Skip to content

6.6.144-rc1 review

Greg Kroah-Hartman bpf linux-erofs linux-fsdevel linux-mips linux-patches linux-unionfs lkml netdev stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest175 patches 13 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/175fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate foliosfs/fuse/dev.c+4 -00 replies
2/175net/sched: fix pedit partial COW leading to page cache corruptioninclude/net/tc_act/tc_pedit.h net/sched/act_pedit.c+41 -370 replies
3/175drm/amd/display: Bound VBIOS record-chain walk loopsdrivers/gpu/drm/amd/display/dc/bios/bios_parser.c drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c drivers/gpu/drm/amd/display/dc/bios/bios_parser_helper.h+33 -140 replies
4/175ip6_vti: set netns_immutable on the fallback device.net/ipv6/ip6_vti.c+1 -00 replies
5/175drm/v3d: Store the active job inside the queues statedrivers/gpu/drm/v3d/v3d_drv.h drivers/gpu/drm/v3d/v3d_gem.c drivers/gpu/drm/v3d/v3d_irq.c +1 more+38 -250 replies
6/175drm/v3d: Skip CSD when it has zeroed workgroupsdrivers/gpu/drm/v3d/v3d_sched.c+10 -00 replies
7/175batman-adv: tt: prevent TVLV entry number overflownet/batman-adv/translation-table.c+17 -30 replies
8/175debugobjects: Allow to refill the pool before SYSTEM_SCHEDULINGlib/debugobjects.c+1 -10 replies
9/175debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEPlib/debugobjects.c+2 -20 replies
10/175debugobjects: Do not fill_pool() if pi_blocked_onlib/debugobjects.c+14 -40 replies
11/175debugobjects: Dont call fill_pool() in early boot hardirq contextlib/debugobjects.c+36 -80 replies
12/175ARM: group is_permission_fault() with is_translation_fault()arch/arm/mm/fault.c+13 -130 replies
13/175ARM: allow __do_kernel_fault() to report execution of memory faultsarch/arm/mm/fault.c+2 -00 replies
14/175ARM: fix hash_name() faultarch/arm/mm/fault.c+35 -00 replies
15/175ARM: fix branch predictor hardeningarch/arm/mm/alignment.c arch/arm/mm/fault.c+30 -130 replies
16/175KVM: VMX: Update SVI during runtime APICv activationarch/x86/kvm/vmx/vmx.c arch/x86/kvm/x86.c+7 -40 replies
17/175RDMA/bnxt_re: zero shared page before exposing to userspacedrivers/infiniband/hw/bnxt_re/ib_verbs.c+1 -10 replies
18/175i2c: stub: Reject I2C block transfers with invalid lengthdrivers/i2c/i2c-stub.c+5 -00 replies
19/175net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h+5 -40 replies
20/175agp/amd64: Fix broken error propagation in agp_amd64_probe()drivers/char/agp/amd64-agp.c+1 -10 replies
21/175bpf: Reject sleepable kprobe_multi programs at attach timekernel/trace/bpf_trace.c+4 -00 replies
22/175selftests/bpf: Add test to ensure kprobe_multi is not sleepabletools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c+59 -00 replies
23/175af_unix: Reject SIOCATMARK on non-stream socketsnet/unix/af_unix.c+3 -00 replies
24/175bpf: Track equal scalars history on per-instruction levelinclude/linux/bpf_verifier.h kernel/bpf/verifier.c tools/testing/selftests/bpf/progs/verifier_subprog_precision.c +1 more+237 -240 replies
25/175bpf: Remove mark_precise_scalar_ids()kernel/bpf/verifier.c tools/testing/selftests/bpf/progs/verifier_scalar_ids.c tools/testing/selftests/bpf/verifier/precise.c+56 -2320 replies
26/175selftests/bpf: Tests for per-insn sync_linked_regs() precision trackingtools/testing/selftests/bpf/progs/verifier_scalar_ids.c+162 -00 replies
27/175selftests/bpf: Update comments find_equal_scalars->sync_linked_regstools/testing/selftests/bpf/progs/verifier_spill_fill.c+2 -20 replies
28/175ring-buffer: Remove ring_buffer_read_prepare_sync()include/linux/ring_buffer.h kernel/trace/ring_buffer.c kernel/trace/trace.c +1 more+18 -750 replies
29/175regulator: core: fix locking in regulator_resolve_supply() error pathdrivers/regulator/core.c+9 -10 replies
30/175dlm: prevent NPD when writing a positive value to event_donefs/dlm/lockspace.c+1 -10 replies
31/175netfilter: nf_tables: always walk all pending catchall elementsnet/netfilter/nf_tables_api.c+0 -20 replies
32/175mptcp: pm: fix extra_subflows underflow on userspace PM subflow creationnet/mptcp/pm_userspace.c+8 -50 replies
33/175hv: utils: handle and propagate errors in kvp_registerdrivers/hv/hv_kvp.c+14 -130 replies
34/175futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlockkernel/futex/requeue.c+6 -00 replies
35/175Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMsdrivers/hv/vmbus_drv.c+26 -30 replies
36/175locking/rtmutex: Skip remove_waiter() when waiter is not enqueuedkernel/locking/rtmutex.c kernel/locking/rtmutex_api.c+4 -10 replies
37/175phonet: Pass ifindex to fill_addr().net/phonet/pn_netlink.c+7 -60 replies
38/175phonet: Pass net and ifindex to phonet_address_notify().include/net/phonet/pn_dev.h net/phonet/pn_dev.c net/phonet/pn_netlink.c+14 -100 replies
39/175net: phonet: free phonet_device after RCU grace periodnet/phonet/pn_dev.c+1 -10 replies
40/175rxrpc: Fix the ACK parser to extract the SACK table for parsingnet/rxrpc/input.c+12 -10 replies
41/175slimbus: qcom-ngd-ctrl: Fix up platform_driver registrationdrivers/slimbus/qcom-ngd-ctrl.c+33 -30 replies
42/175slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGDdrivers/slimbus/qcom-ngd-ctrl.c+3 -00 replies
43/175fuse: re-lock request before replacing page cache foliofs/fuse/dev.c+5 -140 replies
44/175scripts/sorttable: Remove unused macro definesscripts/sorttable.h+0 -270 replies
45/175scripts/sorttable: Remove unused write functionsscripts/sorttable.c+0 -260 replies
46/175scripts/sorttable: Remove unneeded Elf_Relscripts/sorttable.h+2 -210 replies
47/175scripts/sorttable: Have the ORC code use the _r() functions to readscripts/sorttable.h+4 -40 replies
48/175scripts/sorttable: Make compare_extable() into two functionsscripts/sorttable.c scripts/sorttable.h+20 -140 replies
49/175scripts/sorttable: Convert Elf_Ehdr to unionscripts/sorttable.c scripts/sorttable.h+26 -220 replies
50/175scripts/sorttable: Replace Elf_Shdr Macro with a unionscripts/sorttable.c scripts/sorttable.h+51 -330 replies
51/175scripts/sorttable: Convert Elf_Sym MACRO over to a unionscripts/sorttable.c scripts/sorttable.h+19 -110 replies
52/175scripts/sorttable: Add helper functions for Elf_Ehdrscripts/sorttable.c scripts/sorttable.h+41 -40 replies
53/175scripts/sorttable: Add helper functions for Elf_Shdrscripts/sorttable.c scripts/sorttable.h+85 -230 replies
54/175scripts/sorttable: Add helper functions for Elf_Symscripts/sorttable.c scripts/sorttable.h+63 -140 replies
55/175scripts/sorttable: Use uint64_t for mcount sortingscripts/sorttable.h+11 -110 replies
56/175scripts/sorttable: Move code from sorttable.h into sorttable.cscripts/sorttable.c scripts/sorttable.h+460 -4980 replies
57/175scripts/sorttable: Get start/stop_mcount_loc from ELF file directlyscripts/sorttable.c+45 -500 replies
58/175scripts/sorttable: Use a structure of function pointers for elf helpersscripts/sorttable.c+118 -570 replies
59/175arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64arch/arm64/Kconfig scripts/sorttable.c+183 -30 replies
60/175scripts/sorttable: Have mcount rela sort use direct valuesscripts/sorttable.c+25 -10 replies
61/175scripts/sorttable: Always use an array for the mcount_loc sortingscripts/sorttable.c+90 -320 replies
62/175scripts/sorttable: Zero out weak functions in mcount_loc tablekernel/trace/ftrace.c scripts/link-vmlinux.sh scripts/sorttable.c+134 -40 replies
63/175ftrace: Update the mcount_loc check of skipped entrieskernel/trace/ftrace.c+22 -10 replies
64/175ftrace: Have ftrace pages output reflect freed pageskernel/trace/ftrace.c+12 -30 replies
65/175ftrace: Do not over-allocate ftrace memorykernel/trace/ftrace.c+15 -140 replies
66/175ftrace: Test mcount_loc addr before calling ftrace_call_addr()kernel/trace/ftrace.c+5 -10 replies
67/175ftrace: Check against is_kernel_text() instead of kaslr_offset()kernel/trace/ftrace.c+12 -50 replies
68/175scripts/sorttable: Use normal sort if theres no relocs in the mcount sectionscripts/sorttable.c+7 -20 replies
69/175scripts/sorttable: Allow matches to functions before function entryscripts/sorttable.c+6 -10 replies
70/175scripts/sorttable: Fix endianness handling in build-time mcount sortscripts/sorttable.c+1 -10 replies
71/175vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_writedrivers/tty/vt/vc_screen.c+1 -10 replies
72/175ksmbd: reject non-VALID session in compound request branchfs/smb/server/smb2pdu.c+5 -00 replies
73/175media: vidtv: fix NULL pointer dereference in vidtv_mux_push_sidrivers/media/test-drivers/vidtv/vidtv_mux.c+7 -10 replies
74/175virtiofs: fix UAF on submount umountfs/fuse/file.c+7 -10 replies
75/175file: add fput() cleanup helperinclude/linux/file.h+2 -00 replies
76/175eventpoll: use hlist_is_singular_node() in __ep_remove()fs/eventpoll.c+1 -10 replies
77/175eventpoll: split __ep_remove()fs/eventpoll.c+23 -40 replies
78/175eventpoll: kill __ep_remove()fs/eventpoll.c+30 -370 replies
79/175eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()fs/eventpoll.c+6 -60 replies
80/175eventpoll: rename ep_remove_safe() back to ep_remove()fs/eventpoll.c+8 -80 replies
81/175eventpoll: move epi_fget() upfs/eventpoll.c+28 -280 replies
82/175eventpoll: fix ep_remove struct eventpoll / struct file UAFfs/eventpoll.c+10 -60 replies
83/175KVM: x86: Fix shadow paging use-after-free due to unexpected rolearch/x86/kvm/mmu/mmu.c+6 -40 replies
84/175KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping levelarch/x86/kvm/mmu/mmu.c include/linux/kvm_host.h+18 -70 replies
85/175Revert "ptp: add testptp mask test"tools/testing/selftests/ptp/testptp.c+1 -180 replies
86/175Bluetooth: btmtk: validate WMT event SKB length before struct accessdrivers/bluetooth/btmtk.c+13 -20 replies
87/175Bluetooth: btmtk: accept too short WMT FUNC_CTRL eventsdrivers/bluetooth/btmtk.c+2 -20 replies
88/175fs: prepare for adding LSM blob to backing_filefs/file_table.c+19 -10 replies
89/175lsm: add backing_file LSM hooksfs/file_table.c fs/internal.h fs/open.c +7 more+190 -150 replies
90/175selinux: fix overlayfs mmap() and mprotect() access checkssecurity/selinux/hooks.c security/selinux/include/objsec.h+189 -640 replies
91/175batman-adv: tp_meter: keep unacked list in ascending orderednet/batman-adv/tp_meter.c+1 -10 replies
92/175batman-adv: tp_meter: initialize dup_acks explicitlynet/batman-adv/tp_meter.c+1 -00 replies
93/175batman-adv: tp_meter: initialize dec_cwnd explicitlynet/batman-adv/tp_meter.c+2 -00 replies
94/175batman-adv: tp_meter: avoid window underflownet/batman-adv/tp_meter.c+6 -10 replies
95/175batman-adv: tp_meter: avoid divide-by-zero for dec_cwndnet/batman-adv/tp_meter.c+4 -10 replies
96/175batman-adv: tp_meter: fix fast recovery preconditionnet/batman-adv/tp_meter.c+1 -10 replies
97/175batman-adv: tp_meter: handle seqno wrap-around for fast recovery detectionnet/batman-adv/tp_meter.c+1 -10 replies
98/175batman-adv: tp_meter: add only finished tp_vars to listsnet/batman-adv/tp_meter.c+9 -90 replies
99/175batman-adv: bla: annotate lasttime access with READ/WRITE_ONCEnet/batman-adv/bridge_loop_avoidance.c+14 -140 replies
100/175batman-adv: prevent ELP transmission interval underflownet/batman-adv/netlink.c+7 -10 replies
101/175batman-adv: tp_meter: initialize last_recv_time during initnet/batman-adv/tp_meter.c+7 -30 replies
102/175batman-adv: ensure bcast is writable before modifying TTLnet/batman-adv/routing.c+6 -00 replies
103/175batman-adv: fix (m|b)cast csum after decrementing TTLnet/batman-adv/routing.c+54 -10 replies
104/175batman-adv: frag: ensure fragment is writable before modifying TTLnet/batman-adv/fragmentation.c net/batman-adv/fragmentation.h net/batman-adv/routing.c+17 -40 replies
105/175batman-adv: frag: avoid underflow of TTLnet/batman-adv/fragmentation.c+7 -00 replies
106/175batman-adv: v: prevent OGM aggregation on disabled hardifnet/batman-adv/bat_v.c net/batman-adv/bat_v_ogm.c net/batman-adv/types.h+19 -00 replies
107/175batman-adv: tp_meter: restrict number of unacked list entriesnet/batman-adv/tp_meter.c net/batman-adv/types.h+25 -10 replies
108/175batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCEnet/batman-adv/tp_meter.c+4 -40 replies
109/175batman-adv: tp_meter: prevent parallel modifications of last_recvnet/batman-adv/tp_meter.c net/batman-adv/types.h+14 -100 replies
110/175batman-adv: tp_meter: handle overlapping packetsnet/batman-adv/tp_meter.c+11 -140 replies
111/175batman-adv: tt: dont merge change entries with different VIDsnet/batman-adv/translation-table.c+3 -00 replies
112/175batman-adv: tt: track roam count per VIDnet/batman-adv/translation-table.c net/batman-adv/types.h+10 -20 replies
113/175batman-adv: dat: prevent false sharing between VLANsnet/batman-adv/distributed-arp-table.c+9 -30 replies
114/175batman-adv: tvlv: enforce 2-byte alignmentnet/batman-adv/bat_iv_ogm.c net/batman-adv/bat_v_ogm.c net/batman-adv/tvlv.c+26 -20 replies
115/175batman-adv: tvlv: avoid race of cifsnotfound handler statenet/batman-adv/tvlv.c net/batman-adv/types.h+57 -130 replies
116/175ipv6: account for fraggap on the paged allocation pathnet/ipv6/ip6_output.c+3 -60 replies
117/175inet: add indirect call wrapper for getfrag() callsnet/ipv4/ip_output.c net/ipv6/ip6_output.c+17 -90 replies
118/175ipv4: account for fraggap on the paged allocation pathnet/ipv4/ip_output.c+2 -50 replies
119/175ntfs3: reject direct userspace writes to reserved $LX* xattrsfs/ntfs3/xattr.c+12 -00 replies
120/175nvmet-tcp: fix race between ICReq handling and queue teardowndrivers/nvme/target/tcp.c+28 -10 replies
121/175af_unix: Set gc_in_progress to true in unix_gc().net/unix/garbage.c+2 -00 replies
122/175mac802154: llsec: add skb_cow_data() before in-place cryptonet/mac802154/llsec.c+14 -00 replies
123/175net: skmsg: preserve sg.copy across SG transformsinclude/linux/skmsg.h net/core/filter.c net/core/skmsg.c +1 more+44 -40 replies
124/175apparmor: mediate the implicit connect of TCP fast open sendmsgsecurity/apparmor/lsm.c+15 -10 replies
125/175apparmor: fix use-after-free in rawdata dedup loopsecurity/apparmor/include/policy_unpack.h security/apparmor/policy.c+25 -20 replies
126/175NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BARdrivers/ntb/hw/epf/ntb_hw_epf.c+2 -10 replies
127/175fbdev: fix use-after-free in store_modes()drivers/video/fbdev/core/fbsysfs.c+9 -10 replies
128/175err.h: use __always_inline on all error pointer helpersinclude/linux/err.h+6 -60 replies
129/175KEYS: fix overflow in keyctl_pkey_params_get_2()security/keys/keyctl_pkey.c+8 -10 replies
130/175keys: Pin request_key_auth payload in instantiate pathsinclude/keys/request_key_auth-type.h security/keys/internal.h security/keys/keyctl.c +1 more+53 -80 replies
131/175wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3Sdrivers/net/wireless/mediatek/mt76/mt76x2/usb.c+1 -00 replies
132/175wifi: ath11k: fix warning when unbindingdrivers/net/wireless/ath/ath11k/dp.c+1 -00 replies
133/175wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptordrivers/net/wireless/realtek/rtlwifi/rtl8821ae/trx.h+1 -10 replies
134/175wifi: rtw88: increase TX report timeout to fix race conditiondrivers/net/wireless/realtek/rtw88/tx.c+6 -10 replies
135/175wifi: rtw88: usb: fix memory leaks on USB write failuresdrivers/net/wireless/realtek/rtw88/usb.c+11 -20 replies
136/175wifi: iwlwifi: mvm: fix race condition in PTP removaldrivers/net/wireless/intel/iwlwifi/mvm/ptp.c+1 -10 replies
137/175f2fs: validate compress cache inode only when enabledfs/f2fs/inode.c+7 -20 replies
138/175f2fs: fix to round down start offset of fallocate for pin filefs/f2fs/file.c+8 -10 replies
139/175f2fs: validate ACL entry sizes in f2fs_acl_from_disk()fs/f2fs/acl.c+16 -20 replies
140/175f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()fs/f2fs/extent_cache.c+7 -120 replies
141/175f2fs: keep atomic write retry from zeroing original datafs/f2fs/data.c+11 -50 replies
142/175bpf: use kvfree() for replaced sysctl write bufferkernel/bpf/cgroup.c+1 -10 replies
143/175MIPS: DEC: Prevent initial console buffer from landing in XKPHYSarch/mips/dec/prom/console.c+5 -20 replies
144/175exfat: fix potential use-after-free in exfat_find_dir_entry()fs/exfat/dir.c+3 -10 replies
145/175gfs2: fix use-after-free in gfs2_qd_deallocfs/gfs2/super.c+1 -00 replies
146/175hdlc_ppp: sync per-proto timers before freeing hdlc statedrivers/net/wan/hdlc_ppp.c+13 -20 replies
147/175blk-cgroup: fix UAF in __blkcg_rstat_flush()block/blk-cgroup.c+11 -100 replies
148/175tipc: fix slab-use-after-free Read in tipc_aead_decrypt_donenet/tipc/crypto.c+9 -00 replies
149/175LoongArch: Report dying CPU to RCU in stop_this_cpu()arch/loongarch/kernel/smp.c+1 -00 replies
150/175pNFS: Fix use-after-free in pnfs_update_layout()fs/nfs/pnfs.c+1 -10 replies
151/175irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on removedrivers/irqchip/irq-imgpdc.c+6 -00 replies
152/175fpga: region: fix use-after-free in child_regions_with_firmware()drivers/fpga/of-fpga-region.c+1 -20 replies
153/175rpmsg: char: Fix use-after-free on probe error pathdrivers/rpmsg/rpmsg_char.c+13 -20 replies
154/175ocfs2: reject oversized group bitmap descriptorsfs/ocfs2/suballoc.c+22 -00 replies
155/1759p: avoid putting oldfid in p9_client_walk() error pathnet/9p/client.c+2 -10 replies
156/175MIPS: smp: report dying CPU to RCU in stop_this_cpu()arch/mips/kernel/smp.c+2 -00 replies
157/175KVM: x86: hyper-v: Bound the bank index when querying sparse banksarch/x86/kvm/hyperv.c+5 -00 replies
158/175KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT patharch/x86/kvm/svm/sev.c+1 -00 replies
159/175power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()drivers/power/reset/linkstation-poweroff.c+1 -10 replies
160/175fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_vardrivers/video/fbdev/core/fbmem.c+12 -00 replies
161/175fbdev: modedb: fix a possible UAF in fb_find_mode()drivers/video/fbdev/core/modedb.c+1 -20 replies
162/175fbdev: modedb: Fix misaligned fields in the 1920x1080-60 modedrivers/video/fbdev/core/modedb.c+1 -10 replies
163/175NFSD: Fix SECINFO_NO_NAME decode error cleanupfs/nfsd/nfs4xdr.c+2 -10 replies
164/175nfsd: fix posix_acl leak on SETACL decode failurefs/nfsd/nfs2acl.c fs/nfsd/nfs3acl.c+24 -100 replies
165/175nfsd: check get_user() return when reading princhashlenfs/nfsd/nfs4recover.c+2 -10 replies
166/175NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addrfs/nfs/pnfs_nfs.c+2 -20 replies
167/175NFS: Prevent resource leak in nfs_alloc_server()fs/nfs/client.c+1 -00 replies
168/175ksmbd: fix out-of-bounds read in smb_check_perm_dacl()fs/smb/server/smbacl.c+3 -10 replies
169/175serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zerodrivers/tty/serial/qcom_geni_serial.c+3 -60 replies
170/175serial: 8250_dw: unregister 8250 port if clk_notifier_register() failsdrivers/tty/serial/8250/8250_dw.c+3 -10 replies
171/175drivers/base/memory: set mem->altmap after successful device registrationdrivers/base/memory.c+2 -10 replies
172/175Documentation: ioctl-number: Extend "Include File" column widthDocumentation/userspace-api/ioctl/ioctl-number.rst+232 -2320 replies
173/175crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user()drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c+3 -100 replies
174/175crypto: qat - Return pointer directly in adf_ctl_alloc_resourcesdrivers/crypto/intel/qat/qat_common/adf_ctl_drv.c+13 -180 replies
175/175crypto: qat - remove unused character device and IOCTLsDocumentation/userspace-api/ioctl/ioctl-number.rst drivers/crypto/intel/qat/qat_common/adf_cfg_common.h drivers/crypto/intel/qat/qat_common/adf_cfg_user.h +3 more+1 -5440 replies

Reviews trailers per patch

62 of 175 patches have a Reviewed-by or Acked-by.

PatchMiklos SzerediSebastian Andrzej SiewiorXie YuanbinChao GaoJean DelvareHan GuidongDavide CarattiToke Høiland-JørgensenVictor NogueiraJamal Hadi SalimLukas WunnerKumar Kartikeya DwivediLeon HwangJiri OlsaKuniyuki IwashimaDavid HowellsMasami Hiramatsu (Google)Alex HungDaniel WheelerMatthieu Baerts (NGI0)Long LiMichael KelleyKrister JohansenMatthew RuffellEric DumazetRémi Denis-CourmontSimon HormanNicolas DichtelDmitry BaryshkovMukesh OjhaIago Toral QuirogaMelissa WenCatalin MarinasNathan ChancellorJiri SlabyNamjae JeonGreg KurzJosef BacikJeff LaytonMikhail GavrilovSerge HallynAmir GoldsteinChristian BraunerIdo SchimmelWillem de BruijnBrian VazquezShivam KumarAlexander LobakinFrank LiDave JiangTamir DubersteinAlessandro GroppoLorenzo BianconiBaochen QiangRameshkumar SundaramPing-Ke ShihLuka GejakVadim FedorenkoChao YuYunji KangYeongjin GilSungjong SeoGuo RenXu YilunJoseph QiVitaly KuznetsovEmil TsalapatisJiayuan ChenYonghong SongBartosz GolaszewskiAndy ShevchenkoOscar Salvador (SUSE)Haren MyneniMadhavan SrinivasanThorsten BlumGiovanni CabidduAhsan Atta[email protected]Jose Fernandez (Anthropic)Tung NguyenBrett A C SheffieldPeter SchneiderMiguel OjedaRon EconomosShung-Hsi YuFrancesco DolciniWentao GuanPavel Machek (CIP)Mark BrownFlorian Fainelli
SeriesT-b T-b T-b T-b T-b T-b T-b T-b T-b T-b
1/175A-b
2/175R-b T-b R-b T-b R-b T-b R-b T-b A-b
3/175R-b T-b
4/175R-b
5/175R-b R-b
6/175R-b
7/175
8/175
9/175
10/175
11/175R-b
12/175
13/175R-b T-b
14/175R-b T-b
15/175R-b T-b
16/175R-b
17/175
18/175R-b
19/175
20/175R-b
21/175A-b A-b A-b
22/175
23/175R-b
24/175
25/175
26/175
27/175
28/175T-b R-b
29/175
30/175
31/175
32/175R-b
33/175R-b
34/175
35/175R-b T-b T-b
36/175
37/175R-b
38/175R-b
39/175A-b R-b
40/175
41/175R-b R-b
42/175
43/175
44/175
45/175
46/175
47/175
48/175
49/175
50/175
51/175
52/175
53/175
54/175
55/175
56/175
57/175
58/175
59/175A-b
60/175
61/175
62/175
63/175
64/175
65/175
66/175T-b
67/175T-b
68/175T-b
69/175T-b
70/175
71/175R-b
72/175A-b
73/175
74/175R-b
75/175R-b R-b
76/175
77/175
78/175
79/175
80/175
81/175
82/175
83/175
84/175
85/175
86/175
87/175T-b
88/175R-b
89/175R-b R-b R-b
90/175A-b
91/175
92/175
93/175
94/175
95/175
96/175
97/175
98/175
99/175
100/175
101/175
102/175
103/175
104/175
105/175
106/175
107/175
108/175
109/175
110/175
111/175
112/175
113/175
114/175
115/175
116/175R-b
117/175R-b R-b
118/175R-b
119/175
120/175T-b
121/175
122/175R-b
123/175
124/175
125/175
126/175R-b R-b
127/175
128/175R-b R-b T-b
129/175T-b
130/175
131/175A-b
132/175R-b R-b
133/175A-b
134/175A-b T-b
135/175A-b T-b
136/175R-b R-b
137/175R-b
138/175R-b R-b R-b R-b
139/175R-b
140/175R-b
141/175R-b
142/175R-b R-b A-b
143/175
144/175
145/175T-b
146/175
147/175T-b
148/175R-b R-b R-b
149/175R-b
150/175
151/175
152/175R-b
153/175
154/175R-b
155/175
156/175
157/175R-b
158/175
159/175
160/175
161/175
162/175
163/175
164/175
165/175R-b
166/175
167/175
168/175A-b
169/175R-b
170/175R-b
171/175A-b
172/175R-b A-b
173/175
174/175R-b A-b
175/175R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 90 reviewers.

Read the v1 thread

Cover letter [PATCH 6.6 000/175] 6.6.144-rc1 review

This is the start of the stable review cycle for the 6.6.144 release. There are 175 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.144-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.144-rc1

Giovanni Cabiddu <[email protected]>
crypto: qat - remove unused character device and IOCTLs

Herbert Xu <[email protected]>
crypto: qat - Return pointer directly in adf_ctl_alloc_resources

Thorsten Blum <[email protected]>
crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user()

Bagas Sanjaya <[email protected]>
Documentation: ioctl-number: Extend "Include File" column width

Georgi Djakov <[email protected]>

    drivers/base/memory: set mem->altmap after successful device registration

Stepan Ionichev <[email protected]>
serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails

Viken Dadhaniya <[email protected]>
serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero

Hem Parekh <[email protected]>
ksmbd: fix out-of-bounds read in smb_check_perm_dacl()

Markus Elfring <[email protected]>
NFS: Prevent resource leak in nfs_alloc_server()

Michael Bommarito <[email protected]>
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

Dominik Woźniak <[email protected]>
nfsd: check get_user() return when reading princhashlen

Jeff Layton <[email protected]>
nfsd: fix posix_acl leak on SETACL decode failure

Guannan Wang <[email protected]>
NFSD: Fix SECINFO_NO_NAME decode error cleanup

Steffen Persvold <[email protected]>

    fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode

Tuo Li <[email protected]>
fbdev: modedb: fix a possible UAF in fb_find_mode()

Ian Bridges <[email protected]>
fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

Wentao Liang <[email protected]>
power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()

Ashutosh Desai <[email protected]>
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path

Hyunwoo Kim <[email protected]>
KVM: x86: hyper-v: Bound the bank index when querying sparse banks

Jonas Jelonek <[email protected]>
MIPS: smp: report dying CPU to RCU in stop_this_cpu()

Yizhou Zhao <[email protected]>
9p: avoid putting oldfid in p9_client_walk() error path

Zhang Cen <[email protected]>
ocfs2: reject oversized group bitmap descriptors

Yuho Choi <[email protected]>
rpmsg: char: Fix use-after-free on probe error path

Wentao Liang <[email protected]>
fpga: region: fix use-after-free in child_regions_with_firmware()

Qingshuang Fu <[email protected]>
irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove

Wentao Liang <[email protected]>
pNFS: Fix use-after-free in pnfs_update_layout()

Huacai Chen <[email protected]>
LoongArch: Report dying CPU to RCU in stop_this_cpu()

Doruk Tan Ozturk <[email protected]>
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done

Michal Koutný <[email protected]>
blk-cgroup: fix UAF in __blkcg_rstat_flush()

Fan Wu <[email protected]>
hdlc_ppp: sync per-proto timers before freeing hdlc state

Tristan Madani <[email protected]>
gfs2: fix use-after-free in gfs2_qd_dealloc

Michael Bommarito <[email protected]>
exfat: fix potential use-after-free in exfat_find_dir_entry()

Maciej W. Rozycki <[email protected]>
MIPS: DEC: Prevent initial console buffer from landing in XKPHYS

Dawei Feng <[email protected]>
bpf: use kvfree() for replaced sysctl write buffer

Wenjie Qi <[email protected]>
f2fs: keep atomic write retry from zeroing original data

Yongpeng Yang <[email protected]>
f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()

Zhang Cen <[email protected]>
f2fs: validate ACL entry sizes in f2fs_acl_from_disk()

Sunmin Jeong <[email protected]>
f2fs: fix to round down start offset of fallocate for pin file

Wenjie Qi <[email protected]>
f2fs: validate compress cache inode only when enabled

Junjie Cao <[email protected]>
wifi: iwlwifi: mvm: fix race condition in PTP removal

Luka Gejak <[email protected]>
wifi: rtw88: usb: fix memory leaks on USB write failures

Luka Gejak <[email protected]>
wifi: rtw88: increase TX report timeout to fix race condition

Bitterblue Smith <[email protected]>
wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor

Jose Ignacio Tornos Martinez <[email protected]>
wifi: ath11k: fix warning when unbinding

Zenm Chen <[email protected]>
wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S

Shaomin Chen <[email protected]>
keys: Pin request_key_auth payload in instantiate paths

Jarkko Sakkinen <[email protected]>
KEYS: fix overflow in keyctl_pkey_params_get_2()

Arnd Bergmann <[email protected]>
err.h: use __always_inline on all error pointer helpers

Ian Bridges <[email protected]>
fbdev: fix use-after-free in store_modes()

Koichiro Den <[email protected]>
NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR

Ruslan Valiyev <[email protected]>
apparmor: fix use-after-free in rawdata dedup loop

Bryam Vargas <[email protected]>
apparmor: mediate the implicit connect of TCP fast open sendmsg

Yiming Qian <[email protected]>
net: skmsg: preserve sg.copy across SG transforms

Doruk Tan Ozturk <[email protected]>
mac802154: llsec: add skb_cow_data() before in-place crypto

Kuniyuki Iwashima <[email protected]>
af_unix: Set gc_in_progress to true in unix_gc().

Chaitanya Kulkarni <[email protected]>
nvmet-tcp: fix race between ICReq handling and queue teardown

Konstantin Komarov <[email protected]>
ntfs3: reject direct userspace writes to reserved $LX* xattrs

Wongi Lee <[email protected]>
ipv4: account for fraggap on the paged allocation path

Eric Dumazet <[email protected]>
inet: add indirect call wrapper for getfrag() calls

Wongi Lee <[email protected]>
ipv6: account for fraggap on the paged allocation path

Sven Eckelmann <[email protected]>
batman-adv: tvlv: avoid race of cifsnotfound handler state

Sven Eckelmann <[email protected]>
batman-adv: tvlv: enforce 2-byte alignment

Sven Eckelmann <[email protected]>
batman-adv: dat: prevent false sharing between VLANs

Sven Eckelmann <[email protected]>
batman-adv: tt: track roam count per VID

Sven Eckelmann <[email protected]>
batman-adv: tt: don't merge change entries with different VIDs

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: handle overlapping packets

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: prevent parallel modifications of last_recv

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: restrict number of unacked list entries

Sven Eckelmann <[email protected]>
batman-adv: v: prevent OGM aggregation on disabled hardif

Sven Eckelmann <[email protected]>
batman-adv: frag: avoid underflow of TTL

Sven Eckelmann <[email protected]>
batman-adv: frag: ensure fragment is writable before modifying TTL

Sven Eckelmann <[email protected]>
batman-adv: fix (m|b)cast csum after decrementing TTL

Sven Eckelmann <[email protected]>
batman-adv: ensure bcast is writable before modifying TTL

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: initialize last_recv_time during init

Sven Eckelmann <[email protected]>
batman-adv: prevent ELP transmission interval underflow

Sven Eckelmann <[email protected]>
batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: add only finished tp_vars to lists

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: fix fast recovery precondition

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: avoid window underflow

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: initialize dec_cwnd explicitly

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: initialize dup_acks explicitly

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: keep unacked list in ascending ordered

Paul Moore <[email protected]>
selinux: fix overlayfs mmap() and mprotect() access checks

Paul Moore <[email protected]>
lsm: add backing_file LSM hooks

Amir Goldstein <[email protected]>
fs: prepare for adding LSM blob to backing_file

Pauli Virtanen <[email protected]>
Bluetooth: btmtk: accept too short WMT FUNC_CTRL events

Tristan Madani <[email protected]>
Bluetooth: btmtk: validate WMT event SKB length before struct access

Petr Machata <[email protected]>
Revert "ptp: add testptp mask test"

Sean Christopherson <[email protected]>
KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level

Paolo Bonzini <[email protected]>
KVM: x86: Fix shadow paging use-after-free due to unexpected role

Christian Brauner <[email protected]>
eventpoll: fix ep_remove struct eventpoll / struct file UAF

Christian Brauner <[email protected]>
eventpoll: move epi_fget() up

Christian Brauner <[email protected]>
eventpoll: rename ep_remove_safe() back to ep_remove()

Christian Brauner <[email protected]>
eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()

Christian Brauner <[email protected]>
eventpoll: kill __ep_remove()

Christian Brauner <[email protected]>
eventpoll: split __ep_remove()

Christian Brauner <[email protected]>
eventpoll: use hlist_is_singular_node() in __ep_remove()

Christian Brauner <[email protected]>
file: add fput() cleanup helper

Miklos Szeredi <[email protected]>
virtiofs: fix UAF on submount umount

Ruslan Valiyev <[email protected]>
media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si

Gil Portnoy <[email protected]>
ksmbd: reject non-VALID session in compound request branch

Yi Yang <[email protected]>
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

Vasily Gorbik <[email protected]>
scripts/sorttable: Fix endianness handling in build-time mcount sort

Steven Rostedt <[email protected]>
scripts/sorttable: Allow matches to functions before function entry

Steven Rostedt <[email protected]>
scripts/sorttable: Use normal sort if theres no relocs in the mcount section

Steven Rostedt <[email protected]>
ftrace: Check against is_kernel_text() instead of kaslr_offset()

Steven Rostedt <[email protected]>
ftrace: Test mcount_loc addr before calling ftrace_call_addr()

Guenter Roeck <[email protected]>
ftrace: Do not over-allocate ftrace memory

Steven Rostedt <[email protected]>
ftrace: Have ftrace pages output reflect freed pages

Steven Rostedt <[email protected]>
ftrace: Update the mcount_loc check of skipped entries

Steven Rostedt <[email protected]>
scripts/sorttable: Zero out weak functions in mcount_loc table

Steven Rostedt <[email protected]>
scripts/sorttable: Always use an array for the mcount_loc sorting

Steven Rostedt <[email protected]>
scripts/sorttable: Have mcount rela sort use direct values

Steven Rostedt <[email protected]>
arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64

Steven Rostedt <[email protected]>
scripts/sorttable: Use a structure of function pointers for elf helpers

Steven Rostedt <[email protected]>
scripts/sorttable: Get start/stop_mcount_loc from ELF file directly

Steven Rostedt <[email protected]>
scripts/sorttable: Move code from sorttable.h into sorttable.c

Steven Rostedt <[email protected]>
scripts/sorttable: Use uint64_t for mcount sorting

Steven Rostedt <[email protected]>
scripts/sorttable: Add helper functions for Elf_Sym

Steven Rostedt <[email protected]>
scripts/sorttable: Add helper functions for Elf_Shdr

Steven Rostedt <[email protected]>
scripts/sorttable: Add helper functions for Elf_Ehdr

Steven Rostedt <[email protected]>
scripts/sorttable: Convert Elf_Sym MACRO over to a union

Steven Rostedt <[email protected]>
scripts/sorttable: Replace Elf_Shdr Macro with a union

Steven Rostedt <[email protected]>
scripts/sorttable: Convert Elf_Ehdr to union

Steven Rostedt <[email protected]>
scripts/sorttable: Make compare_extable() into two functions

Steven Rostedt <[email protected]>
scripts/sorttable: Have the ORC code use the _r() functions to read

Steven Rostedt <[email protected]>
scripts/sorttable: Remove unneeded Elf_Rel

Steven Rostedt <[email protected]>
scripts/sorttable: Remove unused write functions

Steven Rostedt <[email protected]>
scripts/sorttable: Remove unused macro defines

Joanne Koong <[email protected]>
fuse: re-lock request before replacing page cache folio

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Fix up platform_driver registration

David Howells <[email protected]>
rxrpc: Fix the ACK parser to extract the SACK table for parsing

Santosh Kalluri <[email protected]>
net: phonet: free phonet_device after RCU grace period

Kuniyuki Iwashima <[email protected]>
phonet: Pass net and ifindex to phonet_address_notify().

Kuniyuki Iwashima <[email protected]>
phonet: Pass ifindex to fill_addr().

Davidlohr Bueso <[email protected]>
locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

Dexuan Cui <[email protected]>
Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs

Ji'an Zhou <[email protected]>
futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock

Thorsten Blum <[email protected]>
hv: utils: handle and propagate errors in kvp_register

Tao Cui <[email protected]>
mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation

Florian Westphal <[email protected]>
netfilter: nf_tables: always walk all pending catchall elements

Thadeu Lima de Souza Cascardo <[email protected]>
dlm: prevent NPD when writing a positive value to event_done

André Draszik <[email protected]>
regulator: core: fix locking in regulator_resolve_supply() error path

Bjoern Doebel <[email protected]>
ring-buffer: Remove ring_buffer_read_prepare_sync()

Eduard Zingerman <[email protected]>

    selftests/bpf: Update comments find_equal_scalars->sync_linked_regs

Eduard Zingerman <[email protected]>
selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking

Eduard Zingerman <[email protected]>
bpf: Remove mark_precise_scalar_ids()

Eduard Zingerman <[email protected]>
bpf: Track equal scalars history on per-instruction level

Jiexun Wang <[email protected]>
af_unix: Reject SIOCATMARK on non-stream sockets

Varun R Mallya <[email protected]>
selftests/bpf: Add test to ensure kprobe_multi is not sleepable

Varun R Mallya <[email protected]>
bpf: Reject sleepable kprobe_multi programs at attach time

Mingyu Wang <[email protected]>
agp/amd64: Fix broken error propagation in agp_amd64_probe()

Weiming Shi <[email protected]>
net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()

Weiming Shi <[email protected]>
i2c: stub: Reject I2C block transfers with invalid length

Lord Ulf Henrik Holmberg <[email protected]>
RDMA/bnxt_re: zero shared page before exposing to userspace

Dongli Zhang <[email protected]>
KVM: VMX: Update SVI during runtime APICv activation

Russell King (Oracle) <[email protected]>
ARM: fix branch predictor hardening

Russell King (Oracle) <[email protected]>
ARM: fix hash_name() fault

Russell King (Oracle) <[email protected]>
ARM: allow __do_kernel_fault() to report execution of memory faults

Russell King (Oracle) <[email protected]>
ARM: group is_permission_fault() with is_translation_fault()

Waiman Long <[email protected]>
debugobjects: Dont call fill_pool() in early boot hardirq context

Helen Koike <[email protected]>
debugobjects: Do not fill_pool() if pi_blocked_on

Sebastian Andrzej Siewior <[email protected]>
debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP

Sebastian Andrzej Siewior <[email protected]>
debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING

Sven Eckelmann <[email protected]>
batman-adv: tt: prevent TVLV entry number overflow

Maíra Canal <[email protected]>
drm/v3d: Skip CSD when it has zeroed workgroups

Maíra Canal <[email protected]>
drm/v3d: Store the active job inside the queue's state

Eric Dumazet <[email protected]>
ip6_vti: set netns_immutable on the fallback device.

Harry Wentland <[email protected]>
drm/amd/display: Bound VBIOS record-chain walk loops

Rajat Gupta <[email protected]>
net/sched: fix pedit partial COW leading to page cache corruption

Jann Horn <[email protected]>
fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios

-------------

Diffstat:

 Documentation/userspace-api/ioctl/ioctl-number.rst |  463 ++++----
 Makefile                                           |    4 +-
 arch/arm/mm/alignment.c                            |    4 +
 arch/arm/mm/fault.c                                |   94 +-
 arch/arm64/Kconfig                                 |    1 +
 arch/loongarch/kernel/smp.c                        |    1 +
 arch/mips/dec/prom/console.c                       |    7 +-
 arch/mips/kernel/smp.c                             |    2 +
 arch/x86/kvm/hyperv.c                              |    5 +
 arch/x86/kvm/mmu/mmu.c                             |   28 +-
 arch/x86/kvm/svm/sev.c                             |    1 +
 arch/x86/kvm/vmx/vmx.c                             |    4 -
 arch/x86/kvm/x86.c                                 |    7 +
 block/blk-cgroup.c                                 |   21 +-
 drivers/base/memory.c                              |    3 +-
 drivers/bluetooth/btmtk.c                          |   15 +-
 drivers/char/agp/amd64-agp.c                       |    2 +-
 .../crypto/intel/qat/qat_common/adf_cfg_common.h   |   32 -
 drivers/crypto/intel/qat/qat_common/adf_cfg_user.h |   38 -
 .../crypto/intel/qat/qat_common/adf_common_drv.h   |    3 -
 drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c  |  413 +-------
 drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c  |   70 --
 drivers/fpga/of-fpga-region.c                      |    3 +-
 drivers/gpu/drm/amd/display/dc/bios/bios_parser.c  |   15 +-
 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c |   27 +-
 .../drm/amd/display/dc/bios/bios_parser_helper.h   |    5 +
 drivers/gpu/drm/v3d/v3d_drv.h                      |    8 +-
 drivers/gpu/drm/v3d/v3d_gem.c                      |    5 +-
 drivers/gpu/drm/v3d/v3d_irq.c                      |   24 +-
 drivers/gpu/drm/v3d/v3d_sched.c                    |   36 +-
 drivers/hv/hv_kvp.c                                |   25 +-
 drivers/hv/vmbus_drv.c                             |   29 +-
 drivers/i2c/i2c-stub.c                             |    5 +
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |    2 +-
 drivers/irqchip/irq-imgpdc.c                       |    6 +
 drivers/media/test-drivers/vidtv/vidtv_mux.c       |    8 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c |    8 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h |    1 +
 drivers/net/wan/hdlc_ppp.c                         |   15 +-
 drivers/net/wireless/ath/ath11k/dp.c               |    1 +
 drivers/net/wireless/intel/iwlwifi/mvm/ptp.c       |    2 +-
 drivers/net/wireless/mediatek/mt76/mt76x2/usb.c    |    1 +
 .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h   |    2 +-
 drivers/net/wireless/realtek/rtw88/tx.c            |    7 +-
 drivers/net/wireless/realtek/rtw88/usb.c           |   13 +-
 drivers/ntb/hw/epf/ntb_hw_epf.c                    |    3 +-
 drivers/nvme/target/tcp.c                          |   29 +-
 drivers/power/reset/linkstation-poweroff.c         |    2 +-
 drivers/regulator/core.c                           |   10 +-
 drivers/rpmsg/rpmsg_char.c                         |   15 +-
 drivers/slimbus/qcom-ngd-ctrl.c                    |   39 +-
 drivers/tty/serial/8250/8250_dw.c                  |    4 +-
 drivers/tty/serial/qcom_geni_serial.c              |    9 +-
 drivers/tty/vt/vc_screen.c                         |    2 +-
 drivers/video/fbdev/core/fbmem.c                   |   12 +
 drivers/video/fbdev/core/fbsysfs.c                 |   10 +-
 drivers/video/fbdev/core/modedb.c                  |    5 +-
 fs/dlm/lockspace.c                                 |    2 +-
 fs/eventpoll.c                                     |  142 +--
 fs/exfat/dir.c                                     |    4 +-
 fs/f2fs/acl.c                                      |   18 +-
 fs/f2fs/data.c                                     |   16 +-
 fs/f2fs/extent_cache.c                             |   19 +-
 fs/f2fs/file.c                                     |    9 +-
 fs/f2fs/inode.c                                    |    9 +-
 fs/file_table.c                                    |   46 +-
 fs/fuse/dev.c                                      |   23 +-
 fs/fuse/file.c                                     |    8 +-
 fs/gfs2/super.c                                    |    1 +
 fs/internal.h                                      |    3 +-
 fs/nfs/client.c                                    |    1 +
 fs/nfs/pnfs.c                                      |    2 +-
 fs/nfs/pnfs_nfs.c                                  |    4 +-
 fs/nfsd/nfs2acl.c                                  |   17 +-
 fs/nfsd/nfs3acl.c                                  |   17 +-
 fs/nfsd/nfs4recover.c                              |    3 +-
 fs/nfsd/nfs4xdr.c                                  |    3 +-
 fs/ntfs3/xattr.c                                   |   12 +
 fs/ocfs2/suballoc.c                                |   22 +
 fs/open.c                                          |    7 +-
 fs/overlayfs/file.c                                |    8 +-
 fs/smb/server/smb2pdu.c                            |    5 +
 fs/smb/server/smbacl.c                             |    4 +-
 include/keys/request_key_auth-type.h               |    2 +
 include/linux/bpf_verifier.h                       |    4 +
 include/linux/err.h                                |   12 +-
 include/linux/file.h                               |    2 +
 include/linux/fs.h                                 |   15 +-
 include/linux/kvm_host.h                           |    7 +-
 include/linux/lsm_audit.h                          |    2 +-
 include/linux/lsm_hook_defs.h                      |    5 +
 include/linux/lsm_hooks.h                          |    1 +
 include/linux/ring_buffer.h                        |    4 +-
 include/linux/security.h                           |   22 +
 include/linux/skmsg.h                              |   15 +-
 include/net/phonet/pn_dev.h                        |    2 +-
 include/net/tc_act/tc_pedit.h                      |    1 -
 kernel/bpf/cgroup.c                                |    2 +-
 kernel/bpf/verifier.c                              |  366 ++++---
 kernel/futex/requeue.c                             |    6 +
 kernel/locking/rtmutex.c                           |    3 +
 kernel/locking/rtmutex_api.c                       |    2 +-
 kernel/trace/bpf_trace.c                           |    4 +
 kernel/trace/ftrace.c                              |   68 +-
 kernel/trace/ring_buffer.c                         |   67 +-
 kernel/trace/trace.c                               |   14 +-
 kernel/trace/trace_kdb.c                           |    8 +-
 lib/debugobjects.c                                 |   56 +-
 net/9p/client.c                                    |    3 +-
 net/batman-adv/bat_iv_ogm.c                        |   11 +-
 net/batman-adv/bat_v.c                             |    1 +
 net/batman-adv/bat_v_ogm.c                         |   23 +-
 net/batman-adv/bridge_loop_avoidance.c             |   28 +-
 net/batman-adv/distributed-arp-table.c             |   12 +-
 net/batman-adv/fragmentation.c                     |   22 +-
 net/batman-adv/fragmentation.h                     |    3 +-
 net/batman-adv/netlink.c                           |   10 +-
 net/batman-adv/routing.c                           |   64 +-
 net/batman-adv/tp_meter.c                          |  115 +-
 net/batman-adv/translation-table.c                 |   32 +-
 net/batman-adv/tvlv.c                              |   69 +-
 net/batman-adv/types.h                             |   21 +-
 net/core/filter.c                                  |   27 +
 net/core/skmsg.c                                   |    2 +
 net/ipv4/ip_output.c                               |   20 +-
 net/ipv6/ip6_output.c                              |   22 +-
 net/ipv6/ip6_vti.c                                 |    1 +
 net/mac802154/llsec.c                              |   14 +
 net/mptcp/pm_userspace.c                           |   13 +-
 net/netfilter/nf_tables_api.c                      |    2 -
 net/phonet/pn_dev.c                                |   12 +-
 net/phonet/pn_netlink.c                            |   23 +-
 net/rxrpc/input.c                                  |   13 +-
 net/sched/act_pedit.c                              |   77 +-
 net/tipc/crypto.c                                  |    9 +
 net/tls/tls_sw.c                                   |    4 +
 net/unix/af_unix.c                                 |    3 +
 net/unix/garbage.c                                 |    2 +
 scripts/link-vmlinux.sh                            |    4 +-
 scripts/sorttable.c                                | 1119 +++++++++++++++++++-
 scripts/sorttable.h                                |  500 ---------
 security/apparmor/include/policy_unpack.h          |   19 +
 security/apparmor/lsm.c                            |   16 +-
 security/apparmor/policy.c                         |    8 +-
 security/keys/internal.h                           |    2 +
 security/keys/keyctl.c                             |   24 +-
 security/keys/keyctl_pkey.c                        |    9 +-
 security/keys/request_key_auth.c                   |   33 +-
 security/security.c                                |  110 ++
 security/selinux/hooks.c                           |  256 +++--
 security/selinux/include/objsec.h                  |   11 +
 .../selftests/bpf/prog_tests/kprobe_multi_test.c   |   34 +
 .../selftests/bpf/progs/kprobe_multi_sleepable.c   |   25 +
 .../selftests/bpf/progs/verifier_scalar_ids.c      |  333 ++++--
 .../selftests/bpf/progs/verifier_spill_fill.c      |    4 +-
 .../bpf/progs/verifier_subprog_precision.c         |    2 +-
 tools/testing/selftests/bpf/verifier/precise.c     |    4 +-
 tools/testing/selftests/ptp/testptp.c              |   19 +-
 158 files changed, 3649 insertions(+), 2242 deletions(-)