/wireless/ralink/rt2x00/rt2400pci.c     |    2 +-
 drivers/net/wireless/ralink/rt2x00/rt2500pci.c     |    2 +-
 drivers/net/wireless/ralink/rt2x00/rt2800pci.c     |    2 +-
 drivers/net/wireless/ralink/rt2x00/rt61pci.c       |    2 +-
 drivers/net/wireless/realtek/rtw88/fw.c            |   11 +-
 drivers/net/wireless/realtek/rtw88/tx.c            |    2 +-
 drivers/net/wireless/realtek/rtw89/core.c          |    4 +-
 drivers/net/wireless/realtek/rtw89/pci.c           |   16 +-
 drivers/net/wireless/rsi/rsi_91x_hal.c             |    8 +
 drivers/net/wireless/rsi/rsi_91x_mgmt.c            |    8 +-
 drivers/net/wireless/ti/wlcore/main.c              |    4 +-
 drivers/net/wireless/virtual/mac80211_hwsim.c      |   45 +-
 drivers/net/wireless/virtual/virt_wifi.c           |    4 +-
 drivers/net/wwan/mhi_wwan_mbim.c                   |   28 +-
 drivers/net/wwan/t7xx/t7xx_netdev.c                |    4 +
 drivers/net/wwan/t7xx/t7xx_pci.c                   |    3 +
 drivers/nfc/microread/microread.c                  |    6 +-
 drivers/nfc/nfcmrvl/fw_dnld.c                      |   11 +-
 drivers/nfc/pn533/pn533.c                          |   14 +-
 drivers/nfc/pn533/pn533.h                          |    4 +-
 drivers/nfc/pn533/usb.c                            |    4 +-
 drivers/nfc/pn544/pn544.c                          |    7 +-
 drivers/nfc/port100.c                              |    7 +
 drivers/nfc/st21nfca/core.c                        |   12 +-
 drivers/nfc/st21nfca/i2c.c                         |   29 +-
 drivers/nfc/virtual_ncidev.c                       |    3 +-
 drivers/nvme/host/apple.c                          |  182 +-
 drivers/nvme/host/core.c                           |   64 +-
 drivers/nvme/host/fabrics.c                        |    6 +-
 drivers/nvme/host/fc.c                             |    7 +-
 drivers/nvme/host/rdma.c                           |   18 +-
 drivers/of/dynamic.c                               |   20 +-
 drivers/of/overlay.c                               |   15 +
 drivers/opp/of.c                                   |    2 +-
 drivers/pci/controller/dwc/pcie-intel-gw.c         |   19 +-
 drivers/pci/controller/pcie-altera.c               |    2 +
 drivers/pci/controller/pcie-iproc.c                |    2 +
 drivers/pci/controller/pcie-mediatek.c             |    2 +
 drivers/pci/controller/pcie-rockchip-host.c        |    2 +
 drivers/pci/of_property.c                          |   11 +-
 drivers/pci/pci-driver.c                           |   10 +-
 drivers/pci/pci-sysfs.c                            |   11 +-
 drivers/pci/pci.c                                  |   24 +-
 drivers/pci/proc.c                                 |   79 +-
 drivers/pci/quirks.c                               |    3 +
 drivers/pci/switch/switchtec.c                     |   16 +
 drivers/perf/arm-cmn.c                             |   10 +-
 drivers/phy/mediatek/phy-mtk-hdmi-mt8195.c         |    4 +-
 drivers/phy/mediatek/phy-mtk-hdmi-mt8195.h         |    3 +
 drivers/pinctrl/meson/pinctrl-meson-s4.c           |    2 +-
 drivers/pinctrl/pinctrl-single.c                   |    3 +-
 drivers/pinctrl/renesas/pinctrl-rzv2m.c            |    4 +-
 drivers/platform/x86/dell/dell-laptop.c            |    9 +
 drivers/platform/x86/intel/hid.c                   |    7 +
 drivers/ptp/ptp_ocp.c                              |    1 +
 drivers/regulator/core.c                           |  163 +-
 drivers/regulator/da9121-regulator.c               |   18 +-
 drivers/regulator/db8500-prcmu.c                   |   12 +-
 drivers/remoteproc/qcom_q6v5_adsp.c                |    8 +-
 drivers/rtc/rtc-aspeed.c                           |    1 +
 drivers/rtc/rtc-bq32k.c                            |    9 +
 drivers/s390/char/zcore.c                          |    8 +-
 drivers/s390/cio/chp.c                             |    3 +
 drivers/s390/cio/cio.c                             |   11 +-
 drivers/s390/cio/device.c                          |    9 +-
 drivers/s390/cio/device_fsm.c                      |    3 +
 drivers/s390/cio/device_ops.c                      |   23 +
 drivers/s390/cio/vfio_ccw_fsm.c                    |    2 +-
 drivers/s390/net/ism_drv.c                         |    4 +-
 drivers/s390/net/qeth_l2.h                         |    3 +-
 drivers/s390/net/qeth_l2_main.c                    |   26 +-
 drivers/s390/net/qeth_l2_sys.c                     |    7 +-
 drivers/scsi/bfa/bfa_fcs_lport.c                   |    2 +-
 drivers/scsi/libiscsi_tcp.c                        |    3 +
 drivers/scsi/megaraid/megaraid_sas_base.c          |    4 +-
 drivers/scsi/mpi3mr/mpi3mr_transport.c             |    8 +
 drivers/scsi/mpt3sas/mpt3sas_base.c                |    5 +-
 drivers/scsi/pm8001/pm8001_ctl.c                   |    8 +
 drivers/scsi/pm8001/pm80xx_hwi.c                   |    7 +
 drivers/scsi/qla2xxx/qla_os.c                      |    2 +-
 drivers/scsi/scsi.c                                |   24 +-
 drivers/scsi/scsi_error.c                          |    2 +-
 drivers/soc/ti/pm33xx.c                            |    2 +-
 drivers/soundwire/bus.c                            |    4 +
 drivers/soundwire/cadence_master.c                 |    7 +
 drivers/soundwire/dmi-quirks.c                     |   35 +
 drivers/soundwire/intel.c                          |   31 +-
 drivers/soundwire/intel_ace2x.c                    |   39 +-
 drivers/soundwire/slave.c                          |    4 +-
 drivers/spi/spi-dw-dma.c                           |    3 +-
 drivers/spi/spi-dw.h                               |    1 +
 drivers/spi/spi-qcom-qspi.c                        |   44 +-
 drivers/spi/spi-xilinx.c                           |    6 +-
 drivers/spi/spi-zynqmp-gqspi.c                     |   52 +-
 drivers/spi/spi.c                                  |    9 +-
 drivers/staging/fbtft/fbtft-core.c                 |    9 +-
 drivers/target/iscsi/iscsi_target.c                |    4 +-
 drivers/tee/optee/call.c                           |    3 +-
 drivers/thermal/db8500_thermal.c                   |   10 +-
 drivers/thermal/qcom/tsens.c                       |  111 +-
 drivers/thermal/qcom/tsens.h                       |    1 +
 drivers/thermal/tegra/soctherm.c                   |    6 +-
 drivers/thunderbolt/icm.c                          |   10 +
 drivers/thunderbolt/switch.c                       |    6 +
 drivers/thunderbolt/tb.c                           |    9 +-
 drivers/thunderbolt/tb_regs.h                      |    1 +
 drivers/thunderbolt/usb4.c                         |   11 +-
 drivers/thunderbolt/xdomain.c                      |   41 +-
 drivers/tty/serial/8250/8250_port.c                |    7 +
 drivers/usb/atm/xusbatm.c                          |    6 +-
 drivers/usb/class/cdc-acm.c                        |    6 +
 drivers/usb/class/usbtmc.c                         |    2 -
 drivers/usb/core/hcd.c                             |   14 +-
 drivers/usb/gadget/udc/aspeed_udc.c                |    7 +-
 drivers/usb/gadget/udc/core.c                      |    7 +-
 drivers/usb/gadget/udc/goku_udc.c                  |    3 +-
 drivers/usb/host/Kconfig                           |    2 +-
 drivers/usb/host/xhci-debugfs.c                    |   16 +-
 drivers/usb/host/xhci-hub.c                        |  117 +-
 drivers/usb/host/xhci-mem.c                        |   40 +-
 drivers/usb/host/xhci-pci.c                        |    8 +-
 drivers/usb/host/xhci-ring.c                       |   14 +-
 drivers/usb/host/xhci-tegra.c                      |   12 +-
 drivers/usb/host/xhci-trace.h                      |    5 +
 drivers/usb/host/xhci.c                            |   79 +-
 drivers/usb/host/xhci.h                            |   44 +-
 drivers/usb/serial/spcp8x5.c                       |    6 +-
 drivers/usb/usbip/vhci_sysfs.c                     |   52 +-
 drivers/vdpa/ifcvf/ifcvf_main.c                    |   14 +-
 drivers/vdpa/solidrun/snet_main.c                  |    6 +-
 drivers/vdpa/vdpa_sim/vdpa_sim_blk.c               |    3 +-
 drivers/vdpa/vdpa_sim/vdpa_sim_net.c               |    7 +-
 drivers/vhost/scsi.c                               |    3 +-
 drivers/vhost/vdpa.c                               |  106 +-
 drivers/video/fbdev/pm2fb.c                        |    1 +
 drivers/video/fbdev/vfb.c                          |   11 +-
 drivers/virtio/virtio_input.c                      |    9 +-
 drivers/virtio/virtio_pci_common.c                 |    4 +-
 drivers/virtio/virtio_vdpa.c                       |    2 +-
 drivers/watchdog/da9063_wdt.c                      |    4 +-
 drivers/watchdog/db8500_wdt.c                      |   22 +-
 drivers/watchdog/digicolor_wdt.c                   |   13 +-
 drivers/watchdog/msc313e_wdt.c                     |   88 +-
 drivers/watchdog/rtd119x_wdt.c                     |    7 +-
 drivers/watchdog/sp5100_tco.c                      |    6 +-
 drivers/watchdog/starfive-wdt.c                    |    2 +-
 drivers/watchdog/sunxi_wdt.c                       |   45 +-
 drivers/watchdog/watchdog_hrtimer_pretimeout.c     |    1 +
 drivers/xen/gntalloc.c                             |   13 +-
 drivers/xen/xen-front-pgdir-shbuf.c                |   12 +-
 fs/9p/vfs_dir.c                                    |   14 +-
 fs/affs/affs.h                                     |    5 -
 fs/affs/super.c                                    |    6 +-
 fs/autofs/inode.c                                  |    4 +
 fs/befs/linuxvfs.c                                 |    3 +-
 fs/bfs/inode.c                                     |    3 +-
 fs/btrfs/block-group.c                             |    3 +-
 fs/btrfs/btrfs_inode.h                             |    2 +-
 fs/btrfs/file.c                                    |   12 +-
 fs/btrfs/free-space-cache.c                        |   13 +-
 fs/btrfs/inode.c                                   |   42 +-
 fs/btrfs/ioctl.c                                   |   13 +-
 fs/btrfs/raid-stripe-tree.c                        |   19 +-
 fs/btrfs/raid-stripe-tree.h                        |    1 +
 fs/btrfs/reflink.c                                 |    3 +-
 fs/btrfs/relocation.c                              |   47 +-
 fs/btrfs/send.c                                    |    2 +-
 fs/btrfs/transaction.c                             |   13 +-
 fs/btrfs/tree-checker.c                            |   43 +-
 fs/btrfs/tree-log.c                                |   12 +-
 fs/btrfs/verity.c                                  |    4 +-
 fs/btrfs/volumes.c                                 |   10 +-
 fs/btrfs/xattr.c                                   |    4 +-
 fs/btrfs/zoned.c                                   |    2 +
 fs/cachefiles/namei.c                              |    1 -
 fs/configfs/dir.c                                  |   12 +-
 fs/erofs/fscache.c                                 |    2 +
 fs/exec.c                                          |   51 +-
 fs/f2fs/inline.c                                   |    7 +
 fs/freevxfs/vxfs_bmap.c                            |    3 +-
 fs/fs-writeback.c                                  |   25 +-
 fs/fuse/file.c                                     |    3 +-
 fs/gfs2/bmap.c                                     |   19 +
 fs/gfs2/bmap.h                                     |    1 +
 fs/gfs2/file.c                                     |   10 +
 fs/hfs/catalog.c                                   |    9 -
 fs/hfs/dir.c                                       |   28 +-
 fs/hfs/hfs.h                                       |    3 +-
 fs/hfs/hfs_fs.h                                    |    2 -
 fs/hfs/inode.c                                     |    4 -
 fs/hfsplus/catalog.c                               |   11 -
 fs/hfsplus/dir.c                                   |   28 +-
 fs/hfsplus/hfsplus_fs.h                            |    5 +-
 fs/hfsplus/inode.c                                 |   40 +-
 fs/hfsplus/super.c                                 |    2 -
 fs/hpfs/super.c                                    |    3 +-
 fs/inode.c                                         |   11 +-
 fs/isofs/inode.c                                   |    3 +-
 fs/jfs/super.c                                     |    3 +-
 fs/minix/inode.c                                   |    3 +-
 fs/nfs/nfs42proc.c                                 |   15 +-
 fs/ntfs3/dir.c                                     |    4 +-
 fs/ntfs3/fslog.c                                   |   28 +-
 fs/ntfs3/index.c                                   |   41 +-
 fs/ntfs3/super.c                                   |    8 +-
 fs/ntfs3/xattr.c                                   |    4 +-
 fs/ocfs2/namei.c                                   |    9 +-
 fs/ocfs2/xattr.c                                   |   13 +-
 fs/ocfs2/xattr.h                                   |    8 +-
 fs/omfs/inode.c                                    |    6 +-
 fs/qnx4/inode.c                                    |    3 +-
 fs/smb/client/cifsacl.c                            |   30 +-
 fs/smb/client/connect.c                            |   36 +-
 fs/smb/client/file.c                               |    5 +-
 fs/smb/client/misc.c                               |   36 +-
 fs/smb/client/readdir.c                            |    9 +-
 fs/smb/client/reparse.c                            |    5 +-
 fs/smb/client/smb2inode.c                          |   11 +
 fs/smb/client/smb2ops.c                            |   75 +-
 fs/smb/client/smb2pdu.c                            |   64 +-
 fs/smb/client/transport.c                          |   11 +-
 fs/smb/server/mgmt/share_config.c                  |   36 +-
 fs/smb/server/mgmt/user_session.c                  |   25 +-
 fs/smb/server/misc.c                               |   14 +-
 fs/smb/server/oplock.c                             |  221 ++-
 fs/smb/server/oplock.h                             |    2 +-
 fs/smb/server/server.c                             |    6 +
 fs/smb/server/smb2misc.c                           |    9 +-
 fs/smb/server/smb2pdu.c                            |  366 ++--
 fs/smb/server/smb2pdu.h                            |    1 +
 fs/smb/server/smbacl.c                             |   25 +-
 fs/smb/server/transport_ipc.c                      |   21 +-
 fs/smb/server/vfs.c                                |   46 +-
 fs/smb/server/vfs_cache.c                          |   28 +-
 fs/smb/server/vfs_cache.h                          |    8 +-
 fs/squashfs/xz_wrapper.c                           |    6 +-
 fs/ufs/cylinder.c                                  |   10 +
 fs/ufs/dir.c                                       |  122 +-
 fs/ufs/ialloc.c                                    |    2 +-
 fs/ufs/inode.c                                     |   42 +-
 fs/ufs/super.c                                     |   17 +-
 fs/xfs/scrub/agheader_repair.c                     |   39 +-
 fs/xfs/scrub/ialloc.c                              |    4 +
 fs/xfs/scrub/scrub.c                               |    3 +-
 fs/xfs/scrub/stats.c                               |   60 +-
 fs/xfs/scrub/stats.h                               |    4 +-
 fs/xfs/xfs_icache.c                                |    2 +-
 include/drm/drm_probe_helper.h                     |    2 +
 include/keys/request_key_auth-type.h               |    2 +-
 include/linux/bitfield.h                           |    2 +-
 include/linux/bpf.h                                |    2 +
 include/linux/dev_printk.h                         |    1 +
 include/linux/firmware/intel/stratix10-smc.h       |   18 +-
 include/linux/fwnode.h                             |    1 +
 include/linux/ipv6.h                               |   35 +-
 include/linux/kcsan-checks.h                       |    6 +-
 include/linux/mailbox_controller.h                 |    2 +
 include/linux/mfd/db8500-prcmu.h                   |  252 ++-
 include/linux/mfd/dbx500-prcmu.h                   |  575 -------
 include/linux/netdevice.h                          |   28 +-
 include/linux/perf_event.h                         |    5 +
 include/linux/rculist.h                            |   29 +
 include/linux/rtnetlink.h                          |    7 +
 include/linux/skbuff.h                             |    5 +-
 include/linux/switchtec.h                          |    1 +
 include/linux/thunderbolt.h                        |    2 +
 include/linux/vdpa.h                               |   41 +-
 include/linux/workqueue.h                          |   41 +-
 include/media/v4l2-hevc.h                          |   41 +
 include/net/cfg80211.h                             |    2 +-
 include/net/cfg802154.h                            |    1 +
 include/net/gue.h                                  |   19 +-
 include/net/if_inet6.h                             |    2 -
 include/net/inet_sock.h                            |    1 +
 include/net/ip.h                                   |    3 +-
 include/net/ip6_route.h                            |    2 +
 include/net/ip_fib.h                               |    5 +
 include/net/ipv6.h                                 |    4 +-
 include/net/mac80211.h                             |    9 +-
 include/net/netfilter/nf_conntrack.h               |    5 +
 include/net/netfilter/nf_tables.h                  |    3 -
 include/net/netns/nftables.h                       |    1 +
 include/net/netns/xfrm.h                           |    2 +-
 include/net/nfc/hci.h                              |    2 +-
 include/net/nfc/nfc.h                              |    3 +-
 include/net/sch_generic.h                          |    2 +-
 include/net/sock.h                                 |    2 +-
 include/net/udp_tunnel.h                           |    7 +-
 include/rdma/ib_umem.h                             |    4 +-
 include/sound/hda_codec.h                          |   30 +
 include/sound/rawmidi.h                            |    2 +
 include/trace/events/icmp.h                        |   13 +-
 include/uapi/linux/vhost_types.h                   |    7 +
 include/uapi/linux/virtio_crypto.h                 |    1 +
 include/uapi/sound/asound.h                        |    6 +-
 kernel/bpf/bpf_iter.c                              |    2 +-
 kernel/bpf/btf.c                                   |   22 +-
 kernel/bpf/cgroup.c                                |    1 +
 kernel/bpf/disasm.c                                |    5 +-
 kernel/bpf/hashtab.c                               |   24 +-
 kernel/bpf/helpers.c                               |   58 +-
 kernel/bpf/offload.c                               |    2 +
 kernel/bpf/syscall.c                               |    5 +-
 kernel/bpf/verifier.c                              |   15 +-
 kernel/dma/coherent.c                              |   13 +-
 kernel/events/ring_buffer.c                        |    9 +-
 kernel/locking/lockdep.c                           |   50 +-
 kernel/rcu/tasks.h                                 |    3 +-
 kernel/sched/fair.c                                |   11 +-
 kernel/time/clockevents.c                          |   35 +-
 kernel/time/tick-broadcast.c                       |   36 +-
 kernel/time/tick-internal.h                        |    2 +
 kernel/trace/Makefile                              |    5 +-
 kernel/trace/bpf_trace.c                           |   11 +
 kernel/trace/ring_buffer.c                         |   13 +-
 kernel/trace/trace_event_perf.c                    |   12 +-
 kernel/trace/trace_events_hist.c                   |   53 +-
 kernel/trace/trace_events_user.c                   |   26 +-
 kernel/trace/trace_probe.c                         |   48 +-
 kernel/trace/trace_probe.h                         |    2 +
 kernel/workqueue.c                                 |    7 +-
 mm/backing-dev.c                                   |    5 +-
 mm/damon/core.c                                    |   13 +-
 mm/huge_memory.c                                   |   10 +
 mm/memblock.c                                      |   18 +-
 mm/mlock.c                                         |    2 +-
 net/8021q/vlan.c                                   |   23 -
 net/8021q/vlan.h                                   |    2 +
 net/8021q/vlan_dev.c                               |   61 +-
 net/9p/client.c                                    |    2 +-
 net/appletalk/aarp.c                               |    5 +
 net/atm/pppoatm.c                                  |   42 +-
 net/bluetooth/bnep/core.c                          |   17 +-
 net/bluetooth/bnep/netdev.c                        |    8 +-
 net/bluetooth/eir.c                                |   10 +-
 net/bluetooth/hci_codec.c                          |   36 +-
 net/bluetooth/hci_conn.c                           |   14 +-
 net/bluetooth/hci_core.c                           |    4 +-
 net/bluetooth/hci_sock.c                           |   20 +-
 net/bluetooth/hci_sync.c                           |    2 +
 net/bluetooth/iso.c                                |   32 +-
 net/bluetooth/l2cap_core.c                         |   28 +-
 net/bluetooth/mgmt.c                               |   27 +-
 net/bluetooth/msft.c                               |    2 +-
 net/bluetooth/rfcomm/core.c                        |    6 +
 net/bluetooth/rfcomm/sock.c                        |   19 +-
 net/bluetooth/smp.c                                |   17 +
 net/bridge/br_arp_nd_proxy.c                       |   16 +-
 net/bridge/br_device.c                             |    2 +-
 net/bridge/br_fdb.c                                |    7 +-
 net/bridge/br_input.c                              |    2 +-
 net/bridge/br_mst.c                                |   20 +-
 net/bridge/br_multicast.c                          |   11 +-
 net/bridge/br_stp_bpdu.c                           |    5 +-
 net/core/dev.c                                     |   68 +-
 net/core/drop_monitor.c                            |   22 +-
 net/core/filter.c                                  |   67 +-
 net/core/skbuff.c                                  |   16 +-
 net/core/skmsg.c                                   |    4 +
 net/core/sock.c                                    |   13 +-
 net/core/sock_map.c                                |    1 +
 net/dccp/ipv6.c                                    |    2 +-
 net/hsr/hsr_forward.c                              |    2 +-
 net/hsr/hsr_netlink.c                              |    9 +-
 net/ieee802154/6lowpan/core.c                      |    2 +-
 net/ipv4/arp.c                                     |    1 +
 net/ipv4/esp4.c                                    |    6 +
 net/ipv4/fib_rules.c                               |    4 +-
 net/ipv4/fib_trie.c                                |    4 +
 net/ipv4/fou_core.c                                |    6 +-
 net/ipv4/icmp.c                                    |   17 +-
 net/ipv4/inet_connection_sock.c                    |    3 +-
 net/ipv4/inet_fragment.c                           |    6 +
 net/ipv4/ip_gre.c                                  |   12 +
 net/ipv4/ip_tunnel_core.c                          |    6 +
 net/ipv4/nexthop.c                                 |    2 +-
 net/ipv4/sysctl_net_ipv4.c                         |    4 +-
 net/ipv4/tcp_input.c                               |    3 +-
 net/ipv4/tcp_output.c                              |    3 +
 net/ipv4/udp.c                                     |    4 +-
 net/ipv6/addrconf.c                                |   13 +-
 net/ipv6/af_inet6.c                                |    2 +-
 net/ipv6/esp6.c                                    |    6 +
 net/ipv6/exthdrs.c                                 |    4 +-
 net/ipv6/exthdrs_core.c                            |    3 +
 net/ipv6/ip6_fib.c                                 |    4 +-
 net/ipv6/ip6_gre.c                                 |    8 +-
 net/ipv6/ip6_output.c                              |   23 +-
 net/ipv6/ip6_udp_tunnel.c                          |   37 +-
 net/ipv6/ipv6_sockglue.c                           |   90 +-
 net/ipv6/mcast.c                                   |  273 +--
 net/ipv6/ndisc.c                                   |    4 +-
 net/ipv6/netfilter/ip6_tables.c                    |    5 +
 net/ipv6/netfilter/ip6t_rpfilter.c                 |    2 +-
 net/ipv6/netfilter/ip6t_rt.c                       |   11 +-
 net/ipv6/route.c                                   |   22 +-
 net/ipv6/seg6.c                                    |    4 +-
 net/ipv6/seg6_local.c                              |    3 +
 net/ipv6/tcp_ipv6.c                                |    6 +-
 net/ipv6/xfrm6_output.c                            |   10 +-
 net/llc/llc_c_ac.c                                 |    2 +-
 net/llc/llc_s_ac.c                                 |    4 +
 net/llc/llc_sap.c                                  |    8 +-
 net/mac80211/cfg.c                                 |   14 +-
 net/mac80211/debugfs.c                             |    2 +-
 net/mac80211/debugfs_netdev.c                      |    9 +
 net/mac80211/ieee80211_i.h                         |    7 +-
 net/mac80211/iface.c                               |   31 +-
 net/mac80211/main.c                                |    4 +
 net/mac80211/mesh.c                                |    1 -
 net/mac80211/mlme.c                                |    6 +-
 net/mac80211/pm.c                                  |    8 +-
 net/mac80211/status.c                              |    4 +-
 net/mac80211/tdls.c                                |   19 +-
 net/mac80211/tx.c                                  |   46 +-
 net/mac802154/ieee802154_i.h                       |    8 +
 net/mac802154/iface.c                              |    6 +
 net/mac802154/main.c                               |    1 +
 net/mac802154/rx.c                                 |  120 +-
 net/mac802154/scan.c                               |   10 +-
 net/mptcp/options.c                                |    3 +-
 net/mptcp/protocol.c                               |   15 +-
 net/mptcp/protocol.h                               |    3 +-
 net/mptcp/subflow.c                                |   12 +-
 net/mptcp/syncookies.c                             |    5 +-
 net/netfilter/ipset/ip_set_hash_gen.h              |   13 +-
 net/netfilter/ipvs/ip_vs_core.c                    |    6 +
 net/netfilter/ipvs/ip_vs_sync.c                    |   30 +-
 net/netfilter/nf_conntrack_expect.c                |    3 +-
 net/netfilter/nf_conntrack_netlink.c               |   16 +-
 net/netfilter/nf_conntrack_proto_tcp.c             |   10 +-
 net/netfilter/nf_conntrack_sip.c                   |    2 +-
 net/netfilter/nf_flow_table_core.c                 |   12 +-
 net/netfilter/nf_flow_table_offload.c              |    7 +-
 net/netfilter/nf_log_syslog.c                      |    6 +-
 net/netfilter/nf_tables_api.c                      |  151 +-
 net/netfilter/nfnetlink_log.c                      |   28 +-
 net/netfilter/nfnetlink_queue.c                    |   77 +-
 net/netfilter/nft_chain_filter.c                   |   50 +-
 net/netfilter/nft_nat.c                            |    2 +-
 net/netfilter/nft_set_pipapo_avx2.c                |    1 +
 net/netfilter/nft_set_rbtree.c                     |    2 -
 net/netfilter/nft_synproxy.c                       |    3 +-
 net/netlabel/netlabel_unlabeled.c                  |    2 +-
 net/netlink/genetlink.c                            |    8 +-
 net/nfc/core.c                                     |   15 +-
 net/nfc/digital_dep.c                              |    8 +-
 net/nfc/llcp.h                                     |    1 +
 net/nfc/llcp_commands.c                            |    2 +-
 net/nfc/llcp_core.c                                |  173 +-
 net/nfc/llcp_sock.c                                |   67 +-
 net/nfc/nci/core.c                                 |   10 +-
 net/nfc/netlink.c                                  |    7 +-
 net/nfc/nfc.h                                      |    3 +-
 net/openvswitch/conntrack.c                        |   14 +-
 net/openvswitch/flow.c                             |    4 +-
 net/openvswitch/flow_table.c                       |    4 +-
 net/packet/af_packet.c                             |  108 +-
 net/packet/internal.h                              |    2 +-
 net/phonet/pn_dev.c                                |   30 +-
 net/qrtr/af_qrtr.c                                 |    4 +-
 net/rds/af_rds.c                                   |   63 +-
 net/rds/connection.c                               |  102 +-
 net/rds/ib_cm.c                                    |   27 +-
 net/rds/ib_frmr.c                                  |   11 +-
 net/rds/ib_recv.c                                  |    9 +-
 net/rds/message.c                                  |    4 +-
 net/rds/send.c                                     |   16 +-
 net/rds/tcp.c                                      |  164 +-
 net/rds/tcp_listen.c                               |    6 +-
 net/sched/act_api.c                                |  136 +-
 net/sched/act_csum.c                               |    8 +-
 net/sched/act_ct.c                                 |    5 +-
 net/sched/act_gate.c                               |   30 +-
 net/sched/cls_api.c                                |    2 +-
 net/sched/cls_route.c                              |  101 +-
 net/sched/cls_u32.c                                |   44 +-
 net/sched/sch_api.c                                |    2 +-
 net/sched/sch_drr.c                                |   13 +-
 net/sched/sch_ets.c                                |   12 +-
 net/sched/sch_fq_pie.c                             |   62 +-
 net/sched/sch_generic.c                            |   24 +-
 net/sched/sch_hfsc.c                               |   22 +
 net/sched/sch_hhf.c                                |   15 +-
 net/sched/sch_pie.c                                |    2 +-
 net/sched/sch_sfq.c                                |    7 +-
 net/sched/sch_teql.c                               |    7 +-
 net/sctp/associola.c                               |   15 +-
 net/sctp/input.c                                   |    7 +-
 net/sctp/ipv6.c                                    |   12 +-
 net/sctp/protocol.c                                |   10 +-
 net/sctp/sm_make_chunk.c                           |   14 +-
 net/sctp/sm_sideeffect.c                           |   48 +-
 net/sctp/sm_statefuns.c                            |    7 +
 net/smc/smc_core.c                                 |    2 +
 net/smc/smc_ib.c                                   |   10 +-
 net/sunrpc/xprtrdma/verbs.c                        |   21 +-
 net/tipc/group.c                                   |    4 +-
 net/tipc/monitor.c                                 |    3 +-
 net/tipc/name_table.c                              |   32 +-
 net/tipc/socket.c                                  |    4 +-
 net/tls/tls_main.c                                 |   11 +
 net/tls/tls_sw.c                                   |   18 +-
 net/unix/af_unix.c                                 |   42 +-
 net/unix/garbage.c                                 |    1 +
 net/vmw_vsock/hyperv_transport.c                   |    2 +-
 net/vmw_vsock/vmci_transport.c                     |    2 +-
 net/wireless/mlme.c                                |  105 +-
 net/wireless/nl80211.c                             |    8 +-
 net/wireless/scan.c                                |   12 +-
 net/wireless/util.c                                |   26 +-
 net/wireless/wext-sme.c                            |    9 +
 net/xdp/xskmap.c                                   |    2 +-
 net/xfrm/espintcp.c                                |    6 +-
 net/xfrm/xfrm_input.c                              |   11 +
 net/xfrm/xfrm_state.c                              |    5 +
 net/xfrm/xfrm_user.c                               |   37 +-
 scripts/mod/modpost.c                              |   11 +-
 scripts/sorttable.c                                |    2 +-
 security/apparmor/lsm.c                            |    4 +-
 security/apparmor/policy.c                         |   13 +-
 security/apparmor/policy_unpack.c                  |    2 +
 security/integrity/digsig_asymmetric.c             |    4 +
 security/integrity/ima/ima_appraise.c              |    5 +
 security/keys/gc.c                                 |    4 +-
 security/keys/request_key_auth.c                   |   12 +-
 security/keys/trusted-keys/trusted_tpm2.c          |   12 +-
 security/selinux/avc.c                             |    5 +-
 security/selinux/hooks.c                           |  158 +-
 security/selinux/include/objsec.h                  |   10 +-
 sound/core/pcm_native.c                            |   35 +-
 sound/core/pcm_timer.c                             |    7 +-
 sound/core/rawmidi.c                               |    4 +
 sound/core/seq/oss/seq_oss_rw.c                    |    3 +-
 sound/core/ump.c                                   |   94 +-
 sound/hda/ext/hdac_ext_controller.c                |    6 +-
 sound/hda/hdac_bus.c                               |    8 +-
 sound/hda/hdac_component.c                         |    6 +-
 sound/hda/hdac_device.c                            |   28 +-
 sound/hda/hdac_regmap.c                            |   35 +-
 sound/isa/es18xx.c                                 |    4 +
 sound/pci/ctxfi/cthw20k2.c                         |    1 +
 sound/pci/hda/hda_codec.c                          |  119 +-
 sound/pci/hda/hda_controller.c                     |   26 +-
 sound/pci/hda/hda_proc.c                           |    4 +-
 sound/pci/hda/hda_sysfs.c                          |   77 +-
 sound/pci/hda/patch_conexant.c                     |   12 +
 sound/pci/hda/patch_realtek.c                      |   44 +
 sound/soc/amd/renoir/acp3x-pdm-dma.c               |    2 +-
 sound/soc/amd/yc/acp6x-mach.c                      |   21 +
 sound/soc/amd/yc/acp6x-pdm-dma.c                   |    2 +
 sound/soc/bcm/bcm63xx-i2s-whistler.c               |    1 +
 sound/soc/codecs/ab8500-codec.c                    |  543 +++---
 sound/soc/codecs/hdmi-codec.c                      |    6 +-
 sound/soc/codecs/mt6351.c                          |    1 +
 sound/soc/codecs/pcm3168a.c                        |   20 +-
 sound/soc/codecs/rk3328_codec.c                    |   54 +-
 sound/soc/codecs/rt5645.c                          |    4 +
 sound/soc/codecs/rt712-sdca-dmic.c                 |   14 +-
 sound/soc/intel/atom/sst/sst_pci.c                 |    1 +
 sound/soc/intel/avs/core.c                         |   11 +-
 sound/soc/intel/catpt/ipc.c                        |    8 +
 sound/soc/intel/catpt/loader.c                     |    3 +
 sound/soc/intel/catpt/registers.h                  |   12 +
 sound/soc/meson/aiu-acodec-ctrl.c                  |    3 +
 sound/soc/meson/aiu-codec-ctrl.c                   |    3 +
 sound/soc/qcom/qdsp6/q6apm.c                       |   10 +-
 sound/soc/rockchip/rockchip_pdm.c                  |   16 +-
 sound/soc/rockchip/rockchip_spdif.c                |    1 +
 sound/soc/soc-topology.c                           |   37 +-
 sound/soc/sprd/sprd-pcm-compress.c                 |   15 +-
 sound/soc/sti/uniperif_reader.c                    |    4 +-
 sound/soc/ti/omap3pandora.c                        |    5 +-
 sound/soc/ux500/ux500_msp_dai.c                    |  132 +-
 sound/soc/ux500/ux500_msp_dai.h                    |   11 -
 sound/soc/ux500/ux500_msp_i2s.c                    |  260 ++-
 sound/soc/ux500/ux500_msp_i2s.h                    |   16 +-
 sound/usb/6fire/chip.c                             |   40 +-
 sound/usb/6fire/comm.c                             |   42 +-
 sound/usb/6fire/comm.h                             |    2 +-
 sound/usb/6fire/midi.c                             |   64 +-
 sound/usb/6fire/midi.h                             |    2 +-
 sound/usb/6fire/pcm.c                              |  221 +--
 sound/usb/6fire/pcm.h                              |    5 +-
 sound/usb/bcd2000/bcd2000.c                        |   33 +-
 sound/usb/caiaq/audio.c                            |   10 +-
 sound/usb/caiaq/device.c                           |   53 +-
 sound/usb/caiaq/device.h                           |    4 +-
 sound/usb/caiaq/input.c                            |    6 +
 sound/usb/caiaq/midi.c                             |    6 +-
 sound/usb/mixer.c                                  |   17 +-
 sound/usb/mixer_maps.c                             |   25 +
 sound/usb/quirks-table.h                           |   22 +
 sound/usb/quirks.c                                 |    4 +
 sound/usb/usx2y/us122l.c                           |    9 +-
 sound/usb/usx2y/usbusx2y.c                         |   45 +-
 sound/usb/usx2y/usbusx2y.h                         |    4 +-
 sound/virtio/virtio_card.c                         |    4 +-
 tools/build/feature/test-bpf.c                     |    2 +
 tools/include/nolibc/crt.h                         |    2 +-
 tools/lib/bpf/bpf.c                                |    2 +
 tools/lib/bpf/gen_loader.c                         |    2 +
 tools/lib/bpf/libbpf.c                             |    7 +
 tools/lib/bpf/relo_core.c                          |   58 +-
 tools/perf/tests/shell/stat_bpf_counters.sh        |   30 +-
 tools/perf/util/evsel.c                            |    4 +
 tools/testing/selftests/alsa/mixer-test.c          |    4 +-
 .../selftests/arm64/mte/check_gcr_el1_cswitch.c    |    2 +-
 tools/testing/selftests/bpf/config                 |    1 +
 tools/testing/selftests/bpf/prog_tests/bpf_nf.c    |    7 +
 tools/testing/selftests/bpf/progs/test_bpf_nf.c    |  112 +-
 tools/testing/selftests/cgroup/cgroup_util.c       |   82 +-
 tools/testing/selftests/cgroup/cgroup_util.h       |    8 +-
 tools/testing/selftests/cgroup/test_kmem.c         |    2 +-
 tools/testing/selftests/cgroup/test_memcontrol.c   |   78 +
 .../ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc |    2 +-
 tools/testing/selftests/landlock/fs_test.c         | 1746 +++++++++++++++++++-
 tools/testing/selftests/mm/cow.c                   |  338 ++--
 tools/testing/selftests/nci/nci_dev.c              |   45 +-
 tools/testing/selftests/net/fib_nexthops.sh        |   28 +
 tools/testing/selftests/net/mptcp/mptcp_connect.c  |    4 +-
 tools/testing/selftests/net/pmtu.sh                |    2 +-
 tools/testing/selftests/net/test_vxlan_mdb.sh      |    6 +
 tools/testing/selftests/powerpc/tm/tm.h            |    8 +-
 tools/thermal/tmon/tui.c                           |    2 +-
 1071 files changed, 14700 insertions(+), 7671 deletions(-)

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Abdifatah Suruur <[email protected]>

commit 0e753899627b5e28a9fea8bca98262a6f65a2452 upstream.

smb2_oplock_break_noti() reads opinfo->conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check() clears opinfo->conn and drops its conn reference under ci->m_lock, and the last ksmbd_conn_put() frees the connection. A break triggered by another connection that races with the teardown can then resurrect the freed connection: ksmbd_conn_get() is a plain atomic_inc, and the queued break work later dereferences the stale conn via ksmbd_conn_write(), a use-after-free reachable by any authenticated client holding a durable batch oplock.

Thread the caller's inode into the notification path instead of taking a new reference on it. Every caller of oplock_break() already holds a live ksmbd_file (or an explicit ksmbd_inode_lookup_lock() reference, in the parent lease break paths) on the inode that owns the break target's oplock list, so ci cannot be freed during the call, and its lock can be taken without dereferencing opinfo->o_fp, which a concurrent close may free. Select and pin the connection under ci->m_lock, the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update opinfo->conn, so a concurrent detach either loses the race to the clear or keeps the connection alive until the notification work releases it. Transfer the reference to the work item and release it on allocation failures.

[ This tree predates the deferred break machinery
(oplock_break_add()/oplock_break_drain_none()) that the original commit is layered on, so it is ported in the same patch: the three walks that hold ci->m_lock (smb_send_parent_lease_break_noti(), smb_lazy_parent_lease_break_close(), smb_break_all_levII_oplock()) collect the breaks and drain them after releasing the lock, and every oplock_break() call site runs outside ci->m_lock, so smb2_oplock_break_conn_get() takes the read lock itself, as in the 6.18.y backport. ]

---
 fs/smb/server/oplock.c | 118 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 104 insertions(+), 14 deletions(-)

index 6f595756c41fd..296eb3db37355 100644
@@ -708,31 +708,67 @@ static void __smb2_oplock_break_noti(struct work_struct *wk)
 	ksmbd_conn_put(conn);
 }
 
+/*
+ * Select and pin the connection used for an oplock break before doing any
+ * allocations which may sleep.  The caller of oplock_break() holds a live
+ * reference on ci (a file being opened, a file being operated on, or an
+ * explicit ksmbd_inode_lookup_lock() reference in the parent lease break
+ * paths), so the inode cannot be freed during the call.
+ *
+ * opinfo->conn is cleared under ci->m_lock by session_fd_check() when the
+ * durable handle owning the oplock is disconnected, reassigned by
+ * ksmbd_reopen_durable_fd() under the same lock, and the last
+ * ksmbd_conn_put() of the old connection frees it.  Holding the read lock
+ * excludes both writers, so the connection cannot be freed while it is
+ * selected.
+ */
+static struct ksmbd_conn *smb2_oplock_break_conn_get(struct oplock_info *opinfo,
+						     struct ksmbd_inode *ci)
+{
+	struct ksmbd_conn *conn;
+
+	down_read(&ci->m_lock);
+	conn = READ_ONCE(opinfo->conn);
+	if (conn && !ksmbd_conn_releasing(conn))
+		conn = ksmbd_conn_get(conn);
+	else
+		conn = NULL;
+	up_read(&ci->m_lock);
+
+	return conn;
+}
+
 /**
  * smb2_oplock_break_noti() - send smb2 exclusive/batch to level2 oplock
  *		break command from server to client
  * @opinfo:		oplock info object
+ * @ci:		inode owning the break target's oplock list, pinned by
+ *		the caller
  *
  * Return:      0 on success, otherwise error
  */
-static int smb2_oplock_break_noti(struct oplock_info *opinfo)
+static int smb2_oplock_break_noti(struct oplock_info *opinfo,
+				  struct ksmbd_inode *ci)
 {
 	struct ksmbd_conn *conn;
 	struct oplock_break_info *br_info;
 	int ret = 0;
 	struct ksmbd_work *work;
 
-	conn = READ_ONCE(opinfo->conn);
+	conn = smb2_oplock_break_conn_get(opinfo, ci);
 	if (!conn)
 		return 0;
 
 	work = ksmbd_alloc_work_struct();
-	if (!work)
+	if (!work) {
+		ksmbd_conn_put(conn);
 		return -ENOMEM;
+	}
 
 	br_info = kmalloc(sizeof(struct oplock_break_info), GFP_KERNEL);
 	if (!br_info) {
 		ksmbd_free_work_struct(work);
+		ksmbd_conn_put(conn);
 		return -ENOMEM;
 	}
 

@@ -741,7 +777,8 @@ static int smb2_oplock_break_noti(struct oplock_info *opinfo)
 	br_info->open_trunc = opinfo->open_trunc;
 
 	work->request_buf = (char *)br_info;
-	work->conn = ksmbd_conn_get(conn);
+	/* Transfer the reference acquired by smb2_oplock_break_conn_get(). */
+	work->conn = conn;
 	work->sess = opinfo->sess;
 
 	ksmbd_conn_r_count_inc(conn);

@@ -890,8 +927,8 @@ static void wait_lease_breaking(struct oplock_info *opinfo)
 	}
 }
 
-static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level,
-			struct ksmbd_work *in_work)
+static int oplock_break(struct oplock_info *brk_opinfo, struct ksmbd_inode *ci,
+			int req_op_level, struct ksmbd_work *in_work)
 {
 	int err = 0;
 

@@ -957,7 +994,7 @@ static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level,
 	if (brk_opinfo->is_lease)
 		err = smb2_lease_break_noti(brk_opinfo);
 	else
-		err = smb2_oplock_break_noti(brk_opinfo);
+		err = smb2_oplock_break_noti(brk_opinfo, ci);
 
 	ksmbd_debug(OPLOCK, "oplock granted = %d\n", brk_opinfo->level);
 	if (brk_opinfo->op_state == OPLOCK_CLOSING)

@@ -969,6 +1006,43 @@ static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level,
 	return err;
 }
 
+struct oplock_break_entry {
+	struct list_head	list;
+	struct oplock_info	*opinfo;
+};
+
+/*
+ * Collect an oplock for a deferred break.  oplock_break() may block for
+ * the client's break acknowledgment, and the close that wakes that wait
+ * needs ci->m_lock for write, so the walks that hold ci->m_lock defer the
+ * break until the lock is released.
+ */
+static int oplock_break_add(struct list_head *head, struct oplock_info *opinfo)
+{
+	struct oplock_break_entry *ent;
+
+	ent = kmalloc(sizeof(*ent), GFP_KERNEL);
+	if (!ent)
+		return -ENOMEM;
+
+	ent->opinfo = opinfo;
+	list_add_tail(&ent->list, head);
+	return 0;
+}
+
+static void oplock_break_drain_none(struct list_head *head,
+				    struct ksmbd_inode *ci)
+{
+	struct oplock_break_entry *ent, *tmp;
+
+	list_for_each_entry_safe(ent, tmp, head, list) {
+		oplock_break(ent->opinfo, ci, SMB2_OPLOCK_LEVEL_NONE, NULL);
+		list_del(&ent->list);
+		opinfo_put(ent->opinfo);
+		kfree(ent);
+	}
+}
+
 void destroy_lease_table(struct ksmbd_conn *conn)
 {
 	struct lease_table *lb, *lbtmp;

@@ -1112,6 +1186,7 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp,
 {
 	struct oplock_info *opinfo;
 	struct ksmbd_inode *p_ci = NULL;
+	LIST_HEAD(brk_list);
 
 	if (lctx->version != 2)
 		return;

@@ -1137,12 +1212,14 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp,
 				continue;
 			}
 
-			oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL);
-			opinfo_put(opinfo);
+			if (oplock_break_add(&brk_list, opinfo))
+				opinfo_put(opinfo);
 		}
 	}
 	up_read(&p_ci->m_lock);
 
+	oplock_break_drain_none(&brk_list, p_ci);
+
 	ksmbd_inode_put(p_ci);
 }
 

@@ -1150,6 +1227,7 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp)
 {
 	struct oplock_info *opinfo;
 	struct ksmbd_inode *p_ci = NULL;
+	LIST_HEAD(brk_list);
 
 	rcu_read_lock();
 	opinfo = rcu_dereference(fp->f_opinfo);

@@ -1178,12 +1256,14 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp)
 				continue;
 			}
 
-			oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL);
-			opinfo_put(opinfo);
+			if (oplock_break_add(&brk_list, opinfo))
+				opinfo_put(opinfo);
 		}
 	}
 	up_read(&p_ci->m_lock);
 
+	oplock_break_drain_none(&brk_list, p_ci);
+
 	ksmbd_inode_put(p_ci);
 }
 

@@ -1280,7 +1360,7 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid,
 		goto op_break_not_needed;
 	}
 
-	err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II, work);
+	err = oplock_break(prev_opinfo, fp->f_ci, SMB2_OPLOCK_LEVEL_II, work);
 	opinfo_put(prev_opinfo);
 	if (err == -ENOENT)
 		goto set_lev;

@@ -1366,7 +1446,7 @@ static void smb_break_all_write_oplock(struct ksmbd_work *work,
 	}
 
 	brk_opinfo->open_trunc = is_trunc;
-	oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II, work);
+	oplock_break(brk_opinfo, fp->f_ci, SMB2_OPLOCK_LEVEL_II, work);
 	opinfo_put(brk_opinfo);
 }
 

@@ -1383,6 +1463,7 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp,
 	struct oplock_info *op, *brk_op;
 	struct ksmbd_inode *ci;
 	struct ksmbd_conn *conn = work->conn;
+	LIST_HEAD(brk_list);
 
 	if (!test_share_config_flag(work->tcon->share_conf,
 				    KSMBD_SHARE_FLAG_OPLOCKS))

@@ -1430,12 +1511,21 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp,
 			    SMB2_LEASE_KEY_SIZE))
 			goto next;
 		brk_op->open_trunc = is_trunc;
-		oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE, NULL);
+
+		/*
+		 * Defer the break until ci->m_lock is released: oplock_break()
+		 * may block waiting for the break acknowledgment, and the
+		 * close that wakes that wait needs ci->m_lock for write.
+		 */
+		if (!oplock_break_add(&brk_list, brk_op))
+			continue;
 next:
 		opinfo_put(brk_op);
 	}
 	up_read(&ci->m_lock);
 
+	oplock_break_drain_none(&brk_list, ci);
+
 	if (op)
 		opinfo_put(op);
 }

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Boris Brezillon <[email protected]>

[ Upstream commit 71c8224a18825102ee1e5e70498f96f6c2d2a81d ]

If the object wasn't moved to a different LRU after the shrink callback returns, it means the buffer is still reclaimable. Update the remaining counter to reflect that.

v2:
- Collect R-b

v3:
- Collect R-b

v4:
- No changes

v5:
- No changes

v6:
- No changes

v7:
- No changes

---
 drivers/gpu/drm/drm_gem.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

index a3370c77e949d..4476f44f2badb 100644
@@ -1519,6 +1519,16 @@ drm_gem_lru_scan(struct drm_gem_lru *lru,
 			 */
 			WARN_ON(obj->lru == &still_in_lru);
 			WARN_ON(obj->lru == lru);
+		} else if (obj->lru == &still_in_lru) {
+			/*
+			 * If the object wasn't moved and wasn't shrunk either,
+			 * it's still remaining as reclaimable. Note that
+			 * obj->lru is supposed to be checked with the LRU lock
+			 * held for an accurate result, but we don't care about
+			 * accuracy here. Worst thing that could happen is an
+			 * extra scan.
+			 */
+			*remaining += obj->size >> PAGE_SHIFT;
 		}
 
 		dma_resv_unlock(obj->resv);

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ioana Ciornei <[email protected]>

[ Upstream commit 208858b1b48eba83d073542372329cf8ed606526 ]

There are use cases in which the Management Complex firmware boot process is started by the bootloader which does not wait for the boot to complete. This is mainly done in order to reduce the overall boot time of a DPAA2 based SoC.

In this kind of circumstance, the fsl-mc bus driver needs to make sure that the MC firmware boot process is finished before proceeding to the usual operations such as interrogating the firmware to gather all existent DPAA2 objects, creating the fsl-mc devices on the bus etc.

Add this kind of check early in the boot process of the fsl-mc bus and defer the probe in case the firmware is still in its boot process.

---
 drivers/bus/fsl-mc/fsl-mc-bus.c | 46 +++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

index 56f5c24c367c0..b5a1daed1ea41 100644
@@ -66,6 +66,13 @@ struct fsl_mc_addr_translation_range {
 #define GCR1_P1_STOP	BIT(31)
 #define GCR1_P2_STOP	BIT(30)
 
+#define FSL_MC_GSR		0x8
+#define FSL_MC_GSR_BOOT_DONE	BIT(0)
+#define FSL_MC_GSR_MCS_MASK	GENMASK(7, 0)
+#define FSL_MC_GSR_MCS_ERR_MASK	GENMASK(7, 1)
+#define FSL_MC_GSR_BC_MASK	GENMASK(15, 8)
+#define FSL_MC_GSR_BC_SHIFT	8
+
 #define FSL_MC_FAPR	0x28
 #define MC_FAPR_PL	BIT(18)
 #define MC_FAPR_BMT	BIT(17)

@@ -1035,6 +1042,41 @@ static int get_mc_addr_translation_ranges(struct device *dev,
 	return 0;
 }
 
+static u32 fsl_mc_read_gsr(struct fsl_mc *mc)
+{
+	return readl(mc->fsl_mc_regs + FSL_MC_GSR);
+}
+
+static int fsl_mc_firmware_check(struct platform_device *pdev)
+{
+	struct fsl_mc *mc = platform_get_drvdata(pdev);
+	u32 gsr, boot_done, boot_code, mcs;
+
+	gsr = fsl_mc_read_gsr(mc);
+	boot_code = (gsr & FSL_MC_GSR_BC_MASK) >> FSL_MC_GSR_BC_SHIFT;
+	if (boot_code == 0xDD) {
+		dev_err(&pdev->dev,
+			"fsl-mc: DPL processing was not started, DPAA2 will not work!\n");
+		return -EOPNOTSUPP;
+	}
+
+	boot_done = gsr & FSL_MC_GSR_BOOT_DONE;
+	if (!boot_done) {
+		dev_dbg(&pdev->dev,
+			"fsl-mc: DPL processing in progress, defer probe\n");
+		return -EPROBE_DEFER;
+	}
+
+	mcs = gsr & FSL_MC_GSR_MCS_MASK;
+	if (mcs & FSL_MC_GSR_MCS_ERR_MASK) {
+		dev_err(&pdev->dev,
+			"fsl-mc: MC boot completed with error 0x%x\n", mcs);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 /*
  * fsl_mc_bus_probe - callback invoked when the root MC bus is being
  * added

@@ -1099,6 +1141,10 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
 		       mc->fsl_mc_regs + FSL_MC_GCR1);
 	}
 
+	error = fsl_mc_firmware_check(pdev);
+	if (error)
+		return error;
+
 	/*
 	 * Get physical address of MC portal for the root DPRC:
 	 */

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dominik Kaszewski <[email protected]>

[ Upstream commit 6fd45b5d8955bbc362ac3dfe181529f7b1cfd224 ]

[Why & How]
DPMS functions should not use partially updated pipe context passed as argument of commit_planes_do_stream_update, and instead use the one in current_state, which is guaranteed to be the most recently programmed HW config.

---
 drivers/gpu/drm/amd/display/dc/core/dc.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

index bea18f450ac9c..50b860c07ae01 100644
@@ -3225,27 +3225,34 @@ static void commit_planes_do_stream_update(struct dc *dc,
 					stream->test_pattern.cust_pattern_size);
 			}
 
+			// DPMS should not use partially updated pipe context
+			struct pipe_ctx *dpms_pipe_ctx = &dc->current_state->res_ctx.pipe_ctx[j];
+
 			if (stream_update->dpms_off) {
 				if (*stream_update->dpms_off) {
-					dc->link_srv->set_dpms_off(pipe_ctx);
+					dc->link_srv->set_dpms_off(dpms_pipe_ctx);
 					/* for dpms, keep acquired resources*/
-					if (pipe_ctx->stream_res.audio && !dc->debug.az_endpoint_mute_only)
-						pipe_ctx->stream_res.audio->funcs->az_disable(pipe_ctx->stream_res.audio);
+					if (dpms_pipe_ctx->stream_res.audio && !dc->debug.az_endpoint_mute_only) {
+						struct audio *audio = dpms_pipe_ctx->stream_res.audio;
+
+						audio->funcs->az_disable(audio);
+					}
 
 					dc->optimized_required = true;
 
 				} else {
 					if (get_seamless_boot_stream_count(context) == 0)
 						dc->hwss.prepare_bandwidth(dc, dc->current_state);
-					dc->link_srv->set_dpms_on(dc->current_state, pipe_ctx);
+					dc->link_srv->set_dpms_on(dc->current_state, dpms_pipe_ctx);
 				}
-			} else if (pipe_ctx->stream->link->wa_flags.blank_stream_on_ocs_change && stream_update->output_color_space
-					&& !stream->dpms_off && dc_is_dp_signal(pipe_ctx->stream->signal)) {
+			} else if (dpms_pipe_ctx->stream->link->wa_flags.blank_stream_on_ocs_change &&
+					stream_update->output_color_space &&
+					!stream->dpms_off && dc_is_dp_signal(dpms_pipe_ctx->stream->signal)) {
 				/*
 				 * Workaround for firmware issue in some receivers where they don't pick up
 				 * correct output color space unless DP link is disabled/re-enabled
 				 */
-				dc->link_srv->set_dpms_on(dc->current_state, pipe_ctx);
+				dc->link_srv->set_dpms_on(dc->current_state, dpms_pipe_ctx);
 			}
 
 			if (stream_update->abm_level && pipe_ctx->stream_res.abm) {

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dmitry Baryshkov <[email protected]>

[ Upstream commit b55a4b5d4769a650f52ea3f1ae680610169d125e ]

Sending DSI commands from the prepare() callback requires DSI link to be up at that point. For DSI hosts is guaranteed only if the panel driver sets the .prepare_prev_first flag. Set it to let these panels work with the DSI hosts which don't power on the link in their .mode_set callback.

---
 drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c | 2 ++
 1 file changed, 2 insertions(+)

index 4879835fe101d..e7433ee109427 100644
@@ -626,6 +626,8 @@ static int jadard_dsi_probe(struct mipi_dsi_device *dsi)
 	if (ret)
 		return ret;
 
+	jadard->panel.prepare_prev_first = true;
+
 	drm_panel_add(&jadard->panel);
 
 	mipi_dsi_set_drvdata(dsi, jadard);

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lijo Lazar <[email protected]>

[ Upstream commit 6fc63d80c01a480e3d2c98620f07d46e5bcfc85a ]

Check if data fetch is proper by matching the first few bytes against 0xFFs. If 0xFFs, that means data couldn't be read properly.

---
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 4 ++++
 1 file changed, 4 insertions(+)

index 44c5f8585f1ee..4edb631461223 100644
@@ -317,6 +317,10 @@ static int smu_v13_0_6_get_metrics_table(struct smu_context *smu,
 		amdgpu_asic_invalidate_hdp(smu->adev, NULL);
 		memcpy(smu_table->metrics_table, table->cpu_addr, table_size);
 
+		if (!memchr_inv(smu_table->metrics_table, 0xff,
+				min(16, table_size)))
+			return -EHWPOISON;
+
 		smu_table->metrics_time = jiffies;
 	}
 

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Cássio Gabriel <[email protected]>

[ Upstream commit 87a6f2fa6e6c69bb649fa327635a0bd977724603 ]

mixer_ctl_feature_put(), mixer_ctl_procunit_put(), and mixer_ctl_selector_put() ignore failures from their SET_CUR helper routines and report the control as changed whenever the requested value differs from the current one.

If the device rejects the write, userspace still sees success although the hardware state did not change. Propagate write failures instead, using filter_error() so ignore_ctl_error keeps the same semantics as the existing get paths.

---
 sound/usb/mixer.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

index 8c4fb5be3dba9..0a729ec282179 100644
@@ -1463,7 +1463,10 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol,
 				return -EINVAL;
 			val = get_abs_value(cval, val);
 			if (oval != val) {
-				snd_usb_set_cur_mix_value(cval, c + 1, cnt, val);
+				err = snd_usb_set_cur_mix_value(cval, c + 1,
+								cnt, val);
+				if (err < 0)
+					return filter_error(cval, err);
 				changed = 1;
 			}
 			cnt++;

@@ -1478,7 +1481,9 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol,
 			return -EINVAL;
 		val = get_abs_value(cval, val);
 		if (val != oval) {
-			snd_usb_set_cur_mix_value(cval, 0, 0, val);
+			err = snd_usb_set_cur_mix_value(cval, 0, 0, val);
+			if (err < 0)
+				return filter_error(cval, err);
 			changed = 1;
 		}
 	}

@@ -2343,7 +2348,9 @@ static int mixer_ctl_procunit_put(struct snd_kcontrol *kcontrol,
 		return -EINVAL;
 	val = get_abs_value(cval, val);
 	if (val != oval) {
-		set_cur_ctl_value(cval, cval->control << 8, val);
+		err = set_cur_ctl_value(cval, cval->control << 8, val);
+		if (err < 0)
+			return filter_error(cval, err);
 		return 1;
 	}
 	return 0;

@@ -2707,7 +2714,9 @@ static int mixer_ctl_selector_put(struct snd_kcontrol *kcontrol,
 		return -EINVAL;
 	val = get_abs_value(cval, val);
 	if (val != oval) {
-		set_cur_ctl_value(cval, cval->control << 8, val);
+		err = set_cur_ctl_value(cval, cval->control << 8, val);
+		if (err < 0)
+			return filter_error(cval, err);
 		return 1;
 	}
 	return 0;

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Goldwyn Rodrigues <[email protected]>

[ Upstream commit 69fc6474236d9edda6983623e4282f2bdfd8e3d8 ]

During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning.

WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561
CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed  c2dfc3c9d9f6f1233251c5d4410574fe82a348ee
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022
RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4]
Call Trace:
  __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
  ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
  __vfs_setxattr+0x9a/0xd0
  __vfs_setxattr_noperm+0x76/0x1f0
  ima_appraise_measurement+0x23e/0xe40
  ima_d_path+0x5a/0xd0
  process_measurement+0xb29/0xc40
  ? copy_from_kernel_nofault+0x21/0xe0
  ? fscrypt_file_open+0xc0/0xe0
  ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
  ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126
  ? __bpf_prog_exit+0x23/0xd0
  ? __bpf_tramp_exit+0xd/0x50
  ? bpf_trampoline_6442530367+0x9f/0xea
  ima_file_check+0x57/0x80
  security_file_post_open+0x50/0xf0
  path_openat+0x493/0x1650
  do_filp_open+0xc7/0x170

Detect the state of the file early and return the error.

---
 security/integrity/ima/ima_appraise.c | 5 +++++
 1 file changed, 5 insertions(+)

index a5dff9c38393e..3804eaea120cd 100644
@@ -90,6 +90,11 @@ static int ima_fix_xattr(struct dentry *dentry,
 	int rc, offset;
 	u8 algo = iint->ima_hash->algo;
 
+	if (IS_RDONLY(d_inode(dentry)))
+		return -EROFS;
+	if (IS_IMMUTABLE(d_inode(dentry)))
+		return -EPERM;
+
 	if (algo <= HASH_ALGO_SHA1) {
 		offset = 1;
 		iint->ima_hash->xattr.sha1.type = IMA_XATTR_DIGEST;

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xu Yang <[email protected]>

[ Upstream commit 62911bc82b0332aee7546156800d3516500fa1e1 ]

The device controller may update vbus status via usb_udc_vbus_handler(), which tries to connect the gadget even though gadget_bind_driver() has already called usb_udc_connect_control_locked(). This causes pullup() to be called twice. Avoid this by checking if gadget->connected is true.

This also set gadget->connected as false in usb_gadget_activate() if it became connected while it was being deactivated. Otherwise, usb_gadget_connect_locked will return early and pullup() won't be called.

---
 drivers/usb/gadget/udc/core.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

index a13fbef19c0ad..2ef28760e9ad9 100644
@@ -714,6 +714,9 @@ static int usb_gadget_connect_locked(struct usb_gadget *gadget)
 		goto out;
 	}
 
+	if (gadget->connected)
+		goto out;
+
 	if (gadget->deactivated || !gadget->udc->allow_connect || !gadget->udc->started) {
 		/*
 		 * If the gadget isn't usable (because it is deactivated,

@@ -887,8 +890,10 @@ int usb_gadget_activate(struct usb_gadget *gadget)
 	 * If gadget has been connected before deactivation, or became connected
 	 * while it was being deactivated, we call usb_gadget_connect().
 	 */
-	if (gadget->connected)
+	if (gadget->connected) {
+		gadget->connected = false;
 		ret = usb_gadget_connect_locked(gadget);
+	}
 
 unlock:
 	mutex_unlock(&gadget->udc->connect_lock);

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hirokazu Honda <[email protected]>

[ Upstream commit 1a6e94a8ff32e7879effd1e4a45bf112e506edc1 ]

On ARM64, shared memory can have MT_NORMAL_TAGGED attribute when using the Memory Tagging Extension (MTE). The OP-TEE driver needs to recognize this as normal memory to allow sharing such buffers with the Secure World.

---
 drivers/tee/optee/call.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index df5fb5410b722..bfabf057f06f4 100644
@@ -486,7 +486,8 @@ static bool is_normal_memory(pgprot_t p)
 	return (((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC) ||
 		((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEBACK));
 #elif defined(CONFIG_ARM64)
-	return (pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL);
+	return ((pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL)) ||
+	       ((pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL_TAGGED));
 #else
 #error "Unsupported architecture"
 #endif

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Weißschuh <[email protected]>

[ Upstream commit 4c6826ee7d04f489ad6fcf46ae6dd595fe9c6295 ]

Clang may convert the loop to find _auxv into a call to wcslen() which is missing on nolibc. -fsanitize needs to be disabled for this to happen.

Use the same pattern as in the nolibc strlen() implementation to avoid the function call generation.

---
 tools/include/nolibc/crt.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index a05655b4ce1d7..d72ed7b37adbb 100644
@@ -52,7 +52,7 @@ void _start_c(long *sp)
 
 	/* find _auxv */
 	for (auxv = (void *)envp; *auxv++;)
-		;
+		__asm__("");
 	_auxv = auxv;
 
 	/* go to application */

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lukas Wunner <[email protected]>

[ Upstream commit d462c8e89e84bfb6417e6b4c88e0cb7cc747ba41 ]

When a PCI device is unbound from its driver, pci_device_remove() sets the cached power state in pci_dev->current_state to PCI_UNKNOWN. This was introduced by commit 2449e06a5696 ("PCI: reset pci device state to unknown state for resume") to invalidate the cached power state in case the system is subsequently put to sleep.

For bound devices, the cached power state is set to PCI_UNKNOWN in pci_pm_suspend_noirq(), immediately before entering system sleep.

Extend to unbound devices for consistency.

This obviates the need to change the cached power state on unbind, so stop doing so.

---
 drivers/pci/pci-driver.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

index 8c941d6267a5c..cfb8b81250db6 100644
@@ -490,13 +490,6 @@ static void pci_device_remove(struct device *dev)
 	/* Undo the runtime PM settings in local_pci_probe() */
 	pm_runtime_put_sync(dev);
 
-	/*
-	 * If the device is still on, set the power state as "unknown",
-	 * since it might change by the next time we load the driver.
-	 */
-	if (pci_dev->current_state == PCI_D0)
-		pci_dev->current_state = PCI_UNKNOWN;
-
 	/*
 	 * We would love to complain here if pci_dev->is_enabled is set, that
 	 * the driver should have called pci_disable_device(), but the

@@ -874,7 +867,7 @@ static int pci_pm_suspend_noirq(struct device *dev)
 
 	if (!pm) {
 		pci_save_state(pci_dev);
-		goto Fixup;
+		goto set_unknown;
 	}
 
 	if (pm->suspend_noirq) {

@@ -926,6 +919,7 @@ static int pci_pm_suspend_noirq(struct device *dev)
 		goto Fixup;
 	}
 
+set_unknown:
 	pci_pm_set_unknown_state(pci_dev);
 
 	/*

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Viacheslav Dubeyko <[email protected]>

[ Upstream commit 5f63ac80aef2ee6bb58eab62e98c264774872da6 ]

The xfstests' test-case generic/729 fails with error:

sudo ./check generic/729

FSTYP         -- hfsplus
PLATFORM      -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #36 SMP PREEMPT_DYNAMIC Fri Apr 17 12:40:51 PDT 2026
MKFS_OPTIONS  -- /dev/loop51

MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch

generic/729 23s ... [failed, exit status 1]- output mismatch

mmap-rw-fault: /mnt/test/mmap-rw-fault.tmp: Input/output error

The hfsplus_get_block() only allows creating the next sequential block. It returns -EIO for direct writes beyond EOF. This patch waits for any in-flight DIO on the inode to finish. Then, it extends the file by calling generic_cont_expand_simple() with the goal to guarantee that blockdev_direct_IO() finds all needed blocks already reachable sequentially. And, finally, it flushes and invalidates the DIO range again so the page cache is clean before the direct write begins.

sudo ./check generic/729

FSTYP         -- hfsplus
PLATFORM      -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #40 SMP PREEMPT_DYNAMIC Thu Apr 16 15:41:03 PDT 2026
MKFS_OPTIONS  -- /dev/loop51

MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch

generic/729 23s ... 32s
Ran: generic/729
Passed all 1 tests

---
 fs/hfsplus/inode.c | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

index 2dd17192d11c3..8020232053423 100644
@@ -129,9 +129,44 @@ static ssize_t hfsplus_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
 	struct file *file = iocb->ki_filp;
 	struct address_space *mapping = file->f_mapping;
 	struct inode *inode = mapping->host;
+	loff_t isize;
 	size_t count = iov_iter_count(iter);
+	loff_t end = iocb->ki_pos + count;
 	ssize_t ret;
 
+	/*
+	 * The hfsplus_get_block() only allows creating the next sequential block.
+	 * For direct writes beyond EOF, expand the file first.
+	 */
+	if (iov_iter_rw(iter) == WRITE && iocb->ki_pos > i_size_read(inode)) {
+		loff_t start_off, end_off;
+		loff_t start_page, end_page;
+
+		isize = i_size_read(inode);
+
+		/*
+		 * Wait for any in-flight DIO on this inode to finish before
+		 * calling generic_cont_expand_simple().
+		 */
+		inode_dio_wait(inode);
+
+		ret = generic_cont_expand_simple(inode, iocb->ki_pos);
+		if (ret)
+			return ret;
+
+		start_off = isize;
+		end_off = (end > 0) ? end - 1 : end;
+
+		ret = filemap_write_and_wait_range(mapping, start_off, end_off);
+		if (ret)
+			return ret;
+
+		start_page = start_off >> PAGE_SHIFT;
+		end_page = end_off >> PAGE_SHIFT;
+
+		invalidate_inode_pages2_range(mapping, start_page, end_page);
+	}
+
 	ret = blockdev_direct_IO(iocb, inode, iter, hfsplus_get_block);
 
 	/*

@@ -139,8 +174,7 @@ static ssize_t hfsplus_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
 	 * blocks outside i_size. Trim these off again.
 	 */
 	if (unlikely(iov_iter_rw(iter) == WRITE && ret < 0)) {
-		loff_t isize = i_size_read(inode);
-		loff_t end = iocb->ki_pos + count;
+		isize = i_size_read(inode);
 
 		if (end > isize)
 			hfsplus_write_failed(mapping, end);

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Berg <[email protected]>

[ Upstream commit 8b9a100e1a76c52988b31099b349fd95a58c8768 ]

The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this.

---
 net/wireless/nl80211.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

index 545f7ecaad76f..79c3c065ab0c2 100644
@@ -5825,8 +5825,12 @@ static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
 	if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
 		params->he_cap = (void *)(cap->data + 1);
 	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
-	if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
+	if (cap && cap->datalen >= sizeof(*params->he_oper) + 1) {
 		params->he_oper = (void *)(cap->data + 1);
+		/* takes extension ID into account */
+		if (cap->datalen < ieee80211_he_oper_size((void *)params->he_oper))
+			return -EINVAL;
+	}
 	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
 	if (cap) {
 		if (!cap->datalen)

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Berg <[email protected]>

[ Upstream commit 51129a2ca0482b006d0e12a0aa025ff1e1cad2cb ]

Jouni reported that certain sequences of tests caused some WDS tests to fail after applying the upcoming hwsim changes for NAN. I bisected that down to converting hwsim to TXQs, and after a long debug session found that the 4-addr NDP was getting dropped, because it goes out via a (management) TXQ and is a data frame.

It's unclear to me now why this only happens in some test sequences (e.g. "sigma_dut_sae_h2e_ap_loop ap_wds_sta" and "sigma_dut_eap_ttls_all_akm_suites ap_wds_sta_open"), maybe that affects timing and the frame is otherwise delayed in some way.

Correct the check to only drop frames that actually carry data, not NDPs.

---
 net/mac80211/tx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 5ea7572aae3df..912686d07a419 100644
@@ -3882,7 +3882,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
 		 * injected frames or EAPOL frames from the local station.
 		 */
 		if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) &&
-			     ieee80211_is_data(hdr->frame_control) &&
+			     ieee80211_is_data_present(hdr->frame_control) &&
 			     !ieee80211_vif_is_mesh(&tx.sdata->vif) &&
 			     tx.sdata->vif.type != NL80211_IFTYPE_OCB &&
 			     !is_multicast_ether_addr(hdr->addr1) &&

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Panagiotis Petrakopoulos <[email protected]>

[ Upstream commit d5e6f353ce1e1c25b8458ea390ed09d2377412c5 ]

It was recently reported that rtw_fw_adaptivity_result() in fw.c dereferences rtwdev->chip->edcca_th without a NULL check. The issue is that devices with the 8821CE chip don't define edcca_th in their chip info. As a result, when rtw_fw_adaptivity_result() tries to dereference it, the kernel triggers an oops.

Add a NULL check for edcca_th before dereferencing it in rtw_fw_adaptivity_result() in fw.c. Placing the check at the function entry avoids logging any garbage values.

This change does not address the root cause for this behavior, but it prevents the NULL dereference and the resulting oops while a more permanent solution is developed.

Tested on a 8822CE chip which defines edcca_th, so this issue is not present on it, but it still uses this driver and I can verify there are no regressions.

---
 drivers/net/wireless/realtek/rtw88/fw.c | 3 +++
 1 file changed, 3 insertions(+)

index 3596cf99c2ed4..2e0ca3bc5670f 100644
@@ -197,6 +197,9 @@ static void rtw_fw_adaptivity_result(struct rtw_dev *rtwdev, u8 *payload,
 	struct rtw_hw_reg_offset *edcca_th = rtwdev->chip->edcca_th;
 	struct rtw_c2h_adaptivity *result = (struct rtw_c2h_adaptivity *)payload;
 
+	if (!edcca_th)
+		return;
+
 	rtw_dbg(rtwdev, RTW_DBG_ADAPTIVITY,
 		"Adaptivity: density %x igi %x l2h_th_init %x l2h %x h2l %x option %x\n",
 		result->density, result->igi, result->l2h_th_init, result->l2h,

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marco Elver <[email protected]>

[ Upstream commit 07a1a6562ce29e2e0c134a57882d6e52e8758492 ]

Some subsystems enable -Wmaybe-uninitialized [1], which can trigger false positives when KCSAN is enabled. Specifically, passing an uninitialized variable to functions that instrument accesses (e.g., copy_from_user()) results in calls to __kcsan_check_access().

Because __kcsan_check_access() takes a const volatile void *ptr, GCC infers that the function may only read the memory location, and thus warns if the passed variable is uninitialized.

However, KCSAN is a dynamic analysis tool for data race detection; while it does read the memory location to detect concurrent modifications, the "initialized'ness" of the memory location is irrelevant for its analysis.

Use absolute_pointer() in __kcsan_check_write(), kcsan_check_write(), and kcsan_check_atomic_write() to hide the pointer from the compiler, preventing it from concluding that the pointer passed points to uninitialized memory.

This fixes warnings like:

|   CC      fs/ntfs3/file.o
| In file included from include/asm-generic/rwonce.h:27,
|                  from arch/arm64/include/asm/rwonce.h:81,
|                  from include/linux/compiler.h:369,
|                  from include/linux/array_size.h:5,
|                  from include/linux/kernel.h:16,
|                  from include/linux/backing-dev.h:12,
|                  from fs/ntfs3/file.c:10:
| In function 'instrument_copy_from_user_before',
|     inlined from '_inline_copy_from_user' at include/linux/uaccess.h:184:2,
|     inlined from 'copy_from_user' at include/linux/uaccess.h:221:9,
|     inlined from 'ntfs_ioctl_fitrim' at fs/ntfs3/file.c:77:6,
|     inlined from 'ntfs_ioctl' at fs/ntfs3/file.c:164:10:
| include/linux/kcsan-checks.h:220:28: error: 'range' may be used uninitialized [-Werror=maybe-uninitialized]
|   220 | #define kcsan_check_access __kcsan_check_access
|       |                            ^
| include/linux/kcsan-checks.h:311:9: note: in expansion of macro 'kcsan_check_access'
|   311 |         kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE)
|       |         ^~~~~~~~~~~~~~~~~~
| include/linux/instrumented.h:147:9: note: in expansion of macro 'kcsan_check_write'
|   147 |         kcsan_check_write(to, n);
|       |         ^~~~~~~~~~~~~~~~~
| include/linux/kcsan-checks.h: In function 'ntfs_ioctl':
| include/linux/kcsan-checks.h:37:6: note: by argument 1 of type 'const volatile void *' to '__kcsan_check_access' declared here
|    37 | void __kcsan_check_access(const volatile void *ptr, size_t size, int type);
|       |      ^~~~~~~~~~~~~~~~~~~~
| fs/ntfs3/file.c:65:29: note: 'range' declared here
|    65 |         struct fstrim_range range;
|       |                             ^~~~~

---
 include/linux/kcsan-checks.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index 92f3843d9ebb8..e135dacaa90f3 100644
@@ -282,7 +282,7 @@ static inline void __kcsan_disable_current(void) { }
  * @size: size of access
  */
 #define __kcsan_check_write(ptr, size)                                         \
-	__kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE)
+	__kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_WRITE)
 
 /**
  * __kcsan_check_read_write - check regular read-write access for races

@@ -308,7 +308,7 @@ static inline void __kcsan_disable_current(void) { }
  * @size: size of access
  */
 #define kcsan_check_write(ptr, size)                                           \
-	kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE)
+	kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_WRITE)
 
 /**
  * kcsan_check_read_write - check regular read-write access for races

@@ -331,7 +331,7 @@ static inline void __kcsan_disable_current(void) { }
 #define kcsan_check_atomic_read(ptr, size)                                     \
 	kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC)
 #define kcsan_check_atomic_write(ptr, size)                                    \
-	kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE)
+	kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE)
 #define kcsan_check_atomic_read_write(ptr, size)                               \
 	kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE | KCSAN_ACCESS_COMPOUND)
 #endif

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Siew Chin Lim <[email protected]>

[ Upstream commit 4b0a32016347bfd6ae9849f21b1b767905f68d14 ]

Change INTEL_SIP_SMC_FCS_GET_PROVISION_DATA's SMC call to async from sync to avoid long runtime which may cause the watchdog timeout issue.

---
 drivers/firmware/stratix10-svc.c             |  4 ++--
 include/linux/firmware/intel/stratix10-smc.h | 12 ++++--------
 2 files changed, 6 insertions(+), 10 deletions(-)

index f723869c5b2db..6bfe02b7b895a 100644
@@ -340,6 +340,7 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data,
 	case COMMAND_FCS_SEND_CERTIFICATE:
 	case COMMAND_FCS_DATA_ENCRYPTION:
 	case COMMAND_FCS_DATA_DECRYPTION:
+	case COMMAND_FCS_GET_PROVISION_DATA:
 		cb_data->status = BIT(SVC_STATUS_OK);
 		break;
 	case COMMAND_RECONFIG_DATA_SUBMIT:

@@ -366,7 +367,6 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data,
 		cb_data->kaddr2 = &res.a2;
 		break;
 	case COMMAND_FCS_RANDOM_NUMBER_GEN:
-	case COMMAND_FCS_GET_PROVISION_DATA:
 	case COMMAND_POLL_SERVICE_STATUS:
 		cb_data->status = BIT(SVC_STATUS_OK);
 		cb_data->kaddr1 = &res.a1;

@@ -533,7 +533,7 @@ static int svc_normal_to_secure_thread(void *data)
 			break;
 		case COMMAND_FCS_GET_PROVISION_DATA:
 			a0 = INTEL_SIP_SMC_FCS_GET_PROVISION_DATA;
-			a1 = (unsigned long)pdata->paddr;
+			a1 = 0;
 			a2 = 0;
 			break;
 

index ee80ca4bb0d0c..1e60fd6210c3b 100644
@@ -600,24 +600,20 @@ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE)
 
 /**
  * Request INTEL_SIP_SMC_FCS_GET_PROVISION_DATA
- * Sync call to dump all the fuses and key hashes
+ * Async call to dump all the fuses and key hashes
  *
  * Call register usage:
  * a0 INTEL_SIP_SMC_FCS_GET_PROVISION_DATA
- * a1 the physical address for firmware to write structure of fuse and
- *    key hashes
- * a2-a7 not used
+ * a1-a7 not used
  *
  * Return status:
  * a0 INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_FCS_ERROR or
  *      INTEL_SIP_SMC_FCS_REJECTED
- * a1 mailbox error
- * a2 physical address for the structure of fuse and key hashes
- * a3 the size of structure
+ * a1-a3 not used
  *
  */
 #define INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA 94
 #define INTEL_SIP_SMC_FCS_GET_PROVISION_DATA \
-	INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA)
+	INTEL_SIP_SMC_STD_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA)
 
 #endif

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Danielle Ratson <[email protected]>

[ Upstream commit fee1fc1d5a5475f5516d406a03e443348cd0f06c ]

When neighbor suppression is enabled on a VXLAN port, the bridge is expected to reply to ARP/NS messages on behalf of remote hosts when both FDB and neighbor entries exist. This allows the bridge to suppress flooding of these messages to the VXLAN overlay.

According to RFC 9161 ("Operational Aspects of Proxy ARP/ND in Ethernet Virtual Private Networks"):
"A PE SHOULD reply to broadcast/multicast address resolution messages, i.e., ARP Requests, ARP probes, NS messages, as well as DAD NS messages. An ARP probe is an ARP Request constructed with an all-zero sender IP address that may be used by hosts for IPv4 Address Conflict Detection as specified in [RFC5227]".

However, the current implementation unconditionally suppresses ARP probes and DAD Neighbor Solicitations, which breaks Duplicate Address Detection (DAD) over EVPN.

For DAD to work correctly over the VXLAN fabric:
- When the bridge does not know the answer:
flood the probe/DAD packet to allow remote VTEPs to respond.
- When the bridge knows the answer:
reply to indicate the address is in use.

Fix by adjusting the early suppression checks to exclude ARP probes and DAD NS from unconditional suppression.

When replying to a DAD NS, br_nd_send() is adjusted to set the NA destination to the all-nodes multicast address (ff02::1) and clear the Solicited flag, in accordance with RFC 4861 section 7.2.4.

---
 net/bridge/br_arp_nd_proxy.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

index 985aaf7ff1564..f2d6643d2c0a1 100644
@@ -162,7 +162,7 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
 			return;
 		if (parp->ar_op != htons(ARPOP_RREQUEST) &&
 		    parp->ar_op != htons(ARPOP_RREPLY) &&
-		    (ipv4_is_zeronet(sip) || sip == tip)) {
+		    sip == tip) {
 			/* prevent flooding to neigh suppress ports */
 			BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
 			return;

@@ -260,6 +260,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
 	int ns_olen;
 	int i, len;
 	u8 *daddr;
+	bool dad;
 	u16 pvid;
 
 	if (!dev || skb_linearize(request))

@@ -298,8 +299,13 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
 		}
 	}
 
+	dad = ipv6_addr_any(&ipv6_hdr(request)->saddr);
+
 	/* Ethernet header */
-	ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
+	if (dad)
+		ipv6_eth_mc_map(&in6addr_linklocal_allnodes, eth_hdr(reply)->h_dest);
+	else
+		ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
 	ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
 	eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
 	reply->protocol = htons(ETH_P_IPV6);

@@ -315,7 +321,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
 	pip6->priority = ipv6_hdr(request)->priority;
 	pip6->nexthdr = IPPROTO_ICMPV6;
 	pip6->hop_limit = 255;
-	pip6->daddr = ipv6_hdr(request)->saddr;
+	pip6->daddr = dad ? in6addr_linklocal_allnodes : ipv6_hdr(request)->saddr;
 	pip6->saddr = *(struct in6_addr *)n->primary_key;
 
 	skb_pull(reply, sizeof(struct ipv6hdr));

@@ -328,7 +334,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
 	na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
 	na->icmph.icmp6_router = (n->flags & NTF_ROUTER) ? 1 : 0;
 	na->icmph.icmp6_override = 1;
-	na->icmph.icmp6_solicited = 1;
+	na->icmph.icmp6_solicited = dad ? 0 : 1;
 	na->target = ns->target;
 	ether_addr_copy(&na->opt[2], n->ha);
 	na->opt[0] = ND_OPT_TARGET_LL_ADDR;

@@ -429,7 +435,7 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
 	saddr = &iphdr->saddr;
 	daddr = &iphdr->daddr;
 
-	if (ipv6_addr_any(saddr) || !ipv6_addr_cmp(saddr, daddr)) {
+	if (!ipv6_addr_cmp(saddr, daddr)) {
 		/* prevent flooding to neigh suppress ports */
 		BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
 		return;

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pengpeng Hou <[email protected]>

[ Upstream commit 45c7bda7b7440183850012153988e40b300f40d0 ]

sdw_of_find_slaves() fetches raw "compatible" bytes with of_get_property() and then immediately parses them with sscanf("sdw%01x%04hx%04hx%02hhx", ...).

Live-tree OF properties are stored as raw bytes plus a separate length; they are not globally guaranteed to be NUL-terminated. Validate the first compatible string before parsing it.

---
 drivers/soundwire/slave.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 0aadfc2010287..9076208bd06e9 100644
@@ -233,8 +233,8 @@ int sdw_of_find_slaves(struct sdw_bus *bus)
 		struct sdw_slave_id id;
 		const __be32 *addr;
 
-		compat = of_get_property(node, "compatible", NULL);
-		if (!compat)
+		ret = of_property_read_string(node, "compatible", &compat);
+		if (ret)
 			continue;
 
 		ret = sscanf(compat, "sdw%01x%04hx%04hx%02hhx", &sdw_version,

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Viken Dadhaniya <[email protected]>

[ Upstream commit d283d5d4d9f6d081ddb65e371be26fffeb611c42 ]

The runtime PM functions had incomplete error handling that could leave the system in an inconsistent state. If any operation failed midway through suspend or resume, some resources would be left in the wrong state while others were already changed, leading to potential clock/power imbalances.

Reorder the suspend/resume sequences to avoid brownout risk by ensuring the performance state is set appropriately before clocks are enabled and clocks are disabled before dropping the performance state.

Fix by adding proper error checking for all operations and using goto-based cleanup to ensure all successfully acquired resources are properly released on any error.

---
 drivers/spi/spi-qcom-qspi.c | 44 ++++++++++++++++++++++++++++++-------
 1 file changed, 36 insertions(+), 8 deletions(-)

index 591fdd2ec7b85..0a2ac4bba2b94 100644
@@ -820,20 +820,34 @@ static int __maybe_unused qcom_qspi_runtime_suspend(struct device *dev)
 	struct qcom_qspi *ctrl = spi_controller_get_devdata(host);
 	int ret;
 
-	/* Drop the performance state vote */
-	dev_pm_opp_set_rate(dev, 0);
 	clk_bulk_disable_unprepare(QSPI_NUM_CLKS, ctrl->clks);
 
 	ret = icc_disable(ctrl->icc_path_cpu_to_qspi);
 	if (ret) {
 		dev_err_ratelimited(ctrl->dev, "%s: ICC disable failed for cpu: %d\n",
 			__func__, ret);
-		return ret;
+		goto err_enable_clk;
 	}
 
-	pinctrl_pm_select_sleep_state(dev);
+	ret = pinctrl_pm_select_sleep_state(dev);
+	if (ret)
+		goto err_enable_icc;
+
+	/* Drop the performance state vote */
+	ret = dev_pm_opp_set_rate(dev, 0);
+	if (ret)
+		goto err_select_default_state;
 
 	return 0;
+
+err_select_default_state:
+	pinctrl_pm_select_default_state(dev);
+err_enable_icc:
+	icc_enable(ctrl->icc_path_cpu_to_qspi);
+err_enable_clk:
+	if (clk_bulk_prepare_enable(QSPI_NUM_CLKS, ctrl->clks))
+		dev_err_ratelimited(ctrl->dev, "Failed to re-enable clocks\n");
+	return ret;
 }
 
 static int __maybe_unused qcom_qspi_runtime_resume(struct device *dev)

@@ -842,20 +856,34 @@ static int __maybe_unused qcom_qspi_runtime_resume(struct device *dev)
 	struct qcom_qspi *ctrl = spi_controller_get_devdata(host);
 	int ret;
 
-	pinctrl_pm_select_default_state(dev);
+	ret = dev_pm_opp_set_rate(dev, ctrl->last_speed * 4);
+	if (ret)
+		return ret;
+
+	ret = pinctrl_pm_select_default_state(dev);
+	if (ret)
+		goto err_opp_set_rate_zero;
 
 	ret = icc_enable(ctrl->icc_path_cpu_to_qspi);
 	if (ret) {
 		dev_err_ratelimited(ctrl->dev, "%s: ICC enable failed for cpu: %d\n",
 			__func__, ret);
-		return ret;
+		goto err_select_sleep_state;
 	}
 
 	ret = clk_bulk_prepare_enable(QSPI_NUM_CLKS, ctrl->clks);
 	if (ret)
-		return ret;
+		goto err_disable_icc;
 
-	return dev_pm_opp_set_rate(dev, ctrl->last_speed * 4);
+	return 0;
+
+err_disable_icc:
+	icc_disable(ctrl->icc_path_cpu_to_qspi);
+err_select_sleep_state:
+	pinctrl_pm_select_sleep_state(dev);
+err_opp_set_rate_zero:
+	dev_pm_opp_set_rate(dev, 0);
+	return ret;
 }
 
 static int __maybe_unused qcom_qspi_suspend(struct device *dev)

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Riccardo Boninsegna <[email protected]>

[ Upstream commit 0692c2602e4cd410aa045f8991bd1c142b2e56f9 ]

This is a Sonix SN8P2202XG microcontroller with firmware compatible with the already supported Northstar 04eb:e004, implementing an MCE IR receiver (PCB seems to be tracked for a transmitter too but missing related parts).

Found in a Skintek SK-CR-IN+IR ( http://www.skintek.it/SK-CR-IN+IR.php ) internal 3.5 inch USB card reader and MCE receiver combo (implemented by, and wired as, separate USB devices)
PCB marking: AU6475 966816 STIR REV:A02 MCE

---
 drivers/media/rc/mceusb.c | 2 ++
 1 file changed, 2 insertions(+)

index 4115a46929c47..3e5c2aa582cff 100644
@@ -398,6 +398,8 @@ static const struct usb_device_id mceusb_dev_table[] = {
 	{ USB_DEVICE(VENDOR_COMPRO, 0x3082) },
 	/* Northstar Systems, Inc. eHome Infrared Transceiver */
 	{ USB_DEVICE(VENDOR_NORTHSTAR, 0xe004) },
+	/* Northstar Systems, Inc. eHome Infrared Transceiver - variant */
+	{ USB_DEVICE(VENDOR_NORTHSTAR, 0xe033) },
 	/* TiVo PC IR Receiver */
 	{ USB_DEVICE(VENDOR_TIVO, 0x2000),
 	  .driver_info = TIVO_KIT },

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mika Westerberg <[email protected]>

[ Upstream commit 4c63f29872cb444b33665348bbd2f45cab06afcd ]

If tb_cfg_request() fails setting up the request (for example the control channel is shut down already) it returns an error without calling the callback. To avoid leaking that memory, call tb_cfg_request_put() if tb_cfg_request() fails.

---
 drivers/thunderbolt/xdomain.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

index 87fbced665b91..99a3f4317b5ca 100644
@@ -139,6 +139,7 @@ static int __tb_xdomain_response(struct tb_ctl *ctl, const void *response,
 				 size_t size, enum tb_cfg_pkg_type type)
 {
 	struct tb_cfg_request *req;
+	int ret;
 
 	req = tb_cfg_request_alloc();
 	if (!req)

@@ -150,7 +151,11 @@ static int __tb_xdomain_response(struct tb_ctl *ctl, const void *response,
 	req->request_size = size;
 	req->request_type = type;
 
-	return tb_cfg_request(ctl, req, response_ready, req);
+	ret = tb_cfg_request(ctl, req, response_ready, req);
+	if (ret)
+		tb_cfg_request_put(req);
+
+	return ret;
 }
 
 /**

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mika Westerberg <[email protected]>

[ Upstream commit 8b4060998637f06975fceee9b73845d8672d411e ]

This is needed because we release the service ID in tb_service_release() and the ID array is owned by the parent XDomain.

---
 drivers/thunderbolt/xdomain.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 99a3f4317b5ca..834fb56bde026 100644
@@ -1025,6 +1025,7 @@ static void tb_service_release(struct device *dev)
 	ida_simple_remove(&xd->service_ids, svc->id);
 	kfree(svc->key);
 	kfree(svc);
+	tb_xdomain_put(xd);
 }
 
 struct device_type tb_service_type = {

@@ -1133,7 +1134,7 @@ static void enumerate_services(struct tb_xdomain *xd)
 		svc->id = id;
 		svc->dev.bus = &tb_bus_type;
 		svc->dev.type = &tb_service_type;
-		svc->dev.parent = &xd->dev;
+		svc->dev.parent = get_device(&xd->dev);
 		dev_set_name(&svc->dev, "%s.%d", dev_name(&xd->dev), svc->id);
 
 		tb_service_debugfs_init(svc);

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mika Westerberg <[email protected]>

[ Upstream commit 138ec65b2c761f065b19d115aed2b8246fc272f5 ]

We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotplug().

---
 drivers/thunderbolt/tb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index bf35fd23b5e16..d3c9479080ffe 100644
@@ -191,7 +191,7 @@ static void tb_queue_hotplug(struct tb *tb, u64 route, u8 port, bool unplug)
 	if (!ev)
 		return;
 
-	ev->tb = tb;
+	ev->tb = tb_domain_get(tb);
 	ev->route = route;
 	ev->port = port;
 	ev->unplug = unplug;

@@ -2324,6 +2324,9 @@ static void tb_handle_hotplug(struct work_struct *work)
 	pm_runtime_mark_last_busy(&tb->dev);
 	pm_runtime_put_autosuspend(&tb->dev);
 
+	/* Undo the refcount increased in tb_queue_hotplug() */
+	tb_domain_put(tb);
+
 	kfree(ev);
 }
 

2.53.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mika Westerberg <[email protected]>

[ Upstream commit e56249d8a68e712f3b60e1f3fdbb5b4fea146468 ]

Similarly what we do with the firmware connection manager. This makes tb_xdp_handle_request() return error to the remote host. However, we need to make sure we keep the uuid alive so that we can reply until the whole domain is released.

---
 drivers/thunderbolt/tb.c      | 1 +
 drivers/thunderbolt/xdomain.c | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

index d3c9479080ffe..dc9b7aac45682 100644
@@ -2646,6 +2646,7 @@ static void tb_stop(struct tb *tb)
 		tb_tunnel_free(tunnel);
 	}
 	tb_switch_remove(tb->root_switch);
+	tb->root_switch = NULL;
 	tcm->hotplug_active = false; /* signal tb_handle_hotplug to quit */
 }
 

index 834fb56bde026..867eac780cce9 100644
@@ -754,7 +754,7 @@ static void tb_xdp_handle_request(struct work_struct *work)
 
 	mutex_lock(&tb->lock);
 	if (tb->root_switch)
-		uuid = tb->root_switch->uuid;
+		uuid = kmemdup(tb->root_switch->uuid, sizeof(*uuid), GFP_KERNEL);
 	else
 		uuid = NULL;
 	mutex_unlock(&tb->lock);

@@ -868,6 +868,7 @@ static void tb_xdp_handle_request(struct work_struct *work)
 	}
 
 out:
+	kfree(uuid);
 	kfree(xw->pkg);
 	kfree(xw);