6.18.61-rc1 review

This is the start of the stable review cycle for the 6.18.61 release. There are 1005 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 06 Nov 2026 21:07:23 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.61-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.18.61-rc1

Scott Gauche <[email protected]>
ALSA: hda/realtek: Fix audio after Windows reboot on ASUS Q423SA

Peter Griffin <[email protected]>
opp: fix use after free in _update_opp_table_clk()

Pablo Neira Ayuso <[email protected]>
netfilter: conntrack: always lower timeout for non-closing RST packets

Srinivasan Shanmugam <[email protected]>
drm/amdgpu/powerplay: Align get_tonga_state_array() header with prototype

Alexander Atanasov <[email protected]>
selftests: ublk: add missing gitignore for metadata_size binary

Sean Young <[email protected]>
media: rc: Fix build failure with CONFIG_LIRC disabled

Zi Yan <[email protected]>
mm/rmap: don't discard lazyfree THPs at PMD level

Danish Khateeb <[email protected]>
pps: generators: fix use-after-free when closing a removed device

Jori Koolstra <[email protected]>
pps: change pps_gen_class to a const struct

Yibo Tan <[email protected]>
media: ipu-bridge: Fix use-after-free in IVSC error path

Ian Bridges <[email protected]>
ksmbd: fix use-after-free after a failed durable reconnect

Dairui Zhang <[email protected]>
ksmbd: verify transform SessionId matches the decrypted header

DaeMyung Kang <[email protected]>
ksmbd: fix named stream write and EOF handling

Ian Bridges <[email protected]>
ksmbd: fix out-of-bounds read when padding the final compound response

DaeMyung Kang <[email protected]>
ksmbd: use the existing xattr name for a named stream

Henry Hu <[email protected]>
ksmbd: fix invalid pointer dereference when get_inode_acl() fails

Namjae Jeon <[email protected]>
ksmbd: prevent stale data from being written by SMB2 WRITE requests

Namjae Jeon <[email protected]>
ksmbd: prevent share root removal through empty paths

Ian Bridges <[email protected]>
ksmbd: fix session reference leak on compounded SESSION_SETUP

Aamir Ahmed <[email protected]>
ksmbd: deny access for an empty DACL instead of granting the request

Mario Peter <[email protected]>
driver core: take parent lock in async device attach

Vincent Liu <[email protected]>
driver core: Check drivers_autoprobe for all added devices

Fredric Cover <[email protected]>
smb: client: fix early procfs exposure race

Zikang Gao <[email protected]>
smb: client: do not pass a NULL buf to is_oplock_break()

Cheng Yongkang <[email protected]>
io_uring/net: fix multishot recv length limit accounting

Cheng Yongkang <[email protected]>
io_uring/timeout: count cancelled timeouts in cq_timeouts

Kyle Zeng <[email protected]>
io_uring: defer foreign io-wq enqueues to task_work

Chris Mason <[email protected]>
io_uring/sqpoll: don't wait for the thread to exit

Chris Mason <[email protected]>
io_uring: free XArray nodes left by a failed store

Chris Mason <[email protected]>
io_uring: charge tctx nodes and personalities

Chris Mason <[email protected]>
io_uring/rsrc: charge buffer arrays and nodes to memcg

Josef Bacik <[email protected]>
io_uring/io-wq: no new workers once the exit has begun

Daan De Meyer <[email protected]>
io_uring/net: don't retry a non-blocking connect() that fails with -EAGAIN

Yichong Chen <[email protected]>
io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT

Yichong Chen <[email protected]>
io_uring/kbuf: advance head when a pickup empties the buffer ring

Stefan Metzmacher <[email protected]>
smb: smbdirect: fix buffer length underflow in RDMA transfers

Amir Goldstein <[email protected]>
ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN

Chris Mason <[email protected]>
ovl: do not copy up a dentry that was removed

Chris Mason <[email protected]>
ovl: hold a reference on the parent in readdir

Chris Mason <[email protected]>
ovl: check that the parents of volatile/dirty are dirs

Jiale Yao <[email protected]>
HID: roccat: savu: reject short special reports

Jiale Yao <[email protected]>
HID: roccat: ryos: reject short special reports

Jiale Yao <[email protected]>
HID: roccat: pyra: reject short button reports

Jiale Yao <[email protected]>
HID: roccat: kovaplus: reject short button reports

Jiale Yao <[email protected]>
HID: roccat: konepure: reject short button reports

Jiale Yao <[email protected]>
HID: roccat: koneplus: reject short button reports

Jiale Yao <[email protected]>
HID: roccat: isku: reject short button reports

Gabor Tanz <[email protected]>
HID: quirks: Always poll the Anne Pro 2 with product ID a292

Jiale Yao <[email protected]>
HID: pxrc: reject short input reports

Jiale Yao <[email protected]>
HID: prodikeys: validate fixed-format MIDI reports

Lorenzo Stoakes (ARM) <[email protected]>
HID: picoLCD: check for fb_deferred_io_init() error

Jiale Yao <[email protected]>
HID: mcp2221: validate response report length

Jiale Yao <[email protected]>
HID: mcp2200: validate READ_ALL response length

Jiale Yao <[email protected]>
HID: logitech-dj: validate unnumbered keyboard reports

Jiale Yao <[email protected]>
HID: elo: reject short touchscreen reports

Jiale Yao <[email protected]>
HID: cp2112: validate response report lengths

Jiale Yao <[email protected]>
HID: cougar: reject short special-key reports

Alan Stern <[email protected]>
HID: core: Fix out-of-bounds left shift by 32 in s32ton()

Basavaraj Natikar <[email protected]>
HID: amd_sfh: Use report type from request node

Basavaraj Natikar <[email protected]>
HID: amd_sfh: Remove unsupported motion-state field from accelerometer report

Jiale Yao <[email protected]>
HID: zydacron: validate key report length

Amit Machhiwal <[email protected]>
KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form

Amit Machhiwal <[email protected]>
KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users

Xiaoyao Li <[email protected]>
KVM: TDX: Enable Bus Lock VM exit

Xiaoyao Li <[email protected]>
KVM: TDX: Enable Notify VM exit

Xiaoyao Li <[email protected]>
KVM: TDX: Check if there is valid exit infos based on vp_enter_ret

Sean Christopherson <[email protected]>
KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak

Chengfeng Ye <[email protected]>
KVM: x86: Take SRCU in kvm_zap_gfn_range()

Loc Nguyen <[email protected]>
KVM: x86: Request event processing for exception VM-Exits

Sean Christopherson <[email protected]>
KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload

Keqiang Duan <[email protected]>
KVM: x86: Clear hardware HLT state when userspace makes a vCPU not-halted

David Woodhouse <[email protected]>

    KVM: x86/xen: Take kvm->srcu in __kvm_xen_has_interrupt()

David Woodhouse <[email protected]>
KVM: x86/xen: Enforce 4-byte alignment of vcpu_info registration

Sean Christopherson <[email protected]>

    KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0

Sean Christopherson <[email protected]>
KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has

Xiaoyao Li <[email protected]>
KVM: VMX: Preserve negative return value in vmx_handle_exit() with bus lock detected

Xiaoyao Li <[email protected]>
KVM: VMX: Make handle_bus_lock_vmexit() a shared helper

Sean Christopherson <[email protected]>
KVM: VMX: Disallow using to_vmx() in common VT code

Sean Christopherson <[email protected]>
KVM: Use goto to handle errors during memslot preparation

Sean Christopherson <[email protected]>
KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state

Yosry Ahmed <[email protected]>
KVM: SVM: Trigger new ASID allocation in both VMCBs on pCPU switch

Mike Rapoport (Microsoft) <[email protected]>
x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()

Sean Christopherson <[email protected]>

    x86/cpuid: Mark CPUID function 0x23 as being indexed

David Howells <[email protected]>
rxrpc: Fix return in rxrpc_recvmsg_data() for service calls

David Howells <[email protected]>
rxrpc: Fix double IRQ enablement

David Howells <[email protected]>
afs: Fix afs to abort the rxrpc call on send error

David Howells <[email protected]>
rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data()

David Howells <[email protected]>

    rxrpc: Fix update of call->tx_pending without holding lock

Chuck Lever <[email protected]>
SUNRPC: Treat every TLS error alert as fatal

Ameer Hamza <[email protected]>
sunrpc: treat empty auth.unix.gid replies as negative entries

Zhiling Zou <[email protected]>
SUNRPC: trace an accepted transport before publishing it

Chuck Lever <[email protected]>
SUNRPC: Resume receiving after a TLS control record

Chuck Lever <[email protected]>
SUNRPC: Reject a TLS alert record that is not two octets

Chuck Lever <[email protected]>
SUNRPC: Reject a socket that already has an svc_sock attached

Chris Mason <[email protected]>
sunrpc: pin gss module across auth_domain RCU free

Jeff Layton <[email protected]>
SUNRPC: keep the first error in svc_register()

Jérémy Jean <[email protected]>
SUNRPC: fix oversized GSS proxy token copy

Chuck Lever <[email protected]>
SUNRPC: Do not credit control-record octets to the RPC stream

Chuck Lever <[email protected]>
SUNRPC: Copy the deferred RPC Call from the head buffer

Aldo Ariel Panzardo <[email protected]>
nfsd: zero NFSv4 COMPOUND tag padding

Jeff Layton <[email protected]>
NFSD: validate transport name in listener_set before serv creation

Chuck Lever <[email protected]>

    NFSD: Set nn->cld_net before registering the cld pipe

Chuck Lever <[email protected]>
NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE on a non-regular file

Chuck Lever <[email protected]>
NFSD: Resolve the recall-any mask names in the trace format

Chuck Lever <[email protected]>
NFSD: Reject an oversized principal hash from nfsdcld

Aldo Ariel Panzardo <[email protected]>
nfsd: propagate SETXATTR value decode errors

Jérémy Jean <[email protected]>
nfsd: preflight SEQUENCE replies before accepting a slot

Chuck Lever <[email protected]>
NFSD: Map flex file layout IDs through the request's user namespace

Chuck Lever <[email protected]>
NFSD: map fh_verify() status codes for NFS_ACLv3 replies

NeilBrown <[email protected]>
nfsd: honour client-provided attributes for NFS4_CREATE_EXCLUSIVE4_1

Cen Zhang (Microsoft Security FORGE Labs) <[email protected]>
nfsd: hold cl_lock in client_has_openowners()

Chuck Lever <[email protected]>
NFSD: Fix out-of-bounds read in the rpc_status dump

Wentao Liang <[email protected]>
nfsd: Fix id-to-name cache entry leak in idtoname_parse()

David Flynn <[email protected]>
nfsd: fetch direct I/O alignment for files handed to the filecache

Chuck Lever <[email protected]>
NFSD: Fail a pool_threads read whose reply does not fit

Ameer Hamza <[email protected]>
nfsd: don't modify a session slot when replaying its cached reply

Chuck Lever <[email protected]>
NFSD: Don't complete a cld upcall the daemon has not read

Chuck Lever <[email protected]>
NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients

Aldo Ariel Panzardo <[email protected]>
NFSD: copy SETXATTR data from all XDR buffer segments

Aldo Ariel Panzardo <[email protected]>
nfsd: clear XDR padding in GETXATTR replies

Jeff Layton <[email protected]>
NFSD: cap the number of listeners accepted in listener_set

Mike Snitzer <[email protected]>
NFS/localio: report the stability a DIO WRITE actually has

Mike Snitzer <[email protected]>
NFS/localio: fix nfs_local_dio_misaligned tracepoint

Jimmy Zuber <[email protected]>
NFS: Fix stale negative cache on failed nfs_mkdir()

Benjamin Coddington <[email protected]>
NFSv4/flexfiles: Bound page coalescing on the absolute stripe offset

Benjamin Coddington <[email protected]>
NFSv4/flexfiles: Use the full 64-bit stripe_unit

Benjamin Coddington <[email protected]>
NFSv4/flexfiles: Use the full 64-bit offset for read DS selection

Benjamin Coddington <[email protected]>
NFSv4/flexfiles: fail I/O to the data server once a lock is lost

Benjamin Coddington <[email protected]>
NFSv4/filelayout: Anchor page coalescing on pattern_offset

Benjamin Coddington <[email protected]>
NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from LAYOUTGET

Benjamin Coddington <[email protected]>
NFSv4/pnfs: Free the netid when draining a data-server address list

Chuck Lever <[email protected]>
pnfs/blocklayout: Complete a device upcall when the pipe is closed

Chuck Lever <[email protected]>
pnfs/blocklayout: Complete a device upcall only on its own reply

Benjamin Coddington <[email protected]>
pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume ndc_immediate

Ratnaker Gautam <[email protected]>
smb: client: validate NT transaction response layout and offsets

Dominik Maier <[email protected]>
smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()

Abdifatah Suruur <[email protected]>
smb: client: fix fiemap wild read on empty truncated response

Luxiao Xu <[email protected]>
smb: client: fix buffer overflow in SMB2_tcon()

Paulo Alcantara <[email protected]>
smb: client: don't resurrect an exiting tcon from cached dir workers

VeroFess <[email protected]>
smb: server: size directory name conversion buffer correctly

Borislav Petkov (AMD) <[email protected]>
x86/bugs: Adapt SRSO mitigation to Zen6

Darrick J. Wong <[email protected]>
xfs: reattach dquots after changing inode ids

Darrick J. Wong <[email protected]>
xfs: range-check bc_levels array access in scrub tracepoints

Darrick J. Wong <[email protected]>
xfs: propagate errors while checking null siblings

Darrick J. Wong <[email protected]>
xfs: opportunistically skip btree block checks

Darrick J. Wong <[email protected]>
xfs: only written file data blocks can be shared

Darrick J. Wong <[email protected]>
xfs: never reset the default quota timer

Darrick J. Wong <[email protected]>
xfs: init inode number for tracepoint

Darrick J. Wong <[email protected]>
xfs: fix data fork block count check in xrep_inode_blockcounts

Darrick J. Wong <[email protected]>
xfs: fix correction of unwritten extents in quota file data fork

Darrick J. Wong <[email protected]>
xfs: don't try to scrub self-referential dirent in metapath checker

Darrick J. Wong <[email protected]>
xfs: don't try to repair rtsummary if the summary file isn't computed

Darrick J. Wong <[email protected]>
xfs: don't subtract excess usage twice when computing agf_btreeblks

Darrick J. Wong <[email protected]>
xfs: don't set a metadata directory's parent to sb_rootino

Darrick J. Wong <[email protected]>
xfs: don't scan across metadata/regular directory trees for dirents

Darrick J. Wong <[email protected]>
xfs: don't rescan ifree and icount when frozen

Darrick J. Wong <[email protected]>
xfs: don't queue rmap update twice when reaping a fork

Darrick J. Wong <[email protected]>
xfs: don't overrun incore inode when cleaning attr forks

Darrick J. Wong <[email protected]>
xfs: don't clear COWEXTSIZE on directories on reflink filesystems

Darrick J. Wong <[email protected]>
xfs: don't allow sm_agno for non-group metadir path checking

Darrick J. Wong <[email protected]>
xfs: complain loudly when dirtree checker finds broken links

Darrick J. Wong <[email protected]>
xfs: clear set[ug]id mode bits when zapping attr fork

Darrick J. Wong <[email protected]>
xfs: clarify various parts of the bitmap API

Darrick J. Wong <[email protected]>
xfs: check for termination during rmap btree walk

Darrick J. Wong <[email protected]>
xfs: check for fragments when full-extent sharing matches

Aldo Ariel Panzardo <[email protected]>
xfs: bound inode fork length against the fork size during log recovery

Aldo Ariel Panzardo <[email protected]>
xfs: bound da-node entry count against the correct geometry

Darrick J. Wong <[email protected]>
xfs: always zero the whole shortform header when zeroing attr fork

Darrick J. Wong <[email protected]>
xfs: always report scrub errors in tracepoints

Darrick J. Wong <[email protected]>
xfs: always report inode repair setup failures

Darrick J. Wong <[email protected]>
xfs: always forget cached ACLs if the attr fork swap succeeds

Darrick J. Wong <[email protected]>

    xfs: abort directory tree repair whenever dl->aborted is set

Darrick J. Wong <[email protected]>
xfs: update quota flags on secondary supers when metadir enabled

Darrick J. Wong <[email protected]>
xfs: rescan the AGs if incore delalloc counter is negative

Darrick J. Wong <[email protected]>
xfs: release ip after unlinked list store failure

Aldo Ariel Panzardo <[email protected]>
xfs: reject remote xattr entries with an out-of-range value length

Aldo Ariel Panzardo <[email protected]>
xfs: reject out-of-range attribute value lengths in xfs_attr_copy_value

Darrick J. Wong <[email protected]>
xfs: reject absurdly large xattr value lengths in xchk_xattr_actor

Darrick J. Wong <[email protected]>
xfs: reduce new btree slack factor if free space is negative

Aleksandr Nogikh <[email protected]>
media: usbtv: fix null-pointer dereference on disconnect

Johan Hovold <[email protected]>
media: usbtv: drop redundant device reference

Hazem Mohamed Abuelfotoh <[email protected]>
Revert "net: Convert proto_ops bind() callbacks to use sockaddr_unsized"

Jean Delvare <[email protected]>
EDAC/mc: Really fix error path ordering in edac_mc_alloc()

Andrea Parri <[email protected]>
rtnetlink: wait for RCU readers in rtnl_link_unregister()

Joseph Qi <[email protected]>
ksmbd: fix breaking_cnt leak on early return in oplock_break()

Yongjun Gwon <[email protected]>
ksmbd: serialize directory emptiness checks with readdir

Florian Westphal <[email protected]>
netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables

Florian Westphal <[email protected]>
netfilter: nft_payload: restrict checksum offsets to known values

Zhiling Zou <[email protected]>
netfilter: validate L4 headers after userspace packet writes

Florian Westphal <[email protected]>
netfilter: nftables: restrict checkum update offset

Florian Westphal <[email protected]>
netfilter: nftables: restrict linklayer and network header writes

Pablo Neira Ayuso <[email protected]>
netfilter: nft_meta: add double-tagged vlan and pppoe support

Florian Westphal <[email protected]>
netfilter: nfnetlink_queue: restrict writes to network header

Daniel Borkmann <[email protected]>
ipv6: Implement limits on extension header parsing

Florian Westphal <[email protected]>
netfilter: disable payload mangling in userns

Cheng-Yang Chou <[email protected]>
sched_ext: Fix scx_flush_disable_work() UAF race

Richard Cheng <[email protected]>
sched_ext: sync disable_irq_work in bpf_scx_unreg()

Darrick J. Wong <[email protected]>
xfs: fix xchk_stats_estimate_bufsize to allow for the trailing null

Darrick J. Wong <[email protected]>
xfs: actually check XFS_DIFLAG2_METADATA for metadata btree data forks

Darrick J. Wong <[email protected]>
xfs: adjust checks for cross-AG reaping issues

Darrick J. Wong <[email protected]>
xfs: cross-reference the primary superblock

Darrick J. Wong <[email protected]>
xfs: jump out of xchk_bmap_check_rmap if fatal signals

Darrick J. Wong <[email protected]>
xfs: mark overfull dabtree node blocks as corrupt

Darrick J. Wong <[email protected]>
xfs: check fork type against dabtree block magic number

Darrick J. Wong <[email protected]>
xfs: abort dirtree repair if the live update hook dies

Darrick J. Wong <[email protected]>
xfs: fix revalidation of xchk_dquot_iter cached mappings

Darrick J. Wong <[email protected]>
xfs: bail out of directory tree repairs on error

Darrick J. Wong <[email protected]>
xfs: assign an owner to scrub_stats_fops

Darrick J. Wong <[email protected]>
xfs: allow softlimit with no hardlimit in quota scrub

Darrick J. Wong <[email protected]>
xfs: fix lost errno returned from xfarray_foliosort

Darrick J. Wong <[email protected]>
xfs: don't repair fs summary counters with garbage

Darrick J. Wong <[email protected]>
xfs: fix skipped inode mask handling in iscan

Darrick J. Wong <[email protected]>
xfs: don't proceed with xattr repair if the live update fails

Eric Sandeen <[email protected]>
xfs: validate rc_domain in xchk_rtrefcount_mergeable

Darrick J. Wong <[email protected]>
xfs: don't fix the directory tree if live update fails

Darrick J. Wong <[email protected]>
xfs: flag excessive delalloc rt extents as corruption

Darrick J. Wong <[email protected]>
xfs: zero out di_metatype when removing the metadir file iflag

Darrick J. Wong <[email protected]>
xfs: don't pass iget failures up when marking ondisk inodes

Darrick J. Wong <[email protected]>
xfs: always reset incore attr fork buffer when resetting fork

Darrick J. Wong <[email protected]>
xfs: fix inode btree repair when a cluster is larger than a chunk

Darrick J. Wong <[email protected]>
xfs: actually report corrupt xattrs as XFAIL during cross-referencing

Darrick J. Wong <[email protected]>
xfs: fix buffer overflow in corrupt inline attr structure

Darrick J. Wong <[email protected]>
xfs: fix unnecessary dapos truncation in xchk_dir_walk

Darrick J. Wong <[email protected]>
xfs: actually lock the metafile reservation when adjusting after repair

Darrick J. Wong <[email protected]>
xfs: avoid cross-rtgroup reaping after a repair

Darrick J. Wong <[email protected]>
xfs: online quotacheck must dirty dquot if enforcement adjustments needed

Darrick J. Wong <[email protected]>
xfs: fix buffer overruns in xfs_ioc_attr_list

Darrick J. Wong <[email protected]>
xfs: fix missing xfs_qm_adjust_dqlimits call in quotacheck repair

Darrick J. Wong <[email protected]>
xfs: fix xfs_rename_space_res for non-pptr filesystems

Darrick J. Wong <[email protected]>
xfs: fix ondisk symlink target validation in xrep_dinode_check_dfork

Darrick J. Wong <[email protected]>
xfs: compute the correct fdblocks/frextents for repair when they're negative

Darrick J. Wong <[email protected]>
xfs: mark cow extents bad if there's no rmap mapping for them

Darrick J. Wong <[email protected]>
xfs: clear the symlink zapped flag if inline symlink is ok

Amir Goldstein <[email protected]>
ovl: skip copy up of empty security.capability

Chris Mason <[email protected]>
ovl: set the revalidate flags after d_instantiate()

Hungyu Lin <[email protected]>
ovl: reserve space for the casefolded name terminator

Chris Mason <[email protected]>
ovl: read the nlink xattr of every indexed non-dir

Amir Goldstein <[email protected]>
ovl: fortify ovl_copy_xattr() against underlying layer modifications

Chris Mason <[email protected]>
ovl: fix a torn path in ovl_get_redirect()

Chris Mason <[email protected]>
ovl: do not copy up an xattr value that was never read

Chris Mason <[email protected]>
ovl: check the casefold flag of directories only

Chris Mason <[email protected]>
ovl: always encode the origin fh when index is enabled

Chris Mason <[email protected]>
ovl: use the pinned upper dir in ovl_fix_origin()

Chris Mason <[email protected]>
ovl: take a snapshot of the name for copy up

Chris Mason <[email protected]>
ovl: set OVL_WHITEOUTS before publishing the upper dir

Weiming Shi <[email protected]>
smb: client: stop processing a read response after a receive error

Diego Oliva <[email protected]>
smb: client: fix OOB last_entry pointer from unbounded LastNameOffset

Cen Zhang <[email protected]>
ocfs2: snapshot dentry names in file and setattr traces

Cen Zhang <[email protected]>
ocfs2: pin refcount trees before dropping the lookup lock

Jiaming Zhang <[email protected]>
ocfs2: fix chunk number of the first chunk in a local quota file

Cen Zhang <[email protected]>
ocfs2: cancel quota sync work before freeing quota info

Joseph Qi <[email protected]>
ocfs2/dlm: hold the lookup reference across convert AST enqueue

Cen Zhang <[email protected]>
ocfs2/dlm: hold a lock reference across grant AST enqueue

Cen Zhang <[email protected]>
ocfs2/heartbeat: unlink live slots when their node is missing

Sean Young <[email protected]>
media: rc: Fix ABBA deadlock by making locks more fine grained

Sean Young <[email protected]>
media: rc: Fix use after free in bpf progs

Sean Young <[email protected]>
media: rc: After rc_unregister_device() timers can be re-armed

Sean Young <[email protected]>
media: rc: Use after free in ir_raw_event_handle()

Sean Young <[email protected]>
media: rc: mce_kbd: Fix inconsistent locking of keylock

Sean Young <[email protected]>
media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister

Weigang He <[email protected]>
media: rc: fintek-cir: process a full RX buffer instead of overflowing it

Sean Young <[email protected]>
media: rc: Ensure registered is cleared in error path

Sean Young <[email protected]>
media: rc: Ensure that rc_unregister_device() does not free input device

Janne Grunau <[email protected]>
nvmem: core: Fix OOB read for bit offsets of more than one byte

Myeonghun Pak <[email protected]>
power: supply: sbs-battery: disable polling before supply teardown

Bryan O'Donoghue <[email protected]>
phy: core: Fix race-condition between _of_phy_get() and try_module_get()

Nickolai Zeldovich <[email protected]>
resource: report a devm_request_resource() conflict under the lock

Weibin Liu <[email protected]>
spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout

YANXIN LI <[email protected]>
ufs: use u64 for directory size in ufs_last_byte

Nguyen Quang Le Kien <[email protected]>
usb: gadget: fix refcount underflow in gadgetfs_bind() error path

Zhao Li <[email protected]>
wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement

Rosen Penev <[email protected]>
wifi: ath9k: delete channel-context timers on deinit

Yuchao Zhang <[email protected]>
xen-blkfront: unbind irq before tearing down ring and shadow requests

Igor Putko <[email protected]>
serial: core: shut down initialized port on removal

Fan Wu <[email protected]>
scsi: dc395x: sync the waiting_timer before freeing the host

Vernon Yang <[email protected]>
mm: khugepaged: fix folio is used after folio_put/unlock()

Imre Kaloz <[email protected]>
mm/slab: sample slab_state once in kmem_cache_destroy()

Fan Wu <[email protected]>
media: s5p-mfc: use timer_shutdown_sync() for the self-rearming watchdog

Rik van Riel <[email protected]>
media: redrat3: fix UAF in probe error path leaving rc device registered

Balakrishnan Sambath <[email protected]>
media: microchip-isc: take a reference on the parsed endpoints

Cong Nguyen <[email protected]>
media: microchip-csi2dc: fix async notifier leak on probe error path

Fan Wu <[email protected]>
media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA buffers

Fan Wu <[email protected]>
media: imx-jpeg: cancel timeout worker when streaming stops

Shuangpeng Bai <[email protected]>
media: gspca: use vb2_video_unregister_device() on disconnect

Myeonghun Pak <[email protected]>
media: cx23885: unregister DVB bus when SP2 CI setup fails

Amit Machhiwal <[email protected]>
KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls

Nicolin Chen <[email protected]>
iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown

Andrea Parri <[email protected]>

    iomap: don't resubmit an ioend after ->writeback_submit() failed

Kyle Zeng <[email protected]>
io_uring/io-wq: save worker type before dropping its reference

Yousef Alhouseen <[email protected]>
HID: hiddev: keep state alive through disconnect unlock

Richard Patel <[email protected]>
genirq: Move interrupt thread exit_work object to irqaction

Richard Patel <[email protected]>
genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes

Ngoc Quy <[email protected]>
fs/proc/task_mmu: pin mm_users in do_pagemap_scan()

Xiang Mei <[email protected]>
fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use

Yibo Tan <[email protected]>
fbdev: atmel_lcdfb: Prevent FIFO work after removal

Osama Abdelkader <[email protected]>
drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase

Bui Viet Dung <[email protected]>
Bluetooth: hci_vhci: Pin module for debugfs file operations

Fan Wu <[email protected]>
ASoC: amd: ps: fix snd_acp63_remove() teardown ordering

Sung Byeongchan <[email protected]>
ALSA: pcmtest: handle multiple wraps in random capture fill

Takashi Iwai <[email protected]>
ALSA: emux: Fix UAF of soundfont zones at note-on

Takashi Iwai <[email protected]>
ALSA: control: Fix UAF in snd_ctl_elem_add() on card disconnect

Frank Zhang <[email protected]>
rust: rcpufreq_dt: add module alias

Mehmet Koseoglu <[email protected]>
rust: cpufreq: reject NULL from cpufreq_cpu_get()

Andreas Hindborg <[email protected]>
rust: configfs: fix data offset calculation for subsystem callbacks

Andreas Hindborg <[email protected]>
rust: block: require Sync for Operations::QueueData

Andreas Hindborg <[email protected]>
rust: block: fix Send bound for GenDisk

Eliot Courtney <[email protected]>
rust: bitmap: restrict bitmap length to at most i32::MAX

Miguel Ojeda <[email protected]>
objtool/rust: add one more noreturn Rust function for Rust 1.101.0

Karl Mehltretter <[email protected]>
klist: avoid accesses after waking klist_remove()

Ping Cheng <[email protected]>
HID: wacom: Write shared touch initial status only once

Ping Cheng <[email protected]>
HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration

Lee Jones <[email protected]>
HID: wacom: Redesign shared sibling data lifecycle

Lee Jones <[email protected]>
HID: wacom: Fix Use-After-Free in wacom_bamboo_pad

Lee Jones <[email protected]>
HID: wacom: Fix Use-After-Free in wacom_intuos_pad

Lee Jones <[email protected]>
HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration

Lee Jones <[email protected]>

    HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities

Harald Freudenberger <[email protected]>
s390/zcrypt: Fix out-of-bounds ptr advance in cca_query_crypto_facility()

Heiko Carstens <[email protected]>
s390/signal: Fix incorrect return address in signal frame

Heiko Carstens <[email protected]>
s390/probes: Fix wrong opcode for cgrb fixup

Heiko Carstens <[email protected]>
s390/kprobes: Prevent kprobes on instructions with exception table entry

Heiko Carstens <[email protected]>
s390/extable: Fix mvcos instruction decoding

Sumanth Korikkar <[email protected]>
s390/cpum_cf: Check session mask before cpu offline

Wentao Liang <[email protected]>
drm/msm: Fix vm_bo use-after-free in with_vm_locks()

Niklas Cassel <[email protected]>
ata: sata_fsl: Fix use-after-free of host_priv on probe() failure

Wentao Liang <[email protected]>
ASoC: audio-graph-card2: Fix use-after-free in audio_graph2_link_c2c()

Binbin Deng <[email protected]>
apparmor: fix a use-after-free in aa_lookupn_ns()

Josef Bacik <[email protected]>
mm/hugetlb: fix use-after-free of a new anon folio

David Hildenbrand (Arm) <[email protected]>
mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte()

Deepanshu Kartikey <[email protected]>
media: imon: fix use-after-free in display_close via dev_dbg

Anuj Bolewar <[email protected]>
media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path

Pei Xiao <[email protected]>
media: cx23885: Fix use-after-free in cx23885_finidev due to race condition

Fan Wu <[email protected]>
media: au0828: fix use-after-free in bulk_timeout timer on disconnect

Chuck Lever <[email protected]>
lockd: Fix use-after-free in nlmsvc_retry_blocked

Günther Noack <[email protected]>
landlock: Fix superblock use-after-free in release_inode()

Nirmoy Das <[email protected]>
iommufd: Fix event queue release use-after-free

Yehyeong Lee <[email protected]>
nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection()

Daejun Park <[email protected]>
nvmet: fix use-after-free of the old registrant in nvmet_pr_preempt()

Mario Limonciello <[email protected]>
platform/x86/amd: hfi: Fix a use-after-free when unloading the driver

James Kim <[email protected]>
rapidio: mport_cdev: fix use-after-free in mport_mm_close()

Guangshuo Li <[email protected]>
RDMA/irdma: avoid use-after-free in icrdma_remove

Henry Martin <[email protected]>
smb: client: fix use-after-free in cifs_ses_add_channel()

Diego Oliva <[email protected]>
smb: client: fix use-after-free infoleak via the readdir resume name

AngeloGioacchino Del Regno <[email protected]>
spmi: Fix potential use-after-free by grabbing of_node reference

Zijing Yin <[email protected]>
SUNRPC: fix netns use-after-free in write_gssp()

Andreas Wendleder <[email protected]>
wifi: b43: fix use-after-free in b43_bcma_remove()

Li RongQing <[email protected]>
x86/ioperm: Prevent NULL dereference on theoretical missing IO bitmap

Kevin Cheng <[email protected]>
KVM: VMX: Synthesize nested EPT violation GVA_IS_VALID/GVA_TRANSLATED bits

Sean Christopherson <[email protected]>

    KVM: x86: Tell ->inject_page_fault() whether or a fault came from hardware

Paolo Bonzini <[email protected]>
KVM: x86/mmu: pass PFERR_GUEST_PAGE/FINAL_MASK to kvm_translate_gpa

Christoph Zwerschke <[email protected]>
Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU"

Christoph Zwerschke <[email protected]>
Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU"

Daehyeon Ko <[email protected]>
cgroup: serialize migrations of newly forked processes

Eric Dumazet <[email protected]>
vlan: restore HW VLAN tag insertion with reorder_hdr off

Kuniyuki Iwashima <[email protected]>
tcp: Fix potential UAF in reqsk_timer_handler().

Namjae Jeon <[email protected]>
ksmbd: validate security descriptor offsets before pointer arithmetic

Karl Mehltretter <[email protected]>
ksmbd: use u8 for SMB2 oplock level values

DaeMyung Kang <[email protected]>
ksmbd: return end of file for reads past a named stream's data

Abdifatah Suruur <[email protected]>
ksmbd: reserve space for the UTF-16 terminator in stream info

DaeMyung Kang <[email protected]>
ksmbd: preserve unreadable named streams on open

Jan Koester <[email protected]>
ksmbd: ignore network devices of other namespaces

Cen Zhang (Microsoft) <[email protected]>
ksmbd: fix parent dentry lifetime in directory enumeration

Giorgi Kobakhia <[email protected]>
ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()

Dairui Zhang <[email protected]>
ksmbd: fix OOB read and cross-share confusion in ksmbd_validate_name_reconnect()

Namjae Jeon <[email protected]>
ksmbd: fix extended session security negotiation for raw NTLMSSP

DaeMyung Kang <[email protected]>
ksmbd: avoid restoring only in-memory EOF after allocation change

Michail Andreas Michalopoulos <[email protected]>
ksmbd: accept share config responses from ksmbd-tools before 3.5.3

David Heidelberg <[email protected]>
backlight: qcom-wled: Fix WLED3 brightness register stride

David Heidelberg <[email protected]>
backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe

David Heidelberg <[email protected]>
backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()

Myeonghun Pak <[email protected]>
backlight: lm3630a: Cancel delayed work before destroying workqueue

Kameron Carr <[email protected]>
Drivers: hv: vmbus: Bounds check the shared ring buffer indices

Johan Hovold <[email protected]>
driver core: fix parent lock use-after-free on USB disconnect

Josef Bacik <[email protected]>
driver core: Limit the messages on a refused uevent

Johan Hovold <[email protected]>
driver core: take parent lock on deferred probe

Jamal Hadi Salim <[email protected]>
net/sched: act_ife: do not consume the inner header on egress

Antonio Quartulli <[email protected]>
net/sched: fix packet reordering on requeue

owen kwan <[email protected]>
net/sched: sch_teql: fix use-after-free on lower qdisc drop

Jamal Hadi Salim <[email protected]>
net/sched: sch_teql: fix slaves_lock IRQ deadlock

Yuhang Zheng <[email protected]>
net/sched: cls_flower: avoid stale mask references after delete

Jamal Hadi Salim <[email protected]>
net/sched: cls_bpf: accept dev-bound programs on shared blocks

Hengyu Liang <[email protected]>
serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports

Jiakai Xu <[email protected]>
RISC-V: KVM: Fix double-free of sdata in kvm_pmu_clear_snapshot_area()

Timur Kristóf <[email protected]>
drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set

Donggeun Yoo <[email protected]>
tracing: Fix NULL dereference when copying keys for a field variable

Pengpeng Hou <[email protected]>
tracing: Bound histogram expression strings with seq_buf

Pengpeng Hou <[email protected]>
tracing: Return ERR_PTR() from expr_str()

Pengpeng Hou <[email protected]>
tracing: Use __free() for expr_str() buffer

Tom Zanussi <[email protected]>
tracing: Fix fully-qualified variable reference printing in histograms

Christian Brauner <[email protected]>
ntfs3: free replaced mount options after a grace period

Christian Brauner <[email protected]>
ipc: drop the mqueue mount with kern_unmount() on setup failure

Vlad Kulikov <[email protected]>
ipc: create_ipc_ns: drop mqueue mount on sysctl setup failure

Igor Paunovic <[email protected]>
accel/rocket: search every core slot when looking up a scheduler

Hari Mishal <[email protected]>
drm/amd/display: guard dc_sink dereferences in MST mode validation

Alex Deucher <[email protected]>
drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub()

Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: remove gart_window_lock usage from gmc v12

Timur Kristóf <[email protected]>
drm/amd/display: Fix fast updates on DCE 6.x

Ali Ahmet Memis <[email protected]>
tools/power turbostat: Read complete CPU lists

Paulo Alcantara <[email protected]>
smb: client: require stable pages for signed connections

Paulo Alcantara <[email protected]>
smb: client: only require read lease for size-extending zero range

Paulo Alcantara <[email protected]>
smb: client: drain and invalidate before server-side copy/clone

Paulo Alcantara <[email protected]>
smb: client: discard post-EOF pagecache when extending a file via clone range

Paulo Alcantara <[email protected]>
smb: client: clear post-EOF pagecache when extending a file via truncate

Jakub Gawlik <[email protected]>
ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72

Zhang Heng <[email protected]>
ALSA: hda/realtek: add quirk for Acer Nitro ANV15-51

Sean Christopherson <[email protected]>
KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded

Sean Christopherson <[email protected]>
KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN

Ilya Maximets <[email protected]>
net/sched: act_ct: remove 'add_helper' dead code

Johan Hovold <[email protected]>
serial: abort TIOCMIWAIT on hangup

Johan Hovold <[email protected]>
serial: fix ioctl hangup race

Jiri Slaby (SUSE) <[email protected]>
serial: serial_core: simplify uart_ioctl() returns

Sean Christopherson <[email protected]>
KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages() error paths

Adarsh Das <[email protected]>
smb: client: delete compound mids on send failure before unlock

David Francis <[email protected]>
drm/amdkfd: Avoid integer underflow in EOP ring size calculation.

David Francis <[email protected]>
drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc

Xiaogang Chen <[email protected]>

    drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size

Darrick J. Wong <[email protected]>
xfs: don't cross reference rmapbt with bitmaps if they're incomplete

Zongmin Zhou <[email protected]>
RISC-V: KVM: Fix sdata leak and stale snapshot_addr in snapshot_set_shmem

Xie Bo <[email protected]>
RISC-V: KVM: Release unused page after MMU invalidation

Paulo Alcantara <[email protected]>
smb: client: fix fattr leaking on wsl_to_fattr() failure

Mahmoud Nagy Adam <[email protected]>
selftests: ublk: install test_common.sh and trace/ scripts

Ming Lei <[email protected]>
selftests: ublk: increase timeout to 150 seconds

Caleb Sander Mateos <[email protected]>
selftests: ublk: add utility to get block device metadata size

Ming Lei <[email protected]>
selftests/ublk: fix Makefile to rebuild on header changes

Kevin Wang <[email protected]>
drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7

Arie Miller <[email protected]>
hwmon: (asus_rog_ryujin) Synchronize HID command and report handling

Arie Miller <[email protected]>
hwmon: (asus_rog_ryujin) Validate HID report lengths

Arie Miller <[email protected]>
hwmon: (asus_rog_ryujin) Add per-device configuration

Guenter Roeck <[email protected]>
hwmon: (asus_rog_ryujin) Rely on subsystem locking

Paulo Alcantara <[email protected]>
smb: client: fix WSL reparse point uid/gid override

Paulo Alcantara <[email protected]>
smb: client: fix uid/gid override in getattr with posix extensions

Théo Lebrun <[email protected]>
mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ

Gregory CLEMENT <[email protected]>
MIPS: Fix HOTPLUG_PARALLEL dependency

Harald Freudenberger <[email protected]>
s390/crypto: Fix handling of EBUSY in PAES when req is pushed to crypto engine

Harald Freudenberger <[email protected]>
s390/crypto: Fix use of mutex in atomic context in PAES

Harald Freudenberger <[email protected]>
s390/crypto: Fix return code handling at skcipher_walk_done in PAES algorithms

Peter Zijlstra <[email protected]>
s390/crypto: Replace cond_resched() with msleep(1)

Chaithanya Lagisetty <[email protected]>
LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path

Chaithanya Lagisetty <[email protected]>
LoongArch: KVM: Add unregister helpers for the KVM interrupt devices

Austin Zheng <[email protected]>
drm/amd/display: Remove const Qualifier From Non-Pointer Fields

Wenjing Liu <[email protected]>
drm/amd/display: add const qualifiers to watermark params struct

Austin Zheng <[email protected]>
drm/amd/display: Update P-state naming for clarity.

Austin Zheng <[email protected]>
drm/amd/display: DML2.1 Reintegration

Sven Peter <[email protected]>
thunderbolt: Make the DP tunnel activation callback mandatory

Ido Schimmel <[email protected]>
ipv6: udp: Create exceptions before socket matching

Andy Chiu <[email protected]>

    riscv: hwprobe: initialize pair->value in hwprobe_one_pair()

Yunpeng Tian <[email protected]>
smb: client: reject SetEA requests that do not fit the request buffer

Arvind Yadav <[email protected]>
mm/migrate_device: clear stale mapping after freeing swapcache

Breno Leitao <[email protected]>
mm/kmemleak: report RCU-tasks quiescent states during the scan

Breno Leitao <[email protected]>
mm/kmemleak: stop the task stack scan early when interrupted

Gary Guo <[email protected]>
rust: cfi: disable function merging if CFI is enabled

Tiezhu Yang <[email protected]>
LoongArch: Expand module virtual address space to 2GB

Jeff Layton <[email protected]>
nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update

Jeff Layton <[email protected]>
nfsd: dedup nfs4_client_to_reclaim inserts

FUJITA Tomonori <[email protected]>
rust: bug: fix warn_on macro build error on UML

Bibo Mao <[email protected]>

    LoongArch: KVM: Set vcpu->cpu before IN_GUEST_MODE is set

Bibo Mao <[email protected]>
LoongArch: KVM: Deliver interrupt after IN_GUEST_MODE is set

Bibo Mao <[email protected]>
LoongArch: KVM: Check kvm_request_pending() in kvm_late_check_requests()

Adrian Hunter <[email protected]>
i3c: master: Fix potential UAF in i3c_device_uevent()

Brendan Jackman <[email protected]>
mm/page_alloc: don't spin_trylock() when disallowed in free_one_page()

Jose Villaseñor Montfort <[email protected]>
HID: input: read battery capacity from its actual report offset

Dev Jain <[email protected]>
mm/migrate: use huge_ptep_get() in remove_migration_pte()

Yosry Ahmed <[email protected]>
KVM: x86: Always initialize EFER reserved bits on vendor initialization

Matthew Auld <[email protected]>
drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs

Lorenzo Pieralisi <[email protected]>
irqchip/gic-v5: Fix standalone IRSes OF probe

Lorenzo Pieralisi <[email protected]>
dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints

Qing Luo <[email protected]>
sctp: auth: discard auth_chunk when skb_clone fails

Pablo Neira Ayuso <[email protected]>
netfilter: ctnetlink: do not expose expectation DEAD flag

Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()

Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: use conntrack GC to reap expectations

Darrick J. Wong <[email protected]>
xfs: fix integer overflow problem when setting large free areas

Bui Viet Dung <[email protected]>
wwan: wwan_hwsim: Pin module for debugfs file operations

Giorgi Kobakhia <[email protected]>
udf: fix return value for non-recorded-allocated extents in udf_map_block()

Jonathan Gopel <[email protected]>
thunderbolt: Do not RPM complete unrelated subtrees on unplug

Cen Zhang <[email protected]>
ocfs2: publish the filecheck owner before adding sysfs attributes

Cen Zhang <[email protected]>
ocfs2: pin owning modules for open debugfs files

Cen Zhang <[email protected]>
ocfs2: drain quorum work before removing the cluster

Cen Zhang <[email protected]>
ocfs2/dlm: drain join handlers before releasing module text

Ameer Hamza <[email protected]>
nfsd: fix race between client_info_show() and free_client()

Wei Jie Law <[email protected]>

    net: usb: pegasus: do not advance rx_skb->data on dropped frames

Kaho Jiang <[email protected]>
net: ipv4: add zero check for snd_cwnd_clamp

Xiang Mei <[email protected]>
media: go7007: only set audio_enabled if go7007_snd_init() succeeded

Xiang Mei <[email protected]>
media: em28xx: reject audio endpoint with zero packet size

Myeonghun Pak <[email protected]>
media: cx88: Disable PCI device on MPEG initialization failure

Xiang Mei <[email protected]>
libceph: bound mon_command ack decode to front len

Andrea Parri <[email protected]>
kcsan: Avoid division by zero in kcsan_prandom_u32_max()

Fang Xieyan <[email protected]>
kcov: ignore an out-of-range comparison count in write_comp_data()

Xiang Mei <[email protected]>
fuse: don't BUG when the copy buffer is exhausted

Yuanfu Xie <[email protected]>
ceph: fail readdir when the MDS reply carries no dirfrag

Baokun Li <[email protected]>
blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()

Karl Mehltretter <[email protected]>
ARM: 9524/1: mm: align hugetlb mappings to the huge page size

Rohinthan P <[email protected]>
media: em28xx: use video_unregister_device for radio_dev

Christian Brauner <[email protected]>
Revert "namei: don't reveal overmounted entries in refwalk"

Petr Mladek <[email protected]>
nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()

Michael Reeves <[email protected]>
regmap: Remove debugfs before cache teardown

Yong-Xuan Wang <[email protected]>
RISC-V: errata: Add SiFive MAL-9092 workaround

Jesse Zhang <[email protected]>
drm/amdgpu/gfx11: set KMD_QUEUE for kernel gfx queues

Jesse Zhang <[email protected]>
drm/amdgpu/gfx12: set KMD_QUEUE for kernel gfx queues

Matus Gajdos <[email protected]>
ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers

Jaidheer Sirigineedi <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)

Miquel Raynal <[email protected]>
spi: cadence-qspi: Fix status polling with octal DTR chips

Zeyu Li <[email protected]>
ALSA: hda/realtek: Add ALC235 support for headset mode

Eckhart Mohr <[email protected]>
ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H

Reinhard Speyerer <[email protected]>
net: usb: qmi_wwan: add Rolling Wireless RN947R

Vladimir Murzin <[email protected]>
usb: mtu3: Fix double dereference in TP_printk

renpanpan <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 14-dv1001TU

Muhtasham Nawr al-Mahmud <[email protected]>
ALSA: hda/realtek: Fix speakers on ASUS PM3406CHA

Zhang Heng <[email protected]>
ALSA: hda/realtek: Add quirk for Acer Nitro AN515-45

Krish Gulati <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Victus 15-fb2xxx

Tarun Noonemunthala <[email protected]>
ALSA: hda/realtek: Add quirk for HP ENVY 13-aq1xxx

Luis Banha <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-ec1xxx

Zhang Heng <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo ThinkBook G8+

KIM MinWoo <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo ThinkBook 16p Gen 3 ARH (21EK)

Tomasz Bojanowski <[email protected]>
ALSA: usb-audio: Add mixer mapping for MSI MAG B850M MORTAR WIFI

Hernan Ganzo <[email protected]>
ALSA: hda/realtek: Limit internal mic boost on HP Pavilion 15 (103c:2164)

Christian Brauner <[email protected]>
docs: update the unmount propagation rule

Eric Dumazet <[email protected]>
nvme-tcp: delay nvme_tcp_reclassify_socket()

Jasper Firth <[email protected]>
ASoC: Intel: bytcr_rt5651: Add quirk for Chuwi Hi8 with generic DMI strings

Even Xu <[email protected]>
HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow

Even Xu <[email protected]>
HID: Intel-thc-hid: Intel-quickspi: Fix buffer overflow

Tomasz Pakuła <[email protected]>
HID: universal-pidff: Add support for Turtle Beach VelocityOne Race

Daniel Ortiz <[email protected]>
ASoC: amd: yc: Add DMI quirk for Lenovo V15 G6 ARP

Andy Moreton <[email protected]>
sfc: add X4D PF support

Rosen Penev <[email protected]>
gpio: mvebu: keep resume masks within the irqchip cache

Seiji Adachi <[email protected]>
ASoC: amd: yc: Add Lenovo ThinkPad E16 Gen 2 (21JN) to quirks

Ewan D. Milne <[email protected]>
scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC Symmetrix

Dmitry Antipov <[email protected]>
HID: roccat: fix locking in roccat_connect() and roccat_disconnect()

Maurizio Lombardi <[email protected]>
nvme-fc: do not warn on controller removal race

Berke Durak <[email protected]>
HID: elecom: Add support for ELECOM M-XT4DRBK (018E)

Oleg Keri <[email protected]>
HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard

Youth Cao <[email protected]>

    HID: i2c-hid: Add i2c-hid-quirk-bad-input-size quirk for 0911:5288 device

Mark Brown <[email protected]>
regmap: irq: Free the irqdomain we create

Namjae Jeon <[email protected]>
ksmbd: handle allocated range queries on dense files

Fernando Fernandez Mancera <[email protected]>
netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks

Xiubo Li <[email protected]>
ceph: fix use-after-dereference of NULL ci in __ceph_remove_cap()

Mehmet Aysel <[email protected]>
ASoC: amd: acp-config: Add HVY-WXX9/M1060 DMI quirk

Bob Song <[email protected]>
ALSA: hda/conexant: Always enable the headset-mic pin on plugin

Xiubo Li <[email protected]>
ceph: do not cache negative dentries for snapped directories

Mehmet Aysel <[email protected]>

    ASoC: amd: acp3x-es83xx: Add HVY-WXX9/M1060 DMI quirk

Federico Valentín Andrade <[email protected]>
ALSA: usb-audio: Skip mixer creation on M-Audio Venom

Karl Mehltretter <[email protected]>
tpm: atmel: depend on X86

Li Jun <[email protected]>
tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume is null

Dave Carey <[email protected]>
HID: multitouch: Fix stale MT slots when contact count drops to zero

Vadim Klishko <[email protected]>
HID: i2c-hid: Add a quirk for a Cirque I2C device.

Zhang Heng <[email protected]>
ASoC: amd: yc: Add DMI entry for Alienware m18 R1 AMD

Jimmy Zuber <[email protected]>
fuse: zero the partial EOF page when extending a file

Zhang Heng <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo IdeaPad Slim 3 15ABR8

Md Rabbani <[email protected]>
net: stmmac: fix device node reference leaks in stmmac_mtl_setup()

Sumeet Pawnikar <[email protected]>
powercap: intel_rapl: Fix kernel panic during PMU unbind

Helge Deller <[email protected]>
fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo

Shiji Yang <[email protected]>

    net: ethernet: mtk_wed: increase WED v2 WDMA RESV_BUFF to 0x80

Jenson Johnathon Reggentin <[email protected]>
docs: block: fix dead http link in blk-mq.rst

Chen Changcheng <[email protected]>
scsi: snic: Fix SCSI host leak on workqueue allocation failure

Will Porter <[email protected]>
ALSA: usb-audio: Add iD14 MkI to monitor-mix volume quirk

Csaba Budai <[email protected]>
ALSA: hda/realtek: Fix ALC700 audio on Intel Hades Canyon

Daeho Jeong <[email protected]>
f2fs: avoid setting SBI_NEED_FSCK on transient resize failure

Robin Everaars <[email protected]>
ACPI: button: Add DMI quirk for Razer Blade Pro 17 early 2020 lid switch

Tao Cui <[email protected]>
sched_ext/scx_flatcg: expire cached hweights on weight changes

Namjae Jeon <[email protected]>
ksmbd: enable TCP keepalive for accepted connections

BingKun Yue <[email protected]>
fbdev: platinumfb: add error checking for ioremap calls

Randy Dunlap <[email protected]>
fbdev: maxine: fix 64-bit build error

Carlos Song <[email protected]>
i2c: imx-lpi2c: properly unwind resources on probe failure

Li Jun <[email protected]>
spi: loongson: pm: add .freeze .poweroff .thaw .restore

Pengpeng Hou <[email protected]>
rtc: brcmstb-waketimer: add missing MODULE_DEVICE_TABLE()

Robert Leussler <[email protected]>
rtc: ds1307: fix RX8130 wakeup alarm WADA bit for day-of-month mode

Jack Yu <[email protected]>
ASoC: rt712-sdca: Pull high JD2 to prevent from entering TV mode

Jinqian Yang <[email protected]>
virtio_ring: fix infinite loop in virtnet_poll_cleantx when device is broken

Szymon Durawa <[email protected]>
PCI: vmd: Add Nova Lake (NVL) and Dunlow (DNL) Device IDs

Pengpeng Hou <[email protected]>
rtc: ab-eoz9: add missing MODULE_DEVICE_TABLE()

Denis V. Lunev <[email protected]>
virtio_balloon: warn on failed buffer add in tell_host()

Chad Talbott <[email protected]>
ALSA: usb-audio: Add MIN_MUTE quirk for Creative Sound Blaster Play! 3

Weimin Xiong <[email protected]>
vdpa/mlx5: roll back MR update after VQ setup failure

Gilles Risch <[email protected]>
drm/radeon: fix internal display on iMac11, 1 (RV770/DCE3.1)

Xiong Weimin <[email protected]>
vdpa_sim: hold iommu_lock across dma_unmap passthrough transition

Kuninori Morimoto <[email protected]>
ASoC: codec: max98926: fixup invert setup mask

Andrew Onyshchuk <[email protected]>
platform/x86: thinkpad_acpi: Fix fan speed reporting on Edge E330

Yaroslav Dudkov <[email protected]>
platform/x86: msi-ec: Add MSI Katana GF76 11UEK EC firmware

Benjamin Coddington <[email protected]>
NFSv4/flexfiles: report cancelled I/O as a layout error

Alex Elder <[email protected]>
net: stmmac: use dma_addr_t for DMA addresses

Jia Zhu <[email protected]>
NFSv4: pin the superblock for active state owners

Xu Rao <[email protected]>
ALSA: hda: Add Lisuan HDMI controller and codec support

ZhangGuoDong <[email protected]>
NFS: Verify symlink inode before caching target

Thomas Huth <[email protected]>
smb: server: Free session data in user_session.c with kfree_sensitive()

Namjae Jeon <[email protected]>
ksmbd: notify parent directory leases on child create

Benjamin Coddington <[email protected]>
pNFS: honor clora_changed when recalling a layout

Thomas Huth <[email protected]>
smb: server: Make sure that passkey is not leaked on the heap in user_config.c

Namjae Jeon <[email protected]>
ksmbd: honor client signing-required in all modes

Namjae Jeon <[email protected]>
ksmbd: reject blocking compound lock requests

Gael Blivet <[email protected]>
ksmbd: fix AsyncId zeroed before use in smb2_lock() cancel response

Namjae Jeon <[email protected]>
ksmbd: fix SMB2 byte-range lock end offset

Yashraj Ghule <[email protected]>
ALSA: hda/realtek: Fix mute LED for HP Victus 15-fa1xxx (MB 8C3F)

ChenXiaoSong <[email protected]>
smb/server: cancel async requests when closing connection

Gael Blivet <[email protected]>
ksmbd: report actual xattr value length in stream enumeration

Gael Blivet <[email protected]>
ksmbd: skip fallocate for SMB2_CREATE_ALLOCATION_SIZE on a stream handle

Namjae Jeon <[email protected]>
ksmbd: allow FSCTL_SET_SPARSE without input buffer

Namjae Jeon <[email protected]>
ksmbd: honor byte-range locks for zero data

Namjae Jeon <[email protected]>
ksmbd: handle empty QUERY_ALLOCATED_RANGES output

Namjae Jeon <[email protected]>
ksmbd: return buffer too small for short security queries

Gael Blivet <[email protected]>
ksmbd: fix off-by-one rejecting minimal COPYCHUNK query-limits request

Namjae Jeon <[email protected]>
ksmbd: reject SMB3.1.1 binding with mismatched cipher

Gael Blivet <[email protected]>

    ksmbd: fix durable handle v2 default timeout units (60 -> 60000)

Namjae Jeon <[email protected]>
ksmbd: allow I/O on directory named streams

Namjae Jeon <[email protected]>
ksmbd: preserve access denied status for copychunk

Namjae Jeon <[email protected]>
ksmbd: protect private extended attributes

David C.C.M. Gall <[email protected]>
crypto: keembay - use crypto_memneq() to compare CCM AEAD tags

Israel Téllez García <[email protected]>
libbpf: Fix ring buffer consumer loop on 32-bit position wrap

David C.C.M. Gall <[email protected]>
crypto: sa2ul - use crypto_memneq() to compare AEAD tag

David C.C.M. Gall <[email protected]>
crypto: keembay - use crypto_memneq() to compare GCM AEAD tags

Eric Dumazet <[email protected]>
gre: fix ERSPAN o_flags race/corruption in xmit and fill_info

Yang Wen <[email protected]>
exfat: keep FITRIM within the requested range

Anuj Bolewar <[email protected]>
drm/virtio: reclaim pending vbufs before tearing down vqs

Basavaraj Natikar <[email protected]>
HID: amd_sfh: Serialize access to the shared emp2 pointer

Neil Andrews <[email protected]>
ALSA: usb-audio: Rename the Audient iD14 monitor mix volume control

Mathias Nyman <[email protected]>
xhci: include all root port children in recovery prevention on link error

Takashi Iwai <[email protected]>
ALSA: hda/intel: Add sanity check for BAR0 size

Farhan Ali <[email protected]>
PCI: Avoid saving config space state if inaccessible

Michail Tatas <[email protected]>
ipmi: Fix leak in __ipmi_bmc_register

Charles Keepax <[email protected]>
soundwire: dmi-quirks: Disable ghost Realtek on Asus ROG Zephyrus Duo

Arash Golgol <[email protected]>
regulator: fan53555: Add support for FAN53555BUC23X type

Jiaming Zhang <[email protected]>
hfsplus: validate extent record length before writing it back

Dmytro Moroziuk <[email protected]>
ALSA: hda/conexant: Add mute LED quirk for HP ProBook 440 G5

Matt Turner <[email protected]>
alpha: run the remote RTC access in a worker, not an IPI callback

Chao Shi <[email protected]>
nvme: ratelimit the completion-path messages driven by device data

Griffin Kroah-Hartman <[email protected]>
nfc: nxp-nci: Add remove on IRQ error

Griffin Kroah-Hartman <[email protected]>
nfc: mrvl: spi: Unregister dev on allocation fail

Vasant Hegde <[email protected]>
iommu/amd: Fix missing CMD_COMPLETE_PPR response for invalid PPR requests

Feng Tang <[email protected]>
selftests: net: reuseport_bpf_numa: consider cpuless numa node

John Johansen <[email protected]>
apparmor: fix auditing of mount binary data

Rongguang Wei <[email protected]>
tap: fix incorrect variable used for USO check in set_offload()

Geliang Tang <[email protected]>
nvme-tcp: look up host_iface in the current netns

Zhe Liu <[email protected]>
docs: cgroup-v2: fix stale "io" controller introduction

Brian Grech <[email protected]>
selftests/net: fin_ack_lat: fix latency threshold typo

Hari Mishal <[email protected]>
nvmet: passthru: fix OOB reads when parsing ns id descriptor list

Dapeng Mi <[email protected]>
perf/x86: Free hybrid state on PMU init failure

Dapeng Mi <[email protected]>
perf/x86: Unregister PMI handler on PMU init failure

Michal Pecio <[email protected]>

    ALSA: usx2y: Stop clearing urb->hcpriv before submission

Guanghui Feng <[email protected]>
iommu/vt-d: Fix CACHE_TAG_NESTING_DEVTLB polluting shared variables in flush loop

Pengpeng Hou <[email protected]>
fbdev: udlfb: validate vendor descriptor items

Andreas Kemnade <[email protected]>
fbdev: omap2: dsi: do not copy isr table

Atish Patra <[email protected]>
RISC-V: perf: fix resource cleanup on driver probe failure

Rui Qi <[email protected]>
riscv: kprobes: Prevent probes in breakpoint handlers

Daniel Golle <[email protected]>

    net: dsa: mt7530: check CORE_PLL_GROUP4 access in mt7531_setup()

Daniel Golle <[email protected]>
net: pcs: mtk-lynxi: check regmap reads in mtk_pcs_lynxi_get_state()

Daniel Golle <[email protected]>

    net: dsa: mt7530: check bus->read() error in core_rmw()

Laxman Acharya <[email protected]>
Bluetooth: hci_event: fix out-of-bounds read in LE PA report reassembly

Daniel Golle <[email protected]>
net: dsa: mt7530: error out on failed PHY_IAC command writes

Muhammad Saheed <[email protected]>
Bluetooth: hci_sync: Disable legacy instance's ext adv before setup snapshot

Iva Kasprzaková <[email protected]>
Bluetooth: fix BT dependency for submodules

Li Qiang <[email protected]>
Bluetooth: hci_bcsp: validate received packet lengths

Chen Changcheng <[email protected]>
Bluetooth: btrsi: Move set_bt_context after successful HCI registration

Zhang Heng <[email protected]>
ALSA: hda/realtek: Add quirk for Acer Nitro ANV16-42 headset mic

Zhang Heng <[email protected]>
ALSA: hda/conexant: Add pin config quirk for Huawei Matebook

Garrett Blackmon <[email protected]>
ALSA: hda/realtek: Fix speakers on ASUS ROG Zephyrus G14 GA403UM

Zhang Heng <[email protected]>
ALSA: hda/realtek: Fix headset mic on ASUS Vivobook S14 S5406SA

Junhao He <[email protected]>
ACPI: APEI: Handle repeated SEA error storms

Aurabindo Pillai <[email protected]>
drm/amd: Add DCN6 register headers

Filipe Manana <[email protected]>
btrfs: fix memory barrier order in reloc_root_is_dead()

Li Qiang <[email protected]>
Bluetooth: bfusb: validate received block boundaries

Zhao Dongdong <[email protected]>
Bluetooth: btnxpuart: Fix use-after-free in probe error path

Pengpeng Hou <[email protected]>
Bluetooth: hci_nokia: validate firmware packet bounds

Pavel Zverev <[email protected]>
Bluetooth: btusb: Add support for 1357:c123 Realtek 8852BE device

Gustavo Evgucci <[email protected]>
Bluetooth: btusb: Add USB ID 13d3:3625 for MediaTek MT7922

Rui Qi <[email protected]>
selftests/ftrace: Force C locale in ftracetest

Andreas Haufler <[email protected]>
tools/lib/thermal: Fix misplaced extern "C" closing brace

Yunye Zhao <[email protected]>
md: add cond_resched() to md_do_sync()'s skip path

Yu Kuai <[email protected]>
md: skip bitmap accounting for empty write ranges

Yu Kuai <[email protected]>
md/raid5: reject zero-sector reshape chunks

Shang En Sim <[email protected]>

    ALSA: hda/realtek: Enable mute LEDs on HP Spectre x360 16-aa0xxx

Junzhe Yu <[email protected]>
ext4: guard against NULL s_group_info in ext4_get_group_info

Pengpeng Hou <[email protected]>
HID: rmi: check report length before trimming sentinel bytes

Yang Wang <[email protected]>
drm/amd/pm: derive stable PPT limits from PPTable

liulhong617 <[email protected]>
arm64: mm: fix accidental linear mapping of no-map reserved memory

Stefan Hansson <[email protected]>
wifi: rsi: Fix types to appease CFI

Charles Keepax <[email protected]>
soundwire: dmi-quirks: Disable ghost Realtek on Asus Zenbook Duo

Praveen Talari <[email protected]>

    opp: Use clk_get_optional() to avoid leaving opp_table->clk as an error pointer

Edson Juliano Drosdeck <[email protected]>
ALSA: hda/realtek: Limit mic boost on Positivo N15RPE-S

Carl Quist <[email protected]>

    ALSA: hda/realtek: Enable mute LED on HP Laptop 15-dy0xxx

Zihan Xi <[email protected]>
xsk: account ring allocations to memcg

Jinhui Guo <[email protected]>
net: usb: cdc_ether: add quirk for AMI BMC stale link events

Johan Alvarado <[email protected]>
net: stmmac: raise TX completion interrupt at the end of an xmit burst

Felix Fietkau <[email protected]>
wifi: mt76: mt7603: file buffered frames under the TID reported to mac80211

Marcos Paulo Medeiros <[email protected]>
ACPI: video: force native backlight on Acer Nitro AN515-46

Luca Castaldini <[email protected]>
ALSA: hda/realtek: Add mute LED support for HP Pavilion 15-eh2xxx

Stefan Haberland <[email protected]>
s390/dasd: Snapshot intrc before freeing the request block

Simon Glass <[email protected]>
kconfig: abort rather than loop for ever on EOF

Allison Henderson <[email protected]>
net/rds: unpin MR pages with unpin_user_pages_dirty_lock()

Sharath Srinivasan <[email protected]>
net/rds: fix rds_message leak in the rds_send_xmit() drop path

Håkon Bugge <[email protected]>
net/rds: hold the socket while an rds_mr references it

Allison Henderson <[email protected]>
net/rds: don't use unpin_user_pages_dirty_lock() from atomic context

Wahid Khan <[email protected]>
HID: intel-ish-hid: ignore post-init ENUM_DEVICES from firmware

Yuxiang Lin <[email protected]>
HID: quirks: add ALWAYS_POLL quirk for AULA Mini 60 HE Pro Dongle

Aaron Ma <[email protected]>
HID: quirks: Add ALWAYS_POLL quirk for Beitong BTP-KP20D dongle

Stuart Hayhurst <[email protected]>
HID: logitech-hidpp: Add support for G502 X Plus USB mouse

Mauricio Orozco <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS VivoBook M515DA/X515DAP

Mariano Baragiola <[email protected]>
wifi: wilc1000: validate monitor transmit frame headers

Can Peng <[email protected]>
wifi: brcmfmac: validate msgbuf flowring IDs before use

Can Peng <[email protected]>
wifi: brcmfmac: Set DMA direction for msgbuf packet IDs

Felix Fietkau <[email protected]>
wifi: mt76: mt7603: restore hardware PS buffering after a service period

Felix Fietkau <[email protected]>
wifi: mt76: mt7603: fix U-APSD service period termination

Felix Fietkau <[email protected]>
wifi: mt76: set the EOSP bit in the QoS header of the last released frame

Felix Fietkau <[email protected]>

    wifi: mt76: mt7615: fix NULL deref in mt7615_mac_set_rates

Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: mtl: Power down DSP if it is left enabled in pre_fw_run()

ZhaoJinming <[email protected]>
wifi: ath11k: fix resource leak on error in ext IRQ setup

Geetha sowjanya <[email protected]>
perf: marvell: Cancel CN10K DDR PMU hrtimer on device remove

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: call skb_valid_dst() before skb_dst()

Minghao Zhang <[email protected]>
netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets

Zhi-Jun You <[email protected]>
wifi: mt76: wed: fix kernel panic on non-DBDC MT7986

Ahmed Naseef <[email protected]>

    wifi: mt76: mt7603: add 0x7592 EEPROM chip ID

Prashant Rahul <[email protected]>
wifi: mt76: mt7921: fix memory leak when skb_linearize fails in mcu rx event

David Bauer <[email protected]>
wifi: mt76: mt7915: configure noise floor reporting on reset

Devin Wittmayer <[email protected]>

    wifi: mt76: mt76x02: report rx FCS errors to mac80211

David Bauer <[email protected]>
wifi: mt76: mt7603: free beacon SKB on error

Hari Mishal <[email protected]>
virtio_console: take a kref in find_port_by_vq() to fix port UAF

Rosen Penev <[email protected]>
nvmem: brcm_nvram: fix out-of-bounds access on malformed flash data

Rosen Penev <[email protected]>
nvmem: brcm_nvram: reject empty NVRAM partition

이상호 <[email protected]>
romfs: detect hard link cycles

Genjian Zhang <[email protected]>
md/raid5: complete discard bios while reshape is active

bui duc phuc <[email protected]>
regulator: rt6245: Restore state on enable failure

Oleg Proshkin <[email protected]>

    mfd: axp20x: Preserve other control bits when powering off

Bob Song <[email protected]>
ALSA: hda/realtek: add missing error checks for COEF index reads in alc269

Dmitry Torokhov <[email protected]>
mfd: ipaq-micro: Fix out-of-bounds stack read in ipaq_micro_str

Konstantin Komarov <[email protected]>
fs/ntfs3: Fix memory leak in indx_find_sort()

Bob Song <[email protected]>

    ALSA: hda/realtek: add missing NULL check for codec->bus->pci

Yichong Chen <[email protected]>
exfat: free new directory cluster if zeroing fails

Pengpeng Hou <[email protected]>
soc: mediatek: add missing MODULE_DEVICE_TABLE()

Weiji Wang <[email protected]>
drm/panel-edp: Add BOE NE140QDM-NX2

Heiko Carstens <[email protected]>
s390/mm: Fix handling of vmalloc area in do_secure_storage_access()

Heiko Carstens <[email protected]>
s390/mm: Add missing mm check to do_secure_storage_access()

Armin Wolf <[email protected]>
platform/x86: dell-smbios-wmi: Fix chardev resource management

Rob Clark <[email protected]>
drm/msm: Fix barriers accessing ctx vm

Rob Clark <[email protected]>
drm/msm: Move nr_cmds initialization

wangdicheng <[email protected]>
ALSA: hda/conexant: Add NULL check for dc_mode_path

Yichong Chen <[email protected]>
exfat: clean up new entry on add entry failure

K Prateek Nayak <[email protected]>
arm64/runtime-const: Use aarch64_insn_patch_text_nosync() for patching

Matthew Stewart <[email protected]>
drm/amd/display: Fix rounding errors in CalculatePrefetchSchedule

Amber Lin <[email protected]>
drm/amdkfd: Fix signal reset event

David Strahan <[email protected]>
scsi: smartpqi: Add new PCI device-ids

Pengpeng Hou <[email protected]>
i2c: qup: Propagate clock enable failures

Gary Guo <[email protected]>
ata: ata_generic: Don't store pci_device_id

Colin Foster <[email protected]>
clk: clocking-wizard: fix clock difference detection

Dmitry Osipenko <[email protected]>
clk: tegra: support 48MHz clock for pll_p_out1

Pengpeng Hou <[email protected]>
clk: mediatek: mt6735-vencsys: add missing MODULE_DEVICE_TABLE()

Pengpeng Hou <[email protected]>
clk: mediatek: mt6735-vdecsys: add missing MODULE_DEVICE_TABLE()

Chen Changcheng <[email protected]>
media: cx88: fix memory leak in cx8802_register_driver() error path

Pengpeng Hou <[email protected]>
clk: imx: imx8qxp-lpcg: add missing MODULE_DEVICE_TABLE()

Pengpeng Hou <[email protected]>
clk: imx: imx8qxp: add missing MODULE_DEVICE_TABLE()

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Rate-limit the error ISR's log message

Bjorn Andersson <[email protected]>
remoteproc: Force shutdown during device removal

Yichong Chen <[email protected]>
exfat: write moved entry before removing source

Jay Vadayath <[email protected]>
udf: bound lengthAllocDescs from unallocated space entry

Jan Kara <[email protected]>
udf: Fix bh leak for unallocated space entries

Tyrel Datwyler <[email protected]>
scsi: ibmvfc: free ibmvfc_target allocations with mempool_free

Tyrel Datwyler <[email protected]>
scsi: ibmvfc: check for NULL evt in implicit LOGO and target delete path

Jiaxing Hu <[email protected]>
iommu/rockchip: Clear stale page faults before enabling stall

Pengpeng Hou <[email protected]>
hsi: omap_ssi: remove debugfs on port creation failure

Tomer Maimon <[email protected]>
pinctrl: npcm8xx: move GPIO IRQ setup into request_resources

Tomer Maimon <[email protected]>
pinctrl: npcm8xx: fix debounce register selection

Tomer Maimon <[email protected]>
pinctrl: npcm8xx: clear pending GPIO events during init

Tomer Maimon <[email protected]>
pinctrl: npcm8xx: enable RMII outputs from RMII groups

Pengpeng Hou <[email protected]>
firmware: imx: scu: manage mailbox channels and global handle

Abdun Nihaal <[email protected]>
platform/x86: int1092: Fix info leak in parse_package()

Konstantin Komarov <[email protected]>
fs/ntfs3: load ATTR_BITMAP run extents from $MFT extension records

Senjin <[email protected]>
fs/ntfs3: fix lseek EINVAL on sparse/compressed files with 64-bit clusters

Konstantin Komarov <[email protected]>
ntfs3: fix info-leak in ntfs_rename()

Kyle Zeng <[email protected]>
fs/ntfs3: reserve NUL byte when converting UTF-16 names

Brian Norris <[email protected]>
PCI/portdrv: Allow probing even without child services

Ruoyu Wang <[email protected]>
ntfs3: initialize err in attr_wof_frame_info

Pengpeng Hou <[email protected]>
soc: ixp4xx: qmgr: add missing MODULE_DEVICE_TABLE()

Randolph Sapp <[email protected]>
drm/etnaviv: force flush on power register ops

Rosen Penev <[email protected]>
ata: pata_ep93xx: fix PIO fallback when DMA init fails

Benjamin Marzinski <[email protected]>
bitops: make the *_bit_le functions use unsigned long

Zhang Yi <[email protected]>
ext4: use FGP_WRITEBEGIN for tail block zeroing

Zhang Yi <[email protected]>
ext4: check return value of ext4_get_block() in ext4_load_tail_bh()

Alexander Wilhelm <[email protected]>
wifi: ath12k: fix scan command endianness on big endian

Manikanta Pubbisetty <[email protected]>
wifi: ath10k: trigger hardware recovery upon rx failures

Pengpeng Hou <[email protected]>
wifi: ath11k: validate regulatory capability phy_id

Jiawen Wu <[email protected]>
net: libwx: disable TX VLAN offload for packets with >2 VLAN tags

Mukesh Ojha <[email protected]>
iommu/qcom: Publish pgtbl_ops before releasing init_mutex

Pengpeng Hou <[email protected]>

    thermal: intel: int340x: clean up RFIM groups on DVFS failure

Mukesh Ojha <[email protected]>
iommu/qcom: Enable clocks before hardware access in qcom_iommu_ctx_probe()

Mukesh Ojha <[email protected]>
iommu/qcom: Check pm_runtime_resume_and_get() return in probe

Heiko Schocher <[email protected]>
drm/panel: simple: Add Kyocera tcg070wvlq panel

Esteban Urrutia <[email protected]>
iommu/arm-smmu-qcom: Add SM8450 MDSS compatible

Baokun Li <[email protected]>
ext4: reject mount if clusters/inodes per group are not 8-aligned

Lachlan Hodges <[email protected]>
wifi: cfg80211: include cf1 offset when sending chandef

Kuan-Wei Chiu <[email protected]>
riscv, bpf: Add support for BPF_MOVSX in RV32 JIT

Pengpeng Hou <[email protected]>
power: reset: piix4-poweroff: add missing MODULE_DEVICE_TABLE()

Yuyang Huang <[email protected]>
net: prestera: ignore duplicate RIF destruction events

Aleksander Jan Bajkowski <[email protected]>
net: sfp: add quirk for HORACO copper SFP+ module

Pengpeng Hou <[email protected]>
power: supply: cros_pchg: unregister EC notifier

Kuan-Wei Chiu <[email protected]>
riscv, bpf: Add support for BPF_SDIV and BPF_SMOD in RV32 JIT

Thomas Renninger <[email protected]>
ACPI: sysfs: Properly map BERT and CCEL data to their ACPI tables

Zhao Li <[email protected]>
wifi: mac80211_hwsim: clear PMSR request state on abort

Shahar Tzarfati <[email protected]>
wifi: mac80211: ibss: read deauth reason_code after frame length check

Yun Zhou <[email protected]>
ext4: set EXT4_STATE_NO_EXPAND in ext4_evict_inode

Ali Alaei <[email protected]>
PCI: vmd: Handle BUS_RESTRICT_CFG value 3 for Arrow Lake-HX

Baokun Li <[email protected]>
ext4: reduce max cluster size to match documented 256MB limit

Yap Weei Choong <[email protected]>
platform/x86/amd/pmc: Add T14 Gen2 AMD (20XL) to s2idle quirk list

Kate Hsuan <[email protected]>
ACPI: battery: Sanitise model_number by dropping unprintable characters

Pengpeng Hou <[email protected]>
ACPI: FPDT: validate table and record lengths

Bob Song <[email protected]>
ALSA: hda: Check snd_hda_power_pm construct error before executing verb

Nizar Al-Kabbani <[email protected]>

    platform/x86: asus-nb-wmi: map ProArt key (0x8b) to KEY_PROG3

Dio Zhang <[email protected]>

    drm/panel: panel-edp: Adjust T8 timing for AUO B116XAK01.6 and B140XTK02.4

Yousef Alhouseen <[email protected]>
media: go7007: s2250: propagate control I/O failures

Rituparna Warwatkar <[email protected]>
media: dvb-core: fix feed leak on failed DMX_ADD_PID

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: ignore sync frames when sync is disabled

Ayala Beker <[email protected]>
wifi: iwlwifi: mld: drop connection on D3 resume failure

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mld: validate wake packet crypto overhead

Aditya Sherawat <[email protected]>
drm/msm/adreno: Add support for A704 GPU

Yuho Choi <[email protected]>
driver core: attribute_container: Unwind device_add() on attr failure

Logan Gunthorpe <[email protected]>
PCI: switchtec: Add Microchip PCI1008 to NTB DMA alias quirk

Logan Gunthorpe <[email protected]>
PCI: switchtec: Add Microchip PCI1008 device ID

Yousef Alhouseen <[email protected]>
misc: ibmvmc: reject oversized inbound messages

Pei Xiao <[email protected]>
ipack: ipoctal: add rwsem to guard against TOCTOU in remove path

Yousef Alhouseen <[email protected]>
misc: ibmvmc: release send buffer on write errors

Pengpeng Hou <[email protected]>
greybus: manifest: validate string descriptor header

Pengpeng Hou <[email protected]>
misc: rp1: clear chained IRQ handlers on teardown

Yousef Alhouseen <[email protected]>
misc: hpilo: validate device queue entries before use

Yousef Alhouseen <[email protected]>
misc: genwqe: handle a first DMA address of zero

Yousef Alhouseen <[email protected]>
misc: bcm-vk: validate write size before allocation

Ian Abbott <[email protected]>
comedi: pcmuio: Add sanity check to interrupt handler

Ian Abbott <[email protected]>
comedi: pcm816: Fix sanity check in interrupt handler

Ian Abbott <[email protected]>
comedi: pcmmio: Add sanity check to interrupt handler

Ian Abbott <[email protected]>
comedi: aio_iiro_16: Add sanity check to interrupt handler

Ian Abbott <[email protected]>
comedi: pcm711: Fix sanity check in interrupt handler

Ian Abbott <[email protected]>
comedi: dt2811: Fix sanity check in interrupt handler

Ian Abbott <[email protected]>
comedi: das6402: Add sanity check to interrupt handler

Ian Abbott <[email protected]>
comedi: quatech_daqp_cs: Fix sanity check in interrupt handler

Ian Abbott <[email protected]>
comedi: pcm818: Fix sanity check in interrupt handler

Ian Abbott <[email protected]>
comedi: ni_at_a2150: Fix sanity check in interrupt handler

Ian Abbott <[email protected]>
comedi: ni_atmio16d: Add sanity check to interrupt handler

Pengpeng Hou <[email protected]>
uio: sercos3: add missing MODULE_DEVICE_TABLE()

Michail Tatas <[email protected]>
USB: misc: uss720: Fix leak in get_1284_register

Oliver Neukum <[email protected]>
usb: misc: cypress_cy7c63: check result of IO

Lucas Martins Alves <[email protected]>
usb: musb: host: clear stale RX interrupt on three-strikes error

Hans Verkuil <[email protected]>
media: cec/core: drop cec_post_state_event call

Hans Verkuil <[email protected]>
media: cec: tegra_cec: don't break off msg on NACK

Shivaprasad G Bhat <[email protected]>
scsi: qla2xxx: Handle INTx not connected while passing through

Ilan Peer <[email protected]>
wifi: iwlwifi: mld: Do not cleanup FW state when the device is dead

Avraham Stern <[email protected]>
wifi: iwlwifi: mld: support aborting an ongoing ftm request

Mikko Perttunen <[email protected]>
gpu: host1x: Wait for timeout worker completion on channel free

Namhyung Kim <[email protected]>
tools/lib/api: Fix potential double-free from fdarray__grow()

Miri Korenblit <[email protected]>
wifi: iwlwifi: mld: cancel wiphy work before freeing wiphy

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: reset the smart fifo state upon FW stop

Stefan Binding <[email protected]>
ASoC: cs35l56: Add support for CS35L62 for SoundWire

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mld: reset the driver state upon firmware recovery

Jingyi Wang <[email protected]>
remoteproc: core: cancel crash_handler work in rproc_add() error path

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mld: validate D3_END notif size

Pengpeng Hou <[email protected]>
wifi: iwlwifi: validate UEFI reduced-power SKU TLV length

Miri Korenblit <[email protected]>
wifi: iwlwifi: support TTL platform device ID

Pengpeng Hou <[email protected]>
wifi: iwlwifi: validate PNVM SKU TLV length

Jingyi Wang <[email protected]>
remoteproc: qcom: Check subdev start status in rproc_stop()

Yousef Alhouseen <[email protected]>
media: go7007: avoid undefined shifts in MPEG-4 headers

Pengpeng Hou <[email protected]>
media: cx18: stop VBI start-code scan before short tail

Pengpeng Hou <[email protected]>
media: ivtv: stop VBI start-code scan before short tail

Jurison Murati <[email protected]>
media: i2c: ov8865: Program the sensor on stream start

Lucas Stach <[email protected]>
drm/etnaviv: check MMUv2 status after reset

Lucas Stach <[email protected]>
drm/etnaviv: check all modules for idle after reset

Jurison Murati <[email protected]>
media: i2c: ov8865: Drop the runtime PM usage count on stream failure

Hari Mishal <[email protected]>
nvme: clamp FDP nruhsd to allocated RUH status descriptor count

Haoxiang Li <[email protected]>
iwlwifi: dvm: add missing cleaup for on error path

Hari Mishal <[email protected]>
nvme: bound ns descriptor header and body to identify buffer

David Maximiliano Hermitte <[email protected]>
hfs: validate catalog CNIDs before instantiating inodes

Charles Keepax <[email protected]>
soundwire: intel_auxdevice: Add cs42l44 to wake_capable_list

Bard Liao <[email protected]>
soundwire: dmi-quirks: add a global ghost list

Niranjana Vishwanathapura <[email protected]>
drm/xe: only resume exec queues that were actually suspended

Hans Verkuil <[email protected]>
media: em28xx: use vb2_video_unregister_device

Hans Verkuil <[email protected]>
media: em28xx: requeue buffers if start_streaming fails

Hans Verkuil <[email protected]>

    media: em28xx: dev_info->pr_info since dev has been freed

Sean Rhodes <[email protected]>
mmc: rtsx_usb_sdmmc: suppress false CD after init timeout

Mike Tipton <[email protected]>
pmdomain: qcom: rpmhpd: Skip retention by default

Pengpeng Hou <[email protected]>
gpio: vf610: add missing MODULE_DEVICE_TABLE()

Pengpeng Hou <[email protected]>
crypto: keembay - add missing MODULE_DEVICE_TABLE()

Pengpeng Hou <[email protected]>

    pinctrl: sx150x: add missing MODULE_DEVICE_TABLE()

Gabriel Prostitis <[email protected]>
USB: gadget: inode: fix mm lifetime handling

David Laight <[email protected]>
usb_string_copy: Use kzalloc() to avoid leaking old data

Xu Rao <[email protected]>
usb: gadget: u_audio: clean up capture endpoint on feedback failure

Haoxiang Li <[email protected]>
usb: fsl_qe_udc: check qe_alloc_request() failure in ch9getstatus()

Aniket Randive <[email protected]>
serial: qcom_geni: Disable closing_wait for console to prevent shutdown timeout

Haoxiang Li <[email protected]>
tty: serial: pch_uart: add check for pci_get_slot()

Rahul Bukte <[email protected]>
serial: 8250: force synchronous probe for the ISA and PNP drivers

Xu Rao <[email protected]>
mmc: block: reject invalid perdev_minors before division

Arnd Bergmann <[email protected]>
media: v4l2-tpg: reduce stack usage for kasan builds

Pengpeng Hou <[email protected]>
media: cec: tegra: add missing MODULE_DEVICE_TABLE()

Chris Lew <[email protected]>
rpmsg: char: Check for ongoing chrdev destroy

Pranjal Shrivastava <[email protected]>
PCI/ATS: Ensure pci_ats_supported() is PF-aware for VFs

Muralidhara M K <[email protected]>
platform/x86/amd/hsmp: Validate _DSD mailbox sub-package element count

Pengpeng Hou <[email protected]>
ASoC: codecs: max98396: Unwind supplies on resume failure

Muralidhara M K <[email protected]>
platform/x86/amd/hsmp: Validate ACPI UID before parsing socket index

Qingtao Cao <[email protected]>
bus: mhi: core: Fix sys error transition latency

John Garry <[email protected]>
nvme: don't reference NS after unlocking in nvme_ns_head_ctrl_ioctl()

Alex Deucher <[email protected]>
drm/amdgpu/gfx11: WARN() rather than BUG() for invalid SDMA engine

Alex Deucher <[email protected]>
drm/amdgpu/atomfirmware: WARN() rather than BUG()

Pengpeng Hou <[email protected]>
ASoC: codecs: uda1342: Leave cache-only mode before syncing

Deepanshu Kartikey <[email protected]>
udf: avoid recursive s_alloc_mutex deadlock when freeing AED blocks

Kyle Zeng <[email protected]>
udf: validate extent partition references in udf_current_aext()

Pengpeng Hou <[email protected]>
usb: typec: mux: tusb1046: add missing MODULE_DEVICE_TABLE()

Devansh Soni <[email protected]>
staging: rtl8723bs: fix missing unregister_netdev on sdio_alloc_irq failure

Xixin Liu <[email protected]>
nvme: zns: cap zone report nr_zones by DMA buffer size

Xixin Liu <[email protected]>
nvme-auth: use crypto_memneq for DH-HMAC-CHAP response comparison

John Garry <[email protected]>
nvme: handle positive error codes in nuse_show()

Tanmay Shah <[email protected]>
remoteproc: core: Full attach detach during recovery

Jerome Brunet <[email protected]>
clk: sunxi-ng: fix ccu probe clock unregister on error

Marek Szyprowski <[email protected]>
mmc: dw_mmc: stop and complete DMA also in STATE_DATA_BUSY state

Pengpeng Hou <[email protected]>
mmc: sdhci-of-ma35d1: add missing MODULE_DEVICE_TABLE()

Ben Dooks <[email protected]>
mmc: cqhci: fix to missed endian conversions

Pengpeng Hou <[email protected]>
mmc: moxart: report DMA completion timeout

Pengpeng Hou <[email protected]>
gpio: sifive: add missing MODULE_DEVICE_TABLE()

David Heidelberg <[email protected]>
dt-bindings: arm: qcom,ids: Add SoC ID for Snapdragon SDM 850

Zhiwei Zhang <[email protected]>
RDMA/rxe: Check PDs for memory window binds

David Heidelberg <[email protected]>
soc: qcom: socinfo: Add SoC ID for SDM850

Seyeong Kim <[email protected]>
RDMA/irdma: Suppress PF reset on HMC error

Pengpeng Hou <[email protected]>
iio: adc: max1241: add missing MODULE_DEVICE_TABLE()

Yun Zhou <[email protected]>

    block: reject block device inodes with i_rdev == 0 in lookup_bdev()

Pengpeng Hou <[email protected]>
soc: amlogic: meson-clk-measure: remove debugfs tree

Chin-Yen Lee <[email protected]>
wifi: rtw89: wow: add QoS control field to WoWLAN ARP response for MLO

William Hansen-Baird <[email protected]>
wifi: rtlwifi: fix disabling of ASPM for RTL8723BE with AER flooding

Chih-Kang Chang <[email protected]>
wifi: rtw89: wow: only WiFi 6 chips initialize RF registers in WoWLAN mode

William Hansen-Baird <[email protected]>
wifi: rtlwifi: rtl8723be: Remove unnecessary irq save/restore in hw_init()

Ben Dooks <[email protected]>
dmaengine: dw-axi-dmac: fix __le32 on set of CH_CTL_H_LLI_VALID

Yun Zhou <[email protected]>
net: mvneta_bm: add suspend/resume support to prevent crash after resume

Pengpeng Hou <[email protected]>
dmaengine: pl330: remove debugfs file on teardown

Charles Keepax <[email protected]>
soundwire: dmi-quirks: Disable ghost Realtek on Asus Expertbook

Jiayuan Chen <[email protected]>
netfilter: ebtables: bound num_counters like nentries in do_replace()

Yousef Alhouseen <[email protected]>
net: usb: rtl8150: handle link status read failures

Yuan Chen <[email protected]>
libbpf: Skip bpf_object__probe_loading() when BPF token is in use

Haikun Zhou <[email protected]>
drm/panel-edp: Support MB116AS01'3 edp panel

Eric Huang <[email protected]>
drm/amdkfd: add sanity check in svm_range_is_valid

Yang Wang <[email protected]>
drm/amd/pm: Validate legacy hwmgr PP table offsets

Yang Wang <[email protected]>
drm/amd/pm: Validate Vega10 PPTable subtable bounds

Yang Wang <[email protected]>
drm/amd/pm: Validate Tonga PPTable subtable bounds

Xiang Liu <[email protected]>
drm/amd/pm: Guard VBIOS AC timing table walk

Yang Wang <[email protected]>
drm/amd/pm: Validate Tonga PowerPlay state array bounds

Yongqiang Sun <[email protected]>
drm/amdkfd: use node XCC count for v9 CRIU control stack restore

Yang Wang <[email protected]>
drm/amd/pm: Use uploaded size for legacy custom PPTable

Yang Wang <[email protected]>
drm/amd/pm: Validate pp_table header before reading size

Yang Wang <[email protected]>
drm/amd/pm: Validate Vega hwmgr PowerPlay table bounds

Gangliang Xie <[email protected]>
drm/amdgpu: add check for xcp id

Lijo Lazar <[email protected]>
drm/amdgpu: Guard reads in pcie state readout

Matthew Jacob <[email protected]>
drm/amdgpu: Support some Barco AMD based graphics adapters

Lijo Lazar <[email protected]>
drm/amd/pm: validate vega10 profile mode inputs

Asad Kamal <[email protected]>
drm/amdgpu: validate XCP topology counts before division

Lijo Lazar <[email protected]>
drm/amdgpu: Validate ATIF buffer length before use

Lijo Lazar <[email protected]>
drm/amdgpu: Fix kobject cleanup in xcp sysfs

Lijo Lazar <[email protected]>
drm/amdgpu: Validate ATPX buffer length before use

Lijo Lazar <[email protected]>
drm/amdgpu: Add checks to vbios fetch through ATRM

Abhijeeth Babu <[email protected]>
i2c: acpi: Force ELAN1300 touchpads to 100 kHz

Breno Leitao <[email protected]>
netpoll: do not warn when the best-effort pool refill fails

Paritosh Potukuchi <[email protected]>
i2c: amd-asf: Validate firmware-reported length

Nicolas Escande <[email protected]>
wifi: ath12k: avoid setting 320MHz support on non 6GHz band

Ruoyu Wang <[email protected]>
memory: stm32_omm: initialize ret in stm32_omm_set_amcr

Jiawen Liu <[email protected]>
spi: bcmbca-hsspi: return error from failed controller suspend

Jiawen Liu <[email protected]>
spi: nxp-fspi: disable runtime PM on probe failures

Jiawen Liu <[email protected]>
spi: fsl-dspi: clean up after failed suspend and resume

Damon Ding <[email protected]>
drm/panel-edp: Add BOE NE160QDM-NY1 panel

Jiawen Liu <[email protected]>
spi: bcm63xx-hsspi: return error from failed controller suspend

Jiawen Liu <[email protected]>
spi: bcm63xx: return error from failed controller suspend

Jiawen Liu <[email protected]>
spi: bcm-qspi: return error from failed controller suspend

Guopeng Zhang <[email protected]>
fs/namespace: notify pollers of legacy propagation changes

Zide Chen <[email protected]>
perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failure

Zizhi Wo <[email protected]>
fat: reject name longer than NAME_MAX in msdos_format_name()

Dapeng Mi <[email protected]>
perf/core: Fix kernel register info leak via hardware skid

Thomas Zimmermann <[email protected]>
drm/sysfb: simpledrm: Validate mmap size against framebuffer size

Dapeng Mi <[email protected]>
perf/x86/intel: Fallback to sw branch type decoding if no hw decoding

Bryam Vargas <[email protected]>
iio: accel: fxls8962af: clamp the device-reported FIFO sample count

Mithil Bavishi <[email protected]>
ARM: OMAP2+: Add CFI type for omap4_finish_suspend

Joe Simmons-Talbott <[email protected]>
selftests/cgroup: Adjust cpu test duration based on HZ

Uwe Kleine-König (The Capable Hub) <[email protected]>
regmap: maple: Workaround for another false-positive compiler warning

Haoxiang Li <[email protected]>
ASoC: hdac_hdmi: Fix resource cleanup on probe failure

Pengpeng Hou <[email protected]>
ASoC: tlv320aic26: remove keyclick sysfs file

William Theesfeld <[email protected]>
clk: zynq: handle kasprintf() failure in periph_clk registration

Pengpeng Hou <[email protected]>
spi: qpic-snand: free OOB buffer with ECC context

Pengpeng Hou <[email protected]>
ASoC: sma1303: remove fault-check sysfs group on remove

Kemeng Shi <[email protected]>
irqdomain: Plug leak in irq_domain_alloc_irqs_locked() error path

Cen Zhang <[email protected]>
ALSA: usb-audio: Release components on probe errors

Pengpeng Hou <[email protected]>
media: cec: stm32: return an error when log-address wait times out

Nícolas F. R. A. Prado <[email protected]>
ALSA: hda: Force resume if acomp notified during system suspend

Fu Hao <[email protected]>
ALSA: hda: Add support for Hygon family 18h model 5h HD-Audio

Kryštof Černý <[email protected]>
w1: ds2482: add OF device match table

Ruoyu Wang <[email protected]>
HID: wacom: avoid copying Bluetooth input reports

Christian Brauner <[email protected]>
selftests/filesystems/overlayfs: fix set_layers_via_fds link error

Pengpeng Hou <[email protected]>
gpio: pca9570: Use I2C match data

YiPeng Chai <[email protected]>
drm/amdgpu: add bounds check to prevent array overflow

Gangliang Xie <[email protected]>
drm/amdgpu: add buf length check

Ruoyu Wang <[email protected]>
drm/radeon: avoid double free in r600 DPM cleanup

Charlene Liu <[email protected]>
drm/amd/display: fix max dispclk_khz/dppclk_khz double 1000

Asad Kamal <[email protected]>
drm/amdgpu: Gate debugfs MMIO access on kernel lockdown

Asad Kamal <[email protected]>
drm/amd/pm: Validate OD DPM triples before mutating tables

Jesse Zhang <[email protected]>
drm/amdgpu/mes_v12_0: use mes schedule pipe for legacy queues on unified MES

Terry Hsiao <[email protected]>

    drm/panel-edp: Add BOE NV116WH2-M30, BOE NT116WHM-N21, BOE NV116FH1-M31, BOE NV116FH1-M30

Ryosuke Yasuoka <[email protected]>
drm/virtio: abort virtqueue wait on device removal to avoid hung task

Jonas Karlman <[email protected]>
drm/rockchip: dw_hdmi: Use resume_early pm ops for system suspend

YuanZhe Liu <[email protected]>
ALSA: line6: Clear prev_fbuf on capture buffer release

Tonghao Zhang <[email protected]>
net: bonding: move bond_should_notify_peers, e.g. into rtnl lock block

Tonghao Zhang <[email protected]>
net: bonding: use workqueue to make sure peer notify updated in lacp mode

Christian Brauner <[email protected]>
coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps

Christian Brauner <[email protected]>
fork: don't create io threads once PF_POSTCOREDUMP is set

Christian Brauner <[email protected]>
fork: move the coredump and exec checks into create_io_thread()

Christian Brauner <[email protected]>
exec: cancel io_uring requests before de_thread()

Guenter Roeck <[email protected]>
hwmon: (lm90) Rely on subsystem locking

André Draszik <[email protected]>
kbuild: link-vmlinux.sh: improve detection of third pass requirement

Ridham Khurana <[email protected]>
platform: cznic: turris-omnia-mcu: Add missing MODULE_DEVICE_TABLE()

Daniel Schaefer <[email protected]>
iio: hid-sensor: als: scale each channel individually

Baolin Wang <[email protected]>
mm: vmscan: fix dirty folios throttling on cgroup v1 for MGLRU

Namjae Jeon <[email protected]>
ksmbd: wait for negotiation before receiving another PDU

Zizhen Liu <[email protected]>
net: skbuff: propagate shared-frag marker in skb_zerocopy()

-------------

Diffstat:

 Documentation/admin-guide/cgroup-v2.rst            |    10 +-
 Documentation/block/blk-mq.rst                     |     2 +-
 .../bindings/interrupt-controller/arm,gic-v5.yaml  |     9 +-
 Documentation/filesystems/sharedsubtree.rst        |    20 +-
 Documentation/networking/rxrpc.rst                 |    21 +-
 Makefile                                           |     7 +-
 arch/alpha/kernel/rtc.c                            |    37 +-
 arch/arm/mach-omap2/sleep44xx.S                    |     5 +-
 arch/arm/mm/mmap.c                                 |    11 +-
 arch/arm64/include/asm/runtime-const.h             |    17 +-
 arch/arm64/mm/mmu.c                                |    14 +
 arch/loongarch/include/asm/kvm_eiointc.h           |     1 +
 arch/loongarch/include/asm/kvm_ipi.h               |     1 +
 arch/loongarch/include/asm/kvm_pch_pic.h           |     1 +
 arch/loongarch/include/asm/pgtable.h               |     2 +-
 arch/loongarch/kvm/intc/eiointc.c                  |     5 +
 arch/loongarch/kvm/intc/ipi.c                      |     5 +
 arch/loongarch/kvm/intc/pch_pic.c                  |     5 +
 arch/loongarch/kvm/main.c                          |    23 +-
 arch/loongarch/kvm/vcpu.c                          |    24 +-
 arch/loongarch/mm/init.c                           |    17 +-
 arch/mips/Kconfig                                  |     3 +-
 arch/powerpc/kvm/book3s_hv.c                       |    76 +-
 arch/powerpc/kvm/book3s_paired_singles.c           |     7 +-
 arch/riscv/Kconfig.errata                          |    14 +
 arch/riscv/errata/sifive/errata.c                  |    20 +
 arch/riscv/include/asm/errata_list_vendors.h       |     3 +-
 arch/riscv/include/asm/insn-def.h                  |    16 +-
 arch/riscv/kernel/sys_hwprobe.c                    |     4 +-
 arch/riscv/kernel/traps.c                          |     3 +
 arch/riscv/kvm/mmu.c                               |     8 +-
 arch/riscv/kvm/vcpu_pmu.c                          |     9 +
 arch/riscv/net/bpf_jit_comp32.c                    |    47 +-
 arch/s390/crypto/paes_s390.c                       |   213 +-
 arch/s390/crypto/phmac_s390.c                      |    25 +-
 arch/s390/include/asm/pkey.h                       |    16 +
 arch/s390/kernel/kprobes.c                         |     3 +
 arch/s390/kernel/perf_cpum_cf.c                    |     3 +
 arch/s390/kernel/process.c                         |    12 +-
 arch/s390/kernel/signal.c                          |     6 +-
 arch/s390/lib/probes.c                             |     2 +-
 arch/s390/mm/extable.c                             |     4 +-
 arch/s390/mm/fault.c                               |     7 +-
 arch/x86/events/core.c                             |    19 +-
 arch/x86/events/intel/lbr.c                        |     2 +-
 arch/x86/events/intel/uncore.c                     |     5 +-
 arch/x86/include/asm/cpufeatures.h                 |     1 +
 arch/x86/include/asm/cpuid/api.h                   |     1 +
 arch/x86/include/asm/kvm-x86-ops.h                 |     1 +
 arch/x86/include/asm/kvm_host.h                    |    25 +-
 arch/x86/kernel/cpu/bugs.c                         |    18 +-
 arch/x86/kernel/cpu/scattered.c                    |     1 +
 arch/x86/kernel/process.c                          |     1 +
 arch/x86/kvm/hyperv.c                              |     5 +-
 arch/x86/kvm/mmu/mmu.c                             |     8 +-
 arch/x86/kvm/mmu/paging_tmpl.h                     |    39 +-
 arch/x86/kvm/regs.c                                |     3 +-
 arch/x86/kvm/svm/nested.c                          |    15 +-
 arch/x86/kvm/svm/svm.c                             |    35 +-
 arch/x86/kvm/svm/svm.h                             |     1 +
 arch/x86/kvm/vmx/common.h                          |    20 +
 arch/x86/kvm/vmx/main.c                            |    26 +
 arch/x86/kvm/vmx/nested.c                          |    41 +-
 arch/x86/kvm/vmx/posted_intr.c                     |     2 +
 arch/x86/kvm/vmx/tdx.c                             |    56 +-
 arch/x86/kvm/vmx/vmx.c                             |    33 +-
 arch/x86/kvm/vmx/x86_ops.h                         |     1 +
 arch/x86/kvm/x86.c                                 |    99 +-
 arch/x86/kvm/xen.c                                 |    18 +
 arch/x86/mm/pat/set_memory.c                       |     8 +-
 block/bdev.c                                       |    12 +
 block/blk-crypto-fallback.c                        |     6 +
 crypto/af_alg.c                                    |     2 +-
 drivers/accel/rocket/rocket_job.c                  |     2 +-
 drivers/acpi/acpi_fpdt.c                           |    55 +-
 drivers/acpi/apei/ghes.c                           |    10 +-
 drivers/acpi/battery.c                             |    14 +
 drivers/acpi/button.c                              |    11 +
 drivers/acpi/sysfs.c                               |     9 +-
 drivers/acpi/video_detect.c                        |     8 +
 drivers/ata/ata_generic.c                          |     6 +-
 drivers/ata/pata_ep93xx.c                          |    30 +-
 drivers/ata/sata_fsl.c                             |    20 +-
 drivers/base/attribute_container.c                 |     7 +-
 drivers/base/base.h                                |     1 +
 drivers/base/bus.c                                 |    45 +-
 drivers/base/core.c                                |     4 +-
 drivers/base/dd.c                                  |    92 +-
 drivers/base/regmap/regcache-maple.c               |     2 +-
 drivers/base/regmap/regmap-debugfs.c               |     1 +
 drivers/base/regmap/regmap-irq.c                   |     2 +-
 drivers/base/regmap/regmap.c                       |    15 +-
 drivers/block/drbd/drbd_receiver.c                 |     4 +-
 drivers/block/xen-blkfront.c                       |    12 +-
 drivers/bluetooth/bfusb.c                          |    37 +-
 drivers/bluetooth/btnxpuart.c                      |     4 +-
 drivers/bluetooth/btrsi.c                          |     3 +-
 drivers/bluetooth/btusb.c                          |    10 +-
 drivers/bluetooth/hci_bcsp.c                       |     5 +-
 drivers/bluetooth/hci_nokia.c                      |    20 +
 drivers/bluetooth/hci_vhci.c                       |     4 +
 drivers/bus/mhi/host/pm.c                          |    14 +-
 drivers/char/ipmi/ipmi_msghandler.c                |     1 +
 drivers/char/tpm/Kconfig                           |     3 +-
 drivers/char/tpm/tpm_tis_spi.h                     |     8 +-
 drivers/char/virtio_console.c                      |    13 +-
 drivers/clk/imx/clk-imx8qxp-lpcg.c                 |     1 +
 drivers/clk/imx/clk-imx8qxp.c                      |     1 +
 drivers/clk/mediatek/clk-mt6735-vdecsys.c          |     1 +
 drivers/clk/mediatek/clk-mt6735-vencsys.c          |     1 +
 drivers/clk/sunxi-ng/ccu_common.c                  |    12 +-
 drivers/clk/tegra/clk-pll.c                        |     1 +
 drivers/clk/xilinx/clk-xlnx-clock-wizard.c         |     2 +-
 drivers/clk/zynq/clkc.c                            |     8 +
 drivers/comedi/drivers/aio_iiro_16.c               |     3 +
 drivers/comedi/drivers/das6402.c                   |    10 +-
 drivers/comedi/drivers/dt2811.c                    |     7 +-
 drivers/comedi/drivers/ni_at_a2150.c               |    13 +-
 drivers/comedi/drivers/ni_atmio16d.c               |     3 +
 drivers/comedi/drivers/pcl711.c                    |     3 +-
 drivers/comedi/drivers/pcl816.c                    |     3 +-
 drivers/comedi/drivers/pcl818.c                    |     3 +-
 drivers/comedi/drivers/pcmmio.c                    |     3 +
 drivers/comedi/drivers/pcmuio.c                    |     5 +-
 drivers/comedi/drivers/quatech_daqp_cs.c           |     4 +-
 drivers/cpufreq/rcpufreq_dt.rs                     |     1 +
 .../crypto/intel/keembay/keembay-ocs-aes-core.c    |     3 +-
 drivers/crypto/intel/keembay/keembay-ocs-ecc.c     |     1 +
 drivers/crypto/intel/keembay/ocs-aes.c             |     3 +-
 drivers/crypto/sa2ul.c                             |     3 +-
 drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c     |     2 +-
 drivers/dma/pl330.c                                |    19 +-
 drivers/edac/edac_mc.c                             |     6 +-
 drivers/firmware/imx/imx-scu.c                     |    25 +-
 drivers/gpio/gpio-mvebu.c                          |    33 +-
 drivers/gpio/gpio-pca9570.c                        |     2 +-
 drivers/gpio/gpio-sifive.c                         |     1 +
 drivers/gpio/gpio-vf610.c                          |     1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c           |    68 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v11.c |     3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c   |     2 -
 drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c   |    33 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c           |    10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c        |     7 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |     4 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c         |     5 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c            |     7 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c            |    11 +-
 drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c         |    61 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c             |     2 +
 drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c             |     2 +
 drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c             |     4 +-
 drivers/gpu/drm/amd/amdgpu/mes_v12_0.c             |    27 +-
 drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c              |     2 +-
 drivers/gpu/drm/amd/amdkfd/kfd_events.c            |    17 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c   |     4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c   |     4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c   |     4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c    |     6 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c    |     7 +-
 .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c |     2 +-
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c               |     8 +-
 .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c    |     3 +
 .../drm/amd/display/dc/dml2/dml21/dml21_wrapper.c  |     8 +-
 .../dc/dml2/dml21/inc/dml_top_display_cfg_types.h  |    11 +
 .../dml2/dml21/inc/dml_top_soc_parameter_types.h   |     7 +-
 .../amd/display/dc/dml2/dml21/inc/dml_top_types.h  |    13 +
 .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c     |    66 +-
 .../dml2/dml21/src/dml2_core/dml2_core_factory.c   |     2 +
 .../dml21/src/dml2_core/dml2_core_shared_types.h   |    54 +-
 .../dc/dml2/dml21/src/dml2_core/dml2_core_utils.c  |     2 +
 .../dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c  |   445 +-
 .../dml21/src/inc/dml2_internal_shared_types.h     |    36 +-
 .../amd/display/dc/resource/dce60/dce60_resource.c |     7 +
 .../amd/include/asic_reg/dcn/dcn_6_0_0_offset.h    | 15799 +++++
 .../amd/include/asic_reg/dcn/dcn_6_0_0_sh_mask.h   | 58556 +++++++++++++++++++
 .../amd/include/asic_reg/dpcs/dpcs_6_0_0_offset.h  |    47 +
 .../amd/include/asic_reg/dpcs/dpcs_6_0_0_sh_mask.h |    55 +
 .../include/asic_reg/mmhub/mmhub_5_0_1_offset.h    |    17 +
 .../include/asic_reg/mmhub/mmhub_5_0_1_sh_mask.h   |    17 +
 drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c   |    21 +-
 .../gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c    |    28 +-
 .../amd/pm/powerplay/hwmgr/process_pptables_v1_0.c |   673 +-
 .../drm/amd/pm/powerplay/hwmgr/processpptables.c   |   446 +-
 .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c    |    36 +-
 .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c  |    48 +-
 .../pm/powerplay/hwmgr/vega10_processpptables.c    |   623 +-
 .../pm/powerplay/hwmgr/vega12_processpptables.c    |     7 +
 .../pm/powerplay/hwmgr/vega20_processpptables.c    |     7 +
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c          |    19 +-
 drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c  |    25 +-
 drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c    |    32 +-
 .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c    |    28 +-
 drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c |     8 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c   |     2 -
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c   |     4 +-
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c              |    33 +-
 drivers/gpu/drm/etnaviv/etnaviv_gpu.h              |     6 +
 drivers/gpu/drm/msm/adreno/a6xx_catalog.c          |     2 +-
 drivers/gpu/drm/msm/msm_drv.c                      |    13 +-
 drivers/gpu/drm/msm/msm_gem_shrinker.c             |     3 +-
 drivers/gpu/drm/msm/msm_gem_submit.c               |     5 +-
 drivers/gpu/drm/panel/panel-edp.c                  |    11 +-
 drivers/gpu/drm/panel/panel-simple.c               |     3 +
 drivers/gpu/drm/panthor/panthor_sched.c            |    14 +-
 drivers/gpu/drm/radeon/atombios_crtc.c             |     5 +-
 drivers/gpu/drm/radeon/atombios_encoders.c         |    23 +-
 drivers/gpu/drm/radeon/r600_dpm.c                  |    21 +-
 drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c        |     7 +-
 drivers/gpu/drm/sysfb/simpledrm.c                  |    24 +
 drivers/gpu/drm/virtio/virtgpu_drv.c               |    15 +
 drivers/gpu/drm/virtio/virtgpu_drv.h               |     2 +
 drivers/gpu/drm/virtio/virtgpu_kms.c               |     1 +
 drivers/gpu/drm/virtio/virtgpu_vq.c                |    38 +-
 drivers/gpu/drm/xe/display/intel_fb_bo.c           |     3 +-
 drivers/gpu/drm/xe/display/xe_fb_pin.c             |     3 +-
 drivers/gpu/drm/xe/xe_exec_queue_types.h           |    12 +
 drivers/gpu/drm/xe/xe_preempt_fence.c              |     7 +
 drivers/gpu/drm/xe/xe_vm.c                         |    18 +-
 drivers/gpu/host1x/hw/cdma_hw.c                    |     2 +-
 drivers/greybus/manifest.c                         |     2 +
 drivers/hid/amd-sfh-hid/amd_sfh_client.c           |     4 +-
 .../amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.h  |     2 -
 .../hid_descriptor/amd_sfh_hid_report_desc.h       |     7 -
 drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c |     6 +
 drivers/hid/hid-core.c                             |     4 +-
 drivers/hid/hid-cougar.c                           |     3 +
 drivers/hid/hid-cp2112.c                           |     9 +-
 drivers/hid/hid-elecom.c                           |     6 +-
 drivers/hid/hid-elo.c                              |     3 +
 drivers/hid/hid-ids.h                              |    13 +-
 drivers/hid/hid-input.c                            |    17 +-
 drivers/hid/hid-logitech-dj.c                      |     3 +
 drivers/hid/hid-logitech-hidpp.c                   |     2 +
 drivers/hid/hid-mcp2200.c                          |     5 +
 drivers/hid/hid-mcp2221.c                          |     2 +-
 drivers/hid/hid-multitouch.c                       |    19 +-
 drivers/hid/hid-picolcd_fb.c                       |    12 +-
 drivers/hid/hid-prodikeys.c                        |     7 +-
 drivers/hid/hid-pxrc.c                             |     3 +
 drivers/hid/hid-quirks.c                           |     7 +-
 drivers/hid/hid-rmi.c                              |     2 +-
 drivers/hid/hid-roccat-isku.c                      |     3 +
 drivers/hid/hid-roccat-koneplus.c                  |     3 +
 drivers/hid/hid-roccat-konepure.c                  |     3 +
 drivers/hid/hid-roccat-kovaplus.c                  |     3 +
 drivers/hid/hid-roccat-pyra.c                      |     3 +
 drivers/hid/hid-roccat-ryos.c                      |     3 +
 drivers/hid/hid-roccat-savu.c                      |     3 +
 drivers/hid/hid-roccat.c                           |     8 +-
 drivers/hid/hid-universal-pidff.c                  |     1 +
 drivers/hid/hid-zydacron.c                         |     3 +
 drivers/hid/i2c-hid/i2c-hid-core.c                 |     6 +-
 drivers/hid/intel-ish-hid/ishtp-hid-client.c       |     5 +-
 .../intel-thc-hid/intel-quicki2c/pci-quicki2c.c    |     6 +-
 .../intel-thc-hid/intel-quickspi/pci-quickspi.c    |     3 +-
 drivers/hid/usbhid/hiddev.c                        |    37 +-
 drivers/hid/wacom_sys.c                            |   198 +-
 drivers/hid/wacom_wac.c                            |   107 +-
 drivers/hid/wacom_wac.h                            |     6 +-
 drivers/hsi/controllers/omap_ssi_core.c            |     3 +
 drivers/hv/ring_buffer.c                           |    29 +-
 drivers/hwmon/asus_rog_ryujin.c                    |   151 +-
 drivers/hwmon/lm90.c                               |    25 +-
 drivers/i2c/busses/i2c-amd-asf-plat.c              |     4 +
 drivers/i2c/busses/i2c-imx-lpi2c.c                 |    21 +-
 drivers/i2c/busses/i2c-qup.c                       |    31 +-
 drivers/i2c/i2c-core-acpi.c                        |     1 +
 drivers/i3c/master.c                               |     3 +-
 drivers/iio/accel/fxls8962af-core.c                |     2 +
 drivers/iio/adc/max1241.c                          |     1 +
 drivers/iio/light/hid-sensor-als.c                 |    22 +-
 drivers/infiniband/hw/erdma/erdma_cm.c             |     4 +-
 drivers/infiniband/hw/irdma/i40iw_hw.c             |     4 +-
 drivers/infiniband/hw/irdma/icrdma_hw.c            |     2 +
 drivers/infiniband/hw/irdma/icrdma_hw.h            |     2 +
 drivers/infiniband/hw/irdma/icrdma_if.c            |    17 +-
 drivers/infiniband/hw/irdma/irdma.h                |     2 +
 drivers/infiniband/sw/rxe/rxe_mw.c                 |    20 +-
 drivers/infiniband/sw/siw/siw_cm.c                 |     6 +-
 drivers/iommu/amd/amd_iommu_types.h                |     1 +
 drivers/iommu/amd/iommu.c                          |    38 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c        |     2 +-
 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c     |    16 +-
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c         |     1 +
 drivers/iommu/arm/arm-smmu/qcom_iommu.c            |    18 +-
 drivers/iommu/intel/cache.c                        |     5 +-
 drivers/iommu/iommufd/eventq.c                     |     4 +-
 drivers/iommu/rockchip-iommu.c                     |    13 +
 drivers/ipack/devices/ipoctal.c                    |    16 +-
 drivers/irqchip/irq-gic-v5-irs.c                   |     4 +
 drivers/isdn/mISDN/l1oip_core.c                    |     2 +-
 drivers/isdn/mISDN/socket.c                        |     4 +-
 drivers/md/md.c                                    |    13 +-
 drivers/md/raid5.c                                 |    13 +-
 drivers/media/cec/core/cec-adap.c                  |     1 -
 drivers/media/cec/platform/stm32/stm32-cec.c       |    16 +-
 drivers/media/cec/platform/tegra/tegra_cec.c       |    14 +-
 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c      |    14 +-
 drivers/media/dvb-core/dmxdev.c                    |    11 +-
 drivers/media/i2c/ov8865.c                         |    48 +-
 drivers/media/pci/cx18/cx18-vbi.c                  |     2 +-
 drivers/media/pci/cx23885/cx23885-core.c           |     4 +
 drivers/media/pci/cx23885/cx23885-dvb.c            |    14 +-
 drivers/media/pci/cx88/cx88-mpeg.c                 |    10 +-
 drivers/media/pci/intel/ipu-bridge.c               |     2 +-
 drivers/media/pci/ivtv/ivtv-vbi.c                  |     2 +-
 drivers/media/platform/marvell/mcam-core.c         |    14 +-
 .../media/platform/microchip/microchip-csi2dc.c    |     1 +
 .../media/platform/microchip/microchip-isc-base.c  |     6 +
 .../platform/microchip/microchip-sama5d2-isc.c     |    17 +-
 .../platform/microchip/microchip-sama7g5-isc.c     |    17 +-
 drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c     |     2 +
 drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c   |     4 +-
 drivers/media/rc/bpf-lirc.c                        |    18 +-
 drivers/media/rc/fintek-cir.c                      |     4 +
 drivers/media/rc/imon.c                            |     5 -
 drivers/media/rc/ir-mce_kbd-decoder.c              |     5 +-
 drivers/media/rc/lirc_dev.c                        |     3 +
 drivers/media/rc/rc-ir-raw.c                       |    66 +-
 drivers/media/rc/rc-main.c                         |    42 +-
 drivers/media/rc/redrat3.c                         |     4 +
 drivers/media/usb/au0828/au0828-dvb.c              |     1 +
 drivers/media/usb/em28xx/em28xx-audio.c            |     7 +
 drivers/media/usb/em28xx/em28xx-cards.c            |     2 +-
 drivers/media/usb/em28xx/em28xx-video.c            |    26 +-
 drivers/media/usb/go7007/go7007-driver.c           |     5 +-
 drivers/media/usb/go7007/go7007-fw.c               |    28 +-
 drivers/media/usb/go7007/s2250-board.c             |    54 +-
 drivers/media/usb/gspca/gspca.c                    |     3 +-
 drivers/media/usb/hackrf/hackrf.c                  |     7 +-
 drivers/media/usb/usbtv/usbtv-core.c               |     6 +-
 drivers/media/usb/usbtv/usbtv-video.c              |     4 +
 drivers/memory/stm32_omm.c                         |     2 +-
 drivers/mfd/axp20x.c                               |     2 +-
 drivers/mfd/ipaq-micro.c                           |     2 +-
 drivers/misc/bcm-vk/bcm_vk_msg.c                   |    18 +-
 drivers/misc/genwqe/card_utils.c                   |     2 +-
 drivers/misc/hpilo.c                               |     7 +-
 drivers/misc/ibmvmc.c                              |    17 +-
 drivers/misc/rp1/rp1_pci.c                         |     3 +
 drivers/mmc/core/block.c                           |     5 +
 drivers/mmc/host/cqhci-core.c                      |    14 +-
 drivers/mmc/host/dw_mmc.c                          |     1 +
 drivers/mmc/host/moxart-mmc.c                      |    11 +-
 drivers/mmc/host/rtsx_usb_sdmmc.c                  |    13 +-
 drivers/mmc/host/sdhci-of-ma35d1.c                 |     1 +
 drivers/net/bonding/bond_3ad.c                     |     7 +-
 drivers/net/bonding/bond_main.c                    |    96 +-
 drivers/net/dsa/mt7530.c                           |    44 +-
 drivers/net/ethernet/marvell/mvneta.c              |    18 +
 drivers/net/ethernet/marvell/mvneta_bm.c           |    72 +
 .../ethernet/marvell/prestera/prestera_router.c    |     6 +-
 drivers/net/ethernet/mediatek/mtk_wed.c            |     5 +
 drivers/net/ethernet/mediatek/mtk_wed_regs.h       |     1 +
 drivers/net/ethernet/sfc/efx.c                     |     4 +
 drivers/net/ethernet/stmicro/stmmac/chain_mode.c   |     3 +-
 drivers/net/ethernet/stmicro/stmmac/ring_mode.c    |     3 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |     4 +
 .../net/ethernet/stmicro/stmmac/stmmac_platform.c  |     6 +-
 drivers/net/ethernet/wangxun/libwx/wx_lib.c        |    24 +
 drivers/net/pcs/pcs-mtk-lynxi.c                    |     7 +-
 drivers/net/phy/sfp.c                              |     3 +
 drivers/net/ppp/pptp.c                             |     4 +-
 drivers/net/tap.c                                  |     5 +-
 drivers/net/usb/cdc_ether.c                        |    16 +
 drivers/net/usb/pegasus.c                          |     6 +-
 drivers/net/usb/qmi_wwan.c                         |     1 +
 drivers/net/usb/rtl8150.c                          |     4 +-
 drivers/net/wireless/ath/ath10k/htt_rx.c           |     6 +-
 drivers/net/wireless/ath/ath11k/ahb.c              |    79 +-
 drivers/net/wireless/ath/ath11k/wmi.c              |     6 +
 drivers/net/wireless/ath/ath12k/wmi.c              |    37 +-
 drivers/net/wireless/ath/ath12k/wmi.h              |    10 +
 drivers/net/wireless/ath/ath9k/channel.c           |     2 +
 drivers/net/wireless/broadcom/b43/main.c           |     5 +-
 .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c  |    47 +-
 drivers/net/wireless/intel/iwlwifi/dvm/tx.c        |     4 +-
 drivers/net/wireless/intel/iwlwifi/fw/pnvm.c       |     6 +
 drivers/net/wireless/intel/iwlwifi/fw/uefi.c       |     6 +
 drivers/net/wireless/intel/iwlwifi/mld/d3.c        |    76 +-
 .../net/wireless/intel/iwlwifi/mld/ftm-initiator.c |    21 +
 .../net/wireless/intel/iwlwifi/mld/ftm-initiator.h |     1 +
 drivers/net/wireless/intel/iwlwifi/mld/mac80211.c  |    19 +-
 drivers/net/wireless/intel/iwlwifi/mld/mac80211.h  |     2 +
 drivers/net/wireless/intel/iwlwifi/mld/mld.c       |     4 +
 drivers/net/wireless/intel/iwlwifi/mvm/ops.c       |     1 +
 drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h |     4 +
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c      |     1 +
 drivers/net/wireless/mediatek/mt76/mt7603/beacon.c |     2 +
 drivers/net/wireless/mediatek/mt76/mt7603/dma.c    |     2 +-
 drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c |     1 +
 drivers/net/wireless/mediatek/mt76/mt7603/mac.c    |    73 +-
 drivers/net/wireless/mediatek/mt76/mt7603/main.c   |    78 +-
 drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h |     4 +
 .../net/wireless/mediatek/mt76/mt7615/pci_mac.c    |     5 +-
 .../net/wireless/mediatek/mt76/mt7615/usb_sdio.c   |     5 +-
 drivers/net/wireless/mediatek/mt76/mt76x02_mac.c   |     3 +
 drivers/net/wireless/mediatek/mt76/mt7915/mac.c    |     9 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c    |     4 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mac.c    |     4 +-
 drivers/net/wireless/mediatek/mt76/tx.c            |    16 +-
 drivers/net/wireless/mediatek/mt76/wed.c           |     7 +-
 drivers/net/wireless/microchip/wilc1000/mon.c      |    30 +-
 drivers/net/wireless/realtek/rtlwifi/pci.c         |    39 +-
 .../net/wireless/realtek/rtlwifi/rtl8723be/hw.c    |     6 -
 drivers/net/wireless/realtek/rtw89/fw.c            |    31 +-
 drivers/net/wireless/realtek/rtw89/wow.c           |     3 +-
 drivers/net/wireless/rsi/rsi_91x_coex.c            |     3 +-
 drivers/net/wireless/rsi/rsi_91x_main.c            |     7 +-
 drivers/net/wireless/rsi/rsi_91x_sdio_ops.c        |     3 +-
 drivers/net/wireless/rsi/rsi_91x_usb_ops.c         |     7 +-
 drivers/net/wireless/rsi/rsi_common.h              |     2 +-
 drivers/net/wireless/rsi/rsi_sdio.h                |     2 +-
 drivers/net/wireless/rsi/rsi_usb.h                 |     2 +-
 drivers/net/wireless/virtual/mac80211_hwsim.c      |    10 +-
 drivers/net/wwan/wwan_hwsim.c                      |     4 +
 drivers/nfc/nfcmrvl/spi.c                          |     4 +
 drivers/nfc/nxp-nci/i2c.c                          |     4 +-
 drivers/nvme/host/auth.c                           |     3 +-
 drivers/nvme/host/core.c                           |     6 +-
 drivers/nvme/host/fc.c                             |     2 +-
 drivers/nvme/host/ioctl.c                          |     2 +-
 drivers/nvme/host/nvme.h                           |     6 +-
 drivers/nvme/host/pci.c                            |     6 +-
 drivers/nvme/host/sysfs.c                          |     4 +-
 drivers/nvme/host/tcp.c                            |     8 +-
 drivers/nvme/host/zns.c                            |     8 +-
 drivers/nvme/target/fabrics-cmd-auth.c             |     3 +-
 drivers/nvme/target/fc.c                           |     8 +-
 drivers/nvme/target/passthru.c                     |     9 +
 drivers/nvme/target/pr.c                           |     2 +-
 drivers/nvme/target/tcp.c                          |     2 +-
 drivers/nvmem/brcm_nvram.c                         |    15 +-
 drivers/nvmem/core.c                               |     4 +-
 drivers/opp/core.c                                 |    54 +-
 drivers/pci/ats.c                                  |     7 +-
 drivers/pci/controller/vmd.c                       |     7 +
 drivers/pci/pci.c                                  |    25 +
 drivers/pci/pcie/portdrv.c                         |    28 +-
 drivers/pci/quirks.c                               |     1 +
 drivers/pci/switch/switchtec.c                     |     1 +
 drivers/perf/marvell_cn10k_ddr_pmu.c               |     6 +
 drivers/perf/riscv_pmu_sbi.c                       |    33 +-
 drivers/phy/phy-core.c                             |    45 +-
 drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c          |    96 +-
 drivers/pinctrl/pinctrl-sx150x.c                   |     1 +
 drivers/platform/cznic/turris-omnia-mcu-base.c     |     1 +
 drivers/platform/x86/amd/hfi/hfi.c                 |     5 +
 drivers/platform/x86/amd/hsmp/acpi.c               |    15 +-
 drivers/platform/x86/amd/pmc/pmc-quirks.c          |     8 +
 drivers/platform/x86/asus-nb-wmi.c                 |     1 +
 drivers/platform/x86/dell/dell-smbios-wmi.c        |    69 +-
 drivers/platform/x86/intel/int1092/intel_sar.c     |     8 +-
 drivers/platform/x86/lenovo/thinkpad_acpi.c        |     1 +
 drivers/platform/x86/msi-ec.c                      |     1 +
 drivers/pmdomain/qcom/rpmhpd.c                     |    14 +-
 drivers/power/reset/piix4-poweroff.c               |     1 +
 drivers/power/supply/cros_peripheral_charger.c     |    13 +-
 drivers/power/supply/sbs-battery.c                 |    11 +
 drivers/powercap/intel_rapl_common.c               |     4 +-
 drivers/pps/generators/pps_gen.c                   |    81 +-
 drivers/rapidio/devices/rio_mport_cdev.c           |     5 +-
 drivers/regulator/fan53555.c                       |     6 +
 drivers/regulator/rt6245-regulator.c               |     5 +-
 drivers/remoteproc/remoteproc_core.c               |   118 +-
 drivers/rpmsg/rpmsg_char.c                         |     5 +
 drivers/rtc/rtc-ab-eoz9.c                          |     1 +
 drivers/rtc/rtc-brcmstb-waketimer.c                |     1 +
 drivers/rtc/rtc-ds1307.c                           |     2 +-
 drivers/s390/block/dasd.c                          |    10 +-
 drivers/s390/crypto/zcrypt_ccamisc.c               |    22 +-
 drivers/scsi/dc395x.c                              |    10 +-
 drivers/scsi/ibmvscsi/ibmvfc.c                     |    10 +-
 drivers/scsi/qla2xxx/qla_os.c                      |    15 +-
 drivers/scsi/scsi_devinfo.c                        |     2 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |    36 +
 drivers/scsi/snic/snic_main.c                      |     1 +
 drivers/soc/amlogic/meson-clk-measure.c            |    14 +
 drivers/soc/ixp4xx/ixp4xx-qmgr.c                   |     1 +
 drivers/soc/mediatek/mtk-dvfsrc.c                  |     1 +
 drivers/soc/qcom/socinfo.c                         |     1 +
 drivers/soundwire/dmi-quirks.c                     |    42 +-
 drivers/soundwire/intel_auxdevice.c                |     1 +
 drivers/spi/spi-bcm-qspi.c                         |     6 +-
 drivers/spi/spi-bcm63xx-hsspi.c                    |     6 +-
 drivers/spi/spi-bcm63xx.c                          |     5 +-
 drivers/spi/spi-bcmbca-hsspi.c                     |     6 +-
 drivers/spi/spi-cadence-quadspi.c                  |     3 +-
 drivers/spi/spi-fsl-dspi.c                         |    21 +-
 drivers/spi/spi-loongson-core.c                    |     6 +-
 drivers/spi/spi-nxp-fspi.c                         |    31 +-
 drivers/spi/spi-pci1xxxx.c                         |    71 +
 drivers/spi/spi-qpic-snand.c                       |     6 +-
 drivers/spmi/spmi.c                                |     3 +-
 drivers/staging/rtl8723bs/os_dep/sdio_intf.c       |     5 +-
 drivers/target/iscsi/iscsi_target_login.c          |     2 +-
 .../intel/int340x_thermal/processor_thermal_rfim.c |    11 +-
 drivers/thunderbolt/icm.c                          |     6 +-
 drivers/thunderbolt/tb.c                           |     4 +-
 drivers/thunderbolt/test.c                         |    37 +-
 drivers/thunderbolt/tunnel.c                       |    47 +-
 drivers/thunderbolt/tunnel.h                       |     8 +-
 drivers/tty/serial/8250/8250_platform.c            |     1 +
 drivers/tty/serial/8250/8250_pnp.c                 |     1 +
 drivers/tty/serial/pch_uart.c                      |     5 +
 drivers/tty/serial/qcom_geni_serial.c              |     8 +
 drivers/tty/serial/serial_core.c                   |    91 +-
 drivers/uio/uio_sercos3.c                          |     1 +
 drivers/usb/core/driver.c                          |     1 -
 drivers/usb/core/message.c                         |     1 +
 drivers/usb/gadget/configfs.c                      |     4 +-
 drivers/usb/gadget/function/u_audio.c              |    12 +-
 drivers/usb/gadget/legacy/inode.c                  |    20 +-
 drivers/usb/gadget/udc/fsl_qe_udc.c                |     8 +-
 drivers/usb/host/xhci-ring.c                       |    27 +-
 drivers/usb/host/xhci.c                            |     4 +-
 drivers/usb/host/xhci.h                            |     9 +-
 drivers/usb/misc/cypress_cy7c63.c                  |     8 +-
 drivers/usb/misc/uss720.c                          |     1 +
 drivers/usb/mtu3/mtu3_trace.h                      |     4 +-
 drivers/usb/musb/musb_host.c                       |    14 +-
 drivers/usb/typec/mux/tusb1046.c                   |     1 +
 drivers/vdpa/mlx5/net/mlx5_vnet.c                  |    23 +-
 drivers/vdpa/vdpa_sim/vdpa_sim.c                   |     3 +-
 drivers/video/backlight/lm3630a_bl.c               |     1 +
 drivers/video/backlight/qcom-wled.c                |    35 +-
 drivers/video/fbdev/atmel_lcdfb.c                  |    11 +-
 drivers/video/fbdev/core/fbcon.c                   |     7 +
 drivers/video/fbdev/omap2/omapfb/dss/dsi.c         |     9 +-
 drivers/video/fbdev/platinumfb.c                   |    35 +-
 drivers/video/fbdev/udlfb.c                        |    27 +-
 drivers/virtio/virtio_balloon.c                    |     6 +-
 drivers/virtio/virtio_ring.c                       |     8 +
 drivers/w1/masters/ds2482.c                        |     8 +
 drivers/xen/pvcalls-back.c                         |     2 +-
 fs/afs/rxrpc.c                                     |    63 +-
 fs/btrfs/relocation.c                              |    13 +-
 fs/ceph/caps.c                                     |    17 +-
 fs/ceph/dir.c                                      |    14 +-
 fs/ceph/inode.c                                    |     3 +-
 fs/coredump.c                                      |     2 +
 fs/dlm/lowcomms.c                                  |     6 +-
 fs/exec.c                                          |    11 +-
 fs/exfat/balloc.c                                  |    31 +-
 fs/exfat/dir.c                                     |     8 +-
 fs/exfat/namei.c                                   |    27 +-
 fs/ext4/balloc.c                                   |     4 +
 fs/ext4/ext4.h                                     |     2 +-
 fs/ext4/inode.c                                    |     7 +-
 fs/ext4/super.c                                    |    10 +-
 fs/f2fs/gc.c                                       |     9 +-
 fs/fat/namei_msdos.c                               |     3 +
 fs/fuse/dev.c                                      |     3 +-
 fs/fuse/dir.c                                      |     3 +
 fs/fuse/file.c                                     |     9 +
 fs/hfs/catalog.c                                   |    41 +-
 fs/hfs/hfs_fs.h                                    |    19 +
 fs/hfs/inode.c                                     |    13 +-
 fs/hfs/super.c                                     |     5 +
 fs/hfsplus/extents.c                               |     2 +
 fs/iomap/ioend.c                                   |    10 +-
 fs/lockd/svclock.c                                 |     2 +
 fs/namei.c                                         |    29 -
 fs/namespace.c                                     |     7 +
 fs/nfs/blocklayout/blocklayout.h                   |     5 -
 fs/nfs/blocklayout/rpc_pipefs.c                    |    79 +-
 fs/nfs/callback_proc.c                             |     3 +-
 fs/nfs/callback_xdr.c                              |     2 +-
 fs/nfs/dir.c                                       |     8 +
 fs/nfs/filelayout/filelayout.c                     |     8 +-
 fs/nfs/filelayout/filelayoutdev.c                  |    17 +-
 fs/nfs/flexfilelayout/flexfilelayout.c             |    75 +-
 fs/nfs/flexfilelayout/flexfilelayout.h             |     2 +-
 fs/nfs/flexfilelayout/flexfilelayoutdev.c          |    17 +-
 fs/nfs/localio.c                                   |    16 +-
 fs/nfs/netns.h                                     |     5 +-
 fs/nfs/nfs4_fs.h                                   |     2 +
 fs/nfs/nfs4proc.c                                  |     8 +
 fs/nfs/nfs4state.c                                 |    78 +-
 fs/nfs/nfstrace.h                                  |     5 +-
 fs/nfs/pnfs.c                                      |    24 +-
 fs/nfs/pnfs.h                                      |     3 +-
 fs/nfs/pnfs_nfs.c                                  |    21 +-
 fs/nfsd/filecache.c                                |     4 +-
 fs/nfsd/flexfilelayout.c                           |    20 +-
 fs/nfsd/flexfilelayoutxdr.c                        |     4 +-
 fs/nfsd/flexfilelayoutxdr.h                        |     5 +-
 fs/nfsd/netns.h                                    |     6 +-
 fs/nfsd/nfs3acl.c                                  |    15 +
 fs/nfsd/nfs4idmap.c                                |     4 +-
 fs/nfsd/nfs4proc.c                                 |     4 +-
 fs/nfsd/nfs4recover.c                              |    78 +-
 fs/nfsd/nfs4state.c                                |   116 +-
 fs/nfsd/nfs4xdr.c                                  |    26 +-
 fs/nfsd/nfsctl.c                                   |    73 +-
 fs/nfsd/nfsproc.c                                  |    19 +-
 fs/nfsd/xdr4.h                                     |     1 +
 fs/ntfs3/attrib.c                                  |     2 +-
 fs/ntfs3/dir.c                                     |    14 +-
 fs/ntfs3/index.c                                   |     1 +
 fs/ntfs3/inode.c                                   |    10 +-
 fs/ntfs3/namei.c                                   |     9 +-
 fs/ntfs3/ntfs_fs.h                                 |     2 +
 fs/ntfs3/super.c                                   |    18 +-
 fs/ocfs2/cluster/heartbeat.c                       |    13 +-
 fs/ocfs2/cluster/netdebug.c                        |     4 +
 fs/ocfs2/cluster/nodemanager.c                     |     3 +
 fs/ocfs2/cluster/quorum.c                          |     7 +-
 fs/ocfs2/cluster/quorum.h                          |     1 +
 fs/ocfs2/cluster/tcp.c                             |     4 +-
 fs/ocfs2/dlm/dlmconvert.c                          |    10 +-
 fs/ocfs2/dlm/dlmdebug.c                            |     5 +
 fs/ocfs2/dlm/dlmdomain.c                           |     3 +-
 fs/ocfs2/dlm/dlmlock.c                             |     8 +-
 fs/ocfs2/dlmglue.c                                 |     2 +
 fs/ocfs2/file.c                                    |   100 +-
 fs/ocfs2/filecheck.c                               |     5 +-
 fs/ocfs2/quota_local.c                             |    12 +-
 fs/ocfs2/refcounttree.c                            |    15 +-
 fs/ocfs2/super.c                                   |     1 +
 fs/overlayfs/copy_up.c                             |   112 +-
 fs/overlayfs/dir.c                                 |    22 +-
 fs/overlayfs/inode.c                               |    16 +-
 fs/overlayfs/namei.c                               |    11 +-
 fs/overlayfs/overlayfs.h                           |     8 +-
 fs/overlayfs/readdir.c                             |    33 +-
 fs/overlayfs/super.c                               |    34 +-
 fs/proc/task_mmu.c                                 |     9 +-
 fs/romfs/super.c                                   |     8 +
 fs/smb/client/cached_dir.c                         |    30 +-
 fs/smb/client/cifsacl.c                            |     9 +-
 fs/smb/client/cifsfs.c                             |    62 +-
 fs/smb/client/cifsfs.h                             |     5 +-
 fs/smb/client/cifssmb.c                            |    69 +-
 fs/smb/client/connect.c                            |     6 +-
 fs/smb/client/file.c                               |     3 +-
 fs/smb/client/inode.c                              |    32 +-
 fs/smb/client/readdir.c                            |     3 +
 fs/smb/client/reparse.c                            |    40 +-
 fs/smb/client/sess.c                               |     6 +-
 fs/smb/client/smb2ops.c                            |    74 +-
 fs/smb/client/smb2pdu.c                            |    12 +-
 fs/smb/client/transport.c                          |     6 +
 fs/smb/server/auth.c                               |     3 +-
 fs/smb/server/connection.c                         |    22 +
 fs/smb/server/mgmt/user_config.c                   |     6 +-
 fs/smb/server/mgmt/user_session.c                  |     4 +-
 fs/smb/server/misc.c                               |     8 +-
 fs/smb/server/oplock.c                             |    16 +-
 fs/smb/server/server.c                             |    21 +
 fs/smb/server/smb2pdu.c                            |   423 +-
 fs/smb/server/smb2pdu.h                            |     1 +
 fs/smb/server/smb_common.c                         |     6 +-
 fs/smb/server/smbacl.c                             |    53 +-
 fs/smb/server/transport_ipc.c                      |    16 +-
 fs/smb/server/transport_rdma.c                     |     1 -
 fs/smb/server/transport_tcp.c                      |    19 +-
 fs/smb/server/vfs.c                                |   137 +-
 fs/smb/server/vfs.h                                |     3 +-
 fs/smb/server/vfs_cache.c                          |    46 +-
 fs/smb/server/vfs_cache.h                          |     2 +
 fs/udf/balloc.c                                    |    12 +-
 fs/udf/inode.c                                     |    33 +-
 fs/udf/truncate.c                                  |     2 +-
 fs/udf/udfdecl.h                                   |     3 +-
 fs/ufs/dir.c                                       |     2 +-
 fs/xfs/libxfs/xfs_attr_leaf.c                      |    13 +
 fs/xfs/libxfs/xfs_da_btree.c                       |    14 +
 fs/xfs/libxfs/xfs_inode_fork.c                     |     4 +-
 fs/xfs/libxfs/xfs_symlink_remote.c                 |     8 +-
 fs/xfs/libxfs/xfs_symlink_remote.h                 |     2 +-
 fs/xfs/libxfs/xfs_trans_space.c                    |     6 +-
 fs/xfs/scrub/agheader.c                            |    15 +-
 fs/xfs/scrub/agheader_repair.c                     |    13 +-
 fs/xfs/scrub/alloc_repair.c                        |    11 +-
 fs/xfs/scrub/attr.c                                |    17 +-
 fs/xfs/scrub/attr_repair.c                         |    18 +-
 fs/xfs/scrub/bitmap.c                              |    20 +
 fs/xfs/scrub/bmap.c                                |     7 +
 fs/xfs/scrub/btree.c                               |    16 +-
 fs/xfs/scrub/common.c                              |     7 +-
 fs/xfs/scrub/cow_repair.c                          |    84 +-
 fs/xfs/scrub/dabtree.c                             |    27 +-
 fs/xfs/scrub/dir.c                                 |     2 +
 fs/xfs/scrub/dir_repair.c                          |     9 +-
 fs/xfs/scrub/dirtree.c                             |     4 +-
 fs/xfs/scrub/dirtree_repair.c                      |    76 +-
 fs/xfs/scrub/dqiterate.c                           |     1 +
 fs/xfs/scrub/fscounters.c                          |    38 +-
 fs/xfs/scrub/ialloc_repair.c                       |     8 +-
 fs/xfs/scrub/inode.c                               |     2 +-
 fs/xfs/scrub/inode_repair.c                        |   181 +-
 fs/xfs/scrub/iscan.c                               |     2 +-
 fs/xfs/scrub/metapath.c                            |    17 +-
 fs/xfs/scrub/newbt.c                               |    15 +-
 fs/xfs/scrub/newbt.h                               |     1 -
 fs/xfs/scrub/parent_repair.c                       |     4 +
 fs/xfs/scrub/quota.c                               |     8 +-
 fs/xfs/scrub/quota_repair.c                        |    39 +-
 fs/xfs/scrub/quotacheck_repair.c                   |    54 +-
 fs/xfs/scrub/readdir.c                             |     2 +-
 fs/xfs/scrub/reap.c                                |    65 +-
 fs/xfs/scrub/refcount.c                            |    17 +-
 fs/xfs/scrub/repair.c                              |    18 +-
 fs/xfs/scrub/repair.h                              |     2 +-
 fs/xfs/scrub/rmap.c                                |    20 +-
 fs/xfs/scrub/rtbitmap_repair.c                     |     2 +-
 fs/xfs/scrub/rtrefcount.c                          |     2 +
 fs/xfs/scrub/rtsummary.c                           |     9 +-
 fs/xfs/scrub/rtsummary.h                           |     1 +
 fs/xfs/scrub/rtsummary_repair.c                    |     2 +-
 fs/xfs/scrub/stats.c                               |     5 +-
 fs/xfs/scrub/symlink.c                             |    17 +-
 fs/xfs/scrub/trace.c                               |    13 +
 fs/xfs/scrub/trace.h                               |    10 +-
 fs/xfs/scrub/xfarray.c                             |     4 +-
 fs/xfs/xfs_dquot.c                                 |    20 +-
 fs/xfs/xfs_dquot.h                                 |     2 +-
 fs/xfs/xfs_handle.c                                |     2 +-
 fs/xfs/xfs_inode_item_recover.c                    |    20 +-
 fs/xfs/xfs_mount.c                                 |     9 +-
 fs/xfs/xfs_qm.c                                    |    42 +-
 fs/xfs/xfs_quota.h                                 |     9 +
 fs/xfs/xfs_trans_dquot.c                           |     6 +-
 include/asm-generic/bitops/le.h                    |    18 +-
 include/dt-bindings/arm/qcom,ids.h                 |     1 +
 include/linux/device.h                             |     5 +
 include/linux/device/bus.h                         |     3 -
 include/linux/hid.h                                |     1 +
 include/linux/hiddev.h                             |     2 +
 include/linux/interrupt.h                          |     2 +
 include/linux/net.h                                |     4 +-
 include/linux/pps_gen_kernel.h                     |     2 +-
 include/linux/remoteproc.h                         |     2 +
 include/linux/socket.h                             |    17 -
 include/net/af_rxrpc.h                             |     5 +-
 include/net/bonding.h                              |     2 +
 include/net/dropreason-core.h                      |     6 +
 include/net/inet_common.h                          |     2 +-
 include/net/ipv6.h                                 |     5 +-
 include/net/netfilter/nf_conntrack_expect.h        |    19 +-
 include/net/netfilter/nf_tables.h                  |     4 +
 include/net/netfilter/nf_tables_ipv4.h             |    17 +-
 include/net/netfilter/nf_tables_ipv6.h             |    16 +-
 include/net/sock.h                                 |     2 +-
 include/sound/hda_codec.h                          |     1 +
 include/trace/events/huge_memory.h                 |     6 +-
 include/trace/events/rxrpc.h                       |     2 +-
 include/trace/misc/nfs.h                           |    10 +
 include/uapi/linux/netfilter/nf_conntrack_common.h |     1 +
 include/video/maxinefb.h                           |     4 +-
 io_uring/io-wq.c                                   |    14 +-
 io_uring/io_uring.c                                |    30 +-
 io_uring/kbuf.c                                    |     4 +-
 io_uring/net.c                                     |    23 +-
 io_uring/rsrc.c                                    |     6 +-
 io_uring/sqpoll.c                                  |    28 +-
 io_uring/sqpoll.h                                  |     3 +-
 io_uring/tctx.c                                    |     6 +-
 io_uring/timeout.c                                 |     3 +
 ipc/namespace.c                                    |     9 +-
 kernel/cgroup/cgroup.c                             |    28 +
 kernel/events/core.c                               |    37 +-
 kernel/fork.c                                      |     4 +
 kernel/irq/internals.h                             |     2 +
 kernel/irq/irqdomain.c                             |     4 +-
 kernel/irq/manage.c                                |    31 +-
 kernel/kcov.c                                      |     8 +
 kernel/kcsan/core.c                                |     7 +-
 kernel/reboot.c                                    |     9 +
 kernel/resource.c                                  |     9 +-
 kernel/sched/ext.c                                 |    23 +-
 kernel/trace/trace_events_hist.c                   |   105 +-
 lib/klist.c                                        |    16 +-
 lib/kobject_uevent.c                               |     6 +-
 mm/hugetlb.c                                       |    15 +-
 mm/khugepaged.c                                    |     4 +-
 mm/kmemleak.c                                      |    32 +-
 mm/migrate.c                                       |     6 +-
 mm/migrate_device.c                                |     6 +
 mm/page_alloc.c                                    |     4 +-
 mm/rmap.c                                          |    11 -
 mm/slab_common.c                                   |    17 +-
 mm/vmscan.c                                        |    17 +-
 net/8021q/vlan_dev.c                               |    33 +-
 net/9p/trans_fd.c                                  |     2 +-
 net/appletalk/ddp.c                                |     2 +-
 net/atm/pvc.c                                      |     4 +-
 net/atm/svc.c                                      |     2 +-
 net/ax25/af_ax25.c                                 |     2 +-
 net/bluetooth/Kconfig                              |     2 +-
 net/bluetooth/bnep/Kconfig                         |     2 +-
 net/bluetooth/hci_event.c                          |     7 +
 net/bluetooth/hci_sock.c                           |     2 +-
 net/bluetooth/hci_sync.c                           |    30 +
 net/bluetooth/hidp/Kconfig                         |     2 +-
 net/bluetooth/iso.c                                |     4 +-
 net/bluetooth/l2cap_sock.c                         |     2 +-
 net/bluetooth/rfcomm/Kconfig                       |     2 +-
 net/bluetooth/rfcomm/core.c                        |     4 +-
 net/bluetooth/rfcomm/sock.c                        |     2 +-
 net/bluetooth/sco.c                                |     2 +-
 net/bridge/netfilter/ebtables.c                    |    12 +-
 net/can/isotp.c                                    |     2 +-
 net/can/j1939/socket.c                             |     2 +-
 net/can/raw.c                                      |     2 +-
 net/ceph/mon_client.c                              |     2 +-
 net/core/netpoll.c                                 |     2 +-
 net/core/rtnetlink.c                               |     4 +
 net/core/skbuff.c                                  |     2 +
 net/core/sock.c                                    |     2 +-
 net/ieee802154/socket.c                            |     4 +-
 net/ipv4/af_inet.c                                 |     4 +-
 net/ipv4/inet_connection_sock.c                    |     2 +-
 net/ipv4/ip_gre.c                                  |    42 +-
 net/ipv4/metrics.c                                 |     5 +
 net/ipv4/netfilter/nf_nat_h323.c                   |    22 +-
 net/ipv4/netfilter/nf_reject_ipv4.c                |     6 +-
 net/ipv4/netfilter/nf_tproxy_ipv4.c                |     2 +-
 net/ipv4/udp_tunnel_core.c                         |     2 +-
 net/ipv6/af_inet6.c                                |     4 +-
 net/ipv6/exthdrs_core.c                            |     7 +
 net/ipv6/ip6_gre.c                                 |     5 +-
 net/ipv6/ip6_input.c                               |     5 +
 net/ipv6/ip6_tunnel.c                              |     4 +
 net/ipv6/ip6_udp_tunnel.c                          |     2 +-
 net/ipv6/netfilter/nf_reject_ipv6.c                |     8 +-
 net/ipv6/netfilter/nf_tproxy_ipv6.c                |     2 +-
 net/ipv6/udp.c                                     |    13 +
 net/iucv/af_iucv.c                                 |     2 +-
 net/l2tp/l2tp_core.c                               |     4 +-
 net/llc/af_llc.c                                   |     2 +-
 net/mac80211/ibss.c                                |     4 +-
 net/mctp/af_mctp.c                                 |     2 +-
 net/mctp/test/route-test.c                         |     2 +-
 net/mctp/test/utils.c                              |     2 +-
 net/mptcp/protocol.c                               |     6 +-
 net/mptcp/subflow.c                                |     2 +-
 net/netfilter/ipvs/ip_vs_sync.c                    |     4 +-
 net/netfilter/nf_conntrack_core.c                  |    33 +-
 net/netfilter/nf_conntrack_expect.c                |   180 +-
 net/netfilter/nf_conntrack_h323_main.c             |     4 +-
 net/netfilter/nf_conntrack_helper.c                |    10 +-
 net/netfilter/nf_conntrack_netlink.c               |    24 +-
 net/netfilter/nf_conntrack_proto_tcp.c             |     6 +-
 net/netfilter/nf_conntrack_sip.c                   |    13 +-
 net/netfilter/nf_nat_sip.c                         |    20 +-
 net/netfilter/nf_tables_api.c                      |    34 +-
 net/netfilter/nf_tables_core.c                     |     2 +-
 net/netfilter/nfnetlink_queue.c                    |   242 +-
 net/netfilter/nft_ct.c                             |     3 +-
 net/netfilter/nft_meta.c                           |    60 +-
 net/netfilter/nft_payload.c                        |   314 +-
 net/netfilter/nft_rt.c                             |     6 +-
 net/netfilter/nft_xfrm.c                           |     9 +-
 net/netlink/af_netlink.c                           |     2 +-
 net/netrom/af_netrom.c                             |     2 +-
 net/nfc/llcp_sock.c                                |     4 +-
 net/packet/af_packet.c                             |    11 +-
 net/phonet/socket.c                                |     8 +-
 net/qrtr/af_qrtr.c                                 |     2 +-
 net/qrtr/ns.c                                      |     2 +-
 net/rds/bind.c                                     |     2 +-
 net/rds/ib_rdma.c                                  |     4 +-
 net/rds/message.c                                  |    26 +
 net/rds/rdma.c                                     |    63 +-
 net/rds/rds.h                                      |    17 +-
 net/rds/send.c                                     |    18 +-
 net/rds/tcp_connect.c                              |     2 +-
 net/rds/tcp_listen.c                               |     2 +-
 net/rose/af_rose.c                                 |     2 +-
 net/rxrpc/af_rxrpc.c                               |     2 +-
 net/rxrpc/recvmsg.c                                |    22 +-
 net/rxrpc/rxperf.c                                 |    43 +-
 net/rxrpc/sendmsg.c                                |    86 +-
 net/sched/act_ct.c                                 |     5 +-
 net/sched/act_ife.c                                |     4 +
 net/sched/cls_bpf.c                                |    28 +-
 net/sched/cls_flower.c                             |    50 +-
 net/sched/sch_generic.c                            |    10 +-
 net/sched/sch_teql.c                               |    60 +-
 net/sctp/associola.c                               |     4 +
 net/sctp/endpointola.c                             |     4 +
 net/smc/af_smc.c                                   |     2 +-
 net/smc/smc.h                                      |     2 +-
 net/socket.c                                       |     6 +-
 net/sunrpc/auth_gss/svcauth_gss.c                  |    29 +-
 net/sunrpc/clnt.c                                  |     4 +-
 net/sunrpc/svc.c                                   |     9 +-
 net/sunrpc/svc_xprt.c                              |    24 +-
 net/sunrpc/svcauth_unix.c                          |     7 +
 net/sunrpc/svcsock.c                               |    88 +-
 net/sunrpc/xprtsock.c                              |     4 +-
 net/tipc/socket.c                                  |     4 +-
 net/unix/af_unix.c                                 |     4 +-
 net/vmw_vsock/af_vsock.c                           |     4 +-
 net/wireless/nl80211.c                             |     4 +
 net/x25/af_x25.c                                   |     2 +-
 net/xdp/xsk.c                                      |     2 +-
 net/xdp/xsk_queue.c                                |    12 +-
 rust/kernel/bitmap.rs                              |    70 +-
 rust/kernel/block/mq/gen_disk.rs                   |    10 +-
 rust/kernel/block/mq/operations.rs                 |     2 +-
 rust/kernel/bug.rs                                 |     2 +-
 rust/kernel/configfs.rs                            |    43 +-
 rust/kernel/cpufreq.rs                             |    22 +-
 scripts/kconfig/conf.c                             |    17 +
 scripts/link-vmlinux.sh                            |    20 +-
 security/apparmor/include/policy_ns.h              |    16 +
 security/apparmor/mount.c                          |     4 +-
 security/apparmor/policy_ns.c                      |     2 +-
 security/landlock/fs.c                             |    10 +-
 sound/core/control.c                               |     2 +
 sound/drivers/pcmtest.c                            |    42 +-
 sound/hda/codecs/conexant.c                        |    26 +-
 sound/hda/codecs/hdmi/hdmi.c                       |     5 +-
 sound/hda/codecs/realtek/alc269.c                  |   109 +-
 sound/hda/codecs/realtek/realtek.c                 |     6 +
 sound/hda/common/codec.c                           |    11 +-
 sound/hda/controllers/intel.c                      |    18 +
 sound/hda/core/device.c                            |     1 +
 sound/soc/amd/acp-config.c                         |    14 +
 sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c      |     8 +
 sound/soc/amd/ps/acp63.h                           |     8 +
 sound/soc/amd/ps/pci-ps.c                          |     2 +
 sound/soc/amd/ps/ps-common.c                       |     2 +
 sound/soc/amd/yc/acp6x-mach.c                      |    21 +
 sound/soc/codecs/cs35l56-sdw.c                     |     2 +
 sound/soc/codecs/cs35l56-shared.c                  |     4 +
 sound/soc/codecs/cs35l56.c                         |     1 +
 sound/soc/codecs/hdac_hdmi.c                       |    10 +-
 sound/soc/codecs/max98396.c                        |    24 +-
 sound/soc/codecs/max98926.c                        |     2 +-
 sound/soc/codecs/rt712-sdca.c                      |     1 +
 sound/soc/codecs/rt712-sdca.h                      |     1 +
 sound/soc/codecs/sma1303.c                         |     2 +
 sound/soc/codecs/tlv320aic26.c                     |     6 +
 sound/soc/codecs/uda1342.c                         |     9 +-
 sound/soc/generic/audio-graph-card2.c              |     3 +-
 sound/soc/intel/boards/bytcr_rt5651.c              |    17 +
 sound/soc/sof/intel/mtl.c                          |    23 +
 sound/synth/emux/emux_synth.c                      |     3 +
 sound/synth/emux/soundfont.c                       |     9 +-
 sound/usb/card.c                                   |    70 +-
 sound/usb/line6/pcm.c                              |     8 +
 sound/usb/mixer_maps.c                             |    27 +
 sound/usb/quirks-table.h                           |    22 +
 sound/usb/quirks.c                                 |     4 +
 sound/usb/usx2y/usbusx2yaudio.c                    |     1 -
 tools/lib/api/fd/array.c                           |     5 +-
 tools/lib/bpf/libbpf.c                             |    10 +-
 tools/lib/bpf/ringbuf.c                            |     2 +-
 tools/lib/thermal/include/thermal.h                |     4 +-
 tools/objtool/check.c                              |     1 +
 tools/power/x86/turbostat/turbostat.c              |    22 +-
 tools/sched_ext/scx_flatcg.bpf.c                   |     3 +
 .../testing/selftests/bpf/test_kmods/bpf_testmod.c |     2 +-
 .../selftests/cgroup/lib/include/cgroup_util.h     |     1 +
 tools/testing/selftests/cgroup/test_cpu.c          |    43 +-
 .../filesystems/overlayfs/set_layers_via_fds.c     |    16 +-
 tools/testing/selftests/ftrace/ftracetest          |     3 +
 tools/testing/selftests/net/fin_ack_lat.c          |     2 +-
 tools/testing/selftests/net/reuseport_bpf_numa.c   |    24 +
 tools/testing/selftests/ublk/.gitignore            |     6 +-
 tools/testing/selftests/ublk/Makefile              |    11 +-
 tools/testing/selftests/ublk/metadata_size.c       |    36 +
 tools/testing/selftests/ublk/settings              |     1 +
 virt/kvm/kvm_main.c                                |    31 +-
 969 files changed, 86932 insertions(+), 4449 deletions(-)

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zizhen Liu <[email protected]>

commit 79dc34beb1fdb3da79753e51e15c68591a2561fe upstream.

skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skb_has_shared_frag() as false.

That breaks the invariant relied on by later in-place writers. ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file.

Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for the other frag-transfer helpers.

---
 net/core/skbuff.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -3883,6 +3883,8 @@ skb_zerocopy(struct sk_buff *to, struct
 	}
 	skb_shinfo(to)->nr_frags = j;
 
+	skb_shinfo(to)->flags |= skb_shinfo(from)->flags & SKBFL_SHARED_FRAG;
+
 	return 0;
 }
 EXPORT_SYMBOL_GPL(skb_zerocopy);

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Namjae Jeon <[email protected]>

[ Upstream commit 68f410faedaf6ee74d81e574733c50ebcc1bd8ed ]

The receive thread queues a request and can read the next PDU before the negotiation worker finishes. While need_neg is set, the next PDU can cause ksmbd_init_smb_server() to replace conn->ops. A pipelined SMB2 request can therefore make the worker handle an earlier, shorter SMB1 request with SMB2 operations and read beyond its buffer.

An SMB1 multi-protocol negotiate may be followed by an SMB2 NEGOTIATE that changes conn->ops again. Wait for work queued while the connection is new or needs negotiation to complete before reading another PDU. This keeps the operations stable for both stages of negotiation without changing when need_neg is cleared.

---
 fs/smb/server/server.c | 5 +++++
 1 file changed, 5 insertions(+)

index e7af6353a641f..85f14d1cc0cd3 100644
@@ -291,6 +291,7 @@ static void handle_ksmbd_work(struct work_struct *wk)
 static int queue_ksmbd_work(struct ksmbd_conn *conn)
 {
 	struct ksmbd_work *work;
+	bool wait_for_neg = ksmbd_conn_new(conn) || ksmbd_conn_need_negotiate(conn);
 	int err;
 
 	err = ksmbd_init_smb_server(conn);

@@ -313,6 +314,10 @@ static int queue_ksmbd_work(struct ksmbd_conn *conn)
 	conn->last_active = jiffies;
 	INIT_WORK(&work->work, handle_ksmbd_work);
 	ksmbd_queue_work(work);
+	/* Negotiation can change conn->ops, finish it before reading another PDU. */
+	if (wait_for_neg)
+		wait_event(conn->req_running_q,
+			   atomic_read(&conn->req_running) == 0);
 	return 0;
 }
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Baolin Wang <[email protected]>

[ Upstream commit 13b6b620910436c29dea398382e83c9499fd13e4 ]

The balance_dirty_pages() won't do the dirty folios throttling on cgroupv1. See commit 9badce000e2c ("cgroup, writeback: don't enable cgroup writeback on traditional hierarchies").

Moreover, after commit 6b0dfabb3555 ("fs: Remove aops->writepage"), we no longer attempt to write back filesystem folios through reclaim.

On large memory systems, the flusher may not be able to write back quickly enough. Consequently, MGLRU will encounter many folios that are already under writeback. Since we cannot reclaim these dirty folios, the system may run out of memory and trigger the OOM killer.

Hence, for cgroup v1, let's throttle reclaim after waking up the flusher, which is similar to commit 81a70c21d917 ("mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1"), to avoid unnecessary OOM.

The following test program can easily reproduce the OOM issue. With this patch applied, the test passes successfully.

$mkdir /sys/fs/cgroup/memory/test
$echo 256M > /sys/fs/cgroup/memory/test/memory.limit_in_bytes $echo $$ > /sys/fs/cgroup/memory/test/cgroup.procs $dd if=/dev/zero of=/mnt/data.bin bs=1M count=800

---
 mm/vmscan.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

index 2c66fbcd6e845..c983815bde5bf 100644
@@ -4901,9 +4901,24 @@ static bool try_to_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
 	 * If too many file cache in the coldest generation can't be evicted
 	 * due to being dirty, wake up the flusher.
 	 */
-	if (sc->nr.unqueued_dirty && sc->nr.unqueued_dirty == sc->nr.file_taken)
+	if (sc->nr.unqueued_dirty && sc->nr.unqueued_dirty == sc->nr.file_taken) {
+		struct pglist_data *pgdat = lruvec_pgdat(lruvec);
+
 		wakeup_flusher_threads(WB_REASON_VMSCAN);
 
+		/*
+		 * For cgroupv1 dirty throttling is achieved by waking up
+		 * the kernel flusher here and later waiting on folios
+		 * which are in writeback to finish (see shrink_folio_list()).
+		 *
+		 * Flusher may not be able to issue writeback quickly
+		 * enough for cgroupv1 writeback throttling to work
+		 * on a large system.
+		 */
+		if (!writeback_throttling_sane(sc))
+			reclaim_throttle(pgdat, VMSCAN_THROTTLE_WRITEBACK);
+	}
+
 	/* whether this lruvec should be rotated */
 	return nr_to_scan < 0;
 }

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Schaefer <[email protected]>

[ Upstream commit cad928dad9a4c26aa56b4223dc2a29bca517fb5f ]

Some sensors have multiple channels (not just brightness but color ALS sensors) with different scaling factors.

---
 drivers/iio/light/hid-sensor-als.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

index 384572844162c..232cb58e0a9ff 100644
@@ -33,9 +33,9 @@ struct als_state {
 		u32 illum[CHANNEL_SCAN_INDEX_MAX];
 		aligned_s64 timestamp;
 	} scan;
-	int scale_pre_decml;
-	int scale_post_decml;
-	int scale_precision;
+	int scale_pre_decml[CHANNEL_SCAN_INDEX_MAX];
+	int scale_post_decml[CHANNEL_SCAN_INDEX_MAX];
+	int scale_precision[CHANNEL_SCAN_INDEX_MAX];
 	int value_offset;
 	int num_channels;
 	s64 timestamp;

@@ -186,9 +186,11 @@ static int als_read_raw(struct iio_dev *indio_dev,
 		ret_type = IIO_VAL_INT;
 		break;
 	case IIO_CHAN_INFO_SCALE:
-		*val = als_state->scale_pre_decml;
-		*val2 = als_state->scale_post_decml;
-		ret_type = als_state->scale_precision;
+		if (chan->scan_index >= CHANNEL_SCAN_INDEX_MAX)
+			return -EINVAL;
+		*val = als_state->scale_pre_decml[chan->scan_index];
+		*val2 = als_state->scale_post_decml[chan->scan_index];
+		ret_type = als_state->scale_precision[chan->scan_index];
 		break;
 	case IIO_CHAN_INFO_OFFSET:
 		*val = als_state->value_offset;

@@ -338,6 +340,10 @@ static int als_parse_report(struct platform_device *pdev,
 		als_adjust_channel_bit_mask(channels, index, st->als[i].size);
 		++index;
 
+		st->scale_precision[i] = hid_sensor_format_scale(usage_id,
+					&st->als[i], &st->scale_pre_decml[i],
+					&st->scale_post_decml[i]);
+
 		dev_dbg(&pdev->dev, "als %x:%x\n", st->als[i].index,
 			st->als[i].report_id);
 	}

@@ -347,10 +353,6 @@ static int als_parse_report(struct platform_device *pdev,
 	if (index)
 		ret = 0;
 
-	st->scale_precision = hid_sensor_format_scale(usage_id,
-				&st->als[CHANNEL_SCAN_INDEX_INTENSITY],
-				&st->scale_pre_decml, &st->scale_post_decml);
-
 	return ret;
 }
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ridham Khurana <[email protected]>

[ Upstream commit 59797443846bc2451c35816026bbb79d281c9f23 ]

The driver wires of_omnia_mcu_match into the i2c_driver's .of_match_table but never exports it with MODULE_DEVICE_TABLE(), so no module alias is generated and the module is not autoloaded when the MCU is probed from the device tree.

Found by code inspection. Not tested on the hardware itself; with the module built, the alias lookup

  $ modprobe -R 'of:Nsystem-controllerT(null)Ccznic,turris-omnia-mcu'

reports no match before this change and resolves to turris_omnia_mcu after it.

---
 drivers/platform/cznic/turris-omnia-mcu-base.c | 1 +
 1 file changed, 1 insertion(+)

index e8fc0d7b33434..f0416302a1f3c 100644
@@ -403,6 +403,7 @@ static const struct of_device_id of_omnia_mcu_match[] = {
 	{ .compatible = "cznic,turris-omnia-mcu" },
 	{}
 };
+MODULE_DEVICE_TABLE(of, of_omnia_mcu_match);
 
 static struct i2c_driver omnia_mcu_driver = {
 	.probe		= omnia_mcu_probe,

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: André Draszik <[email protected]>

commit 14b8b4bf2d7bd5d58c17adbeed0edfda1dfc1a7f upstream.

It can happen that symbol sizes within .tmp_vmlinux1.kallsyms.o and .tmp_vmlinux2.kallsyms.o differ, without affecting file size on disk because of section alignment and/or padding emitted by the assembler.

link-vmlinux.sh doesn't detect this case currently and keeps using .tmp_vmlinux2.kallsyms.o to link the final vmlinux. Due to the different symbol sizes, other symbols are shifted within the final image compared to .tmp_vmlinux2, and the final comparison of System.map against "${kallsyms_sysmap}" fails with the message:

Inconsistent kallsyms data
Try "make KALLSYMS_EXTRA_PASS=1" as a workaround

This can happen in particular if the linker emits additional symbols that might have different names between our (re-)linking steps, e.g. because those names depend on the virtual address of the symbol. Linker stubs for ARM errata work-arounds are one such case.

These changed symbol names can cause the output of the token compression of kallsyms.c to change due to the changed symbol substring count, which in turn can change the size of the kallsyms_names symbol itself, causing the potential shift of subsequent symbol addresses in .tmp_vmlinux2.kallsyms.o and therefore the final image.

Update link-vmlinux.sh to not rely on file size of .tmp_vmlinux?.kallsyms.o alone but to also consider symbol offsets within to resolve this, and do a third pass if required.

---
 scripts/link-vmlinux.sh | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

index 433849ff7529e..050791ea10235 100755
@@ -133,6 +133,18 @@ gen_btf()
 	btf_vmlinux_bin_o=${btf_data}
 }
 
+# Check if kallsymso_prev and kallsymso differ
+# If symbol sizes within ${kallsymso} change, any symbols within vmlinux are
+# likely to shift, invalidating ${kallsymso}.
+# Since file size can remain unchanged even if symbol sizes change, compare the
+# actual symbols instead of relying on file size only.
+kallsymso_changed()
+{
+	${NM} -n "${kallsymso_prev}" > "${kallsymso_prev}.sym"
+	${NM} -n "${kallsymso}" > "${kallsymso}.sym"
+	! cmp -s "${kallsymso_prev}.sym" "${kallsymso}.sym"
+}
+
 # Create ${2}.o file with all symbols from the ${1} object file
 kallsyms()
 {

@@ -149,6 +161,7 @@ kallsyms()
 	${CC} ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS} \
 	      ${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL} -c -o "${2}.o" "${2}.S"
 
+	kallsymso_prev="${kallsymso:-}"
 	kallsymso=${2}.o
 }
 

@@ -267,7 +280,12 @@ if is_enabled CONFIG_KALLSYMS; then
 	sysmap_and_kallsyms .tmp_vmlinux2
 	size2=$(${CONFIG_SHELL} "${srctree}/scripts/file-size.sh" ${kallsymso})
 
-	if [ $size1 -ne $size2 ] || [ -n "${KALLSYMS_EXTRA_PASS}" ]; then
+	# Due to alignment, file size of the kallsymso object file might remain
+	# unchanged even if individual symbols within change size. Changed
+	# symbol sizes can still shift other symbols, though. Therefore, don't
+	# rely on file size alone.
+	if [ $size1 -ne $size2 ] || kallsymso_changed || \
+			[ -n "${KALLSYMS_EXTRA_PASS}" ]; then
 		vmlinux_link .tmp_vmlinux3
 		sysmap_and_kallsyms .tmp_vmlinux3
 	fi

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <[email protected]>

[ Upstream commit e9b64fae44be190ea21c1092e96f316f90deb663 ]

Attribute access is now serialized in the hardware monitoring core, so locking n the driver code is no longer necessary. Drop it.

---
 drivers/hwmon/lm90.c | 25 ++++---------------------
 1 file changed, 4 insertions(+), 21 deletions(-)

index e1795ccde876c..0153160552e02 100644
@@ -108,7 +108,6 @@
 #include <linux/hwmon.h>
 #include <linux/kstrtox.h>
 #include <linux/module.h>
-#include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/regulator/consumer.h>
 #include <linux/slab.h>

@@ -735,7 +734,6 @@ struct lm90_data {
 	struct hwmon_channel_info temp_info;
 	const struct hwmon_channel_info *info[3];
 	struct hwmon_chip_info chip;
-	struct mutex update_lock;
 	struct delayed_work alert_work;
 	struct work_struct report_work;
 	bool shutdown;		/* true if shutting down */

@@ -1230,9 +1228,9 @@ static int lm90_update_alarms(struct lm90_data *data, bool force)
 {
 	int err;
 
-	mutex_lock(&data->update_lock);
+	hwmon_lock(data->hwmon_dev);
 	err = lm90_update_alarms_locked(data, force);
-	mutex_unlock(&data->update_lock);
+	hwmon_unlock(data->hwmon_dev);
 
 	return err;
 }

@@ -1523,9 +1521,7 @@ static int lm90_temp_read(struct device *dev, u32 attr, int channel, long *val)
 	int err;
 	u16 bit;
 
-	mutex_lock(&data->update_lock);
 	err = lm90_update_device(dev);
-	mutex_unlock(&data->update_lock);
 	if (err)
 		return err;
 

@@ -1594,11 +1590,9 @@ static int lm90_temp_write(struct device *dev, u32 attr, int channel, long val)
 	struct lm90_data *data = dev_get_drvdata(dev);
 	int err;
 
-	mutex_lock(&data->update_lock);
-
 	err = lm90_update_device(dev);
 	if (err)
-		goto error;
+		return err;
 
 	switch (attr) {
 	case hwmon_temp_min:

@@ -1628,9 +1622,6 @@ static int lm90_temp_write(struct device *dev, u32 attr, int channel, long val)
 		err = -EOPNOTSUPP;
 		break;
 	}
-error:
-	mutex_unlock(&data->update_lock);
-
 	return err;
 }
 

@@ -1666,9 +1657,7 @@ static int lm90_chip_read(struct device *dev, u32 attr, int channel, long *val)
 	struct lm90_data *data = dev_get_drvdata(dev);
 	int err;
 
-	mutex_lock(&data->update_lock);
 	err = lm90_update_device(dev);
-	mutex_unlock(&data->update_lock);
 	if (err)
 		return err;
 

@@ -1714,11 +1703,9 @@ static int lm90_chip_write(struct device *dev, u32 attr, int channel, long val)
 	struct i2c_client *client = data->client;
 	int err;
 
-	mutex_lock(&data->update_lock);
-
 	err = lm90_update_device(dev);
 	if (err)
-		goto error;
+		return err;
 
 	switch (attr) {
 	case hwmon_chip_update_interval:

@@ -1732,9 +1719,6 @@ static int lm90_chip_write(struct device *dev, u32 attr, int channel, long val)
 		err = -EOPNOTSUPP;
 		break;
 	}
-error:
-	mutex_unlock(&data->update_lock);
-
 	return err;
 }
 

@@ -2805,7 +2789,6 @@ static int lm90_probe(struct i2c_client *client)
 
 	data->client = client;
 	i2c_set_clientdata(client, data);
-	mutex_init(&data->update_lock);
 	INIT_DELAYED_WORK(&data->alert_work, lm90_alert_work);
 	INIT_WORK(&data->report_work, lm90_report_alarms);
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Brauner <[email protected]>

[ Upstream commit b42c85c20d84ff3e4f0f027d6596c3b3b4a20657 ]

begin_new_exec() cancels the exec'ing thread's io_uring requests after de_thread() made it the only thread in the thread-group. Now io_uring_task_cancel() runs task work after. If it runs a create_worker_cb() item then a io-wq queued on the thread before the exec creates a new io-wq worker thread.

Said thread joins the thread-group which de_thread() just took down. The io-iwq sticks around until it notices that its workqueue is dying. But code after de_thread() relies on being single-threaded.

Move io_uring_task_cancel() before de_thread() but behind the point of no return. Any worker created during task work run from io_uring_task_cancel() is just a sibling thread that de_thread() will take down and reap.

Once io_uring_task_cancel() returned the thread has neither a task context nor a workqueue left so nothing can add a thread behind de_thread()'s back anymore.

---
 fs/exec.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

index 4aa6905259591..3f301138e65a0 100644
@@ -1134,6 +1134,13 @@ int begin_new_exec(struct linux_binprm * bprm)
 	 */
 	bprm->point_of_no_return = true;
 
+	/*
+	 * Cancel any io_uring activity across execve. This runs task work
+	 * that may still create an io-wq worker, so do it while de_thread()
+	 * can still zap it.
+	 */
+	io_uring_task_cancel();
+
 	/* Make this the only thread in the thread group */
 	retval = de_thread(me);
 	if (retval)

@@ -1150,10 +1157,6 @@ int begin_new_exec(struct linux_binprm * bprm)
 
 	/* see the comment in check_unsafe_exec() */
 	current->fs->in_exec = 0;
-	/*
-	 * Cancel any io_uring activity across execve
-	 */
-	io_uring_task_cancel();
 
 	/* Ensure the files table is not shared. */
 	retval = unshare_files();

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Brauner <[email protected]>

[ Upstream commit e760200370e4de054b6b5f568a7faa911e2956bb ]

Only a PF_USER_WORKER thread returns from get_signal() after a fatal signal and can go on to create a thread. get_signal() sets PF_SIGNALED before it dumps core and before it lets a PF_USER_WORKER thread return. That flags sticks.

The exec'ing thread itself is never signaled. But it doesn't need the check anyway as we moved cancellation of io_uring requests before de_thread(). create_io_thread() is the only way a signaled thread creates another one. vhost_task_create() is reached from ioctls alone.

io_should_retry_thread() doesn't retry -EINTR, so io-wq callers give up the same way they did when copy_process() refused.

Stable-dep-of: 1f978881ce6c ("fork: don't create io threads once PF_POSTCOREDUMP is set")

---
 kernel/fork.c | 4 ++++
 1 file changed, 4 insertions(+)

index 6734b94600333..bf0bbd8a569e5 100644
@@ -2559,6 +2559,10 @@ struct task_struct *create_io_thread(int (*fn)(void *), void *arg, int node)
 		.user_worker	= 1,
 	};
 
+	/* A creator past its fatal signal gets no thread. */
+	if (current->flags & PF_SIGNALED)
+		return ERR_PTR(-EINTR);
+
 	return copy_process(NULL, 0, node, &args);
 }
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Brauner <[email protected]>

[ Upstream commit 1f978881ce6c9ac4f4d4a7b6a6e52339eadcd350 ]

zap_process() skips every thread that already has PF_POSTCOREDUMP set. Such a thread is past synchronize_group_exit(), so a coredump can't catch it anymore. It isn't counted in core_state->threads_remaining and it isn't sent SIGKILL.

do_exit() sets PF_POSTCOREDUMP in synchronize_group_exit() and calls io_uring_files_cancel() right after that. The cancellation runs task work and a create_worker_cb() that io-wq queued before the exit creates a new io-wq worker from there. If another thread started a coredump in the meantime that worker joins a thread-group which is already being dumped. zap_process() never saw it so it was never counted. But when it exits it sees signal->core_state in synchronize_group_exit() and decrements threads_remaining like any other thread.

So the count reaches zero one thread early and the dumper leaves coredump_wait_inactive() while a thread it counted is still running.

The task has no fatal signal pending because zap_process() deliberately didn't send it one, and it never went through get_signal() so it doesn't have PF_SIGNALED either.

Refuse to create an io thread when the creator has PF_POSTCOREDUMP. That costs nothing. io_uring_files_cancel() raises IO_WQ_BIT_EXIT before it runs any task work, so a worker created from there only ever gets to exit again, and io_should_retry_thread() doesn't retry -EINTR.

Clearing PF_POSTCOREDUMP for the new thread in copy_process() was the other option. It makes the worker a thread like any other, but it only helps while the dump hasn't started. A worker born after zap_process() has run is invisible to it whatever its flags say and still decrements threads_remaining on the way out. Refusing to create it covers both, and then no task is ever born with the flag, so there is nothing to clear.

Moving io_uring_files_cancel() ahead of synchronize_group_exit() closes the same window. It runs the cancellation, and whatever that can block on, before the thread announces itself to the dumper. A thread that blocks there never reaches coredump_task_exit() at all, so the dumper ends up waiting for a thread that never parks. Refusing the creation leaves the cancellation where it is. But it's very ugly to run io_uring work even before we did all the generic exit work.

---
 kernel/fork.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index bf0bbd8a569e5..b7543a93f269a 100644
@@ -2559,8 +2559,8 @@ struct task_struct *create_io_thread(int (*fn)(void *), void *arg, int node)
 		.user_worker	= 1,
 	};
 
-	/* A creator past its fatal signal gets no thread. */
-	if (current->flags & PF_SIGNALED)
+	/* A creator past its fatal signal or its coredump point gets no thread. */
+	if (current->flags & (PF_SIGNALED | PF_POSTCOREDUMP))
 		return ERR_PTR(-EINTR);
 
 	return copy_process(NULL, 0, node, &args);

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Brauner <[email protected]>

[ Upstream commit a58d647acfdc62561f3570d114025b3bf38ae41b ]

TIF_NOTIFY_SIGNAL is used to kick a task in uninterruptible sleep to return to userspace and run task work and then go back to sleep. This mechanism works well but breaks coredumps. dump_interrupted() only allows fatal signals to interrupt a coredump and the whole regular write path going to actual filesystems is impervious to TIF_NOTIFY_SIGNAL as well.

However, both the usermodehelper pipe and the coredump socket will bail early on TIF_NOTIFY_SIGNAL. This affects the following codepaths:

- coredump_sock_recv() -> unix_stream_read_generic()
The request/ack handshake is abandoned before any coredump data is sent.

- anon_pipe_write() returning -ERESTARTSYS Once the pipe is full this truncates the coredump.

- unix_stream_sendmsg() returning -ERESTARTSYS Once the send buffer is full this truncates the coredump.

- coredump_sock_wait() -> __kernel_read()
This reports a failure that didn't happen.

- wait_for_dump_helpers() -> wait_event_interruptible() This stops waiting for the coredump helpers.

Such truncation is entirely invisible to userspace and all uapi bits still indicate that a successful coredump happened. A crashing process with a bunch of file backed mappings and io_uring thrown in loses most of the coredump data. If the NT_FILE note goes past PAGE_SIZE mappings it's gonzo.

TIF_NOTIFY_SIGNAL is sent by io_uring for the common case. And it uses poll without sleeping so a completion callback runs task_work_add() from interrupt context against the task that submitted the request. This is the task that is running the coredump. Since that task hasn't set work_exited (it hasn't exited yet after all) TIF_NOTIFY_SIGNAL keeps reappearing.

A coredumping task doesn't return to userspace. The task work is run at exit. So interrupting it doesn't buy anything and just loses the coredump which is quite valuable.

Note that this isn't specific to io_uring. There's also klp_send_signals(), bpf_task_work_schedule_signal(), landlock's tsync and then technically, kthread_stop() and the printk kunit test set the bit raw.

---
 fs/coredump.c | 2 ++
 1 file changed, 2 insertions(+)

index 3e927378bf5bf..b3cc7c0531ee1 100644
@@ -1131,6 +1131,8 @@ void vfs_coredump(const kernel_siginfo_t *siginfo)
 	if (coredump_wait(siginfo->si_signo, &core_state) < 0)
 		return;
 
+	/* Task work must not cut the dump short, see signal_pending(). */
+	guard(no_notify_signal)();
 	old_cred = override_creds(cred);
 
 	if (!coredump_parse(&cn, &cprm, &argv, &argc)) {

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tonghao Zhang <[email protected]>

commit 11ea9b8a88dd7524c23dffc22d8173504273a9db upstream.

The rtnl lock might be locked, preventing ad_cond_set_peer_notif() from acquiring the lock and updating send_peer_notif. This patch addresses the issue by using a workqueue. Since updating send_peer_notif does not require high real-time performance, such delayed updates are entirely acceptable.

In fact, checking this value and using it in multiple places, all operations are protected at the same time by rtnl lock, such as
- read send_peer_notif
- send_peer_notif--
- bond_should_notify_peers

By the way, rtnl lock is still required, when accessing bond.params.* for updating send_peer_notif. In lacp mode, resetting send_peer_notif in workqueue is safe, simple and effective way.

Additionally, this patch introduces bond_peer_notify_may_events(), which is used to check whether an event should be sent. This function will be used in both patch 1 and 2.

---
 drivers/net/bonding/bond_3ad.c  |    7 +---
 drivers/net/bonding/bond_main.c |   66 +++++++++++++++++++++++++++++++---------
 include/net/bonding.h           |    2 +
 3 files changed, 56 insertions(+), 19 deletions(-)

@@ -1014,11 +1014,8 @@ static void ad_cond_set_peer_notif(struc
 {
 	struct bonding *bond = port->slave->bond;
 
-	if (bond->params.broadcast_neighbor && rtnl_trylock()) {
-		bond->send_peer_notif = bond->params.num_peer_notif *
-			max(1, bond->params.peer_notif_delay);
-		rtnl_unlock();
-	}
+	if (bond->params.broadcast_neighbor)
+		bond_peer_notify_work_rearm(bond, 0);
 }
 
 /**

@@ -255,6 +255,7 @@ struct bonding {
 	struct   delayed_work ad_work;
 	struct   delayed_work mcast_work;
 	struct   delayed_work slave_arr_work;
+	struct   delayed_work peer_notify_work;
 #ifdef CONFIG_DEBUG_FS
 	/* debugging support via debugfs */
 	struct	 dentry *debug_dir;

@@ -712,6 +713,7 @@ struct bond_vlan_tag *bond_verify_device
 					      int level);
 int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave);
 void bond_slave_arr_work_rearm(struct bonding *bond, unsigned long delay);
+void bond_peer_notify_work_rearm(struct bonding *bond, unsigned long delay);
 void bond_work_init_all(struct bonding *bond);
 void bond_work_cancel_all(struct bonding *bond);
 

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tonghao Zhang <[email protected]>

commit 70fc6649b36cf22167bbd7e2a6cc0960b746316e upstream.

This patch tries to avoid the possible peer notify event loss.

In bond_mii_monitor()/bond_activebackup_arp_mon(), when we hold the rtnl lock:
- check send_peer_notif again to avoid unconditionally reducing this value.
- send_peer_notif may have been reset. Therefore, it is necessary to check whether to send peer notify via bond_should_notify_peers() to avoid the loss of notification events.

---
 drivers/net/bonding/bond_main.c |   30 +++++++++---------------------
 1 file changed, 9 insertions(+), 21 deletions(-)

@@ -2887,11 +2887,10 @@ static void bond_mii_monitor(struct work
 {
 	struct bonding *bond = container_of(work, struct bonding,
 					    mii_work.work);
-	bool should_notify_peers;
-	bool commit;
-	unsigned long delay;
-	struct slave *slave;
 	struct list_head *iter;
+	struct slave *slave;
+	unsigned long delay;
+	bool commit;
 
 	delay = msecs_to_jiffies(bond->params.miimon);
 

@@ -2900,7 +2899,6 @@ static void bond_mii_monitor(struct work
 
 	rcu_read_lock();
 
-	should_notify_peers = bond_should_notify_peers(bond);
 	commit = !!bond_miimon_inspect(bond);
 
 	rcu_read_unlock();

@@ -2920,12 +2918,8 @@ static void bond_mii_monitor(struct work
 			bond_miimon_commit(bond);
 		}
 
-		if (bond->send_peer_notif) {
-			bond->send_peer_notif--;
-			if (should_notify_peers)
-				call_netdevice_notifiers(NETDEV_NOTIFY_PEERS,
-							 bond->dev);
-		}
+		if (bond->send_peer_notif)
+			bond_peer_notify_may_events(bond, true);
 
 		rtnl_unlock();	/* might sleep, hold no other locks */
 	}

@@ -3839,7 +3833,6 @@ check_state:
 
 static void bond_activebackup_arp_mon(struct bonding *bond)
 {
-	bool should_notify_peers = false;
 	bool should_notify_rtnl = false;
 	int delta_in_ticks;
 

@@ -3850,15 +3843,12 @@ static void bond_activebackup_arp_mon(st
 
 	rcu_read_lock();
 
-	should_notify_peers = bond_should_notify_peers(bond);
-
 	if (bond_ab_arp_inspect(bond)) {
 		rcu_read_unlock();
 
 		/* Race avoidance with bond_close flush of workqueue */
 		if (!rtnl_trylock()) {
 			delta_in_ticks = 1;
-			should_notify_peers = false;
 			goto re_arm;
 		}
 

@@ -3875,15 +3865,13 @@ re_arm:
 	if (bond->params.arp_interval)
 		queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 
-	if (should_notify_peers || should_notify_rtnl) {
+	if (bond->send_peer_notif || should_notify_rtnl) {
 		if (!rtnl_trylock())
 			return;
 
-		if (should_notify_peers) {
-			bond->send_peer_notif--;
-			call_netdevice_notifiers(NETDEV_NOTIFY_PEERS,
-						 bond->dev);
-		}
+		if (bond->send_peer_notif)
+			bond_peer_notify_may_events(bond, true);
+
 		if (should_notify_rtnl) {
 			bond_slave_state_notify(bond);
 			bond_slave_link_notify(bond);

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: YuanZhe Liu <[email protected]>

commit aa118c8f61d59387961d58ffae831c5259a9f222 upstream.

A KASAN slab-use-after-free read was reported in submit_audio_out_urb() when generating an impulse test signal:

  BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]
  BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249
  Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785

  Allocated by task 11:
   kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144
   line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158
   line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329
   line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728

  Freed by task 7785:
   kfree+0xf8/0x390 mm/slub.c:6566
   line6_buffer_release sound/usb/line6/pcm.c:176 [inline]
   line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170
   __line6_pcm_release sound/usb/line6/pcm.c:305 [inline]
   line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313
   snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183

line6pcm->prev_fbuf points into the capture PCM stream buffer (line6pcm->in.buffer), which is updated during audio_in_callback() to feed rate synchronization, software monitoring, and impulse test signal generation on playback side.

When all capture streams are closed, line6_buffer_release() frees pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf. If playback is subsequently started (e.g. via impulse test signal volume control snd_line6_impulse_volume_put()), submit_audio_out_urb() dereferences the stale pointer line6pcm->prev_fbuf under in.lock, resulting in a slab-use-after-free read.

Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing the capture stream buffer under in.lock, ensuring that no stale buffer pointer can be accessed by submit_audio_out_urb().

---
 sound/usb/line6/pcm.c |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -173,6 +173,14 @@ static void line6_buffer_release(struct
 	clear_bit(type, &pstr->opened);
 	if (!pstr->opened) {
 		line6_wait_clear_audio_urbs(line6pcm, pstr);
+		if (pstr == &line6pcm->in) {
+			/* prev_fbuf points into the capture buffer we are about
+			 * to free; drop it while no capture URB is in flight.
+			 */
+			guard(spinlock_irqsave)(&line6pcm->in.lock);
+			line6pcm->prev_fbuf = NULL;
+			line6pcm->prev_fsize = 0;
+		}
 		kfree(pstr->buffer);
 		pstr->buffer = NULL;
 	}

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jonas Karlman <[email protected]>

[ Upstream commit af3a9eadc11896f6677bcb7102bfb7c84be48d2d ]

rockchip_drm_sys_resume()/drm_mode_config_helper_resume() is called before the resume pm ops of dw-hdmi. This result in an atomic_enable() before dw_hdmi_rockchip_resume()/dw_hdmi_resume() is called.

Resume (without changes):
- rockchip_drm_sys_resume()
- drm_mode_config_helper_resume()
- atomic_enable()
- dw_hdmi_rockchip_resume()
- dw_hdmi_resume()
- dw_hdmi_init_hw()

Change to use resume_early pm ops for system suspend to ensure pm ops for dw-hdmi is run before rockchip-drm pm ops. Also fix a possible NULL pointer dereference timing issue while at it.

Resume (with changes):
- dw_hdmi_rockchip_resume_early()
- dw_hdmi_resume()
- dw_hdmi_init_hw()
- rockchip_drm_sys_resume()
- drm_mode_config_helper_resume()
- atomic_enable()

---
 drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

index 727cdf768161a..ff34aeef3a6ff 100644
@@ -635,17 +635,18 @@ static void dw_hdmi_rockchip_remove(struct platform_device *pdev)
 	component_del(&pdev->dev, &dw_hdmi_rockchip_ops);
 }
 
-static int __maybe_unused dw_hdmi_rockchip_resume(struct device *dev)
+static int __maybe_unused dw_hdmi_rockchip_resume_early(struct device *dev)
 {
 	struct rockchip_hdmi *hdmi = dev_get_drvdata(dev);
 
-	dw_hdmi_resume(hdmi->hdmi);
+	if (hdmi)
+		dw_hdmi_resume(hdmi->hdmi);
 
 	return 0;
 }
 
 static const struct dev_pm_ops dw_hdmi_rockchip_pm = {
-	SET_SYSTEM_SLEEP_PM_OPS(NULL, dw_hdmi_rockchip_resume)
+	SET_LATE_SYSTEM_SLEEP_PM_OPS(NULL, dw_hdmi_rockchip_resume_early)
 };
 
 struct platform_driver dw_hdmi_rockchip_pltfm_driver = {

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ryosuke Yasuoka <[email protected]>

[ Upstream commit a46991b334f663fa0e0e9c051e50587ef977ac8b ]

virtio_gpu_queue_ctrl_sgs() and virtio_gpu_queue_cursor() use wait_event() without any abort condition when waiting for virtqueue space. If the host device stops processing commands, these waits block indefinitely inside a drm_dev_enter/exit() critical section. Since drm_dev_unplug(), which is called in device removal and system shutdown call path, blocks on synchronize_srcu() until all critical sections complete, device removal and system shutdown also hang.

Add a vqs_released flag to virtio_gpu_device and include it in the wait_event() condition. Set the flag and wake up both queues in a new virtio_gpu_release_vqs() helper, called before drm_dev_unplug() in both virtio_gpu_remove() and virtio_gpu_shutdown(). When the flag is set, the wait returns immediately and the command is aborted, following the same cleanup path as drm_dev_enter() failure.

---
 drivers/gpu/drm/virtio/virtgpu_drv.c | 15 +++++++++++++++
 drivers/gpu/drm/virtio/virtgpu_drv.h |  1 +
 drivers/gpu/drm/virtio/virtgpu_vq.c  | 23 +++++++++++++++++++++--
 3 files changed, 37 insertions(+), 2 deletions(-)

index d9556e1b67b10..78cc388b434d9 100644
@@ -118,10 +118,24 @@ static int virtio_gpu_probe(struct virtio_device *vdev)
 	return ret;
 }
 
+/*
+ * Release pending virtqueue waits so the drm_dev_enter/exit() critical
+ * sections complete before drm_dev_unplug() blocks on synchronize_srcu().
+ */
+static void virtio_gpu_release_vqs(struct drm_device *dev)
+{
+	struct virtio_gpu_device *vgdev = dev->dev_private;
+
+	vgdev->vqs_released = true;
+	wake_up_all(&vgdev->ctrlq.ack_queue);
+	wake_up_all(&vgdev->cursorq.ack_queue);
+}
+
 static void virtio_gpu_remove(struct virtio_device *vdev)
 {
 	struct drm_device *dev = vdev->priv;
 
+	virtio_gpu_release_vqs(dev);
 	drm_dev_unplug(dev);
 
 	if (drm_core_check_feature(dev, DRIVER_ATOMIC))

@@ -135,6 +149,7 @@ static void virtio_gpu_shutdown(struct virtio_device *vdev)
 {
 	struct drm_device *dev = vdev->priv;
 
+	virtio_gpu_release_vqs(dev);
 	/* stop talking to the device */
 	drm_dev_unplug(dev);
 }

index 8575c7787fc36..51b78f8a8aa2e 100644
@@ -260,6 +260,7 @@ struct virtio_gpu_device {
 
 	struct virtio_gpu_queue ctrlq;
 	struct virtio_gpu_queue cursorq;
+	bool vqs_released;
 	struct kmem_cache *vbufs;
 
 	atomic_t pending_commands;

index 592ad4f9b100d..244a791ab915e 100644
@@ -422,7 +422,19 @@ static int virtio_gpu_queue_ctrl_sgs(struct virtio_gpu_device *vgdev,
 	if (vq->num_free < elemcnt) {
 		spin_unlock(&vgdev->ctrlq.qlock);
 		virtio_gpu_notify(vgdev);
-		wait_event(vgdev->ctrlq.ack_queue, vq->num_free >= elemcnt);
+		wait_event(vgdev->ctrlq.ack_queue,
+			   vq->num_free >= elemcnt || vgdev->vqs_released);
+		/*
+		 * Set by virtio_gpu_release_vqs() to unblock
+		 * synchronize_srcu() wait in drm_dev_unplug().
+		 */
+		if (vgdev->vqs_released) {
+			if (fence && vbuf->objs)
+				virtio_gpu_array_unlock_resv(vbuf->objs);
+			free_vbuf(vgdev, vbuf);
+			drm_dev_exit(idx);
+			return -ENODEV;
+		}
 		goto again;
 	}
 

@@ -592,7 +604,14 @@ static void virtio_gpu_queue_cursor(struct virtio_gpu_device *vgdev,
 	ret = virtqueue_add_sgs(vq, sgs, outcnt, 0, vbuf, GFP_ATOMIC);
 	if (ret == -ENOSPC) {
 		spin_unlock(&vgdev->cursorq.qlock);
-		wait_event(vgdev->cursorq.ack_queue, vq->num_free >= outcnt);
+		wait_event(vgdev->cursorq.ack_queue,
+			   vq->num_free >= outcnt || vgdev->vqs_released);
+		/* See comment in virtio_gpu_queue_ctrl_sgs(). */
+		if (vgdev->vqs_released) {
+			free_vbuf(vgdev, vbuf);
+			drm_dev_exit(idx);
+			return;
+		}
 		spin_lock(&vgdev->cursorq.qlock);
 		goto retry;
 	} else {

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Terry Hsiao <[email protected]>

[ Upstream commit d4ae726fc08024b359e9cacf2507f1c256b9d71c ]

The raw EDIDs for each panel:

BOE NV116WH2-M30
00 ff ff ff ff ff ff 00 09 e5 6e 38 00 00 00 00 0a 24 01 04 95 1a 0e 78 03 0b 55 9a 5f 58 95 28 1e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 96 1d 56 c8 50 00 26 30 30 20 36 00 00 90 10 00 00 1a b9 13 56 c8 50 00 26 30 30 20 36 00 00 90 10 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0d 40 ff 0a 3c 7d 0f 0c 17 7d 00 00 00 00 80

BOE NT116WHM-N21
00 ff ff ff ff ff ff 00 09 e5 79 38 00 00 00 00 08 24 01 04 95 1a 0e 78 03 3a d5 95 5c 58 94 29 24 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 38 1d 56 c8 50 00 1c 30 30 20 36 00 00 90 10 00 00 1a 7b 13 56 c8 50 00 1c 30 30 20 36 00 00 90 10 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0d 40 ff 0a 3c 7d 0f 0c 17 7d 00 00 00 00 7a

BOE NV116FH1-M31
00 ff ff ff ff ff ff 00 09 e5 8b 38 01 ff 00 00 0c 24 01 04 a5 1a 0e 78 03 50 d5 9c 55 52 8f 27 15 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 9a 36 80 a0 70 38 28 40 30 20 35 00 00 90 10 00 00 1a 67 24 80 a0 70 38 28 40 30 20 35 00 00 90 10 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0d 36 ff 0a 3c 96 0f 0b 1a 96 00 00 00 01 cd

70 20 79 02 00 20 00 0c 9a 0e 00 8b 38 00 00 00 00 0c 1a 00 21 01 1d 03 0a a2 05 80 07 38 04 88 c2 39 55 1e 15 8f 7a 32 15 02 35 54 b0 5c b0 5c 00 36 12 78 22 00 14 ff 21 02 85 7f 07 9f 00 2f 00 1f 00 37 04 27 00 02 00 04 00 81 00 15 74 1a 00 00 03 00 28 3c 00 00 53 5a 53 5a 3c 00 00 00 00 00 00 2b 00 06 27 00 28 3b 00 00 2e 00 06 80 4b b0 5c b0 5c 00 00 00 00 00 00 00 00 00 89 90

BOE NV116FH1-M30
00 ff ff ff ff ff ff 00 09 e5 8c 38 01 ff 00 00 0c 24 01 04 a5 1a 0e 78 03 50 d5 9c 55 52 8f 27 15 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 9a 36 80 a0 70 38 28 40 30 20 35 00 00 90 10 00 00 1a 67 24 80 a0 70 38 28 40 30 20 35 00 00 90 10 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0d 36 ff 0a 3c 96 0f 0b 1a 96 00 00 00 01 cc

70 20 79 02 00 20 00 0c 9a 0e 00 8c 38 00 00 00 00 0c 1a 00 21 01 1d 03 0a a2 05 80 07 38 04 88 c2 39 55 1e 15 8f 7a 32 15 02 35 54 b0 5c b0 5c 00 36 12 78 22 00 14 ff 21 02 85 7f 07 9f 00 2f 00 1f 00 37 04 27 00 02 00 04 00 81 00 15 74 1a 00 00 03 00 28 3c 00 00 53 5a 53 5a 3c 00 00 00 00 00 00 2b 00 06 27 00 28 3b 00 00 2e 00 06 80 4b b0 5c b0 5c 00 00 00 00 00 00 00 00 00 88 90

---
 drivers/gpu/drm/panel/panel-edp.c | 4 ++++
 1 file changed, 4 insertions(+)

index 9ad1769885b3c..792923b1d7878 100644
@@ -2005,6 +2005,10 @@ static const struct edp_panel_entry edp_panels[] = {
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0d45, &delay_200_500_e80, "NV116WHM-N4B"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0d73, &delay_200_500_e80, "NE140WUM-N6S"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0ddf, &delay_200_500_e80, "NV116WHM-T01"),
+	EDP_PANEL_ENTRY('B', 'O', 'E', 0x386e, &delay_200_500_e80, "NV116WH2-M30"),
+	EDP_PANEL_ENTRY('B', 'O', 'E', 0x3879, &delay_200_500_e80, "NT116WHM-N21"),
+	EDP_PANEL_ENTRY('B', 'O', 'E', 0x388b, &delay_200_500_e80, "NV116FH1-M31"),
+	EDP_PANEL_ENTRY('B', 'O', 'E', 0x388c, &delay_200_500_e80, "NV116FH1-M30"),
 
 	EDP_PANEL_ENTRY('C', 'M', 'N', 0x1130, &delay_200_500_e50, "N116BGE-EB2"),
 	EDP_PANEL_ENTRY('C', 'M', 'N', 0x1132, &delay_200_500_e80_d50, "N116BGE-EA2"),

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jesse Zhang <[email protected]>

[ Upstream commit 5ec4cc91708370847772f2a2397316dbd8d8f066 ]

when suspend_all_gangs is issued to pipe0 MES during system suspend or runtime PM, pipe0 can only suspend and resume queues it has tracked. KCQs registered with a non-zero pipe slot may not be correctly handled, leaving them in an inconsistent state after resume.

v3: fix the schedule pipe issue
v4: use schedule pipe for KQ resets

---
 drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 27 ++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

index c40aed5a8fc21..7d7bcf1c69f27 100644
@@ -524,10 +524,15 @@ static int mes_v12_0_map_legacy_queue(struct amdgpu_mes *mes,
 		convert_to_mes_queue_type(input->queue_type);
 	mes_add_queue_pkt.map_legacy_kq = 1;
 
-	if (mes->adev->enable_uni_mes)
-		pipe = AMDGPU_MES_KIQ_PIPE;
-	else
+	if (mes->adev->enable_uni_mes) {
+		/* Keep scheduler queue on KIQ pipe; map all other kernel queues on sched pipe. */
+		if (input->queue_type == AMDGPU_RING_TYPE_MES)
+			pipe = AMDGPU_MES_KIQ_PIPE;
+		else
+			pipe = AMDGPU_MES_SCHED_PIPE;
+	} else {
 		pipe = AMDGPU_MES_SCHED_PIPE;
+	}
 
 	return mes_v12_0_submit_pkt_and_poll_completion(mes, pipe,
 			&mes_add_queue_pkt, sizeof(mes_add_queue_pkt),

@@ -563,10 +568,15 @@ static int mes_v12_0_unmap_legacy_queue(struct amdgpu_mes *mes,
 			convert_to_mes_queue_type(input->queue_type);
 	}
 
-	if (mes->adev->enable_uni_mes)
-		pipe = AMDGPU_MES_KIQ_PIPE;
-	else
+	if (mes->adev->enable_uni_mes) {
+		/* Keep scheduler queue on KIQ pipe; unmap all other kernel queues on sched pipe. */
+		if (input->queue_type == AMDGPU_RING_TYPE_MES)
+			pipe = AMDGPU_MES_KIQ_PIPE;
+		else
+			pipe = AMDGPU_MES_SCHED_PIPE;
+	} else {
 		pipe = AMDGPU_MES_SCHED_PIPE;
+	}
 
 	return mes_v12_0_submit_pkt_and_poll_completion(mes, pipe,
 			&mes_remove_queue_pkt, sizeof(mes_remove_queue_pkt),

@@ -909,10 +919,7 @@ static int mes_v12_0_reset_hw_queue(struct amdgpu_mes *mes,
 		mes_reset_queue_pkt.doorbell_offset = input->doorbell_offset;
 	}
 
-	if (input->is_kq)
-		pipe = AMDGPU_MES_KIQ_PIPE;
-	else
-		pipe = AMDGPU_MES_SCHED_PIPE;
+	pipe = AMDGPU_MES_SCHED_PIPE;
 
 	return mes_v12_0_submit_pkt_and_poll_completion(mes, pipe,
 			&mes_reset_queue_pkt, sizeof(mes_reset_queue_pkt),

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Asad Kamal <[email protected]>

[ Upstream commit b390cb9d776039fc4f0be13b2649299079227d12 ]

vega10_odn_edit_dpm_table() and smu7_odn_edit_dpm_table() could mutate the live ODN table for valid triples, then return 0 after detecting a truncated buffer or out-of-range index. Validate all (index, clock, voltage) triples first and return -EINVAL on any failure; only then apply updates.

v2: Use distinct message for different error case, removed unused input_level from validation loop (Lijo)

v3: Reject negative level indices, input[] is long but was compared only against unsigned table bounds, so negative values could pass and truncate when assigned to uint32_t input_level.

Set DPMTABLE_OD_UPDATE_SCLK/MCLK only after validation passes, so a failed sysfs write does not leave need_update_dpm_table set for a later commit.

---
 .../drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c   | 34 ++++++++++-------
 .../drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 37 ++++++++++++-------
 2 files changed, 43 insertions(+), 28 deletions(-)

index ba953654a0206..cf008ed409552 100644
@@ -5661,23 +5661,29 @@ static int smu7_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
 	}
 
 	for (i = 0; i < size; i += 3) {
-		if (i + 3 > size || input[i] >= podn_dpm_table_in_backend->num_of_pl) {
-			pr_info("invalid clock voltage input \n");
-			return 0;
+		if (i + 3 > size) {
+			pr_info("truncated clock/voltage input\n");
+			return -EINVAL;
 		}
-		input_level = input[i];
-		input_clk = input[i+1] * 100;
-		input_vol = input[i+2];
-
-		if (smu7_check_clk_voltage_valid(hwmgr, type, input_clk, input_vol)) {
-			podn_dpm_table_in_backend->entries[input_level].clock = input_clk;
-			podn_vdd_dep_in_backend->entries[input_level].clk = input_clk;
-			podn_dpm_table_in_backend->entries[input_level].vddc = input_vol;
-			podn_vdd_dep_in_backend->entries[input_level].vddc = input_vol;
-			podn_vdd_dep_in_backend->entries[input_level].vddgfx = input_vol;
-		} else {
+		if (input[i] < 0 || input[i] >= podn_dpm_table_in_backend->num_of_pl) {
+			pr_info("invalid clock/voltage level\n");
 			return -EINVAL;
 		}
+		input_clk = input[i + 1] * 100;
+		input_vol = input[i + 2];
+		if (!smu7_check_clk_voltage_valid(hwmgr, type, input_clk, input_vol))
+			return -EINVAL;
+	}
+
+	for (i = 0; i < size; i += 3) {
+		input_level = input[i];
+		input_clk = input[i + 1] * 100;
+		input_vol = input[i + 2];
+		podn_dpm_table_in_backend->entries[input_level].clock = input_clk;
+		podn_vdd_dep_in_backend->entries[input_level].clk = input_clk;
+		podn_dpm_table_in_backend->entries[input_level].vddc = input_vol;
+		podn_vdd_dep_in_backend->entries[input_level].vddc = input_vol;
+		podn_vdd_dep_in_backend->entries[input_level].vddgfx = input_vol;
 	}
 
 	return 0;

index b3fed2a478aab..d6aaba0b3613d 100644
@@ -5645,11 +5645,9 @@ static int vega10_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
 	if (PP_OD_EDIT_SCLK_VDDC_TABLE == type) {
 		dpm_table = &data->dpm_table.gfx_table;
 		podn_vdd_dep_table = &data->odn_dpm_table.vdd_dep_on_sclk;
-		data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_SCLK;
 	} else if (PP_OD_EDIT_MCLK_VDDC_TABLE == type) {
 		dpm_table = &data->dpm_table.mem_table;
 		podn_vdd_dep_table = &data->odn_dpm_table.vdd_dep_on_mclk;
-		data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_MCLK;
 	} else if (PP_OD_RESTORE_DEFAULT_TABLE == type) {
 		memcpy(&(data->dpm_table), &(data->golden_dpm_table), sizeof(struct vega10_dpm_table));
 		vega10_odn_initial_default_setting(hwmgr);

@@ -5667,21 +5665,32 @@ static int vega10_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
 	}
 
 	for (i = 0; i < size; i += 3) {
-		if (i + 3 > size || input[i] >= podn_vdd_dep_table->count) {
-			pr_info("invalid clock voltage input\n");
-			return 0;
+		if (i + 3 > size) {
+			pr_info("truncated clock/voltage input\n");
+			return -EINVAL;
 		}
-		input_level = input[i];
-		input_clk = input[i+1] * 100;
-		input_vol = input[i+2];
-
-		if (vega10_check_clk_voltage_valid(hwmgr, type, input_clk, input_vol)) {
-			dpm_table->dpm_levels[input_level].value = input_clk;
-			podn_vdd_dep_table->entries[input_level].clk = input_clk;
-			podn_vdd_dep_table->entries[input_level].vddc = input_vol;
-		} else {
+		if (input[i] < 0 || input[i] >= podn_vdd_dep_table->count) {
+			pr_info("invalid clock/voltage level\n");
 			return -EINVAL;
 		}
+		input_clk = input[i + 1] * 100;
+		input_vol = input[i + 2];
+		if (!vega10_check_clk_voltage_valid(hwmgr, type, input_clk, input_vol))
+			return -EINVAL;
+	}
+
+	if (type == PP_OD_EDIT_SCLK_VDDC_TABLE)
+		data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_SCLK;
+	else
+		data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_MCLK;
+
+	for (i = 0; i < size; i += 3) {
+		input_level = input[i];
+		input_clk = input[i + 1] * 100;
+		input_vol = input[i + 2];
+		dpm_table->dpm_levels[input_level].value = input_clk;
+		podn_vdd_dep_table->entries[input_level].clk = input_clk;
+		podn_vdd_dep_table->entries[input_level].vddc = input_vol;
 	}
 	vega10_odn_update_soc_table(hwmgr, type);
 	return 0;

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Asad Kamal <[email protected]>

[ Upstream commit 17ac73b24006700f50972d37e297dec1f523c14a ]

amdgpu_regs, amdgpu_regs2, and related debugfs nodes allow arbitrary MMIO read/write via RREG32/WREG32 without checking security_locked_down(). On kernel_lockdown=integrity systems this bypasses the same restrictions as /dev/mem and PCI config space sysfs.

Check LOCKDOWN_PCI_ACCESS (matching pci-sysfs) at the entry of every debugfs handler that performs direct register access.

v2: Use consistent check as per previous check to use LOCKDOWN_DEBUGFS(Lijo)

v3: Do not create any entry from amdgpu_debugfs_regs_init() if LOCKDOWN_PCI_ACCESS is active and log once. (Lijo)

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 7 +++++++
 1 file changed, 7 insertions(+)

index 04939a9711e95..c7535ef0ae401 100644
@@ -26,6 +26,7 @@
 #include <linux/kthread.h>
 #include <linux/pci.h>
 #include <linux/uaccess.h>
+#include <linux/security.h>
 #include <linux/pm_runtime.h>
 
 #include "amdgpu.h"

@@ -1646,6 +1647,12 @@ int amdgpu_debugfs_regs_init(struct amdgpu_device *adev)
 	struct dentry *ent, *root = minor->debugfs_root;
 	unsigned int i;
 
+	if (security_locked_down(LOCKDOWN_PCI_ACCESS)) {
+		drm_info(adev_to_drm(adev),
+			 "amdgpu: HW debugfs nodes disabled (kernel lockdown)\n");
+		return 0;
+	}
+
 	for (i = 0; i < ARRAY_SIZE(debugfs_regs); i++) {
 		ent = debugfs_create_file(debugfs_regs_names[i],
 					  S_IFREG | 0400, root,

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Charlene Liu <[email protected]>

[ Upstream commit f48124ff35357d05a98d9cd5cb7982e7e5509003 ]

[why]
Fix regresson caused by double roundup and index out of range

---
 drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

index 08f7f03b10231..0167d936feaf5 100644
@@ -152,16 +152,16 @@ static void dml21_calculate_rq_and_dlg_params(const struct dc *dc, struct dc_sta
 	context->bw_ctx.bw.dcn.clk.bw_dispclk_khz = context->bw_ctx.bw.dcn.clk.dispclk_khz;
 	if (in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.num_clk_values > 1) {
 		context->bw_ctx.bw.dcn.clk.max_supported_dispclk_khz =
-			in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.clk_values_khz[in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.num_clk_values] * 1000;
+			in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.clk_values_khz[in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.num_clk_values - 1];
 	} else {
-		context->bw_ctx.bw.dcn.clk.max_supported_dispclk_khz = in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.clk_values_khz[0] * 1000;
+		context->bw_ctx.bw.dcn.clk.max_supported_dispclk_khz = in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.clk_values_khz[0];
 	}
 
 	if (in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.num_clk_values > 1) {
 		context->bw_ctx.bw.dcn.clk.max_supported_dppclk_khz =
-			in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.clk_values_khz[in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.num_clk_values] * 1000;
+			in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.clk_values_khz[in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.num_clk_values - 1];
 	} else {
-		context->bw_ctx.bw.dcn.clk.max_supported_dppclk_khz = in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.clk_values_khz[0] * 1000;
+		context->bw_ctx.bw.dcn.clk.max_supported_dppclk_khz = in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.clk_values_khz[0];
 	}
 
 	/* get global mall allocation */

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ruoyu Wang <[email protected]>

[ Upstream commit d3f30034f861a585f8e487ae1555d9f288a96f87 ]

r600_parse_extended_power_table() uses manual kfree() calls for some early allocation failures, but the freed pointers are left in the dynamic power-management state. If device teardown later calls r600_free_extended_power_table(), those stale pointers can be freed again.

Use the common extended power table cleanup helper for those early failure paths as well, and clear each pointer after freeing it so repeated cleanup stays safe.

---
 drivers/gpu/drm/radeon/r600_dpm.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

index 81d58ef667dd4..2bc0bdfd11590 100644
@@ -933,7 +933,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
 			ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
 							       dep_table);
 			if (ret) {
-				kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries);
+				r600_free_extended_power_table(rdev);
 				return ret;
 			}
 		}

@@ -944,8 +944,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
 			ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
 							       dep_table);
 			if (ret) {
-				kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries);
-				kfree(rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries);
+				r600_free_extended_power_table(rdev);
 				return ret;
 			}
 		}

@@ -956,9 +955,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
 			ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.mvdd_dependency_on_mclk,
 							       dep_table);
 			if (ret) {
-				kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries);
-				kfree(rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries);
-				kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk.entries);
+				r600_free_extended_power_table(rdev);
 				return ret;
 			}
 		}

@@ -1298,17 +1295,29 @@ void r600_free_extended_power_table(struct radeon_device *rdev)
 	struct radeon_dpm_dynamic_state *dyn_state = &rdev->pm.dpm.dyn_state;
 
 	kfree(dyn_state->vddc_dependency_on_sclk.entries);
+	dyn_state->vddc_dependency_on_sclk.entries = NULL;
 	kfree(dyn_state->vddci_dependency_on_mclk.entries);
+	dyn_state->vddci_dependency_on_mclk.entries = NULL;
 	kfree(dyn_state->vddc_dependency_on_mclk.entries);
+	dyn_state->vddc_dependency_on_mclk.entries = NULL;
 	kfree(dyn_state->mvdd_dependency_on_mclk.entries);
+	dyn_state->mvdd_dependency_on_mclk.entries = NULL;
 	kfree(dyn_state->cac_leakage_table.entries);
+	dyn_state->cac_leakage_table.entries = NULL;
 	kfree(dyn_state->phase_shedding_limits_table.entries);
+	dyn_state->phase_shedding_limits_table.entries = NULL;
 	kfree(dyn_state->ppm_table);
+	dyn_state->ppm_table = NULL;
 	kfree(dyn_state->cac_tdp_table);
+	dyn_state->cac_tdp_table = NULL;
 	kfree(dyn_state->vce_clock_voltage_dependency_table.entries);
+	dyn_state->vce_clock_voltage_dependency_table.entries = NULL;
 	kfree(dyn_state->uvd_clock_voltage_dependency_table.entries);
+	dyn_state->uvd_clock_voltage_dependency_table.entries = NULL;
 	kfree(dyn_state->samu_clock_voltage_dependency_table.entries);
+	dyn_state->samu_clock_voltage_dependency_table.entries = NULL;
 	kfree(dyn_state->acp_clock_voltage_dependency_table.entries);
+	dyn_state->acp_clock_voltage_dependency_table.entries = NULL;
 }
 
 enum radeon_pcie_gen r600_get_pcie_gen_support(struct radeon_device *rdev,

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gangliang Xie <[email protected]>

[ Upstream commit 473f99e4a262776141366f7fb10f101d0f22b019 ]

add buf length check before using it to access data

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index 0d3c18f04ac36..8ae72c862d112 100644
@@ -166,7 +166,8 @@ static ssize_t ta_if_load_debugfs_write(struct file *fp, const char *buf, size_t
 	if (ret)
 		return -EFAULT;
 
-	if (ta_bin_len > PSP_1_MEG)
+	if (ta_bin_len < sizeof(struct common_firmware_header) ||
+	    ta_bin_len > PSP_1_MEG)
 		return -EINVAL;
 
 	copy_pos += sizeof(uint32_t);

@@ -321,6 +322,8 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	ret = copy_from_user((void *)&shared_buf_len, &buf[copy_pos], sizeof(uint32_t));
 	if (ret)
 		return -EFAULT;
+	if (!shared_buf_len || shared_buf_len > PSP_1_MEG)
+		return -EINVAL;
 	copy_pos += sizeof(uint32_t);
 
 	shared_buf = memdup_user(&buf[copy_pos], shared_buf_len);

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: YiPeng Chai <[email protected]>

[ Upstream commit db15c49a17b8fab9ada38f3a548e5353d7d6b1a8 ]

Add bounds check to prevent array overflow.

v2:
Add warning messages.

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +++++++
 1 file changed, 7 insertions(+)

index 16ae44e131ad4..b03d422572589 100644
@@ -4814,6 +4814,13 @@ static void amdgpu_register_bad_pages_mca_notifier(struct amdgpu_device *adev)
 	 * Use this list instead of mgpu_info to find the amdgpu
 	 * device on which the UMC error was reported.
 	 */
+	if (mce_adev_list.num_gpu >= MAX_GPU_INSTANCE) {
+		dev_warn_ratelimited(adev->dev,
+			"mce_adev_list full, skip notifier registration (max=%d)\n",
+			MAX_GPU_INSTANCE);
+		return;
+	}
+
 	mce_adev_list.devs[mce_adev_list.num_gpu++] = adev;
 
 	/*

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pengpeng Hou <[email protected]>

[ Upstream commit 415c63896b76fd98883e190bc7518383cb01779c ]

The driver stores chip metadata in both the OF match table and the I2C id table, but probe currently reads it with device_get_match_data(). That helper only returns firmware-node match data, so an I2C-id/modalias match can leave chip_data NULL before the driver dereferences it to read ngpio.

Use i2c_get_match_data() so the I2C id table driver_data is consumed when firmware match data is not present.

---
 drivers/gpio/gpio-pca9570.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index c5a1287079a06..f7cc3fbf45336 100644
@@ -128,7 +128,7 @@ static int pca9570_probe(struct i2c_client *client)
 	gpio->chip.get = pca9570_get;
 	gpio->chip.set = pca9570_set;
 	gpio->chip.base = -1;
-	gpio->chip_data = device_get_match_data(&client->dev);
+	gpio->chip_data = i2c_get_match_data(client);
 	gpio->chip.ngpio = gpio->chip_data->ngpio;
 	gpio->chip.can_sleep = true;
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Brauner <[email protected]>

[ Upstream commit e5804b1024193c91ff2648403beda882cb4f8b6c ]

set_layers_via_fds.c calls open_tree() directly, but that wrapper is not provided by all C libraries, so the test fails to link with "undefined reference to open_tree" on toolchains without it.

Use sys_open_tree() from ../wrappers.h, the syscall wrapper already used for move_mount(), fsmount() and friends here. This is also a prerequisite for building the new idmapped_mounts test added to this directory.

---
 .../filesystems/overlayfs/set_layers_via_fds.c   | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

index dc0449fa628f8..d4a645ec88636 100644
@@ -624,7 +624,7 @@ TEST_F(set_layers_via_fds, set_layers_via_detached_mount_fds)
 
 	ASSERT_EQ(sys_move_mount(fd_tmpfs, "", -EBADF, "/set_layers_via_fds_tmpfs", MOVE_MOUNT_F_EMPTY_PATH), 0);
 
-	fd_tmp = open_tree(fd_tmpfs, "u", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	fd_tmp = sys_open_tree(fd_tmpfs, "u", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(fd_tmp, 0);
 
 	layer_fds[0] = openat(fd_tmp, "upper", O_CLOEXEC | O_DIRECTORY | O_PATH);

@@ -633,25 +633,25 @@ TEST_F(set_layers_via_fds, set_layers_via_detached_mount_fds)
 	layer_fds[1] = openat(fd_tmp, "work", O_CLOEXEC | O_DIRECTORY | O_PATH);
 	ASSERT_GE(layer_fds[1], 0);
 
-	layer_fds[2] = open_tree(fd_tmpfs, "l1", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[2] = sys_open_tree(fd_tmpfs, "l1", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[2], 0);
 
-	layer_fds[3] = open_tree(fd_tmpfs, "l2", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[3] = sys_open_tree(fd_tmpfs, "l2", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[3], 0);
 
-	layer_fds[4] = open_tree(fd_tmpfs, "l3", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[4] = sys_open_tree(fd_tmpfs, "l3", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[4], 0);
 
-	layer_fds[5] = open_tree(fd_tmpfs, "l4", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[5] = sys_open_tree(fd_tmpfs, "l4", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[5], 0);
 
-	layer_fds[6] = open_tree(fd_tmpfs, "d1", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[6] = sys_open_tree(fd_tmpfs, "d1", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[6], 0);
 
-	layer_fds[7] = open_tree(fd_tmpfs, "d2", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[7] = sys_open_tree(fd_tmpfs, "d2", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[7], 0);
 
-	layer_fds[8] = open_tree(fd_tmpfs, "d3", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[8] = sys_open_tree(fd_tmpfs, "d3", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[8], 0);
 
 	ASSERT_EQ(close(fd_tmpfs), 0);

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ruoyu Wang <[email protected]>

[ Upstream commit 8310cdeefc8a14d2093c3234b570c7805c20bcbf ]

wacom_intuos_bt_irq() duplicates the received Bluetooth report with kmemdup() so that it can pass 10-byte input report payloads to the common Intuos parser. The helper then copies each payload back into wacom->data before calling wacom_intuos_irq().

Avoid the allocation and copy by temporarily pointing wacom->data at the current 10-byte payload while the common parser runs, then restoring the original report pointer. The Bluetooth report parser keeps using the original report buffer for dispatch and battery parsing, while the common parser sees the same payload bytes as before.

This also removes the unchecked kmemdup() result from the Bluetooth IRQ path.

---
 drivers/hid/wacom_wac.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

index af76e49fd0f25..8feb8027be95e 100644
@@ -1192,8 +1192,11 @@ static int int_dist(int x1, int y1, int x2, int y2)
 static void wacom_intuos_bt_process_data(struct wacom_wac *wacom,
 		unsigned char *data)
 {
-	memcpy(wacom->data, data, 10);
+	u8 *saved_data = wacom->data;
+
+	wacom->data = data;
 	wacom_intuos_irq(wacom);
+	wacom->data = saved_data;
 
 	input_sync(wacom->pen_input);
 	if (wacom->pad_input)

@@ -1202,7 +1205,7 @@ static void wacom_intuos_bt_process_data(struct wacom_wac *wacom,
 
 static int wacom_intuos_bt_irq(struct wacom_wac *wacom, size_t len)
 {
-	u8 *data = kmemdup(wacom->data, len, GFP_KERNEL);
+	u8 *data = wacom->data;
 	int i = 1;
 	unsigned power_raw, battery_capacity, bat_charging, ps_connected;
 

@@ -1242,7 +1245,6 @@ static int wacom_intuos_bt_irq(struct wacom_wac *wacom, size_t len)
 		break;
 	}
 
-	kfree(data);
 	return 0;
 }
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kryštof Černý <[email protected]>

[ Upstream commit 53f33fd74d3993af0fbb5494b5be709f6ca6b712 ]

Add an of_device_id table and hook it into the i2c driver so the ds2482/ds2484 can be matched and auto-probed from Device Tree.

This allows automatic module loading when instantiated via DT.

---
 drivers/w1/masters/ds2482.c | 8 ++++++++
 1 file changed, 8 insertions(+)

index 0c93bf338a6ef..e91c7b0f3617c 100644
@@ -549,9 +549,17 @@ static const struct i2c_device_id ds2482_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, ds2482_id);
 
+static const struct of_device_id ds2482_of_match[] = {
+	{ .compatible = "maxim,ds2482", },
+	{ .compatible = "maxim,ds2484", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, ds2482_of_match);
+
 static struct i2c_driver ds2482_driver = {
 	.driver = {
 		.name	= "ds2482",
+		.of_match_table  = ds2482_of_match,
 	},
 	.probe		= ds2482_probe,
 	.remove		= ds2482_remove,

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fu Hao <[email protected]>

[ Upstream commit 41212ff3e4ed475d9f91d26b5324075087702987 ]

Add the new PCI ID 0x1d94 0x14a9 for Hygon family 18h model 5h HDA controller.

---
 sound/hda/controllers/intel.c | 7 +++++++
 1 file changed, 7 insertions(+)

index 98367b87d8017..f07fc5dc5cede 100644
@@ -100,6 +100,8 @@ enum {
 #define ATIHDMI_NUM_CAPTURE	0
 #define ATIHDMI_NUM_PLAYBACK	8
 
+/* Hygon HD Audio controller */
+#define PCI_DEVICE_ID_HYGON_18H_M05H_HDA	0x14a9
 
 static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;
 static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR;

@@ -241,6 +243,7 @@ enum {
 	AZX_DRIVER_ZHAOXIN,
 	AZX_DRIVER_ZHAOXINHDMI,
 	AZX_DRIVER_LOONGSON,
+	AZX_DRIVER_HYGON,
 	AZX_DRIVER_GENERIC,
 	AZX_NUM_DRIVERS, /* keep this as last entry */
 };

@@ -357,6 +360,7 @@ static const char * const driver_short_names[] = {
 	[AZX_DRIVER_ZHAOXIN] = "HDA Zhaoxin",
 	[AZX_DRIVER_ZHAOXINHDMI] = "HDA Zhaoxin HDMI",
 	[AZX_DRIVER_LOONGSON] = "HDA Loongson",
+	[AZX_DRIVER_HYGON] = "HDA Hygon",
 	[AZX_DRIVER_GENERIC] = "HD-Audio Generic",
 };
 

@@ -2814,6 +2818,9 @@ static const struct pci_device_id azx_ids[] = {
 	  .driver_data = AZX_DRIVER_LOONGSON | AZX_DCAPS_NO_TCSEL },
 	{ PCI_VDEVICE(LOONGSON, PCI_DEVICE_ID_LOONGSON_HDMI),
 	  .driver_data = AZX_DRIVER_LOONGSON | AZX_DCAPS_NO_TCSEL },
+	/* Hygon HDAudio */
+	{ PCI_VDEVICE(HYGON, PCI_DEVICE_ID_HYGON_18H_M05H_HDA),
+	  .driver_data = AZX_DRIVER_HYGON | AZX_DCAPS_POSFIX_LPIB | AZX_DCAPS_NO_MSI },
 	{ 0, }
 };
 MODULE_DEVICE_TABLE(pci, azx_ids);

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nícolas F. R. A. Prado <[email protected]>

[ Upstream commit c0933934d5d96fc641e8d0025f9099e554a7b47a ]

Currently if an HDMI cable is connected while the system is suspended, the HDMI audio jack status stays off after resume.

This is due to the jack state not being synced by the HDA HDMI codec device's runtime resume, as that never happens if the device was runtime suspended before the system suspended, or by the acomp notification triggered from the DRM side if that happens before the HDA HDMI codec device has resumed.

To fix this, if snd_hda_hdmi_acomp_pin_eld_notify() gets called before the HDA HDMI codec device has resumed, mark it to be forcefully runtime resumed at the next PM complete time.

Do this using a separate acomp_requested_resume flag that can be temporarily set without overwriting forced_resume for drivers that always want to force resume.

---
 include/sound/hda_codec.h    | 1 +
 sound/hda/codecs/hdmi/hdmi.c | 4 +++-
 sound/hda/common/codec.c     | 5 ++++-
 3 files changed, 8 insertions(+), 2 deletions(-)