7.1.8-rc1 review

Greg Kroah-Hartman amd-gfx dri-devel linux-fsdevel linux-patches lkml netfs stable 1 version Aug 7 In review

Get series with b4

b4 am [email protected]

Versions newest first

v1 Latest Aug 7438 patches 18 repliesIn review

Patches in v1 No applies recorded yet

#	Subject and files	Size	Replies
1/438	net: mpls: initialize rtm_tos in mpls_getroute()`net/mpls/af_mpls.c`	+1 -0	0 replies
2/438	mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT`include/linux/slab.h` `mm/slub.c`	+17 -6	0 replies
3/438	lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()`include/linux/alloc_tag.h` `lib/alloc_tag.c`	+12 -0	0 replies
4/438	mm/slab: prevent unbounded recursion in free path with new kmalloc type`include/linux/slab.h` `mm/slab.h` `mm/slab_common.c` +1 more	+75 ~~-59~~	0 replies
5/438	ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)`sound/hda/codecs/realtek/alc269.c`	+1 -0	0 replies
6/438	thunderbolt: Prevent XDomain delayed work use-after-free on disconnect`drivers/thunderbolt/xdomain.c` `include/linux/thunderbolt.h`	+33 ~~-10~~	0 replies
7/438	KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context`Documentation/arch/arm64/silicon-errata.rst` `arch/arm64/kvm/vgic/vgic-v3.c`	+11 -1	0 replies
8/438	dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold`drivers/dma/switchtec_dma.c`	+1 -1	0 replies
9/438	pinctrl: qcom: Unconditionally mark gpio as wakeup enable`drivers/pinctrl/qcom/pinctrl-msm.c`	+4 -4	0 replies
10/438	pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151`drivers/pinctrl/qcom/pinctrl-sc8280xp.c`	+11 ~~-10~~	0 replies
11/438	dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA`drivers/dma/sun6i-dma.c`	+4 -7	0 replies
12/438	dmaengine: idxd: fix double free of wq, engine, and group structs`drivers/dma/idxd/init.c`	+5 ~~-31~~	0 replies
13/438	dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()`drivers/dma/idxd/cdev.c`	+3 -1	0 replies
14/438	iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE`drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c`	+15 -0	0 replies
15/438	gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()`drivers/gpio/gpio-sloppy-logic-analyzer.c`	+10 -0	0 replies
16/438	selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE`tools/testing/selftests/lkdtm/tests.txt`	+1 -1	0 replies
17/438	selftests/seccomp: Fix pointer type mismatch build error`tools/testing/selftests/seccomp/seccomp_bpf.c`	+2 -1	0 replies
18/438	ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points`fs/ntfs/namei.c`	+2 -1	0 replies
19/438	ata: sata_mv: accept 1 or 2 resources in platform probe`drivers/ata/sata_mv.c`	+1 -1	0 replies
20/438	ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()`drivers/ata/ahci_ceva.c`	+14 -4	0 replies
21/438	phy: qcom: m31-eusb2: Fix return value of init call`drivers/phy/qualcomm/phy-qcom-m31-eusb2.c`	+1 -1	0 replies
22/438	ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup`sound/soc/codecs/max98095.c`	+3 -2	0 replies
23/438	ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup`sound/soc/codecs/max98090.c`	+3 -2	0 replies
24/438	of: reserved_mem: prevent OOB when too many dynamic regions are defined`drivers/of/of_reserved_mem.c`	+11 -3	0 replies
25/438	btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag`fs/btrfs/super.c`	+5 -3	0 replies
26/438	btrfs: zoned: fix deadlock between metadata writeback and transaction commit`fs/btrfs/zoned.c`	+5 -1	0 replies
27/438	btrfs: zoned: reset meta_write_pointer on zone reset`fs/btrfs/zoned.c`	+11 -0	0 replies
28/438	btrfs: warn about extent buffer that can not be released`fs/btrfs/disk-io.c` `fs/btrfs/extent_io.c` `fs/btrfs/extent_io.h`	+57 -8	0 replies
29/438	btrfs: skip global block reserve accounting for rescue mounts`fs/btrfs/block-rsv.c` `fs/btrfs/disk-io.c` `fs/btrfs/fs.h`	+27 ~~-12~~	0 replies
30/438	btrfs: raid56: fix an incorrect csum skip during scrub`fs/btrfs/raid56.c`	+3 -1	0 replies
31/438	btrfs: zoned: skip fully truncated ordered extents at zone finish`fs/btrfs/zoned.c`	+10 -0	0 replies
32/438	ntfs: harden runlist realloc size calculations`fs/ntfs/runlist.c`	+27 ~~-23~~	0 replies
33/438	ntfs: drop stale page-cache when shrinking a non-resident attr`fs/ntfs/attrib.c`	+10 -0	0 replies
34/438	rtla/timerlat_top: Fix on-threshold actions firing on signal`tools/tracing/rtla/src/timerlat_top.c`	+1 -1	0 replies
35/438	phy: zynqmp: fix clock error handling in xpsgtr_phy_init()`drivers/phy/xilinx/phy-zynqmp.c`	+9 -4	0 replies
36/438	phy: zynqmp: fix runtime PM leak on probe allocation failure`drivers/phy/xilinx/phy-zynqmp.c`	+6 -6	0 replies
37/438	netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()`include/linux/netfilter/nf_conntrack_sip.h` `net/netfilter/nf_conntrack_sip.c` `net/netfilter/nf_nat_sip.c`	+3 -3	0 replies
38/438	selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests`tools/testing/selftests/net/netfilter/nft_flowtable.sh`	+12 -2	0 replies
39/438	netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()`include/net/netfilter/nf_conntrack_expect.h` `net/ipv4/netfilter/nf_nat_h323.c` `net/netfilter/nf_conntrack_expect.c` +1 more	+50 ~~-30~~	0 replies
40/438	drm/mediatek: Check CRTC state before freeing`drivers/gpu/drm/mediatek/mtk_crtc.c`	+3 -3	0 replies
41/438	mshv_vtl: fix fd leak in mshv_ioctl_create_vtl()`drivers/hv/mshv_vtl_main.c`	+1 -0	0 replies
42/438	Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation`drivers/hv/vmbus_drv.c`	+12 -1	0 replies
43/438	mshv: Fix duplicate GSI detection for GSI 0`drivers/hv/mshv_irq.c`	+1 -1	0 replies
44/438	mshv: Fix sleeping under spinlock in mshv_portid_alloc`drivers/hv/mshv_portid_table.c`	+4 -2	0 replies
45/438	KVM: arm64: vgic: Fix race between LPI release and re-registration`arch/arm64/kvm/vgic/vgic-its.c` `arch/arm64/kvm/vgic/vgic.c` `include/kvm/arm_vgic.h`	+24 ~~-21~~	0 replies
46/438	KVM: arm64: vgic: Mitigate potential LPI registration failure`arch/arm64/kvm/vgic/vgic-its.c`	+2 -1	0 replies
47/438	KVM: arm64: Fix hyp_trace clock disabling`arch/arm64/kvm/hyp_trace.c`	+8 -8	0 replies
48/438	KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing`arch/arm64/kvm/hyp_trace.c`	+8 -1	0 replies
49/438	KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load()`arch/arm64/kvm/hyp_trace.c`	+7 -3	0 replies
50/438	KVM: arm64: Add missing hyp_enter when trapping sysreg`arch/arm64/include/asm/kvm_hypevents.h` `arch/arm64/kvm/hyp/nvhe/hyp-main.c` `arch/arm64/kvm/hyp_trace.c`	+3 -0	0 replies
51/438	KVM: arm64: Reject guest_memfd memslots when the VM has MTE`Documentation/virt/kvm/api.rst` `arch/arm64/kvm/arm.c` `arch/arm64/kvm/mmu.c`	+29 -6	0 replies
52/438	KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type`security/keys/trusted-keys/trusted_dcp.c`	+11 -4	0 replies
53/438	keys: fix out-of-bounds read in keyring_get_key_chunk()`security/keys/keyring.c`	+5 -4	0 replies
54/438	keys: make keyring key-chunk byte order agree with keyring_diff_objects()`security/keys/keyring.c`	+3 -2	0 replies
55/438	assoc_array: trim the final shortcut word using the current chunk end`lib/assoc_array.c`	+2 -1	0 replies
56/438	ipvs: adjust double hashing when fwd method changes`net/netfilter/ipvs/ip_vs_conn.c`	+147 ~~-42~~	0 replies
57/438	netfilter: nf_tables: make nft_object rhltable per table`include/net/netfilter/nf_tables.h` `net/netfilter/nf_tables_api.c`	+19 ~~-19~~	0 replies
58/438	netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH`net/netfilter/xt_hashlimit.c`	+15 -1	0 replies
59/438	ipvs: fix the checksum validations`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_core.c` `net/netfilter/ipvs/ip_vs_proto_sctp.c` +2 more	+74 ~~-86~~	0 replies
60/438	ipvs: fix places with wrong packet offsets`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_app.c` `net/netfilter/ipvs/ip_vs_core.c` +4 more	+97 ~~-93~~	0 replies
61/438	ipvs: do not mangle ICMP replies for non-first fragments`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_core.c` `net/netfilter/ipvs/ip_vs_xmit.c`	+48 ~~-52~~	0 replies
62/438	ipvs: clear the nfct flag under lock`net/netfilter/ipvs/ip_vs_core.c`	+8 -2	0 replies
63/438	netfilter: nft_payload: fix mask build for partial field offload`net/netfilter/nft_payload.c`	+1 ~~-11~~	0 replies
64/438	ASoC: SDCA: Correct pointer passed to devm_acpi_table_put`sound/soc/sdca/sdca_device.c`	+1 -1	0 replies
65/438	ASoC: SDCA: Always free firmware in FDL path`sound/soc/sdca/sdca_fdl.c`	+4 -1	0 replies
66/438	ASoC: SDCA: Make UMP message size check more robust`sound/soc/sdca/sdca_ump.c`	+2 -2	0 replies
67/438	ASoC: SDCA: Ensure that Control Range is large enough for header`sound/soc/sdca/sdca_functions.c`	+2 -0	0 replies
68/438	rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()`net/rds/tcp.c`	+5 -3	0 replies
69/438	nexthop: take nh->lock for f6i_list walks in replace check and notify`net/ipv4/nexthop.c`	+11 -2	0 replies
70/438	nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush`net/ipv4/nexthop.c`	+6 -6	0 replies
71/438	af_unix: fix listen() succeeding on sockets in the wrong state`net/unix/af_unix.c`	+1 -0	0 replies
72/438	selftests/net/af_unix: test listen() rejects wrong socket states`tools/testing/selftests/net/af_unix/.gitignore` `tools/testing/selftests/net/af_unix/Makefile` `tools/testing/selftests/net/af_unix/unix_listen.c`	+189 -0	0 replies
73/438	xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx`net/xdp/xsk.c`	+8 -5	0 replies
74/438	xsk: drain continuation descs after overflow in xsk_build_skb()`include/net/xdp_sock.h` `net/xdp/xsk.c`	+43 -3	0 replies
75/438	xsk: provide sufficient space in pool->tx_descs`include/net/xsk_buff_pool.h` `net/xdp/xsk.c` `net/xdp/xsk_buff_pool.c`	+19 -9	0 replies
76/438	xsk: reclaim invalid Tx descriptors in ZC batch path`Documentation/networking/af_xdp.rst` `include/net/xsk_buff_pool.h` `net/xdp/xsk.c` +2 more	+248 ~~-62~~	0 replies
77/438	net/sched: sch_cake: skip clearing unused tins during rate adjustment`net/sched/sch_cake.c`	+5 -3	0 replies
78/438	pinctrl-amd: Dont clear S4 wake bits at probe`drivers/pinctrl/pinctrl-amd.c`	+1 -2	0 replies
79/438	scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer`drivers/scsi/libiscsi.c`	+1 -1	0 replies
80/438	scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer`drivers/scsi/libiscsi_tcp.c`	+1 -7	0 replies
81/438	scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race`drivers/scsi/hisi_sas/hisi_sas_v3_hw.c` `drivers/scsi/libsas/sas_init.c` `include/scsi/libsas.h`	+19 ~~-29~~	0 replies
82/438	smb: client: fix buffer leaks in SMB1 read and write`fs/smb/client/cifssmb.c`	+9 -3	0 replies
83/438	erofs: clean up erofs_ishare_fill_inode()`fs/erofs/internal.h` `fs/erofs/ishare.c`	+21 ~~-26~~	0 replies
84/438	erofs: remove fscache backend entirely`Documentation/filesystems/erofs.rst` `fs/erofs/Kconfig` `fs/erofs/Makefile` +7 more	+26 ~~-847~~	0 replies
85/438	erofs: ensure valid f_path for page cache sharing`fs/erofs/Kconfig` `fs/erofs/internal.h` `fs/erofs/ishare.c`	+31 ~~-32~~	0 replies
86/438	gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper`drivers/gpio/gpio-by-pinctrl.c`	+12 -6	0 replies
87/438	ACPI: CPPC: Skip writes to unsupported performance controls`drivers/acpi/cppc_acpi.c`	+4 -3	0 replies
88/438	wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()`drivers/net/wireless/ath/ath12k/mac.c`	+4 -1	0 replies
89/438	ASoC: tas2781: Use correct calibration data for SINEGAIN2 register`sound/soc/codecs/tas2781-i2c.c`	+2 -2	0 replies
90/438	spi: spi-cadence: Move TX FIFO full busy-wait into FIFO`drivers/spi/spi-cadence.c`	+16 ~~-10~~	0 replies
91/438	hwmon: (nct6775-core) Fix number of temperature registers for NCT6116`drivers/hwmon/nct6775-core.c`	+3 -5	0 replies
92/438	hwmon: (ina2xx) Fix various overflow issues`drivers/hwmon/ina2xx.c`	+35 ~~-26~~	0 replies
93/438	hwmon: (ltc4282) Fix reading the minimum alarm voltage`drivers/hwmon/ltc4282.c`	+2 -2	0 replies
94/438	hwmon: (sht3x) Fix unaligned accesses`drivers/hwmon/sht3x.c`	+5 -4	0 replies
95/438	hwmon: (lm90) Only report alarms if driver is ready`drivers/hwmon/lm90.c`	+2 -2	0 replies
96/438	hwmon: (nzxt-smart2) DMA-align output buffer`drivers/hwmon/nzxt-smart2.c`	+1 -1	0 replies
97/438	net: do not send ICMP/NDISC Redirects when peer allocation fails`net/ipv4/route.c` `net/ipv6/ip6_output.c` `net/ipv6/ndisc.c`	+3 -3	0 replies
98/438	hwmon: (nct6775-core) Prevent access to unsupported weight registers`drivers/hwmon/nct6775-core.c`	+6 -6	0 replies
99/438	net: bridge: mrp: fix Option TLV length in MRP_Test frames`net/bridge/br_mrp.c`	+1 -1	0 replies
100/438	ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()`sound/soc/sophgo/cv1800b-sound-adc.c`	+8 -2	0 replies
101/438	forcedeth: fix UAF of txrx_stats in nv_remove`drivers/net/ethernet/nvidia/forcedeth.c`	+2 -2	0 replies
102/438	hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors`drivers/hwmon/adt7470.c`	+29 ~~-11~~	0 replies
103/438	hwmon: (adt7470) Fix cache updated before hardware write on I2C error`drivers/hwmon/adt7470.c`	+9 -5	0 replies
104/438	hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread`drivers/hwmon/adt7470.c`	+1 -1	0 replies
105/438	hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()`drivers/hwmon/adt7470.c`	+17 -2	0 replies
106/438	hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks`drivers/hwmon/adt7470.c`	+2 -2	0 replies
107/438	hwmon: (adt7470) Use cached PWM frequency value`drivers/hwmon/adt7470.c`	+18 -2	0 replies
108/438	hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read`drivers/hwmon/adt7470.c`	+10 ~~-13~~	0 replies
109/438	hwmon: (adt7470) Fix PWM auto temp state array and bounds check`drivers/hwmon/adt7470.c`	+6 -1	0 replies
110/438	rtase: fix double free of multi-frag skb on DMA map failure`drivers/net/ethernet/realtek/rtase/rtase_main.c`	+3 -0	0 replies
111/438	ethtool: Embed FEC hist ranges as buffer in struct`drivers/net/ethernet/mellanox/mlx5/core/en.h` `drivers/net/ethernet/mellanox/mlx5/core/en_main.c` `drivers/net/ethernet/mellanox/mlx5/core/en_stats.c` +1 more	+10 ~~-18~~	0 replies
112/438	powerpc/boot: Fix simpleboot CPU node lookup check`arch/powerpc/boot/simpleboot.c`	+1 -1	0 replies
113/438	powerpc/boot: Fix treeboot-currituck CPU node lookup check`arch/powerpc/boot/treeboot-currituck.c`	+1 -1	0 replies
114/438	powerpc/boot: Fix treeboot-akebono CPU node lookup check`arch/powerpc/boot/treeboot-akebono.c`	+1 -1	0 replies
115/438	net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds`net/sched/cls_u32.c`	+7 -0	0 replies
116/438	net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()`net/ipv4/udp_tunnel_nic.c`	+17 ~~-15~~	0 replies
117/438	wifi: mac80211: validate individual TWT params before driver setup`net/mac80211/s1g.c`	+4 -0	0 replies
118/438	netfs: clear PG_private_2 on copy-to-cache append failure`fs/netfs/read_pgpriv2.c`	+1 -0	0 replies
119/438	netfs: handle single writeback rolling buffer allocation failure`fs/netfs/write_issue.c`	+6 -1	0 replies
120/438	netfs: release readahead folios on iterator preparation failure`fs/netfs/buffered_read.c`	+3 -1	0 replies
121/438	netfs: Fix folio_queue ENOMEM in writeback by adding a mempool`fs/netfs/buffered_read.c` `fs/netfs/internal.h` `fs/netfs/main.c` +6 more	+51 ~~-34~~	0 replies
122/438	net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller`drivers/net/ethernet/mediatek/mtk_eth_soc.c`	+1 -1	0 replies
123/438	hwmon: (pmbus) Fix return value from pmbus_update_byte_data()`drivers/hwmon/pmbus/pmbus_core.c`	+1 -1	0 replies
124/438	idpf: bound interrupt-vector register fill to the allocated array`drivers/net/ethernet/intel/idpf/idpf_dev.c` `drivers/net/ethernet/intel/idpf/idpf_vf_dev.c` `drivers/net/ethernet/intel/idpf/idpf_virtchnl.c` +1 more	+6 -5	0 replies
125/438	idpf: adjust TxQ ring count minimum`drivers/net/ethernet/intel/idpf/idpf_txrx.c` `drivers/net/ethernet/intel/idpf/idpf_txrx.h`	+2 -5	0 replies
126/438	idpf: Fix mailbox IRQ name leak on request failure`drivers/net/ethernet/intel/idpf/idpf_lib.c`	+1 -1	0 replies
127/438	ice: suppress DPLL errors during reset recovery`drivers/net/ethernet/intel/ice/ice_dpll.c`	+12 -7	0 replies
128/438	Bluetooth: ISO: clear iso_data always when detaching conn from hcon`net/bluetooth/iso.c`	+1 -0	0 replies
129/438	Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp`net/bluetooth/l2cap_core.c`	+5 -0	0 replies
130/438	Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release`net/bluetooth/iso.c`	+20 -6	0 replies
131/438	Bluetooth: ISO: lock sk in iso_sock_getname`net/bluetooth/iso.c`	+4 -0	0 replies
132/438	Bluetooth: ISO: lock sk in iso_connect_ind`net/bluetooth/iso.c`	+11 -8	0 replies
133/438	Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos`net/bluetooth/iso.c`	+1 -1	0 replies
134/438	Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()`net/bluetooth/iso.c`	+3 -3	0 replies
135/438	Bluetooth: ISO: hold sk properly in iso_conn_ready`net/bluetooth/iso.c`	+23 ~~-11~~	0 replies
136/438	Bluetooth: ISO: fix leaking sk after socket release`net/bluetooth/iso.c`	+18 -4	0 replies
137/438	Bluetooth: ISO: avoid deadlocks in iso_sock_timeout`net/bluetooth/iso.c`	+29 ~~-31~~	0 replies
138/438	Bluetooth: ISO: ensure no dangling hcon references in iso_conn`net/bluetooth/iso.c`	+21 -3	0 replies
139/438	Bluetooth: ISO: fix refcounting of iso_conn`net/bluetooth/iso.c`	+17 ~~-12~~	0 replies
140/438	Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero`include/net/bluetooth/hci_core.h` `net/bluetooth/hci_conn.c` `net/bluetooth/iso.c`	+58 ~~-12~~	0 replies
141/438	Bluetooth: btintel: Validate length before parsing diagnostics TLV`drivers/bluetooth/btintel.c`	+3 -0	0 replies
142/438	Bluetooth: hci_conn: hold conn reference in abort_conn_sync()`net/bluetooth/hci_conn.c`	+11 -1	0 replies
143/438	Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks`net/bluetooth/hci_sync.c`	+24 -8	0 replies
144/438	Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback`net/bluetooth/hci_sync.c`	+12 -4	0 replies
145/438	Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback`net/bluetooth/hci_sync.c`	+7 -2	0 replies
146/438	Bluetooth: hci_sync: hold conn in hci_past_sync() callback`net/bluetooth/hci_sync.c`	+8 -3	0 replies
147/438	Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync`net/bluetooth/hci_sync.c`	+3 -1	0 replies
148/438	Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync`net/bluetooth/hci_sync.c`	+0 ~~-13~~	0 replies
149/438	x86/boot: Add volatile, clobbers and zero-length test in memcmp()`arch/x86/boot/string.c`	+9 -2	0 replies
150/438	net: phylink: put link_gpio if phylink_create fails`drivers/net/phy/phylink.c`	+15 ~~-14~~	0 replies
151/438	scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE`drivers/target/target_core_iblock.c`	+3 -3	0 replies
152/438	scsi: ufs: core: Cancel RTC work in active-active suspend`drivers/ufs/core/ufshcd.c`	+4 -2	0 replies
153/438	scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"`drivers/ufs/core/ufshcd.c`	+3 ~~-36~~	0 replies
154/438	scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req`drivers/s390/scsi/zfcp_aux.c`	+1 -0	0 replies
155/438	scsi: target: Clear cmd_cnt when initial counter enrollment fails`drivers/target/target_core_transport.c`	+10 -2	0 replies
156/438	octeontx2: cn20k: Coordinate default rules with NIX LF lifecycle`drivers/net/ethernet/marvell/octeontx2/af/mbox.h` `drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c` `drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c` +1 more	+69 ~~-35~~	0 replies
157/438	octeontx2-af: Block VFs from clobbering special CGX PKIND state`drivers/net/ethernet/marvell/octeontx2/af/cgx.c` `drivers/net/ethernet/marvell/octeontx2/af/cgx.h` `drivers/net/ethernet/marvell/octeontx2/af/rvu.h` +3 more	+131 ~~-14~~	0 replies
158/438	scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit`drivers/scsi/mpi3mr/mpi3mr_fw.c`	+7 -2	0 replies
159/438	scsi: ufs: core: Initialize hba->rpmbs list in ufshcd`drivers/ufs/core/ufs-rpmb.c` `drivers/ufs/core/ufshcd.c`	+1 -2	0 replies
160/438	net: sxgbe: free TX rings on RX allocation failure`drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c`	+4 -5	0 replies
161/438	net: sxgbe: check descriptor ring allocation failures`drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c`	+4 -1	0 replies
162/438	can: isotp: check register_netdevice_notifier() error in module init`net/can/isotp.c`	+9 -4	0 replies
163/438	drm/i915/dp: Ignore the sinks DSC max FRL rate without a PCON DSC encoder`drivers/gpu/drm/i915/display/intel_dp.c`	+8 -1	0 replies
164/438	drm/xe/pt: check no-DMA huge-pte cases before DMA segment test`drivers/gpu/drm/xe/xe_pt.c`	+8 -5	0 replies
165/438	fprobe: Fix module reference count leak on error in register_fprobe()`kernel/trace/fprobe.c`	+2 -4	0 replies
166/438	tracing/mmiotrace: Reset dropped_count in mmio_reset_data()`kernel/trace/trace_mmiotrace.c`	+1 -0	0 replies
167/438	tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions`kernel/trace/trace_mmiotrace.c`	+10 -2	0 replies
168/438	riscv: drop __init from vec_check_unaligned_access_speed_all_cpus`arch/riscv/kernel/unaligned_access_speed.c`	+2 -2	0 replies
169/438	accel/qaic: use sizeof(*trans_hdr) for transaction length check`drivers/accel/qaic/qaic_control.c`	+1 -1	0 replies
170/438	riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove`arch/riscv/mm/init.c`	+2 -2	0 replies
171/438	ring-buffer: Fix reader page read offset for remote buffers`kernel/trace/ring_buffer.c`	+1 -0	0 replies
172/438	ipv6: release fib6_null_entry on subtree failure`net/ipv6/ip6_fib.c`	+1 -0	0 replies
173/438	riscv: vdso: Only try to install vDSO when present`arch/riscv/Makefile`	+1 -1	0 replies
174/438	net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend`drivers/net/dsa/mt7530-mdio.c`	+9 -2	0 replies
175/438	net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling`drivers/net/dsa/mt7530.c`	+18 ~~-10~~	0 replies
176/438	net: dsa: mt7530: error out on failed reads in MT7531 PHY polling`drivers/net/dsa/mt7530.c`	+20 ~~-38~~	0 replies
177/438	net: stmmac: Fix E2E delay mechanism`drivers/net/ethernet/stmicro/stmmac/stmmac_main.c`	+2 -1	0 replies
178/438	net: mana: Create separate EQs for each vPort`drivers/infiniband/hw/mana/main.c` `drivers/infiniband/hw/mana/mana_ib.h` `drivers/infiniband/hw/mana/qp.c` +3 more	+228 ~~-67~~	0 replies
179/438	net: mana: Return error code from mana_create_rxq()`drivers/net/ethernet/microsoft/mana/mana_en.c`	+4 -4	0 replies
180/438	ptp: netc: fix potential interrupt storm caused by incorrect unbind order`drivers/ptp/ptp_netc.c`	+12 -3	0 replies
181/438	net: libwx: fix FDIR ATR queue mismatch for software VLAN packets`drivers/net/ethernet/wangxun/libwx/wx_lib.c`	+2 -0	0 replies
182/438	octeontx2-pf: Set correct sequence for carrier off and tx queue stop`drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c`	+1 -1	0 replies
183/438	sched/deadline: Use revised wakeup rule only for running dl_server`kernel/sched/deadline.c`	+2 -1	0 replies
184/438	spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs`drivers/spi/spi-nxp-fspi.c`	+80 -3	0 replies
185/438	qede: sync udp_tunnel ports outside qede_lock in the recovery path`drivers/net/ethernet/qlogic/qede/qede_main.c`	+22 ~~-22~~	0 replies
186/438	drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status`drivers/gpu/drm/i915/display/intel_ddi.c` `drivers/gpu/drm/i915/display/intel_hdmi.c` `drivers/gpu/drm/i915/display/intel_hdmi.h`	+30 -0	0 replies
187/438	ksmbd: return success for deferred final close`fs/smb/server/vfs_cache.c`	+3 -1	0 replies
188/438	ksmbd: fix use-after-free in __close_file_table_ids()`fs/smb/server/vfs_cache.c`	+2 -0	0 replies
189/438	ksmbd: use memcmp() to compare ClientGUIDs`fs/smb/server/smb2pdu.c`	+2 -2	0 replies
190/438	iomap: add a separate bio_set for iomap_split_ioend`fs/iomap/ioend.c`	+19 -2	0 replies
191/438	mshv: Fix race in mshv_irqfd_deassign`drivers/hv/mshv_eventfd.c`	+3 -2	0 replies
192/438	mshv: Fix level-triggered check on uninitialized data`drivers/hv/mshv_eventfd.c`	+14 ~~-11~~	0 replies
193/438	mshv: Fix missing error code on VP allocation failure`drivers/hv/mshv_root_main.c`	+3 -1	0 replies
194/438	mshv: Order pt_vp_array publish against irqfd assertion path`drivers/hv/mshv_eventfd.c` `drivers/hv/mshv_root_main.c`	+15 -2	0 replies
195/438	mshv: Publish VP to pt_vp_array before installing the file descriptor`drivers/hv/mshv_root_main.c`	+22 -7	0 replies
196/438	ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path`kernel/trace/ring_buffer.c`	+1 -0	0 replies
197/438	iommufd/viommu: Release the igroup lock on the vdevice_size error path`drivers/iommu/iommufd/viommu.c`	+1 -1	0 replies
198/438	iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds`drivers/iommu/iommufd/viommu.c`	+15 -5	0 replies
199/438	iommufd: Reject DMABUF pages from the access pin path`drivers/iommu/iommufd/pages.c`	+3 -0	0 replies
200/438	iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace`drivers/iommu/iommufd/device.c`	+1 -1	0 replies
201/438	iommu/iommufd: Fix IOPF group ownership UAF`drivers/iommu/io-pgfault.c` `drivers/iommu/iommufd/eventq.c` `include/linux/iommu.h`	+26 -5	0 replies
202/438	kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos`Makefile`	+3 -5	0 replies
203/438	ACPI: CPPC: Check all controls for fast switching`drivers/acpi/cppc_acpi.c` `drivers/cpufreq/cppc_cpufreq.c` `include/acpi/cppc_acpi.h`	+21 -8	0 replies
204/438	mm: mglru: fix stale batch updates after memcg reparenting`include/linux/memcontrol.h` `mm/vmscan.c`	+29 -7	0 replies
205/438	mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()`mm/hugetlb.c`	+7 -3	0 replies
206/438	pinctrl: microchip-sgpio: add missing select REGMAP_MMIO`drivers/pinctrl/Kconfig`	+1 -0	0 replies
207/438	pinctrl: devicetree: dont free uninitialized dev_name on error path`drivers/pinctrl/devicetree.c`	+4 -0	0 replies
208/438	btrfs: raid56: fix scrub read assembly submitting no reads`fs/btrfs/raid56.c`	+5 -6	0 replies
209/438	erofs: cap LZMA stream pool size`fs/erofs/Kconfig` `fs/erofs/decompressor_lzma.c`	+16 -1	0 replies
210/438	pinctrl: bm1880: add missing select GENERIC_PINCONF`drivers/pinctrl/Kconfig`	+1 -0	0 replies
211/438	fortify: Disable -Wstringop-overread in tests`lib/test_fortify/Makefile`	+1 -0	0 replies
212/438	lib: test_hmm: use device devt for coherent device range selection`lib/test_hmm.c`	+1 -1	0 replies
213/438	btrfs: zoned: fix missing chunk metadata reservation`fs/btrfs/block-group.c`	+19 ~~-15~~	0 replies
214/438	ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset`fs/ocfs2/dir.c`	+3 -2	0 replies
215/438	mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE`mm/migrate_device.c`	+3 -2	0 replies
216/438	mm/util: dont read __page_2 for order-1 folios in snapshot_page()`mm/util.c`	+1 -1	0 replies
217/438	selftest: fix headers in fclog.c`tools/testing/selftests/filesystems/fclog.c`	+1 -3	0 replies
218/438	fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes`fs/proc/task_mmu.c` `tools/testing/selftests/mm/pagemap_ioctl.c`	+67 -3	0 replies
219/438	fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes`fs/proc/task_mmu.c`	+18 -2	0 replies
220/438	mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()`mm/percpu-km.c`	+1 -1	0 replies
221/438	mm/hugetlb: fix list corruption in allocate_file_region_entries()`mm/hugetlb.c`	+1 -1	0 replies
222/438	userfaultfd: wait on source PMD during UFFDIO_MOVE`mm/huge_memory.c`	+1 -1	0 replies
223/438	mm/vmstat: fold stranded per-cpu node stats when a node comes online`mm/mm_init.c`	+11 -4	0 replies
224/438	KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs`arch/x86/kvm/x86.c`	+6 -0	0 replies
225/438	tracing/probes: Reject $arg0 in meta argument expansion`kernel/trace/trace_probe.c`	+5 -1	0 replies
226/438	tracing/fprobe: Roll back on enable_trace_fprobe() failure`kernel/trace/trace_fprobe.c`	+11 -1	0 replies
227/438	KVM: VMX: add memory clobber to asm for VMX instructions`arch/x86/kvm/vmx/vmx_ops.h`	+4 -4	0 replies
228/438	KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active`arch/x86/kvm/svm/avic.c`	+0 -8	0 replies
229/438	KVM: s390: pci: Reject adapter interrupt forwarding if already enabled`arch/s390/kvm/pci.c`	+4 -0	0 replies
230/438	KVM: s390: pci: Fix memory accounting for pinned/unpinned pages`arch/s390/kvm/pci.c` `arch/s390/kvm/pci.h`	+34 ~~-11~~	0 replies
231/438	KVM: s390: pci: Fix missing error codes and memory unaccounting`arch/s390/kvm/pci.c`	+7 -2	0 replies
232/438	KVM: s390: pci: Fix resource leak on IRQ registration failure`arch/s390/kvm/pci.c`	+21 -8	0 replies
233/438	KVM: s390: pci: Fix NULL dereference on AIBV allocation failure`arch/s390/kvm/pci.c`	+8 -0	0 replies
234/438	KVM: s390: pci: Validate AIBV and AISB before pinning guest pages`arch/s390/kvm/pci.c`	+15 -1	0 replies
235/438	dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister`drivers/dibs/dibs_loopback.c`	+24 ~~-23~~	0 replies
236/438	sctp: validate Adaptation Indication parameter length`net/sctp/sm_make_chunk.c`	+6 -0	0 replies
237/438	audit: fix potential integer overflow in audit_log_n_string()`kernel/audit.c`	+9 -2	0 replies
238/438	audit: fix potential use-after-free in audit_del_rule()`kernel/auditfilter.c`	+4 -2	0 replies
239/438	Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()`drivers/bluetooth/btusb.c`	+9 ~~-21~~	0 replies
240/438	Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()`drivers/bluetooth/btmtk.c`	+22 ~~-28~~	0 replies
241/438	Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()`drivers/bluetooth/btmtk.c`	+15 ~~-21~~	0 replies
242/438	Bluetooth: mgmt: fix pending command UAF in EIR updates`net/bluetooth/mgmt.c`	+18 -2	0 replies
243/438	Bluetooth: SCO: give the socket its own sco_conn reference`net/bluetooth/sco.c`	+13 -9	0 replies
244/438	Bluetooth: mgmt: fix UAF in pair command cancellation`net/bluetooth/mgmt.c`	+46 ~~-18~~	0 replies
245/438	Bluetooth: hci_sync: Fix advertising data UAFs`net/bluetooth/hci_sync.c`	+97 ~~-34~~	0 replies
246/438	Bluetooth: HIDP: reject frames without a transaction header`net/bluetooth/hidp/core.c`	+15 ~~-10~~	0 replies
247/438	Bluetooth: HIDP: validate numbered report payloads`net/bluetooth/hidp/core.c`	+3 -2	0 replies
248/438	bpf: lwt: Fix dst reference leak on reroute failure`net/core/lwt_bpf.c`	+3 -1	0 replies
249/438	afs: Fix afs_fs_fetch_data() to set call->async`fs/afs/fsclient.c`	+3 -0	0 replies
250/438	afs: Fix afs_fs_fetch_data() to subtract transferred from len`fs/afs/fsclient.c`	+1 -1	0 replies
251/438	afs: Fix UAF when sending a message`fs/afs/internal.h`	+2 -1	0 replies
252/438	ALSA: 6fire: Fix UAF at error handling during probe`sound/usb/6fire/chip.c`	+4 -0	0 replies
253/438	ALSA: hda/realtek: Add quirk for TongFang X6SP45xU`sound/hda/codecs/realtek/alc269.c`	+2 -1	0 replies
254/438	ALSA: lx6464es: fix period byte count for 16-bit streams`sound/pci/lx6464es/lx6464es.c` `sound/pci/lx6464es/lx_core.c`	+2 -8	0 replies
255/438	ALSA: pcm: wake linked drain waiters on unlink`sound/core/pcm_native.c`	+7 -0	0 replies
256/438	ALSA: seq: Fix division by zero in initialize_timer()`sound/core/seq/seq_timer.c`	+4 -5	0 replies
257/438	ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes`sound/core/timer.c`	+2 -0	0 replies
258/438	ALSA: ump: fix double free of out_cvts on rawmidi error`sound/core/ump.c`	+1 -0	0 replies
259/438	ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return`sound/soc/fsl/fsl_asrc.c`	+1 -1	0 replies
260/438	ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return`sound/soc/fsl/fsl_easrc.c`	+1 -1	0 replies
261/438	ASoC: tas2562: fix DVC coefficient write order`sound/soc/codecs/tas2562.c`	+15 -8	0 replies
262/438	ASoC: tas2562: fix broken entries in the volume lookup table`sound/soc/codecs/tas2562.c`	+4 -3	0 replies
263/438	ata: libata-eh: Increase STANDBY IMMEDIATE timeout`drivers/ata/libata-eh.c` `include/linux/libata.h`	+9 -1	0 replies
264/438	ata: libata-sata: fix ata_scsi_lpm_supported() iteration`drivers/ata/libata-sata.c`	+1 -1	0 replies
265/438	ata: libata-scsi: terminate deferred commands on time out`drivers/ata/libata-eh.c` `drivers/ata/libata-scsi.c` `drivers/ata/libata.h` +1 more	+111 ~~-35~~	0 replies
266/438	ata: libata-scsi: schedule deferred atapi command`drivers/ata/libata-scsi.c`	+6 -2	0 replies
267/438	ALSA: usb-audio: fix use-after-free in ump_to_endpoint()`sound/usb/midi2.c`	+3 -1	0 replies
268/438	ALSA: usb-audio: fix stack info leak in RME Digiface status`sound/usb/mixer_quirks.c`	+1 -1	0 replies
269/438	ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()`sound/usb/midi.c`	+2 -0	0 replies
270/438	ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set`sound/usb/endpoint.c`	+4 -2	0 replies
271/438	ALSA: usb-audio: Clamp frame size in implicit-feedback mode`sound/usb/endpoint.c`	+5 -3	0 replies
272/438	dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+`include/linux/dma/qcom_bam_dma.h`	+16 -5	0 replies
273/438	e1000: fix memory leak in e1000_probe()`drivers/net/ethernet/intel/e1000/e1000_main.c`	+1 -1	0 replies
274/438	fou: Fix use-after-free in fou_create()`net/ipv4/fou_core.c`	+1 -1	0 replies
275/438	igbvf: Fix leak in TX DMA error cleanup`drivers/net/ethernet/intel/igbvf/netdev.c`	+0 -2	0 replies
276/438	igc: remove napi_synchronize() in igc_down()`drivers/net/ethernet/intel/igc/igc_main.c`	+1 -2	0 replies
277/438	ipvs: do not propagate one-packet flag to synced conns`net/netfilter/ipvs/ip_vs_conn.c`	+3 -0	0 replies
278/438	ksmbd: reject repeated SMB2 NEGOTIATE requests`fs/smb/server/connection.h` `fs/smb/server/smb2pdu.c` `fs/smb/server/smb_common.c`	+37 ~~-15~~	0 replies
279/438	mshv: fix hv_input_get_system_property struct`include/hyperv/hvhdk_mini.h`	+2 -1	0 replies
280/438	net/smc: fix socket use-after-free during link group termination`net/smc/smc_core.c`	+1 -1	0 replies
281/438	netfilter: ipset: do not update comments from kernel-side hash adds`net/netfilter/ipset/ip_set_hash_gen.h`	+1 -1	0 replies
282/438	of/address: Fix NULL bus dereference in of_pci_range_parser_one()`drivers/of/address.c`	+16 -6	0 replies
283/438	PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug`drivers/pci/controller/dwc/pci-imx6.c`	+6 -3	0 replies
284/438	tipc: avoid use-after-free in poll trace queue dumps`net/tipc/socket.c`	+1 -1	0 replies
285/438	x86/CPU/AMD: Carve out a Zen5 models range`arch/x86/kernel/cpu/amd.c`	+3 -1	0 replies
286/438	wifi: mac80211: fix tid_tx use-after-free on BA session stop`net/mac80211/agg-tx.c`	+3 -1	0 replies
287/438	wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames`drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c`	+1 -1	0 replies
288/438	binfmt_misc: restore write access when removing an entry`fs/binfmt_misc.c`	+3 -1	0 replies
289/438	binfmt_misc: use exe_file_deny_write_access() for the interpreter clone`fs/binfmt_misc.c`	+8 -2	0 replies
290/438	binfmt_misc: reject a flag character as the field delimiter`fs/binfmt_misc.c`	+4 -0	0 replies
291/438	binfmt_misc: dont let an F entry pin its own instance`fs/binfmt_misc.c`	+4 -0	0 replies
292/438	binfmt_misc: dont leak the user namespace when the mount fails`fs/binfmt_misc.c`	+15 ~~-17~~	0 replies
293/438	io_uring/net: initialize mshot_len for send`io_uring/net.c`	+1 -0	0 replies
294/438	io_uring: preserve task restrictions across exec`io_uring/cancel.c` `io_uring/tctx.c` `io_uring/tctx.h`	+8 -2	0 replies
295/438	mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios`mm/huge_memory.c`	+12 -0	0 replies
296/438	mm/page_reporting: use system_freezable_wq to fix UAF during suspend`mm/page_reporting.c`	+4 -2	0 replies
297/438	mm: memcg: initialize *locked in memcg1_oom_prepare() stub`mm/memcontrol-v1.h`	+5 -1	0 replies
298/438	net: bridge: stop fast-leave after deleting a port group`net/bridge/br_multicast.c`	+1 -0	0 replies
299/438	net: ipv6: clear suppressed fib6 rule result`net/ipv6/fib6_rules.c`	+1 -0	0 replies
300/438	net: pktgen: fix proc entry use-after-free`net/core/pktgen.c`	+1 -3	0 replies
301/438	riscv/mm: use physical alignment for vmemmap_start_pfn`arch/riscv/mm/init.c`	+2 -1	0 replies
302/438	powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()`arch/powerpc/platforms/ps3/mm.c`	+1 -0	0 replies
303/438	um: vector: fix use-after-free in vector_mmsg_rx()`arch/um/drivers/vector_kern.c`	+3 -0	0 replies
304/438	uprobes: Fix NULL pointer dereference in hprobe_expire()`kernel/events/uprobes.c`	+1 -1	0 replies
305/438	veth: convert frag_list skbs before running XDP`drivers/net/veth.c` `net/core/skbuff.c`	+14 -8	0 replies
306/438	vxlan: re-fetch eth header after route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+1 -0	0 replies
307/438	vxlan: unclone skb head before modifying eth header in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+4 -0	0 replies
308/438	vxlan: use neigh_ha_snapshot() in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+4 -2	0 replies
309/438	vxlan: use pskb_network_may_pull() for transmit path header pulls`drivers/net/vxlan/vxlan_core.c` `drivers/net/vxlan/vxlan_mdb.c`	+5 -5	0 replies
310/438	vxlan: use pskb_network_may_pull() in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+2 -2	0 replies
311/438	ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()`drivers/block/ublk_drv.c`	+9 -0	0 replies
312/438	tracing: Check return value of __register_event() in trace_module_add_events()`kernel/trace/trace_events.c`	+2 -2	0 replies
313/438	tracing/filters: Fix false positive match in regex_match_full()`kernel/trace/trace_events_filter.c`	+3 -0	0 replies
314/438	spi: spi-qpic-snand: write the feature value before executing SET_FEATURE`drivers/spi/spi-qpic-snand.c`	+18 -4	0 replies
315/438	spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure`drivers/spi/spi-qcom-qspi.c`	+2 -1	0 replies
316/438	selftests/mm: fix potential wild pointer access of getline due to missing init`tools/testing/selftests/mm/mlock-random-test.c`	+1 -1	0 replies
317/438	selftests/clone3: fix wild pointer access of getline due to missing init`tools/testing/selftests/clone3/clone3_set_tid.c`	+1 -1	0 replies
318/438	scsi: libsas: terminate deferred commands on time out`drivers/ata/libata-scsi.c` `drivers/scsi/libsas/sas_scsi_host.c` `include/linux/libata.h` +1 more	+22 -2	0 replies
319/438	scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write`drivers/scsi/scsi_debug.c`	+6 -2	0 replies
320/438	scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc`Documentation/devicetree/bindings/ufs/qcom,sa8255p-ufshc.yaml`	+8 -1	0 replies
321/438	sctp: reject stale cookies with mismatched verification tags`net/sctp/sm_make_chunk.c`	+7 -4	0 replies
322/438	sctp: prevent peer transport count overflow`net/sctp/associola.c`	+3 -0	0 replies
323/438	hwmon: (npcm750-pwm-fan): stop fan timer on device detach`drivers/hwmon/npcm750-pwm-fan.c`	+11 -0	0 replies
324/438	hwmon: (pmbus/core) notify on the hwmon device, not the i2c client`drivers/hwmon/pmbus/pmbus_core.c`	+3 -2	0 replies
325/438	i2c: amd-mp2: Unregister callback on adapter add failure`drivers/i2c/busses/i2c-amd-mp2-plat.c`	+3 -1	0 replies
326/438	i2c: designware: defer probe if child GpioInt controllers are not bound`drivers/i2c/busses/i2c-designware-platdrv.c`	+80 -0	2 replies
327/438	gpiolib: tolerate gpio-hogs lacking a hogging state`drivers/gpio/gpiolib.c`	+8 -5	0 replies
328/438	gpio: pca953x: fix cache_only and IRQ state on restore_context() failure`drivers/gpio/gpio-pca953x.c`	+13 -2	0 replies
329/438	gpio: pch: use raw_spinlock_t for the register lock`drivers/gpio/gpio-pch.c`	+14 ~~-14~~	0 replies
330/438	cifs: add fscache_resize_cookie() to cifs_setsize()`fs/smb/client/inode.c`	+1 -0	0 replies
331/438	cpufreq: cppc: Sanitize lockless policy limit snapshots`drivers/cpufreq/cppc_cpufreq.c`	+22 -9	0 replies
332/438	cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()`drivers/cpufreq/powernow-k8.c`	+1 -0	0 replies
333/438	cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized`kernel/sched/cpufreq_schedutil.c`	+11 -0	0 replies
334/438	power: supply: bq25890: fix the -10 C NTC lookup entry`drivers/power/supply/bq25890_charger.c`	+1 -1	0 replies
335/438	power: supply: macsmc: Support macOS 27 SMC firmware`drivers/power/supply/macsmc-power.c`	+45 -7	1 reply
336/438	power: supply: max17040: handle missing status supplier`drivers/power/supply/max17040_battery.c`	+5 -1	0 replies
337/438	s390/pci: Fix s390_pci_mmio_write syscall error return without MIO`arch/s390/pci/pci_mmio.c`	+1 -0	0 replies
338/438	s390/qeth: Check CAP_NET_ADMIN for private ioctls`drivers/s390/net/qeth_core_main.c`	+3 -0	0 replies
339/438	s390/dasd: Fix potential NULL pointer dereference`drivers/s390/block/dasd_ioctl.c`	+1 -1	0 replies
340/438	s390/dasd: Fix undersized format-check buffer`drivers/s390/block/dasd_eckd.c`	+7 -4	0 replies
341/438	s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs`drivers/s390/crypto/zcrypt_api.c`	+1 -1	0 replies
342/438	s390/zcrypt: Close speculative mem read possibility`drivers/s390/crypto/zcrypt_api.c`	+2 -0	0 replies
343/438	s390/zcrypt: Fix buffer over-read in cca_cipher2protkey`drivers/s390/crypto/pkey_cca.c` `drivers/s390/crypto/zcrypt_ccamisc.c` `drivers/s390/crypto/zcrypt_ccamisc.h`	+62 ~~-23~~	0 replies
344/438	s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()`drivers/s390/crypto/zcrypt_ccamisc.c`	+13 -6	0 replies
345/438	s390/zcrypt: Validate length for CCA AES cipher key requests`drivers/s390/crypto/zcrypt_ccamisc.c`	+3 -0	0 replies
346/438	s390/zcrypt: Validate length for CCA ECC private key requests`drivers/s390/crypto/zcrypt_ccamisc.c`	+3 -0	0 replies
347/438	phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask`drivers/phy/xilinx/phy-zynqmp.c`	+1 -1	0 replies
348/438	phy: zynqmp: use read-modify-write for SERDES scrambler bypass`drivers/phy/xilinx/phy-zynqmp.c`	+6 -2	0 replies
349/438	phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB`drivers/phy/xilinx/phy-zynqmp.c`	+29 ~~-10~~	0 replies
350/438	net: openvswitch: fix potential UAF on meter attach failure`net/openvswitch/meter.c`	+19 ~~-14~~	0 replies
351/438	net: openvswitch: fix skb leak on flow key update failure during recirculation`net/openvswitch/actions.c`	+9 -1	0 replies
352/438	net: openvswitch: fix skb leak on flow key update failure during ct`net/openvswitch/actions.c`	+1 -1	0 replies
353/438	ice: wait for reset completion in ice_resume()`drivers/net/ethernet/intel/ice/ice_main.c`	+10 -0	0 replies
354/438	ice: fix VF interrupts cleanup`drivers/net/ethernet/intel/ice/ice_vf_lib.c` `drivers/net/ethernet/intel/ice/ice_vf_lib_private.h` `drivers/net/ethernet/intel/ice/virt/queues.c`	+49 -0	0 replies
355/438	ice: fix memory leak in ice_lbtest_prepare_rings()`drivers/net/ethernet/intel/ice/ice_ethtool.c`	+5 -5	0 replies
356/438	i2c: spacemit: request IRQ after controller initialization`drivers/i2c/busses/i2c-k1.c`	+5 -5	0 replies
357/438	i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers`drivers/i2c/busses/i2c-qcom-cci.c`	+1 ~~-17~~	0 replies
358/438	i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock`drivers/i2c/busses/i2c-jz4780.c`	+4 -1	0 replies
359/438	i2c: iproc: reset bus after timeout if START_BUSY is stuck`drivers/i2c/busses/i2c-bcm-iproc.c`	+11 -0	0 replies
360/438	i2c: imx: mark I2C adapter when hardware is powered down`drivers/i2c/busses/i2c-imx.c`	+43 -2	0 replies
361/438	i2c: imx: Fix slave registration race and error handling`drivers/i2c/busses/i2c-imx.c`	+5 -3	0 replies
362/438	i2c: imx: Cancel hrtimer before clearing slave pointer`drivers/i2c/busses/i2c-imx.c`	+1 -0	0 replies
363/438	can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured`drivers/net/can/c_can/c_can_main.c`	+4 -4	0 replies
364/438	can: ems_usb: validate CPC message lengths`drivers/net/can/usb/ems_usb.c`	+43 -0	0 replies
365/438	can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure`drivers/net/can/usb/etas_es58x/es58x_core.c`	+0 -1	0 replies
366/438	can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure`drivers/net/can/usb/gs_usb.c`	+2 -2	0 replies
367/438	can: isotp: fix timer drain order, wakeup handling and tx_gen ordering`net/can/isotp.c`	+230 ~~-87~~	0 replies
368/438	can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer`net/can/j1939/transport.c`	+1 -1	0 replies
369/438	can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking`net/can/j1939/bus.c` `net/can/j1939/j1939-priv.h` `net/can/j1939/main.c` +1 more	+11 -4	0 replies
370/438	can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()`drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c`	+1 -0	0 replies
371/438	can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents`drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c`	+11 -2	0 replies
372/438	can: rcar_canfd: change the initializing flow for clocks and resets`drivers/net/can/rcar/rcar_canfd.c`	+16 ~~-16~~	0 replies
373/438	can: softing: fw_parse(): validate firmware record spans`drivers/net/can/softing/softing_fw.c`	+32 ~~-14~~	0 replies
374/438	can: peak_usb: add bounds check for USB channel index`drivers/net/can/usb/peak_usb/pcan_usb_pro.c`	+16 -4	0 replies
375/438	can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error`drivers/net/can/usb/peak_usb/pcan_usb_core.c`	+0 -1	0 replies
376/438	can: peak_usb: validate uCAN receive record lengths`drivers/net/can/usb/peak_usb/pcan_usb_fd.c`	+39 -1	0 replies
377/438	can: ctucanfd: add missing MODULE_DEVICE_TABLE()`drivers/net/can/ctucanfd/ctucanfd_pci.c`	+1 -0	0 replies
378/438	can: ctucanfd: use self-test mode for PRESUME_ACK`drivers/net/can/ctucanfd/ctucanfd_base.c`	+2 -2	0 replies
379/438	can: ctucanfd: unmap BAR0 using base address`drivers/net/can/ctucanfd/ctucanfd_pci.c`	+1 -1	0 replies
380/438	can: ctucanfd: handle bus error interrupts`drivers/net/can/ctucanfd/ctucanfd_base.c`	+6 -2	0 replies
381/438	can: ctucanfd: mark error-active controller status valid`drivers/net/can/ctucanfd/ctucanfd_base.c`	+1 -1	0 replies
382/438	drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs`drivers/gpu/drm/display/drm_dp_helper.c`	+12 -0	0 replies
383/438	drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size`drivers/gpu/drm/vc4/vc4_irq.c`	+1 -1	0 replies
384/438	drm/vc4: Zero the tile state data array before each BIN job`drivers/gpu/drm/vc4/vc4_validate.c`	+23 -6	0 replies
385/438	drm/bridge: display-connector: Fix I2C adapter resource leak`drivers/gpu/drm/bridge/display-connector.c`	+8 -3	0 replies
386/438	drm/panthor: reject firmware sections with oversized data`drivers/gpu/drm/panthor/panthor_fw.c`	+9 -2	0 replies
387/438	drm/panthor: validate firmware interface structure sizes`drivers/gpu/drm/panthor/panthor_fw.c`	+24 ~~-12~~	0 replies
388/438	drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2`drivers/gpu/drm/mediatek/mtk_hdmi_v2.c`	+0 -8	0 replies
389/438	drm/mediatek: ovl_adaptor: balance component registrations`drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c`	+6 -1	0 replies
390/438	drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini`drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c`	+16 ~~-14~~	0 replies
391/438	drm/amdgpu: restore UMD profile pstate after runtime resume`drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c`	+15 -0	0 replies
392/438	drm/amdgpu: cap GTT size to physical RAM on APUs`drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c`	+12 -0	0 replies
393/438	drm/amd/pm: fix torn gpu metrics reads`drivers/gpu/drm/amd/pm/amdgpu_dpm.c` `drivers/gpu/drm/amd/pm/amdgpu_pm.c` `drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h`	+12 ~~-11~~	0 replies
394/438	drm/amd/pm: fix pptable use-after-free`drivers/gpu/drm/amd/pm/amdgpu_dpm.c` `drivers/gpu/drm/amd/pm/amdgpu_pm.c` `drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h`	+16 ~~-14~~	0 replies
395/438	drm/amd/pm: hide pp_table sysfs on APUs`drivers/gpu/drm/amd/pm/amdgpu_dpm.c`	+11 -2	0 replies
396/438	drm/amd/pm: use milliwatts for GPU power sensors`drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c` `drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c` `drivers/gpu/drm/amd/include/kgd_pp_interface.h` +24 more	+65 ~~-51~~	0 replies
397/438	drm/amd/display: check if dml21_add_phantom_plane() is successful`drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_utils.c`	+7 -8	0 replies
398/438	drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport`drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c`	+25 -6	0 replies
399/438	drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames`drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c`	+11 -5	0 replies
400/438	drm/amd/display: Silence link_dpms I2C retimer failures`drivers/gpu/drm/amd/display/dc/link/link_dpms.c`	+8 -8	0 replies
401/438	drm/amd/display: use proper context for logging`drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c`	+9 ~~-11~~	0 replies
402/438	drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE`drivers/gpu/drm/amd/amdkfd/kfd_chardev.c`	+7 -3	0 replies
403/438	drm/amdkfd: fix QID bit leak in pqm_create_queue()`drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c`	+1 -1	0 replies
404/438	drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment`drivers/gpu/drm/amd/amdkfd/kfd_queue.c`	+1 -1	0 replies
405/438	drm/amdkfd: Handle invalid event type in CRIU event restore`drivers/gpu/drm/amd/amdkfd/kfd_events.c`	+3 -0	0 replies
406/438	drm/amdkfd: hold event_mutex while checkpointing CRIU events`drivers/gpu/drm/amd/amdkfd/kfd_events.c`	+18 -4	0 replies
407/438	drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size`drivers/gpu/drm/vmwgfx/vmwgfx_resource.c`	+2 -2	0 replies
408/438	drm/vmwgfx: reject DX_BIND_QUERY without a DX context`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+5 -1	0 replies
409/438	drm/vmwgfx: clamp dirty-page range with min, not max`drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c`	+2 -2	0 replies
410/438	drm/vmwgfx: take fman->lock around fence list mutation in fifo_down`drivers/gpu/drm/vmwgfx/vmwgfx_fence.c`	+12 -1	0 replies
411/438	drm/vmwgfx: drop dma_buf reference on foreign-fd prime import`drivers/gpu/drm/vmwgfx/ttm_object.c`	+5 -2	0 replies
412/438	drm/vmwgfx: validate DRAW_PRIMITIVES header size before division`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+7 -1	0 replies
413/438	drm/vmwgfx: bound DMA command body size against suffix pointer`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+6 -0	0 replies
414/438	drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure`drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c`	+9 -8	0 replies
415/438	drm/vmwgfx: enforce cursor size limits for MOB cursors`drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c`	+44 -5	0 replies
416/438	drm/vmwgfx: use check_add_overflow for shader size+offset bound`drivers/gpu/drm/vmwgfx/vmwgfx_shader.c`	+9 -4	0 replies
417/438	drm/vmwgfx: validate external BO copy bounds for both stride paths`drivers/gpu/drm/vmwgfx/vmwgfx_blit.c`	+31 -8	0 replies
418/438	drm/xe/rtp: Maintain OA whitelists separately`drivers/gpu/drm/xe/xe_gt_debugfs.c` `drivers/gpu/drm/xe/xe_hw_engine.c` `drivers/gpu/drm/xe/xe_hw_engine_types.h` +1 more	+19 -1	0 replies
419/438	drm/xe/rtp: Keep track of non-OA nonpriv slots`drivers/gpu/drm/xe/xe_reg_whitelist.c`	+5 -2	0 replies
420/438	drm/xe/rtp: Generalize whitelist_apply_to_hwe`drivers/gpu/drm/xe/xe_reg_whitelist.c`	+6 -5	0 replies
421/438	drm/xe/rtp: Save OA nonpriv registers to register save/restore lists`drivers/gpu/drm/xe/xe_reg_whitelist.c`	+11 -0	0 replies
422/438	drm/xe/rtp: Toggle deny bit to (de-)whitelist OA regs`drivers/gpu/drm/xe/xe_reg_whitelist.c`	+15 -0	0 replies
423/438	drm/xe/rtp: (De-)whitelist OA registers for all hwes for a gt`drivers/gpu/drm/xe/xe_reg_whitelist.c` `drivers/gpu/drm/xe/xe_reg_whitelist.h`	+36 -2	0 replies
424/438	drm/xe/oa: (De-)whitelist OA registers on OA stream open/release`drivers/gpu/drm/xe/xe_oa.c`	+7 -0	0 replies
425/438	drm/xe/rtp: Ensure locking/ref counting for OA whitelists`drivers/gpu/drm/xe/xe_oa_types.h` `drivers/gpu/drm/xe/xe_reg_whitelist.c`	+12 -0	0 replies
426/438	usb: typec: ucsi: split connector lock classes`drivers/usb/typec/ucsi/ucsi.c` `drivers/usb/typec/ucsi/ucsi.h`	+9 -0	0 replies
427/438	usb: typec: ucsi: Fix race condition and ordering in port unregistration`drivers/usb/typec/ucsi/ucsi.c`	+39 ~~-43~~	0 replies
428/438	drm/xe: Drop unused param from xe_device_create()`drivers/gpu/drm/xe/xe_device.c` `drivers/gpu/drm/xe/xe_device.h` `drivers/gpu/drm/xe/xe_pci.c`	+11 -5	0 replies
429/438	drm/xe: Move xe->info.force_execlist initialization`drivers/gpu/drm/xe/xe_device.c` `drivers/gpu/drm/xe/xe_pci.c`	+1 -1	0 replies
430/438	drm/xe: Move xe->info.devid\|revid initialization`drivers/gpu/drm/xe/tests/xe_pci.c` `drivers/gpu/drm/xe/xe_device.c` `drivers/gpu/drm/xe/xe_pci.c`	+18 -2	0 replies
431/438	drm/xe: Separate early xe_device initialization`drivers/gpu/drm/xe/xe_device.c` `drivers/gpu/drm/xe/xe_device.h`	+29 ~~-11~~	0 replies
432/438	drm/xe: Set TTM device beneficial_order to 9 (2M)`drivers/gpu/drm/xe/xe_device.c`	+2 -1	0 replies
433/438	drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]`drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c` `drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c` `drivers/gpu/drm/drm_exec.c` +3 more	+20 ~~-24~~	0 replies
434/438	drm/xe: Wait on external BO kernel fences in exec IOCTL`drivers/gpu/drm/xe/xe_exec.c`	+16 -6	0 replies
435/438	media: chips-media: wave5: Support CBP profile`drivers/media/platform/chips-media/wave5/wave5-hw.c` `drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c` `drivers/media/platform/chips-media/wave5/wave5-vpuapi.h`	+8 -1	0 replies
436/438	drm/amd/display: check GRPH_FLIP status before sending event`drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c` `drivers/gpu/drm/amd/display/dc/core/dc.c` `drivers/gpu/drm/amd/display/dc/dc.h`	+197 ~~-40~~	0 replies
437/438	drm/amd/display: Exit idle optimizations before programming`drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c`	+46 ~~-32~~	0 replies
438/438	usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path`drivers/usb/typec/ucsi/ucsi.c`	+2 -2	0 replies

Reviews trailers per patch

260 of 438 patches have a Reviewed-by or Acked-by.

Patch	Jernej Skrabec	Frank Li	Vinicius Costa Gomes	Dave Jiang	Kevin Tian	Pranjal Shrivastava	Wolfram Sang	Jiri Olsa	Vlastimil Babka (SUSE)	Suren Baghdasaryan	Logan Gunthorpe	Maulik Shah	Linus Walleij	Konrad Dybcio	Teng Liu	Filipe Manana	Qu Wenruo	Daniel Vacek	David Sterba	Alper Mudar	Wander Lairson Costa	Michal Simek	CK Hu	Hamza Mahfooz	Michael Kelley	Anirudh Rayabharam (Microsoft)	Fuad Tabba	David Gstir	Richard Weinberger	Jarkko Sakkinen	Talha Berk Arslan	Pierre-Louis Bossart	Johannes Thumshirn	Naohiro Aota	Jason Xing	Stanislav Fomichev	Mike Pham	Toke Høiland-Jørgensen	Chris Leech	John Garry	Hongbo Li	Chao Yu	Jingbo Xu	Allison Henderson	Sumit Gupta	Lifeng Zheng	Rameshkumar Sundaram	Radhey Shyam Pandey	Ido Schimmel	Nikolay Aleksandrov	Vadim Fedorenko	Zhu Yanjun	Jacob Keller	Justin Lai	Ritesh Harjani (IBM)	Maciej Fijalkowski	Jamal Hadi Salim	Victor Nogueira	Aleksandr Loktionov	Samuel Salin	Simon Horman	Rinitha S	Andrew Lunn	Mike Christie	Peter Wang	Bean Huo	Bart Van Assche	Sebastian Andrzej Siewior	André Draszik	M Nikhil	Chinmaya Kajagar	Nihar Panda	[email protected]	Ankit Nautiyal	Maxime Chevallier	Joe Damato	Matthew Brost	Juri Lelli	Andrea Righi	Arun R Murthy	Vincent Donnefort	Peiyang He	Philipp Hahn	Harry Yoo (Oracle)	Johannes Weiner	Shakeel Butt	David Hildenbrand (Arm)	Andy Shevchenko	Jeff Hugo	Keir Fraser	Muhammad Usama Anjum	Dennis Zhou	Muchun Song	Rik van Riel	Baolin Wang	Lance Yang	Lorenzo Stoakes	Christian Borntraeger	Matthew Rosato	Alexandra Winter	Xin Long	Alistair Popple	Ren Wei	Shuangpeng Bai	Dmitry Antipov	Balbir Singh	Zi Yan	Matthew Wilcox (Oracle)	Luiz Capitulino	Gao Xiang	Lakshmi Sowjanya D	Dmitry Baryshkov	Dima Ruinskiy	Moriya Kadosh	Julian Anastasov	Mahanta Jambigi	Jozsef Kadlecsik	Manivannan Sadhasivam	Richard Zhu	Tung Nguyen	Gabriel Krisman Bertazi	Miaohe Lin	David Rientjes	Michael S. Tsirkin	Joshua Hahn	SeongJae Park	Kiryl Shutsemau (Meta)	Geert Uytterhoeven	Igor Pylypiv	Niklas Cassel	Martin K. Petersen	Lorenzo Bianconi	Md Sadre Alam	Hannes Reinecke	Damien Le Moal	Krzysztof Kozlowski	Bartosz Golaszewski	Paulo Alcantara	Viresh Kumar	Zhongqiu Han	Christian Loehle	Sven Peter	Joshua Peisach	Janne Grunau	Julian Ruess	Farhan Ali	Eduard Shishkin	Stefan Haberland	Jan Höppner	Finn Callies	Ingo Franzki	Holger Dengler	Harald Freudenberger	Eelco Chaudron	Caleb Sander Mateos	Oleg Nesterov	Andrii Nakryiko	Aaron Conole	Carlos Song	Vincent Mailhol	Oleksij Rempel	Kohei Enju	Przemek Kitszel	Alexander Nowlin	Claudiu Beznea	Pavel Pisa	Patryk Holda	Maíra Canal	Iago Toral Quiroga	Johan Hovold	Luca Ceresoli	Steven Price	Boris Brezillon	Christian König	Hawking Zhang	Yang Wang	David Francis	Kenneth Feng	Asad Kamal	Dillon Varone	Dan Wheeler	Sun peng (Leo) Li	Troy Mitchell	Alex Elder	Vladimir Zapolskiy	Loic Poulain	Ray Jui	Ian Forbes	Umesh Nerlige Ramappa	Bhawanpreet Lakha	Heikki Krogerus	Benson Leung	Raag Jadav	Gustavo Sousa	Kent Russell	Andi Shyti	Thomas Hellström	Matthew Auld	Brandon Brnich	Nicolas Dufresne	Mario Limonciello (AMD)	Chaitanya Kumar Borah	Alysa Liu	Wayne Lin	Ronald Warsow	Pavel Machek (CIP)	Shuah Khan	Brett A C Sheffield	Takeshi Ogasawara	Benjamin Boortz	Justin M. Forbes	Peter Schneider	Markus Reichelt	Ron Economos	Barry K. Nathan	Miguel Ojeda	Jeffrin Jose T	Mark Brown	Florian Fainelli
Series																																																																																																																																																																																																													T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b
1/438
2/438									R-b	R-b
3/438										A-b
4/438										R-b
5/438
6/438
7/438
8/438		R-b									Review-by
9/438												R-b	R-b	R-b
10/438
11/438	A-b	R-b
12/438		R-b	A-b
13/438			A-b	R-b
14/438					R-b	R-b
15/438							R-b
16/438
17/438								A-b
18/438
19/438
20/438
21/438
22/438
23/438
24/438
25/438																																	R-b
26/438																																		R-b
27/438																																		R-b
28/438															T-b	R-b
29/438																	R-b
30/438																		R-b	R-b
31/438																	R-b
32/438																				T-b
33/438
34/438																					R-b
35/438																						R-b
36/438																						R-b
37/438
38/438
39/438
40/438																							R-b
41/438																								R-b
42/438																									R-b
43/438																										R-b
44/438																										R-b
45/438
46/438
47/438																											R-b
48/438																											R-b T-b
49/438																											R-b T-b
50/438																											R-b T-b
51/438																											T-b R-b
52/438																												R-b	R-b	R-b T-b
53/438																														R-b T-b
54/438																														R-b T-b
55/438																														R-b T-b
56/438
57/438
58/438																															Reported-and-tested-by
59/438
60/438
61/438
62/438
63/438
64/438																																R-b
65/438																																R-b
66/438																																R-b
67/438																																R-b
68/438																																												R-b
69/438																																																	R-b
70/438																																																	R-b
71/438
72/438
73/438																																				A-b																				A-b
74/438																																			R-b	A-b
75/438																																			R-b	A-b
76/438																																			R-b	A-b
77/438																																					T-b	A-b
78/438
79/438																																							A-b
80/438																																							A-b
81/438																																								R-b
82/438
83/438																																									R-b	R-b
84/438																																											A-b
85/438																																									A-b
86/438													R-b
87/438																																													R-b	R-b
88/438																																															R-b
89/438
90/438																																																R-b
91/438
92/438
93/438
94/438
95/438
96/438
97/438																																																	R-b
98/438
99/438																																																		A-b
100/438
101/438																																																			R-b	R-b
102/438
103/438
104/438
105/438
106/438
107/438
108/438
109/438
110/438																																																					R-b	R-b
111/438																																																			R-b
112/438																																																							R-b
113/438																																																							R-b
114/438																																																							R-b
115/438																																																									A-b T-b	T-b
116/438
117/438
118/438
119/438
120/438
121/438																																																																									T-b
122/438
123/438
124/438																																																											R-b	T-b
125/438																																																											R-b	T-b
126/438																																																											R-b	T-b
127/438																																																											R-b		R-b	T-b
128/438
129/438
130/438
131/438
132/438
133/438
134/438
135/438
136/438
137/438
138/438
139/438
140/438
141/438
142/438
143/438
144/438
145/438
146/438
147/438
148/438
149/438
150/438																																																															R-b
151/438																																																																R-b
152/438																																																																	R-b	R-b	R-b
153/438																																																																				R-b	T-b R-b
154/438																																																																						T-b A-b	R-b	R-b
155/438																																																																R-b
156/438
157/438
158/438
159/438																																																																		R-b
160/438																																																			R-b
161/438																																																			R-b
162/438
163/438																																																																										R-b
164/438																																																																													R-b
165/438
166/438
167/438
168/438
169/438																																																																																									R-b
170/438
171/438																																																																																										R-b T-b
172/438																																																	R-b
173/438
174/438																																																															R-b
175/438																																																															R-b
176/438																																																															R-b
177/438																																																																											R-b
178/438
179/438																																																																												R-b
180/438
181/438																																																													R-b
182/438																																																													R-b
183/438																																																																														A-b	T-b
184/438
185/438																																																					R-b
186/438																																																																																R-b
187/438
188/438
189/438
190/438
191/438																										R-b
192/438																										R-b
193/438																										R-b
194/438																										R-b
195/438																										R-b
196/438																																																																																	R-b
197/438					R-b	R-b
198/438					R-b	R-b
199/438					R-b																																																																													T-b
200/438					R-b
201/438					R-b																																																																													T-b
202/438																																																																																			T-b R-b
203/438
204/438																																																																																				R-b	A-b	A-b
205/438																																																																																							A-b
206/438																																																																																								R-b
207/438
208/438																	R-b
209/438																																																																																																														R-b
210/438
211/438
212/438																																																																																																						R-b
213/438																																	R-b
214/438																																																																																																									R-b T-b
215/438																																																																																																										R-b	A-b
216/438																																																																																							A-b										R-b											R-b	R-b
217/438
218/438
219/438																																																																																							A-b				T-b
220/438																																																																																												A-b
221/438																																																																																													R-b
222/438																																																																																							A-b							R-b	R-b	R-b R-b	R-b
223/438
224/438
225/438
226/438
227/438
228/438
229/438																																																																																																		R-b	R-b T-b
230/438																																																																																																		R-b	R-b T-b
231/438																																																																																																		R-b	R-b T-b
232/438																																																																																																		R-b	R-b T-b
233/438																																																																																																		R-b	R-b T-b
234/438																																																																																																		R-b	R-b T-b
235/438																																																																																																				R-b
236/438																																																																																																					A-b
237/438
238/438
239/438
240/438
241/438
242/438
243/438
244/438																																																																																																							R-b
245/438
246/438
247/438
248/438
249/438
250/438
251/438
252/438																																																																																																								Reported-and-tested-by
253/438
254/438
255/438
256/438
257/438
258/438
259/438
260/438
261/438
262/438
263/438
264/438
265/438																																																																																																																																	R-b T-b	R-b	R-b
266/438
267/438
268/438
269/438
270/438
271/438
272/438		R-b																																																																																																													T-b	R-b
273/438																																																																																																																	R-b
274/438
275/438
276/438																																																								R-b																																																									R-b	T-b
277/438																																																																																																																			A-b
278/438
279/438
280/438																																																																																																																				R-b
281/438																																																																																																																					A-b
282/438
283/438		R-b																																																																																																																				R-b	A-b
284/438																																																																																																																								R-b
285/438
286/438
287/438
288/438
289/438
290/438
291/438
292/438
293/438																																																																																																																									R-b
294/438
295/438																																																																																							A-b								R-b												R-b															R-b
296/438																																																																																							A-b																																				A-b	A-b
297/438																																																																																					A-b	A-b																																							R-b	R-b
298/438																																																		A-b
299/438																																																	R-b
300/438																																																													R-b
301/438																																																																																																																															R-b
302/438																																																							R-b																																																																									R-b
303/438
304/438																																																																																																																																																												A-b	A-b
305/438																																						R-b																																																																																														A-b
306/438																																																			R-b
307/438
308/438																																																			R-b
309/438																																																	R-b		R-b
310/438																																																			R-b
311/438																																																																																																																																																											R-b
312/438
313/438
314/438																																																																																																																																					R-b
315/438
316/438																																																																																							A-b										R-b
317/438																																																																																							A-b										R-b
318/438																																								R-b																																																																																									T-b	R-b	R-b			R-b
319/438																																																																			R-b																																																																				R-b
320/438																																																																																																																																								A-b
321/438																																																																																																					A-b
322/438																																																																																																					A-b
323/438
324/438
325/438
326/438																																																																																								R-b																																																	A-b
327/438																																																																																								R-b
328/438													R-b
329/438													R-b
330/438																																																																																																																																										R-b
331/438
332/438																																																																																																																																											A-b	R-b
333/438																																																																																																																																													R-b
334/438
335/438																																																																																																																																														R-b	R-b T-b	R-b
336/438
337/438																																																																																																																																																	R-b	R-b
338/438																																																																																																		R-b		R-b
339/438																																																																																																																																																			A-b	R-b
340/438																																																																																																																																																					R-b
341/438																																																																																																																																																						R-b
342/438																																																																																																																																																						R-b
343/438																																																																																																																																																							R-b
344/438																																																																																																																																																								R-b
345/438																																																																																																																																																									R-b
346/438																																																																																																																																																									R-b
347/438																						A-b
348/438																						A-b
349/438																						A-b
350/438																																																																																																																																																										R-b
351/438																																																																																																																																																														R-b
352/438																																																																																																																																																														R-b
353/438																																																											R-b																																																																																																							R-b	R-b	T-b
354/438																																																											R-b		R-b																																																																																																										T-b
355/438																																																					R-b									T-b
356/438																																																																																																																																																																																							R-b	R-b
357/438														R-b																																																																																																																																																																											R-b	R-b
358/438
359/438																																																																																																																																																																																											A-b
360/438		R-b																																																																																																																																																															A-b
361/438		R-b																																																																																																																																																													A-b
362/438		R-b																																																																																																																																																													A-b
363/438
364/438
365/438																																																																																																																																																																R-b
366/438
367/438
368/438
369/438																																																																																																																																																																	A-b
370/438
371/438
372/438																																																																																																																																R-b																																R-b					T-b
373/438
374/438																																																																																																																																																																R-b
375/438																																																																																																																																																																R-b
376/438
377/438																																																																																																																																																																						A-b
378/438																																																																																																																																																																						A-b
379/438																																																																																																																																																																						A-b
380/438																																																																																																																																																																						A-b
381/438
382/438																																																																										R-b
383/438																																																																																																																																																																								R-b	R-b
384/438																																																																																																																																																																									R-b
385/438																																																																																																																																																																										R-b	R-b
386/438																																																																																																																																																																												R-b	R-b
387/438																																																																																																																																																																												R-b
388/438																							R-b																																																																																																																																																			R-b
389/438																							R-b
390/438																																																																																																																																																																														R-b
391/438																																																																																																																																																																															R-b	R-b
392/438																																																																																																																																																																																	R-b
393/438																																																																																																																																																																																		R-b
394/438																																																																																																																																																																																		R-b
395/438																																																																																																																																																																																		R-b	R-b
396/438																																																																																																																																																																																		R-b
397/438																																																																																																																																																																																				R-b	T-b
398/438																																																																																																																																																																																				R-b	T-b	R-b
399/438																																																																																																																																																																																					T-b																							R-b
400/438
401/438																																																																																																																																																																																														R-b
402/438																																																																																																																																																																																																			R-b
403/438																																																																																																																																																																																																			R-b
404/438																																																																																																																																																																																																											R-b
405/438																																																																																																																																																																																																			R-b
406/438																																																																																																																																																																																																											R-b
407/438																																																																																																																																																																																												R-b
408/438																																																																																																																																																																																												R-b
409/438																																																																																																																																																																																												R-b
410/438																																																																																																																																																																																												R-b
411/438																																																																																																																																																																																												R-b
412/438																																																																																																																																																																																												R-b
413/438																																																																																																																																																																																												R-b
414/438																																																																																																																																																																																												R-b
415/438																																																																																																																																																																																												R-b
416/438																																																																																																																																																																																												R-b
417/438																																																																																																																																																																																												R-b
418/438																																																																																																																																																																																													R-b
419/438																																																																																																																																																																																													R-b
420/438																																																																																																																																																																																													R-b
421/438																																																																																																																																																																																													R-b
422/438																																																																																																																																																																																													R-b
423/438																																																																																																																																																																																													R-b
424/438																																																																																																																																																																																													R-b
425/438																																																																																																																																																																																													R-b
426/438																																																																																																																																																																																															R-b
427/438																																																																																																																																																																																																R-b
428/438																																																																																																																																																																																																	R-b	R-b
429/438																																																																																																																																																																																																		R-b
430/438																																																																																																																																																																																																		R-b
431/438																																																																																																																																																																																																	R-b	R-b
432/438																																																																																																																																																																																																				R-b	R-b
433/438																																																																																																																																																																														R-b
434/438																																																																																																																																																																																																						R-b
435/438																																																																																																																																																																																																							T-b	R-b
436/438																																																																																																																																																																																																									T-b R-b
437/438																																																																																																																																																																																																									R-b
438/438																																																																																																																																																																																															R-b											T-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 219 reviewers.

Read the v1 thread

Cover letter [PATCH 7.1 000/438] 7.1.8-rc1 review

This is the start of the stable review cycle for the 7.1.8 release. There are 438 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.8-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 7.1.8-rc1

Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path

Leo Li <[email protected]>
drm/amd/display: Exit idle optimizations before programming

Leo Li <[email protected]>
drm/amd/display: check GRPH_FLIP status before sending event

Jackson Lee <[email protected]>
media: chips-media: wave5: Support CBP profile

Matthew Brost <[email protected]>
drm/xe: Wait on external BO kernel fences in exec IOCTL

Thomas Hellström <[email protected]>
drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]

Matthew Brost <[email protected]>
drm/xe: Set TTM device beneficial_order to 9 (2M)

Michal Wajdeczko <[email protected]>
drm/xe: Separate early xe_device initialization

Michal Wajdeczko <[email protected]>

    drm/xe: Move xe->info.devid|revid initialization

Michal Wajdeczko <[email protected]>

    drm/xe: Move xe->info.force_execlist initialization

Michal Wajdeczko <[email protected]>
drm/xe: Drop unused param from xe_device_create()

Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Fix race condition and ordering in port unregistration

Sergey Senozhatsky <[email protected]>
usb: typec: ucsi: split connector lock classes

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Ensure locking/ref counting for OA whitelists

Ashutosh Dixit <[email protected]>
drm/xe/oa: (De-)whitelist OA registers on OA stream open/release

Ashutosh Dixit <[email protected]>
drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Save OA nonpriv registers to register save/restore lists

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Generalize whitelist_apply_to_hwe

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Keep track of non-OA nonpriv slots

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Maintain OA whitelists separately

Zack Rusin <[email protected]>
drm/vmwgfx: validate external BO copy bounds for both stride paths

Zack Rusin <[email protected]>
drm/vmwgfx: use check_add_overflow for shader size+offset bound

Zack Rusin <[email protected]>
drm/vmwgfx: enforce cursor size limits for MOB cursors

Zack Rusin <[email protected]>
drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure

Zack Rusin <[email protected]>
drm/vmwgfx: bound DMA command body size against suffix pointer

Zack Rusin <[email protected]>
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

Zack Rusin <[email protected]>
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

Zack Rusin <[email protected]>

    drm/vmwgfx: take fman->lock around fence list mutation in fifo_down

Zack Rusin <[email protected]>
drm/vmwgfx: clamp dirty-page range with min, not max

Zack Rusin <[email protected]>
drm/vmwgfx: reject DX_BIND_QUERY without a DX context

Zack Rusin <[email protected]>
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size

William Palacek <[email protected]>
drm/amdkfd: hold event_mutex while checkpointing CRIU events

David Francis <[email protected]>
drm/amdkfd: Handle invalid event type in CRIU event restore

William Palacek <[email protected]>
drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment

Vladimir Marioukhine <[email protected]>
drm/amdkfd: fix QID bit leak in pqm_create_queue()

Gang Ba <[email protected]>
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE

Jiri Slaby (SUSE) <[email protected]>
drm/amd/display: use proper context for logging

Alan Swanson <[email protected]>
drm/amd/display: Silence link_dpms I2C retimer failures

Ray Wu <[email protected]>
drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames

George Zhang <[email protected]>
drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport

Alex Deucher <[email protected]>
drm/amd/display: check if dml21_add_phantom_plane() is successful

Yang Wang <[email protected]>
drm/amd/pm: use milliwatts for GPU power sensors

Yang Wang <[email protected]>
drm/amd/pm: hide pp_table sysfs on APUs

Yang Wang <[email protected]>
drm/amd/pm: fix pptable use-after-free

Yang Wang <[email protected]>
drm/amd/pm: fix torn gpu metrics reads

Harkirat Gill <[email protected]>
drm/amdgpu: cap GTT size to physical RAM on APUs

Candice Li <[email protected]>
drm/amdgpu: restore UMD profile pstate after runtime resume

Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini

Myeonghun Pak <[email protected]>
drm/mediatek: ovl_adaptor: balance component registrations

Guangshuo Li <[email protected]>
drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2

Osama Abdelkader <[email protected]>
drm/panthor: validate firmware interface structure sizes

Osama Abdelkader <[email protected]>
drm/panthor: reject firmware sections with oversized data

Laurent Pinchart <[email protected]>
drm/bridge: display-connector: Fix I2C adapter resource leak

Maíra Canal <[email protected]>
drm/vc4: Zero the tile state data array before each BIN job

Jose Maria Casanova Crespo <[email protected]>
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size

Alexander Kaplan <[email protected]>
drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs

Avi Weiss <[email protected]>
can: ctucanfd: mark error-active controller status valid

Avi Weiss <[email protected]>
can: ctucanfd: handle bus error interrupts

Avi Weiss <[email protected]>
can: ctucanfd: unmap BAR0 using base address

Avi Weiss <[email protected]>
can: ctucanfd: use self-test mode for PRESUME_ACK

Pengpeng Hou <[email protected]>
can: ctucanfd: add missing MODULE_DEVICE_TABLE()

Pengpeng Hou <[email protected]>
can: peak_usb: validate uCAN receive record lengths

Maoyi Xie <[email protected]>
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

James Gao <[email protected]>
can: peak_usb: add bounds check for USB channel index

Pengpeng Hou <[email protected]>
can: softing: fw_parse(): validate firmware record spans

Tu Nguyen <[email protected]>
can: rcar_canfd: change the initializing flow for clocks and resets

Pengpeng Hou <[email protected]>
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

Abdun Nihaal <[email protected]>
can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()

Tetsuo Handa <[email protected]>
can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking

Oleksij Rempel <[email protected]>
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer

Oliver Hartkopp <[email protected]>
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering

Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure

Guangshuo Li <[email protected]>
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure

Pengpeng Hou <[email protected]>
can: ems_usb: validate CPC message lengths

Lucas Martins Alves <[email protected]>
can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured

Liem <[email protected]>
i2c: imx: Cancel hrtimer before clearing slave pointer

Liem <[email protected]>
i2c: imx: Fix slave registration race and error handling

Carlos Song <[email protected]>
i2c: imx: mark I2C adapter when hardware is powered down

Jonas Gorski <[email protected]>
i2c: iproc: reset bus after timeout if START_BUSY is stuck

H. Nikolaus Schaller <[email protected]>
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock

Wenmeng Liu <[email protected]>
i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers

Linmao Li <[email protected]>
i2c: spacemit: request IRQ after controller initialization

Dawei Feng <[email protected]>
ice: fix memory leak in ice_lbtest_prepare_rings()

Dawid Osuchowski <[email protected]>
ice: fix VF interrupts cleanup

Aaron Ma <[email protected]>
ice: wait for reset completion in ice_resume()

Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during ct

Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during recirculation

Ilya Maximets <[email protected]>
net: openvswitch: fix potential UAF on meter attach failure

Nava kishore Manne <[email protected]>
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB

Nava kishore Manne <[email protected]>
phy: zynqmp: use read-modify-write for SERDES scrambler bypass

Nava kishore Manne <[email protected]>
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask

Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA ECC private key requests

Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA AES cipher key requests

Harald Freudenberger <[email protected]>
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()

Harald Freudenberger <[email protected]>
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey

Harald Freudenberger <[email protected]>
s390/zcrypt: Close speculative mem read possibility

Harald Freudenberger <[email protected]>
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

Stefan Haberland <[email protected]>
s390/dasd: Fix undersized format-check buffer

Jan Höppner <[email protected]>
s390/dasd: Fix potential NULL pointer dereference

Aswin Karuvally <[email protected]>
s390/qeth: Check CAP_NET_ADMIN for private ioctls

Niklas Schnelle <[email protected]>
s390/pci: Fix s390_pci_mmio_write syscall error return without MIO

Jianing Li <[email protected]>
power: supply: max17040: handle missing status supplier

Sasha Finkelstein <[email protected]>
power: supply: macsmc: Support macOS 27 SMC firmware

Xu Rao <[email protected]>
power: supply: bq25890: fix the -10 C NTC lookup entry

Zhongqiu Han <[email protected]>
cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized

Abdun Nihaal <[email protected]>
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()

Christian Loehle <[email protected]>
cpufreq: cppc: Sanitize lockless policy limit snapshots

Frank Sorenson <[email protected]>
cifs: add fscache_resize_cookie() to cifs_setsize()

Junjie Cao <[email protected]>
gpio: pch: use raw_spinlock_t for the register lock

bui duc phuc <[email protected]>
gpio: pca953x: fix cache_only and IRQ state on restore_context() failure

Daniel Golle <[email protected]>
gpiolib: tolerate gpio-hogs lacking a hogging state

Hardik Prakash <[email protected]>
i2c: designware: defer probe if child GpioInt controllers are not bound

Myeonghun Pak <[email protected]>
i2c: amd-mp2: Unregister callback on adapter add failure

Vincent Jardin <[email protected]>
hwmon: (pmbus/core) notify on the hwmon device, not the i2c client

Hongyan Xu <[email protected]>
hwmon: (npcm750-pwm-fan): stop fan timer on device detach

Asim Viladi Oglu Manizada <[email protected]>
sctp: prevent peer transport count overflow

Yuxiang Yang <[email protected]>
sctp: reject stale cookies with mismatched verification tags

Shawn Guo <[email protected]>
scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc

Ibrahim Hashimov <[email protected]>
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

Damien Le Moal <[email protected]>
scsi: libsas: terminate deferred commands on time out

Chris Gellermann <[email protected]>
selftests/clone3: fix wild pointer access of getline due to missing init

Chris Gellermann <[email protected]>
selftests/mm: fix potential wild pointer access of getline due to missing init

Vijaya Krishna Nivarthi <[email protected]>
spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure

Stanislaw Pal <[email protected]>
spi: spi-qpic-snand: write the feature value before executing SET_FEATURE

Masami Hiramatsu (Google) <[email protected]>
tracing/filters: Fix false positive match in regex_match_full()

Masami Hiramatsu (Google) <[email protected]>
tracing: Check return value of __register_event() in trace_module_add_events()

Ming Lei <[email protected]>
ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

Eric Dumazet <[email protected]>
vxlan: use pskb_network_may_pull() in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: use pskb_network_may_pull() for transmit path header pulls

Eric Dumazet <[email protected]>
vxlan: use neigh_ha_snapshot() in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: unclone skb head before modifying eth header in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: re-fetch eth header after route_shortcircuit()

Matt Fleming <[email protected]>
veth: convert frag_list skbs before running XDP

Breno Leitao <[email protected]>
uprobes: Fix NULL pointer dereference in hprobe_expire()

Michael Bommarito <[email protected]>
um: vector: fix use-after-free in vector_mmsg_rx()

Thorsten Blum <[email protected]>
powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()

Jiakai Xu <[email protected]>
riscv/mm: use physical alignment for vmemmap_start_pfn

Chengfeng Ye <[email protected]>
net: pktgen: fix proc entry use-after-free

Zhiling Zou <[email protected]>
net: ipv6: clear suppressed fib6 rule result

Zhiling Zou <[email protected]>
net: bridge: stop fast-leave after deleting a port group

Breno Leitao <[email protected]>
mm: memcg: initialize *locked in memcg1_oom_prepare() stub

Link Lin <[email protected]>
mm/page_reporting: use system_freezable_wq to fix UAF during suspend

Kiryl Shutsemau (Meta) <[email protected]>
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

Kyumin Lee <[email protected]>
io_uring: preserve task restrictions across exec

Jens Axboe <[email protected]>
io_uring/net: initialize mshot_len for send

Christian Brauner <[email protected]>
binfmt_misc: don't leak the user namespace when the mount fails

Christian Brauner <[email protected]>
binfmt_misc: don't let an 'F' entry pin its own instance

Christian Brauner <[email protected]>
binfmt_misc: reject a flag character as the field delimiter

Christian Brauner <[email protected]>
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

Christian Brauner <[email protected]>
binfmt_misc: restore write access when removing an entry

Zhao Li <[email protected]>
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

Zhao Li <[email protected]>
wifi: mac80211: fix tid_tx use-after-free on BA session stop

Pratik Vishwakarma <[email protected]>
x86/CPU/AMD: Carve out a Zen5 models range

Zihan Xi <[email protected]>
tipc: avoid use-after-free in poll trace queue dumps

Soeren Moch <[email protected]>
PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug

Carlo Caione <[email protected]>
of/address: Fix NULL bus dereference in of_pci_range_parser_one()

David Lee <[email protected]>
netfilter: ipset: do not update comments from kernel-side hash adds

Xuanqiang Luo <[email protected]>
net/smc: fix socket use-after-free during link group termination

Wei Liu <[email protected]>
mshv: fix hv_input_get_system_property struct

Namjae Jeon <[email protected]>
ksmbd: reject repeated SMB2 NEGOTIATE requests

Zhiling Zou <[email protected]>
ipvs: do not propagate one-packet flag to synced conns

David Carlier <[email protected]>
igc: remove napi_synchronize() in igc_down()

Matt Vollrath <[email protected]>
igbvf: Fix leak in TX DMA error cleanup

Xuanqiang Luo <[email protected]>
fou: Fix use-after-free in fou_create()

Dawei Feng <[email protected]>

    e1000: fix memory leak in e1000_probe()

Md Sadre Alam <[email protected]>
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+

Sonali Pradhan <[email protected]>
ALSA: usb-audio: Clamp frame size in implicit-feedback mode

Sonali Pradhan <[email protected]>
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set

Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()

Baul Lee <[email protected]>
ALSA: usb-audio: fix stack info leak in RME Digiface status

Baul Lee <[email protected]>
ALSA: usb-audio: fix use-after-free in ump_to_endpoint()

Damien Le Moal <[email protected]>
ata: libata-scsi: schedule deferred atapi command

Damien Le Moal <[email protected]>
ata: libata-scsi: terminate deferred commands on time out

Niklas Cassel <[email protected]>
ata: libata-sata: fix ata_scsi_lpm_supported() iteration

Matt Vollrath <[email protected]>
ata: libata-eh: Increase STANDBY IMMEDIATE timeout

Haidar Lee <[email protected]>
ASoC: tas2562: fix broken entries in the volume lookup table

Haidar Lee <[email protected]>
ASoC: tas2562: fix DVC coefficient write order

Shengjiu Wang <[email protected]>
ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return

Shengjiu Wang <[email protected]>
ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return

Baul Lee <[email protected]>
ALSA: ump: fix double free of out_cvts on rawmidi error

Norbert Szetei <[email protected]>
ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes

Norbert Szetei <[email protected]>
ALSA: seq: Fix division by zero in initialize_timer()

Norbert Szetei <[email protected]>
ALSA: pcm: wake linked drain waiters on unlink

Xu Rao <[email protected]>
ALSA: lx6464es: fix period byte count for 16-bit streams

Eckhart Mohr <[email protected]>
ALSA: hda/realtek: Add quirk for TongFang X6SP45xU

Takashi Iwai <[email protected]>
ALSA: 6fire: Fix UAF at error handling during probe

David Howells <[email protected]>
afs: Fix UAF when sending a message

David Howells <[email protected]>
afs: Fix afs_fs_fetch_data() to subtract transferred from len

David Howells <[email protected]>

    afs: Fix afs_fs_fetch_data() to set call->async

Xuanqiang Luo <[email protected]>
bpf: lwt: Fix dst reference leak on reroute failure

Sangho Lee <[email protected]>
Bluetooth: HIDP: validate numbered report payloads

Sangho Lee <[email protected]>
Bluetooth: HIDP: reject frames without a transaction header

Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Fix advertising data UAFs

Zihan Xi <[email protected]>
Bluetooth: mgmt: fix UAF in pair command cancellation

Aldo Ariel Panzardo <[email protected]>
Bluetooth: SCO: give the socket its own sco_conn reference

Zihan Xi <[email protected]>
Bluetooth: mgmt: fix pending command UAF in EIR updates

Greg Kroah-Hartman <[email protected]>
Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()

Greg Kroah-Hartman <[email protected]>
Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()

Greg Kroah-Hartman <[email protected]>
Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()

Luxiao Xu <[email protected]>
audit: fix potential use-after-free in audit_del_rule()

Zhan Xusheng <[email protected]>
audit: fix potential integer overflow in audit_log_n_string()

Charles Vosburgh <[email protected]>
sctp: validate Adaptation Indication parameter length

Hidayath Khan <[email protected]>
dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

Farhan Ali <[email protected]>
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

Farhan Ali <[email protected]>
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure

Farhan Ali <[email protected]>
KVM: s390: pci: Fix resource leak on IRQ registration failure

Farhan Ali <[email protected]>
KVM: s390: pci: Fix missing error codes and memory unaccounting

Farhan Ali <[email protected]>
KVM: s390: pci: Fix memory accounting for pinned/unpinned pages

Farhan Ali <[email protected]>
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled

Sean Christopherson <[email protected]>
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active

Paolo Bonzini <[email protected]>
KVM: VMX: add memory clobber to asm for VMX instructions

Raushan Patel <[email protected]>
tracing/fprobe: Roll back on enable_trace_fprobe() failure

Raushan Patel <[email protected]>
tracing/probes: Reject $arg0 in meta argument expansion

Weiming Shi <[email protected]>
KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs

Gregory Price <[email protected]>
mm/vmstat: fold stranded per-cpu node stats when a node comes online

Usama Arif <[email protected]>
userfaultfd: wait on source PMD during UFFDIO_MOVE

Xiangfeng Cai <[email protected]>
mm/hugetlb: fix list corruption in allocate_file_region_entries()

Zi Yan <[email protected]>
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()

Kiryl Shutsemau (Meta) <[email protected]>
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes

Kiryl Shutsemau (Meta) <[email protected]>
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes

Jori Koolstra <[email protected]>
selftest: fix headers in fclog.c

Aboorva Devarajan <[email protected]>
mm/util: don't read __page_2 for order-1 folios in snapshot_page()

Kefeng Wang <[email protected]>
mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

Joseph Qi <[email protected]>
ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset

Guanghui Yang <[email protected]>
btrfs: zoned: fix missing chunk metadata reservation

Stanislav Kinsburskii <[email protected]>
lib: test_hmm: use device devt for coherent device range selection

Nathan Chancellor <[email protected]>
fortify: Disable -Wstringop-overread in tests

Benjamin Boortz <[email protected]>
pinctrl: bm1880: add missing select GENERIC_PINCONF

Michael Bommarito <[email protected]>
erofs: cap LZMA stream pool size

Mykola Lysenko <[email protected]>
btrfs: raid56: fix scrub read assembly submitting no reads

Karl Mehltretter <[email protected]>
pinctrl: devicetree: don't free uninitialized dev_name on error path

Benjamin Boortz <[email protected]>
pinctrl: microchip-sgpio: add missing select REGMAP_MMIO

Kiryl Shutsemau (Meta) <[email protected]>
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()

Qi Zheng <[email protected]>
mm: mglru: fix stale batch updates after memcg reparenting

Christian Loehle <[email protected]>
ACPI: CPPC: Check all controls for fast switching

Nicolas Schier <[email protected]>

    kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos

Peiyang He <[email protected]>
iommu/iommufd: Fix IOPF group ownership UAF

Peiyang He <[email protected]>
iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace

Peiyang He <[email protected]>
iommufd: Reject DMABUF pages from the access pin path

Nicolin Chen <[email protected]>
iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds

Nicolin Chen <[email protected]>
iommufd/viommu: Release the igroup lock on the vdevice_size error path

Masami Hiramatsu (Google) <[email protected]>
ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path

Stanislav Kinsburskii <[email protected]>
mshv: Publish VP to pt_vp_array before installing the file descriptor

Stanislav Kinsburskii <[email protected]>
mshv: Order pt_vp_array publish against irqfd assertion path

Stanislav Kinsburskii <[email protected]>
mshv: Fix missing error code on VP allocation failure

Stanislav Kinsburskii <[email protected]>
mshv: Fix level-triggered check on uninitialized data

Stanislav Kinsburskii <[email protected]>
mshv: Fix race in mshv_irqfd_deassign

Christoph Hellwig <[email protected]>
iomap: add a separate bio_set for iomap_split_ioend

Namjae Jeon <[email protected]>
ksmbd: use memcmp() to compare ClientGUIDs

Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in __close_file_table_ids()

Namjae Jeon <[email protected]>
ksmbd: return success for deferred final close

Jerome Tollet <[email protected]>
drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status

Denis V. Lunev <[email protected]>
qede: sync udp_tunnel ports outside qede_lock in the recovery path

Haibo Chen <[email protected]>
spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs

Gabriele Monaco <[email protected]>
sched/deadline: Use revised wakeup rule only for running dl_server

Suman Ghosh <[email protected]>
octeontx2-pf: Set correct sequence for carrier off and tx queue stop

Jiawen Wu <[email protected]>
net: libwx: fix FDIR ATR queue mismatch for software VLAN packets

Wei Fang <[email protected]>
ptp: netc: fix potential interrupt storm caused by incorrect unbind order

Aditya Garg <[email protected]>
net: mana: Return error code from mana_create_rxq()

Long Li <[email protected]>
net: mana: Create separate EQs for each vPort

Nazim Amirul <[email protected]>
net: stmmac: Fix E2E delay mechanism

Daniel Golle <[email protected]>
net: dsa: mt7530: error out on failed reads in MT7531 PHY polling

Daniel Golle <[email protected]>
net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling

Daniel Golle <[email protected]>

    net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend

Thomas Weißschuh <[email protected]>
riscv: vdso: Only try to install vDSO when present

Shuangpeng Bai <[email protected]>
ipv6: release fib6_null_entry on subtree failure

Vincent Donnefort <[email protected]>
ring-buffer: Fix reader page read offset for remote buffers

Karl Mehltretter <[email protected]>
riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove

Muhammad Bilal <[email protected]>
accel/qaic: use sizeof(*trans_hdr) for transaction length check

Anirudh Srinivasan <[email protected]>
riscv: drop __init from vec_check_unaligned_access_speed_all_cpus

Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions

Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()

Masami Hiramatsu (Google) <[email protected]>
fprobe: Fix module reference count leak on error in register_fprobe()

Himal Prasad Ghimiray <[email protected]>
drm/xe/pt: check no-DMA huge-pte cases before DMA segment test

Alexander Kaplan <[email protected]>
drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder

Minhong He <[email protected]>
can: isotp: check register_netdevice_notifier() error in module init

Chenguang Zhao <[email protected]>
net: sxgbe: check descriptor ring allocation failures

Chenguang Zhao <[email protected]>
net: sxgbe: free TX rings on RX allocation failure

Ao Sun <[email protected]>

    scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

Chandrakanth Patil <[email protected]>
scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit

Hariprasad Kelam <[email protected]>
octeontx2-af: Block VFs from clobbering special CGX PKIND state

Ratheesh Kannoth <[email protected]>
octeontx2: cn20k: Coordinate default rules with NIX LF lifecycle

Leon Romanovsky <[email protected]>
scsi: target: Clear cmd_cnt when initial counter enrollment fails

Benjamin Block <[email protected]>
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req

Bart Van Assche <[email protected]>
scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"

Guangshuo Li <[email protected]>
scsi: ufs: core: Cancel RTC work in active-active suspend

TanZheng <[email protected]>
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE

Christian Marangi <[email protected]>
net: phylink: put link_gpio if phylink_create fails

Mauricio Faria de Oliveira <[email protected]>
x86/boot: Add volatile, clobbers and zero-length test in memcmp()

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hold conn in hci_past_sync() callback

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

Pauli Virtanen <[email protected]>
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

Zijun Hu <[email protected]>
Bluetooth: btintel: Validate length before parsing diagnostics TLV

Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero

Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix refcounting of iso_conn

Pauli Virtanen <[email protected]>
Bluetooth: ISO: ensure no dangling hcon references in iso_conn

Pauli Virtanen <[email protected]>
Bluetooth: ISO: avoid deadlocks in iso_sock_timeout

Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix leaking sk after socket release

Pauli Virtanen <[email protected]>
Bluetooth: ISO: hold sk properly in iso_conn_ready

Pauli Virtanen <[email protected]>
Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()

Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos

Pauli Virtanen <[email protected]>
Bluetooth: ISO: lock sk in iso_connect_ind

Pauli Virtanen <[email protected]>
Bluetooth: ISO: lock sk in iso_sock_getname

Pauli Virtanen <[email protected]>

    Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release

Jiale Yao <[email protected]>
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

Pauli Virtanen <[email protected]>
Bluetooth: ISO: clear iso_data always when detaching conn from hcon

Przemyslaw Korba <[email protected]>
ice: suppress DPLL errors during reset recovery

Yuho Choi <[email protected]>
idpf: Fix mailbox IRQ name leak on request failure

Joshua Hay <[email protected]>
idpf: adjust TxQ ring count minimum

Michael Bommarito <[email protected]>
idpf: bound interrupt-vector register fill to the allocated array

Guenter Roeck <[email protected]>
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()

Chenguang Zhao <[email protected]>
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller

David Howells <[email protected]>
netfs: Fix folio_queue ENOMEM in writeback by adding a mempool

Yichong Chen <[email protected]>
netfs: release readahead folios on iterator preparation failure

Yichong Chen <[email protected]>
netfs: handle single writeback rolling buffer allocation failure

Yichong Chen <[email protected]>
netfs: clear PG_private_2 on copy-to-cache append failure

Zhao Li <[email protected]>
wifi: mac80211: validate individual TWT params before driver setup

Eric Dumazet <[email protected]>
net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()

Cen Zhang (Microsoft) <[email protected]>
net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds

Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-akebono CPU node lookup check

Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-currituck CPU node lookup check

Thorsten Blum <[email protected]>
powerpc/boot: Fix simpleboot CPU node lookup check

Eric Joyner <[email protected]>
ethtool: Embed FEC hist ranges as buffer in struct

Yun Lu <[email protected]>
rtase: fix double free of multi-frag skb on DMA map failure

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix PWM auto temp state array and bounds check

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Use cached PWM frequency value

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix cache updated before hardware write on I2C error

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors

Chenguang Zhao <[email protected]>
forcedeth: fix UAF of txrx_stats in nv_remove

Surendra Singh Chouhan <[email protected]>
ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()

David Corvaglia <[email protected]>
net: bridge: mrp: fix Option TLV length in MRP_Test frames

Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Prevent access to unsupported weight registers

Eric Dumazet <[email protected]>
net: do not send ICMP/NDISC Redirects when peer allocation fails

Guenter Roeck <[email protected]>
hwmon: (nzxt-smart2) DMA-align output buffer

Guenter Roeck <[email protected]>
hwmon: (lm90) Only report alarms if driver is ready

Guenter Roeck <[email protected]>
hwmon: (sht3x) Fix unaligned accesses

Guenter Roeck <[email protected]>
hwmon: (ltc4282) Fix reading the minimum alarm voltage

Guenter Roeck <[email protected]>
hwmon: (ina2xx) Fix various overflow issues

Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116

Srikanth Boyapally <[email protected]>
spi: spi-cadence: Move TX FIFO full busy-wait into FIFO

wangdicheng <[email protected]>
ASoC: tas2781: Use correct calibration data for SINEGAIN2 register

Baochen Qiang <[email protected]>
wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()

Christian Loehle <[email protected]>
ACPI: CPPC: Skip writes to unsupported performance controls

Alex Tran <[email protected]>
gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper

Gao Xiang <[email protected]>
erofs: ensure valid f_path for page cache sharing

Gao Xiang <[email protected]>
erofs: remove fscache backend entirely

Gao Xiang <[email protected]>
erofs: clean up erofs_ishare_fill_inode()

Dawei Feng <[email protected]>
smb: client: fix buffer leaks in SMB1 read and write

Xingui Yang <[email protected]>
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race

HyeongJun An <[email protected]>
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

HyeongJun An <[email protected]>
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

Mario Limonciello <[email protected]>
pinctrl-amd: Don't clear S4 wake bits at probe

Jonas Köppeler <[email protected]>
net/sched: sch_cake: skip clearing unused tins during rate adjustment

Maciej Fijalkowski <[email protected]>
xsk: reclaim invalid Tx descriptors in ZC batch path

Maciej Fijalkowski <[email protected]>

    xsk: provide sufficient space in pool->tx_descs

Jason Xing <[email protected]>
xsk: drain continuation descs after overflow in xsk_build_skb()

Jason Xing <[email protected]>
xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx

John Ericson <[email protected]>
selftests/net/af_unix: test listen() rejects wrong socket states

John Ericson <[email protected]>
af_unix: fix listen() succeeding on sockets in the wrong state

Xiang Mei (Microsoft) <[email protected]>
nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush

Xiang Mei (Microsoft) <[email protected]>

    nexthop: take nh->lock for f6i_list walks in replace check and notify

Xiang Mei <[email protected]>
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()

Charles Keepax <[email protected]>
ASoC: SDCA: Ensure that Control Range is large enough for header

Charles Keepax <[email protected]>
ASoC: SDCA: Make UMP message size check more robust

Charles Keepax <[email protected]>
ASoC: SDCA: Always free firmware in FDL path

Charles Keepax <[email protected]>
ASoC: SDCA: Correct pointer passed to devm_acpi_table_put

Xiang Mei (Microsoft) <[email protected]>
netfilter: nft_payload: fix mask build for partial field offload

Julian Anastasov <[email protected]>
ipvs: clear the nfct flag under lock

Julian Anastasov <[email protected]>
ipvs: do not mangle ICMP replies for non-first fragments

Julian Anastasov <[email protected]>
ipvs: fix places with wrong packet offsets

Julian Anastasov <[email protected]>
ipvs: fix the checksum validations

Pablo Neira Ayuso <[email protected]>
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: make nft_object rhltable per table

Julian Anastasov <[email protected]>
ipvs: adjust double hashing when fwd method changes

Michael Bommarito <[email protected]>
assoc_array: trim the final shortcut word using the current chunk end

Michael Bommarito <[email protected]>
keys: make keyring key-chunk byte order agree with keyring_diff_objects()

Michael Bommarito <[email protected]>
keys: fix out-of-bounds read in keyring_get_key_chunk()

Fabrice Derepas <[email protected]>
KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type

Alexandru Elisei <[email protected]>
KVM: arm64: Reject guest_memfd memslots when the VM has MTE

Vincent Donnefort <[email protected]>
KVM: arm64: Add missing hyp_enter when trapping sysreg

Vincent Donnefort <[email protected]>
KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load()

Vincent Donnefort <[email protected]>
KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing

Vincent Donnefort <[email protected]>
KVM: arm64: Fix hyp_trace clock disabling

Carlos López <[email protected]>
KVM: arm64: vgic: Mitigate potential LPI registration failure

Carlos López <[email protected]>
KVM: arm64: vgic: Fix race between LPI release and re-registration

Stanislav Kinsburskii <[email protected]>
mshv: Fix sleeping under spinlock in mshv_portid_alloc

Stanislav Kinsburskii <[email protected]>
mshv: Fix duplicate GSI detection for GSI 0

Sebastian Andrzej Siewior <[email protected]>
Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation

Yi Xie <[email protected]>
mshv_vtl: fix fd leak in mshv_ioctl_create_vtl()

Ruoyu Wang <[email protected]>
drm/mediatek: Check CRTC state before freeing

Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()

Lorenzo Bianconi <[email protected]>
selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests

Xiang Mei <[email protected]>
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix runtime PM leak on probe allocation failure

Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()

Tomas Glozar <[email protected]>
rtla/timerlat_top: Fix on-threshold actions firing on signal

Namjae Jeon <[email protected]>
ntfs: drop stale page-cache when shrinking a non-resident attr

Namjae Jeon <[email protected]>
ntfs: harden runlist realloc size calculations

Johannes Thumshirn <[email protected]>
btrfs: zoned: skip fully truncated ordered extents at zone finish

Qu Wenruo <[email protected]>
btrfs: raid56: fix an incorrect csum skip during scrub

Dongjiang Zhu <[email protected]>
btrfs: skip global block reserve accounting for rescue mounts

Qu Wenruo <[email protected]>
btrfs: warn about extent buffer that can not be released

Johannes Thumshirn <[email protected]>
btrfs: zoned: reset meta_write_pointer on zone reset

Johannes Thumshirn <[email protected]>
btrfs: zoned: fix deadlock between metadata writeback and transaction commit

Qu Wenruo <[email protected]>
btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag

Sang-Heon Jeon <[email protected]>
of: reserved_mem: prevent OOB when too many dynamic regions are defined

Uday Khare <[email protected]>
ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup

Uday Khare <[email protected]>
ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup

Krishna Kurapati <[email protected]>
phy: qcom: m31-eusb2: Fix return value of init call

Radhey Shyam Pandey <[email protected]>
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()

Rosen Penev <[email protected]>
ata: sata_mv: accept 1 or 2 resources in platform probe

Namjae Jeon <[email protected]>
ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points

Kuan-Ying Lee <[email protected]>
selftests/seccomp: Fix pointer type mismatch build error

Haofeng Li <[email protected]>
selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE

Abdun Nihaal <[email protected]>
gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()

Nicolin Chen <[email protected]>
iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE

Yuho Choi <[email protected]>
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()

Yuho Choi <[email protected]>
dmaengine: idxd: fix double free of wq, engine, and group structs

Hongling Zeng <[email protected]>
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA

Konrad Dybcio <[email protected]>

    pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151

Sneh Mankad <[email protected]>
pinctrl: qcom: Unconditionally mark gpio as wakeup enable

David Carlier <[email protected]>
dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold

D Scott Phillips <[email protected]>
KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context

Michael Bommarito <[email protected]>
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

Michael Diesen <[email protected]>
ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)

Harry Yoo (Oracle) <[email protected]>
mm/slab: prevent unbounded recursion in free path with new kmalloc type

Harry Yoo (Oracle) <[email protected]>
lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()

Harry Yoo (Oracle) <[email protected]>
mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT

Yehyeong Lee <[email protected]>
net: mpls: initialize rtm_tos in mpls_getroute()

-------------

Diffstat:

 Documentation/arch/arm64/silicon-errata.rst        |   4 +
 .../bindings/ufs/qcom,sa8255p-ufshc.yaml           |   9 +-
 Documentation/filesystems/erofs.rst                |   9 +-
 Documentation/networking/af_xdp.rst                |  54 +-
 Documentation/virt/kvm/api.rst                     |   6 +
 Makefile                                           |  12 +-
 arch/arm64/include/asm/kvm_hypevents.h             |   1 +
 arch/arm64/kvm/arm.c                               |  25 +-
 arch/arm64/kvm/hyp/nvhe/hyp-main.c                 |   1 +
 arch/arm64/kvm/hyp_trace.c                         |  36 +-
 arch/arm64/kvm/mmu.c                               |   4 +
 arch/arm64/kvm/vgic/vgic-its.c                     |  25 +-
 arch/arm64/kvm/vgic/vgic-v3.c                      |   8 +-
 arch/arm64/kvm/vgic/vgic.c                         |  18 +-
 arch/powerpc/boot/simpleboot.c                     |   2 +-
 arch/powerpc/boot/treeboot-akebono.c               |   2 +-
 arch/powerpc/boot/treeboot-currituck.c             |   2 +-
 arch/powerpc/platforms/ps3/mm.c                    |   1 +
 arch/riscv/Makefile                                |   2 +-
 arch/riscv/kernel/unaligned_access_speed.c         |   4 +-
 arch/riscv/mm/init.c                               |   7 +-
 arch/s390/kvm/pci.c                                | 107 +++-
 arch/s390/kvm/pci.h                                |   2 +
 arch/s390/pci/pci_mmio.c                           |   1 +
 arch/um/drivers/vector_kern.c                      |   3 +
 arch/x86/boot/string.c                             |  11 +-
 arch/x86/kernel/cpu/amd.c                          |   4 +-
 arch/x86/kvm/svm/avic.c                            |   8 -
 arch/x86/kvm/vmx/vmx_ops.h                         |   8 +-
 arch/x86/kvm/x86.c                                 |   6 +
 drivers/accel/qaic/qaic_control.c                  |   2 +-
 drivers/acpi/cppc_acpi.c                           |  29 +-
 drivers/ata/ahci_ceva.c                            |  18 +-
 drivers/ata/libata-eh.c                            |  37 +-
 drivers/ata/libata-sata.c                          |   2 +-
 drivers/ata/libata-scsi.c                          | 119 +++-
 drivers/ata/libata.h                               |   3 +-
 drivers/ata/sata_mv.c                              |   2 +-
 drivers/block/ublk_drv.c                           |   9 +
 drivers/bluetooth/btintel.c                        |   3 +
 drivers/bluetooth/btmtk.c                          |  86 ++-
 drivers/bluetooth/btusb.c                          |  30 +-
 drivers/cpufreq/cppc_cpufreq.c                     |  35 +-
 drivers/cpufreq/powernow-k8.c                      |   1 +
 drivers/dibs/dibs_loopback.c                       |  47 +-
 drivers/dma/idxd/cdev.c                            |   4 +-
 drivers/dma/idxd/init.c                            |  36 +-
 drivers/dma/sun6i-dma.c                            |  11 +-
 drivers/dma/switchtec_dma.c                        |   2 +-
 drivers/gpio/gpio-by-pinctrl.c                     |  18 +-
 drivers/gpio/gpio-pca953x.c                        |  15 +-
 drivers/gpio/gpio-pch.c                            |  28 +-
 drivers/gpio/gpio-sloppy-logic-analyzer.c          |  10 +
 drivers/gpio/gpiolib.c                             |  13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |  39 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c        |   9 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |  15 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c            |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  12 +
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |  10 +-
 drivers/gpu/drm/amd/amdkfd/kfd_events.c            |  23 +-
 .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c |   2 +-
 drivers/gpu/drm/amd/amdkfd/kfd_queue.c             |   2 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  | 243 ++++++--
 drivers/gpu/drm/amd/display/dc/core/dc.c           |  45 ++
 drivers/gpu/drm/amd/display/dc/dc.h                |   1 +
 .../gpu/drm/amd/display/dc/dce/dce_clock_source.c  |  20 +-
 .../drm/amd/display/dc/dml2_0/dml21/dml21_utils.c  |  15 +-
 .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c     |  31 +-
 .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c    |  16 +-
 drivers/gpu/drm/amd/display/dc/link/link_dpms.c    |  16 +-
 drivers/gpu/drm/amd/include/kgd_pp_interface.h     |   6 +-
 drivers/gpu/drm/amd/pm/amdgpu_dpm.c                |  39 +-
 drivers/gpu/drm/amd/pm/amdgpu_pm.c                 |  29 +-
 drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h            |   6 +-
 .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c    |   4 +-
 .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c  |   4 +-
 .../gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c  |   2 +-
 .../gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c  |   5 +-
 drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h       |   5 +
 drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c  |   2 +-
 .../drm/amd/pm/swsmu/smu11/cyan_skillfish_ppt.c    |   6 +-
 drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c    |   8 +-
 .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c    |   7 +-
 drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c   |   9 +-
 drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c    |   5 +-
 drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c |   3 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c   |   2 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_12_ppt.c  |   3 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c   |   4 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c   |   2 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c   |   3 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c   |   2 +-
 .../gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c   |   2 +-
 .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c   |   3 +-
 .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c   |   2 +-
 .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_0_ppt.c   |   3 +-
 .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_8_ppt.c   |   3 +-
 drivers/gpu/drm/bridge/display-connector.c         |  11 +-
 drivers/gpu/drm/display/drm_dp_helper.c            |  12 +
 drivers/gpu/drm/drm_exec.c                         |   6 +-
 drivers/gpu/drm/drm_gpuvm.c                        |   3 +-
 drivers/gpu/drm/i915/display/intel_ddi.c           |   2 +
 drivers/gpu/drm/i915/display/intel_dp.c            |   9 +-
 drivers/gpu/drm/i915/display/intel_hdmi.c          |  26 +
 drivers/gpu/drm/i915/display/intel_hdmi.h          |   2 +
 drivers/gpu/drm/mediatek/mtk_crtc.c                |   6 +-
 drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c    |   7 +-
 drivers/gpu/drm/mediatek/mtk_hdmi_v2.c             |   8 -
 drivers/gpu/drm/panthor/panthor_fw.c               |  47 +-
 drivers/gpu/drm/vc4/vc4_irq.c                      |   2 +-
 drivers/gpu/drm/vc4/vc4_validate.c                 |  29 +-
 drivers/gpu/drm/vmwgfx/ttm_object.c                |   7 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_blit.c               |  39 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c       |  49 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c            |  20 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c              |  13 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c         |   4 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c           |   4 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_shader.c             |  13 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c               |  17 +-
 drivers/gpu/drm/xe/tests/xe_pci.c                  |   6 +
 drivers/gpu/drm/xe/xe_device.c                     |  56 +-
 drivers/gpu/drm/xe/xe_device.h                     |   4 +-
 drivers/gpu/drm/xe/xe_exec.c                       |  22 +-
 drivers/gpu/drm/xe/xe_gt_debugfs.c                 |   4 +-
 drivers/gpu/drm/xe/xe_hw_engine.c                  |   2 +
 drivers/gpu/drm/xe/xe_hw_engine_types.h            |   8 +
 drivers/gpu/drm/xe/xe_oa.c                         |   7 +
 drivers/gpu/drm/xe/xe_oa_types.h                   |   3 +
 drivers/gpu/drm/xe/xe_pci.c                        |  15 +-
 drivers/gpu/drm/xe/xe_pt.c                         |  13 +-
 drivers/gpu/drm/xe/xe_reg_whitelist.c              |  87 ++-
 drivers/gpu/drm/xe/xe_reg_whitelist.h              |   4 +
 drivers/gpu/drm/xe/xe_vm.c                         |   3 +-
 drivers/hv/mshv_eventfd.c                          |  41 +-
 drivers/hv/mshv_irq.c                              |   2 +-
 drivers/hv/mshv_portid_table.c                     |   6 +-
 drivers/hv/mshv_root_main.c                        |  41 +-
 drivers/hv/mshv_vtl_main.c                         |   1 +
 drivers/hv/vmbus_drv.c                             |  13 +-
 drivers/hwmon/adt7470.c                            | 131 ++--
 drivers/hwmon/ina2xx.c                             |  61 +-
 drivers/hwmon/lm90.c                               |   4 +-
 drivers/hwmon/ltc4282.c                            |   4 +-
 drivers/hwmon/nct6775-core.c                       |  20 +-
 drivers/hwmon/npcm750-pwm-fan.c                    |  11 +
 drivers/hwmon/nzxt-smart2.c                        |   2 +-
 drivers/hwmon/pmbus/pmbus_core.c                   |   7 +-
 drivers/hwmon/sht3x.c                              |   9 +-
 drivers/i2c/busses/i2c-amd-mp2-plat.c              |   4 +-
 drivers/i2c/busses/i2c-bcm-iproc.c                 |  11 +
 drivers/i2c/busses/i2c-designware-platdrv.c        |  80 +++
 drivers/i2c/busses/i2c-imx.c                       |  54 +-
 drivers/i2c/busses/i2c-jz4780.c                    |   5 +-
 drivers/i2c/busses/i2c-k1.c                        |  10 +-
 drivers/i2c/busses/i2c-qcom-cci.c                  |  18 +-
 drivers/infiniband/hw/mana/main.c                  |  40 +-
 drivers/infiniband/hw/mana/mana_ib.h               |  14 +
 drivers/infiniband/hw/mana/qp.c                    |  68 ++-
 .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c    |  15 +
 drivers/iommu/io-pgfault.c                         |  24 +-
 drivers/iommu/iommufd/device.c                     |   2 +-
 drivers/iommu/iommufd/eventq.c                     |   2 +
 drivers/iommu/iommufd/pages.c                      |   3 +
 drivers/iommu/iommufd/viommu.c                     |  22 +-
 .../media/platform/chips-media/wave5/wave5-hw.c    |   3 +
 .../platform/chips-media/wave5/wave5-vpu-enc.c     |   5 +-
 .../platform/chips-media/wave5/wave5-vpuapi.h      |   1 +
 drivers/net/can/c_can/c_can_main.c                 |   8 +-
 drivers/net/can/ctucanfd/ctucanfd_base.c           |  14 +-
 drivers/net/can/ctucanfd/ctucanfd_pci.c            |   3 +-
 drivers/net/can/rcar/rcar_canfd.c                  |  32 +-
 drivers/net/can/softing/softing_fw.c               |  46 +-
 drivers/net/can/usb/ems_usb.c                      |  43 ++
 drivers/net/can/usb/etas_es58x/es58x_core.c        |   1 -
 drivers/net/can/usb/gs_usb.c                       |   4 +-
 drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c  |   1 +
 drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c   |  13 +-
 drivers/net/can/usb/peak_usb/pcan_usb_core.c       |   1 -
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c         |  40 +-
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c        |  20 +-
 drivers/net/dsa/mt7530-mdio.c                      |  11 +-
 drivers/net/dsa/mt7530.c                           |  86 ++-
 drivers/net/ethernet/intel/e1000/e1000_main.c      |   2 +-
 drivers/net/ethernet/intel/ice/ice_dpll.c          |  19 +-
 drivers/net/ethernet/intel/ice/ice_ethtool.c       |  10 +-
 drivers/net/ethernet/intel/ice/ice_main.c          |  10 +
 drivers/net/ethernet/intel/ice/ice_vf_lib.c        |  27 +
 .../net/ethernet/intel/ice/ice_vf_lib_private.h    |   1 +
 drivers/net/ethernet/intel/ice/virt/queues.c       |  21 +
 drivers/net/ethernet/intel/idpf/idpf_dev.c         |   2 +-
 drivers/net/ethernet/intel/idpf/idpf_lib.c         |   2 +-
 drivers/net/ethernet/intel/idpf/idpf_txrx.c        |   5 +-
 drivers/net/ethernet/intel/idpf/idpf_txrx.h        |   2 +-
 drivers/net/ethernet/intel/idpf/idpf_vf_dev.c      |   2 +-
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c    |   5 +-
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.h    |   2 +-
 drivers/net/ethernet/intel/igbvf/netdev.c          |   2 -
 drivers/net/ethernet/intel/igc/igc_main.c          |   3 +-
 drivers/net/ethernet/marvell/octeontx2/af/cgx.c    |  12 +
 drivers/net/ethernet/marvell/octeontx2/af/cgx.h    |   1 +
 drivers/net/ethernet/marvell/octeontx2/af/mbox.h   |   1 +
 drivers/net/ethernet/marvell/octeontx2/af/rvu.h    |   2 +
 .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c    |  79 +++
 .../net/ethernet/marvell/octeontx2/af/rvu_nix.c    |  97 ++-
 .../net/ethernet/marvell/octeontx2/af/rvu_npc.c    |  49 +-
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |   8 +-
 drivers/net/ethernet/mediatek/mtk_eth_soc.c        |   2 +-
 drivers/net/ethernet/mellanox/mlx5/core/en.h       |   1 -
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |   7 -
 drivers/net/ethernet/mellanox/mlx5/core/en_stats.c |  19 +-
 drivers/net/ethernet/microsoft/mana/mana_en.c      | 143 +++--
 drivers/net/ethernet/microsoft/mana/mana_ethtool.c |  23 +-
 drivers/net/ethernet/nvidia/forcedeth.c            |   4 +-
 drivers/net/ethernet/qlogic/qede/qede_main.c       |  44 +-
 drivers/net/ethernet/realtek/rtase/rtase_main.c    |   3 +
 drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c    |  14 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |   3 +-
 drivers/net/ethernet/wangxun/libwx/wx_lib.c        |   2 +
 drivers/net/phy/phylink.c                          |  29 +-
 drivers/net/veth.c                                 |   4 +-
 drivers/net/vxlan/vxlan_core.c                     |  21 +-
 drivers/net/vxlan/vxlan_mdb.c                      |   4 +-
 drivers/net/wireless/ath/ath12k/mac.c              |   5 +-
 .../net/wireless/marvell/mwifiex/11n_rxreorder.c   |   2 +-
 drivers/of/address.c                               |  22 +-
 drivers/of/of_reserved_mem.c                       |  14 +-
 drivers/pci/controller/dwc/pci-imx6.c              |   9 +-
 drivers/phy/qualcomm/phy-qcom-m31-eusb2.c          |   2 +-
 drivers/phy/xilinx/phy-zynqmp.c                    |  62 +-
 drivers/pinctrl/Kconfig                            |   2 +
 drivers/pinctrl/devicetree.c                       |   4 +
 drivers/pinctrl/pinctrl-amd.c                      |   3 +-
 drivers/pinctrl/qcom/pinctrl-msm.c                 |   8 +-
 drivers/pinctrl/qcom/pinctrl-sc8280xp.c            |  21 +-
 drivers/power/supply/bq25890_charger.c             |   2 +-
 drivers/power/supply/macsmc-power.c                |  52 +-
 drivers/power/supply/max17040_battery.c            |   6 +-
 drivers/ptp/ptp_netc.c                             |  15 +-
 drivers/s390/block/dasd_eckd.c                     |  11 +-
 drivers/s390/block/dasd_ioctl.c                    |   2 +-
 drivers/s390/crypto/pkey_cca.c                     |  15 +-
 drivers/s390/crypto/zcrypt_api.c                   |   4 +-
 drivers/s390/crypto/zcrypt_ccamisc.c               |  89 ++-
 drivers/s390/crypto/zcrypt_ccamisc.h               |   6 +-
 drivers/s390/net/qeth_core_main.c                  |   3 +
 drivers/s390/scsi/zfcp_aux.c                       |   1 +
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c             |  10 +-
 drivers/scsi/libiscsi.c                            |   2 +-
 drivers/scsi/libiscsi_tcp.c                        |   8 +-
 drivers/scsi/libsas/sas_init.c                     |  37 +-
 drivers/scsi/libsas/sas_scsi_host.c                |  15 +
 drivers/scsi/mpi3mr/mpi3mr_fw.c                    |   9 +-
 drivers/scsi/scsi_debug.c                          |   8 +-
 drivers/spi/spi-cadence.c                          |  26 +-
 drivers/spi/spi-nxp-fspi.c                         |  83 ++-
 drivers/spi/spi-qcom-qspi.c                        |   3 +-
 drivers/spi/spi-qpic-snand.c                       |  22 +-
 drivers/target/target_core_iblock.c                |   6 +-
 drivers/target/target_core_transport.c             |  12 +-
 drivers/thunderbolt/xdomain.c                      |  40 +-
 drivers/ufs/core/ufs-rpmb.c                        |   2 -
 drivers/ufs/core/ufshcd.c                          |  46 +-
 drivers/usb/typec/ucsi/ucsi.c                      |  88 +--
 drivers/usb/typec/ucsi/ucsi.h                      |   1 +
 fs/afs/fsclient.c                                  |   5 +-
 fs/afs/internal.h                                  |   3 +-
 fs/binfmt_misc.c                                   |  54 +-
 fs/btrfs/block-group.c                             |  34 +-
 fs/btrfs/block-rsv.c                               |  19 +-
 fs/btrfs/disk-io.c                                 |  58 +-
 fs/btrfs/extent_io.c                               |   6 -
 fs/btrfs/extent_io.h                               |   6 +
 fs/btrfs/fs.h                                      |   9 +
 fs/btrfs/raid56.c                                  |  15 +-
 fs/btrfs/super.c                                   |   8 +-
 fs/btrfs/zoned.c                                   |  27 +-
 fs/erofs/Kconfig                                   |  36 +-
 fs/erofs/Makefile                                  |   1 -
 fs/erofs/data.c                                    |   4 +-
 fs/erofs/decompressor_lzma.c                       |   3 +-
 fs/erofs/fscache.c                                 | 664 ---------------------
 fs/erofs/inode.c                                   |   2 +-
 fs/erofs/internal.h                                |  76 +--
 fs/erofs/ishare.c                                  | 101 ++--
 fs/erofs/super.c                                   |  94 +--
 fs/erofs/zdata.c                                   |   6 -
 fs/iomap/ioend.c                                   |  21 +-
 fs/netfs/buffered_read.c                           |  10 +-
 fs/netfs/internal.h                                |   1 +
 fs/netfs/main.c                                    |   7 +
 fs/netfs/objects.c                                 |  30 +-
 fs/netfs/read_pgpriv2.c                            |   3 +-
 fs/netfs/rolling_buffer.c                          |  22 +-
 fs/netfs/write_issue.c                             |  15 +-
 fs/ntfs/attrib.c                                   |  10 +
 fs/ntfs/namei.c                                    |   3 +-
 fs/ntfs/runlist.c                                  |  50 +-
 fs/ocfs2/dir.c                                     |   5 +-
 fs/proc/task_mmu.c                                 |  34 +-
 fs/smb/client/cifssmb.c                            |  12 +-
 fs/smb/client/inode.c                              |   1 +
 fs/smb/server/connection.h                         |   5 +
 fs/smb/server/smb2pdu.c                            |  14 +-
 fs/smb/server/smb_common.c                         |  37 +-
 fs/smb/server/vfs_cache.c                          |   6 +-
 include/acpi/cppc_acpi.h                           |   5 +-
 include/drm/drm_exec.h                             |  20 +-
 include/hyperv/hvhdk_mini.h                        |   3 +-
 include/kvm/arm_vgic.h                             |   3 -
 include/linux/alloc_tag.h                          |   3 +
 include/linux/dma/qcom_bam_dma.h                   |  21 +-
 include/linux/ethtool.h                            |   1 +
 include/linux/iommu.h                              |   5 +
 include/linux/libata.h                             |   6 +-
 include/linux/memcontrol.h                         |  25 +
 include/linux/netfilter/nf_conntrack_sip.h         |   2 +-
 include/linux/netfs.h                              |   1 +
 include/linux/rolling_buffer.h                     |   6 +-
 include/linux/slab.h                               |  19 +-
 include/linux/thunderbolt.h                        |   3 +
 include/net/bluetooth/hci_core.h                   |   4 +-
 include/net/ip_vs.h                                |  45 +-
 include/net/mana/mana.h                            |  15 +-
 include/net/netfilter/nf_conntrack_expect.h        |   3 +
 include/net/netfilter/nf_tables.h                  |   4 +-
 include/net/xdp_sock.h                             |   1 +
 include/net/xsk_buff_pool.h                        |   9 +-
 include/scsi/libsas.h                              |   3 +-
 io_uring/cancel.c                                  |   2 +-
 io_uring/net.c                                     |   1 +
 io_uring/tctx.c                                    |   7 +-
 io_uring/tctx.h                                    |   1 +
 kernel/audit.c                                     |  11 +-
 kernel/auditfilter.c                               |   6 +-
 kernel/events/uprobes.c                            |   2 +-
 kernel/sched/cpufreq_schedutil.c                   |  11 +
 kernel/sched/deadline.c                            |   3 +-
 kernel/trace/fprobe.c                              |   6 +-
 kernel/trace/ring_buffer.c                         |   2 +
 kernel/trace/trace_events.c                        |   4 +-
 kernel/trace/trace_events_filter.c                 |   3 +
 kernel/trace/trace_fprobe.c                        |  12 +-
 kernel/trace/trace_mmiotrace.c                     |  13 +-
 kernel/trace/trace_probe.c                         |   6 +-
 lib/alloc_tag.c                                    |   9 +
 lib/assoc_array.c                                  |   3 +-
 lib/test_fortify/Makefile                          |   1 +
 lib/test_hmm.c                                     |   2 +-
 mm/huge_memory.c                                   |  14 +-
 mm/hugetlb.c                                       |  12 +-
 mm/memcontrol-v1.h                                 |   6 +-
 mm/migrate_device.c                                |   5 +-
 mm/mm_init.c                                       |  15 +-
 mm/page_reporting.c                                |   6 +-
 mm/percpu-km.c                                     |   2 +-
 mm/slab.h                                          |  28 +-
 mm/slab_common.c                                   |  13 +
 mm/slub.c                                          |  97 ++-
 mm/util.c                                          |   2 +-
 mm/vmscan.c                                        |  11 +-
 net/bluetooth/hci_conn.c                           |  14 +-
 net/bluetooth/hci_sync.c                           | 220 ++++---
 net/bluetooth/hidp/core.c                          |  30 +-
 net/bluetooth/iso.c                                | 273 ++++++---
 net/bluetooth/l2cap_core.c                         |   5 +
 net/bluetooth/mgmt.c                               |  84 ++-
 net/bluetooth/sco.c                                |  22 +-
 net/bridge/br_mrp.c                                |   2 +-
 net/bridge/br_multicast.c                          |   1 +
 net/can/isotp.c                                    | 334 ++++++++---
 net/can/j1939/bus.c                                |   2 +
 net/can/j1939/j1939-priv.h                         |   3 +
 net/can/j1939/main.c                               |   8 +-
 net/can/j1939/transport.c                          |   4 +-
 net/core/lwt_bpf.c                                 |   4 +-
 net/core/pktgen.c                                  |   4 +-
 net/core/skbuff.c                                  |  18 +-
 net/ipv4/fou_core.c                                |   2 +-
 net/ipv4/netfilter/nf_nat_h323.c                   |  22 +-
 net/ipv4/nexthop.c                                 |  25 +-
 net/ipv4/route.c                                   |   2 -
 net/ipv4/udp_tunnel_nic.c                          |  32 +-
 net/ipv6/fib6_rules.c                              |   1 +
 net/ipv6/ip6_fib.c                                 |   1 +
 net/ipv6/ip6_output.c                              |   2 +-
 net/ipv6/ndisc.c                                   |   2 +
 net/mac80211/agg-tx.c                              |   4 +-
 net/mac80211/s1g.c                                 |   4 +
 net/mpls/af_mpls.c                                 |   1 +
 net/netfilter/ipset/ip_set_hash_gen.h              |   2 +-
 net/netfilter/ipvs/ip_vs_app.c                     |   4 +-
 net/netfilter/ipvs/ip_vs_conn.c                    | 192 ++++--
 net/netfilter/ipvs/ip_vs_core.c                    | 190 +++---
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |  19 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  48 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c               |  54 +-
 net/netfilter/ipvs/ip_vs_xmit.c                    |  42 +-
 net/netfilter/nf_conntrack_expect.c                |  35 +-
 net/netfilter/nf_conntrack_sip.c                   |   2 +-
 net/netfilter/nf_nat_sip.c                         |  22 +-
 net/netfilter/nf_tables_api.c                      |  34 +-
 net/netfilter/nft_payload.c                        |  12 +-
 net/netfilter/xt_hashlimit.c                       |  16 +-
 net/openvswitch/actions.c                          |  12 +-
 net/openvswitch/meter.c                            |  33 +-
 net/rds/tcp.c                                      |   8 +-
 net/sched/cls_u32.c                                |   7 +
 net/sched/sch_cake.c                               |   8 +-
 net/sctp/associola.c                               |   3 +
 net/sctp/sm_make_chunk.c                           |  17 +-
 net/smc/smc_core.c                                 |   2 +-
 net/tipc/socket.c                                  |   2 +-
 net/unix/af_unix.c                                 |   1 +
 net/xdp/xsk.c                                      | 257 +++++++-
 net/xdp/xsk_buff_pool.c                            |  13 +-
 net/xdp/xsk_queue.h                                |  65 +-
 security/keys/keyring.c                            |  14 +-
 security/keys/trusted-keys/trusted_dcp.c           |  15 +-
 sound/core/pcm_native.c                            |   7 +
 sound/core/seq/seq_timer.c                         |   9 +-
 sound/core/timer.c                                 |   2 +
 sound/core/ump.c                                   |   1 +
 sound/hda/codecs/realtek/alc269.c                  |   4 +-
 sound/pci/lx6464es/lx6464es.c                      |   5 +-
 sound/pci/lx6464es/lx_core.c                       |   5 +-
 sound/soc/codecs/max98090.c                        |   5 +-
 sound/soc/codecs/max98095.c                        |   5 +-
 sound/soc/codecs/tas2562.c                         |  30 +-
 sound/soc/codecs/tas2781-i2c.c                     |   4 +-
 sound/soc/fsl/fsl_asrc.c                           |   2 +-
 sound/soc/fsl/fsl_easrc.c                          |   2 +-
 sound/soc/sdca/sdca_device.c                       |   2 +-
 sound/soc/sdca/sdca_fdl.c                          |   5 +-
 sound/soc/sdca/sdca_functions.c                    |   2 +
 sound/soc/sdca/sdca_ump.c                          |   4 +-
 sound/soc/sophgo/cv1800b-sound-adc.c               |  10 +-
 sound/usb/6fire/chip.c                             |   4 +
 sound/usb/endpoint.c                               |  14 +-
 sound/usb/midi.c                                   |   2 +
 sound/usb/midi2.c                                  |   4 +-
 sound/usb/mixer_quirks.c                           |   2 +-
 tools/testing/selftests/clone3/clone3_set_tid.c    |   2 +-
 tools/testing/selftests/filesystems/fclog.c        |   4 +-
 tools/testing/selftests/lkdtm/tests.txt            |   2 +-
 tools/testing/selftests/mm/mlock-random-test.c     |   2 +-
 tools/testing/selftests/mm/pagemap_ioctl.c         |  56 +-
 tools/testing/selftests/net/af_unix/.gitignore     |   1 +
 tools/testing/selftests/net/af_unix/Makefile       |   1 +
 tools/testing/selftests/net/af_unix/unix_listen.c  | 187 ++++++
 .../selftests/net/netfilter/nft_flowtable.sh       |  14 +-
 tools/testing/selftests/seccomp/seccomp_bpf.c      |   3 +-
 tools/tracing/rtla/src/timerlat_top.c              |   2 +-
 455 files changed, 6043 insertions(+), 3365 deletions(-)

Read the cover letter in its thread