6.6.151-rc1 review

Greg Kroah-Hartman dri-devel linux-fsdevel linux-patches linux-tegra lkml stable 1 version Aug 7 In review

Get series with b4

b4 am [email protected]

Versions newest first

v1 Latest Aug 7260 of 261 patches 12 repliesIn review

260 of 261 patches are in this archive. The cover letter announces 261.

Patches in v1 No applies recorded yet

#	Subject and files	Size	Replies
1/261	netfilter: nf_conntrack_expect: restore helper propagation via expectation`include/net/netfilter/nf_conntrack_expect.h` `net/netfilter/nf_conntrack_broadcast.c` `net/netfilter/nf_conntrack_core.c` +5 more	+39 ~~-12~~	0 replies
2/261	netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()`include/net/neighbour.h` `net/bridge/br_netfilter_hooks.c`	+11 -3	0 replies
3/261	net: mpls: initialize rtm_tos in mpls_getroute()`net/mpls/af_mpls.c`	+1 -0	0 replies
4/261	gve: fix Rx queue stall on alloc failure`drivers/net/ethernet/google/gve/gve.h` `drivers/net/ethernet/google/gve/gve_main.c` `drivers/net/ethernet/google/gve/gve_rx_dqo.c`	+39 -0	0 replies
5/261	HID: logitech-dj: Standardise hid_report_enum variable nomenclature`drivers/hid/hid-logitech-dj.c`	+6 -6	0 replies
6/261	HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write`drivers/hid/hid-logitech-dj.c`	+10 -0	0 replies
7/261	HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report`drivers/hid/hid-logitech-dj.c`	+2 -1	0 replies
8/261	soc: qcom: ice: Allow explicit votes on iface clock for ICE`drivers/soc/qcom/ice.c`	+15 -2	0 replies
9/261	thunderbolt: Prevent XDomain delayed work use-after-free on disconnect`drivers/thunderbolt/xdomain.c` `include/linux/thunderbolt.h`	+33 ~~-10~~	0 replies
10/261	pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151`drivers/pinctrl/qcom/pinctrl-sc8280xp.c`	+11 ~~-10~~	0 replies
11/261	dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA`drivers/dma/sun6i-dma.c`	+4 -7	0 replies
12/261	dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()`drivers/dma/idxd/cdev.c`	+3 -1	0 replies
13/261	ata: sata_mv: accept 1 or 2 resources in platform probe`drivers/ata/sata_mv.c`	+1 -1	0 replies
14/261	ata: libahci_platform: support non-consecutive port numbers`drivers/ata/ahci_brcm.c` `drivers/ata/ahci_ceva.c` `drivers/ata/libahci_platform.c`	+43 -6	0 replies
15/261	ahci: Introduce ahci_ignore_port() helper`drivers/ata/ahci.h` `drivers/ata/ahci_brcm.c` `drivers/ata/ahci_ceva.c` +1 more	+18 -7	0 replies
16/261	ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()`drivers/ata/ahci_ceva.c`	+14 -4	0 replies
17/261	ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup`sound/soc/codecs/max98095.c`	+3 -2	0 replies
18/261	ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup`sound/soc/codecs/max98090.c`	+3 -2	0 replies
19/261	btrfs: zoned: fix deadlock between metadata writeback and transaction commit`fs/btrfs/zoned.c`	+5 -1	0 replies
20/261	phy-zynqmp: Postpone getting clock rate until actually needed`drivers/phy/xilinx/phy-zynqmp.c`	+37 ~~-33~~	0 replies
21/261	phy: zynqmp: fix clock error handling in xpsgtr_phy_init()`drivers/phy/xilinx/phy-zynqmp.c`	+9 -4	0 replies
22/261	phy: zynqmp: fix runtime PM leak on probe allocation failure`drivers/phy/xilinx/phy-zynqmp.c`	+6 -6	0 replies
23/261	netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()`include/linux/netfilter/nf_conntrack_sip.h` `net/netfilter/nf_conntrack_sip.c` `net/netfilter/nf_nat_sip.c`	+3 -3	0 replies
24/261	drm/mediatek: Check CRTC state before freeing`drivers/gpu/drm/mediatek/mtk_drm_crtc.c`	+3 -3	0 replies
25/261	keys: fix out-of-bounds read in keyring_get_key_chunk()`security/keys/keyring.c`	+5 -4	0 replies
26/261	keys: make keyring key-chunk byte order agree with keyring_diff_objects()`security/keys/keyring.c`	+3 -2	0 replies
27/261	assoc_array: trim the final shortcut word using the current chunk end`lib/assoc_array.c`	+2 -1	0 replies
28/261	netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH`net/netfilter/xt_hashlimit.c`	+15 -1	0 replies
29/261	sched: Add task_struct->faults_disabled_mapping`include/linux/sched.h` `init/init_task.c`	+2 -0	0 replies
30/261	ipvs: fix the checksum validations`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_core.c` `net/netfilter/ipvs/ip_vs_proto_sctp.c` +2 more	+74 ~~-86~~	0 replies
31/261	ipvs: fix places with wrong packet offsets`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_app.c` `net/netfilter/ipvs/ip_vs_core.c` +4 more	+97 ~~-93~~	0 replies
32/261	ipvs: do not mangle ICMP replies for non-first fragments`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_core.c` `net/netfilter/ipvs/ip_vs_xmit.c`	+48 ~~-52~~	0 replies
33/261	netfilter: nft_payload: fix mask build for partial field offload`net/netfilter/nft_payload.c`	+1 ~~-11~~	0 replies
34/261	rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled`net/rds/ib.c` `net/rds/ib_cm.c` `net/rds/tcp.c`	+13 -3	0 replies
35/261	rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()`net/rds/tcp.c`	+5 -3	0 replies
36/261	pinctrl-amd: Dont clear S4 wake bits at probe`drivers/pinctrl/pinctrl-amd.c`	+1 -2	0 replies
37/261	scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer`drivers/scsi/libiscsi.c`	+1 -1	0 replies
38/261	scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer`drivers/scsi/libiscsi_tcp.c`	+1 -7	0 replies
39/261	scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race`drivers/scsi/hisi_sas/hisi_sas_v3_hw.c` `drivers/scsi/libsas/sas_init.c` `include/scsi/libsas.h`	+19 ~~-29~~	0 replies
40/261	smb: client: fix buffer leaks in SMB1 read and write`fs/smb/client/cifssmb.c`	+9 -3	0 replies
41/261	spi: spi-cadence: supports transmission with bits_per_word of 16 and 32`drivers/spi/spi-cadence.c`	+93 ~~-13~~	0 replies
42/261	spi: spi-cadence: Move TX FIFO full busy-wait into FIFO`drivers/spi/spi-cadence.c`	+16 ~~-10~~	0 replies
43/261	hwmon: (nct6775-core) Fix number of temperature registers for NCT6116`drivers/hwmon/nct6775-core.c`	+3 -5	0 replies
44/261	hwmon: (lm90) Only report alarms if driver is ready`drivers/hwmon/lm90.c`	+2 -2	0 replies
45/261	hwmon: (nzxt-smart2) DMA-align output buffer`drivers/hwmon/nzxt-smart2.c`	+1 -1	0 replies
46/261	net: do not send ICMP/NDISC Redirects when peer allocation fails`net/ipv4/route.c` `net/ipv6/ip6_output.c` `net/ipv6/ndisc.c`	+3 -3	0 replies
47/261	hwmon: (nct6775-core) Prevent access to unsupported weight registers`drivers/hwmon/nct6775-core.c`	+6 -6	0 replies
48/261	net: bridge: mrp: fix Option TLV length in MRP_Test frames`net/bridge/br_mrp.c`	+1 -1	0 replies
49/261	forcedeth: fix UAF of txrx_stats in nv_remove`drivers/net/ethernet/nvidia/forcedeth.c`	+2 -2	0 replies
50/261	hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors`drivers/hwmon/adt7470.c`	+29 ~~-11~~	0 replies
51/261	hwmon: (adt7470) Fix cache updated before hardware write on I2C error`drivers/hwmon/adt7470.c`	+9 -5	0 replies
52/261	hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread`drivers/hwmon/adt7470.c`	+1 -1	0 replies
53/261	hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()`drivers/hwmon/adt7470.c`	+17 -2	0 replies
54/261	hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks`drivers/hwmon/adt7470.c`	+2 -2	0 replies
55/261	hwmon: (adt7470) Use cached PWM frequency value`drivers/hwmon/adt7470.c`	+18 -2	0 replies
56/261	hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read`drivers/hwmon/adt7470.c`	+10 ~~-13~~	0 replies
57/261	hwmon: (adt7470) Fix PWM auto temp state array and bounds check`drivers/hwmon/adt7470.c`	+6 -1	0 replies
58/261	powerpc/boot: Fix simpleboot CPU node lookup check`arch/powerpc/boot/simpleboot.c`	+1 -1	0 replies
59/261	powerpc/boot: Fix treeboot-currituck CPU node lookup check`arch/powerpc/boot/treeboot-currituck.c`	+1 -1	0 replies
60/261	powerpc/boot: Fix treeboot-akebono CPU node lookup check`arch/powerpc/boot/treeboot-akebono.c`	+1 -1	0 replies
61/261	wifi: mac80211: validate individual TWT params before driver setup`net/mac80211/s1g.c`	+4 -0	0 replies
62/261	hwmon: (pmbus) Fix return value from pmbus_update_byte_data()`drivers/hwmon/pmbus/pmbus_core.c`	+1 -1	0 replies
63/261	Bluetooth: ISO: clear iso_data always when detaching conn from hcon`net/bluetooth/iso.c`	+1 -0	0 replies
64/261	Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp`net/bluetooth/l2cap_core.c`	+5 -0	0 replies
65/261	Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos`net/bluetooth/iso.c`	+1 -1	0 replies
66/261	Bluetooth: btintel: Validate length before parsing diagnostics TLV`drivers/bluetooth/btintel.c`	+3 -0	0 replies
67/261	Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists`net/bluetooth/hci_conn.c` `net/bluetooth/hci_sync.c`	+4 -2	0 replies
68/261	Bluetooth: hci_conn: hold conn reference in abort_conn_sync()`net/bluetooth/hci_conn.c`	+11 -1	0 replies
69/261	Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync`net/bluetooth/hci_sync.c`	+3 -1	0 replies
70/261	Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync`net/bluetooth/hci_sync.c`	+0 ~~-13~~	0 replies
71/261	net: phylink: put link_gpio if phylink_create fails`drivers/net/phy/phylink.c`	+15 ~~-14~~	0 replies
72/261	scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE`drivers/target/target_core_iblock.c`	+3 -3	0 replies
73/261	scsi: ufs: core: Cancel RTC work in active-active suspend`drivers/ufs/core/ufshcd.c`	+4 -2	0 replies
74/261	scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req`drivers/s390/scsi/zfcp_aux.c`	+1 -0	0 replies
75/261	scsi: target: Clear cmd_cnt when initial counter enrollment fails`drivers/target/target_core_transport.c`	+10 -2	0 replies
76/261	net: sxgbe: free TX rings on RX allocation failure`drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c`	+4 -5	0 replies
77/261	net: sxgbe: check descriptor ring allocation failures`drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c`	+4 -1	0 replies
78/261	can: isotp: check register_netdevice_notifier() error in module init`net/can/isotp.c`	+9 -4	0 replies
79/261	tracing/mmiotrace: Reset dropped_count in mmio_reset_data()`kernel/trace/trace_mmiotrace.c`	+1 -0	0 replies
80/261	accel/qaic: use sizeof(*trans_hdr) for transaction length check`drivers/accel/qaic/qaic_control.c`	+1 -1	0 replies
81/261	net: dsa: mt7530: error out on failed reads in MT7531 PHY polling`drivers/net/dsa/mt7530.c`	+20 ~~-38~~	0 replies
82/261	octeontx2-pf: Set correct sequence for carrier off and tx queue stop`drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c`	+1 -1	0 replies
83/261	qede: sync udp_tunnel ports outside qede_lock in the recovery path`drivers/net/ethernet/qlogic/qede/qede_main.c`	+22 ~~-22~~	0 replies
84/261	ksmbd: return success for deferred final close`fs/smb/server/vfs_cache.c`	+3 -1	0 replies
85/261	ksmbd: fix use-after-free in __close_file_table_ids()`fs/smb/server/vfs_cache.c`	+2 -0	0 replies
86/261	ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump`net/ipv6/ip6_fib.c`	+8 -9	0 replies
87/261	rhashtable: clear stale iter->p on table restart`lib/rhashtable.c`	+1 -0	0 replies
88/261	pinctrl: microchip-sgpio: add missing select REGMAP_MMIO`drivers/pinctrl/Kconfig`	+1 -0	0 replies
89/261	pinctrl: devicetree: dont free uninitialized dev_name on error path`drivers/pinctrl/devicetree.c`	+4 -0	0 replies
90/261	erofs: cap LZMA stream pool size`fs/erofs/Kconfig` `fs/erofs/decompressor_lzma.c`	+16 -1	0 replies
91/261	pinctrl: bm1880: add missing select GENERIC_PINCONF`drivers/pinctrl/Kconfig`	+1 -0	0 replies
92/261	mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()`mm/percpu-km.c`	+1 -1	0 replies
93/261	mm/hugetlb: fix list corruption in allocate_file_region_entries()`mm/hugetlb.c`	+1 -1	0 replies
94/261	mm/vmstat: fold stranded per-cpu node stats when a node comes online`mm/mm_init.c`	+11 -4	0 replies
95/261	tracing/probes: Reject $arg0 in meta argument expansion`kernel/trace/trace_probe.c`	+5 -1	3 replies
96/261	KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active`arch/x86/kvm/svm/avic.c`	+0 -8	0 replies
97/261	KVM: s390: pci: Reject adapter interrupt forwarding if already enabled`arch/s390/kvm/pci.c`	+4 -0	0 replies
98/261	KVM: s390: pci: Fix NULL dereference on AIBV allocation failure`arch/s390/kvm/pci.c`	+8 -0	0 replies
99/261	KVM: s390: pci: Validate AIBV and AISB before pinning guest pages`arch/s390/kvm/pci.c`	+15 -1	0 replies
100/261	sctp: validate Adaptation Indication parameter length`net/sctp/sm_make_chunk.c`	+6 -0	0 replies
101/261	audit: fix potential integer overflow in audit_log_n_string()`kernel/audit.c`	+9 -2	0 replies
102/261	audit: fix potential use-after-free in audit_del_rule()`kernel/auditfilter.c`	+4 -2	0 replies
103/261	Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()`drivers/bluetooth/btmtk.c`	+22 ~~-28~~	0 replies
104/261	Bluetooth: mgmt: fix pending command UAF in EIR updates`net/bluetooth/mgmt.c`	+18 -2	0 replies
105/261	Bluetooth: mgmt: fix UAF in pair command cancellation`net/bluetooth/mgmt.c`	+46 ~~-18~~	0 replies
106/261	Bluetooth: HIDP: reject frames without a transaction header`net/bluetooth/hidp/core.c`	+15 ~~-10~~	0 replies
107/261	Bluetooth: HIDP: validate numbered report payloads`net/bluetooth/hidp/core.c`	+3 -2	0 replies
108/261	bpf: lwt: Fix dst reference leak on reroute failure`net/core/lwt_bpf.c`	+3 -1	0 replies
109/261	ALSA: 6fire: Fix UAF at error handling during probe`sound/usb/6fire/chip.c`	+4 -0	0 replies
110/261	ALSA: lx6464es: fix period byte count for 16-bit streams`sound/pci/lx6464es/lx6464es.c` `sound/pci/lx6464es/lx_core.c`	+2 -8	0 replies
111/261	ALSA: pcm: wake linked drain waiters on unlink`sound/core/pcm_native.c`	+7 -0	0 replies
112/261	ALSA: ump: fix double free of out_cvts on rawmidi error`sound/core/ump.c`	+1 -0	0 replies
113/261	ASoC: tas2562: fix DVC coefficient write order`sound/soc/codecs/tas2562.c`	+15 -8	0 replies
114/261	ASoC: tas2562: fix broken entries in the volume lookup table`sound/soc/codecs/tas2562.c`	+4 -3	0 replies
115/261	ata: libata-eh: Increase STANDBY IMMEDIATE timeout`drivers/ata/libata-eh.c` `include/linux/libata.h`	+9 -1	0 replies
116/261	ALSA: usb-audio: fix use-after-free in ump_to_endpoint()`sound/usb/midi2.c`	+3 -1	0 replies
117/261	ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()`sound/usb/midi.c`	+2 -0	0 replies
118/261	ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set`sound/usb/endpoint.c`	+4 -2	0 replies
119/261	ALSA: usb-audio: Clamp frame size in implicit-feedback mode`sound/usb/endpoint.c`	+5 -3	0 replies
120/261	dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+`include/linux/dma/qcom_bam_dma.h`	+16 -5	0 replies
121/261	e1000: fix memory leak in e1000_probe()`drivers/net/ethernet/intel/e1000/e1000_main.c`	+1 -1	0 replies
122/261	igbvf: Fix leak in TX DMA error cleanup`drivers/net/ethernet/intel/igbvf/netdev.c`	+0 -2	0 replies
123/261	ipvs: do not propagate one-packet flag to synced conns`net/netfilter/ipvs/ip_vs_conn.c`	+3 -0	0 replies
124/261	net/smc: fix socket use-after-free during link group termination`net/smc/smc_core.c`	+1 -1	0 replies
125/261	netfilter: ipset: do not update comments from kernel-side hash adds`net/netfilter/ipset/ip_set_hash_gen.h`	+1 -1	0 replies
126/261	tipc: avoid use-after-free in poll trace queue dumps`net/tipc/socket.c`	+1 -1	0 replies
127/261	wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames`drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c`	+1 -1	0 replies
128/261	binfmt_misc: reject a flag character as the field delimiter`fs/binfmt_misc.c`	+4 -0	0 replies
129/261	mm/page_reporting: use system_freezable_wq to fix UAF during suspend`mm/page_reporting.c`	+4 -2	0 replies
130/261	net: bridge: stop fast-leave after deleting a port group`net/bridge/br_multicast.c`	+1 -0	0 replies
131/261	net: ipv6: clear suppressed fib6 rule result`net/ipv6/fib6_rules.c`	+1 -0	0 replies
132/261	powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()`arch/powerpc/platforms/ps3/mm.c`	+1 -0	0 replies
133/261	um: vector: fix use-after-free in vector_mmsg_rx()`arch/um/drivers/vector_kern.c`	+3 -0	0 replies
134/261	vxlan: re-fetch eth header after route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+1 -0	0 replies
135/261	vxlan: unclone skb head before modifying eth header in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+4 -0	0 replies
136/261	vxlan: use neigh_ha_snapshot() in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+4 -2	0 replies
137/261	vxlan: use pskb_network_may_pull() in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+2 -2	0 replies
138/261	ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()`drivers/block/ublk_drv.c`	+9 -0	0 replies
139/261	tracing: Check return value of __register_event() in trace_module_add_events()`kernel/trace/trace_events.c`	+2 -2	0 replies
140/261	tracing/filters: Fix false positive match in regex_match_full()`kernel/trace/trace_events_filter.c`	+3 -0	0 replies
141/261	spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure`drivers/spi/spi-qcom-qspi.c`	+2 -1	0 replies
142/261	selftests/mm: fix potential wild pointer access of getline due to missing init`tools/testing/selftests/mm/mlock-random-test.c`	+1 -1	0 replies
143/261	selftests/clone3: fix wild pointer access of getline due to missing init`tools/testing/selftests/clone3/clone3_set_tid.c`	+1 -1	0 replies
144/261	scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write`drivers/scsi/scsi_debug.c`	+6 -2	0 replies
145/261	sctp: reject stale cookies with mismatched verification tags`net/sctp/sm_make_chunk.c`	+7 -4	0 replies
146/261	sctp: prevent peer transport count overflow`net/sctp/associola.c`	+3 -0	0 replies
147/261	hwmon: (npcm750-pwm-fan): stop fan timer on device detach`drivers/hwmon/npcm750-pwm-fan.c`	+11 -0	0 replies
148/261	hwmon: (pmbus/core) notify on the hwmon device, not the i2c client`drivers/hwmon/pmbus/pmbus_core.c`	+3 -2	0 replies
149/261	i2c: amd-mp2: Unregister callback on adapter add failure`drivers/i2c/busses/i2c-amd-mp2-plat.c`	+3 -1	0 replies
150/261	gpio: pca953x: fix cache_only and IRQ state on restore_context() failure`drivers/gpio/gpio-pca953x.c`	+13 -2	0 replies
151/261	cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()`drivers/cpufreq/powernow-k8.c`	+1 -0	0 replies
152/261	power: supply: bq25890: fix the -10 C NTC lookup entry`drivers/power/supply/bq25890_charger.c`	+1 -1	0 replies
153/261	s390/qeth: Check CAP_NET_ADMIN for private ioctls`drivers/s390/net/qeth_core_main.c`	+3 -0	0 replies
154/261	s390/dasd: Fix potential NULL pointer dereference`drivers/s390/block/dasd_ioctl.c`	+1 -1	0 replies
155/261	s390/dasd: Fix undersized format-check buffer`drivers/s390/block/dasd_eckd.c`	+7 -4	0 replies
156/261	s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs`drivers/s390/crypto/zcrypt_api.c`	+1 -1	0 replies
157/261	s390/zcrypt: Validate length for CCA AES cipher key requests`drivers/s390/crypto/zcrypt_ccamisc.c`	+3 -0	0 replies
158/261	s390/zcrypt: Validate length for CCA ECC private key requests`drivers/s390/crypto/zcrypt_ccamisc.c`	+3 -0	0 replies
159/261	phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask`drivers/phy/xilinx/phy-zynqmp.c`	+1 -1	0 replies
160/261	phy: zynqmp: use read-modify-write for SERDES scrambler bypass`drivers/phy/xilinx/phy-zynqmp.c`	+6 -2	0 replies
161/261	phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB`drivers/phy/xilinx/phy-zynqmp.c`	+29 ~~-10~~	0 replies
162/261	net: openvswitch: fix potential UAF on meter attach failure`net/openvswitch/meter.c`	+19 ~~-14~~	0 replies
163/261	net: openvswitch: fix skb leak on flow key update failure during recirculation`net/openvswitch/actions.c`	+9 -1	0 replies
164/261	net: openvswitch: fix skb leak on flow key update failure during ct`net/openvswitch/actions.c`	+1 -1	0 replies
165/261	ice: wait for reset completion in ice_resume()`drivers/net/ethernet/intel/ice/ice_main.c`	+10 -0	0 replies
166/261	ice: fix memory leak in ice_lbtest_prepare_rings()`drivers/net/ethernet/intel/ice/ice_ethtool.c`	+5 -5	0 replies
167/261	i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock`drivers/i2c/busses/i2c-jz4780.c`	+4 -1	0 replies
168/261	i2c: imx: Fix slave registration race and error handling`drivers/i2c/busses/i2c-imx.c`	+5 -3	0 replies
169/261	i2c: imx: Cancel hrtimer before clearing slave pointer`drivers/i2c/busses/i2c-imx.c`	+1 -0	0 replies
170/261	can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured`drivers/net/can/c_can/c_can_main.c`	+4 -4	0 replies
171/261	can: ems_usb: validate CPC message lengths`drivers/net/can/usb/ems_usb.c`	+43 -0	0 replies
172/261	can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure`drivers/net/can/usb/etas_es58x/es58x_core.c`	+0 -1	0 replies
173/261	can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure`drivers/net/can/usb/gs_usb.c`	+2 -2	0 replies
174/261	can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer`net/can/j1939/transport.c`	+1 -1	0 replies
175/261	can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking`net/can/j1939/bus.c` `net/can/j1939/j1939-priv.h` `net/can/j1939/main.c` +1 more	+11 -4	0 replies
176/261	can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()`drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c`	+1 -0	0 replies
177/261	can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents`drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c`	+11 -2	0 replies
178/261	can: softing: fw_parse(): validate firmware record spans`drivers/net/can/softing/softing_fw.c`	+32 ~~-14~~	0 replies
179/261	can: peak_usb: add bounds check for USB channel index`drivers/net/can/usb/peak_usb/pcan_usb_pro.c`	+16 -4	0 replies
180/261	can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error`drivers/net/can/usb/peak_usb/pcan_usb_core.c`	+0 -1	0 replies
181/261	can: peak_usb: validate uCAN receive record lengths`drivers/net/can/usb/peak_usb/pcan_usb_fd.c`	+39 -1	0 replies
182/261	can: ctucanfd: add missing MODULE_DEVICE_TABLE()`drivers/net/can/ctucanfd/ctucanfd_pci.c`	+1 -0	0 replies
183/261	can: ctucanfd: use self-test mode for PRESUME_ACK`drivers/net/can/ctucanfd/ctucanfd_base.c`	+2 -2	0 replies
184/261	can: ctucanfd: unmap BAR0 using base address`drivers/net/can/ctucanfd/ctucanfd_pci.c`	+1 -1	0 replies
185/261	can: ctucanfd: handle bus error interrupts`drivers/net/can/ctucanfd/ctucanfd_base.c`	+6 -2	0 replies
186/261	can: ctucanfd: mark error-active controller status valid`drivers/net/can/ctucanfd/ctucanfd_base.c`	+1 -1	0 replies
187/261	drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs`drivers/gpu/drm/display/drm_dp_helper.c`	+12 -0	0 replies
188/261	drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size`drivers/gpu/drm/vc4/vc4_irq.c`	+1 -1	0 replies
189/261	drm/vc4: Zero the tile state data array before each BIN job`drivers/gpu/drm/vc4/vc4_validate.c`	+23 -6	0 replies
190/261	drm/mediatek: ovl_adaptor: balance component registrations`drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c`	+6 -1	0 replies
191/261	drm/amdgpu: restore UMD profile pstate after runtime resume`drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c`	+15 -0	0 replies
192/261	drm/amdgpu: cap GTT size to physical RAM on APUs`drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c`	+12 -0	0 replies
193/261	drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE`drivers/gpu/drm/amd/amdkfd/kfd_chardev.c`	+7 -3	0 replies
194/261	drm/amdkfd: fix QID bit leak in pqm_create_queue()`drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c`	+1 -1	0 replies
195/261	drm/amdkfd: Handle invalid event type in CRIU event restore`drivers/gpu/drm/amd/amdkfd/kfd_events.c`	+3 -0	0 replies
196/261	drm/amdkfd: hold event_mutex while checkpointing CRIU events`drivers/gpu/drm/amd/amdkfd/kfd_events.c`	+18 -4	0 replies
197/261	drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size`drivers/gpu/drm/vmwgfx/vmwgfx_resource.c`	+2 -2	0 replies
198/261	drm/vmwgfx: reject DX_BIND_QUERY without a DX context`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+5 -1	0 replies
199/261	drm/vmwgfx: drop dma_buf reference on foreign-fd prime import`drivers/gpu/drm/vmwgfx/ttm_object.c`	+5 -2	0 replies
200/261	drm/vmwgfx: validate DRAW_PRIMITIVES header size before division`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+7 -1	0 replies
201/261	drm/vmwgfx: bound DMA command body size against suffix pointer`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+6 -0	0 replies
202/261	drm/vmwgfx: use check_add_overflow for shader size+offset bound`drivers/gpu/drm/vmwgfx/vmwgfx_shader.c`	+9 -4	0 replies
203/261	drm/vmwgfx: validate external BO copy bounds for both stride paths`drivers/gpu/drm/vmwgfx/vmwgfx_blit.c`	+31 -8	0 replies
204/261	spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX`drivers/spi/spi-cadence.c`	+1 -0	0 replies
205/261	HID: logitech-dj: Fix maxfield check in DJ short report validation`drivers/hid/hid-logitech-dj.c`	+7 -2	0 replies
206/261	ata: libahci_platform: Do not set mask_port_map when not needed`drivers/ata/libahci_platform.c`	+0 -2	0 replies
207/261	ata: ahci: Make ahci_ignore_port() handle empty mask_port_map`drivers/ata/ahci.h` `drivers/ata/libahci.c`	+7 -2	0 replies
208/261	iommu/sva: move x86 disable check before allocation`drivers/iommu/iommu-sva.c`	+3 -3	0 replies
209/261	mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()`mm/hugetlb.c`	+7 -3	0 replies
210/261	mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios`mm/huge_memory.c`	+14 -2	0 replies
212/261	gpio: pch: use raw_spinlock_t for the register lock`drivers/gpio/gpio-pch.c`	+14 ~~-14~~	0 replies
213/261	Revert "ia64: Make acpi_cpufreq_cpu_exit return void"`drivers/cpufreq/ia64-acpi-cpufreq.c`	+3 -1	0 replies
214/261	usb: musb: omap2430: clean up probe error handling`drivers/usb/musb/omap2430.c`	+10 ~~-13~~	0 replies
215/261	usb: musb: omap2430: Do not put borrowed of_node in probe`drivers/usb/musb/omap2430.c`	+0 -2	0 replies
216/261	drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du`drivers/gpu/drm/renesas/Kconfig` `drivers/gpu/drm/renesas/Makefile` `drivers/gpu/drm/renesas/rcar-du/Kconfig` +7 more	+980 ~~-977~~	0 replies
217/261	drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay`drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c`	+1 -1	0 replies
218/261	usb: gadget: f_tcm: synchronize delayed set_alt with teardown`drivers/usb/gadget/function/f_tcm.c` `drivers/usb/gadget/function/tcm.h`	+177 ~~-28~~	0 replies
219/261	usb: typec: ucsi: Only enable supported notifications`drivers/usb/typec/ucsi/ucsi.c`	+23 -2	0 replies
220/261	usb: typec: ucsi: split connector lock classes`drivers/usb/typec/ucsi/ucsi.c` `drivers/usb/typec/ucsi/ucsi.h`	+9 -0	0 replies
221/261	usb: typec: ucsi: Fix race condition and ordering in port unregistration`drivers/usb/typec/ucsi/ucsi.c`	+39 ~~-43~~	0 replies
222/261	drm/fb-helper: Allocate and release fb_info in single place`drivers/gpu/drm/armada/armada_fbdev.c` `drivers/gpu/drm/drm_fb_helper.c` `drivers/gpu/drm/drm_fbdev_dma.c` +9 more	+25 ~~-135~~	0 replies
223/261	drm/tegra: fbdev: Remove offset into framebuffer memory`drivers/gpu/drm/tegra/fbdev.c`	+2 -6	0 replies
224/261	drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions`drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c`	+28 -2	0 replies
225/261	drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()`drivers/gpu/drm/i915/display/intel_vrr.c`	+4 -2	0 replies
226/261	drm/i915/vrr: require valid min/max vfreq for VRR`drivers/gpu/drm/i915/display/intel_vrr.c`	+4 -0	0 replies
227/261	media: i2c: imx219: Access height from active format in imx219_set_ctrl`drivers/media/i2c/imx219.c`	+7 -2	0 replies
228/261	media: i2c: imx219: Dont store the current mode in the imx219 structure`drivers/media/i2c/imx219.c`	+7 -6	0 replies
229/261	media: i2c: imx219: Drop IMX219_VTS_* macros`drivers/media/i2c/imx219.c`	+4 ~~-14~~	0 replies
230/261	media: i2c: imx219: Group functions by purpose`drivers/media/i2c/imx219.c`	+298 ~~-282~~	0 replies
231/261	media: i2c: imx219: Calculate crop rectangle dynamically`drivers/media/i2c/imx219.c`	+15 ~~-30~~	0 replies
232/261	media: i2c: imx219: Rename VTS to FRM_LENGTH`drivers/media/i2c/imx219.c`	+15 ~~-16~~	0 replies
233/261	media: imx219: Fix maximum frame length in lines`drivers/media/i2c/imx219.c`	+1 -1	0 replies
234/261	rxrpc: Fix irq-disabled in local_bh_enable()`net/rxrpc/ar-internal.h` `net/rxrpc/call_accept.c` `net/rxrpc/peer_object.c`	+9 -5	0 replies
235/261	netfilter: nf_tables: clone set on flush only`include/net/netfilter/nf_tables.h` `net/netfilter/nf_tables_api.c` `net/netfilter/nft_set_pipapo.c`	+20 -3	0 replies
236/261	media: v4l: async: Set owner for async sub-devices`drivers/media/v4l2-core/v4l2-async.c` `include/media/v4l2-async.h`	+9 -3	0 replies
237/261	media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()`drivers/media/v4l2-core/v4l2-fwnode.c` `include/media/v4l2-async.h`	+6 -4	0 replies
238/261	wifi: ath6kl: fix use-after-free in aggr_reset_state()`drivers/net/wireless/ath/ath6kl/txrx.c`	+1 -1	0 replies
239/261	wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)`drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c` `drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c` `drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c` +2 more	+9 -9	0 replies
240/261	wifi: brcmfmac: set F2 blocksize to 256 for BCM43752`drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c`	+1 -0	0 replies
241/261	wifi: brcmfmac: drain bus_reset work on device removal`drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c` `drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h` `drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c` +4 more	+77 -4	0 replies
242/261	sysctl: treewide: constify ctl_table_header::ctl_table_arg`drivers/net/vrf.c` `include/linux/sysctl.h` `ipc/ipc_sysctl.c` +24 more	+30 ~~-30~~	0 replies
243/261	sctp: avoid auth_enable sysctl UAF during netns teardown`net/sctp/protocol.c` `net/sctp/sysctl.c`	+19 ~~-10~~	0 replies
244/261	can: use skb hash instead of private variable in headroom`drivers/net/can/dev/skb.c` `include/linux/can/core.h` `include/linux/can/skb.h` +6 more	+15 ~~-19~~	0 replies
245/261	can: isotp: fix timer drain order, wakeup handling and tx_gen ordering`net/can/isotp.c`	+230 ~~-87~~	0 replies
246/261	libceph: add doutc and *_client debug macros support`include/linux/ceph/ceph_debug.h`	+38 -0	0 replies
247/261	ceph: print cluster fsid and client global_id in all debug logs`fs/ceph/acl.c` `fs/ceph/addr.c` `fs/ceph/caps.c` +16 more	+1744 ~~-1309~~	0 replies
248/261	ceph: fix refcount leak in ceph_readdir()`fs/ceph/dir.c`	+6 -1	0 replies
249/261	mptcp: pm: avoid code duplication to lookup endp`net/mptcp/pm_netlink.c`	+6 ~~-14~~	0 replies
250/261	mptcp: add mptcp_userspace_pm_lookup_addr helper`net/mptcp/pm_userspace.c`	+36 ~~-35~~	0 replies
251/261	mptcp: pm: use addr entry for get_local_id`net/mptcp/pm.c` `net/mptcp/pm_netlink.c` `net/mptcp/pm_userspace.c` +1 more	+20 ~~-23~~	0 replies
252/261	mptcp: pm: userspace: fix use-after-free in get_local_id`net/mptcp/pm_userspace.c`	+5 -2	0 replies
253/261	sctp: close UDP tunnel sockets during netns teardown`net/sctp/protocol.c`	+1 -0	0 replies
254/261	drm/i915/fbc: Extract intel_fbc_has_fences()`drivers/gpu/drm/i915/display/intel_fbc.c`	+7 -2	0 replies
255/261	drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind`drivers/gpu/drm/i915/display/intel_hdcp.c`	+6 -4	0 replies
256/261	drm/i915/hdcp: Move to using intel_display in intel_hdcp`drivers/gpu/drm/i915/display/intel_display_core.h` `drivers/gpu/drm/i915/display/intel_display_device.c` `drivers/gpu/drm/i915/display/intel_display_types.h` +1 more	+170 ~~-126~~	0 replies
257/261	drm/i915/hdcp: require monotonically increasing seq_num_v`drivers/gpu/drm/i915/display/intel_hdcp.c`	+4 -3	0 replies
258/261	drm/i915/hdcp: check streams[] bounds before overflow`drivers/gpu/drm/i915/display/intel_hdcp.c`	+4 -1	0 replies
259/261	ALSA: hda: codecs: hdmi: disable keep-alive before audio format change`sound/pci/hda/patch_hdmi.c`	+42 -6	0 replies
260/261	drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info`drivers/gpu/drm/tegra/fbdev.c`	+0 -1	0 replies
261/261	usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path`drivers/usb/typec/ucsi/ucsi.c`	+2 -2	0 replies

Reviews trailers per patch

154 of 260 patches have a Reviewed-by or Acked-by.

Patch	Ilya Maximets	Jernej Skrabec	Frank Li	Dave Jiang	Vinicius Costa Gomes	Hans de Goede	Niklas Cassel	Ido Schimmel	Jordan Rhee	Przemek Kitszel	Manivannan Sadhasivam	Kuldeep Singh	Konrad Dybcio	Naohiro Aota	Talha Berk Arslan	Allison Henderson	Chris Leech	Michal Simek	John Garry	Radhey Shyam Pandey	Nikolay Aleksandrov	Vadim Fedorenko	Zhu Yanjun	Ritesh Harjani (IBM)	CK Hu	Jarkko Sakkinen	Jeff Hugo	Andrew Lunn	Simon Horman	Jacob Keller	NeilBrown	Andy Shevchenko	Gao Xiang	Dennis Zhou	Muchun Song	Christian Borntraeger	Matthew Rosato	Xin Long	Ren Wei	Shuangpeng Bai	Mike Christie	Peter Wang	Bean Huo	Bart Van Assche	M Nikhil	Chinmaya Kajagar	Nihar Panda	Julian Anastasov	Mahanta Jambigi	Jozsef Kadlecsik	Tung Nguyen	David Rientjes	David Hildenbrand (Arm)	Michael S. Tsirkin	Geert Uytterhoeven	Caleb Sander Mateos	Lorenzo Stoakes	Damien Le Moal	Linus Walleij	Viresh Kumar	Zhongqiu Han	Alexandra Winter	Eduard Shishkin	Stefan Haberland	Jan Höppner	Finn Callies	Harald Freudenberger	Lakshmi Sowjanya D	Dmitry Baryshkov	Dima Ruinskiy	Vincent Mailhol	Oleksij Rempel	Eelco Chaudron	Pavel Pisa	Ankit Nautiyal	Maíra Canal	Iago Toral Quiroga	Aaron Conole	Hawking Zhang	Yang Wang	David Francis	Kent Russell	Alysa Liu	Ian Forbes	Klaus Kudielka	Josua Mayer	Marek Szyprowski	Kohei Enju	Aleksandr Loktionov	Alexander Nowlin	Rinitha S	Carlos Song	Heikki Krogerus	Benson Leung	Christian König	Javier Martinez Canillas	Jacopo Mondi	Dave Stevenson	Zi Yan	Baolin Wang	Miaohe Lin	Laurent Pinchart	Jeffrey Altman	Vasanthakumar Thiagarajan	Arend van Spriel	Kees Cook	Patrick Donnelly	Milind Changire	Viacheslav Dubeyko	Alex Markuze	Matthieu Baerts (NGI0)	Xuanqiang Luo	Rodrigo Vivi	Johan Hovold	Biju Das	Tommaso Merciai	Lu Baolu	Jani Nikula	Suraj Kandpal	Alexander Kaplan	Chaitanya Kumar Borah	Gustavo Sousa	Pavel Machek (CIP)	Shuah Khan	Peter Schneider	Wentao Guan	Brett A C Sheffield	Ron Economos	Miguel Ojeda	Mark Brown	Florian Fainelli
Series																																																																																																																											T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b
1/261	T-b
2/261								R-b
3/261
4/261									R-b	R-b
5/261
6/261
7/261
8/261											R-b	R-b	R-b
9/261
10/261
11/261		A-b	R-b
12/261				R-b	A-b
13/261
14/261						R-b
15/261							R-b
16/261
17/261
18/261
19/261														R-b
20/261																		A-b
21/261																		R-b
22/261																		R-b
23/261
24/261																									R-b
25/261																										R-b T-b
26/261																										R-b T-b
27/261																										R-b T-b
28/261															Reported-and-tested-by
29/261
30/261
31/261
32/261
33/261
34/261																R-b
35/261																R-b
36/261
37/261																	A-b
38/261																	A-b
39/261																			R-b
40/261
41/261
42/261																				R-b
43/261
44/261
45/261
46/261								R-b
47/261
48/261																					A-b
49/261																						R-b	R-b
50/261
51/261
52/261
53/261
54/261
55/261
56/261
57/261
58/261																								R-b
59/261																								R-b
60/261																								R-b
61/261
62/261
63/261
64/261
65/261
66/261
67/261
68/261
69/261
70/261
71/261																												R-b
72/261																																									R-b
73/261																																										R-b	R-b	R-b
74/261																																													T-b A-b	R-b	R-b
75/261																																									R-b
76/261																						R-b
77/261																						R-b
78/261
79/261
80/261																											R-b
81/261																												R-b
82/261																													R-b
83/261																														R-b
84/261
85/261
86/261								R-b
87/261																															R-b
88/261																																R-b
89/261
90/261																																	R-b
91/261
92/261																																		A-b
93/261																																			R-b
94/261
95/261
96/261
97/261																																				R-b	R-b T-b
98/261																																				R-b	R-b T-b
99/261																																				R-b	R-b T-b
100/261																																						A-b
101/261
102/261
103/261
104/261
105/261																																							R-b
106/261
107/261
108/261
109/261																																								Reported-and-tested-by
110/261
111/261
112/261
113/261
114/261
115/261
116/261
117/261
118/261
119/261
120/261			R-b																																																																	T-b	R-b
121/261																																																																						R-b
122/261
123/261																																																A-b
124/261																																																	R-b
125/261																																																		A-b
126/261																																																			R-b
127/261
128/261
129/261																																																				A-b	A-b	A-b
130/261																					A-b
131/261								R-b
132/261																								R-b																															R-b
133/261
134/261																						R-b
135/261
136/261																						R-b
137/261																						R-b
138/261																																																								R-b
139/261
140/261
141/261
142/261																																																					A-b				R-b
143/261																																																					A-b				R-b
144/261																																												R-b														R-b
145/261																																						A-b
146/261																																						A-b
147/261
148/261
149/261
150/261																																																											R-b
151/261																																																												A-b	R-b
152/261
153/261																																				R-b																										R-b
154/261																																																															A-b	R-b
155/261																																																																	R-b
156/261																																																																		R-b
157/261																																																																			R-b
158/261																																																																			R-b
159/261																		A-b
160/261																		A-b
161/261																		A-b
162/261																																																																									R-b
163/261																																																																														R-b
164/261																																																																														R-b
165/261										R-b																																																																														R-b	R-b	T-b
166/261																														R-b																																																													T-b
167/261
168/261			R-b																																																																																									A-b
169/261			R-b																																																																																									A-b
170/261
171/261
172/261																																																																							R-b
173/261
174/261
175/261																																																																								A-b
176/261
177/261
178/261
179/261																																																																							R-b
180/261																																																																							R-b
181/261
182/261																																																																										A-b
183/261																																																																										A-b
184/261																																																																										A-b
185/261																																																																										A-b
186/261
187/261																																																																											R-b
188/261																																																																												R-b	R-b
189/261																																																																													R-b
190/261																									R-b
191/261																																																																															R-b	R-b
192/261																																																																																	R-b
193/261																																																																																		R-b
194/261																																																																																		R-b
195/261																																																																																		R-b
196/261																																																																																			R-b
197/261																																																																																				R-b
198/261																																																																																				R-b
199/261																																																																																				R-b
200/261																																																																																				R-b
201/261																																																																																				R-b
202/261																																																																																				R-b
203/261																																																																																				R-b
204/261
205/261
206/261																																																																																					T-b	A-b
207/261																																																																																							T-b
208/261																																																																																																																					A-b
209/261																																																					A-b
210/261																																																					A-b																																														R-b	R-b	R-b
212/261																																																											R-b
213/261
214/261
215/261																																																																																																																		R-b
216/261																																																																																																						R-b													A-b
217/261																																																																																																																				R-b T-b
218/261
219/261																																																																																													R-b
220/261																																																																																													R-b
221/261																																																																																														R-b
222/261																																																																					A-b																										A-b	A-b
223/261
224/261																																																																																															R-b
225/261																																																																											R-b
226/261																																																																											R-b
227/261																																																																																																	R-b	R-b
228/261																																																																																																	R-b	R-b
229/261																																																																																																	R-b	R-b
230/261																																																																																																		R-b
231/261																																																																																																	R-b
232/261																																																																																																		R-b
233/261																																																																																																		R-b				R-b
234/261																																																																																																							R-b
235/261
236/261
237/261			R-b																																																																																																			R-b
238/261																																																																																																								R-b
239/261																																																																																																									A-b
240/261																																																																																																									A-b
241/261																																																																																																									A-b
242/261																																																																																																										R-b
243/261																																						A-b
244/261
245/261
246/261																																																																																																											R-b	R-b
247/261																																																																																																											R-b	R-b
248/261																																																																																																													R-b	R-b
249/261
250/261																																																																																																															R-b
251/261																																																																																																															R-b
252/261																																																																																																															R-b	T-b
253/261																																						A-b
254/261																																																																																																																	R-b
255/261																																																																																																																										R-b
256/261																																																																																																																						R-b
257/261																																																																																																																							R-b
258/261																																																																																																																							R-b
259/261																																																																																																																								T-b
260/261
261/261																																																																																													R-b																												T-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 131 reviewers.

Read the v1 thread

Cover letter [PATCH 6.6 000/261] 6.6.151-rc1 review

This is the start of the stable review cycle for the 6.6.151 release. There are 261 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.151-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.151-rc1

Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path

Thomas Zimmermann <[email protected]>
drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info

Kai Vehmanen <[email protected]>
ALSA: hda: codecs: hdmi: disable keep-alive before audio format change

Jani Nikula <[email protected]>

    drm/i915/hdcp: check streams[] bounds before overflow

Jani Nikula <[email protected]>
drm/i915/hdcp: require monotonically increasing seq_num_v

Suraj Kandpal <[email protected]>
drm/i915/hdcp: Move to using intel_display in intel_hdcp

Jani Nikula <[email protected]>
drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind

Ville Syrjälä <[email protected]>
drm/i915/fbc: Extract intel_fbc_has_fences()

Zhiling Zou <[email protected]>
sctp: close UDP tunnel sockets during netns teardown

Geliang Tang <[email protected]>
mptcp: pm: userspace: fix use-after-free in get_local_id

Geliang Tang <[email protected]>
mptcp: pm: use addr entry for get_local_id

Geliang Tang <[email protected]>
mptcp: add mptcp_userspace_pm_lookup_addr helper

Geliang Tang <[email protected]>
mptcp: pm: avoid code duplication to lookup endp

WenTao Liang <[email protected]>
ceph: fix refcount leak in ceph_readdir()

Xiubo Li <[email protected]>
ceph: print cluster fsid and client global_id in all debug logs

Xiubo Li <[email protected]>
libceph: add doutc and *_client debug macros support

Oliver Hartkopp <[email protected]>
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering

Oliver Hartkopp <[email protected]>
can: use skb hash instead of private variable in headroom

Zhiling Zou <[email protected]>
sctp: avoid auth_enable sysctl UAF during netns teardown

Thomas Weißschuh <[email protected]>
sysctl: treewide: constify ctl_table_header::ctl_table_arg

Fan Wu <[email protected]>
wifi: brcmfmac: drain bus_reset work on device removal

LiangCheng Wang <[email protected]>
wifi: brcmfmac: set F2 blocksize to 256 for BCM43752

Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)

Daniel Hodges <[email protected]>
wifi: ath6kl: fix use-after-free in aggr_reset_state()

Mirela Rabulea <[email protected]>
media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()

Sakari Ailus <[email protected]>
media: v4l: async: Set owner for async sub-devices

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: clone set on flush only

David Howells <[email protected]>
rxrpc: Fix irq-disabled in local_bh_enable()

Sakari Ailus <[email protected]>
media: imx219: Fix maximum frame length in lines

Jai Luthra <[email protected]>
media: i2c: imx219: Rename VTS to FRM_LENGTH

Laurent Pinchart <[email protected]>
media: i2c: imx219: Calculate crop rectangle dynamically

Laurent Pinchart <[email protected]>
media: i2c: imx219: Group functions by purpose

Laurent Pinchart <[email protected]>

    media: i2c: imx219: Drop IMX219_VTS_* macros

Laurent Pinchart <[email protected]>
media: i2c: imx219: Don't store the current mode in the imx219 structure

Laurent Pinchart <[email protected]>
media: i2c: imx219: Access height from active format in imx219_set_ctrl

Jani Nikula <[email protected]>
drm/i915/vrr: require valid min/max vfreq for VRR

Ville Syrjälä <[email protected]>
drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()

Timur Kristóf <[email protected]>
drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions

Thomas Zimmermann <[email protected]>
drm/tegra: fbdev: Remove offset into framebuffer memory

Thomas Zimmermann <[email protected]>
drm/fb-helper: Allocate and release fb_info in single place

Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Fix race condition and ordering in port unregistration

Sergey Senozhatsky <[email protected]>
usb: typec: ucsi: split connector lock classes

Diogo Ivo <[email protected]>
usb: typec: ucsi: Only enable supported notifications

Cen Zhang <[email protected]>
usb: gadget: f_tcm: synchronize delayed set_alt with teardown

Biju Das <[email protected]>
drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay

Lad Prabhakar <[email protected]>
drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du

Guangshuo Li <[email protected]>
usb: musb: omap2430: Do not put borrowed of_node in probe

Johan Hovold <[email protected]>
usb: musb: omap2430: clean up probe error handling

Frank Scheiner <[email protected]>
Revert "ia64: Make acpi_cpufreq_cpu_exit return void"

Junjie Cao <[email protected]>
gpio: pch: use raw_spinlock_t for the register lock

Tze Yee Ng <[email protected]>
firmware: stratix10-svc: fix memory leaks and list corruption bugs

Kiryl Shutsemau (Meta) <[email protected]>
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

Kiryl Shutsemau (Meta) <[email protected]>
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()

Wei Yang <[email protected]>
iommu/sva: move x86 disable check before allocation

Niklas Cassel <[email protected]>
ata: ahci: Make ahci_ignore_port() handle empty mask_port_map

Damien Le Moal <[email protected]>
ata: libahci_platform: Do not set mask_port_map when not needed

HyeongJun An <[email protected]>
HID: logitech-dj: Fix maxfield check in DJ short report validation

Jun Guo <[email protected]>
spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX

Zack Rusin <[email protected]>
drm/vmwgfx: validate external BO copy bounds for both stride paths

Zack Rusin <[email protected]>
drm/vmwgfx: use check_add_overflow for shader size+offset bound

Zack Rusin <[email protected]>
drm/vmwgfx: bound DMA command body size against suffix pointer

Zack Rusin <[email protected]>
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

Zack Rusin <[email protected]>
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

Zack Rusin <[email protected]>
drm/vmwgfx: reject DX_BIND_QUERY without a DX context

Zack Rusin <[email protected]>
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size

William Palacek <[email protected]>
drm/amdkfd: hold event_mutex while checkpointing CRIU events

David Francis <[email protected]>
drm/amdkfd: Handle invalid event type in CRIU event restore

Vladimir Marioukhine <[email protected]>
drm/amdkfd: fix QID bit leak in pqm_create_queue()

Gang Ba <[email protected]>
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE

Harkirat Gill <[email protected]>
drm/amdgpu: cap GTT size to physical RAM on APUs

Candice Li <[email protected]>
drm/amdgpu: restore UMD profile pstate after runtime resume

Myeonghun Pak <[email protected]>
drm/mediatek: ovl_adaptor: balance component registrations

Maíra Canal <[email protected]>
drm/vc4: Zero the tile state data array before each BIN job

Jose Maria Casanova Crespo <[email protected]>
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size

Alexander Kaplan <[email protected]>
drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs

Avi Weiss <[email protected]>
can: ctucanfd: mark error-active controller status valid

Avi Weiss <[email protected]>
can: ctucanfd: handle bus error interrupts

Avi Weiss <[email protected]>
can: ctucanfd: unmap BAR0 using base address

Avi Weiss <[email protected]>
can: ctucanfd: use self-test mode for PRESUME_ACK

Pengpeng Hou <[email protected]>
can: ctucanfd: add missing MODULE_DEVICE_TABLE()

Pengpeng Hou <[email protected]>
can: peak_usb: validate uCAN receive record lengths

Maoyi Xie <[email protected]>
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

James Gao <[email protected]>
can: peak_usb: add bounds check for USB channel index

Pengpeng Hou <[email protected]>
can: softing: fw_parse(): validate firmware record spans

Pengpeng Hou <[email protected]>
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

Abdun Nihaal <[email protected]>
can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()

Tetsuo Handa <[email protected]>
can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking

Oleksij Rempel <[email protected]>
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer

Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure

Guangshuo Li <[email protected]>
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure

Pengpeng Hou <[email protected]>
can: ems_usb: validate CPC message lengths

Lucas Martins Alves <[email protected]>
can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured

Liem <[email protected]>
i2c: imx: Cancel hrtimer before clearing slave pointer

Liem <[email protected]>
i2c: imx: Fix slave registration race and error handling

H. Nikolaus Schaller <[email protected]>
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock

Dawei Feng <[email protected]>
ice: fix memory leak in ice_lbtest_prepare_rings()

Aaron Ma <[email protected]>
ice: wait for reset completion in ice_resume()

Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during ct

Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during recirculation

Ilya Maximets <[email protected]>
net: openvswitch: fix potential UAF on meter attach failure

Nava kishore Manne <[email protected]>
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB

Nava kishore Manne <[email protected]>
phy: zynqmp: use read-modify-write for SERDES scrambler bypass

Nava kishore Manne <[email protected]>
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask

Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA ECC private key requests

Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA AES cipher key requests

Harald Freudenberger <[email protected]>
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

Stefan Haberland <[email protected]>
s390/dasd: Fix undersized format-check buffer

Jan Höppner <[email protected]>
s390/dasd: Fix potential NULL pointer dereference

Aswin Karuvally <[email protected]>
s390/qeth: Check CAP_NET_ADMIN for private ioctls

Xu Rao <[email protected]>
power: supply: bq25890: fix the -10 C NTC lookup entry

Abdun Nihaal <[email protected]>
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()

bui duc phuc <[email protected]>
gpio: pca953x: fix cache_only and IRQ state on restore_context() failure

Myeonghun Pak <[email protected]>
i2c: amd-mp2: Unregister callback on adapter add failure

Vincent Jardin <[email protected]>
hwmon: (pmbus/core) notify on the hwmon device, not the i2c client

Hongyan Xu <[email protected]>
hwmon: (npcm750-pwm-fan): stop fan timer on device detach

Asim Viladi Oglu Manizada <[email protected]>
sctp: prevent peer transport count overflow

Yuxiang Yang <[email protected]>
sctp: reject stale cookies with mismatched verification tags

Ibrahim Hashimov <[email protected]>
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

Chris Gellermann <[email protected]>
selftests/clone3: fix wild pointer access of getline due to missing init

Chris Gellermann <[email protected]>
selftests/mm: fix potential wild pointer access of getline due to missing init

Vijaya Krishna Nivarthi <[email protected]>
spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure

Masami Hiramatsu (Google) <[email protected]>
tracing/filters: Fix false positive match in regex_match_full()

Masami Hiramatsu (Google) <[email protected]>
tracing: Check return value of __register_event() in trace_module_add_events()

Ming Lei <[email protected]>
ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

Eric Dumazet <[email protected]>
vxlan: use pskb_network_may_pull() in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: use neigh_ha_snapshot() in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: unclone skb head before modifying eth header in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: re-fetch eth header after route_shortcircuit()

Michael Bommarito <[email protected]>
um: vector: fix use-after-free in vector_mmsg_rx()

Thorsten Blum <[email protected]>
powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()

Zhiling Zou <[email protected]>
net: ipv6: clear suppressed fib6 rule result

Zhiling Zou <[email protected]>
net: bridge: stop fast-leave after deleting a port group

Link Lin <[email protected]>
mm/page_reporting: use system_freezable_wq to fix UAF during suspend

Christian Brauner <[email protected]>
binfmt_misc: reject a flag character as the field delimiter

Zhao Li <[email protected]>
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

Zihan Xi <[email protected]>
tipc: avoid use-after-free in poll trace queue dumps

David Lee <[email protected]>
netfilter: ipset: do not update comments from kernel-side hash adds

Xuanqiang Luo <[email protected]>
net/smc: fix socket use-after-free during link group termination

Zhiling Zou <[email protected]>
ipvs: do not propagate one-packet flag to synced conns

Matt Vollrath <[email protected]>
igbvf: Fix leak in TX DMA error cleanup

Dawei Feng <[email protected]>

    e1000: fix memory leak in e1000_probe()

Md Sadre Alam <[email protected]>
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+

Sonali Pradhan <[email protected]>
ALSA: usb-audio: Clamp frame size in implicit-feedback mode

Sonali Pradhan <[email protected]>
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set

Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()

Baul Lee <[email protected]>
ALSA: usb-audio: fix use-after-free in ump_to_endpoint()

Matt Vollrath <[email protected]>
ata: libata-eh: Increase STANDBY IMMEDIATE timeout

Haidar Lee <[email protected]>
ASoC: tas2562: fix broken entries in the volume lookup table

Haidar Lee <[email protected]>
ASoC: tas2562: fix DVC coefficient write order

Baul Lee <[email protected]>
ALSA: ump: fix double free of out_cvts on rawmidi error

Norbert Szetei <[email protected]>
ALSA: pcm: wake linked drain waiters on unlink

Xu Rao <[email protected]>
ALSA: lx6464es: fix period byte count for 16-bit streams

Takashi Iwai <[email protected]>
ALSA: 6fire: Fix UAF at error handling during probe

Xuanqiang Luo <[email protected]>
bpf: lwt: Fix dst reference leak on reroute failure

Sangho Lee <[email protected]>
Bluetooth: HIDP: validate numbered report payloads

Sangho Lee <[email protected]>
Bluetooth: HIDP: reject frames without a transaction header

Zihan Xi <[email protected]>
Bluetooth: mgmt: fix UAF in pair command cancellation

Zihan Xi <[email protected]>
Bluetooth: mgmt: fix pending command UAF in EIR updates

Greg Kroah-Hartman <[email protected]>
Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()

Luxiao Xu <[email protected]>
audit: fix potential use-after-free in audit_del_rule()

Zhan Xusheng <[email protected]>
audit: fix potential integer overflow in audit_log_n_string()

Charles Vosburgh <[email protected]>
sctp: validate Adaptation Indication parameter length

Farhan Ali <[email protected]>
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

Farhan Ali <[email protected]>
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure

Farhan Ali <[email protected]>
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled

Sean Christopherson <[email protected]>
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active

Raushan Patel <[email protected]>
tracing/probes: Reject $arg0 in meta argument expansion

Gregory Price <[email protected]>
mm/vmstat: fold stranded per-cpu node stats when a node comes online

Xiangfeng Cai <[email protected]>
mm/hugetlb: fix list corruption in allocate_file_region_entries()

Zi Yan <[email protected]>
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()

Benjamin Boortz <[email protected]>
pinctrl: bm1880: add missing select GENERIC_PINCONF

Michael Bommarito <[email protected]>
erofs: cap LZMA stream pool size

Karl Mehltretter <[email protected]>
pinctrl: devicetree: don't free uninitialized dev_name on error path

Benjamin Boortz <[email protected]>
pinctrl: microchip-sgpio: add missing select REGMAP_MMIO

Cen Zhang (Microsoft) <[email protected]>

    rhashtable: clear stale iter->p on table restart

Pengfei Zhang <[email protected]>
ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump

Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in __close_file_table_ids()

Namjae Jeon <[email protected]>
ksmbd: return success for deferred final close

Denis V. Lunev <[email protected]>
qede: sync udp_tunnel ports outside qede_lock in the recovery path

Suman Ghosh <[email protected]>
octeontx2-pf: Set correct sequence for carrier off and tx queue stop

Daniel Golle <[email protected]>
net: dsa: mt7530: error out on failed reads in MT7531 PHY polling

Muhammad Bilal <[email protected]>
accel/qaic: use sizeof(*trans_hdr) for transaction length check

Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()

Minhong He <[email protected]>
can: isotp: check register_netdevice_notifier() error in module init

Chenguang Zhao <[email protected]>
net: sxgbe: check descriptor ring allocation failures

Chenguang Zhao <[email protected]>
net: sxgbe: free TX rings on RX allocation failure

Leon Romanovsky <[email protected]>
scsi: target: Clear cmd_cnt when initial counter enrollment fails

Benjamin Block <[email protected]>
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req

Guangshuo Li <[email protected]>
scsi: ufs: core: Cancel RTC work in active-active suspend

TanZheng <[email protected]>
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE

Christian Marangi <[email protected]>
net: phylink: put link_gpio if phylink_create fails

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync

Pauli Virtanen <[email protected]>
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists

Zijun Hu <[email protected]>
Bluetooth: btintel: Validate length before parsing diagnostics TLV

Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos

Jiale Yao <[email protected]>
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

Pauli Virtanen <[email protected]>
Bluetooth: ISO: clear iso_data always when detaching conn from hcon

Guenter Roeck <[email protected]>
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()

Zhao Li <[email protected]>
wifi: mac80211: validate individual TWT params before driver setup

Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-akebono CPU node lookup check

Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-currituck CPU node lookup check

Thorsten Blum <[email protected]>
powerpc/boot: Fix simpleboot CPU node lookup check

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix PWM auto temp state array and bounds check

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Use cached PWM frequency value

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix cache updated before hardware write on I2C error

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors

Chenguang Zhao <[email protected]>
forcedeth: fix UAF of txrx_stats in nv_remove

David Corvaglia <[email protected]>
net: bridge: mrp: fix Option TLV length in MRP_Test frames

Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Prevent access to unsupported weight registers

Eric Dumazet <[email protected]>
net: do not send ICMP/NDISC Redirects when peer allocation fails

Guenter Roeck <[email protected]>
hwmon: (nzxt-smart2) DMA-align output buffer

Guenter Roeck <[email protected]>
hwmon: (lm90) Only report alarms if driver is ready

Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116

Srikanth Boyapally <[email protected]>
spi: spi-cadence: Move TX FIFO full busy-wait into FIFO

Jun Guo <[email protected]>
spi: spi-cadence: supports transmission with bits_per_word of 16 and 32

Dawei Feng <[email protected]>
smb: client: fix buffer leaks in SMB1 read and write

Xingui Yang <[email protected]>
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race

HyeongJun An <[email protected]>
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

HyeongJun An <[email protected]>
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

Mario Limonciello <[email protected]>
pinctrl-amd: Don't clear S4 wake bits at probe

Xiang Mei <[email protected]>
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()

Ilia Gavrilov <[email protected]>
rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled

Xiang Mei (Microsoft) <[email protected]>
netfilter: nft_payload: fix mask build for partial field offload

Julian Anastasov <[email protected]>
ipvs: do not mangle ICMP replies for non-first fragments

Julian Anastasov <[email protected]>
ipvs: fix places with wrong packet offsets

Julian Anastasov <[email protected]>
ipvs: fix the checksum validations

Kent Overstreet <[email protected]>

    sched: Add task_struct->faults_disabled_mapping

Pablo Neira Ayuso <[email protected]>
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

Michael Bommarito <[email protected]>
assoc_array: trim the final shortcut word using the current chunk end

Michael Bommarito <[email protected]>
keys: make keyring key-chunk byte order agree with keyring_diff_objects()

Michael Bommarito <[email protected]>
keys: fix out-of-bounds read in keyring_get_key_chunk()

Ruoyu Wang <[email protected]>
drm/mediatek: Check CRTC state before freeing

Xiang Mei <[email protected]>
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix runtime PM leak on probe allocation failure

Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()

Mike Looijmans <[email protected]>
phy-zynqmp: Postpone getting clock rate until actually needed

Johannes Thumshirn <[email protected]>
btrfs: zoned: fix deadlock between metadata writeback and transaction commit

Uday Khare <[email protected]>
ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup

Uday Khare <[email protected]>
ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup

Radhey Shyam Pandey <[email protected]>
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()

Damien Le Moal <[email protected]>
ahci: Introduce ahci_ignore_port() helper

Josua Mayer <[email protected]>
ata: libahci_platform: support non-consecutive port numbers

Rosen Penev <[email protected]>
ata: sata_mv: accept 1 or 2 resources in platform probe

Yuho Choi <[email protected]>
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()

Hongling Zeng <[email protected]>
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA

Konrad Dybcio <[email protected]>

    pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151

Michael Bommarito <[email protected]>
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

Harshal Dev <[email protected]>
soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE

Benjamin Tissoires <[email protected]>
HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report

Lee Jones <[email protected]>
HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write

Lee Jones <[email protected]>
HID: logitech-dj: Standardise hid_report_enum variable nomenclature

Eddie Phillips <[email protected]>
gve: fix Rx queue stall on alloc failure

Yehyeong Lee <[email protected]>
net: mpls: initialize rtm_tos in mpls_getroute()

Lorenzo Bianconi <[email protected]>
netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()

Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: restore helper propagation via expectation

-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/powerpc/boot/simpleboot.c                     |   2 +-
 arch/powerpc/boot/treeboot-akebono.c               |   2 +-
 arch/powerpc/boot/treeboot-currituck.c             |   2 +-
 arch/powerpc/platforms/ps3/mm.c                    |   1 +
 arch/s390/kvm/pci.c                                |  28 +-
 arch/um/drivers/vector_kern.c                      |   3 +
 arch/x86/kvm/svm/avic.c                            |   8 -
 drivers/accel/qaic/qaic_control.c                  |   2 +-
 drivers/ata/ahci.h                                 |  17 +-
 drivers/ata/ahci_brcm.c                            |   3 +
 drivers/ata/ahci_ceva.c                            |  24 +-
 drivers/ata/libahci.c                              |   1 +
 drivers/ata/libahci_platform.c                     |  38 +-
 drivers/ata/libata-eh.c                            |   8 +
 drivers/ata/sata_mv.c                              |   2 +-
 drivers/block/ublk_drv.c                           |   9 +
 drivers/bluetooth/btintel.c                        |   3 +
 drivers/bluetooth/btmtk.c                          |  50 +-
 drivers/cpufreq/ia64-acpi-cpufreq.c                |   4 +-
 drivers/cpufreq/powernow-k8.c                      |   1 +
 drivers/dma/idxd/cdev.c                            |   4 +-
 drivers/dma/sun6i-dma.c                            |  11 +-
 drivers/firmware/stratix10-svc.c                   |  10 +-
 drivers/gpio/gpio-pca953x.c                        |  15 +-
 drivers/gpio/gpio-pch.c                            |  28 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |  15 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c        |  30 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  12 +
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |  10 +-
 drivers/gpu/drm/amd/amdkfd/kfd_events.c            |  23 +-
 .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c |   2 +-
 drivers/gpu/drm/armada/armada_fbdev.c              |  12 +-
 drivers/gpu/drm/display/drm_dp_helper.c            |  12 +
 drivers/gpu/drm/drm_fb_helper.c                    |  41 +-
 drivers/gpu/drm/drm_fbdev_dma.c                    |  12 +-
 drivers/gpu/drm/drm_fbdev_generic.c                |  12 +-
 drivers/gpu/drm/exynos/exynos_drm_fbdev.c          |   9 +-
 drivers/gpu/drm/gma500/fbdev.c                     |  13 +-
 drivers/gpu/drm/i915/display/intel_display_core.h  |   3 +
 .../gpu/drm/i915/display/intel_display_device.c    |   3 +
 drivers/gpu/drm/i915/display/intel_display_types.h |  40 ++
 drivers/gpu/drm/i915/display/intel_fbc.c           |   9 +-
 drivers/gpu/drm/i915/display/intel_fbdev.c         |   9 +-
 drivers/gpu/drm/i915/display/intel_hdcp.c          | 266 ++++----
 drivers/gpu/drm/i915/display/intel_vrr.c           |  10 +-
 drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c    |   7 +-
 drivers/gpu/drm/mediatek/mtk_drm_crtc.c            |   6 +-
 drivers/gpu/drm/msm/msm_fbdev.c                    |   9 +-
 drivers/gpu/drm/omapdrm/omap_fbdev.c               |   9 +-
 drivers/gpu/drm/radeon/radeon_fbdev.c              |  13 +-
 drivers/gpu/drm/renesas/Kconfig                    |   1 +
 drivers/gpu/drm/renesas/Makefile                   |   1 +
 drivers/gpu/drm/renesas/rcar-du/Kconfig            |   8 -
 drivers/gpu/drm/renesas/rcar-du/Makefile           |   2 -
 drivers/gpu/drm/renesas/rz-du/Kconfig              |   8 +
 drivers/gpu/drm/renesas/rz-du/Makefile             |   3 +
 .../renesas/{rcar-du => rz-du}/rzg2l_mipi_dsi.c    |   2 +-
 .../{rcar-du => rz-du}/rzg2l_mipi_dsi_regs.h       |   0
 drivers/gpu/drm/tegra/fbdev.c                      |  18 +-
 drivers/gpu/drm/vc4/vc4_irq.c                      |   2 +-
 drivers/gpu/drm/vc4/vc4_validate.c                 |  29 +-
 drivers/gpu/drm/vmwgfx/ttm_object.c                |   7 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_blit.c               |  39 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c            |  20 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c           |   4 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_shader.c             |  13 +-
 drivers/hid/hid-logitech-dj.c                      |  28 +-
 drivers/hwmon/adt7470.c                            | 131 ++--
 drivers/hwmon/lm90.c                               |   4 +-
 drivers/hwmon/nct6775-core.c                       |  20 +-
 drivers/hwmon/npcm750-pwm-fan.c                    |  11 +
 drivers/hwmon/nzxt-smart2.c                        |   2 +-
 drivers/hwmon/pmbus/pmbus_core.c                   |   7 +-
 drivers/i2c/busses/i2c-amd-mp2-plat.c              |   4 +-
 drivers/i2c/busses/i2c-imx.c                       |   9 +-
 drivers/i2c/busses/i2c-jz4780.c                    |   5 +-
 drivers/iommu/iommu-sva.c                          |   6 +-
 drivers/media/i2c/imx219.c                         | 670 ++++++++++---------
 drivers/media/v4l2-core/v4l2-async.c               |   8 +-
 drivers/media/v4l2-core/v4l2-fwnode.c              |   6 +-
 drivers/net/can/c_can/c_can_main.c                 |   8 +-
 drivers/net/can/ctucanfd/ctucanfd_base.c           |  14 +-
 drivers/net/can/ctucanfd/ctucanfd_pci.c            |   3 +-
 drivers/net/can/dev/skb.c                          |   2 -
 drivers/net/can/softing/softing_fw.c               |  46 +-
 drivers/net/can/usb/ems_usb.c                      |  43 ++
 drivers/net/can/usb/etas_es58x/es58x_core.c        |   1 -
 drivers/net/can/usb/gs_usb.c                       |   4 +-
 drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c  |   1 +
 drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c   |  13 +-
 drivers/net/can/usb/peak_usb/pcan_usb_core.c       |   1 -
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c         |  40 +-
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c        |  20 +-
 drivers/net/dsa/mt7530.c                           |  58 +-
 drivers/net/ethernet/google/gve/gve.h              |   3 +
 drivers/net/ethernet/google/gve/gve_main.c         |   3 +
 drivers/net/ethernet/google/gve/gve_rx_dqo.c       |  33 +
 drivers/net/ethernet/intel/e1000/e1000_main.c      |   2 +-
 drivers/net/ethernet/intel/ice/ice_ethtool.c       |  10 +-
 drivers/net/ethernet/intel/ice/ice_main.c          |  10 +
 drivers/net/ethernet/intel/igbvf/netdev.c          |   2 -
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |   2 +-
 drivers/net/ethernet/nvidia/forcedeth.c            |   4 +-
 drivers/net/ethernet/qlogic/qede/qede_main.c       |  44 +-
 drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c    |  14 +-
 drivers/net/phy/phylink.c                          |  29 +-
 drivers/net/vrf.c                                  |   2 +-
 drivers/net/vxlan/vxlan_core.c                     |  15 +-
 drivers/net/wireless/ath/ath6kl/txrx.c             |   2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  |  16 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |   6 +
 .../wireless/broadcom/brcm80211/brcmfmac/chip.c    |   4 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.c    |  46 +-
 .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |   6 +
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  14 +-
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |   1 +
 .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |   3 +
 .../broadcom/brcm80211/include/brcm_hw_ids.h       |   2 +-
 .../net/wireless/marvell/mwifiex/11n_rxreorder.c   |   2 +-
 drivers/phy/xilinx/phy-zynqmp.c                    | 130 ++--
 drivers/pinctrl/Kconfig                            |   2 +
 drivers/pinctrl/devicetree.c                       |   4 +
 drivers/pinctrl/pinctrl-amd.c                      |   3 +-
 drivers/pinctrl/qcom/pinctrl-sc8280xp.c            |  21 +-
 drivers/power/supply/bq25890_charger.c             |   2 +-
 drivers/s390/block/dasd_eckd.c                     |  11 +-
 drivers/s390/block/dasd_ioctl.c                    |   2 +-
 drivers/s390/crypto/zcrypt_api.c                   |   2 +-
 drivers/s390/crypto/zcrypt_ccamisc.c               |   6 +
 drivers/s390/net/qeth_core_main.c                  |   3 +
 drivers/s390/scsi/zfcp_aux.c                       |   1 +
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c             |  10 +-
 drivers/scsi/libiscsi.c                            |   2 +-
 drivers/scsi/libiscsi_tcp.c                        |   8 +-
 drivers/scsi/libsas/sas_init.c                     |  37 +-
 drivers/scsi/scsi_debug.c                          |   8 +-
 drivers/soc/qcom/ice.c                             |  17 +-
 drivers/spi/spi-cadence.c                          | 129 +++-
 drivers/spi/spi-qcom-qspi.c                        |   3 +-
 drivers/target/target_core_iblock.c                |   6 +-
 drivers/target/target_core_transport.c             |  12 +-
 drivers/thunderbolt/xdomain.c                      |  40 +-
 drivers/ufs/core/ufshcd.c                          |   6 +-
 drivers/usb/gadget/function/f_tcm.c                | 192 +++++-
 drivers/usb/gadget/function/tcm.h                  |  13 +
 drivers/usb/musb/omap2430.c                        |  25 +-
 drivers/usb/typec/ucsi/ucsi.c                      | 113 ++--
 drivers/usb/typec/ucsi/ucsi.h                      |   1 +
 fs/binfmt_misc.c                                   |   4 +
 fs/btrfs/zoned.c                                   |   6 +-
 fs/ceph/acl.c                                      |   6 +-
 fs/ceph/addr.c                                     | 279 ++++----
 fs/ceph/caps.c                                     | 708 ++++++++++++---------
 fs/ceph/crypto.c                                   |  39 +-
 fs/ceph/debugfs.c                                  |   6 +-
 fs/ceph/dir.c                                      | 225 ++++---
 fs/ceph/export.c                                   |  39 +-
 fs/ceph/file.c                                     | 245 ++++---
 fs/ceph/inode.c                                    | 485 +++++++-------
 fs/ceph/ioctl.c                                    |  13 +-
 fs/ceph/locks.c                                    |  57 +-
 fs/ceph/mds_client.c                               | 554 +++++++++-------
 fs/ceph/mdsmap.c                                   |  24 +-
 fs/ceph/metric.c                                   |   5 +-
 fs/ceph/quota.c                                    |  29 +-
 fs/ceph/snap.c                                     | 174 ++---
 fs/ceph/super.c                                    |  70 +-
 fs/ceph/super.h                                    |   6 +
 fs/ceph/xattr.c                                    |  96 +--
 fs/erofs/Kconfig                                   |  14 +
 fs/erofs/decompressor_lzma.c                       |   3 +-
 fs/smb/client/cifssmb.c                            |  12 +-
 fs/smb/server/vfs_cache.c                          |   6 +-
 include/drm/drm_fb_helper.h                        |  12 -
 include/linux/can/core.h                           |   1 +
 include/linux/can/skb.h                            |   2 -
 include/linux/ceph/ceph_debug.h                    |  38 ++
 include/linux/dma/qcom_bam_dma.h                   |  21 +-
 include/linux/libata.h                             |   2 +-
 include/linux/mmc/sdio_ids.h                       |   2 +-
 include/linux/netfilter/nf_conntrack_sip.h         |   2 +-
 include/linux/sched.h                              |   1 +
 include/linux/sysctl.h                             |   2 +-
 include/linux/thunderbolt.h                        |   3 +
 include/media/v4l2-async.h                         |   8 +-
 include/net/ip_vs.h                                |  45 +-
 include/net/neighbour.h                            |   8 +-
 include/net/netfilter/nf_conntrack_expect.h        |   5 +-
 include/net/netfilter/nf_tables.h                  |   2 +
 include/scsi/libsas.h                              |   1 -
 init/init_task.c                                   |   1 +
 ipc/ipc_sysctl.c                                   |   2 +-
 ipc/mq_sysctl.c                                    |   2 +-
 kernel/audit.c                                     |  11 +-
 kernel/auditfilter.c                               |   6 +-
 kernel/trace/trace_events.c                        |   4 +-
 kernel/trace/trace_events_filter.c                 |   3 +
 kernel/trace/trace_mmiotrace.c                     |   1 +
 kernel/trace/trace_probe.c                         |   6 +-
 kernel/ucount.c                                    |   2 +-
 lib/assoc_array.c                                  |   3 +-
 lib/rhashtable.c                                   |   1 +
 mm/huge_memory.c                                   |  16 +-
 mm/hugetlb.c                                       |  12 +-
 mm/mm_init.c                                       |  15 +-
 mm/page_reporting.c                                |   6 +-
 mm/percpu-km.c                                     |   2 +-
 net/ax25/sysctl_net_ax25.c                         |   2 +-
 net/bluetooth/hci_conn.c                           |  14 +-
 net/bluetooth/hci_sync.c                           |  19 +-
 net/bluetooth/hidp/core.c                          |  30 +-
 net/bluetooth/iso.c                                |   3 +-
 net/bluetooth/l2cap_core.c                         |   5 +
 net/bluetooth/mgmt.c                               |  84 ++-
 net/bridge/br_mrp.c                                |   2 +-
 net/bridge/br_multicast.c                          |   1 +
 net/bridge/br_netfilter_hooks.c                    |   8 +-
 net/can/af_can.c                                   |  14 +-
 net/can/bcm.c                                      |   2 -
 net/can/isotp.c                                    | 337 +++++++---
 net/can/j1939/bus.c                                |   2 +
 net/can/j1939/j1939-priv.h                         |   3 +
 net/can/j1939/main.c                               |   8 +-
 net/can/j1939/socket.c                             |   1 -
 net/can/j1939/transport.c                          |   6 +-
 net/can/raw.c                                      |   7 +-
 net/core/lwt_bpf.c                                 |   4 +-
 net/core/sysctl_net_core.c                         |   2 +-
 net/ieee802154/6lowpan/reassembly.c                |   2 +-
 net/ipv4/devinet.c                                 |   2 +-
 net/ipv4/ip_fragment.c                             |   2 +-
 net/ipv4/route.c                                   |   4 +-
 net/ipv4/sysctl_net_ipv4.c                         |   2 +-
 net/ipv4/xfrm4_policy.c                            |   2 +-
 net/ipv6/addrconf.c                                |   2 +-
 net/ipv6/fib6_rules.c                              |   1 +
 net/ipv6/ip6_fib.c                                 |  17 +-
 net/ipv6/ip6_output.c                              |   2 +-
 net/ipv6/ndisc.c                                   |   2 +
 net/ipv6/netfilter/nf_conntrack_reasm.c            |   2 +-
 net/ipv6/reassembly.c                              |   2 +-
 net/ipv6/sysctl_net_ipv6.c                         |   6 +-
 net/ipv6/xfrm6_policy.c                            |   2 +-
 net/mac80211/s1g.c                                 |   4 +
 net/mpls/af_mpls.c                                 |   5 +-
 net/mptcp/ctrl.c                                   |   2 +-
 net/mptcp/pm.c                                     |   9 +-
 net/mptcp/pm_netlink.c                             |  29 +-
 net/mptcp/pm_userspace.c                           |  87 ++-
 net/mptcp/protocol.h                               |   6 +-
 net/netfilter/ipset/ip_set_hash_gen.h              |   2 +-
 net/netfilter/ipvs/ip_vs_app.c                     |   4 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |   3 +
 net/netfilter/ipvs/ip_vs_core.c                    | 180 +++---
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |  19 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  48 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c               |  54 +-
 net/netfilter/ipvs/ip_vs_xmit.c                    |  42 +-
 net/netfilter/nf_conntrack_broadcast.c             |   1 +
 net/netfilter/nf_conntrack_core.c                  |   7 +-
 net/netfilter/nf_conntrack_expect.c                |   1 +
 net/netfilter/nf_conntrack_h323_main.c             |  12 +-
 net/netfilter/nf_conntrack_helper.c                |   5 +
 net/netfilter/nf_conntrack_netlink.c               |  18 +-
 net/netfilter/nf_conntrack_sip.c                   |   4 +-
 net/netfilter/nf_conntrack_standalone.c            |   2 +-
 net/netfilter/nf_log.c                             |   2 +-
 net/netfilter/nf_nat_sip.c                         |   2 +-
 net/netfilter/nf_tables_api.c                      |  10 +-
 net/netfilter/nft_payload.c                        |  12 +-
 net/netfilter/nft_set_pipapo.c                     |  11 +-
 net/netfilter/xt_hashlimit.c                       |  16 +-
 net/openvswitch/actions.c                          |  12 +-
 net/openvswitch/meter.c                            |  33 +-
 net/rds/ib.c                                       |   4 +
 net/rds/ib_cm.c                                    |   4 +
 net/rds/tcp.c                                      |  14 +-
 net/rxrpc/ar-internal.h                            |   1 +
 net/rxrpc/call_accept.c                            |   1 +
 net/rxrpc/peer_object.c                            |  12 +-
 net/sctp/associola.c                               |   3 +
 net/sctp/protocol.c                                |  21 +-
 net/sctp/sm_make_chunk.c                           |  17 +-
 net/sctp/sysctl.c                                  |  11 +-
 net/smc/smc_core.c                                 |   2 +-
 net/smc/smc_sysctl.c                               |   2 +-
 net/tipc/socket.c                                  |   2 +-
 net/unix/sysctl_net_unix.c                         |   2 +-
 net/xfrm/xfrm_sysctl.c                             |   2 +-
 security/keys/keyring.c                            |  14 +-
 sound/core/pcm_native.c                            |   7 +
 sound/core/ump.c                                   |   1 +
 sound/pci/hda/patch_hdmi.c                         |  48 +-
 sound/pci/lx6464es/lx6464es.c                      |   5 +-
 sound/pci/lx6464es/lx_core.c                       |   5 +-
 sound/soc/codecs/max98090.c                        |   5 +-
 sound/soc/codecs/max98095.c                        |   5 +-
 sound/soc/codecs/tas2562.c                         |  30 +-
 sound/usb/6fire/chip.c                             |   4 +
 sound/usb/endpoint.c                               |  14 +-
 sound/usb/midi.c                                   |   2 +
 sound/usb/midi2.c                                  |   4 +-
 tools/testing/selftests/clone3/clone3_set_tid.c    |   2 +-
 tools/testing/selftests/mm/mlock-random-test.c     |   2 +-
 305 files changed, 4972 insertions(+), 3146 deletions(-)

Read the cover letter in its thread