6.12.103-rc1 review

Greg Kroah-Hartman amd-gfx dri-devel linux-patches linux-tegra lkml stable 1 version Aug 7 In review

Get series with b4

b4 am [email protected]

Versions newest first

v1 Latest Aug 7336 of 337 patches 20 repliesIn review

336 of 337 patches are in this archive. The cover letter announces 337.

Patches in v1 No applies recorded yet

#	Subject and files	Size	Replies
2/337	um: Add os_set_pdeathsig helper function`arch/um/include/shared/os.h` `arch/um/os-Linux/process.c`	+8 -0	0 replies
3/337	um: Set parent death signal for winch thread/process`arch/um/drivers/chan_user.c`	+3 -0	0 replies
4/337	um: Use os_set_pdeathsig helper in winch thread/process`arch/um/drivers/chan_user.c`	+1 -2	0 replies
5/337	um: Set parent-death signal for ubd io thread/process`arch/um/drivers/ubd_kern.c`	+1 -0	0 replies
6/337	um: Set parent-death signal for write_sigio thread/process`arch/um/os-Linux/sigio.c`	+1 -0	0 replies
7/337	um: Set parent death signal for userspace process`arch/um/os-Linux/skas/process.c`	+3 -0	0 replies
8/337	kunit: tool: Terminate kernel under test on SIGINT`tools/testing/kunit/kunit_kernel.py`	+19 -9	0 replies
9/337	kunit: tool: skip stty when stdin is not a tty`tools/testing/kunit/kunit_kernel.py` `tools/testing/kunit/kunit_tool_test.py`	+51 -2	0 replies
10/337	um: Preserve errno within signal handler`arch/um/os-Linux/signal.c`	+3 -0	0 replies
11/337	netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()`include/net/neighbour.h` `net/bridge/br_netfilter_hooks.c`	+11 -3	0 replies
12/337	net: airoha: Fix register index for Tx-fwd counter configuration`drivers/net/ethernet/airoha/airoha_eth.c`	+1 -1	0 replies
13/337	net: mpls: initialize rtm_tos in mpls_getroute()`net/mpls/af_mpls.c`	+1 -0	0 replies
14/337	HID: logitech-dj: Standardise hid_report_enum variable nomenclature`drivers/hid/hid-logitech-dj.c`	+6 -6	0 replies
15/337	HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write`drivers/hid/hid-logitech-dj.c`	+10 -0	0 replies
16/337	HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report`drivers/hid/hid-logitech-dj.c`	+2 -1	0 replies
17/337	bpf: Reset register bounds before narrowing retval range in check_mem_access()`kernel/bpf/verifier.c`	+1 -0	0 replies
18/337	netconsole: avoid OOB reads, msg is not nul-terminated`drivers/net/netconsole.c`	+2 -1	0 replies
19/337	thunderbolt: Prevent XDomain delayed work use-after-free on disconnect`drivers/thunderbolt/xdomain.c` `include/linux/thunderbolt.h`	+33 ~~-10~~	0 replies
20/337	pinctrl: qcom: Unconditionally mark gpio as wakeup enable`drivers/pinctrl/qcom/pinctrl-msm.c`	+4 -4	0 replies
21/337	pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151`drivers/pinctrl/qcom/pinctrl-sc8280xp.c`	+11 ~~-10~~	0 replies
22/337	dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA`drivers/dma/sun6i-dma.c`	+4 -7	0 replies
23/337	dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()`drivers/dma/idxd/cdev.c`	+3 -1	0 replies
24/337	gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()`drivers/gpio/gpio-sloppy-logic-analyzer.c`	+10 -0	0 replies
25/337	ata: sata_mv: accept 1 or 2 resources in platform probe`drivers/ata/sata_mv.c`	+1 -1	0 replies
26/337	ata: libahci_platform: support non-consecutive port numbers`drivers/ata/ahci_brcm.c` `drivers/ata/ahci_ceva.c` `drivers/ata/libahci_platform.c`	+43 -6	0 replies
27/337	ahci: Introduce ahci_ignore_port() helper`drivers/ata/ahci.h` `drivers/ata/ahci_brcm.c` `drivers/ata/ahci_ceva.c` +1 more	+18 -7	0 replies
28/337	ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()`drivers/ata/ahci_ceva.c`	+14 -4	0 replies
29/337	ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup`sound/soc/codecs/max98095.c`	+3 -2	0 replies
30/337	ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup`sound/soc/codecs/max98090.c`	+3 -2	0 replies
31/337	of: reserved_mem: Add code to dynamically allocate reserved_mem array`drivers/of/of_reserved_mem.c`	+59 -4	0 replies
32/337	of: reserved_mem: prevent OOB when too many dynamic regions are defined`drivers/of/of_reserved_mem.c`	+11 -3	0 replies
33/337	btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag`fs/btrfs/super.c`	+5 -3	0 replies
34/337	btrfs: zoned: fix deadlock between metadata writeback and transaction commit`fs/btrfs/zoned.c`	+5 -1	0 replies
35/337	phy-zynqmp: Postpone getting clock rate until actually needed`drivers/phy/xilinx/phy-zynqmp.c`	+37 ~~-33~~	0 replies
36/337	phy: zynqmp: fix clock error handling in xpsgtr_phy_init()`drivers/phy/xilinx/phy-zynqmp.c`	+9 -4	0 replies
37/337	phy: zynqmp: fix runtime PM leak on probe allocation failure`drivers/phy/xilinx/phy-zynqmp.c`	+6 -6	0 replies
38/337	netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()`include/linux/netfilter/nf_conntrack_sip.h` `net/netfilter/nf_conntrack_sip.c` `net/netfilter/nf_nat_sip.c`	+3 -3	0 replies
39/337	drm/mediatek: Check CRTC state before freeing`drivers/gpu/drm/mediatek/mtk_crtc.c`	+3 -3	0 replies
40/337	Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation`drivers/hv/vmbus_drv.c`	+12 -1	0 replies
41/337	KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type`security/keys/trusted-keys/trusted_dcp.c`	+11 -4	0 replies
42/337	keys: fix out-of-bounds read in keyring_get_key_chunk()`security/keys/keyring.c`	+5 -4	0 replies
43/337	keys: make keyring key-chunk byte order agree with keyring_diff_objects()`security/keys/keyring.c`	+3 -2	0 replies
44/337	assoc_array: trim the final shortcut word using the current chunk end`lib/assoc_array.c`	+2 -1	0 replies
45/337	netfilter: nf_tables: make nft_object rhltable per table`include/net/netfilter/nf_tables.h` `net/netfilter/nf_tables_api.c`	+19 ~~-19~~	0 replies
46/337	netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH`net/netfilter/xt_hashlimit.c`	+15 -1	0 replies
47/337	ipvs: fix the checksum validations`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_core.c` `net/netfilter/ipvs/ip_vs_proto_sctp.c` +2 more	+74 ~~-86~~	0 replies
48/337	ipvs: fix places with wrong packet offsets`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_app.c` `net/netfilter/ipvs/ip_vs_core.c` +4 more	+97 ~~-93~~	0 replies
49/337	ipvs: do not mangle ICMP replies for non-first fragments`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_core.c` `net/netfilter/ipvs/ip_vs_xmit.c`	+48 ~~-52~~	0 replies
50/337	netfilter: nft_payload: fix mask build for partial field offload`net/netfilter/nft_payload.c`	+1 ~~-11~~	0 replies
51/337	rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled`net/rds/ib.c` `net/rds/ib_cm.c` `net/rds/tcp.c`	+13 -3	0 replies
52/337	rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()`net/rds/tcp.c`	+5 -3	0 replies
53/337	pinctrl-amd: Dont clear S4 wake bits at probe`drivers/pinctrl/pinctrl-amd.c`	+1 -2	0 replies
54/337	scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer`drivers/scsi/libiscsi.c`	+1 -1	0 replies
55/337	scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer`drivers/scsi/libiscsi_tcp.c`	+1 -7	0 replies
56/337	scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race`drivers/scsi/hisi_sas/hisi_sas_v3_hw.c` `drivers/scsi/libsas/sas_init.c` `include/scsi/libsas.h`	+19 ~~-29~~	0 replies
57/337	smb: client: fix buffer leaks in SMB1 read and write`fs/smb/client/cifssmb.c`	+9 -3	0 replies
58/337	spi: spi-cadence: supports transmission with bits_per_word of 16 and 32`drivers/spi/spi-cadence.c`	+93 ~~-13~~	0 replies
59/337	spi: spi-cadence: Move TX FIFO full busy-wait into FIFO`drivers/spi/spi-cadence.c`	+16 ~~-10~~	0 replies
60/337	hwmon: (nct6775-core) Fix number of temperature registers for NCT6116`drivers/hwmon/nct6775-core.c`	+3 -5	0 replies
61/337	hwmon: (ina2xx) Add support for has_alerts configuration flag`drivers/hwmon/ina2xx.c`	+11 -7	0 replies
62/337	hwmon: (ina2xx) Add support for INA260`Documentation/hwmon/ina2xx.rst` `drivers/hwmon/Kconfig` `drivers/hwmon/ina2xx.c`	+59 ~~-11~~	0 replies
63/337	hwmon: (ina226) Add support for SY24655`Documentation/hwmon/ina2xx.rst` `drivers/hwmon/Kconfig` `drivers/hwmon/ina2xx.c`	+116 -7	0 replies
64/337	hwmon: (ina2xx) Make it easier to add more devices`Documentation/hwmon/ina2xx.rst` `drivers/hwmon/ina2xx.c`	+24 -6	0 replies
65/337	hwmon: (ina2xx) Add support for INA234`Documentation/hwmon/ina2xx.rst` `drivers/hwmon/Kconfig` `drivers/hwmon/ina2xx.c`	+31 -2	0 replies
66/337	hwmon: (ina2xx) Shift INA234 shunt and current registers`drivers/hwmon/ina2xx.c`	+19 -3	0 replies
67/337	hwmon: (ina2xx) Fix various overflow issues`drivers/hwmon/ina2xx.c`	+35 ~~-26~~	0 replies
68/337	hwmon: (ltc4282) Fix reading the minimum alarm voltage`drivers/hwmon/ltc4282.c`	+2 -2	0 replies
69/337	hwmon: (sht3x) Fix unaligned accesses`drivers/hwmon/sht3x.c`	+5 -4	0 replies
70/337	hwmon: (lm90) Only report alarms if driver is ready`drivers/hwmon/lm90.c`	+2 -2	0 replies
71/337	hwmon: (nzxt-smart2) DMA-align output buffer`drivers/hwmon/nzxt-smart2.c`	+1 -1	0 replies
72/337	net: do not send ICMP/NDISC Redirects when peer allocation fails`net/ipv4/route.c` `net/ipv6/ip6_output.c` `net/ipv6/ndisc.c`	+3 -3	0 replies
73/337	hwmon: (nct6775-core) Prevent access to unsupported weight registers`drivers/hwmon/nct6775-core.c`	+6 -6	0 replies
74/337	net: bridge: mrp: fix Option TLV length in MRP_Test frames`net/bridge/br_mrp.c`	+1 -1	0 replies
75/337	forcedeth: fix UAF of txrx_stats in nv_remove`drivers/net/ethernet/nvidia/forcedeth.c`	+2 -2	0 replies
76/337	hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors`drivers/hwmon/adt7470.c`	+29 ~~-11~~	0 replies
77/337	hwmon: (adt7470) Fix cache updated before hardware write on I2C error`drivers/hwmon/adt7470.c`	+9 -5	0 replies
78/337	hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread`drivers/hwmon/adt7470.c`	+1 -1	0 replies
79/337	hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()`drivers/hwmon/adt7470.c`	+17 -2	0 replies
80/337	hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks`drivers/hwmon/adt7470.c`	+2 -2	0 replies
81/337	hwmon: (adt7470) Use cached PWM frequency value`drivers/hwmon/adt7470.c`	+18 -2	0 replies
82/337	hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read`drivers/hwmon/adt7470.c`	+10 ~~-13~~	0 replies
83/337	hwmon: (adt7470) Fix PWM auto temp state array and bounds check`drivers/hwmon/adt7470.c`	+6 -1	0 replies
84/337	rtase: fix double free of multi-frag skb on DMA map failure`drivers/net/ethernet/realtek/rtase/rtase_main.c`	+3 -0	0 replies
85/337	powerpc/boot: Fix simpleboot CPU node lookup check`arch/powerpc/boot/simpleboot.c`	+1 -1	0 replies
86/337	powerpc/boot: Fix treeboot-currituck CPU node lookup check`arch/powerpc/boot/treeboot-currituck.c`	+1 -1	0 replies
87/337	powerpc/boot: Fix treeboot-akebono CPU node lookup check`arch/powerpc/boot/treeboot-akebono.c`	+1 -1	0 replies
88/337	net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()`net/ipv4/udp_tunnel_nic.c`	+17 ~~-15~~	0 replies
89/337	wifi: mac80211: validate individual TWT params before driver setup`net/mac80211/s1g.c`	+4 -0	0 replies
90/337	net: ethernet: mtk_eth_soc: support named IRQs`drivers/net/ethernet/mediatek/mtk_eth_soc.c`	+35 ~~-11~~	2 replies
91/337	net: ethernet: mtk_eth_soc: add consts for irq index`drivers/net/ethernet/mediatek/mtk_eth_soc.c` `drivers/net/ethernet/mediatek/mtk_eth_soc.h`	+17 ~~-12~~	0 replies
92/337	net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller`drivers/net/ethernet/mediatek/mtk_eth_soc.c`	+1 -1	0 replies
93/337	hwmon: (pmbus) Fix return value from pmbus_update_byte_data()`drivers/hwmon/pmbus/pmbus_core.c`	+1 -1	0 replies
94/337	idpf: adjust TxQ ring count minimum`drivers/net/ethernet/intel/idpf/idpf_txrx.c` `drivers/net/ethernet/intel/idpf/idpf_txrx.h`	+2 -5	0 replies
95/337	idpf: Fix mailbox IRQ name leak on request failure`drivers/net/ethernet/intel/idpf/idpf_lib.c`	+1 -1	0 replies
96/337	Bluetooth: ISO: clear iso_data always when detaching conn from hcon`net/bluetooth/iso.c`	+1 -0	0 replies
97/337	Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp`net/bluetooth/l2cap_core.c`	+5 -0	0 replies
98/337	Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos`net/bluetooth/iso.c`	+1 -1	0 replies
99/337	Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()`net/bluetooth/iso.c`	+3 -3	0 replies
100/337	Bluetooth: ISO: fix leaking sk after socket release`net/bluetooth/iso.c`	+18 -2	0 replies
101/337	Bluetooth: ISO: avoid deadlocks in iso_sock_timeout`net/bluetooth/iso.c`	+29 ~~-31~~	0 replies
102/337	Bluetooth: btintel: Validate length before parsing diagnostics TLV`drivers/bluetooth/btintel.c`	+3 -0	0 replies
103/337	Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists`net/bluetooth/hci_conn.c` `net/bluetooth/hci_sync.c`	+4 -2	0 replies
104/337	Bluetooth: hci_conn: hold conn reference in abort_conn_sync()`net/bluetooth/hci_conn.c`	+11 -1	0 replies
105/337	Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync`net/bluetooth/hci_sync.c`	+3 -1	0 replies
106/337	Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync`net/bluetooth/hci_sync.c`	+0 ~~-13~~	2 replies
107/337	net: phylink: put link_gpio if phylink_create fails`drivers/net/phy/phylink.c`	+15 ~~-14~~	0 replies
108/337	scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE`drivers/target/target_core_iblock.c`	+3 -3	0 replies
109/337	scsi: ufs: core: Cancel RTC work in active-active suspend`drivers/ufs/core/ufshcd.c`	+4 -2	0 replies
110/337	scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req`drivers/s390/scsi/zfcp_aux.c`	+1 -0	0 replies
111/337	scsi: target: Clear cmd_cnt when initial counter enrollment fails`drivers/target/target_core_transport.c`	+10 -2	0 replies
112/337	net: sxgbe: free TX rings on RX allocation failure`drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c`	+4 -5	0 replies
113/337	net: sxgbe: check descriptor ring allocation failures`drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c`	+4 -1	0 replies
114/337	can: isotp: check register_netdevice_notifier() error in module init`net/can/isotp.c`	+9 -4	0 replies
115/337	tracing/mmiotrace: Reset dropped_count in mmio_reset_data()`kernel/trace/trace_mmiotrace.c`	+1 -0	0 replies
116/337	tracing: Remove TRACE_EVENT_FL_FILTERED logic`include/linux/trace_events.h` `kernel/trace/trace.c` `kernel/trace/trace.h` +7 more	+20 ~~-78~~	0 replies
117/337	tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions`kernel/trace/trace_mmiotrace.c`	+10 -2	2 replies
118/337	accel/qaic: use sizeof(*trans_hdr) for transaction length check`drivers/accel/qaic/qaic_control.c`	+1 -1	0 replies
119/337	riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove`arch/riscv/mm/init.c`	+2 -2	0 replies
120/337	net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend`drivers/net/dsa/mt7530-mdio.c`	+9 -2	0 replies
121/337	net: dsa: mt7530: error out on failed reads in MT7531 PHY polling`drivers/net/dsa/mt7530.c`	+20 ~~-38~~	0 replies
122/337	net: libwx: fix FDIR ATR queue mismatch for software VLAN packets`drivers/net/ethernet/wangxun/libwx/wx_lib.c`	+2 -0	0 replies
123/337	octeontx2-pf: Set correct sequence for carrier off and tx queue stop`drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c`	+1 -1	0 replies
124/337	sched/deadline: Use revised wakeup rule only for running dl_server`kernel/sched/deadline.c`	+2 -1	0 replies
125/337	qede: sync udp_tunnel ports outside qede_lock in the recovery path`drivers/net/ethernet/qlogic/qede/qede_main.c`	+22 ~~-22~~	0 replies
126/337	ksmbd: return success for deferred final close`fs/smb/server/vfs_cache.c`	+3 -1	0 replies
127/337	ksmbd: fix use-after-free in __close_file_table_ids()`fs/smb/server/vfs_cache.c`	+2 -0	0 replies
128/337	rhashtable: clear stale iter->p on table restart`lib/rhashtable.c`	+1 -0	0 replies
129/337	pinctrl: microchip-sgpio: add missing select REGMAP_MMIO`drivers/pinctrl/Kconfig`	+1 -0	2 replies
130/337	pinctrl: devicetree: dont free uninitialized dev_name on error path`drivers/pinctrl/devicetree.c`	+4 -0	0 replies
131/337	erofs: cap LZMA stream pool size`fs/erofs/Kconfig` `fs/erofs/decompressor_lzma.c`	+16 -1	0 replies
132/337	pinctrl: bm1880: add missing select GENERIC_PINCONF`drivers/pinctrl/Kconfig`	+1 -0	0 replies
133/337	fortify: Disable -Wstringop-overread in tests`lib/test_fortify/Makefile`	+1 -0	0 replies
134/337	mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE`mm/migrate_device.c`	+3 -2	0 replies
135/337	fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes`fs/proc/task_mmu.c`	+18 -2	0 replies
136/337	mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()`mm/percpu-km.c`	+1 -1	0 replies
137/337	mm/hugetlb: fix list corruption in allocate_file_region_entries()`mm/hugetlb.c`	+1 -1	0 replies
138/337	mm/vmstat: fold stranded per-cpu node stats when a node comes online`mm/mm_init.c`	+11 -4	0 replies
139/337	tracing/probes: Reject $arg0 in meta argument expansion`kernel/trace/trace_probe.c`	+5 -1	0 replies
140/337	KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active`arch/x86/kvm/svm/avic.c`	+0 -8	0 replies
141/337	KVM: s390: pci: Reject adapter interrupt forwarding if already enabled`arch/s390/kvm/pci.c`	+4 -0	0 replies
142/337	KVM: s390: pci: Fix NULL dereference on AIBV allocation failure`arch/s390/kvm/pci.c`	+8 -0	0 replies
143/337	KVM: s390: pci: Validate AIBV and AISB before pinning guest pages`arch/s390/kvm/pci.c`	+15 -1	0 replies
144/337	sctp: validate Adaptation Indication parameter length`net/sctp/sm_make_chunk.c`	+6 -0	0 replies
145/337	audit: fix potential integer overflow in audit_log_n_string()`kernel/audit.c`	+9 -2	0 replies
146/337	audit: fix potential use-after-free in audit_del_rule()`kernel/auditfilter.c`	+4 -2	0 replies
147/337	Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()`drivers/bluetooth/btusb.c`	+9 ~~-21~~	0 replies
148/337	Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()`drivers/bluetooth/btmtk.c`	+22 ~~-28~~	0 replies
149/337	Bluetooth: mgmt: fix pending command UAF in EIR updates`net/bluetooth/mgmt.c`	+18 -2	0 replies
150/337	Bluetooth: mgmt: fix UAF in pair command cancellation`net/bluetooth/mgmt.c`	+46 ~~-18~~	0 replies
151/337	Bluetooth: hci_sync: Fix advertising data UAFs`net/bluetooth/hci_sync.c`	+97 ~~-34~~	0 replies
152/337	Bluetooth: HIDP: reject frames without a transaction header`net/bluetooth/hidp/core.c`	+15 ~~-10~~	0 replies
153/337	Bluetooth: HIDP: validate numbered report payloads`net/bluetooth/hidp/core.c`	+3 -2	0 replies
154/337	bpf: lwt: Fix dst reference leak on reroute failure`net/core/lwt_bpf.c`	+3 -1	0 replies
155/337	ALSA: 6fire: Fix UAF at error handling during probe`sound/usb/6fire/chip.c`	+4 -0	0 replies
156/337	ALSA: lx6464es: fix period byte count for 16-bit streams`sound/pci/lx6464es/lx6464es.c` `sound/pci/lx6464es/lx_core.c`	+2 -8	0 replies
157/337	ALSA: pcm: wake linked drain waiters on unlink`sound/core/pcm_native.c`	+7 -0	0 replies
158/337	ALSA: seq: Fix division by zero in initialize_timer()`sound/core/seq/seq_timer.c`	+4 -5	0 replies
159/337	ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes`sound/core/timer.c`	+2 -0	0 replies
160/337	ALSA: ump: fix double free of out_cvts on rawmidi error`sound/core/ump.c`	+1 -0	0 replies
161/337	ASoC: tas2562: fix DVC coefficient write order`sound/soc/codecs/tas2562.c`	+15 -8	0 replies
162/337	ASoC: tas2562: fix broken entries in the volume lookup table`sound/soc/codecs/tas2562.c`	+4 -3	0 replies
163/337	ata: libata-eh: Increase STANDBY IMMEDIATE timeout`drivers/ata/libata-eh.c` `include/linux/libata.h`	+9 -1	0 replies
164/337	ata: libata-sata: fix ata_scsi_lpm_supported() iteration`drivers/ata/libata-sata.c`	+1 -1	0 replies
165/337	ALSA: usb-audio: fix use-after-free in ump_to_endpoint()`sound/usb/midi2.c`	+3 -1	0 replies
166/337	ALSA: usb-audio: fix stack info leak in RME Digiface status`sound/usb/mixer_quirks.c`	+1 -1	0 replies
167/337	ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()`sound/usb/midi.c`	+2 -0	0 replies
168/337	ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set`sound/usb/endpoint.c`	+4 -2	0 replies
169/337	ALSA: usb-audio: Clamp frame size in implicit-feedback mode`sound/usb/endpoint.c`	+5 -3	0 replies
170/337	dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+`include/linux/dma/qcom_bam_dma.h`	+16 -5	0 replies
171/337	e1000: fix memory leak in e1000_probe()`drivers/net/ethernet/intel/e1000/e1000_main.c`	+1 -1	0 replies
172/337	igbvf: Fix leak in TX DMA error cleanup`drivers/net/ethernet/intel/igbvf/netdev.c`	+0 -2	0 replies
173/337	ipvs: do not propagate one-packet flag to synced conns`net/netfilter/ipvs/ip_vs_conn.c`	+3 -0	0 replies
174/337	net/smc: fix socket use-after-free during link group termination`net/smc/smc_core.c`	+1 -1	0 replies
175/337	netfilter: ipset: do not update comments from kernel-side hash adds`net/netfilter/ipset/ip_set_hash_gen.h`	+1 -1	0 replies
176/337	tipc: avoid use-after-free in poll trace queue dumps`net/tipc/socket.c`	+1 -1	0 replies
177/337	wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames`drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c`	+1 -1	0 replies
178/337	binfmt_misc: reject a flag character as the field delimiter`fs/binfmt_misc.c`	+4 -0	0 replies
179/337	binfmt_misc: dont let an F entry pin its own instance`fs/binfmt_misc.c`	+4 -0	0 replies
180/337	mm/page_reporting: use system_freezable_wq to fix UAF during suspend`mm/page_reporting.c`	+4 -2	0 replies
181/337	mm: memcg: initialize *locked in memcg1_oom_prepare() stub`mm/memcontrol-v1.h`	+5 -1	0 replies
182/337	net: bridge: stop fast-leave after deleting a port group`net/bridge/br_multicast.c`	+1 -0	0 replies
183/337	net: ipv6: clear suppressed fib6 rule result`net/ipv6/fib6_rules.c`	+1 -0	0 replies
184/337	powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()`arch/powerpc/platforms/ps3/mm.c`	+1 -0	0 replies
185/337	um: vector: fix use-after-free in vector_mmsg_rx()`arch/um/drivers/vector_kern.c`	+3 -0	0 replies
186/337	veth: convert frag_list skbs before running XDP`drivers/net/veth.c` `net/core/skbuff.c`	+14 -8	0 replies
187/337	vxlan: re-fetch eth header after route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+1 -0	0 replies
188/337	vxlan: unclone skb head before modifying eth header in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+4 -0	0 replies
189/337	vxlan: use neigh_ha_snapshot() in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+4 -2	0 replies
190/337	vxlan: use pskb_network_may_pull() in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+2 -2	0 replies
191/337	ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()`drivers/block/ublk_drv.c`	+9 -0	0 replies
192/337	tracing: Check return value of __register_event() in trace_module_add_events()`kernel/trace/trace_events.c`	+2 -2	0 replies
193/337	tracing/filters: Fix false positive match in regex_match_full()`kernel/trace/trace_events_filter.c`	+3 -0	0 replies
194/337	spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure`drivers/spi/spi-qcom-qspi.c`	+2 -1	0 replies
195/337	selftests/mm: fix potential wild pointer access of getline due to missing init`tools/testing/selftests/mm/mlock-random-test.c`	+1 -1	0 replies
196/337	selftests/clone3: fix wild pointer access of getline due to missing init`tools/testing/selftests/clone3/clone3_set_tid.c`	+1 -1	0 replies
197/337	scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write`drivers/scsi/scsi_debug.c`	+6 -2	0 replies
198/337	sctp: reject stale cookies with mismatched verification tags`net/sctp/sm_make_chunk.c`	+7 -4	0 replies
199/337	sctp: prevent peer transport count overflow`net/sctp/associola.c`	+3 -0	0 replies
200/337	hwmon: (npcm750-pwm-fan): stop fan timer on device detach`drivers/hwmon/npcm750-pwm-fan.c`	+11 -0	0 replies
201/337	hwmon: (pmbus/core) notify on the hwmon device, not the i2c client`drivers/hwmon/pmbus/pmbus_core.c`	+3 -2	0 replies
202/337	i2c: amd-mp2: Unregister callback on adapter add failure`drivers/i2c/busses/i2c-amd-mp2-plat.c`	+3 -1	0 replies
203/337	gpio: pca953x: fix cache_only and IRQ state on restore_context() failure`drivers/gpio/gpio-pca953x.c`	+13 -2	0 replies
204/337	cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()`drivers/cpufreq/powernow-k8.c`	+1 -0	0 replies
205/337	cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized`kernel/sched/cpufreq_schedutil.c`	+11 -0	0 replies
206/337	power: supply: bq25890: fix the -10 C NTC lookup entry`drivers/power/supply/bq25890_charger.c`	+1 -1	0 replies
207/337	power: supply: max17040: handle missing status supplier`drivers/power/supply/max17040_battery.c`	+5 -1	0 replies
208/337	s390/pci: Fix s390_pci_mmio_write syscall error return without MIO`arch/s390/pci/pci_mmio.c`	+1 -0	0 replies
209/337	s390/qeth: Check CAP_NET_ADMIN for private ioctls`drivers/s390/net/qeth_core_main.c`	+3 -0	0 replies
210/337	s390/dasd: Fix potential NULL pointer dereference`drivers/s390/block/dasd_ioctl.c`	+1 -1	0 replies
211/337	s390/dasd: Fix undersized format-check buffer`drivers/s390/block/dasd_eckd.c`	+7 -4	0 replies
212/337	s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs`drivers/s390/crypto/zcrypt_api.c`	+1 -1	0 replies
213/337	s390/zcrypt: Validate length for CCA AES cipher key requests`drivers/s390/crypto/zcrypt_ccamisc.c`	+3 -0	0 replies
214/337	s390/zcrypt: Validate length for CCA ECC private key requests`drivers/s390/crypto/zcrypt_ccamisc.c`	+3 -0	0 replies
215/337	phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask`drivers/phy/xilinx/phy-zynqmp.c`	+1 -1	0 replies
216/337	phy: zynqmp: use read-modify-write for SERDES scrambler bypass`drivers/phy/xilinx/phy-zynqmp.c`	+6 -2	0 replies
217/337	phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB`drivers/phy/xilinx/phy-zynqmp.c`	+29 ~~-10~~	0 replies
218/337	net: openvswitch: fix potential UAF on meter attach failure`net/openvswitch/meter.c`	+19 ~~-14~~	0 replies
219/337	net: openvswitch: fix skb leak on flow key update failure during recirculation`net/openvswitch/actions.c`	+9 -1	0 replies
220/337	net: openvswitch: fix skb leak on flow key update failure during ct`net/openvswitch/actions.c`	+1 -1	0 replies
221/337	ice: wait for reset completion in ice_resume()`drivers/net/ethernet/intel/ice/ice_main.c`	+10 -0	0 replies
222/337	ice: fix memory leak in ice_lbtest_prepare_rings()`drivers/net/ethernet/intel/ice/ice_ethtool.c`	+5 -5	0 replies
223/337	i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock`drivers/i2c/busses/i2c-jz4780.c`	+4 -1	0 replies
224/337	i2c: iproc: reset bus after timeout if START_BUSY is stuck`drivers/i2c/busses/i2c-bcm-iproc.c`	+11 -0	0 replies
225/337	i2c: imx: Fix slave registration race and error handling`drivers/i2c/busses/i2c-imx.c`	+5 -3	0 replies
226/337	i2c: imx: Cancel hrtimer before clearing slave pointer`drivers/i2c/busses/i2c-imx.c`	+1 -0	0 replies
227/337	can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured`drivers/net/can/c_can/c_can_main.c`	+4 -4	0 replies
228/337	can: ems_usb: validate CPC message lengths`drivers/net/can/usb/ems_usb.c`	+43 -0	0 replies
229/337	can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure`drivers/net/can/usb/etas_es58x/es58x_core.c`	+0 -1	0 replies
230/337	can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure`drivers/net/can/usb/gs_usb.c`	+2 -2	0 replies
231/337	can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer`net/can/j1939/transport.c`	+1 -1	0 replies
232/337	can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking`net/can/j1939/bus.c` `net/can/j1939/j1939-priv.h` `net/can/j1939/main.c` +1 more	+11 -4	0 replies
233/337	can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()`drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c`	+1 -0	0 replies
234/337	can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents`drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c`	+11 -2	0 replies
235/337	can: softing: fw_parse(): validate firmware record spans`drivers/net/can/softing/softing_fw.c`	+32 ~~-14~~	0 replies
236/337	can: peak_usb: add bounds check for USB channel index`drivers/net/can/usb/peak_usb/pcan_usb_pro.c`	+16 -4	0 replies
237/337	can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error`drivers/net/can/usb/peak_usb/pcan_usb_core.c`	+0 -1	0 replies
238/337	can: peak_usb: validate uCAN receive record lengths`drivers/net/can/usb/peak_usb/pcan_usb_fd.c`	+39 -1	0 replies
239/337	can: ctucanfd: add missing MODULE_DEVICE_TABLE()`drivers/net/can/ctucanfd/ctucanfd_pci.c`	+1 -0	0 replies
240/337	can: ctucanfd: use self-test mode for PRESUME_ACK`drivers/net/can/ctucanfd/ctucanfd_base.c`	+2 -2	0 replies
241/337	can: ctucanfd: unmap BAR0 using base address`drivers/net/can/ctucanfd/ctucanfd_pci.c`	+1 -1	0 replies
242/337	can: ctucanfd: handle bus error interrupts`drivers/net/can/ctucanfd/ctucanfd_base.c`	+6 -2	0 replies
243/337	can: ctucanfd: mark error-active controller status valid`drivers/net/can/ctucanfd/ctucanfd_base.c`	+1 -1	0 replies
244/337	drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs`drivers/gpu/drm/display/drm_dp_helper.c`	+12 -0	0 replies
245/337	drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size`drivers/gpu/drm/vc4/vc4_irq.c`	+1 -1	0 replies
246/337	drm/vc4: Zero the tile state data array before each BIN job`drivers/gpu/drm/vc4/vc4_validate.c`	+23 -6	0 replies
247/337	drm/panthor: reject firmware sections with oversized data`drivers/gpu/drm/panthor/panthor_fw.c`	+9 -2	0 replies
248/337	drm/panthor: validate firmware interface structure sizes`drivers/gpu/drm/panthor/panthor_fw.c`	+24 ~~-12~~	0 replies
249/337	drm/mediatek: ovl_adaptor: balance component registrations`drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c`	+6 -1	0 replies
250/337	drm/amdgpu: restore UMD profile pstate after runtime resume`drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c`	+15 -0	0 replies
251/337	drm/amdgpu: cap GTT size to physical RAM on APUs`drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c`	+12 -0	0 replies
252/337	drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames`drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c`	+11 -5	0 replies
253/337	drm/amd/display: use proper context for logging`drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c`	+9 ~~-11~~	0 replies
254/337	drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE`drivers/gpu/drm/amd/amdkfd/kfd_chardev.c`	+7 -3	0 replies
255/337	drm/amdkfd: fix QID bit leak in pqm_create_queue()`drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c`	+1 -1	0 replies
256/337	drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment`drivers/gpu/drm/amd/amdkfd/kfd_queue.c`	+1 -1	0 replies
257/337	drm/amdkfd: Handle invalid event type in CRIU event restore`drivers/gpu/drm/amd/amdkfd/kfd_events.c`	+3 -0	0 replies
258/337	drm/amdkfd: hold event_mutex while checkpointing CRIU events`drivers/gpu/drm/amd/amdkfd/kfd_events.c`	+18 -4	0 replies
259/337	drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size`drivers/gpu/drm/vmwgfx/vmwgfx_resource.c`	+2 -2	0 replies
260/337	drm/vmwgfx: reject DX_BIND_QUERY without a DX context`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+5 -1	0 replies
261/337	drm/vmwgfx: drop dma_buf reference on foreign-fd prime import`drivers/gpu/drm/vmwgfx/ttm_object.c`	+5 -2	0 replies
262/337	drm/vmwgfx: validate DRAW_PRIMITIVES header size before division`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+7 -1	0 replies
263/337	drm/vmwgfx: bound DMA command body size against suffix pointer`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+6 -0	0 replies
264/337	drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure`drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c`	+9 -8	0 replies
265/337	drm/vmwgfx: use check_add_overflow for shader size+offset bound`drivers/gpu/drm/vmwgfx/vmwgfx_shader.c`	+9 -4	0 replies
266/337	drm/vmwgfx: validate external BO copy bounds for both stride paths`drivers/gpu/drm/vmwgfx/vmwgfx_blit.c`	+31 -8	0 replies
267/337	spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX`drivers/spi/spi-cadence.c`	+1 -0	0 replies
268/337	HID: logitech-dj: Fix maxfield check in DJ short report validation`drivers/hid/hid-logitech-dj.c`	+7 -2	0 replies
269/337	ata: libahci_platform: Do not set mask_port_map when not needed`drivers/ata/libahci_platform.c`	+0 -2	0 replies
270/337	ata: ahci: Make ahci_ignore_port() handle empty mask_port_map`drivers/ata/ahci.h` `drivers/ata/libahci.c`	+7 -2	0 replies
271/337	of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails`drivers/of/of_reserved_mem.c`	+19 -9	0 replies
272/337	Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release`net/bluetooth/iso.c`	+20 -6	0 replies
273/337	drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting`drivers/gpu/drm/xe/xe_reg_whitelist.c`	+13 ~~-16~~	0 replies
274/337	drm/xe: Introduce xe_gt_dbg_printer()`drivers/gpu/drm/xe/xe_gt_printk.h`	+31 -0	0 replies
275/337	drm/xe: Apply whitelist to engine save-restore`drivers/gpu/drm/xe/xe_gt.c` `drivers/gpu/drm/xe/xe_hw_engine.c` `drivers/gpu/drm/xe/xe_reg_sr.c` +1 more	+38 ~~-57~~	0 replies
276/337	drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists`drivers/gpu/drm/xe/xe_reg_whitelist.c`	+5 -3	0 replies
277/337	drm/xe/rtp: Maintain OA whitelists separately`drivers/gpu/drm/xe/xe_gt_debugfs.c` `drivers/gpu/drm/xe/xe_hw_engine.c` `drivers/gpu/drm/xe/xe_hw_engine_types.h` +1 more	+19 -1	0 replies
278/337	drm/xe/rtp: Keep track of non-OA nonpriv slots`drivers/gpu/drm/xe/xe_reg_whitelist.c`	+5 -2	0 replies
279/337	drm/xe/rtp: Generalize whitelist_apply_to_hwe`drivers/gpu/drm/xe/xe_reg_whitelist.c`	+6 -5	0 replies
280/337	drm/xe/rtp: Save OA nonpriv registers to register save/restore lists`drivers/gpu/drm/xe/xe_reg_whitelist.c`	+12 -0	0 replies
281/337	drm/xe/rtp: Toggle deny bit to (de-)whitelist OA regs`drivers/gpu/drm/xe/xe_reg_whitelist.c`	+15 -0	0 replies
282/337	drm/xe/rtp: (De-)whitelist OA registers for all hwes for a gt`drivers/gpu/drm/xe/xe_reg_whitelist.c` `drivers/gpu/drm/xe/xe_reg_whitelist.h`	+36 -2	0 replies
283/337	drm/xe/oa: (De-)whitelist OA registers on OA stream open/release`drivers/gpu/drm/xe/xe_oa.c`	+7 -0	0 replies
284/337	drm/xe/rtp: Ensure locking/ref counting for OA whitelists`drivers/gpu/drm/xe/xe_oa_types.h` `drivers/gpu/drm/xe/xe_reg_whitelist.c`	+13 -0	0 replies
285/337	mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()`mm/hugetlb.c`	+7 -3	0 replies
286/337	fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes`fs/proc/task_mmu.c`	+13 -0	0 replies
287/337	mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios`mm/huge_memory.c`	+14 -2	0 replies
288/337	lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()`include/linux/alloc_tag.h` `lib/alloc_tag.c`	+12 -0	0 replies
289/337	mm/slab: prevent unbounded recursion in free path with new kmalloc type`include/linux/slab.h` `mm/slab.h` `mm/slab_common.c` +1 more	+69 ~~-14~~	3 replies
290/337	gpio: pch: use raw_spinlock_t for the register lock`drivers/gpio/gpio-pch.c`	+14 ~~-14~~	0 replies
291/337	usb: gadget: f_tcm: synchronize delayed set_alt with teardown`drivers/usb/gadget/function/f_tcm.c` `drivers/usb/gadget/function/tcm.h`	+177 ~~-28~~	0 replies
292/337	usb: typec: ucsi: split connector lock classes`drivers/usb/typec/ucsi/ucsi.c` `drivers/usb/typec/ucsi/ucsi.h`	+9 -0	0 replies
293/337	usb: typec: ucsi: Fix race condition and ordering in port unregistration`drivers/usb/typec/ucsi/ucsi.c`	+39 ~~-43~~	0 replies
294/337	media: i2c: imx219: Rename VTS to FRM_LENGTH`drivers/media/i2c/imx219.c`	+15 ~~-16~~	0 replies
295/337	media: imx219: Fix maximum frame length in lines`drivers/media/i2c/imx219.c`	+1 -1	0 replies
296/337	media: chips-media: wave5: Support CBP profile`drivers/media/platform/chips-media/wave5/wave5-hw.c` `drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c` `drivers/media/platform/chips-media/wave5/wave5-vpuapi.h`	+8 -1	0 replies
297/337	media: uapi: rkisp: Correct name version enum`include/uapi/linux/rkisp1-config.h`	+3 -3	0 replies
298/337	wifi: brcmfmac: drain bus_reset work on device removal`drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c` `drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h` `drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c` +4 more	+77 -4	0 replies
299/337	wifi: ath6kl: fix use-after-free in aggr_reset_state()`drivers/net/wireless/ath/ath6kl/txrx.c`	+1 -1	0 replies
300/337	wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)`drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c` `drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c` `drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c` +2 more	+9 -9	0 replies
301/337	wifi: brcmfmac: set F2 blocksize to 256 for BCM43752`drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c`	+1 -0	0 replies
302/337	ALSA: hda: codecs: hdmi: disable keep-alive before audio format change`sound/pci/hda/patch_hdmi.c`	+42 -6	0 replies
303/337	mptcp: pm: avoid code duplication to lookup endp`net/mptcp/pm_netlink.c`	+6 ~~-14~~	0 replies
304/337	mptcp: add mptcp_userspace_pm_lookup_addr helper`net/mptcp/pm_userspace.c`	+36 ~~-35~~	0 replies
305/337	mptcp: pm: use addr entry for get_local_id`net/mptcp/pm.c` `net/mptcp/pm_netlink.c` `net/mptcp/pm_userspace.c` +1 more	+20 ~~-23~~	0 replies
306/337	mptcp: pm: userspace: fix use-after-free in get_local_id`net/mptcp/pm_userspace.c`	+5 -2	0 replies
307/337	kmemleak: iommu/iova: fix transient kmemleak false positive`Documentation/dev-tools/kmemleak.rst` `drivers/iommu/iova.c` `include/linux/kmemleak.h` +1 more	+50 -0	0 replies
308/337	mm/kmemleak: fix checksum computation for per-cpu objects`mm/kmemleak.c`	+4 -3	0 replies
309/337	drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions`drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c`	+28 -2	0 replies
310/337	drm/amdgpu: Fix context pstate override handling`drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c`	+42 ~~-29~~	0 replies
311/337	drm/sched: Store the drm client_id in drm_sched_fence`drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c` `drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c` `drivers/gpu/drm/amd/amdgpu/amdgpu_job.c` +20 more	+60 ~~-32~~	0 replies
312/337	drm/amdgpu: give each kernel job a unique id`drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c` `drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c` `drivers/gpu/drm/amd/amdgpu/amdgpu_job.c` +16 more	+84 ~~-41~~	0 replies
313/337	drm/amdgpu/gfx: fix cleaner shader IB buffer overflow`drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c`	+5 -5	0 replies
314/337	drm/fb-helper: Allocate and release fb_info in single place`drivers/gpu/drm/armada/armada_fbdev.c` `drivers/gpu/drm/drm_fb_helper.c` `drivers/gpu/drm/drm_fbdev_dma.c` +10 more	+26 ~~-144~~	0 replies
315/337	drm/tegra: fbdev: Remove offset into framebuffer memory`drivers/gpu/drm/tegra/fbdev.c`	+2 -6	0 replies
316/337	drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]`drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c` `drivers/gpu/drm/drm_exec.c` `drivers/gpu/drm/drm_gpuvm.c` +2 more	+19 ~~-22~~	0 replies
317/337	drm/xe: Wait on external BO kernel fences in exec IOCTL`drivers/gpu/drm/xe/xe_exec.c`	+16 -6	0 replies
318/337	drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()`drivers/gpu/drm/i915/display/intel_vrr.c`	+4 -2	0 replies
319/337	drm/i915/vrr: require valid min/max vfreq for VRR`drivers/gpu/drm/i915/display/intel_vrr.c`	+4 -0	0 replies
320/337	drm/xe: Rename ___xe_bo_create_locked()`drivers/gpu/drm/xe/xe_bo.c` `drivers/gpu/drm/xe/xe_bo.h` `drivers/gpu/drm/xe/xe_dma_buf.c`	+18 ~~-18~~	0 replies
321/337	drm/xe: Hold a dma-buf reference for imported BOs`drivers/gpu/drm/xe/xe_bo.c` `drivers/gpu/drm/xe/xe_bo.h` `drivers/gpu/drm/xe/xe_bo_types.h` +1 more	+19 -4	0 replies
322/337	drm/i915/hdcp: Move to using intel_display in intel_hdcp`drivers/gpu/drm/i915/display/intel_hdcp.c` `drivers/gpu/drm/i915/display/intel_hdcp_gsc.c` `drivers/gpu/drm/i915/display/intel_hdcp_gsc.h` +2 more	+361 ~~-348~~	0 replies
323/337	drm/i915/hdcp: require monotonically increasing seq_num_v`drivers/gpu/drm/i915/display/intel_hdcp.c`	+4 -3	0 replies
324/337	drm/i915/hdcp: Skip inactive MST connectors when building stream list`drivers/gpu/drm/i915/display/intel_hdcp.c`	+6 -0	0 replies
325/337	drm/i915/hdcp: check streams[] bounds before overflow`drivers/gpu/drm/i915/display/intel_hdcp.c`	+4 -1	0 replies
326/337	drm/xe: Stub out new pagefault layer`drivers/gpu/drm/xe/Makefile` `drivers/gpu/drm/xe/xe_pagefault.c` `drivers/gpu/drm/xe/xe_pagefault.h` +1 more	+221 -0	0 replies
327/337	drm/xe/pt: Reset current_op in xe_pt_update_ops_init()`drivers/gpu/drm/xe/xe_pt.c`	+3 -0	0 replies
328/337	rxrpc: Generate rtt_min`lib/win_minmax.c` `net/rxrpc/ar-internal.h` `net/rxrpc/rtt.c`	+19 -4	0 replies
329/337	rxrpc: Adjust the rxrpc_rtt_rx tracepoint`include/trace/events/rxrpc.h` `net/rxrpc/input.c` `net/rxrpc/rtt.c`	+13 -7	0 replies
330/337	rxrpc: Fix the calculation and use of RTO`net/rxrpc/call_event.c` `net/rxrpc/rtt.c`	+3 -2	0 replies
331/337	rxrpc: Manage RTT per-call rather than per-peer`include/trace/events/rxrpc.h` `net/rxrpc/ar-internal.h` `net/rxrpc/call_event.c` +7 more	+97 ~~-95~~	0 replies
332/337	rxrpc: Fix irq-disabled in local_bh_enable()`net/rxrpc/ar-internal.h` `net/rxrpc/call_accept.c` `net/rxrpc/peer_object.c`	+9 -5	0 replies
333/337	can: use skb hash instead of private variable in headroom`drivers/net/can/dev/skb.c` `include/linux/can/core.h` `include/linux/can/skb.h` +6 more	+15 ~~-19~~	0 replies
334/337	can: isotp: fix timer drain order, wakeup handling and tx_gen ordering`net/can/isotp.c`	+230 ~~-87~~	0 replies
335/337	usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path`drivers/usb/typec/ucsi/ucsi.c`	+2 -2	0 replies
336/337	drm/fb-helper: Fix a locking bug in an error path`drivers/gpu/drm/drm_fb_helper.c`	+3 -1	0 replies
337/337	drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info`drivers/gpu/drm/tegra/fbdev.c`	+0 -1	0 replies

Reviews trailers per patch

196 of 336 patches have a Reviewed-by or Acked-by.

Patch	Ido Schimmel	Lorenzo Bianconi	Eduard Zingerman	Simon Horman	Maulik Shah	Linus Walleij	Konrad Dybcio	Jernej Skrabec	Frank Li	Wolfram Sang	Dave Jiang	Vinicius Costa Gomes	Hans de Goede	Andy Shevchenko	David Gow	Ilya Maximets	Michal Simek	CK Hu	Michael Kelley	David Gstir	Richard Weinberger	Jarkko Sakkinen	Talha Berk Arslan	Allison Henderson	Chris Leech	John Garry	Radhey Shyam Pandey	Tzung-Bi Shih	Bence Csókás	Jens Almer	Jonas Rebmann	Johannes Thumshirn	Naohiro Aota	Niklas Cassel	Vadim Fedorenko	Zhu Yanjun	Jacob Keller	Justin Lai	Ritesh Harjani (IBM)	Daniel Golle	Aleksandr Loktionov	Samuel Salin	Andrew Lunn	Mike Christie	Peter Wang	Bean Huo	Bart Van Assche	M Nikhil	Chinmaya Kajagar	Nihar Panda	Jeff Hugo	Nikolay Aleksandrov	Balbir Singh	Zi Yan	Muhammad Usama Anjum	David Hildenbrand (Arm)	Dennis Zhou	Muchun Song	Christian Borntraeger	Matthew Rosato	Juri Lelli	Andrea Righi	Xin Long	Ren Wei	Shuangpeng Bai	NeilBrown	Gao Xiang	Lakshmi Sowjanya D	Dmitry Baryshkov	David Rientjes	Michael S. Tsirkin	Joshua Hahn	Johannes Weiner	SeongJae Park	Shakeel Butt	Geert Uytterhoeven	Toke Høiland-Jørgensen	Dima Ruinskiy	Caleb Sander Mateos	Lorenzo Stoakes	Damien Le Moal	Viresh Kumar	Zhongqiu Han	Christian Loehle	Julian Ruess	Farhan Ali	Julian Anastasov	Alexandra Winter	Eduard Shishkin	Stefan Haberland	Jan Höppner	Finn Callies	Harald Freudenberger	Mahanta Jambigi	Jozsef Kadlecsik	Tung Nguyen	Carlos Song	Vincent Mailhol	Oleksij Rempel	Eelco Chaudron	Pavel Pisa	Ankit Nautiyal	Maíra Canal	Iago Toral Quiroga	Aaron Conole	Steven Price	Boris Brezillon	Hawking Zhang	Yang Wang	David Francis	Wayne Lin	Dan Wheeler	Bhawanpreet Lakha	Kent Russell	Alysa Liu	Ian Forbes	Kohei Enju	Przemek Kitszel	Alexander Nowlin	Rinitha S	Ray Jui	Lucas De Marchi	Matt Roper	Umesh Nerlige Ramappa	Baolin Wang	Miaohe Lin	Suren Baghdasaryan	Heikki Krogerus	Benson Leung	Dave Stevenson	Laurent Pinchart	Brandon Brnich	Nicolas Dufresne	Arend van Spriel	Vasanthakumar Thiagarajan	Alexander Kaplan	Matthieu Baerts (NGI0)	Xuanqiang Luo	Robin Murphy	Pavel Tikhomirov	Christian König	Klaus Kudielka	Josua Mayer	Marek Szyprowski	Alex Deucher	Thomas Hellström	Jani Nikula	Suraj Kandpal	Santhosh Reddy Guddati	Francois Dugast	Matthew Brost	Lijo Lazar	Jeffrey Altman	Chaitanya Kumar Borah	Thomas Zimmermann	Javier Martinez Canillas	Matthew Auld	Pavel Machek (CIP)	Shuah Khan	Peter Schneider	Brett A C Sheffield	Harshit Mogalapalli	Ron Economos	Miguel Ojeda	Mark Brown	Florian Fainelli
Series																T-b																																																																																																																																														T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b
2/337
3/337
4/337
5/337
6/337
7/337
8/337														R-b T-b
9/337															R-b
10/337
11/337	R-b
12/337		A-b
13/337
14/337
15/337
16/337
17/337			A-b
18/337				R-b
19/337
20/337					R-b	R-b	R-b
21/337
22/337								A-b	R-b
23/337											R-b	A-b
24/337										R-b
25/337
26/337													R-b
27/337																																		R-b
28/337
29/337
30/337
31/337
32/337
33/337																																R-b
34/337																																	R-b
35/337																	A-b
36/337																	R-b
37/337																	R-b
38/337
39/337																		R-b
40/337																			R-b
41/337																				R-b	R-b	R-b T-b
42/337																						R-b T-b
43/337																						R-b T-b
44/337																						R-b T-b
45/337
46/337																							Reported-and-tested-by
47/337
48/337
49/337
50/337
51/337																								R-b
52/337																								R-b
53/337
54/337																									A-b
55/337																									A-b
56/337																										R-b
57/337
58/337
59/337																											R-b
60/337
61/337																												R-b
62/337																												R-b
63/337
64/337																													R-b	T-b
65/337																													R-b	T-b	T-b
66/337
67/337
68/337
69/337
70/337
71/337
72/337	R-b
73/337
74/337																																																				A-b
75/337																																			R-b	R-b
76/337
77/337
78/337
79/337
80/337
81/337
82/337
83/337
84/337																																					R-b	R-b
85/337																																							R-b
86/337																																							R-b
87/337																																							R-b
88/337
89/337
90/337				R-b
91/337				R-b																																				R-b
92/337
93/337
94/337																																									R-b	T-b
95/337																																									R-b	T-b
96/337
97/337
98/337
99/337
100/337
101/337
102/337
103/337
104/337
105/337
106/337
107/337																																											R-b
108/337																																												R-b
109/337																																													R-b	R-b	R-b
110/337																																																T-b A-b	R-b	R-b
111/337																																												R-b
112/337																																			R-b
113/337																																			R-b
114/337
115/337
116/337
117/337
118/337																																																			R-b
119/337
120/337																																											R-b
121/337																																											R-b
122/337				R-b
123/337				R-b
124/337																																																													A-b	T-b
125/337																																					R-b
126/337
127/337
128/337																																																																		R-b
129/337														R-b
130/337
131/337																																																																			R-b
132/337
133/337
134/337																																																					R-b	A-b
135/337																																																							T-b	A-b
136/337																																																									A-b
137/337																																																										R-b
138/337
139/337
140/337
141/337																																																											R-b	R-b T-b
142/337																																																											R-b	R-b T-b
143/337																																																											R-b	R-b T-b
144/337																																																															A-b
145/337
146/337
147/337
148/337
149/337
150/337																																																																R-b
151/337
152/337
153/337
154/337
155/337																																																																	Reported-and-tested-by
156/337
157/337
158/337
159/337
160/337
161/337
162/337
163/337
164/337
165/337
166/337
167/337
168/337
169/337
170/337									R-b																																																											T-b	R-b
171/337																																																																														R-b
172/337
173/337																																																																																							A-b
174/337																																																																																														R-b
175/337																																																																																															A-b
176/337																																																																																																R-b
177/337
178/337
179/337
180/337																																																								A-b														A-b	A-b
181/337																																																																								R-b	A-b	R-b	A-b
182/337																																																				A-b
183/337	R-b
184/337																																							R-b																																					R-b
185/337
186/337		A-b																																																																											R-b
187/337																																			R-b
188/337
189/337																																			R-b
190/337																																			R-b
191/337																																																																															R-b
192/337
193/337
194/337
195/337																																																								A-b																								R-b
196/337																																																								A-b																								R-b
197/337																																															R-b																																		R-b
198/337																																																															A-b
199/337																																																															A-b
200/337
201/337
202/337
203/337						R-b
204/337																																																																																		A-b	R-b
205/337																																																																																				R-b
206/337
207/337
208/337																																																																																					R-b	R-b
209/337																																																											R-b																													R-b
210/337																																																																																									A-b	R-b
211/337																																																																																											R-b
212/337																																																																																												R-b
213/337																																																																																													R-b
214/337																																																																																													R-b
215/337																	A-b
216/337																	A-b
217/337																	A-b
218/337																																																																																																				R-b
219/337																																																																																																									R-b
220/337																																																																																																									R-b
221/337																																									R-b																																																																												R-b	R-b	T-b
222/337																																					R-b																																																																																			T-b
223/337
224/337																																																																																																																									A-b
225/337									R-b																																																																																								A-b
226/337									R-b																																																																																								A-b
227/337
228/337
229/337																																																																																																		R-b
230/337
231/337
232/337																																																																																																			A-b
233/337
234/337
235/337
236/337																																																																																																		R-b
237/337																																																																																																		R-b
238/337
239/337																																																																																																					A-b
240/337																																																																																																					A-b
241/337																																																																																																					A-b
242/337																																																																																																					A-b
243/337
244/337																																																																																																						R-b
245/337																																																																																																							R-b	R-b
246/337																																																																																																								R-b
247/337																																																																																																										R-b	R-b
248/337																																																																																																										R-b
249/337																		R-b
250/337																																																																																																												R-b	R-b
251/337																																																																																																														R-b
252/337																																																																																																															R-b	T-b
253/337																																																																																																																	R-b
254/337																																																																																																																		R-b
255/337																																																																																																																		R-b
256/337																																																																																																																			R-b
257/337																																																																																																																		R-b
258/337																																																																																																																			R-b
259/337																																																																																																																				R-b
260/337																																																																																																																				R-b
261/337																																																																																																																				R-b
262/337																																																																																																																				R-b
263/337																																																																																																																				R-b
264/337																																																																																																																				R-b
265/337																																																																																																																				R-b
266/337																																																																																																																				R-b
267/337
268/337
269/337																																																																																																																																														T-b	A-b
270/337																																																																																																																																																T-b
271/337
272/337
273/337																																																																																																																												R-b
274/337																																																																																																																										R-b
275/337																																																																																																																											R-b
276/337																																																																																																																												R-b
277/337																																																																																																																												R-b
278/337																																																																																																																												R-b
279/337																																																																																																																												R-b
280/337																																																																																																																												R-b
281/337																																																																																																																												R-b
282/337																																																																																																																												R-b
283/337																																																																																																																												R-b
284/337																																																																																																																												R-b
285/337																																																								A-b
286/337
287/337																																																						R-b		A-b																																																																					R-b	R-b
288/337																																																																																																																															A-b
289/337																																																																																																																															R-b
290/337						R-b
291/337
292/337																																																																																																																																R-b
293/337																																																																																																																																	R-b
294/337																																																																																																																																		R-b
295/337																																																																																																																																		R-b	R-b
296/337																																																																																																																																				T-b	R-b
297/337																																																																																																																																			R-b
298/337																																																																																																																																						A-b
299/337																																																																																																																																							R-b
300/337																																																																																																																																						A-b
301/337																																																																																																																																						A-b
302/337																																																																																																																																								T-b
303/337
304/337																																																																																																																																									R-b
305/337																																																																																																																																									R-b
306/337																																																																																																																																									R-b	T-b
307/337	T-b																																																																																																																																										A-b
308/337																																																																																																																																												R-b
309/337																																																																																																																																													R-b
310/337
311/337																																																																																																																																													R-b
312/337																																																																																																																																																	A-b
313/337																																																																																																																																																								R-b
314/337																																																																					A-b																																																																								A-b															A-b
315/337
316/337																																																																																																																																													R-b
317/337																																																																																																																																																													R-b
318/337																																																																																																						R-b
319/337																																																																																																						R-b
320/337																																																																																																																																																							R-b
321/337																																																																																																																																																		R-b
322/337																																																																																																																																																			R-b
323/337																																																																																																																																																				R-b
324/337																																																																																																																																																					R-b
325/337																																																																																																																																																				R-b
326/337																																																																																																																										R-b																												T-b
327/337																																																																																																																																																							R-b
328/337
329/337
330/337
331/337
332/337																																																																																																																																																									R-b
333/337
334/337
335/337																																																																																																																																R-b																										T-b
336/337																																																																																																																																																											R-b
337/337

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 166 reviewers.

Read the v1 thread

Cover letter [PATCH 6.12 000/337] 6.12.103-rc1 review

This is the start of the stable review cycle for the 6.12.103 release. There are 337 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.103-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.12.103-rc1

Thomas Zimmermann <[email protected]>
drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info

Bart Van Assche <[email protected]>
drm/fb-helper: Fix a locking bug in an error path

Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path

Oliver Hartkopp <[email protected]>
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering

Oliver Hartkopp <[email protected]>
can: use skb hash instead of private variable in headroom

David Howells <[email protected]>
rxrpc: Fix irq-disabled in local_bh_enable()

David Howells <[email protected]>
rxrpc: Manage RTT per-call rather than per-peer

David Howells <[email protected]>
rxrpc: Fix the calculation and use of RTO

David Howells <[email protected]>
rxrpc: Adjust the rxrpc_rtt_rx tracepoint

David Howells <[email protected]>
rxrpc: Generate rtt_min

Zongyao Bai <[email protected]>
drm/xe/pt: Reset current_op in xe_pt_update_ops_init()

Matthew Brost <[email protected]>
drm/xe: Stub out new pagefault layer

Jani Nikula <[email protected]>

    drm/i915/hdcp: check streams[] bounds before overflow

Suraj Kandpal <[email protected]>
drm/i915/hdcp: Skip inactive MST connectors when building stream list

Jani Nikula <[email protected]>
drm/i915/hdcp: require monotonically increasing seq_num_v

Suraj Kandpal <[email protected]>
drm/i915/hdcp: Move to using intel_display in intel_hdcp

Nitin Gote <[email protected]>
drm/xe: Hold a dma-buf reference for imported BOs

Thomas Hellström <[email protected]>

    drm/xe: Rename ___xe_bo_create_locked()

Jani Nikula <[email protected]>
drm/i915/vrr: require valid min/max vfreq for VRR

Ville Syrjälä <[email protected]>
drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()

Matthew Brost <[email protected]>
drm/xe: Wait on external BO kernel fences in exec IOCTL

Thomas Hellström <[email protected]>
drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]

Thomas Zimmermann <[email protected]>
drm/tegra: fbdev: Remove offset into framebuffer memory

Thomas Zimmermann <[email protected]>
drm/fb-helper: Allocate and release fb_info in single place

Asad Kamal <[email protected]>
drm/amdgpu/gfx: fix cleaner shader IB buffer overflow

Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: give each kernel job a unique id

Pierre-Eric Pelloux-Prayer <[email protected]>
drm/sched: Store the drm client_id in drm_sched_fence

Tvrtko Ursulin <[email protected]>
drm/amdgpu: Fix context pstate override handling

Timur Kristóf <[email protected]>
drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions

Breno Leitao <[email protected]>
mm/kmemleak: fix checksum computation for per-cpu objects

Catalin Marinas <[email protected]>
kmemleak: iommu/iova: fix transient kmemleak false positive

Geliang Tang <[email protected]>
mptcp: pm: userspace: fix use-after-free in get_local_id

Geliang Tang <[email protected]>
mptcp: pm: use addr entry for get_local_id

Geliang Tang <[email protected]>
mptcp: add mptcp_userspace_pm_lookup_addr helper

Geliang Tang <[email protected]>
mptcp: pm: avoid code duplication to lookup endp

Kai Vehmanen <[email protected]>
ALSA: hda: codecs: hdmi: disable keep-alive before audio format change

LiangCheng Wang <[email protected]>
wifi: brcmfmac: set F2 blocksize to 256 for BCM43752

Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)

Daniel Hodges <[email protected]>
wifi: ath6kl: fix use-after-free in aggr_reset_state()

Fan Wu <[email protected]>
wifi: brcmfmac: drain bus_reset work on device removal

Niklas Söderlund <[email protected]>
media: uapi: rkisp: Correct name version enum

Jackson Lee <[email protected]>
media: chips-media: wave5: Support CBP profile

Sakari Ailus <[email protected]>
media: imx219: Fix maximum frame length in lines

Jai Luthra <[email protected]>
media: i2c: imx219: Rename VTS to FRM_LENGTH

Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Fix race condition and ordering in port unregistration

Sergey Senozhatsky <[email protected]>
usb: typec: ucsi: split connector lock classes

Cen Zhang <[email protected]>
usb: gadget: f_tcm: synchronize delayed set_alt with teardown

Junjie Cao <[email protected]>
gpio: pch: use raw_spinlock_t for the register lock

Harry Yoo (Oracle) <[email protected]>
mm/slab: prevent unbounded recursion in free path with new kmalloc type

Harry Yoo (Oracle) <[email protected]>
lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()

Kiryl Shutsemau (Meta) <[email protected]>
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

Kiryl Shutsemau (Meta) <[email protected]>
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes

Kiryl Shutsemau (Meta) <[email protected]>
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Ensure locking/ref counting for OA whitelists

Ashutosh Dixit <[email protected]>
drm/xe/oa: (De-)whitelist OA registers on OA stream open/release

Ashutosh Dixit <[email protected]>
drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Save OA nonpriv registers to register save/restore lists

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Generalize whitelist_apply_to_hwe

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Keep track of non-OA nonpriv slots

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Maintain OA whitelists separately

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists

Lucas De Marchi <[email protected]>
drm/xe: Apply whitelist to engine save-restore

Michal Wajdeczko <[email protected]>
drm/xe: Introduce xe_gt_dbg_printer()

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting

Pauli Virtanen <[email protected]>

    Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release

Wandun Chen <[email protected]>
of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails

Niklas Cassel <[email protected]>
ata: ahci: Make ahci_ignore_port() handle empty mask_port_map

Damien Le Moal <[email protected]>
ata: libahci_platform: Do not set mask_port_map when not needed

HyeongJun An <[email protected]>
HID: logitech-dj: Fix maxfield check in DJ short report validation

Jun Guo <[email protected]>
spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX

Zack Rusin <[email protected]>
drm/vmwgfx: validate external BO copy bounds for both stride paths

Zack Rusin <[email protected]>
drm/vmwgfx: use check_add_overflow for shader size+offset bound

Zack Rusin <[email protected]>
drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure

Zack Rusin <[email protected]>
drm/vmwgfx: bound DMA command body size against suffix pointer

Zack Rusin <[email protected]>
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

Zack Rusin <[email protected]>
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

Zack Rusin <[email protected]>
drm/vmwgfx: reject DX_BIND_QUERY without a DX context

Zack Rusin <[email protected]>
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size

William Palacek <[email protected]>
drm/amdkfd: hold event_mutex while checkpointing CRIU events

David Francis <[email protected]>
drm/amdkfd: Handle invalid event type in CRIU event restore

William Palacek <[email protected]>
drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment

Vladimir Marioukhine <[email protected]>
drm/amdkfd: fix QID bit leak in pqm_create_queue()

Gang Ba <[email protected]>
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE

Jiri Slaby (SUSE) <[email protected]>
drm/amd/display: use proper context for logging

Ray Wu <[email protected]>
drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames

Harkirat Gill <[email protected]>
drm/amdgpu: cap GTT size to physical RAM on APUs

Candice Li <[email protected]>
drm/amdgpu: restore UMD profile pstate after runtime resume

Myeonghun Pak <[email protected]>
drm/mediatek: ovl_adaptor: balance component registrations

Osama Abdelkader <[email protected]>
drm/panthor: validate firmware interface structure sizes

Osama Abdelkader <[email protected]>
drm/panthor: reject firmware sections with oversized data

Maíra Canal <[email protected]>
drm/vc4: Zero the tile state data array before each BIN job

Jose Maria Casanova Crespo <[email protected]>
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size

Alexander Kaplan <[email protected]>
drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs

Avi Weiss <[email protected]>
can: ctucanfd: mark error-active controller status valid

Avi Weiss <[email protected]>
can: ctucanfd: handle bus error interrupts

Avi Weiss <[email protected]>
can: ctucanfd: unmap BAR0 using base address

Avi Weiss <[email protected]>
can: ctucanfd: use self-test mode for PRESUME_ACK

Pengpeng Hou <[email protected]>
can: ctucanfd: add missing MODULE_DEVICE_TABLE()

Pengpeng Hou <[email protected]>
can: peak_usb: validate uCAN receive record lengths

Maoyi Xie <[email protected]>
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

James Gao <[email protected]>
can: peak_usb: add bounds check for USB channel index

Pengpeng Hou <[email protected]>
can: softing: fw_parse(): validate firmware record spans

Pengpeng Hou <[email protected]>
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

Abdun Nihaal <[email protected]>
can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()

Tetsuo Handa <[email protected]>
can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking

Oleksij Rempel <[email protected]>
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer

Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure

Guangshuo Li <[email protected]>
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure

Pengpeng Hou <[email protected]>
can: ems_usb: validate CPC message lengths

Lucas Martins Alves <[email protected]>
can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured

Liem <[email protected]>
i2c: imx: Cancel hrtimer before clearing slave pointer

Liem <[email protected]>
i2c: imx: Fix slave registration race and error handling

Jonas Gorski <[email protected]>
i2c: iproc: reset bus after timeout if START_BUSY is stuck

H. Nikolaus Schaller <[email protected]>
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock

Dawei Feng <[email protected]>
ice: fix memory leak in ice_lbtest_prepare_rings()

Aaron Ma <[email protected]>
ice: wait for reset completion in ice_resume()

Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during ct

Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during recirculation

Ilya Maximets <[email protected]>
net: openvswitch: fix potential UAF on meter attach failure

Nava kishore Manne <[email protected]>
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB

Nava kishore Manne <[email protected]>
phy: zynqmp: use read-modify-write for SERDES scrambler bypass

Nava kishore Manne <[email protected]>
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask

Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA ECC private key requests

Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA AES cipher key requests

Harald Freudenberger <[email protected]>
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

Stefan Haberland <[email protected]>
s390/dasd: Fix undersized format-check buffer

Jan Höppner <[email protected]>
s390/dasd: Fix potential NULL pointer dereference

Aswin Karuvally <[email protected]>
s390/qeth: Check CAP_NET_ADMIN for private ioctls

Niklas Schnelle <[email protected]>
s390/pci: Fix s390_pci_mmio_write syscall error return without MIO

Jianing Li <[email protected]>
power: supply: max17040: handle missing status supplier

Xu Rao <[email protected]>
power: supply: bq25890: fix the -10 C NTC lookup entry

Zhongqiu Han <[email protected]>
cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized

Abdun Nihaal <[email protected]>
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()

bui duc phuc <[email protected]>
gpio: pca953x: fix cache_only and IRQ state on restore_context() failure

Myeonghun Pak <[email protected]>
i2c: amd-mp2: Unregister callback on adapter add failure

Vincent Jardin <[email protected]>
hwmon: (pmbus/core) notify on the hwmon device, not the i2c client

Hongyan Xu <[email protected]>
hwmon: (npcm750-pwm-fan): stop fan timer on device detach

Asim Viladi Oglu Manizada <[email protected]>
sctp: prevent peer transport count overflow

Yuxiang Yang <[email protected]>
sctp: reject stale cookies with mismatched verification tags

Ibrahim Hashimov <[email protected]>
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

Chris Gellermann <[email protected]>
selftests/clone3: fix wild pointer access of getline due to missing init

Chris Gellermann <[email protected]>
selftests/mm: fix potential wild pointer access of getline due to missing init

Vijaya Krishna Nivarthi <[email protected]>
spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure

Masami Hiramatsu (Google) <[email protected]>
tracing/filters: Fix false positive match in regex_match_full()

Masami Hiramatsu (Google) <[email protected]>
tracing: Check return value of __register_event() in trace_module_add_events()

Ming Lei <[email protected]>
ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

Eric Dumazet <[email protected]>
vxlan: use pskb_network_may_pull() in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: use neigh_ha_snapshot() in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: unclone skb head before modifying eth header in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: re-fetch eth header after route_shortcircuit()

Matt Fleming <[email protected]>
veth: convert frag_list skbs before running XDP

Michael Bommarito <[email protected]>
um: vector: fix use-after-free in vector_mmsg_rx()

Thorsten Blum <[email protected]>
powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()

Zhiling Zou <[email protected]>
net: ipv6: clear suppressed fib6 rule result

Zhiling Zou <[email protected]>
net: bridge: stop fast-leave after deleting a port group

Breno Leitao <[email protected]>
mm: memcg: initialize *locked in memcg1_oom_prepare() stub

Link Lin <[email protected]>
mm/page_reporting: use system_freezable_wq to fix UAF during suspend

Christian Brauner <[email protected]>
binfmt_misc: don't let an 'F' entry pin its own instance

Christian Brauner <[email protected]>
binfmt_misc: reject a flag character as the field delimiter

Zhao Li <[email protected]>
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

Zihan Xi <[email protected]>
tipc: avoid use-after-free in poll trace queue dumps

David Lee <[email protected]>
netfilter: ipset: do not update comments from kernel-side hash adds

Xuanqiang Luo <[email protected]>
net/smc: fix socket use-after-free during link group termination

Zhiling Zou <[email protected]>
ipvs: do not propagate one-packet flag to synced conns

Matt Vollrath <[email protected]>
igbvf: Fix leak in TX DMA error cleanup

Dawei Feng <[email protected]>

    e1000: fix memory leak in e1000_probe()

Md Sadre Alam <[email protected]>
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+

Sonali Pradhan <[email protected]>
ALSA: usb-audio: Clamp frame size in implicit-feedback mode

Sonali Pradhan <[email protected]>
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set

Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()

Baul Lee <[email protected]>
ALSA: usb-audio: fix stack info leak in RME Digiface status

Baul Lee <[email protected]>
ALSA: usb-audio: fix use-after-free in ump_to_endpoint()

Niklas Cassel <[email protected]>
ata: libata-sata: fix ata_scsi_lpm_supported() iteration

Matt Vollrath <[email protected]>
ata: libata-eh: Increase STANDBY IMMEDIATE timeout

Haidar Lee <[email protected]>
ASoC: tas2562: fix broken entries in the volume lookup table

Haidar Lee <[email protected]>
ASoC: tas2562: fix DVC coefficient write order

Baul Lee <[email protected]>
ALSA: ump: fix double free of out_cvts on rawmidi error

Norbert Szetei <[email protected]>
ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes

Norbert Szetei <[email protected]>
ALSA: seq: Fix division by zero in initialize_timer()

Norbert Szetei <[email protected]>
ALSA: pcm: wake linked drain waiters on unlink

Xu Rao <[email protected]>
ALSA: lx6464es: fix period byte count for 16-bit streams

Takashi Iwai <[email protected]>
ALSA: 6fire: Fix UAF at error handling during probe

Xuanqiang Luo <[email protected]>
bpf: lwt: Fix dst reference leak on reroute failure

Sangho Lee <[email protected]>
Bluetooth: HIDP: validate numbered report payloads

Sangho Lee <[email protected]>
Bluetooth: HIDP: reject frames without a transaction header

Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Fix advertising data UAFs

Zihan Xi <[email protected]>
Bluetooth: mgmt: fix UAF in pair command cancellation

Zihan Xi <[email protected]>
Bluetooth: mgmt: fix pending command UAF in EIR updates

Greg Kroah-Hartman <[email protected]>
Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()

Greg Kroah-Hartman <[email protected]>
Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()

Luxiao Xu <[email protected]>
audit: fix potential use-after-free in audit_del_rule()

Zhan Xusheng <[email protected]>
audit: fix potential integer overflow in audit_log_n_string()

Charles Vosburgh <[email protected]>
sctp: validate Adaptation Indication parameter length

Farhan Ali <[email protected]>
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

Farhan Ali <[email protected]>
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure

Farhan Ali <[email protected]>
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled

Sean Christopherson <[email protected]>
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active

Raushan Patel <[email protected]>
tracing/probes: Reject $arg0 in meta argument expansion

Gregory Price <[email protected]>
mm/vmstat: fold stranded per-cpu node stats when a node comes online

Xiangfeng Cai <[email protected]>
mm/hugetlb: fix list corruption in allocate_file_region_entries()

Zi Yan <[email protected]>
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()

Kiryl Shutsemau (Meta) <[email protected]>
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes

Kefeng Wang <[email protected]>
mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

Nathan Chancellor <[email protected]>
fortify: Disable -Wstringop-overread in tests

Benjamin Boortz <[email protected]>
pinctrl: bm1880: add missing select GENERIC_PINCONF

Michael Bommarito <[email protected]>
erofs: cap LZMA stream pool size

Karl Mehltretter <[email protected]>
pinctrl: devicetree: don't free uninitialized dev_name on error path

Benjamin Boortz <[email protected]>
pinctrl: microchip-sgpio: add missing select REGMAP_MMIO

Cen Zhang (Microsoft) <[email protected]>

    rhashtable: clear stale iter->p on table restart

Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in __close_file_table_ids()

Namjae Jeon <[email protected]>
ksmbd: return success for deferred final close

Denis V. Lunev <[email protected]>
qede: sync udp_tunnel ports outside qede_lock in the recovery path

Gabriele Monaco <[email protected]>
sched/deadline: Use revised wakeup rule only for running dl_server

Suman Ghosh <[email protected]>
octeontx2-pf: Set correct sequence for carrier off and tx queue stop

Jiawen Wu <[email protected]>
net: libwx: fix FDIR ATR queue mismatch for software VLAN packets

Daniel Golle <[email protected]>
net: dsa: mt7530: error out on failed reads in MT7531 PHY polling

Daniel Golle <[email protected]>

    net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend

Karl Mehltretter <[email protected]>
riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove

Muhammad Bilal <[email protected]>
accel/qaic: use sizeof(*trans_hdr) for transaction length check

Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions

Zheng Yejian <[email protected]>
tracing: Remove TRACE_EVENT_FL_FILTERED logic

Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()

Minhong He <[email protected]>
can: isotp: check register_netdevice_notifier() error in module init

Chenguang Zhao <[email protected]>
net: sxgbe: check descriptor ring allocation failures

Chenguang Zhao <[email protected]>
net: sxgbe: free TX rings on RX allocation failure

Leon Romanovsky <[email protected]>
scsi: target: Clear cmd_cnt when initial counter enrollment fails

Benjamin Block <[email protected]>
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req

Guangshuo Li <[email protected]>
scsi: ufs: core: Cancel RTC work in active-active suspend

TanZheng <[email protected]>
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE

Christian Marangi <[email protected]>
net: phylink: put link_gpio if phylink_create fails

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync

Pauli Virtanen <[email protected]>
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists

Zijun Hu <[email protected]>
Bluetooth: btintel: Validate length before parsing diagnostics TLV

Pauli Virtanen <[email protected]>
Bluetooth: ISO: avoid deadlocks in iso_sock_timeout

Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix leaking sk after socket release

Pauli Virtanen <[email protected]>
Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()

Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos

Jiale Yao <[email protected]>
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

Pauli Virtanen <[email protected]>
Bluetooth: ISO: clear iso_data always when detaching conn from hcon

Yuho Choi <[email protected]>
idpf: Fix mailbox IRQ name leak on request failure

Joshua Hay <[email protected]>
idpf: adjust TxQ ring count minimum

Guenter Roeck <[email protected]>
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()

Chenguang Zhao <[email protected]>
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller

Frank Wunderlich <[email protected]>
net: ethernet: mtk_eth_soc: add consts for irq index

Frank Wunderlich <[email protected]>
net: ethernet: mtk_eth_soc: support named IRQs

Zhao Li <[email protected]>
wifi: mac80211: validate individual TWT params before driver setup

Eric Dumazet <[email protected]>
net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()

Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-akebono CPU node lookup check

Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-currituck CPU node lookup check

Thorsten Blum <[email protected]>
powerpc/boot: Fix simpleboot CPU node lookup check

Yun Lu <[email protected]>
rtase: fix double free of multi-frag skb on DMA map failure

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix PWM auto temp state array and bounds check

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Use cached PWM frequency value

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix cache updated before hardware write on I2C error

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors

Chenguang Zhao <[email protected]>
forcedeth: fix UAF of txrx_stats in nv_remove

David Corvaglia <[email protected]>
net: bridge: mrp: fix Option TLV length in MRP_Test frames

Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Prevent access to unsupported weight registers

Eric Dumazet <[email protected]>
net: do not send ICMP/NDISC Redirects when peer allocation fails

Guenter Roeck <[email protected]>
hwmon: (nzxt-smart2) DMA-align output buffer

Guenter Roeck <[email protected]>
hwmon: (lm90) Only report alarms if driver is ready

Guenter Roeck <[email protected]>
hwmon: (sht3x) Fix unaligned accesses

Guenter Roeck <[email protected]>
hwmon: (ltc4282) Fix reading the minimum alarm voltage

Guenter Roeck <[email protected]>
hwmon: (ina2xx) Fix various overflow issues

Jonas Rebmann <[email protected]>
hwmon: (ina2xx) Shift INA234 shunt and current registers

Ian Ray <[email protected]>
hwmon: (ina2xx) Add support for INA234

Ian Ray <[email protected]>
hwmon: (ina2xx) Make it easier to add more devices

Wenliang Yan <[email protected]>

    hwmon: (ina226) Add support for SY24655

Guenter Roeck <[email protected]>
hwmon: (ina2xx) Add support for INA260

Guenter Roeck <[email protected]>
hwmon: (ina2xx) Add support for has_alerts configuration flag

Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116

Srikanth Boyapally <[email protected]>
spi: spi-cadence: Move TX FIFO full busy-wait into FIFO

Jun Guo <[email protected]>
spi: spi-cadence: supports transmission with bits_per_word of 16 and 32

Dawei Feng <[email protected]>
smb: client: fix buffer leaks in SMB1 read and write

Xingui Yang <[email protected]>
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race

HyeongJun An <[email protected]>
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

HyeongJun An <[email protected]>
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

Mario Limonciello <[email protected]>
pinctrl-amd: Don't clear S4 wake bits at probe

Xiang Mei <[email protected]>
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()

Ilia Gavrilov <[email protected]>
rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled

Xiang Mei (Microsoft) <[email protected]>
netfilter: nft_payload: fix mask build for partial field offload

Julian Anastasov <[email protected]>
ipvs: do not mangle ICMP replies for non-first fragments

Julian Anastasov <[email protected]>
ipvs: fix places with wrong packet offsets

Julian Anastasov <[email protected]>
ipvs: fix the checksum validations

Pablo Neira Ayuso <[email protected]>
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: make nft_object rhltable per table

Michael Bommarito <[email protected]>
assoc_array: trim the final shortcut word using the current chunk end

Michael Bommarito <[email protected]>
keys: make keyring key-chunk byte order agree with keyring_diff_objects()

Michael Bommarito <[email protected]>
keys: fix out-of-bounds read in keyring_get_key_chunk()

Fabrice Derepas <[email protected]>
KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type

Sebastian Andrzej Siewior <[email protected]>
Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation

Ruoyu Wang <[email protected]>
drm/mediatek: Check CRTC state before freeing

Xiang Mei <[email protected]>
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix runtime PM leak on probe allocation failure

Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()

Mike Looijmans <[email protected]>
phy-zynqmp: Postpone getting clock rate until actually needed

Johannes Thumshirn <[email protected]>
btrfs: zoned: fix deadlock between metadata writeback and transaction commit

Qu Wenruo <[email protected]>
btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag

Sang-Heon Jeon <[email protected]>
of: reserved_mem: prevent OOB when too many dynamic regions are defined

Oreoluwa Babatunde <[email protected]>
of: reserved_mem: Add code to dynamically allocate reserved_mem array

Uday Khare <[email protected]>
ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup

Uday Khare <[email protected]>
ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup

Radhey Shyam Pandey <[email protected]>
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()

Damien Le Moal <[email protected]>
ahci: Introduce ahci_ignore_port() helper

Josua Mayer <[email protected]>
ata: libahci_platform: support non-consecutive port numbers

Rosen Penev <[email protected]>
ata: sata_mv: accept 1 or 2 resources in platform probe

Abdun Nihaal <[email protected]>
gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()

Yuho Choi <[email protected]>
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()

Hongling Zeng <[email protected]>
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA

Konrad Dybcio <[email protected]>

    pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151

Sneh Mankad <[email protected]>
pinctrl: qcom: Unconditionally mark gpio as wakeup enable

Michael Bommarito <[email protected]>
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

Jakub Kicinski <[email protected]>
netconsole: avoid OOB reads, msg is not nul-terminated

Tristan Madani <[email protected]>
bpf: Reset register bounds before narrowing retval range in check_mem_access()

Benjamin Tissoires <[email protected]>
HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report

Lee Jones <[email protected]>
HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write

Lee Jones <[email protected]>
HID: logitech-dj: Standardise hid_report_enum variable nomenclature

Yehyeong Lee <[email protected]>
net: mpls: initialize rtm_tos in mpls_getroute()

Wayen.Yan <[email protected]>
net: airoha: Fix register index for Tx-fwd counter configuration

Lorenzo Bianconi <[email protected]>
netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()

Tiwei Bie <[email protected]>
um: Preserve errno within signal handler

Shuvam Pandey <[email protected]>
kunit: tool: skip stty when stdin is not a tty

David Gow <[email protected]>
kunit: tool: Terminate kernel under test on SIGINT

Benjamin Berg <[email protected]>
um: Set parent death signal for userspace process

Tiwei Bie <[email protected]>
um: Set parent-death signal for write_sigio thread/process

Tiwei Bie <[email protected]>
um: Set parent-death signal for ubd io thread/process

Tiwei Bie <[email protected]>
um: Use os_set_pdeathsig helper in winch thread/process

Benjamin Berg <[email protected]>
um: Set parent death signal for winch thread/process

Tiwei Bie <[email protected]>
um: Add os_set_pdeathsig helper function

Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: restore helper propagation via expectation

-------------

Diffstat:

 Documentation/dev-tools/kmemleak.rst               |   1 +
 Documentation/hwmon/ina2xx.rst                     |  67 +-
 Makefile                                           |   4 +-
 arch/powerpc/boot/simpleboot.c                     |   2 +-
 arch/powerpc/boot/treeboot-akebono.c               |   2 +-
 arch/powerpc/boot/treeboot-currituck.c             |   2 +-
 arch/powerpc/platforms/ps3/mm.c                    |   1 +
 arch/riscv/mm/init.c                               |   4 +-
 arch/s390/kvm/pci.c                                |  28 +-
 arch/s390/pci/pci_mmio.c                           |   1 +
 arch/um/drivers/chan_user.c                        |   2 +
 arch/um/drivers/ubd_kern.c                         |   1 +
 arch/um/drivers/vector_kern.c                      |   3 +
 arch/um/include/shared/os.h                        |   2 +
 arch/um/os-Linux/process.c                         |   6 +
 arch/um/os-Linux/sigio.c                           |   1 +
 arch/um/os-Linux/signal.c                          |   3 +
 arch/um/os-Linux/skas/process.c                    |   3 +
 arch/x86/kvm/svm/avic.c                            |   8 -
 drivers/accel/qaic/qaic_control.c                  |   2 +-
 drivers/ata/ahci.h                                 |  17 +-
 drivers/ata/ahci_brcm.c                            |   3 +
 drivers/ata/ahci_ceva.c                            |  24 +-
 drivers/ata/libahci.c                              |   1 +
 drivers/ata/libahci_platform.c                     |  38 +-
 drivers/ata/libata-eh.c                            |   8 +
 drivers/ata/libata-sata.c                          |   2 +-
 drivers/ata/sata_mv.c                              |   2 +-
 drivers/block/ublk_drv.c                           |   9 +
 drivers/bluetooth/btintel.c                        |   3 +
 drivers/bluetooth/btmtk.c                          |  50 +-
 drivers/bluetooth/btusb.c                          |  30 +-
 drivers/cpufreq/powernow-k8.c                      |   1 +
 drivers/dma/idxd/cdev.c                            |   4 +-
 drivers/dma/sun6i-dma.c                            |  11 +-
 drivers/gpio/gpio-pca953x.c                        |  15 +-
 drivers/gpio/gpio-pch.c                            |  28 +-
 drivers/gpio/gpio-sloppy-logic-analyzer.c          |  10 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c         |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |  12 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c            |  73 ++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |  15 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c            |  11 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c        |  30 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_job.c            |  11 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_job.h            |  22 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c           |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  40 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h            |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c            |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c            |   5 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c            |   8 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h             |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c         |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c          |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c        |  12 +-
 drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c              |   6 +-
 drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c              |   6 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |  10 +-
 drivers/gpu/drm/amd/amdkfd/kfd_events.c            |  23 +-
 drivers/gpu/drm/amd/amdkfd/kfd_migrate.c           |   3 +-
 .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c |   2 +-
 drivers/gpu/drm/amd/amdkfd/kfd_queue.c             |   2 +-
 .../gpu/drm/amd/display/dc/dce/dce_clock_source.c  |  20 +-
 .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c    |  16 +-
 drivers/gpu/drm/armada/armada_fbdev.c              |  12 +-
 drivers/gpu/drm/display/drm_dp_helper.c            |  12 +
 drivers/gpu/drm/drm_exec.c                         |   6 +-
 drivers/gpu/drm/drm_fb_helper.c                    |  41 +-
 drivers/gpu/drm/drm_fbdev_dma.c                    |  12 +-
 drivers/gpu/drm/drm_fbdev_shmem.c                  |  12 +-
 drivers/gpu/drm/drm_fbdev_ttm.c                    |  12 +-
 drivers/gpu/drm/drm_gpuvm.c                        |   3 +-
 drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c       |   2 +-
 drivers/gpu/drm/exynos/exynos_drm_fbdev.c          |   9 +-
 drivers/gpu/drm/gma500/fbdev.c                     |  13 +-
 drivers/gpu/drm/i915/display/intel_fbdev.c         |   9 +-
 drivers/gpu/drm/i915/display/intel_hdcp.c          | 699 +++++++++++----------
 drivers/gpu/drm/i915/display/intel_hdcp_gsc.c      |   9 +-
 drivers/gpu/drm/i915/display/intel_hdcp_gsc.h      |   5 +-
 .../gpu/drm/i915/display/intel_hdcp_gsc_message.h  |   3 +-
 drivers/gpu/drm/i915/display/intel_vrr.c           |  10 +-
 drivers/gpu/drm/imagination/pvr_job.c              |   2 +-
 drivers/gpu/drm/imagination/pvr_queue.c            |   5 +-
 drivers/gpu/drm/imagination/pvr_queue.h            |   2 +-
 drivers/gpu/drm/lima/lima_gem.c                    |   2 +-
 drivers/gpu/drm/lima/lima_sched.c                  |   6 +-
 drivers/gpu/drm/lima/lima_sched.h                  |   3 +-
 drivers/gpu/drm/mediatek/mtk_crtc.c                |   6 +-
 drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c    |   7 +-
 drivers/gpu/drm/msm/msm_fbdev.c                    |   9 +-
 drivers/gpu/drm/msm/msm_gem_submit.c               |   8 +-
 drivers/gpu/drm/nouveau/nouveau_sched.c            |   3 +-
 drivers/gpu/drm/omapdrm/omap_fbdev.c               |   9 +-
 drivers/gpu/drm/panfrost/panfrost_drv.c            |   2 +-
 drivers/gpu/drm/panthor/panthor_drv.c              |   3 +-
 drivers/gpu/drm/panthor/panthor_fw.c               |  47 +-
 drivers/gpu/drm/panthor/panthor_mmu.c              |   2 +-
 drivers/gpu/drm/panthor/panthor_sched.c            |   5 +-
 drivers/gpu/drm/panthor/panthor_sched.h            |   3 +-
 drivers/gpu/drm/radeon/radeon_fbdev.c              |  13 +-
 drivers/gpu/drm/scheduler/sched_fence.c            |   4 +-
 drivers/gpu/drm/scheduler/sched_main.c             |   7 +-
 drivers/gpu/drm/tegra/fbdev.c                      |  18 +-
 drivers/gpu/drm/v3d/v3d_submit.c                   |   2 +-
 drivers/gpu/drm/vc4/vc4_irq.c                      |   2 +-
 drivers/gpu/drm/vc4/vc4_validate.c                 |  29 +-
 drivers/gpu/drm/vmwgfx/ttm_object.c                |   7 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_blit.c               |  39 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c            |  20 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c           |   4 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_shader.c             |  13 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c               |  17 +-
 drivers/gpu/drm/xe/Makefile                        |   1 +
 drivers/gpu/drm/xe/display/xe_hdcp_gsc.c           |   7 +-
 drivers/gpu/drm/xe/xe_bo.c                         |  33 +-
 drivers/gpu/drm/xe/xe_bo.h                         |  10 +-
 drivers/gpu/drm/xe/xe_bo_types.h                   |   2 +
 drivers/gpu/drm/xe/xe_dma_buf.c                    |   6 +-
 drivers/gpu/drm/xe/xe_exec.c                       |  22 +-
 drivers/gpu/drm/xe/xe_gt.c                         |   4 +-
 drivers/gpu/drm/xe/xe_gt_debugfs.c                 |   4 +-
 drivers/gpu/drm/xe/xe_gt_printk.h                  |  31 +
 drivers/gpu/drm/xe/xe_hw_engine.c                  |   3 +-
 drivers/gpu/drm/xe/xe_hw_engine_types.h            |   8 +
 drivers/gpu/drm/xe/xe_oa.c                         |   7 +
 drivers/gpu/drm/xe/xe_oa_types.h                   |   3 +
 drivers/gpu/drm/xe/xe_pagefault.c                  |  65 ++
 drivers/gpu/drm/xe/xe_pagefault.h                  |  19 +
 drivers/gpu/drm/xe/xe_pagefault_types.h            | 136 ++++
 drivers/gpu/drm/xe/xe_pt.c                         |   3 +
 drivers/gpu/drm/xe/xe_reg_sr.c                     |  53 --
 drivers/gpu/drm/xe/xe_reg_whitelist.c              | 147 ++++-
 drivers/gpu/drm/xe/xe_reg_whitelist.h              |   4 +
 drivers/gpu/drm/xe/xe_sched_job.c                  |   3 +-
 drivers/gpu/drm/xe/xe_vm.c                         |   3 +-
 drivers/hid/hid-logitech-dj.c                      |  28 +-
 drivers/hv/vmbus_drv.c                             |  13 +-
 drivers/hwmon/Kconfig                              |   5 +-
 drivers/hwmon/adt7470.c                            | 131 ++--
 drivers/hwmon/ina2xx.c                             | 251 ++++++--
 drivers/hwmon/lm90.c                               |   4 +-
 drivers/hwmon/ltc4282.c                            |   4 +-
 drivers/hwmon/nct6775-core.c                       |  20 +-
 drivers/hwmon/npcm750-pwm-fan.c                    |  11 +
 drivers/hwmon/nzxt-smart2.c                        |   2 +-
 drivers/hwmon/pmbus/pmbus_core.c                   |   7 +-
 drivers/hwmon/sht3x.c                              |   9 +-
 drivers/i2c/busses/i2c-amd-mp2-plat.c              |   4 +-
 drivers/i2c/busses/i2c-bcm-iproc.c                 |  11 +
 drivers/i2c/busses/i2c-imx.c                       |   9 +-
 drivers/i2c/busses/i2c-jz4780.c                    |   5 +-
 drivers/iommu/iova.c                               |   6 +
 drivers/media/i2c/imx219.c                         |  31 +-
 .../media/platform/chips-media/wave5/wave5-hw.c    |   3 +
 .../platform/chips-media/wave5/wave5-vpu-enc.c     |   5 +-
 .../platform/chips-media/wave5/wave5-vpuapi.h      |   1 +
 drivers/net/can/c_can/c_can_main.c                 |   8 +-
 drivers/net/can/ctucanfd/ctucanfd_base.c           |  14 +-
 drivers/net/can/ctucanfd/ctucanfd_pci.c            |   3 +-
 drivers/net/can/dev/skb.c                          |   2 -
 drivers/net/can/softing/softing_fw.c               |  46 +-
 drivers/net/can/usb/ems_usb.c                      |  43 ++
 drivers/net/can/usb/etas_es58x/es58x_core.c        |   1 -
 drivers/net/can/usb/gs_usb.c                       |   4 +-
 drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c  |   1 +
 drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c   |  13 +-
 drivers/net/can/usb/peak_usb/pcan_usb_core.c       |   1 -
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c         |  40 +-
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c        |  20 +-
 drivers/net/dsa/mt7530-mdio.c                      |  11 +-
 drivers/net/dsa/mt7530.c                           |  58 +-
 drivers/net/ethernet/airoha/airoha_eth.c           |   2 +-
 drivers/net/ethernet/intel/e1000/e1000_main.c      |   2 +-
 drivers/net/ethernet/intel/ice/ice_ethtool.c       |  10 +-
 drivers/net/ethernet/intel/ice/ice_main.c          |  10 +
 drivers/net/ethernet/intel/idpf/idpf_lib.c         |   2 +-
 drivers/net/ethernet/intel/idpf/idpf_txrx.c        |   5 +-
 drivers/net/ethernet/intel/idpf/idpf_txrx.h        |   2 +-
 drivers/net/ethernet/intel/igbvf/netdev.c          |   2 -
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |   2 +-
 drivers/net/ethernet/mediatek/mtk_eth_soc.c        |  58 +-
 drivers/net/ethernet/mediatek/mtk_eth_soc.h        |   7 +-
 drivers/net/ethernet/nvidia/forcedeth.c            |   4 +-
 drivers/net/ethernet/qlogic/qede/qede_main.c       |  44 +-
 drivers/net/ethernet/realtek/rtase/rtase_main.c    |   3 +
 drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c    |  14 +-
 drivers/net/ethernet/wangxun/libwx/wx_lib.c        |   2 +
 drivers/net/netconsole.c                           |   3 +-
 drivers/net/phy/phylink.c                          |  29 +-
 drivers/net/veth.c                                 |   4 +-
 drivers/net/vxlan/vxlan_core.c                     |  15 +-
 drivers/net/wireless/ath/ath6kl/txrx.c             |   2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  |  16 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |   6 +
 .../wireless/broadcom/brcm80211/brcmfmac/chip.c    |   4 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.c    |  46 +-
 .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |   6 +
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  14 +-
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |   1 +
 .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |   3 +
 .../broadcom/brcm80211/include/brcm_hw_ids.h       |   2 +-
 .../net/wireless/marvell/mwifiex/11n_rxreorder.c   |   2 +-
 drivers/of/of_reserved_mem.c                       |  87 ++-
 drivers/phy/xilinx/phy-zynqmp.c                    | 130 ++--
 drivers/pinctrl/Kconfig                            |   2 +
 drivers/pinctrl/devicetree.c                       |   4 +
 drivers/pinctrl/pinctrl-amd.c                      |   3 +-
 drivers/pinctrl/qcom/pinctrl-msm.c                 |   8 +-
 drivers/pinctrl/qcom/pinctrl-sc8280xp.c            |  21 +-
 drivers/power/supply/bq25890_charger.c             |   2 +-
 drivers/power/supply/max17040_battery.c            |   6 +-
 drivers/s390/block/dasd_eckd.c                     |  11 +-
 drivers/s390/block/dasd_ioctl.c                    |   2 +-
 drivers/s390/crypto/zcrypt_api.c                   |   2 +-
 drivers/s390/crypto/zcrypt_ccamisc.c               |   6 +
 drivers/s390/net/qeth_core_main.c                  |   3 +
 drivers/s390/scsi/zfcp_aux.c                       |   1 +
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c             |  10 +-
 drivers/scsi/libiscsi.c                            |   2 +-
 drivers/scsi/libiscsi_tcp.c                        |   8 +-
 drivers/scsi/libsas/sas_init.c                     |  37 +-
 drivers/scsi/scsi_debug.c                          |   8 +-
 drivers/spi/spi-cadence.c                          | 129 +++-
 drivers/spi/spi-qcom-qspi.c                        |   3 +-
 drivers/target/target_core_iblock.c                |   6 +-
 drivers/target/target_core_transport.c             |  12 +-
 drivers/thunderbolt/xdomain.c                      |  40 +-
 drivers/ufs/core/ufshcd.c                          |   6 +-
 drivers/usb/gadget/function/f_tcm.c                | 192 +++++-
 drivers/usb/gadget/function/tcm.h                  |  13 +
 drivers/usb/typec/ucsi/ucsi.c                      |  88 +--
 drivers/usb/typec/ucsi/ucsi.h                      |   1 +
 fs/binfmt_misc.c                                   |   8 +
 fs/btrfs/super.c                                   |   8 +-
 fs/btrfs/zoned.c                                   |   6 +-
 fs/erofs/Kconfig                                   |  14 +
 fs/erofs/decompressor_lzma.c                       |   3 +-
 fs/proc/task_mmu.c                                 |  33 +-
 fs/smb/client/cifssmb.c                            |  12 +-
 fs/smb/server/vfs_cache.c                          |   6 +-
 include/drm/drm_exec.h                             |  20 +-
 include/drm/drm_fb_helper.h                        |  12 -
 include/drm/gpu_scheduler.h                        |  12 +-
 include/linux/alloc_tag.h                          |   3 +
 include/linux/can/core.h                           |   1 +
 include/linux/can/skb.h                            |   2 -
 include/linux/dma/qcom_bam_dma.h                   |  21 +-
 include/linux/kmemleak.h                           |   4 +
 include/linux/libata.h                             |   2 +-
 include/linux/mmc/sdio_ids.h                       |   2 +-
 include/linux/netfilter/nf_conntrack_sip.h         |   2 +-
 include/linux/slab.h                               |   8 +-
 include/linux/thunderbolt.h                        |   3 +
 include/linux/trace_events.h                       |   4 -
 include/net/ip_vs.h                                |  45 +-
 include/net/neighbour.h                            |   8 +-
 include/net/netfilter/nf_conntrack_expect.h        |   5 +-
 include/net/netfilter/nf_tables.h                  |   4 +-
 include/scsi/libsas.h                              |   1 -
 include/trace/events/rxrpc.h                       |  14 +-
 include/uapi/linux/rkisp1-config.h                 |   6 +-
 kernel/audit.c                                     |  11 +-
 kernel/auditfilter.c                               |   6 +-
 kernel/bpf/verifier.c                              |   1 +
 kernel/sched/cpufreq_schedutil.c                   |  11 +
 kernel/sched/deadline.c                            |   3 +-
 kernel/trace/trace.c                               |  44 +-
 kernel/trace/trace.h                               |   4 -
 kernel/trace/trace_branch.c                        |   4 +-
 kernel/trace/trace_events.c                        |   6 +-
 kernel/trace/trace_events_filter.c                 |   3 +
 kernel/trace/trace_functions_graph.c               |   8 +-
 kernel/trace/trace_hwlat.c                         |   4 +-
 kernel/trace/trace_mmiotrace.c                     |  21 +-
 kernel/trace/trace_osnoise.c                       |  12 +-
 kernel/trace/trace_probe.c                         |   6 +-
 kernel/trace/trace_sched_wakeup.c                  |   8 +-
 lib/alloc_tag.c                                    |   9 +
 lib/assoc_array.c                                  |   3 +-
 lib/rhashtable.c                                   |   1 +
 lib/test_fortify/Makefile                          |   1 +
 lib/win_minmax.c                                   |   1 +
 mm/huge_memory.c                                   |  16 +-
 mm/hugetlb.c                                       |  12 +-
 mm/kmemleak.c                                      |  44 +-
 mm/memcontrol-v1.h                                 |   6 +-
 mm/migrate_device.c                                |   5 +-
 mm/mm_init.c                                       |  15 +-
 mm/page_reporting.c                                |   6 +-
 mm/percpu-km.c                                     |   2 +-
 mm/slab.h                                          |  28 +-
 mm/slab_common.c                                   |  13 +
 mm/slub.c                                          |  34 +-
 net/bluetooth/hci_conn.c                           |  14 +-
 net/bluetooth/hci_sync.c                           | 154 +++--
 net/bluetooth/hidp/core.c                          |  30 +-
 net/bluetooth/iso.c                                | 113 ++--
 net/bluetooth/l2cap_core.c                         |   5 +
 net/bluetooth/mgmt.c                               |  84 ++-
 net/bridge/br_mrp.c                                |   2 +-
 net/bridge/br_multicast.c                          |   1 +
 net/bridge/br_netfilter_hooks.c                    |   6 +-
 net/can/af_can.c                                   |  14 +-
 net/can/bcm.c                                      |   2 -
 net/can/isotp.c                                    | 337 +++++++---
 net/can/j1939/bus.c                                |   2 +
 net/can/j1939/j1939-priv.h                         |   3 +
 net/can/j1939/main.c                               |   8 +-
 net/can/j1939/socket.c                             |   1 -
 net/can/j1939/transport.c                          |   6 +-
 net/can/raw.c                                      |   7 +-
 net/core/lwt_bpf.c                                 |   4 +-
 net/core/skbuff.c                                  |  18 +-
 net/ipv4/route.c                                   |   2 -
 net/ipv4/udp_tunnel_nic.c                          |  32 +-
 net/ipv6/fib6_rules.c                              |   1 +
 net/ipv6/ip6_output.c                              |   2 +-
 net/ipv6/ndisc.c                                   |   2 +
 net/mac80211/s1g.c                                 |   4 +
 net/mpls/af_mpls.c                                 |   1 +
 net/mptcp/pm.c                                     |   9 +-
 net/mptcp/pm_netlink.c                             |  29 +-
 net/mptcp/pm_userspace.c                           |  87 ++-
 net/mptcp/protocol.h                               |   6 +-
 net/netfilter/ipset/ip_set_hash_gen.h              |   2 +-
 net/netfilter/ipvs/ip_vs_app.c                     |   4 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |   3 +
 net/netfilter/ipvs/ip_vs_core.c                    | 180 +++---
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |  19 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  48 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c               |  54 +-
 net/netfilter/ipvs/ip_vs_xmit.c                    |  42 +-
 net/netfilter/nf_conntrack_broadcast.c             |   1 +
 net/netfilter/nf_conntrack_core.c                  |   7 +-
 net/netfilter/nf_conntrack_expect.c                |   1 +
 net/netfilter/nf_conntrack_h323_main.c             |  12 +-
 net/netfilter/nf_conntrack_helper.c                |   5 +
 net/netfilter/nf_conntrack_netlink.c               |  18 +-
 net/netfilter/nf_conntrack_sip.c                   |   4 +-
 net/netfilter/nf_nat_sip.c                         |   2 +-
 net/netfilter/nf_tables_api.c                      |  34 +-
 net/netfilter/nft_payload.c                        |  12 +-
 net/netfilter/xt_hashlimit.c                       |  16 +-
 net/openvswitch/actions.c                          |  12 +-
 net/openvswitch/meter.c                            |  33 +-
 net/rds/ib.c                                       |   4 +
 net/rds/ib_cm.c                                    |   4 +
 net/rds/tcp.c                                      |  14 +-
 net/rxrpc/ar-internal.h                            |  38 +-
 net/rxrpc/call_accept.c                            |   1 +
 net/rxrpc/call_event.c                             |  19 +-
 net/rxrpc/call_object.c                            |   2 +
 net/rxrpc/input.c                                  |  12 +-
 net/rxrpc/output.c                                 |  14 +-
 net/rxrpc/peer_object.c                            |  20 +-
 net/rxrpc/proc.c                                   |   6 +-
 net/rxrpc/rtt.c                                    | 103 +--
 net/rxrpc/sendmsg.c                                |   2 +-
 net/sctp/associola.c                               |   3 +
 net/sctp/sm_make_chunk.c                           |  17 +-
 net/smc/smc_core.c                                 |   2 +-
 net/tipc/socket.c                                  |   2 +-
 security/keys/keyring.c                            |  14 +-
 security/keys/trusted-keys/trusted_dcp.c           |  15 +-
 sound/core/pcm_native.c                            |   7 +
 sound/core/seq/seq_timer.c                         |   9 +-
 sound/core/timer.c                                 |   2 +
 sound/core/ump.c                                   |   1 +
 sound/pci/hda/patch_hdmi.c                         |  48 +-
 sound/pci/lx6464es/lx6464es.c                      |   5 +-
 sound/pci/lx6464es/lx_core.c                       |   5 +-
 sound/soc/codecs/max98090.c                        |   5 +-
 sound/soc/codecs/max98095.c                        |   5 +-
 sound/soc/codecs/tas2562.c                         |  30 +-
 sound/usb/6fire/chip.c                             |   4 +
 sound/usb/endpoint.c                               |  14 +-
 sound/usb/midi.c                                   |   2 +
 sound/usb/midi2.c                                  |   4 +-
 sound/usb/mixer_quirks.c                           |   2 +-
 tools/testing/kunit/kunit_kernel.py                |  39 +-
 tools/testing/kunit/kunit_tool_test.py             |  42 ++
 tools/testing/selftests/clone3/clone3_set_tid.c    |   2 +-
 tools/testing/selftests/mm/mlock-random-test.c     |   2 +-
 387 files changed, 4750 insertions(+), 2372 deletions(-)

6.12-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pablo Neira Ayuso <[email protected]>

[ Upstream commit dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a ]

A recent series to fix expectations broke helper propagation via expectation, this mechanism is used by the sip and h323 helper. This also propagates the conntrack helper to expected connections. I changed semantics of exp->helper which now tells us the actual helper that created the expectation.

Add an explicit assign_helper field to expectations for this purpose and update helpers to use it.

Restore this feature for userspace conntrack helper via ctnetlink nfqueue integration so it is again possible to attach a helper to an expectation, where it makes sense. This is not restored via ctnetlink expectation creation as there is no client for such feature. Use the expectation layer 4 protocol number for the helper lookup for consistency.

Make sure the expectation using this helper propagation mechanism also go away when the helper is unregistered.

Fixes 9c42bc9db90a ("netfilter: nf_conntrack_expect: honor expectation helper field")

Fixes 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations")

Reported-by Ilya Maximets <[email protected]>

Tested-by Ilya Maximets <[email protected]>

Signed-off-by Pablo Neira Ayuso <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 include/net/netfilter/nf_conntrack_expect.h |  5 ++++-
 net/netfilter/nf_conntrack_broadcast.c      |  1 +
 net/netfilter/nf_conntrack_core.c           |  7 +++++--
 net/netfilter/nf_conntrack_expect.c         |  1 +
 net/netfilter/nf_conntrack_h323_main.c      | 12 ++++++------
 net/netfilter/nf_conntrack_helper.c         |  5 +++++
 net/netfilter/nf_conntrack_netlink.c        | 18 ++++++++++++++++--
 net/netfilter/nf_conntrack_sip.c            |  2 +-
 8 files changed, 39 insertions(+), 12 deletions(-)

include/net/netfilter/nf_conntrack_expect.h +4 -1

index e9a8350e7ccf..80f50fd0f7ad 100644
@@ -45,9 +45,12 @@ struct nf_conntrack_expect {
 	void (*expectfn)(struct nf_conn *new,
 			 struct nf_conntrack_expect *this);
 
-	/* Helper to assign to new connection */
+	/* Helper that created this expectation */
 	struct nf_conntrack_helper __rcu *helper;
 
+	/* Helper to assign to new connection */
+	struct nf_conntrack_helper __rcu *assign_helper;
+
 	/* The conntrack of the master connection */
 	struct nf_conn *master;

net/netfilter/nf_conntrack_broadcast.c +1 -0

index f9528d4db0a8..93c501d9d399 100644
@@ -72,6 +72,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb,
 	exp->flags                = NF_CT_EXPECT_PERMANENT;
 	exp->class		  = NF_CT_EXPECT_CLASS_DEFAULT;
 	rcu_assign_pointer(exp->helper, helper);
+	rcu_assign_pointer(exp->assign_helper, NULL);
 	write_pnet(&exp->net, net);
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 	exp->zone = ct->zone;

net/netfilter/nf_conntrack_core.c +5 -2

index 423080cf86a4..0c457e159727 100644
@@ -1773,14 +1773,17 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
 		spin_lock_bh(&nf_conntrack_expect_lock);
 		exp = nf_ct_find_expectation(net, zone, tuple, !tmpl || nf_ct_is_confirmed(tmpl));
 		if (exp) {
+			struct nf_conntrack_helper *assign_helper;
+
 			/* Welcome, Mr. Bond.  We've been expecting you... */
 			__set_bit(IPS_EXPECTED_BIT, &ct->status);
 			/* exp->master safe, refcnt bumped in nf_ct_find_expectation */
 			ct->master = exp->master;
-			if (exp->helper) {
+			assign_helper = rcu_dereference(exp->assign_helper);
+			if (assign_helper) {
 				help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
 				if (help)
-					rcu_assign_pointer(help->helper, exp->helper);
+					rcu_assign_pointer(help->helper, assign_helper);
 			}
 
 #ifdef CONFIG_NF_CONNTRACK_MARK

net/netfilter/nf_conntrack_expect.c +1 -0

index bb8b87f9ee50..a8929885485b 100644
@@ -344,6 +344,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
 		helper = rcu_dereference(help->helper);
 
 	rcu_assign_pointer(exp->helper, helper);
+	rcu_assign_pointer(exp->assign_helper, NULL);
 	write_pnet(&exp->net, net);
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 	exp->zone = ct->zone;

net/netfilter/nf_conntrack_h323_main.c +6 -6

index 791aafe9f396..c42547284f35 100644
@@ -642,7 +642,7 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct,
 			  &ct->tuplehash[!dir].tuple.src.u3,
 			  &ct->tuplehash[!dir].tuple.dst.u3,
 			  IPPROTO_TCP, NULL, &port);
-	rcu_assign_pointer(exp->helper, &nf_conntrack_helper_h245);
+	rcu_assign_pointer(exp->assign_helper, &nf_conntrack_helper_h245);
 
 	nathook = rcu_dereference(nfct_h323_nat_hook);
 	if (memcmp(&ct->tuplehash[dir].tuple.src.u3,

@@ -766,7 +766,7 @@ static int expect_callforwarding(struct sk_buff *skb,
 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
 			  &ct->tuplehash[!dir].tuple.src.u3, &addr,
 			  IPPROTO_TCP, NULL, &port);
-	rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931);
+	rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931);
 
 	nathook = rcu_dereference(nfct_h323_nat_hook);
 	if (memcmp(&ct->tuplehash[dir].tuple.src.u3,

@@ -1233,7 +1233,7 @@ static int expect_q931(struct sk_buff *skb, struct nf_conn *ct,
 				&ct->tuplehash[!dir].tuple.src.u3 : NULL,
 			  &ct->tuplehash[!dir].tuple.dst.u3,
 			  IPPROTO_TCP, NULL, &port);
-	rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931);
+	rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931);
 	exp->flags = NF_CT_EXPECT_PERMANENT;	/* Accept multiple calls */
 
 	nathook = rcu_dereference(nfct_h323_nat_hook);

@@ -1305,7 +1305,7 @@ static int process_gcf(struct sk_buff *skb, struct nf_conn *ct,
 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
 			  &ct->tuplehash[!dir].tuple.src.u3, &addr,
 			  IPPROTO_UDP, NULL, &port);
-	rcu_assign_pointer(exp->helper, nf_conntrack_helper_ras);
+	rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_ras);
 
 	if (nf_ct_expect_related(exp, 0) == 0) {
 		pr_debug("nf_ct_ras: expect RAS ");

@@ -1522,7 +1522,7 @@ static int process_acf(struct sk_buff *skb, struct nf_conn *ct,
 			  &ct->tuplehash[!dir].tuple.src.u3, &addr,
 			  IPPROTO_TCP, NULL, &port);
 	exp->flags = NF_CT_EXPECT_PERMANENT;
-	rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931);
+	rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931);
 
 	if (nf_ct_expect_related(exp, 0) == 0) {
 		pr_debug("nf_ct_ras: expect Q.931 ");

@@ -1576,7 +1576,7 @@ static int process_lcf(struct sk_buff *skb, struct nf_conn *ct,
 			  &ct->tuplehash[!dir].tuple.src.u3, &addr,
 			  IPPROTO_TCP, NULL, &port);
 	exp->flags = NF_CT_EXPECT_PERMANENT;
-	rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931);
+	rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931);
 
 	if (nf_ct_expect_related(exp, 0) == 0) {
 		pr_debug("nf_ct_ras: expect Q.931 ");

net/netfilter/nf_conntrack_helper.c +5 -0

index 9150bcfd7ca8..ea0cdb7ec915 100644
@@ -419,6 +419,11 @@ static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data)
 
 	this = rcu_dereference_protected(exp->helper,
 					 lockdep_is_held(&nf_conntrack_expect_lock));
+	if (this == me)
+		return true;
+
+	this = rcu_dereference_protected(exp->assign_helper,
+					 lockdep_is_held(&nf_conntrack_expect_lock));
 	return this == me;
 }

net/netfilter/nf_conntrack_netlink.c +16 -2

index eacbbc342c3f..80fdb875c977 100644
@@ -2630,6 +2630,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
 
 static struct nf_conntrack_expect *
 ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct,
+		       const struct nf_conntrack_helper *assign_helper,
 		       struct nf_conntrack_tuple *tuple,
 		       struct nf_conntrack_tuple *mask);

@@ -2856,6 +2857,7 @@ static int
 ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,
 			     u32 portid, u32 report)
 {
+	struct nf_conntrack_helper *assign_helper = NULL;
 	struct nlattr *cda[CTA_EXPECT_MAX+1];
 	struct nf_conntrack_tuple tuple, mask;
 	struct nf_conntrack_expect *exp;

@@ -2871,8 +2873,18 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,
 	if (err < 0)
 		return err;
 
+	if (cda[CTA_EXPECT_HELP_NAME]) {
+		const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
+
+		assign_helper = __nf_conntrack_helper_find(helpname,
+							   nf_ct_l3num(ct),
+							   tuple.dst.protonum);
+		if (!assign_helper)
+			return -EOPNOTSUPP;
+	}
+
 	exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct,
-				     &tuple, &mask);
+				     assign_helper, &tuple, &mask);
 	if (IS_ERR(exp))
 		return PTR_ERR(exp);

@@ -3511,6 +3523,7 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr,
 
 static struct nf_conntrack_expect *
 ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
+		       const struct nf_conntrack_helper *assign_helper,
 		       struct nf_conntrack_tuple *tuple,
 		       struct nf_conntrack_tuple *mask)
 {

@@ -3564,6 +3577,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
 	exp->zone = ct->zone;
 #endif
 	rcu_assign_pointer(exp->helper, helper);
+	rcu_assign_pointer(exp->assign_helper, assign_helper);
 	exp->tuple = *tuple;
 	exp->mask.src.u3 = mask->src.u3;
 	exp->mask.src.u.all = mask->src.u.all;

@@ -3619,7 +3633,7 @@ ctnetlink_create_expect(struct net *net,
 	ct = nf_ct_tuplehash_to_ctrack(h);
 
 	rcu_read_lock();
-	exp = ctnetlink_alloc_expect(cda, ct, &tuple, &mask);
+	exp = ctnetlink_alloc_expect(cda, ct, NULL, &tuple, &mask);
 	if (IS_ERR(exp)) {
 		err = PTR_ERR(exp);
 		goto err_rcu;

net/netfilter/nf_conntrack_sip.c +1 -1

index bd91b8b47f4b..852c0b74b8a7 100644
@@ -1386,7 +1386,7 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff,
 	nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct),
 			  saddr, &daddr, proto, NULL, &port);
 	exp->timeout.expires = sip_timeout * HZ;
-	rcu_assign_pointer(exp->helper, helper);
+	rcu_assign_pointer(exp->assign_helper, helper);
 	exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE;
 
 	hooks = rcu_dereference(nf_nat_sip_hooks);

Signature · 1 line

2.53.0

Read the cover letter in its thread