5.10.265-rc1 review

Greg Kroah-Hartman linux-patches lkml stable 1 version Aug 17 In review

Get series with b4

b4 am [email protected]

Versions newest first

v1 Latest Aug 17389 patches 7 repliesIn review

Patches in v1 No applies recorded yet

#	Subject and files	Size	Replies
1/389	nvmet-tcp: Fix potential UAF when ddgst mismatch`drivers/nvme/target/tcp.c`	+3 -1	0 replies
2/389	cpu: hotplug: Bound hotplug states sysfs output`kernel/cpu.c`	+3 -6	0 replies
3/389	macsec: dont read an unset MAC header in macsec_encrypt()`drivers/net/macsec.c`	+1 -1	0 replies
4/389	KVM: nVMX: Hide shadow VMCS right after VMCLEAR`arch/x86/kvm/vmx/nested.c`	+9 -2	0 replies
5/389	KVM: x86/mmu: Fix use-after-free on vendor module reload`arch/x86/kvm/mmu/mmu.c`	+2 -0	0 replies
6/389	can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER`net/can/isotp.c`	+59 ~~-29~~	0 replies
7/389	can: isotp: serialize TX state transitions under so->rx_lock`net/can/isotp.c`	+154 ~~-38~~	0 replies
8/389	Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()`drivers/input/misc/ims-pcu.c`	+26 -6	0 replies
9/389	Input: ims-pcu - fix logic error in packet reset`drivers/input/misc/ims-pcu.c`	+1 -1	0 replies
10/389	KVM: VMX: Make vmread_error_trampoline() uncallable from C code`arch/x86/kvm/vmx/vmx_ops.h`	+14 -2	0 replies
11/389	IB/mad: Drop unmatched RMPP responses before reassembly`drivers/infiniband/core/mad.c`	+30 -0	0 replies
12/389	mtd: mtdswap: remove debugfs stats file on teardown`drivers/mtd/mtdswap.c`	+4 -1	0 replies
13/389	mtd: nand: mtk-ecc: stop on ECC idle timeouts`drivers/mtd/nand/raw/mtk_ecc.c`	+12 -4	0 replies
14/389	btrfs: remove crc_check logic from free space`fs/btrfs/free-space-cache.c` `fs/btrfs/free-space-cache.h`	+5 ~~-33~~	0 replies
15/389	btrfs: reject free space cache with more entries than pages`fs/btrfs/free-space-cache.c`	+3 -0	0 replies
16/389	RDMA/hns: Fix potential integer overflow in mhop hem cleanup`drivers/infiniband/hw/hns/hns_roce_hem.c`	+1 -1	0 replies
17/389	xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert`net/xfrm/xfrm_policy.c`	+2 -2	0 replies
18/389	wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()`drivers/net/wireless/intel/ipw2x00/ipw2100.c`	+4 -4	0 replies
19/389	mac80211_hwsim: add 6GHz channels`drivers/net/wireless/mac80211_hwsim.c`	+73 -1	0 replies
20/389	wifi: mac80211_hwsim: clamp virtio RX length before skb_put`drivers/net/wireless/mac80211_hwsim.c`	+1 -0	0 replies
21/389	wifi: libertas: fix memory leak in helper_firmware_cb()`drivers/net/wireless/marvell/libertas/firmware.c`	+1 -0	0 replies
22/389	wifi: p54: validate RX frame length in p54_rx_eeprom_readback()`drivers/net/wireless/intersil/p54/txrx.c`	+8 -0	0 replies
23/389	wifi: cfg80211: validate PMSR measurement type data`net/wireless/pmsr.c`	+17 -2	0 replies
24/389	wifi: cfg80211: validate PMSR FTM preamble range`net/wireless/nl80211.c`	+3 -1	0 replies
25/389	wifi: cfg80211: reject unsupported PMSR FTM location requests`net/wireless/pmsr.c`	+2 -0	0 replies
26/389	wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock`net/mac80211/iface.c`	+7 -1	0 replies
27/389	wifi: brcmfmac: initialize SDIO data work before cleanup`drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c`	+1 -1	0 replies
28/389	wifi: cfg80211: bound element ID read when checking non-inheritance`net/wireless/scan.c`	+1 -1	0 replies
29/389	ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop`sound/soc/meson/aiu-fifo-spdif.c`	+5 -0	0 replies
30/389	ASoC: tas2562: fix deprecated shut-down GPIO always cleared after lookup`sound/soc/codecs/tas2562.c`	+3 -2	0 replies
31/389	firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context`drivers/firmware/arm_scmi/notify.c`	+3 -3	0 replies
32/389	ipv4: fib: free fib_alias with kfree_rcu() on insert error path`net/ipv4/fib_trie.c`	+1 -1	0 replies
33/389	net/iucv: take a reference on the socket found in afiucv_hs_rcv()`net/iucv/af_iucv.c`	+4 -0	0 replies
34/389	ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered`drivers/ata/sata_dwc_460ex.c`	+2 -3	0 replies
35/389	ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts`drivers/ata/sata_dwc_460ex.c`	+1 -2	0 replies
36/389	ata: sata_dwc_460ex: remove variable num_processed`drivers/ata/sata_dwc_460ex.c`	+1 -3	0 replies
37/389	ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning`drivers/ata/sata_dwc_460ex.c`	+2 -7	0 replies
38/389	smb/client: handle overlapping allocated ranges in fallocate`fs/cifs/smb2ops.c`	+18 -7	0 replies
39/389	drm/i915/gt: use correct selftest config symbol`drivers/gpu/drm/i915/gt/intel_engine_user.c`	+1 -1	0 replies
40/389	can: j1939: fix lockless local-destination check`net/can/j1939/transport.c`	+14 -4	0 replies
41/389	drm/i915/selftests: Fix GT PM sort comparators`drivers/gpu/drm/i915/gt/selftest_gt_pm.c`	+4 -4	0 replies
42/389	net/sched: act_tunnel_key: Defer dst_release to RCU callback`net/sched/act_tunnel_key.c`	+10 -4	0 replies
43/389	sctp: fix auth_hmacs array size in struct sctp_cookie`include/net/sctp/structs.h`	+2 -1	0 replies
44/389	mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n`net/mpls/af_mpls.c`	+3 -0	0 replies
45/389	wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()`drivers/net/wireless/atmel/at76c50x-usb.c`	+5 -2	0 replies
46/389	USB: storage: add NO_ATA_1X quirk for Longmai USB Key`drivers/usb/storage/unusual_devs.h`	+7 -0	0 replies
47/389	usb: chipidea: fix usage_count leak when autosuspend_delay is negative`drivers/usb/chipidea/core.c`	+1 -0	0 replies
48/389	usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback`drivers/usb/gadget/udc/dummy_hcd.c`	+27 ~~-13~~	0 replies
49/389	usb: gadget: f_midi: cancel pending IN work before freeing the midi object`drivers/usb/gadget/function/f_midi.c`	+1 -0	0 replies
50/389	usb: gadget: printer: fix infinite loop in printer_read()`drivers/usb/gadget/function/f_printer.c`	+18 -5	0 replies
51/389	USB: gadget: snps-udc: fix device name leak on probe failure`drivers/usb/gadget/udc/snps_udc_core.c`	+0 -1	0 replies
52/389	USB: gadget: fsl-udc: fix device name leak on probe failure`drivers/usb/gadget/udc/fsl_udc_core.c`	+0 -1	0 replies
53/389	usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()`drivers/usb/gadget/function/f_ncm.c`	+13 -4	0 replies
54/389	usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer`drivers/usb/gadget/function/uvc_v4l2.c`	+2 -0	0 replies
55/389	USB: serial: ftdi_sio: add support for E+H FXA291`drivers/usb/serial/ftdi_sio.c` `drivers/usb/serial/ftdi_sio_ids.h`	+7 -0	0 replies
56/389	USB: serial: io_edgeport: cap received transmit credits`drivers/usb/serial/io_edgeport.c`	+2 -1	0 replies
57/389	USB: serial: option: add TDTECH MT5710-CN`drivers/usb/serial/option.c`	+1 -0	0 replies
58/389	crypto: rsa-pkcs1pad: Dont WARN on an empty digest`crypto/rsa-pkcs1pad.c`	+1 -1	0 replies
59/389	bpf: Fix ld_{abs,ind} failure path analysis in subprogs`kernel/bpf/verifier.c`	+16 -0	0 replies
60/389	usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits`drivers/usb/host/xhci-pci.c` `drivers/usb/host/xhci.c` `drivers/usb/host/xhci.h`	+12 -5	0 replies
61/389	wifi: ath9k: hif_usb: dont dereference hif_dev after re-arming firmware request`drivers/net/wireless/ath/ath9k/hif_usb.c`	+1 -6	0 replies
62/389	hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop`drivers/hwmon/corsair-cpro.c`	+1 -0	0 replies
63/389	watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()`drivers/watchdog/watchdog_pretimeout.c`	+2 -0	0 replies
64/389	wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()`drivers/net/wireless/ath/ath11k/dp_rx.c`	+3 -0	0 replies
65/389	firewire: net: Fix fragmented datagram reassembly`drivers/firewire/net.c`	+21 ~~-18~~	0 replies
66/389	wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler`drivers/net/wireless/ath/ath6kl/wmi.c`	+12 -0	0 replies
67/389	wifi: ath6kl: fix OOB read from firmware IE lengths in connect event`drivers/net/wireless/ath/ath6kl/wmi.c`	+8 -0	0 replies
68/389	wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read`drivers/net/wireless/ath/carl9170/rx.c`	+2 -1	0 replies
69/389	wifi: carl9170: fix OOB read from off-by-two in TX status handler`drivers/net/wireless/ath/carl9170/tx.c`	+1 -1	0 replies
70/389	wifi: carl9170: fix buffer overflow in rx_stream failover path`drivers/net/wireless/ath/carl9170/rx.c`	+3 -1	0 replies
71/389	ASoC: bt-sco: fix bt-sco-pcm-wb dai widget dont connect to the endpoint`sound/soc/codecs/bt-sco.c`	+6 -2	0 replies
72/389	ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI`sound/soc/codecs/bt-sco.c`	+8 -2	0 replies
73/389	usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect`drivers/usb/atm/ueagle-atm.c`	+17 -0	0 replies
74/389	net/packet: avoid fanout hook re-registration after unregister`net/packet/af_packet.c`	+5 -1	0 replies
75/389	rds: drop incoming messages that cross network namespace boundaries`net/rds/recv.c`	+15 -0	0 replies
76/389	nfp: Check resource mutex allocation`drivers/net/ethernet/netronome/nfp/nfpcore/nfp_resource.c`	+3 -0	0 replies
77/389	wan: wanxl: Only reset hardware after BAR mapping`drivers/net/wan/wanxl.c`	+2 -1	0 replies
78/389	wifi: mwifiex: bound uAP association event IEs to the event buffer`drivers/net/wireless/marvell/mwifiex/uap_event.c`	+22 -2	0 replies
79/389	iommu/amd: Bound the early ACPI HID map`drivers/iommu/amd/init.c`	+6 -0	0 replies
80/389	wifi: mac80211: recalculate TIM when a station enters power save`net/mac80211/rx.c`	+2 -0	0 replies
81/389	amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN`drivers/net/ethernet/amd/xgbe/xgbe-mdio.c`	+8 -3	0 replies
82/389	sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid`net/sctp/auth.c`	+1 -1	0 replies
83/389	sctp: validate stream count in sctp_process_strreset_inreq()`net/sctp/stream.c`	+5 -1	0 replies
84/389	tipc: fix infinite loop in __tipc_nl_compat_dumpit`net/tipc/netlink_compat.c`	+4 -0	0 replies
85/389	wifi: brcmfmac: fix 802.1X-SHA256 call trace warning`drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c`	+1 -1	0 replies
86/389	net: bridge: vlan: add support for global options`include/uapi/linux/if_bridge.h` `net/bridge/br_private.h` `net/bridge/br_vlan.c` +1 more	+115 -3	0 replies
87/389	net: bridge: vlan: add support for dumping global vlan options`include/uapi/linux/if_bridge.h` `net/bridge/br_private.h` `net/bridge/br_vlan.c` +1 more	+69 -8	0 replies
88/389	net: bridge: vlan: fix vlan range dumps starting with pvid`net/bridge/br_netlink_tunnel.c` `net/bridge/br_private.h` `net/bridge/br_vlan.c` +1 more	+13 -9	0 replies
89/389	sctp: auth: verify auth requirement when auth_chunk is NULL`net/sctp/sm_statefuns.c`	+1 -1	0 replies
90/389	vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets`drivers/net/vmxnet3/vmxnet3_drv.c`	+16 -6	0 replies
91/389	tipc: fix u16 MTU truncation in media and bearer MTU validation`net/tipc/netlink.c`	+5 -1	0 replies
92/389	net: stmmac: reset residual action in L3L4 filters on delete`drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c`	+1 -0	0 replies
93/389	ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup`net/ipv4/icmp.c`	+15 -3	0 replies
94/389	hinic: remove unused ethtool RSS user configuration buffers`drivers/net/ethernet/huawei/hinic/hinic_dev.h` `drivers/net/ethernet/huawei/hinic/hinic_ethtool.c`	+0 ~~-23~~	0 replies
95/389	net: qrtr: restrict socket creation to the initial network namespace`net/qrtr/af_qrtr.c`	+8 -0	0 replies
96/389	net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule`drivers/net/ethernet/mellanox/mlx5/core/esw/acl/helper.c`	+1 -1	0 replies
97/389	net/mlx5e: Report zero bandwidth for non-ETS traffic classes`drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c`	+7 -0	0 replies
98/389	net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation`drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c`	+8 -0	0 replies
99/389	raw: use more conventional iterators`include/net/raw.h` `include/net/rawv6.h` `net/ipv4/raw.c` +2 more	+92 ~~-150~~	0 replies
100/389	drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()`drivers/gpu/drm/rockchip/cdn-dp-reg.c`	+2 -0	0 replies
101/389	drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()`drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c`	+1 -0	0 replies
102/389	drm/radeon: fix r100_copy_blit for large BOs`drivers/gpu/drm/radeon/r100.c`	+9 -4	0 replies
103/389	drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()`drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c`	+2 -2	0 replies
104/389	drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()`drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c`	+2 -2	0 replies
105/389	net: ipv6: fix dif and sdif mismatch in raw6_icmp_error`net/ipv6/raw.c`	+1 -1	0 replies
106/389	bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()`net/ipv4/tcp_bpf.c`	+1 -1	0 replies
107/389	can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF`net/can/bcm.c`	+32 -2	0 replies
108/389	can: bcm: add locking when updating filter and timer values`net/can/bcm.c`	+134 ~~-44~~	0 replies
109/389	can: bcm: fix CAN frame rx/tx statistics`net/can/bcm.c`	+45 ~~-22~~	0 replies
110/389	can: bcm: extend bcm_tx_lock usage for data and timer updates`net/can/bcm.c`	+75 ~~-29~~	0 replies
111/389	can: bcm: validate frame length in bcm_rx_setup() for RTR replies`net/can/bcm.c`	+41 ~~-18~~	0 replies
112/389	can: bcm: add missing device refcount for CAN filter removal`net/can/bcm.c`	+24 ~~-20~~	0 replies
113/389	can: bcm: fix stale rx/tx ops after device removal`net/can/bcm.c`	+44 ~~-10~~	0 replies
114/389	can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()`net/can/bcm.c`	+8 -5	0 replies
115/389	can: bcm: track a single source interface for ANYDEV timeout/throttle ops`net/can/bcm.c`	+44 -5	0 replies
116/389	drm/amdgpu: Fix VFCT bus number matching with soft filter`drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c`	+40 -5	0 replies
117/389	drm/amd/pm/ci: Dont disable MCLK DPM on Bonaire 0x6658 (R7 260X)`drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c`	+2 -5	0 replies
118/389	drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved`drivers/gpu/drm/amd/amdgpu/amdgpu_object.c`	+8 -5	0 replies
119/389	drm/vmwgfx: Validate vmw_surface_metadata::array_size`drivers/gpu/drm/vmwgfx/vmwgfx_surface.c`	+17 -5	0 replies
120/389	media: airspy: Return queued buffers on start_streaming() failure`drivers/media/usb/airspy/airspy.c`	+5 -3	0 replies
121/389	media: cec: seco: unregister adapter on IR probe failure`drivers/media/cec/platform/seco/seco-cec.c`	+5 -1	0 replies
122/389	media: cedrus: clean up media device on probe failure`drivers/staging/media/sunxi/cedrus/cedrus.c`	+3 -2	0 replies
123/389	media: cedrus: Fix missing cleanup in error path`drivers/staging/media/sunxi/cedrus/cedrus.c`	+1 -0	0 replies
124/389	media: cedrus: skip invalid H.264 reference list entries`drivers/staging/media/sunxi/cedrus/cedrus_h264.c`	+3 -0	0 replies
125/389	media: cx231xx: fix devres lifetime`drivers/media/usb/cx231xx/cx231xx-cards.c`	+11 -5	0 replies
126/389	media: cx23885: add ioremap return check and cleanup`drivers/media/pci/cx23885/cx23885-core.c`	+12 -2	0 replies
127/389	media: meson: vdec: Fix memory leak in error path of vdec_open`drivers/staging/media/meson/vdec/vdec.c`	+3 -1	0 replies
128/389	media: msi2500: Return queued buffers on start_streaming() failure`drivers/media/usb/msi2500/msi2500.c`	+24 -8	0 replies
129/389	media: pci: dm1105: Free allocated workqueue`drivers/media/pci/dm1105/dm1105.c`	+1 -0	0 replies
130/389	media: pwc: Drain fill_buf on start_streaming() failure`drivers/media/usb/pwc/pwc-if.c`	+5 -0	0 replies
131/389	media: pwc: Return queued buffers on start_streaming() failure`drivers/media/usb/pwc/pwc-if.c`	+6 -2	0 replies
132/389	media: radio-si476x: Unregister v4l2_device on probe failure`drivers/media/radio/radio-si476x.c`	+1 -0	0 replies
133/389	media: rtl2832: fix use-after-free in rtl2832_remove()`drivers/media/dvb-frontends/rtl2832.c`	+2 -2	0 replies
134/389	media: rtl2832_sdr: Return queued buffers on start_streaming() failure`drivers/media/dvb-frontends/rtl2832_sdr.c`	+14 -5	0 replies
135/389	media: saa7134: Fix a possible memory leak in saa7134_video_init1`drivers/media/pci/saa7134/saa7134-video.c`	+20 -5	0 replies
136/389	media: sun4i-csi: Return queued buffers on start_streaming() failure`drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c`	+4 -2	0 replies
137/389	media: tegra-video: vi: fix invalid u32 return value in format lookup`drivers/staging/media/tegra-video/vi.c`	+2 -2	0 replies
138/389	media: vb2: use ssize_t for vb2_read/vb2_write`drivers/media/common/videobuf2/videobuf2-core.c` `include/media/videobuf2-core.h`	+10 ~~-10~~	0 replies
139/389	media: vidtv: fix reference leak on failed device registration`drivers/media/test-drivers/vidtv/vidtv_bridge.c`	+3 -1	0 replies
140/389	media: vimc: fix reference leak on failed device registration`drivers/media/test-drivers/vimc/vimc-core.c`	+1 -0	0 replies
141/389	media: vivid: check for vb2_is_busy() when toggling caps`drivers/media/test-drivers/vivid/vivid-ctrls.c` `drivers/media/test-drivers/vivid/vivid-vid-cap.c` `drivers/media/test-drivers/vivid/vivid-vid-out.c`	+24 -0	0 replies
142/389	wifi: ath6kl: fix OOB access from firmware ADDBA window size`drivers/net/wireless/ath/ath6kl/txrx.c`	+6 -4	0 replies
143/389	wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper`drivers/net/wireless/marvell/mwifiex/tdls.c`	+1 -1	0 replies
144/389	wifi: wilc1000: validate assoc response length before subtracting header`drivers/net/wireless/microchip/wilc1000/hif.c`	+5 -0	0 replies
145/389	wifi: brcmfmac: make release_scratchbuffers idempotent`drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c`	+6 -2	0 replies
146/389	Bluetooth: RFCOMM: Fix session UAF in set_termios`include/net/bluetooth/rfcomm.h` `net/bluetooth/rfcomm/core.c` `net/bluetooth/rfcomm/tty.c`	+23 -4	0 replies
147/389	exec: fix unsigned loop counter wrap in transfer_args_to_stack()`fs/exec.c`	+1 -1	0 replies
148/389	binfmt_misc: set have_execfd only once the interpreter is opened`fs/binfmt_misc.c`	+2 -3	0 replies
149/389	cdrom: fix stack out-of-bounds read in CDROMVOLCTRL`drivers/cdrom/cdrom.c`	+1 -0	0 replies
150/389	comedi: comedi_parport: deal with premature interrupt`drivers/staging/comedi/drivers/comedi_parport.c`	+10 -3	0 replies
151/389	intel_th: fix MSC output device reference leak`drivers/hwtracing/intel_th/core.c` `drivers/hwtracing/intel_th/msu.c`	+2 ~~-10~~	0 replies
152/389	tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev`kernel/trace/trace_mmiotrace.c`	+1 -1	0 replies
153/389	tracing: Fix resource leak on mmiotrace trace_pipe close`kernel/trace/trace_mmiotrace.c`	+1 -1	0 replies
154/389	tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()`kernel/trace/trace_probe.c`	+5 -4	0 replies
155/389	tracing/probes: Fix potential underflow in LEN_OR_ZERO macro`kernel/trace/trace_probe.c`	+1 -1	0 replies
156/389	tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()`kernel/trace/trace_probe.c`	+1 -1	0 replies
157/389	arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates`arch/arm64/kernel/ptrace.c`	+29 -0	0 replies
158/389	Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"`arch/arm64/kernel/ptrace.c`	+0 ~~-29~~	0 replies
159/389	sctp: dont free the ASCONFs own transport in DEL-IP processing`net/sctp/sm_make_chunk.c`	+6 -0	0 replies
160/389	ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()`fs/ceph/caps.c`	+1 -0	0 replies
161/389	libceph: bound get_version reply decode to front len`net/ceph/mon_client.c`	+1 -1	0 replies
162/389	libceph: Fix multiplication overflow in decode_new_up_state_weight()`net/ceph/osdmap.c`	+4 -1	0 replies
163/389	libceph: guard missing CRUSH type name lookup`net/ceph/osdmap.c`	+4 -1	0 replies
164/389	libceph: refresh auth->authorizer_buf{,_len} after authorizer update`net/ceph/auth_x.c`	+8 -1	0 replies
165/389	libceph: reject zero bucket types in crush_decode`net/ceph/osdmap.c`	+2 -0	0 replies
166/389	libceph: remove debugfs files before client teardown`net/ceph/ceph_common.c`	+2 -2	0 replies
167/389	binfmt_elf_fdpic: only honour the first PT_INTERP`fs/binfmt_elf_fdpic.c`	+4 -0	0 replies
168/389	iommu/vt-d: Disallow SVA if page walk is not coherent`drivers/iommu/intel/svm.c`	+1 -1	0 replies
169/389	phonet: pep: fix use-after-free in pep_get_sb()`net/phonet/pep.c`	+2 -0	0 replies
170/389	vxlan: require CAP_NET_ADMIN in the device netns for changelink`drivers/net/vxlan/vxlan_core.c`	+3 -0	0 replies
171/389	net: slip: serialize receive against buffer reallocation`drivers/net/slip/slip.c`	+4 -0	0 replies
172/389	geneve: require CAP_NET_ADMIN in the device netns for changelink`drivers/net/geneve.c`	+3 -0	0 replies
173/389	net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()`net/iucv/af_iucv.c`	+2 -1	0 replies
174/389	net/iucv: fix use-after-free of a severed iucv_path`net/iucv/af_iucv.c`	+14 -0	0 replies
175/389	net/x25: fix use-after-free in x25_kill_by_neigh()`net/x25/af_x25.c`	+6 -2	0 replies
176/389	net: hip04: fix RX buffer leak on build_skb failure`drivers/net/ethernet/hisilicon/hip04_eth.c`	+8 -3	0 replies
177/389	proc: Fix broken error paths for namespace links`fs/proc/namespaces.c`	+3 -1	0 replies
178/389	rbd: Reset positive result codes to zero in object map update path`drivers/block/rbd.c`	+6 -1	0 replies
179/389	ila: reload IPv6 header after pskb_may_pull in checksum adjust`net/ipv6/ila/ila_common.c`	+12 -0	0 replies
180/389	mac802154: llsec: reject frames shorter than the authentication tag`net/mac802154/llsec.c`	+5 -0	0 replies
181/389	pppoe: reload header pointer after dev_hard_header()`drivers/net/ppp/pppoe.c`	+1 -0	0 replies
182/389	tipc: clear sock->sk on the failed-insert path in tipc_sk_create()`net/tipc/socket.c`	+1 -0	0 replies
183/389	drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()`drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c`	+5 -8	0 replies
184/389	drm/amdgpu/gfx8: drop unecessary BUG_ON()`drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c`	+0 -3	0 replies
185/389	drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()`drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c`	+5 -5	0 replies
186/389	drm/amdgpu: fix division by zero with invalid uvd dimensions`drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c`	+8 -0	0 replies
187/389	drm/amdgpu: invoke pm_genpd_remove() before freeing genpd`drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c`	+2 -0	0 replies
188/389	tipc: fix use-after-free of the discoverer in tipc_disc_rcv()`net/tipc/core.c` `net/tipc/discover.c`	+17 -2	0 replies
189/389	wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses`drivers/net/wireless/mediatek/mt76/mt7615/mac.c`	+4 -0	0 replies
190/389	openvswitch: fix GSO userspace truncation underflow`net/openvswitch/actions.c` `net/openvswitch/datapath.c` `net/openvswitch/datapath.h` +1 more	+21 ~~-23~~	0 replies
191/389	raw: remove unused variables from raw6_icmp_error()`net/ipv6/raw.c`	+0 -3	0 replies
192/389	raw: fix a typo in raw_icmp_error()`net/ipv4/raw.c`	+1 -1	0 replies
193/389	net: bridge: vlan: fix global vlan option range dumping`net/bridge/br_vlan.c`	+2 -1	0 replies
194/389	net: mpls: initialize rtm_tos in mpls_getroute()`net/mpls/af_mpls.c`	+1 -0	0 replies
195/389	media: uvcvideo: Implement dual stream quirk to fix loss of usb packets`drivers/media/usb/uvc/uvc_video.c` `drivers/media/usb/uvc/uvcvideo.h`	+31 -1	0 replies
196/389	media: uvcvideo: Fix sequence number when no EOF`drivers/media/usb/uvc/uvc_video.c`	+49 ~~-45~~	0 replies
197/389	HID: logitech-dj: Standardise hid_report_enum variable nomenclature`drivers/hid/hid-logitech-dj.c`	+6 -6	0 replies
198/389	HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write`drivers/hid/hid-logitech-dj.c`	+10 -0	0 replies
199/389	HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report`drivers/hid/hid-logitech-dj.c`	+2 -1	0 replies
200/389	net: qrtr: ns: Limit the maximum server registration per node`net/qrtr/ns.c`	+16 ~~-10~~	0 replies
201/389	net: qrtr: ns: Raise node count limit to 512`net/qrtr/ns.c`	+3 -2	0 replies
202/389	tls: separate no-async decryption request handling from async`net/tls/tls_sw.c`	+10 -7	0 replies
203/389	dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA`drivers/dma/sun6i-dma.c`	+4 -7	0 replies
204/389	ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup`sound/soc/codecs/max98095.c`	+3 -2	0 replies
205/389	ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup`sound/soc/codecs/max98090.c`	+3 -2	0 replies
206/389	netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()`include/linux/netfilter/nf_conntrack_sip.h` `net/netfilter/nf_conntrack_sip.c` `net/netfilter/nf_nat_sip.c`	+3 -3	0 replies
207/389	keys: fix out-of-bounds read in keyring_get_key_chunk()`security/keys/keyring.c`	+5 -4	0 replies
208/389	keys: make keyring key-chunk byte order agree with keyring_diff_objects()`security/keys/keyring.c`	+3 -2	0 replies
209/389	assoc_array: trim the final shortcut word using the current chunk end`lib/assoc_array.c`	+2 -1	0 replies
210/389	netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH`net/netfilter/xt_hashlimit.c`	+15 -1	0 replies
211/389	netfilter: nft_payload: fix mask build for partial field offload`net/netfilter/nft_payload.c`	+1 ~~-11~~	0 replies
212/389	rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled`net/rds/ib.c` `net/rds/ib_cm.c` `net/rds/tcp.c`	+13 -3	0 replies
213/389	rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()`net/rds/tcp.c`	+5 -3	0 replies
214/389	scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer`drivers/scsi/libiscsi.c`	+1 -1	0 replies
215/389	scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer`drivers/scsi/libiscsi_tcp.c`	+1 -7	0 replies
216/389	smb: client: fix buffer leaks in SMB1 read and write`fs/cifs/cifssmb.c`	+9 -3	0 replies
217/389	hwmon: (nct6775-core) Prevent access to unsupported weight registers`drivers/hwmon/nct6775.c`	+6 -6	0 replies
218/389	forcedeth: fix UAF of txrx_stats in nv_remove`drivers/net/ethernet/nvidia/forcedeth.c`	+2 -2	0 replies
219/389	hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread`drivers/hwmon/adt7470.c`	+1 -1	0 replies
220/389	hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks`drivers/hwmon/adt7470.c`	+2 -2	0 replies
221/389	hwmon: (adt7470) Create functions for updating readings and limits`drivers/hwmon/adt7470.c`	+118 ~~-36~~	0 replies
222/389	hwmon: (adt7470) Fix some style issues`drivers/hwmon/adt7470.c`	+3 -3	0 replies
223/389	hwmon: (adt7470) Convert to use regmap`drivers/hwmon/adt7470.c`	+241 ~~-173~~	0 replies
224/389	hwmon: (adt7470) Fix PWM auto temp state array and bounds check`drivers/hwmon/adt7470.c`	+6 -1	0 replies
225/389	powerpc/boot: Fix simpleboot CPU node lookup check`arch/powerpc/boot/simpleboot.c`	+1 -1	0 replies
226/389	powerpc/boot: Fix treeboot-currituck CPU node lookup check`arch/powerpc/boot/treeboot-currituck.c`	+1 -1	0 replies
227/389	powerpc/boot: Fix treeboot-akebono CPU node lookup check`arch/powerpc/boot/treeboot-akebono.c`	+1 -1	0 replies
228/389	hwmon: (pmbus) Fix return value from pmbus_update_byte_data()`drivers/hwmon/pmbus/pmbus_core.c`	+1 -1	0 replies
229/389	Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp`net/bluetooth/l2cap_core.c`	+5 -0	0 replies
230/389	net: phylink: put link_gpio if phylink_create fails`drivers/net/phy/phylink.c`	+15 ~~-14~~	0 replies
231/389	scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req`drivers/s390/scsi/zfcp_aux.c`	+1 -0	0 replies
232/389	net: sxgbe: free TX rings on RX allocation failure`drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c`	+4 -5	0 replies
233/389	net: sxgbe: check descriptor ring allocation failures`drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c`	+4 -1	0 replies
234/389	can: isotp: check register_netdevice_notifier() error in module init`net/can/isotp.c`	+9 -4	0 replies
235/389	tracing/mmiotrace: Reset dropped_count in mmio_reset_data()`kernel/trace/trace_mmiotrace.c`	+1 -0	0 replies
236/389	octeontx2-pf: Set correct sequence for carrier off and tx queue stop`drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c`	+1 -1	0 replies
237/389	qede: sync udp_tunnel ports outside qede_lock in the recovery path`drivers/net/ethernet/qlogic/qede/qede_main.c`	+22 ~~-22~~	0 replies
238/389	ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump`net/ipv6/ip6_fib.c`	+8 -9	0 replies
239/389	rhashtable: clear stale iter->p on table restart`lib/rhashtable.c`	+1 -0	0 replies
240/389	pinctrl: devicetree: dont free uninitialized dev_name on error path`drivers/pinctrl/devicetree.c`	+4 -0	0 replies
241/389	pinctrl: bm1880: add missing select GENERIC_PINCONF`drivers/pinctrl/Kconfig`	+1 -0	0 replies
242/389	mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()`mm/percpu-km.c`	+1 -1	0 replies
243/389	mm/hugetlb: fix list corruption in allocate_file_region_entries()`mm/hugetlb.c`	+1 -1	0 replies
244/389	sctp: validate Adaptation Indication parameter length`net/sctp/sm_make_chunk.c`	+6 -0	0 replies
245/389	audit: fix potential integer overflow in audit_log_n_string()`kernel/audit.c`	+9 -2	0 replies
246/389	audit: fix potential use-after-free in audit_del_rule()`kernel/auditfilter.c`	+4 -2	0 replies
247/389	Bluetooth: HIDP: validate numbered report payloads`net/bluetooth/hidp/core.c`	+3 -2	0 replies
248/389	bpf: lwt: Fix dst reference leak on reroute failure`net/core/lwt_bpf.c`	+3 -1	0 replies
249/389	ALSA: 6fire: Fix UAF at error handling during probe`sound/usb/6fire/chip.c`	+4 -0	0 replies
250/389	ALSA: lx6464es: fix period byte count for 16-bit streams`sound/pci/lx6464es/lx6464es.c` `sound/pci/lx6464es/lx_core.c`	+2 -8	0 replies
251/389	ALSA: pcm: wake linked drain waiters on unlink`sound/core/pcm_native.c`	+7 -0	0 replies
252/389	ASoC: tas2562: fix DVC coefficient write order`sound/soc/codecs/tas2562.c`	+15 -8	0 replies
253/389	ASoC: tas2562: fix broken entries in the volume lookup table`sound/soc/codecs/tas2562.c`	+4 -3	0 replies
254/389	ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()`sound/usb/midi.c`	+2 -0	0 replies
255/389	ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set`sound/usb/endpoint.c`	+4 -2	0 replies
256/389	ALSA: usb-audio: Clamp frame size in implicit-feedback mode`sound/usb/endpoint.c`	+5 -3	0 replies
257/389	dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+`include/linux/dma/qcom_bam_dma.h`	+16 -5	0 replies
258/389	e1000: fix memory leak in e1000_probe()`drivers/net/ethernet/intel/e1000/e1000_main.c`	+1 -1	0 replies
259/389	igbvf: Fix leak in TX DMA error cleanup`drivers/net/ethernet/intel/igbvf/netdev.c`	+0 -2	0 replies
260/389	ipvs: do not propagate one-packet flag to synced conns`net/netfilter/ipvs/ip_vs_conn.c`	+3 -0	0 replies
261/389	net/smc: fix socket use-after-free during link group termination`net/smc/smc_core.c`	+1 -1	0 replies
262/389	netfilter: ipset: do not update comments from kernel-side hash adds`net/netfilter/ipset/ip_set_hash_gen.h`	+1 -1	0 replies
263/389	tipc: avoid use-after-free in poll trace queue dumps`net/tipc/socket.c`	+1 -1	0 replies
264/389	wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames`drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c`	+1 -1	0 replies
265/389	binfmt_misc: reject a flag character as the field delimiter`fs/binfmt_misc.c`	+4 -0	0 replies
266/389	mm/page_reporting: use system_freezable_wq to fix UAF during suspend`mm/page_reporting.c`	+4 -2	0 replies
267/389	net: bridge: stop fast-leave after deleting a port group`net/bridge/br_multicast.c`	+1 -0	0 replies
268/389	net: ipv6: clear suppressed fib6 rule result`net/ipv6/fib6_rules.c`	+1 -0	0 replies
269/389	powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()`arch/powerpc/platforms/ps3/mm.c`	+1 -0	0 replies
270/389	um: vector: fix use-after-free in vector_mmsg_rx()`arch/um/drivers/vector_kern.c`	+3 -0	0 replies
271/389	vxlan: re-fetch eth header after route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+1 -0	0 replies
272/389	vxlan: unclone skb head before modifying eth header in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+4 -0	0 replies
273/389	vxlan: use neigh_ha_snapshot() in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+4 -2	0 replies
274/389	vxlan: use pskb_network_may_pull() in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+2 -2	0 replies
275/389	tracing: Check return value of __register_event() in trace_module_add_events()`kernel/trace/trace_events.c`	+2 -2	0 replies
276/389	tracing/filters: Fix false positive match in regex_match_full()`kernel/trace/trace_events_filter.c`	+3 -0	0 replies
277/389	selftests/clone3: fix wild pointer access of getline due to missing init`tools/testing/selftests/clone3/clone3_set_tid.c`	+1 -1	0 replies
278/389	sctp: reject stale cookies with mismatched verification tags`net/sctp/sm_make_chunk.c`	+7 -4	0 replies
279/389	sctp: prevent peer transport count overflow`net/sctp/associola.c`	+3 -0	0 replies
280/389	i2c: amd-mp2: Unregister callback on adapter add failure`drivers/i2c/busses/i2c-amd-mp2-plat.c`	+3 -1	0 replies
281/389	cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()`drivers/cpufreq/powernow-k8.c`	+1 -0	0 replies
282/389	s390/dasd: Fix potential NULL pointer dereference`drivers/s390/block/dasd_ioctl.c`	+1 -1	0 replies
283/389	s390/zcrypt: Validate length for CCA AES cipher key requests`drivers/s390/crypto/zcrypt_ccamisc.c`	+3 -0	0 replies
284/389	s390/zcrypt: Validate length for CCA ECC private key requests`drivers/s390/crypto/zcrypt_ccamisc.c`	+3 -0	0 replies
285/389	phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask`drivers/phy/xilinx/phy-zynqmp.c`	+1 -1	0 replies
286/389	phy: zynqmp: use read-modify-write for SERDES scrambler bypass`drivers/phy/xilinx/phy-zynqmp.c`	+6 -2	0 replies
287/389	phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB`drivers/phy/xilinx/phy-zynqmp.c`	+29 ~~-10~~	0 replies
288/389	net: openvswitch: fix potential UAF on meter attach failure`net/openvswitch/meter.c`	+19 ~~-14~~	0 replies
289/389	net: openvswitch: fix skb leak on flow key update failure during ct`net/openvswitch/actions.c`	+1 -1	0 replies
290/389	i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock`drivers/i2c/busses/i2c-jz4780.c`	+4 -1	0 replies
291/389	can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer`net/can/j1939/transport.c`	+1 -1	0 replies
292/389	can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()`drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c`	+1 -0	0 replies
293/389	can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents`drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c`	+11 -2	0 replies
294/389	can: softing: fw_parse(): validate firmware record spans`drivers/net/can/softing/softing_fw.c`	+32 ~~-14~~	0 replies
295/389	can: peak_usb: add bounds check for USB channel index`drivers/net/can/usb/peak_usb/pcan_usb_pro.c`	+16 -4	0 replies
296/389	can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error`drivers/net/can/usb/peak_usb/pcan_usb_core.c`	+0 -1	0 replies
297/389	can: peak_usb: validate uCAN receive record lengths`drivers/net/can/usb/peak_usb/pcan_usb_fd.c`	+39 -1	0 replies
298/389	drm/vc4: Zero the tile state data array before each BIN job`drivers/gpu/drm/vc4/vc4_validate.c`	+23 -6	0 replies
299/389	drm/amdgpu: cap GTT size to physical RAM on APUs`drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c`	+12 -0	0 replies
300/389	drm/vmwgfx: validate DRAW_PRIMITIVES header size before division`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+7 -1	0 replies
301/389	drm/vmwgfx: bound DMA command body size against suffix pointer`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+6 -0	0 replies
302/389	HID: logitech-dj: Fix maxfield check in DJ short report validation`drivers/hid/hid-logitech-dj.c`	+7 -2	0 replies
303/389	mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios`mm/huge_memory.c`	+14 -2	0 replies
304/389	Bluetooth: SCO: Fix UAF on sco_sock_timeout`include/net/bluetooth/bluetooth.h` `net/bluetooth/af_bluetooth.c` `net/bluetooth/sco.c`	+35 -5	0 replies
305/389	Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold`net/bluetooth/sco.c`	+7 -3	0 replies
306/389	net: openvswitch: fix skb leak on flow key update failure during recirculation`net/openvswitch/actions.c`	+8 -1	0 replies
307/389	firmware: stratix10-svc: fix memory leaks and list corruption bugs`drivers/firmware/stratix10-svc.c`	+5 -4	0 replies
308/389	gpio: pch: use raw_spinlock_t for the register lock`drivers/gpio/gpio-pch.c`	+14 ~~-14~~	0 replies
309/389	mount: honour SB_NOUSER in the new mount API`fs/namespace.c`	+5 -0	0 replies
310/389	s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()`drivers/s390/crypto/zcrypt_ccamisc.c`	+13 -7	0 replies
311/389	nfs4: take a reference on the nfs_client when running FREE_STATEID`fs/nfs/nfs4proc.c`	+8 -0	0 replies
312/389	NFS: Pin the struct nfs_server during a FREE_STATEID call`fs/nfs/nfs4proc.c`	+5 -0	0 replies
313/389	ARM: npcm: Fix OF node refcount leaks in SMP setup`arch/arm/mach-npcm/platsmp.c`	+2 -0	0 replies
314/389	bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor`drivers/net/bonding/bond_alb.c`	+6 -4	0 replies
315/389	bpf: Preserve pointer state for commuted arithmetic`kernel/bpf/verifier.c`	+8 -7	0 replies
316/389	net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()`net/smc/smc_llc.c`	+2 -1	0 replies
317/389	net/sched: cls_route: fix fastmap use-after-free on filter`net/sched/cls_route.c`	+26 -9	0 replies
318/389	net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete`drivers/net/ethernet/hisilicon/hix5hd2_gmac.c`	+0 -1	0 replies
319/389	net/mlx5: Remove second FW tracer check`drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c` `drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c`	+2 -7	0 replies
320/389	net/mlx5: fw_tracer, return NULL on create error`drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c`	+7 -9	0 replies
321/389	counter: microchip-tcb-capture: Fix DT channel validation`drivers/counter/microchip-tcb-capture.c`	+2 -2	0 replies
322/389	udp: fix potential use-after-free in tunnel segmentation`net/ipv4/udp_offload.c`	+3 -1	0 replies
323/389	net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter`net/sched/sch_cake.c`	+0 -1	0 replies
324/389	net: openvswitch: Fix kerneldoc warnings`net/openvswitch/flow.c` `net/openvswitch/vport.c`	+7 -1	0 replies
325/389	net: openvswitch: fix kernel-doc warnings in flow.c`net/openvswitch/flow.c`	+7 -6	0 replies
326/389	net/openvswitch: check Ethernet header length in key_extract()`net/openvswitch/flow.c`	+7 -4	0 replies
327/389	bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips`drivers/net/ethernet/broadcom/bnxt/bnxt.c` `drivers/net/ethernet/broadcom/bnxt/bnxt.h`	+9 -1	0 replies
328/389	bnxt_en: Disable EOP for TPA on all chips to prevent data corruption`drivers/net/ethernet/broadcom/bnxt/bnxt.c`	+7 -4	0 replies
329/389	sctp: fix addip_serial increment on ASCONF_ACK allocation failure`net/sctp/sm_make_chunk.c`	+1 -2	0 replies
330/389	net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length`net/ncsi/ncsi-netlink.c`	+4 -0	0 replies
331/389	net: marvell: prestera: try to load previous fw version`drivers/net/ethernet/marvell/prestera/prestera_pci.c`	+61 ~~-22~~	0 replies
332/389	net: prestera: validate firmware header length`drivers/net/ethernet/marvell/prestera/prestera_pci.c`	+3 -0	0 replies
333/389	net: remove WARN_ON_ONCE() from sk_mc_loop()`net/core/sock.c`	+0 -1	0 replies
334/389	net: qrtr: ns: Raise lookup limit to 128`net/qrtr/ns.c`	+1 -1	0 replies
335/389	ata: pata_sl82c105: fix bridge revision use-after-free`drivers/ata/pata_sl82c105.c`	+3 -1	0 replies
336/389	sctp: clear control chunk transport if it is being removed`net/sctp/associola.c`	+4 -0	0 replies
337/389	sctp: remove the unessessary hold for idev in sctp_v6_err`net/sctp/ipv6.c`	+2 ~~-10~~	0 replies
338/389	sctp: extract sctp_v6_err_handle function from sctp_v6_err`net/sctp/ipv6.c`	+40 ~~-36~~	0 replies
339/389	sctp: extract sctp_v4_err_handle function from sctp_v4_err`net/sctp/input.c`	+49 ~~-57~~	0 replies
340/389	tls: dont abort the connection on signal-interrupted sends`net/tls/tls_sw.c`	+1 -1	0 replies
341/389	spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers`drivers/spi/spi-fsl-dspi.c`	+7 -6	0 replies
342/389	ALSA: usb-audio: Evaluate packsize caps at the right place`sound/usb/endpoint.c` `sound/usb/pcm.c`	+7 -3	0 replies
343/389	Input: evdev - sanitize event type index when fetching event masks`drivers/input/evdev.c`	+4 -1	0 replies
344/389	ALSA: usb-audio: fix OOB write on Type II inbound URBs`sound/usb/endpoint.c`	+4 -2	0 replies
345/389	usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()`drivers/usb/atm/cxacru.c`	+2 -0	0 replies
346/389	usb: gadget: f_ncm: Use unsigned int for ndp_index`drivers/usb/gadget/function/f_ncm.c`	+1 -1	0 replies
347/389	ipvs: add totalconns for dest`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_conn.c` `net/netfilter/ipvs/ip_vs_ctl.c` +4 more	+28 ~~-38~~	0 replies
348/389	ipvs: properly update the overload flag on dest edit`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_conn.c` `net/netfilter/ipvs/ip_vs_ctl.c`	+72 ~~-25~~	0 replies
349/389	ipvs: clear IPv4 options after rebasing tunnel ICMP errors`net/netfilter/ipvs/ip_vs_core.c`	+1 -0	0 replies
350/389	net/packet: reset the MAC header on the packet-socket transmit path`net/packet/af_packet.c`	+4 -3	0 replies
351/389	net: openvswitch: reallocate update replies for mismatched IDs`net/openvswitch/datapath.c`	+26 -3	0 replies
352/389	net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header`include/linux/netdevice.h`	+0 -5	0 replies
353/389	netfilter: ebt_nflog: pin the NFLOG backend`net/bridge/netfilter/ebt_nflog.c`	+16 -1	0 replies
354/389	vt: add permission check for KDSKBMETA ioctl`drivers/tty/vt/vt_ioctl.c`	+2 -0	0 replies
355/389	vt: stabilize tty reference in kbd_keycode with tty_port_tty_get`drivers/tty/vt/keyboard.c`	+4 -1	0 replies
356/389	Input: evdev - fix information leak in evdev_pass_values()`drivers/input/evdev.c`	+12 ~~-10~~	0 replies
357/389	Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref`include/net/bluetooth/l2cap.h` `net/bluetooth/l2cap_core.c`	+23 ~~-14~~	0 replies
358/389	Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev`net/bluetooth/6lowpan.c`	+3 ~~-15~~	0 replies
359/389	ima: fix out-of-bounds read in xattr_verify()`security/integrity/ima/ima_appraise.c`	+7 -2	0 replies
360/389	futex: Prevent robust futex exit race some more`kernel/futex/core.c`	+56 ~~-26~~	0 replies
361/389	RDMA/rxe: Fix a use-after-free problem in rxe_mmap`drivers/infiniband/sw/rxe/rxe_mmap.c`	+16 -3	0 replies
362/389	mips: sched: Fix CPUMASK_OFFSTACK memory corruption`arch/mips/kernel/mips-mt-fpaff.c`	+15 ~~-13~~	0 replies
363/389	fscrypt: Replace mk_users keyring with simple list`fs/crypto/fscrypt_private.h` `fs/crypto/keyring.c`	+113 ~~-131~~	0 replies
364/389	ipv4: fix use-after-free in fib_nhc_update_mtu()`include/net/route.h` `net/ipv4/fib_semantics.c` `net/ipv4/route.c`	+42 ~~-23~~	0 replies
365/389	serial: 8250_dma: Clear stale RX state on shutdown`drivers/tty/serial/8250/8250_dma.c`	+7 -5	0 replies
366/389	staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()`drivers/staging/rtl8723bs/core/rtw_ieee80211.c`	+3 -0	0 replies
367/389	staging: rtl8723bs: validate monitor transmit frame lengths`drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c`	+4 -0	0 replies
368/389	misc: fastrpc: fix channel ctx ref leak when session alloc fails`drivers/misc/fastrpc.c`	+1 -1	0 replies
369/389	misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free`drivers/misc/fastrpc.c`	+1 -0	0 replies
370/389	fbdev: bitblit: bound-check glyph index in bit_cursor()`drivers/video/fbdev/core/bitblit.c`	+7 -2	0 replies
371/389	ipv6: prevent in6_dev_get() from resurrecting inet6_dev`include/net/addrconf.h`	+2 -2	0 replies
372/389	netfilter: bridge: release template ct on non-IP path`net/bridge/netfilter/nf_conntrack_bridge.c`	+1 -0	0 replies
373/389	net: atlantic: free RX pages of consumed but not refilled buffers`drivers/net/ethernet/aquantia/atlantic/aq_ring.c`	+18 -4	0 replies
374/389	vxlan: do not arm the ageing timer on a device that is down`drivers/net/vxlan/vxlan_core.c`	+1 -1	0 replies
375/389	vsock/virtio: avoid refilling the RX queue after teardown`net/vmw_vsock/virtio_transport.c`	+2 -1	0 replies
376/389	vhost: reset the vring metadata cache on vring reconfiguration`drivers/vhost/vhost.c`	+8 -0	0 replies
377/389	tipc: read le->link under the node lock in tipc_node_link_down()`net/tipc/node.c`	+10 -5	0 replies
378/389	ring-buffer: Use current_context for safe per-CPU buffer swap`kernel/trace/ring_buffer.c`	+4 -4	0 replies
379/389	ipv6: fix Route Information option length validation`net/ipv6/route.c`	+4 -4	0 replies
380/389	ip6_tunnel: clear skb2->cb[] in ip6ip6_err()`net/ipv6/ip6_tunnel.c`	+3 -0	0 replies
381/389	bpf, sockmap: Fix sk_redir use-after-free in send verdict`net/ipv4/tcp_bpf.c`	+2 -0	0 replies
382/389	scsi: scsi_debug: Negate wrapped memcmp() result`drivers/scsi/scsi_debug.c`	+2 -2	0 replies
383/389	sctp: keep chunk->transport in step with the list it is queued on`net/sctp/outqueue.c`	+1 -0	0 replies
384/389	sctp: fix use-after-free of cached ASCONF chunk`net/sctp/associola.c` `net/sctp/sm_statefuns.c`	+8 -2	0 replies
385/389	sctp: clear new_transport when removing a peer`net/sctp/associola.c`	+3 -0	0 replies
386/389	thunderbolt: Bound the DROM dual link port number before indexing sw->ports`drivers/thunderbolt/eeprom.c`	+8 -1	0 replies
387/389	prestera: fix fallback to previous version on same major version`drivers/net/ethernet/marvell/prestera/prestera_pci.c`	+2 -1	0 replies
388/389	hwmon: (adt7470) Add missing dependency on REGMAP_I2C`drivers/hwmon/Kconfig`	+1 -0	0 replies
389/389	hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors`drivers/hwmon/adt7470.c`	+29 ~~-11~~	0 replies

Reviews trailers per patch

194 of 389 patches have a Reviewed-by or Acked-by.

Patch	Christoph Hellwig	David Sterba	Qu Wenruo	Junxian Huang	Florian Westphal	Sabrina Dubroca	Ido Schimmel	Hidayath Khan	ChenXiaoSong	Oleksij Rempel	Victor Nogueira	Davide Caratti	David Ahern	Alan Stern	Frank Li	Peter Chen	Lukas Wunner	Toke Høiland-Jørgensen	Rameshkumar Sundaram	Baochen Qiang	Arend van Spriel	Martin Blumenstingl	Christian Lamparter	Allison Henderson	Simon Horman	Francesco Dolcini	Ankit Soni	Patrick Oppenlander	Xin Long	Tung Nguyen	Vasanthakumar Thiagarajan	Ronak Doshi	Sankararaman Jayaraman	Vadim Fedorenko	Maxime Chevallier	Jakub Raczynski	Joe Damato	Cosmin Ratiu	Carolina Jubran	Pavan Chebbi	Chaoyi Chen	Christian König	Vitaly Prosyak	Emil Tsalapatis	Jakub Sitnicki	Stanislaw Gruszka	Willem de Bruijn	Alex Deucher	Maaz Mombasawala	Paul Kocialkowski	Nicolas Dufresne	Jernej Skrabec	Chen-Yu Tsai	Luca Ceresoli	Marek Szyprowski	David Hildenbrand (Arm)	Feng Xue	Oliver Hartkopp	Viacheslav Dubeyko	Alex Markuze	Ilya Dryomov	Jori Koolstra	Kevin Tian	Samiullah Khawaja	Jason Gunthorpe	Johan Hovold	Fernando Fernandez Mancera	Alexandra Winter	Martin Schiller	Jacob Keller	Magnus Lindholm	Antoine Tenart	Eric Dumazet	Breno Leitao	Leo Liu	Tao Zhou	Ilya Maximets	Aaron Conole	Jonathan Lemon	Jinjie Ruan	Jarkko Sakkinen	Talha Berk Arslan	Chris Leech	Zhu Yanjun	Ricardo Ribalda	Ritesh Harjani (IBM)	Andrew Lunn	M Nikhil	Chinmaya Kajagar	Nihar Panda	Laurent Pinchart	Hans de Goede	Shuangpeng Bai	Lakshmi Sowjanya D	Dmitry Baryshkov	Dima Ruinskiy	Julian Anastasov	Mahanta Jambigi	Jozsef Kadlecsik	David Rientjes	Michael S. Tsirkin	Nikolay Aleksandrov	Geert Uytterhoeven	NeilBrown	Dennis Zhou	Muchun Song	Lorenzo Stoakes	Michal Simek	Eelco Chaudron	Vincent Mailhol	Iago Toral Quiroga	David Francis	Ian Forbes	Zi Yan	Baolin Wang	Miaohe Lin	[email protected]	Linus Walleij	Holger Dengler	Dan Aloni	Avi Fishman	Jay Vosburgh	Daniel Wade	Shung-Hsi Yu	Sidraya Jayagond	Dust Li	Santosh Kalluri	Viresh Kumar	Zhongqiu Han	Eduard Shishkin	Stefan Haberland	Harald Freudenberger	Shay Drori	Elad Nachman	Niklas Cassel	Marcelo Ricardo Leitner	Joshua Crofts	Greg Kroah-Hartman	Andy Gospodarek	Somnath Kotur	Kalesh AP	Sukhdeep Singh	Mina Almasry	Bobby Eshleman	John Fastabend	John Garry	Jesse Brandeburg	Taras Chornyi	Ekansh Gupta	nasm	Pavel Machek (CIP)	Florian Fainelli	Dominique Martinet	Barry K. Nathan	Woody Suwalski	Brett A C Sheffield	Mark Brown
Series																																																																																																																																																							T-b	T-b	T-b	T-b	T-b	T-b	T-b
1/389	R-b
2/389
3/389						R-b
4/389
5/389
6/389
7/389
8/389
9/389
10/389
11/389
12/389
13/389
14/389		R-b
15/389		R-b	R-b
16/389				R-b
17/389					R-b
18/389
19/389
20/389
21/389
22/389																							A-b
23/389
24/389
25/389
26/389
27/389																					A-b
28/389
29/389																						R-b
30/389
31/389
32/389							R-b
33/389								R-b
34/389
35/389
36/389
37/389
38/389									R-b
39/389
40/389										T-b A-b
41/389
42/389											T-b	R-b
43/389
44/389													R-b
45/389
46/389														A-b
47/389															R-b
48/389														R-b
49/389
50/389																R-b
51/389
52/389
53/389
54/389
55/389
56/389
57/389
58/389																	R-b
59/389
60/389
61/389																		A-b
62/389
63/389
64/389																			R-b	R-b
65/389
66/389
67/389																															R-b
68/389																							A-b
69/389																							A-b
70/389																							A-b
71/389
72/389
73/389																																														A-b
74/389																																															R-b
75/389																								R-b T-b
76/389																									R-b
77/389
78/389																										R-b
79/389																											R-b
80/389
81/389																												T-b
82/389																													A-b
83/389																													A-b
84/389																														R-b R-b
85/389																					A-b
86/389
87/389
88/389							R-b
89/389																													A-b
90/389																									R-b							R-b	R-b
91/389																									R-b									R-b
92/389																																			R-b	R-b
93/389													R-b
94/389																																					R-b
95/389
96/389																																						R-b
97/389																																							R-b	R-b
98/389																																							R-b	R-b
99/389
100/389																																									R-b
101/389
102/389																																										A-b
103/389																																											R-b
104/389																																											R-b
105/389																																					R-b
106/389																																												R-b	R-b
107/389																																																									T-b	T-b
108/389
109/389
110/389
111/389
112/389
113/389
114/389
115/389
116/389																																																R-b
117/389
118/389																																										R-b						R-b
119/389																																																	R-b
120/389
121/389
122/389																																																		R-b
123/389																																																		A-b
124/389																																																			R-b	A-b	T-b
125/389
126/389
127/389
128/389
129/389
130/389
131/389
132/389
133/389
134/389
135/389
136/389
137/389																																																						R-b
138/389																																																							A-b
139/389
140/389
141/389																																																			R-b
142/389																															R-b
143/389																										R-b
144/389
145/389																					A-b
146/389
147/389																																																								R-b
148/389
149/389
150/389
151/389																																																																		R-b
152/389
153/389
154/389
155/389
156/389
157/389																																																																																R-b T-b
158/389
159/389																													A-b
160/389																																																											R-b
161/389																																																											R-b
162/389																																																											R-b
163/389																																																											R-b
164/389																																																												R-b
165/389																																																													R-b
166/389																																																											R-b
167/389																																																														R-b
168/389																																																															R-b	R-b	R-b
169/389
170/389																																																																			R-b
171/389
172/389																																																																			R-b
173/389																																																																				R-b
174/389
175/389																																																																					A-b
176/389																																																																						R-b
177/389																																																																							T-b
178/389																																																													R-b
179/389																									R-b																																															R-b
180/389																									R-b
181/389																																		R-b																																							R-b
182/389																									R-b					R-b																																												R-b
183/389																																											R-b
184/389																																											R-b
185/389																																											R-b
186/389																																																R-b																											R-b
187/389																																																																												R-b
188/389																														R-b
189/389
190/389																																																																													R-b	R-b
191/389																																																																															A-b
192/389
193/389
194/389
195/389																																																																																					R-b
196/389																																																																																											R-b	R-b
197/389
198/389
199/389
200/389																									R-b
201/389
202/389
203/389															R-b																																					A-b
204/389
205/389
206/389
207/389																																																																																	R-b T-b
208/389																																																																																	R-b T-b
209/389																																																																																	R-b T-b
210/389																																																																																		Reported-and-tested-by
211/389
212/389																								R-b
213/389																								R-b
214/389																																																																																			A-b
215/389																																																																																			A-b
216/389
217/389
218/389																																		R-b																																																		R-b
219/389
220/389
221/389
222/389
223/389
224/389
225/389																																																																																						R-b
226/389																																																																																						R-b
227/389																																																																																						R-b
228/389
229/389
230/389																																																																																							R-b
231/389																																																																																								T-b A-b	R-b	R-b
232/389																																		R-b
233/389																																		R-b
234/389
235/389
236/389																									R-b
237/389																																																																						R-b
238/389							R-b
239/389																																																																																																								R-b
240/389
241/389
242/389																																																																																																									A-b
243/389																																																																																																										R-b
244/389																													A-b
245/389
246/389
247/389
248/389
249/389																																																																																													Reported-and-tested-by
250/389
251/389
252/389
253/389
254/389
255/389
256/389
257/389															R-b																																																																															T-b	R-b
258/389																																																																																																R-b
259/389
260/389																																																																																																	A-b
261/389																																																																																																		R-b
262/389																																																																																																			A-b
263/389																														R-b
264/389
265/389
266/389																																																								A-b																																												A-b	A-b
267/389																																																																																																						A-b
268/389							R-b
269/389																																																																																						R-b																	R-b
270/389
271/389																																		R-b
272/389
273/389																																		R-b
274/389																																		R-b
275/389
276/389
277/389																																																								A-b																																																			R-b
278/389																													A-b
279/389																													A-b
280/389
281/389																																																																																																																																A-b	R-b
282/389																																																																																																																																		A-b	R-b
283/389																																																																																																																																				R-b
284/389																																																																																																																																				R-b
285/389																																																																																																												A-b
286/389																																																																																																												A-b
287/389																																																																																																												A-b
288/389																																																																																																													R-b
289/389																																																																														R-b
290/389
291/389
292/389
293/389
294/389
295/389																																																																																																														R-b
296/389																																																																																																														R-b
297/389
298/389																																																																																																															R-b
299/389																																																																																																																R-b
300/389																																																																																																																	R-b
301/389																																																																																																																	R-b
302/389
303/389																																																								A-b																																																										R-b	R-b	R-b
304/389																																																																																																																					T-b
305/389
306/389																																																																														R-b
307/389
308/389																																																																																																																						R-b
309/389
310/389																																																																																																																							R-b
311/389
312/389																																																																																																																								T-b
313/389																																																																																																																									R-b
314/389																																																																																																						R-b																				A-b
315/389																																																																																																																											T-b	A-b
316/389								R-b																																																																																																																					R-b	R-b
317/389											T-b																																																																																																																				T-b
318/389
319/389
320/389																																																																																																																																					R-b
321/389																																																																																																																																									R-b
322/389																																																																								R-b
323/389
324/389
325/389
326/389																																																																													R-b																																R-b
327/389																																																																																																																																											R-b	R-b
328/389																																								R-b																																																																																																					R-b
329/389																													A-b
330/389
331/389																																																																																							R-b
332/389																																																																																																																																						A-b
333/389
334/389
335/389																																																																																																																																							R-b
336/389
337/389																																																																																																																																								A-b
338/389																																																																																																																																								A-b
339/389																																																																																																																																								A-b
340/389
341/389
342/389
343/389																																																																																																																																										A-b
344/389
345/389
346/389
347/389
348/389
349/389																																																																																																	A-b
350/389																																															R-b
351/389																																																																													R-b
352/389																																															R-b
353/389
354/389
355/389
356/389
357/389
358/389
359/389
360/389
361/389																																																																																																																																																						Reported-and-tested-by
362/389
363/389
364/389							R-b
365/389
366/389
367/389
368/389																																																																																															R-b
369/389																																																																																																																																																					R-b
370/389
371/389							R-b
372/389
373/389																																																																																																																																														R-b	A-b
374/389							R-b
375/389																																																																																																																																																R-b
376/389
377/389																														R-b
378/389
379/389							R-b
380/389							R-b
381/389																																												R-b																																																																																																					R-b
382/389																																																																																																																																																		R-b
383/389																													A-b
384/389																													A-b
385/389																													A-b
386/389
387/389																																																																																																																																						A-b													R-b	A-b
388/389
389/389

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 157 reviewers.

Read the v1 thread

Cover letter [PATCH 5.10 000/389] 5.10.265-rc1 review

This is the start of the stable review cycle for the 5.10.265 release. There are 389 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.265-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.10.265-rc1

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors

Javier Carrasco <[email protected]>
hwmon: (adt7470) Add missing dependency on REGMAP_I2C

Jonas Gorski <[email protected]>
prestera: fix fallback to previous version on same major version

Bryam Vargas <[email protected]>

    thunderbolt: Bound the DROM dual link port number before indexing sw->ports

Qing Ming <[email protected]>
sctp: clear new_transport when removing a peer

Yuxiang Yang <[email protected]>
sctp: fix use-after-free of cached ASCONF chunk

Baul Lee <[email protected]>

    sctp: keep chunk->transport in step with the list it is queued on

Xu Rao <[email protected]>
scsi: scsi_debug: Negate wrapped memcmp() result

Chengfeng Ye <[email protected]>
bpf, sockmap: Fix sk_redir use-after-free in send verdict

Zhiling Zou <[email protected]>

    ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

Yuejie Shi <[email protected]>
ipv6: fix Route Information option length validation

Tengda Wu <[email protected]>
ring-buffer: Use current_context for safe per-CPU buffer swap

Jun Yang <[email protected]>

    tipc: read le->link under the node lock in tipc_node_link_down()

Jun Yang <[email protected]>
vhost: reset the vring metadata cache on vring reconfiguration

Weiming Shi <[email protected]>
vsock/virtio: avoid refilling the RX queue after teardown

Baul Lee <[email protected]>
vxlan: do not arm the ageing timer on a device that is down

Yangyu Chen <[email protected]>
net: atlantic: free RX pages of consumed but not refilled buffers

Zhiling Zou <[email protected]>
netfilter: bridge: release template ct on non-IP path

Kyle Zeng <[email protected]>
ipv6: prevent in6_dev_get() from resurrecting inet6_dev

Rik van Riel <[email protected]>
fbdev: bitblit: bound-check glyph index in bit_cursor()

Eddie Lin <[email protected]>
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free

Anandu Krishnan E <[email protected]>
misc: fastrpc: fix channel ctx ref leak when session alloc fails

Mariano Baragiola <[email protected]>
staging: rtl8723bs: validate monitor transmit frame lengths

Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

Cunhao Lu <[email protected]>
serial: 8250_dma: Clear stale RX state on shutdown

Chengfeng Ye <[email protected]>
ipv4: fix use-after-free in fib_nhc_update_mtu()

Eric Biggers <[email protected]>
fscrypt: Replace mk_users keyring with simple list

Aaron Tomlin <[email protected]>
mips: sched: Fix CPUMASK_OFFSTACK memory corruption

Zhu Yanjun <[email protected]>
RDMA/rxe: Fix a use-after-free problem in rxe_mmap

Keno Fischer <[email protected]>
futex: Prevent robust futex exit race some more

Lincoln Wallace <[email protected]>
ima: fix out-of-bounds read in xattr_verify()

Luiz Augusto von Dentz <[email protected]>

    Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev

Marco Elver <[email protected]>
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

Dmitry Torokhov <[email protected]>
Input: evdev - fix information leak in evdev_pass_values()

Joshua Rogers <[email protected]>
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get

Joshua Rogers <[email protected]>
vt: add permission check for KDSKBMETA ioctl

Chengfeng Ye <[email protected]>
netfilter: ebt_nflog: pin the NFLOG backend

Qihang Tang <[email protected]>
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

Zhiling Zou <[email protected]>
net: openvswitch: reallocate update replies for mismatched IDs

Doruk Tan Ozturk <[email protected]>
net/packet: reset the MAC header on the packet-socket transmit path

Kyle Zeng <[email protected]>
ipvs: clear IPv4 options after rebasing tunnel ICMP errors

Julian Anastasov <[email protected]>
ipvs: properly update the overload flag on dest edit

Julian Anastasov <[email protected]>
ipvs: add totalconns for dest

Sonali Pradhan <[email protected]>
usb: gadget: f_ncm: Use unsigned int for ndp_index

Aleksandr Nogikh <[email protected]>
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()

Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write on Type II inbound URBs

Dmitry Torokhov <[email protected]>
Input: evdev - sanitize event type index when fetching event masks

Takashi Iwai <[email protected]>
ALSA: usb-audio: Evaluate packsize caps at the right place

Larisa Grigore <[email protected]>
spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers

Maximilian Immanuel Brandtner <[email protected]>
tls: don't abort the connection on signal-interrupted sends

Xin Long <[email protected]>
sctp: extract sctp_v4_err_handle function from sctp_v4_err

Xin Long <[email protected]>
sctp: extract sctp_v6_err_handle function from sctp_v6_err

Xin Long <[email protected]>
sctp: remove the unessessary hold for idev in sctp_v6_err

Xin Long <[email protected]>
sctp: clear control chunk transport if it is being removed

Hongyan Xu <[email protected]>
ata: pata_sl82c105: fix bridge revision use-after-free

Łukasz Patron <[email protected]>
net: qrtr: ns: Raise lookup limit to 128

Eric Dumazet <[email protected]>
net: remove WARN_ON_ONCE() from sk_mc_loop()

Pengpeng Hou <[email protected]>
net: prestera: validate firmware header length

Vadym Kochan <[email protected]>
net: marvell: prestera: try to load previous fw version

Henry Martin <[email protected]>
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

Qing Luo <[email protected]>
sctp: fix addip_serial increment on ASCONF_ACK allocation failure

Michael Chan <[email protected]>
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption

Michael Chan <[email protected]>
bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips

Cen Zhang (Microsoft) <[email protected]>
net/openvswitch: check Ethernet header length in key_extract()

Randy Dunlap <[email protected]>
net: openvswitch: fix kernel-doc warnings in flow.c

Andrew Lunn <[email protected]>
net: openvswitch: Fix kerneldoc warnings

Toke Høiland-Jørgensen <[email protected]>
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter

Xuanqiang Luo <[email protected]>
udp: fix potential use-after-free in tunnel segmentation

Babanpreet Singh <[email protected]>
counter: microchip-tcb-capture: Fix DT channel validation

Michael Guralnik <[email protected]>
net/mlx5: fw_tracer, return NULL on create error

Leon Romanovsky <[email protected]>
net/mlx5: Remove second FW tracer check

Jiawen Liu <[email protected]>
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete

Jamal Hadi Salim <[email protected]>
net/sched: cls_route: fix fastmap use-after-free on filter

Mahanta Jambigi <[email protected]>
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()

Yiyang Chen <[email protected]>
bpf: Preserve pointer state for commuted arithmetic

Xiang Mei (Microsoft) <[email protected]>
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor

Yuho Choi <[email protected]>
ARM: npcm: Fix OF node refcount leaks in SMP setup

Anna Schumaker <[email protected]>
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Scott Mayhew <[email protected]>
nfs4: take a reference on the nfs_client when running FREE_STATEID

Harald Freudenberger <[email protected]>
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()

Al Viro <[email protected]>
mount: honour SB_NOUSER in the new mount API

Junjie Cao <[email protected]>
gpio: pch: use raw_spinlock_t for the register lock

Tze Yee Ng <[email protected]>
firmware: stratix10-svc: fix memory leaks and list corruption bugs

Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during recirculation

Hyunwoo Kim <[email protected]>
Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

Luiz Augusto von Dentz <[email protected]>
Bluetooth: SCO: Fix UAF on sco_sock_timeout

Kiryl Shutsemau (Meta) <[email protected]>
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

HyeongJun An <[email protected]>
HID: logitech-dj: Fix maxfield check in DJ short report validation

Zack Rusin <[email protected]>
drm/vmwgfx: bound DMA command body size against suffix pointer

Zack Rusin <[email protected]>
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

Harkirat Gill <[email protected]>
drm/amdgpu: cap GTT size to physical RAM on APUs

Maíra Canal <[email protected]>
drm/vc4: Zero the tile state data array before each BIN job

Pengpeng Hou <[email protected]>
can: peak_usb: validate uCAN receive record lengths

Maoyi Xie <[email protected]>
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

James Gao <[email protected]>
can: peak_usb: add bounds check for USB channel index

Pengpeng Hou <[email protected]>
can: softing: fw_parse(): validate firmware record spans

Pengpeng Hou <[email protected]>
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

Abdun Nihaal <[email protected]>
can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()

Oleksij Rempel <[email protected]>
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer

H. Nikolaus Schaller <[email protected]>
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock

Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during ct

Ilya Maximets <[email protected]>
net: openvswitch: fix potential UAF on meter attach failure

Nava kishore Manne <[email protected]>
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB

Nava kishore Manne <[email protected]>
phy: zynqmp: use read-modify-write for SERDES scrambler bypass

Nava kishore Manne <[email protected]>
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask

Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA ECC private key requests

Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA AES cipher key requests

Jan Höppner <[email protected]>
s390/dasd: Fix potential NULL pointer dereference

Abdun Nihaal <[email protected]>
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()

Myeonghun Pak <[email protected]>
i2c: amd-mp2: Unregister callback on adapter add failure

Asim Viladi Oglu Manizada <[email protected]>
sctp: prevent peer transport count overflow

Yuxiang Yang <[email protected]>
sctp: reject stale cookies with mismatched verification tags

Chris Gellermann <[email protected]>
selftests/clone3: fix wild pointer access of getline due to missing init

Masami Hiramatsu (Google) <[email protected]>
tracing/filters: Fix false positive match in regex_match_full()

Masami Hiramatsu (Google) <[email protected]>
tracing: Check return value of __register_event() in trace_module_add_events()

Eric Dumazet <[email protected]>
vxlan: use pskb_network_may_pull() in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: use neigh_ha_snapshot() in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: unclone skb head before modifying eth header in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: re-fetch eth header after route_shortcircuit()

Michael Bommarito <[email protected]>
um: vector: fix use-after-free in vector_mmsg_rx()

Thorsten Blum <[email protected]>
powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()

Zhiling Zou <[email protected]>
net: ipv6: clear suppressed fib6 rule result

Zhiling Zou <[email protected]>
net: bridge: stop fast-leave after deleting a port group

Link Lin <[email protected]>
mm/page_reporting: use system_freezable_wq to fix UAF during suspend

Christian Brauner <[email protected]>
binfmt_misc: reject a flag character as the field delimiter

Zhao Li <[email protected]>
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

Zihan Xi <[email protected]>
tipc: avoid use-after-free in poll trace queue dumps

David Lee <[email protected]>
netfilter: ipset: do not update comments from kernel-side hash adds

Xuanqiang Luo <[email protected]>
net/smc: fix socket use-after-free during link group termination

Zhiling Zou <[email protected]>
ipvs: do not propagate one-packet flag to synced conns

Matt Vollrath <[email protected]>
igbvf: Fix leak in TX DMA error cleanup

Dawei Feng <[email protected]>

    e1000: fix memory leak in e1000_probe()

Md Sadre Alam <[email protected]>
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+

Sonali Pradhan <[email protected]>
ALSA: usb-audio: Clamp frame size in implicit-feedback mode

Sonali Pradhan <[email protected]>
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set

Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()

Haidar Lee <[email protected]>
ASoC: tas2562: fix broken entries in the volume lookup table

Haidar Lee <[email protected]>
ASoC: tas2562: fix DVC coefficient write order

Norbert Szetei <[email protected]>
ALSA: pcm: wake linked drain waiters on unlink

Xu Rao <[email protected]>
ALSA: lx6464es: fix period byte count for 16-bit streams

Takashi Iwai <[email protected]>
ALSA: 6fire: Fix UAF at error handling during probe

Xuanqiang Luo <[email protected]>
bpf: lwt: Fix dst reference leak on reroute failure

Sangho Lee <[email protected]>
Bluetooth: HIDP: validate numbered report payloads

Luxiao Xu <[email protected]>
audit: fix potential use-after-free in audit_del_rule()

Zhan Xusheng <[email protected]>
audit: fix potential integer overflow in audit_log_n_string()

Charles Vosburgh <[email protected]>
sctp: validate Adaptation Indication parameter length

Xiangfeng Cai <[email protected]>
mm/hugetlb: fix list corruption in allocate_file_region_entries()

Zi Yan <[email protected]>
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()

Benjamin Boortz <[email protected]>
pinctrl: bm1880: add missing select GENERIC_PINCONF

Karl Mehltretter <[email protected]>
pinctrl: devicetree: don't free uninitialized dev_name on error path

Cen Zhang (Microsoft) <[email protected]>

    rhashtable: clear stale iter->p on table restart

Pengfei Zhang <[email protected]>
ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump

Denis V. Lunev <[email protected]>
qede: sync udp_tunnel ports outside qede_lock in the recovery path

Suman Ghosh <[email protected]>
octeontx2-pf: Set correct sequence for carrier off and tx queue stop

Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()

Minhong He <[email protected]>
can: isotp: check register_netdevice_notifier() error in module init

Chenguang Zhao <[email protected]>
net: sxgbe: check descriptor ring allocation failures

Chenguang Zhao <[email protected]>
net: sxgbe: free TX rings on RX allocation failure

Benjamin Block <[email protected]>
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req

Christian Marangi <[email protected]>
net: phylink: put link_gpio if phylink_create fails

Jiale Yao <[email protected]>
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

Guenter Roeck <[email protected]>
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()

Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-akebono CPU node lookup check

Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-currituck CPU node lookup check

Thorsten Blum <[email protected]>
powerpc/boot: Fix simpleboot CPU node lookup check

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix PWM auto temp state array and bounds check

Chris Packham <[email protected]>
hwmon: (adt7470) Convert to use regmap

Chris Packham <[email protected]>
hwmon: (adt7470) Fix some style issues

Chris Packham <[email protected]>
hwmon: (adt7470) Create functions for updating readings and limits

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

Chenguang Zhao <[email protected]>
forcedeth: fix UAF of txrx_stats in nv_remove

Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Prevent access to unsupported weight registers

Dawei Feng <[email protected]>
smb: client: fix buffer leaks in SMB1 read and write

HyeongJun An <[email protected]>
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

HyeongJun An <[email protected]>
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

Xiang Mei <[email protected]>
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()

Ilia Gavrilov <[email protected]>
rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled

Xiang Mei (Microsoft) <[email protected]>
netfilter: nft_payload: fix mask build for partial field offload

Pablo Neira Ayuso <[email protected]>
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

Michael Bommarito <[email protected]>
assoc_array: trim the final shortcut word using the current chunk end

Michael Bommarito <[email protected]>
keys: make keyring key-chunk byte order agree with keyring_diff_objects()

Michael Bommarito <[email protected]>
keys: fix out-of-bounds read in keyring_get_key_chunk()

Xiang Mei <[email protected]>
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

Uday Khare <[email protected]>
ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup

Uday Khare <[email protected]>
ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup

Hongling Zeng <[email protected]>
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA

Sabrina Dubroca <[email protected]>
tls: separate no-async decryption request handling from async

Youssef Samir <[email protected]>
net: qrtr: ns: Raise node count limit to 512

Manivannan Sadhasivam <[email protected]>
net: qrtr: ns: Limit the maximum server registration per node

Benjamin Tissoires <[email protected]>
HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report

Lee Jones <[email protected]>
HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write

Lee Jones <[email protected]>
HID: logitech-dj: Standardise hid_report_enum variable nomenclature

Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix sequence number when no EOF

Isaac Scott <[email protected]>
media: uvcvideo: Implement dual stream quirk to fix loss of usb packets

Yehyeong Lee <[email protected]>
net: mpls: initialize rtm_tos in mpls_getroute()

Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: fix global vlan option range dumping

Eric Dumazet <[email protected]>

    raw: fix a typo in raw_icmp_error()

Eric Dumazet <[email protected]>

    raw: remove unused variables from raw6_icmp_error()

Kyle Zeng <[email protected]>
openvswitch: fix GSO userspace truncation underflow

Devin Wittmayer <[email protected]>
wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses

Weiming Shi <[email protected]>
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

Ce Sun <[email protected]>
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd

Boyuan Zhang <[email protected]>
drm/amdgpu: fix division by zero with invalid uvd dimensions

Alex Deucher <[email protected]>
drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx8: drop unecessary BUG_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()

Daehyeon Ko <[email protected]>

    tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

Asim Viladi Oglu Manizada <[email protected]>
pppoe: reload header pointer after dev_hard_header()

Doruk Tan Ozturk <[email protected]>
mac802154: llsec: reject frames shorter than the authentication tag

Michael Bommarito <[email protected]>
ila: reload IPv6 header after pskb_may_pull in checksum adjust

Raphael Zimmer <[email protected]>
rbd: Reset positive result codes to zero in object map update path

Jann Horn <[email protected]>
proc: Fix broken error paths for namespace links

Fan Wu <[email protected]>
net: hip04: fix RX buffer leak on build_skb failure

David Lee <[email protected]>

    net/x25: fix use-after-free in x25_kill_by_neigh()

Bryam Vargas <[email protected]>
net/iucv: fix use-after-free of a severed iucv_path

Hidayath Khan <[email protected]>
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

Doruk Tan Ozturk <[email protected]>
geneve: require CAP_NET_ADMIN in the device netns for changelink

Sungmin Kang <[email protected]>
net: slip: serialize receive against buffer reallocation

Doruk Tan Ozturk <[email protected]>
vxlan: require CAP_NET_ADMIN in the device netns for changelink

Breno Leitao <[email protected]>
phonet: pep: fix use-after-free in pep_get_sb()

Lu Baolu <[email protected]>
iommu/vt-d: Disallow SVA if page walk is not coherent

Christian Brauner <[email protected]>
binfmt_elf_fdpic: only honour the first PT_INTERP

Douya Le <[email protected]>
libceph: remove debugfs files before client teardown

Douya Le <[email protected]>
libceph: reject zero bucket types in crush_decode

Shuangpeng Bai <[email protected]>

    libceph: refresh auth->authorizer_buf{,_len} after authorizer update

Zhao Zhang <[email protected]>
libceph: guard missing CRUSH type name lookup

Raphael Zimmer <[email protected]>
libceph: Fix multiplication overflow in decode_new_up_state_weight()

Douya Le <[email protected]>
libceph: bound get_version reply decode to front len

Bryam Vargas <[email protected]>
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()

Jun Yang <[email protected]>
sctp: don't free the ASCONF's own transport in DEL-IP processing

Will Deacon <[email protected]>
Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"

Will Deacon <[email protected]>
arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix potential underflow in LEN_OR_ZERO macro

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()

deepakraog <[email protected]>
tracing: Fix resource leak on mmiotrace trace_pipe close

Steven Rostedt <[email protected]>

    tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev

Guangshuo Li <[email protected]>
intel_th: fix MSC output device reference leak

Ian Abbott <[email protected]>
comedi: comedi_parport: deal with premature interrupt

Xu Rao <[email protected]>
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

Christian Brauner <[email protected]>
binfmt_misc: set have_execfd only once the interpreter is opened

Christian Brauner <[email protected]>
exec: fix unsigned loop counter wrap in transfer_args_to_stack()

Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: Fix session UAF in set_termios

Fan Wu <[email protected]>
wifi: brcmfmac: make release_scratchbuffers idempotent

Huihui Huang <[email protected]>
wifi: wilc1000: validate assoc response length before subtracting header

Doruk Tan Ozturk <[email protected]>
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB access from firmware ADDBA window size

Hans Verkuil <[email protected]>
media: vivid: check for vb2_is_busy() when toggling caps

Guangshuo Li <[email protected]>
media: vimc: fix reference leak on failed device registration

Guangshuo Li <[email protected]>
media: vidtv: fix reference leak on failed device registration

Zile Xiong <[email protected]>
media: vb2: use ssize_t for vb2_read/vb2_write

Hungyu Lin <[email protected]>
media: tegra-video: vi: fix invalid u32 return value in format lookup

Valery Borovsky <[email protected]>
media: sun4i-csi: Return queued buffers on start_streaming() failure

Ma Ke <[email protected]>
media: saa7134: Fix a possible memory leak in saa7134_video_init1

Valery Borovsky <[email protected]>
media: rtl2832_sdr: Return queued buffers on start_streaming() failure

Deepanshu Kartikey <[email protected]>

    media: rtl2832: fix use-after-free in rtl2832_remove()

Myeonghun Pak <[email protected]>
media: radio-si476x: Unregister v4l2_device on probe failure

Valery Borovsky <[email protected]>
media: pwc: Return queued buffers on start_streaming() failure

Valery Borovsky <[email protected]>
media: pwc: Drain fill_buf on start_streaming() failure

Krzysztof Kozlowski <[email protected]>
media: pci: dm1105: Free allocated workqueue

Valery Borovsky <[email protected]>
media: msi2500: Return queued buffers on start_streaming() failure

Anand Moon <[email protected]>
media: meson: vdec: Fix memory leak in error path of vdec_open

Wang Jun <[email protected]>
media: cx23885: add ioremap return check and cleanup

Johan Hovold <[email protected]>
media: cx231xx: fix devres lifetime

Pengpeng Hou <[email protected]>
media: cedrus: skip invalid H.264 reference list entries

Samuel Holland <[email protected]>
media: cedrus: Fix missing cleanup in error path

Myeonghun Pak <[email protected]>
media: cedrus: clean up media device on probe failure

Myeonghun Pak <[email protected]>
media: cec: seco: unregister adapter on IR probe failure

Valery Borovsky <[email protected]>
media: airspy: Return queued buffers on start_streaming() failure

Ian Forbes <[email protected]>
drm/vmwgfx: Validate vmw_surface_metadata::array_size

Zhu Lingshan <[email protected]>

    drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved

Timur Kristóf <[email protected]>

    drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)

Mario Limonciello <[email protected]>
drm/amdgpu: Fix VFCT bus number matching with soft filter

Oliver Hartkopp <[email protected]>
can: bcm: track a single source interface for ANYDEV timeout/throttle ops

Oliver Hartkopp <[email protected]>
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

Oliver Hartkopp <[email protected]>
can: bcm: fix stale rx/tx ops after device removal

Oliver Hartkopp <[email protected]>
can: bcm: add missing device refcount for CAN filter removal

Oliver Hartkopp <[email protected]>
can: bcm: validate frame length in bcm_rx_setup() for RTR replies

Oliver Hartkopp <[email protected]>
can: bcm: extend bcm_tx_lock usage for data and timer updates

Oliver Hartkopp <[email protected]>
can: bcm: fix CAN frame rx/tx statistics

Oliver Hartkopp <[email protected]>
can: bcm: add locking when updating filter and timer values

Lee Jones <[email protected]>
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

Chengfeng Ye <[email protected]>
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

Li RongQing <[email protected]>
net: ipv6: fix dif and sdif mismatch in raw6_icmp_error

Alex Deucher <[email protected]>
drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()

Pavel Ondračka <[email protected]>
drm/radeon: fix r100_copy_blit for large BOs

Wentao Liang <[email protected]>
drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()

Sergey Shtylyov <[email protected]>
drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()

Eric Dumazet <[email protected]>

    raw: use more conventional iterators

Alexei Lazar <[email protected]>
net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation

Alexei Lazar <[email protected]>
net/mlx5e: Report zero bandwidth for non-ETS traffic classes

Yael Chemla <[email protected]>
net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule

Aldo Ariel Panzardo <[email protected]>
net: qrtr: restrict socket creation to the initial network namespace

Chenguang Zhao <[email protected]>
hinic: remove unused ethtool RSS user configuration buffers

Eric Dumazet <[email protected]>
ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup

Nazim Amirul <[email protected]>
net: stmmac: reset residual action in L3L4 filters on delete

Cen Zhang (Microsoft) <[email protected]>
tipc: fix u16 MTU truncation in media and bearer MTU validation

Harshaka Narayana <[email protected]>
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

Qing Luo <[email protected]>
sctp: auth: verify auth requirement when auth_chunk is NULL

Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: fix vlan range dumps starting with pvid

Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: add support for dumping global vlan options

Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: add support for global options

Shelley Yang <[email protected]>
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning

Helen Koike <[email protected]>
tipc: fix infinite loop in __tipc_nl_compat_dumpit

Cen Zhang (Microsoft) <[email protected]>
sctp: validate stream count in sctp_process_strreset_inreq()

HanQuan <[email protected]>
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

Prashanth Kumar KR <[email protected]>
amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN

Andrew Pope <[email protected]>
wifi: mac80211: recalculate TIM when a station enters power save

Pengpeng Hou <[email protected]>
iommu/amd: Bound the early ACPI HID map

HE WEI (ギカク) <[email protected]>
wifi: mwifiex: bound uAP association event IEs to the event buffer

Ruoyu Wang <[email protected]>
wan: wanxl: Only reset hardware after BAR mapping

Ruoyu Wang <[email protected]>
nfp: Check resource mutex allocation

Aldo Ariel Panzardo <[email protected]>
rds: drop incoming messages that cross network namespace boundaries

David Lee <[email protected]>
net/packet: avoid fanout hook re-registration after unregister

Diego Fernando Mancera Gomez <[email protected]>
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect

Shengjiu Wang <[email protected]>
ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI

Jiaxin Yu <[email protected]>
ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint

Tristan Madani <[email protected]>
wifi: carl9170: fix buffer overflow in rx_stream failover path

Tristan Madani <[email protected]>
wifi: carl9170: fix OOB read from off-by-two in TX status handler

Tristan Madani <[email protected]>
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler

Ruoyu Wang <[email protected]>
firewire: net: Fix fragmented datagram reassembly

Dmitry Morgun <[email protected]>
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()

Tzung-Bi Shih <[email protected]>
watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()

Guenter Roeck <[email protected]>
hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop

Cheng Yongkang <[email protected]>
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

Xincheng Zhang <[email protected]>
usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits

Daniel Borkmann <[email protected]>
bpf: Fix ld_{abs,ind} failure path analysis in subprogs

Doruk Tan Ozturk <[email protected]>
crypto: rsa-pkcs1pad: Don't WARN on an empty digest

Chukun Pan <[email protected]>
USB: serial: option: add TDTECH MT5710-CN

Sunho Park <[email protected]>
USB: serial: io_edgeport: cap received transmit credits

Tim Pambor <[email protected]>
USB: serial: ftdi_sio: add support for E+H FXA291

Muhammad Bilal <[email protected]>
usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer

Sonali Pradhan <[email protected]>
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()

Johan Hovold <[email protected]>
USB: gadget: fsl-udc: fix device name leak on probe failure

Johan Hovold <[email protected]>
USB: gadget: snps-udc: fix device name leak on probe failure

Melbin K Mathew <[email protected]>
usb: gadget: printer: fix infinite loop in printer_read()

Fan Wu <[email protected]>
usb: gadget: f_midi: cancel pending IN work before freeing the midi object

Jinchao Wang <[email protected]>
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback

Xu Yang <[email protected]>
usb: chipidea: fix usage_count leak when autosuspend_delay is negative

Huang Wei <[email protected]>
USB: storage: add NO_ATA_1X quirk for Longmai USB Key

Huihui Huang <[email protected]>

    wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()

Weiming Shi <[email protected]>
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

Xin Long <[email protected]>
sctp: fix auth_hmacs array size in struct sctp_cookie

Jamal Hadi Salim <[email protected]>
net/sched: act_tunnel_key: Defer dst_release to RCU callback

Emre Cecanpunar <[email protected]>
drm/i915/selftests: Fix GT PM sort comparators

Shuhao Fu <[email protected]>
can: j1939: fix lockless local-destination check

Pengpeng Hou <[email protected]>
drm/i915/gt: use correct selftest config symbol

Huiwen He <[email protected]>
smb/client: handle overlapping allocated ranges in fallocate

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning

Colin Ian King <[email protected]>
ata: sata_dwc_460ex: remove variable num_processed

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered

Bryam Vargas <[email protected]>
net/iucv: take a reference on the socket found in afiucv_hs_rcv()

Weiming Shi <[email protected]>
ipv4: fib: free fib_alias with kfree_rcu() on insert error path

Pushpendra Singh <[email protected]>
firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context

Uday Khare <[email protected]>
ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup

Christian Hewitt <[email protected]>
ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop

HE WEI (ギカク) <[email protected]>
wifi: cfg80211: bound element ID read when checking non-inheritance

Runyu Xiao <[email protected]>
wifi: brcmfmac: initialize SDIO data work before cleanup

Cen Zhang <[email protected]>
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock

Zhao Li <[email protected]>
wifi: cfg80211: reject unsupported PMSR FTM location requests

Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR FTM preamble range

Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR measurement type data

Xiang Mei <[email protected]>
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

Dawei Feng <[email protected]>
wifi: libertas: fix memory leak in helper_firmware_cb()

Bryam Vargas <[email protected]>
wifi: mac80211_hwsim: clamp virtio RX length before skb_put

Ramon Fontes <[email protected]>
mac80211_hwsim: add 6GHz channels

Abdun Nihaal <[email protected]>
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()

Xiang Mei (Microsoft) <[email protected]>
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

Danila Chernetsov <[email protected]>
RDMA/hns: Fix potential integer overflow in mhop hem cleanup

Xiang Mei <[email protected]>
btrfs: reject free space cache with more entries than pages

Nikolay Borisov <[email protected]>
btrfs: remove crc_check logic from free space

Pengpeng Hou <[email protected]>
mtd: nand: mtk-ecc: stop on ECC idle timeouts

Pengpeng Hou <[email protected]>
mtd: mtdswap: remove debugfs stats file on teardown

Michael Bommarito <[email protected]>
IB/mad: Drop unmatched RMPP responses before reassembly

Sean Christopherson <[email protected]>
KVM: VMX: Make vmread_error_trampoline() uncallable from C code

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix logic error in packet reset

Seungjin Bae <[email protected]>
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()

Oliver Hartkopp <[email protected]>

    can: isotp: serialize TX state transitions under so->rx_lock

Oliver Hartkopp <[email protected]>
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER

Phil Rosenthal <[email protected]>
KVM: x86/mmu: Fix use-after-free on vendor module reload

Hyunwoo Kim <[email protected]>
KVM: nVMX: Hide shadow VMCS right after VMCLEAR

Daehyeon Ko <[email protected]>
macsec: don't read an unset MAC header in macsec_encrypt()

Bradley Morgan <[email protected]>
cpu: hotplug: Bound hotplug states sysfs output

Sagi Grimberg <[email protected]>
nvmet-tcp: Fix potential UAF when ddgst mismatch

-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arm/mach-npcm/platsmp.c                       |   2 +
 arch/mips/kernel/mips-mt-fpaff.c                   |  28 +-
 arch/powerpc/boot/simpleboot.c                     |   2 +-
 arch/powerpc/boot/treeboot-akebono.c               |   2 +-
 arch/powerpc/boot/treeboot-currituck.c             |   2 +-
 arch/powerpc/platforms/ps3/mm.c                    |   1 +
 arch/um/drivers/vector_kern.c                      |   3 +
 arch/x86/kvm/mmu/mmu.c                             |   2 +
 arch/x86/kvm/vmx/nested.c                          |  11 +-
 arch/x86/kvm/vmx/vmx_ops.h                         |  16 +-
 crypto/rsa-pkcs1pad.c                              |   2 +-
 drivers/ata/pata_sl82c105.c                        |   4 +-
 drivers/ata/sata_dwc_460ex.c                       |  21 +-
 drivers/block/rbd.c                                |   7 +-
 drivers/cdrom/cdrom.c                              |   1 +
 drivers/counter/microchip-tcb-capture.c            |   4 +-
 drivers/cpufreq/powernow-k8.c                      |   1 +
 drivers/dma/sun6i-dma.c                            |  11 +-
 drivers/firewire/net.c                             |  37 +-
 drivers/firmware/arm_scmi/notify.c                 |   6 +-
 drivers/firmware/stratix10-svc.c                   |   9 +-
 drivers/gpio/gpio-pch.c                            |  28 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c            |   2 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c           |  45 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |  13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  12 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c            |   8 +
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c             |  13 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c              |   3 -
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |  10 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c             |   4 +-
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c     |   7 +-
 drivers/gpu/drm/i915/gt/intel_engine_user.c        |   2 +-
 drivers/gpu/drm/i915/gt/selftest_gt_pm.c           |   8 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c     |   1 +
 drivers/gpu/drm/radeon/r100.c                      |  13 +-
 drivers/gpu/drm/rockchip/cdn-dp-reg.c              |   2 +
 drivers/gpu/drm/vc4/vc4_validate.c                 |  29 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c            |  14 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c            |  22 +-
 drivers/hid/hid-logitech-dj.c                      |  28 +-
 drivers/hwmon/Kconfig                              |   1 +
 drivers/hwmon/adt7470.c                            | 605 +++++++++++++--------
 drivers/hwmon/corsair-cpro.c                       |   1 +
 drivers/hwmon/nct6775.c                            |  12 +-
 drivers/hwmon/pmbus/pmbus_core.c                   |   2 +-
 drivers/hwtracing/intel_th/core.c                  |  10 -
 drivers/hwtracing/intel_th/msu.c                   |   2 +
 drivers/i2c/busses/i2c-amd-mp2-plat.c              |   4 +-
 drivers/i2c/busses/i2c-jz4780.c                    |   5 +-
 drivers/infiniband/core/mad.c                      |  30 +
 drivers/infiniband/hw/hns/hns_roce_hem.c           |   2 +-
 drivers/infiniband/sw/rxe/rxe_mmap.c               |  19 +-
 drivers/input/evdev.c                              |  27 +-
 drivers/input/misc/ims-pcu.c                       |  32 +-
 drivers/iommu/amd/init.c                           |   6 +
 drivers/iommu/intel/svm.c                          |   2 +-
 drivers/media/cec/platform/seco/seco-cec.c         |   6 +-
 drivers/media/common/videobuf2/videobuf2-core.c    |  12 +-
 drivers/media/dvb-frontends/rtl2832.c              |   4 +-
 drivers/media/dvb-frontends/rtl2832_sdr.c          |  19 +-
 drivers/media/pci/cx23885/cx23885-core.c           |  14 +-
 drivers/media/pci/dm1105/dm1105.c                  |   1 +
 drivers/media/pci/saa7134/saa7134-video.c          |  25 +-
 drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c |   6 +-
 drivers/media/radio/radio-si476x.c                 |   1 +
 drivers/media/test-drivers/vidtv/vidtv_bridge.c    |   4 +-
 drivers/media/test-drivers/vimc/vimc-core.c        |   1 +
 drivers/media/test-drivers/vivid/vivid-ctrls.c     |  12 +
 drivers/media/test-drivers/vivid/vivid-vid-cap.c   |   6 +
 drivers/media/test-drivers/vivid/vivid-vid-out.c   |   6 +
 drivers/media/usb/airspy/airspy.c                  |   8 +-
 drivers/media/usb/cx231xx/cx231xx-cards.c          |  16 +-
 drivers/media/usb/msi2500/msi2500.c                |  32 +-
 drivers/media/usb/pwc/pwc-if.c                     |  13 +-
 drivers/media/usb/uvc/uvc_video.c                  |  78 ++-
 drivers/media/usb/uvc/uvcvideo.h                   |   4 +
 drivers/misc/fastrpc.c                             |   3 +-
 drivers/mtd/mtdswap.c                              |   5 +-
 drivers/mtd/nand/raw/mtk_ecc.c                     |  16 +-
 drivers/net/bonding/bond_alb.c                     |  10 +-
 drivers/net/can/softing/softing_fw.c               |  46 +-
 drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c  |   1 +
 drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c   |  13 +-
 drivers/net/can/usb/peak_usb/pcan_usb_core.c       |   1 -
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c         |  40 +-
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c        |  20 +-
 drivers/net/ethernet/amd/xgbe/xgbe-mdio.c          |  11 +-
 drivers/net/ethernet/aquantia/atlantic/aq_ring.c   |  22 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |  12 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.h          |   1 +
 drivers/net/ethernet/hisilicon/hip04_eth.c         |  11 +-
 drivers/net/ethernet/hisilicon/hix5hd2_gmac.c      |   1 -
 drivers/net/ethernet/huawei/hinic/hinic_dev.h      |   2 -
 drivers/net/ethernet/huawei/hinic/hinic_ethtool.c  |  21 -
 drivers/net/ethernet/intel/e1000/e1000_main.c      |   2 +-
 drivers/net/ethernet/intel/igbvf/netdev.c          |   2 -
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |   2 +-
 .../net/ethernet/marvell/prestera/prestera_pci.c   |  87 ++-
 .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c   |  18 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c |  15 +
 .../ethernet/mellanox/mlx5/core/esw/acl/helper.c   |   2 +-
 drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c |   7 +-
 .../ethernet/netronome/nfp/nfpcore/nfp_resource.c  |   3 +
 drivers/net/ethernet/nvidia/forcedeth.c            |   4 +-
 drivers/net/ethernet/qlogic/qede/qede_main.c       |  44 +-
 drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c    |  14 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c    |   1 +
 drivers/net/geneve.c                               |   3 +
 drivers/net/macsec.c                               |   2 +-
 drivers/net/phy/phylink.c                          |  29 +-
 drivers/net/ppp/pppoe.c                            |   1 +
 drivers/net/slip/slip.c                            |   4 +
 drivers/net/vmxnet3/vmxnet3_drv.c                  |  22 +-
 drivers/net/vxlan/vxlan_core.c                     |  20 +-
 drivers/net/wan/wanxl.c                            |   3 +-
 drivers/net/wireless/ath/ath11k/dp_rx.c            |   3 +
 drivers/net/wireless/ath/ath6kl/txrx.c             |  10 +-
 drivers/net/wireless/ath/ath6kl/wmi.c              |  20 +
 drivers/net/wireless/ath/ath9k/hif_usb.c           |   7 +-
 drivers/net/wireless/ath/carl9170/rx.c             |   7 +-
 drivers/net/wireless/ath/carl9170/tx.c             |   2 +-
 drivers/net/wireless/atmel/at76c50x-usb.c          |   7 +-
 .../broadcom/brcm80211/brcmfmac/cfg80211.c         |   2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |   8 +-
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |   2 +-
 drivers/net/wireless/intel/ipw2x00/ipw2100.c       |   8 +-
 drivers/net/wireless/intersil/p54/txrx.c           |   8 +
 drivers/net/wireless/mac80211_hwsim.c              |  75 ++-
 drivers/net/wireless/marvell/libertas/firmware.c   |   1 +
 .../net/wireless/marvell/mwifiex/11n_rxreorder.c   |   2 +-
 drivers/net/wireless/marvell/mwifiex/tdls.c        |   2 +-
 drivers/net/wireless/marvell/mwifiex/uap_event.c   |  24 +-
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c    |   4 +
 drivers/net/wireless/microchip/wilc1000/hif.c      |   5 +
 drivers/nvme/target/tcp.c                          |   4 +-
 drivers/phy/xilinx/phy-zynqmp.c                    |  37 +-
 drivers/pinctrl/Kconfig                            |   1 +
 drivers/pinctrl/devicetree.c                       |   4 +
 drivers/s390/block/dasd_ioctl.c                    |   2 +-
 drivers/s390/crypto/zcrypt_ccamisc.c               |  26 +-
 drivers/s390/scsi/zfcp_aux.c                       |   1 +
 drivers/scsi/libiscsi.c                            |   2 +-
 drivers/scsi/libiscsi_tcp.c                        |   8 +-
 drivers/scsi/scsi_debug.c                          |   4 +-
 drivers/spi/spi-fsl-dspi.c                         |  13 +-
 drivers/staging/comedi/drivers/comedi_parport.c    |  13 +-
 drivers/staging/media/meson/vdec/vdec.c            |   4 +-
 drivers/staging/media/sunxi/cedrus/cedrus.c        |   6 +-
 drivers/staging/media/sunxi/cedrus/cedrus_h264.c   |   3 +
 drivers/staging/media/tegra-video/vi.c             |   4 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |   3 +
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c  |   4 +
 drivers/thunderbolt/eeprom.c                       |   9 +-
 drivers/tty/serial/8250/8250_dma.c                 |  12 +-
 drivers/tty/vt/keyboard.c                          |   5 +-
 drivers/tty/vt/vt_ioctl.c                          |   2 +
 drivers/usb/atm/cxacru.c                           |   2 +
 drivers/usb/atm/ueagle-atm.c                       |  17 +
 drivers/usb/chipidea/core.c                        |   1 +
 drivers/usb/gadget/function/f_midi.c               |   1 +
 drivers/usb/gadget/function/f_ncm.c                |  19 +-
 drivers/usb/gadget/function/f_printer.c            |  23 +-
 drivers/usb/gadget/function/uvc_v4l2.c             |   2 +
 drivers/usb/gadget/udc/dummy_hcd.c                 |  40 +-
 drivers/usb/gadget/udc/fsl_udc_core.c              |   1 -
 drivers/usb/gadget/udc/snps_udc_core.c             |   1 -
 drivers/usb/host/xhci-pci.c                        |   1 +
 drivers/usb/host/xhci.c                            |  15 +-
 drivers/usb/host/xhci.h                            |   1 +
 drivers/usb/serial/ftdi_sio.c                      |   2 +
 drivers/usb/serial/ftdi_sio_ids.h                  |   5 +
 drivers/usb/serial/io_edgeport.c                   |   3 +-
 drivers/usb/serial/option.c                        |   1 +
 drivers/usb/storage/unusual_devs.h                 |   7 +
 drivers/vhost/vhost.c                              |   8 +
 drivers/video/fbdev/core/bitblit.c                 |   9 +-
 drivers/watchdog/watchdog_pretimeout.c             |   2 +
 fs/binfmt_elf_fdpic.c                              |   4 +
 fs/binfmt_misc.c                                   |   9 +-
 fs/btrfs/free-space-cache.c                        |  38 +-
 fs/btrfs/free-space-cache.h                        |   1 -
 fs/ceph/caps.c                                     |   1 +
 fs/cifs/cifssmb.c                                  |  12 +-
 fs/cifs/smb2ops.c                                  |  25 +-
 fs/crypto/fscrypt_private.h                        |  32 +-
 fs/crypto/keyring.c                                | 212 ++++----
 fs/exec.c                                          |   2 +-
 fs/namespace.c                                     |   5 +
 fs/nfs/nfs4proc.c                                  |  13 +
 fs/proc/namespaces.c                               |   4 +-
 include/linux/dma/qcom_bam_dma.h                   |  21 +-
 include/linux/netdevice.h                          |   5 -
 include/linux/netfilter/nf_conntrack_sip.h         |   2 +-
 include/media/videobuf2-core.h                     |   8 +-
 include/net/addrconf.h                             |   4 +-
 include/net/bluetooth/bluetooth.h                  |   1 +
 include/net/bluetooth/l2cap.h                      |   1 +
 include/net/bluetooth/rfcomm.h                     |   3 +
 include/net/ip_vs.h                                |  20 +-
 include/net/raw.h                                  |   5 +-
 include/net/rawv6.h                                |   6 +-
 include/net/route.h                                |   2 +
 include/net/sctp/structs.h                         |   3 +-
 include/uapi/linux/if_bridge.h                     |  14 +
 kernel/audit.c                                     |  11 +-
 kernel/auditfilter.c                               |   6 +-
 kernel/bpf/verifier.c                              |  31 +-
 kernel/cpu.c                                       |   9 +-
 kernel/futex/core.c                                |  82 ++-
 kernel/trace/ring_buffer.c                         |   8 +-
 kernel/trace/trace_events.c                        |   4 +-
 kernel/trace/trace_events_filter.c                 |   3 +
 kernel/trace/trace_mmiotrace.c                     |   5 +-
 kernel/trace/trace_probe.c                         |  13 +-
 lib/assoc_array.c                                  |   3 +-
 lib/rhashtable.c                                   |   1 +
 mm/huge_memory.c                                   |  16 +-
 mm/hugetlb.c                                       |   2 +-
 mm/page_reporting.c                                |   6 +-
 mm/percpu-km.c                                     |   2 +-
 net/bluetooth/6lowpan.c                            |  18 +-
 net/bluetooth/af_bluetooth.c                       |  22 +
 net/bluetooth/hidp/core.c                          |   5 +-
 net/bluetooth/l2cap_core.c                         |  41 +-
 net/bluetooth/rfcomm/core.c                        |  17 +
 net/bluetooth/rfcomm/tty.c                         |   7 +-
 net/bluetooth/sco.c                                |  27 +-
 net/bridge/br_multicast.c                          |   1 +
 net/bridge/br_netlink_tunnel.c                     |   3 +-
 net/bridge/br_private.h                            |  14 +-
 net/bridge/br_vlan.c                               |  64 ++-
 net/bridge/br_vlan_options.c                       | 119 +++-
 net/bridge/netfilter/ebt_nflog.c                   |  17 +-
 net/bridge/netfilter/nf_conntrack_bridge.c         |   1 +
 net/can/bcm.c                                      | 564 ++++++++++++++-----
 net/can/isotp.c                                    | 295 +++++++---
 net/can/j1939/transport.c                          |  20 +-
 net/ceph/auth_x.c                                  |   9 +-
 net/ceph/ceph_common.c                             |   4 +-
 net/ceph/mon_client.c                              |   2 +-
 net/ceph/osdmap.c                                  |  12 +-
 net/core/lwt_bpf.c                                 |   4 +-
 net/core/sock.c                                    |   1 -
 net/ipv4/fib_semantics.c                           |  34 +-
 net/ipv4/fib_trie.c                                |   2 +-
 net/ipv4/icmp.c                                    |  18 +-
 net/ipv4/raw.c                                     |  91 ++--
 net/ipv4/raw_diag.c                                |  33 +-
 net/ipv4/route.c                                   |  29 +
 net/ipv4/tcp_bpf.c                                 |   4 +-
 net/ipv4/udp_offload.c                             |   4 +-
 net/ipv6/fib6_rules.c                              |   1 +
 net/ipv6/ila/ila_common.c                          |  12 +
 net/ipv6/ip6_fib.c                                 |  17 +-
 net/ipv6/ip6_tunnel.c                              |   3 +
 net/ipv6/raw.c                                     | 102 ++--
 net/ipv6/route.c                                   |   8 +-
 net/iucv/af_iucv.c                                 |  21 +-
 net/mac80211/iface.c                               |   8 +-
 net/mac80211/rx.c                                  |   2 +
 net/mac802154/llsec.c                              |   5 +
 net/mpls/af_mpls.c                                 |   4 +
 net/ncsi/ncsi-netlink.c                            |   4 +
 net/netfilter/ipset/ip_set_hash_gen.h              |   2 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |  44 +-
 net/netfilter/ipvs/ip_vs_core.c                    |   1 +
 net/netfilter/ipvs/ip_vs_ctl.c                     |  77 ++-
 net/netfilter/ipvs/ip_vs_lc.c                      |   4 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |   2 -
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |   2 -
 net/netfilter/ipvs/ip_vs_sync.c                    |   7 +-
 net/netfilter/nf_conntrack_sip.c                   |   2 +-
 net/netfilter/nf_nat_sip.c                         |   2 +-
 net/netfilter/nft_payload.c                        |  12 +-
 net/netfilter/xt_hashlimit.c                       |  16 +-
 net/openvswitch/actions.c                          |  26 +-
 net/openvswitch/datapath.c                         |  54 +-
 net/openvswitch/datapath.h                         |   2 +-
 net/openvswitch/flow.c                             |  28 +-
 net/openvswitch/meter.c                            |  33 +-
 net/openvswitch/vport.c                            |   6 +-
 net/packet/af_packet.c                             |  13 +-
 net/phonet/pep.c                                   |   2 +
 net/qrtr/af_qrtr.c                                 |   8 +
 net/qrtr/ns.c                                      |  33 +-
 net/rds/ib.c                                       |   4 +
 net/rds/ib_cm.c                                    |   4 +
 net/rds/recv.c                                     |  15 +
 net/rds/tcp.c                                      |  14 +-
 net/sched/act_tunnel_key.c                         |  14 +-
 net/sched/cls_route.c                              |  35 +-
 net/sched/sch_cake.c                               |   1 -
 net/sctp/associola.c                               |  14 +-
 net/sctp/auth.c                                    |   2 +-
 net/sctp/input.c                                   | 108 ++--
 net/sctp/ipv6.c                                    |  94 ++--
 net/sctp/outqueue.c                                |   1 +
 net/sctp/sm_make_chunk.c                           |  26 +-
 net/sctp/sm_statefuns.c                            |   8 +-
 net/sctp/stream.c                                  |   6 +-
 net/smc/smc_core.c                                 |   2 +-
 net/smc/smc_llc.c                                  |   3 +-
 net/tipc/core.c                                    |   5 +
 net/tipc/discover.c                                |  14 +-
 net/tipc/netlink.c                                 |   6 +-
 net/tipc/netlink_compat.c                          |   4 +
 net/tipc/node.c                                    |  15 +-
 net/tipc/socket.c                                  |   3 +-
 net/tls/tls_sw.c                                   |  19 +-
 net/vmw_vsock/virtio_transport.c                   |   3 +-
 net/wireless/nl80211.c                             |   4 +-
 net/wireless/pmsr.c                                |  21 +-
 net/wireless/scan.c                                |   2 +-
 net/x25/af_x25.c                                   |   8 +-
 net/xfrm/xfrm_policy.c                             |   4 +-
 security/integrity/ima/ima_appraise.c              |   9 +-
 security/keys/keyring.c                            |  14 +-
 sound/core/pcm_native.c                            |   7 +
 sound/pci/lx6464es/lx6464es.c                      |   5 +-
 sound/pci/lx6464es/lx_core.c                       |   5 +-
 sound/soc/codecs/bt-sco.c                          |  18 +-
 sound/soc/codecs/max98090.c                        |   5 +-
 sound/soc/codecs/max98095.c                        |   5 +-
 sound/soc/codecs/tas2562.c                         |  35 +-
 sound/soc/meson/aiu-fifo-spdif.c                   |   5 +
 sound/usb/6fire/chip.c                             |   4 +
 sound/usb/endpoint.c                               |  23 +-
 sound/usb/midi.c                                   |   2 +
 sound/usb/pcm.c                                    |   7 +
 tools/testing/selftests/clone3/clone3_set_tid.c    |   2 +-
 333 files changed, 3984 insertions(+), 1839 deletions(-)

Read the cover letter in its thread