6.1.183-rc1 review

Greg Kroah-Hartman dri-devel linux-patches lkml stable 1 version Aug 17 In review

Get series with b4

b4 am [email protected]

Versions newest first

v1 Latest Aug 17609 patches 9 repliesIn review

Patches in v1 No applies recorded yet

#	Subject and files	Size	Replies
1/609	platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug`drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c`	+8 -3	0 replies
2/609	af_unix: Set gc_in_progress to true in unix_gc().`net/unix/garbage.c`	+2 -0	0 replies
3/609	perf/x86/amd/brs: Fix kernel address leakage`arch/x86/events/amd/brs.c`	+5 -5	0 replies
4/609	seqlock: Cure some more scoped_seqlock() optimization fails`include/linux/seqlock.h`	+2 -2	0 replies
5/609	seqlock: Allow KASAN to fail optimizing`include/linux/seqlock.h`	+4 -1	0 replies
6/609	seqlock: Allow UBSAN_ALIGNMENT to fail optimizing`include/linux/seqlock.h`	+4 -3	0 replies
7/609	KVM: nVMX: Hide shadow VMCS right after VMCLEAR`arch/x86/kvm/vmx/nested.c`	+9 -2	0 replies
8/609	KVM: x86/mmu: Fix use-after-free on vendor module reload`arch/x86/kvm/mmu/mmu.c`	+2 -0	0 replies
9/609	can: bcm: add locking when updating filter and timer values`net/can/bcm.c`	+133 ~~-43~~	0 replies
10/609	can: bcm: fix CAN frame rx/tx statistics`net/can/bcm.c`	+45 ~~-22~~	0 replies
11/609	can: bcm: extend bcm_tx_lock usage for data and timer updates`net/can/bcm.c`	+75 ~~-29~~	0 replies
12/609	can: bcm: validate frame length in bcm_rx_setup() for RTR replies`net/can/bcm.c`	+41 ~~-18~~	0 replies
13/609	can: bcm: add missing device refcount for CAN filter removal`net/can/bcm.c`	+24 ~~-20~~	0 replies
14/609	can: bcm: fix stale rx/tx ops after device removal`net/can/bcm.c`	+44 ~~-10~~	0 replies
15/609	can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()`net/can/bcm.c`	+8 -5	0 replies
16/609	can: bcm: track a single source interface for ANYDEV timeout/throttle ops`net/can/bcm.c`	+44 -5	0 replies
17/609	can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER`net/can/isotp.c`	+59 ~~-29~~	0 replies
18/609	can: isotp: serialize TX state transitions under so->rx_lock`net/can/isotp.c`	+154 ~~-38~~	0 replies
19/609	dmaengine: sh: rz-dmac: Move interrupt request after everything is set up`drivers/dma/sh/rz-dmac.c`	+38 ~~-58~~	0 replies
20/609	gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings`drivers/gpu/host1x/bus.c`	+2 -2	0 replies
21/609	xprtrdma: Clear receive-side ownership pointers on release`net/sunrpc/xprtrdma/rpc_rdma.c` `net/sunrpc/xprtrdma/verbs.c`	+14 -2	0 replies
22/609	Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()`drivers/input/misc/ims-pcu.c`	+26 -6	0 replies
23/609	Input: ims-pcu - fix logic error in packet reset`drivers/input/misc/ims-pcu.c`	+1 -1	0 replies
24/609	arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234`arch/arm64/boot/dts/nvidia/tegra234.dtsi`	+12 ~~-12~~	0 replies
25/609	IB/mad: Drop unmatched RMPP responses before reassembly`drivers/infiniband/core/mad.c`	+30 -0	0 replies
26/609	mtd: mtdswap: remove debugfs stats file on teardown`drivers/mtd/mtdswap.c`	+4 -1	0 replies
27/609	mtd: nand: mtk-ecc: stop on ECC idle timeouts`drivers/mtd/nand/ecc-mtk.c`	+12 -4	0 replies
28/609	btrfs: reject free space cache with more entries than pages`fs/btrfs/free-space-cache.c`	+3 -0	0 replies
29/609	btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()`fs/btrfs/relocation.c`	+1 -0	0 replies
30/609	firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()`drivers/firmware/arm_ffa/driver.c`	+1 -1	0 replies
31/609	RDMA/cma: Fix hardware address comparison length in netevent callback`drivers/infiniband/core/cma.c`	+1 -1	0 replies
32/609	RDMA/erdma: initialize ret for empty receive WR lists`drivers/infiniband/hw/erdma/erdma_qp.c`	+1 -1	0 replies
33/609	RDMA/hns: Fix potential integer overflow in mhop hem cleanup`drivers/infiniband/hw/hns/hns_roce_hem.c`	+1 -1	0 replies
34/609	RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp`drivers/infiniband/sw/siw/siw_verbs.c`	+5 ~~-13~~	0 replies
35/609	RDMA/siw: publish QP after initialization`drivers/infiniband/sw/siw/siw_verbs.c`	+24 ~~-20~~	0 replies
36/609	selftests/alsa: Fix memory leak in find_controls error path`tools/testing/selftests/alsa/mixer-test.c`	+1 -0	0 replies
37/609	RDMA/irdma: Prevent overflows in memory contiguity checks`drivers/infiniband/hw/irdma/verbs.c`	+2 -2	0 replies
38/609	xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()`net/ipv6/xfrm6_policy.c`	+1 -0	0 replies
39/609	xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert`net/xfrm/xfrm_policy.c`	+2 -2	0 replies
40/609	wifi: cfg80211: cancel sched scan results work on unregister`net/wireless/core.c`	+1 -0	0 replies
41/609	wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()`drivers/net/wireless/intel/ipw2x00/ipw2100.c`	+4 -4	0 replies
42/609	wifi: mac80211_hwsim: clamp virtio RX length before skb_put`drivers/net/wireless/mac80211_hwsim.c`	+1 -0	0 replies
43/609	wifi: libertas: fix memory leak in helper_firmware_cb()`drivers/net/wireless/marvell/libertas/firmware.c`	+1 -0	0 replies
44/609	wifi: p54: validate RX frame length in p54_rx_eeprom_readback()`drivers/net/wireless/intersil/p54/txrx.c`	+8 -0	0 replies
45/609	wifi: nl80211: free RNR data on MBSSID mismatch`net/wireless/nl80211.c`	+3 -1	0 replies
46/609	wifi: nl80211: validate nested MBSSID IE blobs`net/wireless/nl80211.c`	+10 -2	0 replies
47/609	wifi: cfg80211: validate PMSR measurement type data`net/wireless/pmsr.c`	+17 -2	0 replies
48/609	wifi: cfg80211: validate PMSR FTM preamble range`net/wireless/nl80211.c`	+3 -1	0 replies
49/609	wifi: cfg80211: reject unsupported PMSR FTM location requests`net/wireless/pmsr.c`	+2 -0	0 replies
50/609	wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock`net/mac80211/iface.c`	+7 -1	0 replies
51/609	wifi: brcmfmac: initialize SDIO data work before cleanup`drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c`	+1 -1	0 replies
52/609	wifi: cfg80211: bound element ID read when checking non-inheritance`net/wireless/scan.c`	+1 -1	0 replies
53/609	ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop`sound/soc/meson/aiu-fifo-spdif.c`	+5 -0	0 replies
54/609	ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()`sound/soc/amd/ps/pci-ps.c`	+1 -1	0 replies
55/609	ASoC: tas2562: fix deprecated shut-down GPIO always cleared after lookup`sound/soc/codecs/tas2562.c`	+3 -2	0 replies
56/609	firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context`drivers/firmware/arm_scmi/notify.c`	+3 -3	0 replies
57/609	ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF`drivers/net/ppp/ppp_generic.c`	+15 -3	0 replies
58/609	ipv4: fib: free fib_alias with kfree_rcu() on insert error path`net/ipv4/fib_trie.c`	+1 -1	0 replies
59/609	net/iucv: take a reference on the socket found in afiucv_hs_rcv()`net/iucv/af_iucv.c`	+4 -0	0 replies
60/609	ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered`drivers/ata/sata_dwc_460ex.c`	+2 -3	0 replies
61/609	ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts`drivers/ata/sata_dwc_460ex.c`	+1 -2	0 replies
62/609	ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC`sound/usb/quirks.c`	+2 -0	0 replies
63/609	Bluetooth: qca: fix NVM tag length underflow in TLV parser`drivers/bluetooth/btqca.c`	+1 -1	0 replies
64/609	smb/client: handle overlapping allocated ranges in fallocate`fs/smb/client/smb2ops.c`	+18 -7	0 replies
65/609	drm/i915/gt: use correct selftest config symbol`drivers/gpu/drm/i915/gt/intel_engine_user.c`	+1 -1	0 replies
66/609	bpf, sockmap: Reject unhashed UDP sockets on sockmap update`net/core/sock_map.c`	+2 -0	0 replies
67/609	can: j1939: fix lockless local-destination check`net/can/j1939/transport.c`	+14 -4	0 replies
68/609	ksmbd: validate compound request size before reading StructureSize2`fs/smb/server/smb2misc.c`	+5 -0	0 replies
69/609	drm/i915/selftests: Fix GT PM sort comparators`drivers/gpu/drm/i915/gt/selftest_gt_pm.c`	+4 -4	0 replies
70/609	net/sched: act_tunnel_key: Defer dst_release to RCU callback`net/sched/act_tunnel_key.c`	+10 -4	0 replies
71/609	sctp: fix auth_hmacs array size in struct sctp_cookie`include/net/sctp/structs.h`	+2 -1	0 replies
72/609	mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n`net/mpls/af_mpls.c`	+3 -0	0 replies
73/609	wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()`drivers/net/wireless/atmel/at76c50x-usb.c`	+5 -2	0 replies
74/609	USB: storage: add NO_ATA_1X quirk for Longmai USB Key`drivers/usb/storage/unusual_devs.h`	+7 -0	0 replies
75/609	usb: chipidea: fix usage_count leak when autosuspend_delay is negative`drivers/usb/chipidea/core.c`	+1 -0	0 replies
76/609	usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback`drivers/usb/gadget/udc/dummy_hcd.c`	+27 ~~-13~~	0 replies
77/609	usb: gadget: f_midi: cancel pending IN work before freeing the midi object`drivers/usb/gadget/function/f_midi.c`	+1 -0	0 replies
78/609	usb: gadget: printer: fix infinite loop in printer_read()`drivers/usb/gadget/function/f_printer.c`	+18 -5	0 replies
79/609	USB: gadget: snps-udc: fix device name leak on probe failure`drivers/usb/gadget/udc/snps_udc_core.c`	+0 -1	0 replies
80/609	USB: gadget: fsl-udc: fix device name leak on probe failure`drivers/usb/gadget/udc/fsl_udc_core.c`	+0 -1	0 replies
81/609	usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()`drivers/usb/gadget/function/f_ncm.c`	+13 -4	0 replies
82/609	usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown`drivers/usb/gadget/udc/bdc/bdc_core.c` `drivers/usb/gadget/udc/bdc/bdc_udc.c`	+24 -3	0 replies
83/609	usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer`drivers/usb/gadget/function/uvc_v4l2.c`	+2 -0	0 replies
84/609	USB: serial: ftdi_sio: add support for E+H FXA291`drivers/usb/serial/ftdi_sio.c` `drivers/usb/serial/ftdi_sio_ids.h`	+7 -0	0 replies
85/609	USB: serial: io_edgeport: cap received transmit credits`drivers/usb/serial/io_edgeport.c`	+2 -1	0 replies
86/609	USB: serial: keyspan_pda: fix data loss on receive throttling`drivers/usb/serial/keyspan_pda.c`	+35 -9	0 replies
87/609	USB: serial: option: add TDTECH MT5710-CN`drivers/usb/serial/option.c`	+1 -0	0 replies
88/609	crypto: rsa-pkcs1pad: Dont WARN on an empty digest`crypto/rsa-pkcs1pad.c`	+1 -1	0 replies
89/609	Revert "drm/amd/display: Add missing kdoc for ALLM parameters"`drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c`	+0 -2	0 replies
90/609	bpf: Support for hardening against JIT spraying`include/linux/filter.h` `kernel/bpf/core.c`	+29 -0	0 replies
91/609	x86/bugs: Enable IBPB flush on BPF JIT allocation`arch/x86/include/asm/nospec-branch.h` `arch/x86/kernel/cpu/bugs.c`	+49 -5	0 replies
92/609	bpf: Restrict JIT predictor flush to cBPF`arch/x86/net/bpf_jit_comp.c` `include/linux/filter.h` `kernel/bpf/core.c` +1 more	+14 -9	0 replies
93/609	bpf: Skip redundant IBPB in pack allocator`kernel/bpf/core.c`	+14 -1	0 replies
94/609	bpf: Prefer packs that wont trigger an IBPB flush on allocation`kernel/bpf/core.c`	+24 -3	0 replies
95/609	bpf: Prefer dirty packs for eBPF allocations`kernel/bpf/core.c`	+3 -3	0 replies
96/609	bpf: Fix ld_{abs,ind} failure path analysis in subprogs`kernel/bpf/verifier.c`	+17 -0	0 replies
97/609	usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits`drivers/usb/host/xhci-pci.c` `drivers/usb/host/xhci.c` `drivers/usb/host/xhci.h`	+12 -5	0 replies
98/609	wifi: ath9k: hif_usb: dont dereference hif_dev after re-arming firmware request`drivers/net/wireless/ath/ath9k/hif_usb.c`	+1 -6	0 replies
99/609	wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin`drivers/net/wireless/ath/ath11k/qmi.c`	+8 -3	0 replies
100/609	hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop`drivers/hwmon/corsair-psu.c`	+1 -0	0 replies
101/609	hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop`drivers/hwmon/corsair-cpro.c`	+1 -0	0 replies
102/609	hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop`drivers/hwmon/nzxt-smart2.c`	+1 -1	0 replies
103/609	watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()`drivers/watchdog/watchdog_pretimeout.c`	+2 -0	0 replies
104/609	wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()`drivers/net/wireless/ath/ath11k/dp_rx.c`	+3 -0	0 replies
105/609	wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET`drivers/net/wireless/ath/ath11k/pci.c`	+4 -0	0 replies
106/609	firewire: net: Fix fragmented datagram reassembly`drivers/firewire/net.c`	+21 ~~-18~~	0 replies
107/609	wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler`drivers/net/wireless/ath/ath6kl/wmi.c`	+12 -0	0 replies
108/609	wifi: ath6kl: fix OOB read from firmware IE lengths in connect event`drivers/net/wireless/ath/ath6kl/wmi.c`	+8 -0	0 replies
109/609	wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read`drivers/net/wireless/ath/carl9170/rx.c`	+2 -1	0 replies
110/609	wifi: carl9170: fix OOB read from off-by-two in TX status handler`drivers/net/wireless/ath/carl9170/tx.c`	+1 -1	0 replies
111/609	wifi: carl9170: fix buffer overflow in rx_stream failover path`drivers/net/wireless/ath/carl9170/rx.c`	+3 -1	0 replies
112/609	btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8`include/uapi/linux/btrfs.h`	+1 -1	0 replies
113/609	btrfs: free mapping node on duplicate reloc root insert`fs/btrfs/relocation.c`	+1 -0	0 replies
114/609	ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI`sound/soc/codecs/bt-sco.c`	+8 -2	0 replies
115/609	wifi: iwlwifi: mvm: fix read in wake packet notification handler`drivers/net/wireless/intel/iwlwifi/mvm/d3.c`	+2 -1	0 replies
116/609	usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect`drivers/usb/atm/ueagle-atm.c`	+17 -0	0 replies
117/609	hwmon: (asus-ec-sensors) fix looping over banks while reading from EC`drivers/hwmon/asus-ec-sensors.c`	+1 -1	0 replies
118/609	hwmon: (asus-ec-sensors) fix EC read intervals`drivers/hwmon/asus-ec-sensors.c`	+4 -4	0 replies
119/609	hwmon: (asus-ec-sensors) add missed handle for ENOMEM`drivers/hwmon/asus-ec-sensors.c`	+5 -3	0 replies
120/609	smb: client: validate DFS referral PathConsumed`fs/smb/client/misc.c`	+25 -9	0 replies
121/609	hwmon: occ: validate poll response sensor blocks`drivers/hwmon/occ/common.c`	+30 -8	0 replies
122/609	net/packet: avoid fanout hook re-registration after unregister`net/packet/af_packet.c`	+5 -1	0 replies
123/609	bonding: fix devconf_all NULL dereference when IPv6 is disabled`drivers/net/bonding/bond_main.c`	+2 -1	0 replies
124/609	rds: drop incoming messages that cross network namespace boundaries`net/rds/recv.c`	+15 -0	0 replies
125/609	dpaa2-switch: put MAC endpoint device on disconnect`drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c`	+1 -0	0 replies
126/609	net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call`drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c`	+12 -9	0 replies
127/609	dpaa2-eth: put MAC endpoint device on disconnect`drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c`	+1 -0	0 replies
128/609	nfp: Check resource mutex allocation`drivers/net/ethernet/netronome/nfp/nfpcore/nfp_resource.c`	+3 -0	0 replies
129/609	wan: wanxl: Only reset hardware after BAR mapping`drivers/net/wan/wanxl.c`	+2 -1	0 replies
130/609	wifi: mwifiex: bound uAP association event IEs to the event buffer`drivers/net/wireless/marvell/mwifiex/uap_event.c`	+22 -2	0 replies
131/609	iommu/amd: Bound the early ACPI HID map`drivers/iommu/amd/init.c`	+6 -0	0 replies
132/609	iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()`drivers/iommu/intel/perf.c`	+1 -1	0 replies
133/609	wifi: mac80211: recalculate TIM when a station enters power save`net/mac80211/rx.c`	+2 -0	0 replies
134/609	amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN`drivers/net/ethernet/amd/xgbe/xgbe-mdio.c`	+8 -3	0 replies
135/609	sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid`net/sctp/auth.c`	+1 -1	0 replies
136/609	sctp: validate stream count in sctp_process_strreset_inreq()`net/sctp/stream.c`	+5 -1	0 replies
137/609	selftest: af_unix: Add Kconfig file.`tools/testing/selftests/net/af_unix/config`	+3 -0	0 replies
138/609	selftests: af_unix: add USER_NS config`tools/testing/selftests/net/af_unix/config`	+1 -0	0 replies
139/609	selftests: openvswitch: add config file`tools/testing/selftests/net/openvswitch/config`	+16 -0	0 replies
140/609	gtp: check skb_pull_data() return in gtp1u_send_echo_resp()`drivers/net/gtp.c`	+3 -2	0 replies
141/609	nexthop: initialize extack in nh_res_bucket_migrate()`net/ipv4/nexthop.c`	+1 -1	0 replies
142/609	tipc: fix infinite loop in __tipc_nl_compat_dumpit`net/tipc/netlink_compat.c`	+4 -0	0 replies
143/609	wifi: mt76: mt7915: guard HE capability lookups`drivers/net/wireless/mediatek/mt76/mt7915/mcu.c`	+13 -5	0 replies
144/609	wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()`drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c`	+2 -0	0 replies
145/609	wifi: brcmfmac: fix 802.1X-SHA256 call trace warning`drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c`	+1 -1	0 replies
146/609	amt: re-read skb header pointers after every pull`drivers/net/amt.c`	+55 ~~-24~~	0 replies
147/609	amt: make the head writable before rewriting the L2 header`drivers/net/amt.c`	+8 -0	0 replies
148/609	net: bridge: vlan: fix vlan range dumps starting with pvid`net/bridge/br_netlink_tunnel.c` `net/bridge/br_private.h` `net/bridge/br_vlan.c` +1 more	+13 -9	0 replies
149/609	net: hsr: fix memory leak on slave unregistration by removing synced VLANs`net/hsr/hsr_slave.c`	+2 -0	0 replies
150/609	sctp: auth: verify auth requirement when auth_chunk is NULL`net/sctp/sm_statefuns.c`	+1 -1	0 replies
151/609	vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets`drivers/net/vmxnet3/vmxnet3_drv.c`	+16 -6	0 replies
152/609	tipc: fix u16 MTU truncation in media and bearer MTU validation`net/tipc/netlink.c`	+5 -1	0 replies
153/609	net: stmmac: fix l3l4 filter rejecting unsupported offload requests`drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c`	+34 -0	0 replies
154/609	net: stmmac: reset residual action in L3L4 filters on delete`drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c`	+1 -0	0 replies
155/609	octeontx2-vf: set TC flower flag on MCAM entry allocation`drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c`	+1 -0	0 replies
156/609	ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup`net/ipv4/icmp.c`	+15 -3	0 replies
157/609	ppp: use IFF_NO_QUEUE in virtual interfaces`drivers/net/ppp/ppp_generic.c` `drivers/net/ppp/pppoe.c` `drivers/net/ppp/pptp.c` +2 more	+8 -2	0 replies
158/609	ppp: convert to percpu netstats`drivers/net/ppp/ppp_generic.c`	+19 ~~-33~~	0 replies
159/609	ppp: enable TX scatter-gather`drivers/net/ppp/ppp_generic.c`	+25 -5	0 replies
160/609	ppp: annotate data races in ppp_generic`drivers/net/ppp/ppp_generic.c`	+28 ~~-22~~	0 replies
161/609	hinic: remove unused ethtool RSS user configuration buffers`drivers/net/ethernet/huawei/hinic/hinic_dev.h` `drivers/net/ethernet/huawei/hinic/hinic_ethtool.c`	+0 ~~-23~~	0 replies
162/609	net: qrtr: restrict socket creation to the initial network namespace`net/qrtr/af_qrtr.c`	+8 -0	0 replies
163/609	net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule`drivers/net/ethernet/mellanox/mlx5/core/esw/acl/helper.c`	+1 -1	0 replies
164/609	net/mlx5e: Report zero bandwidth for non-ETS traffic classes`drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c`	+7 -0	0 replies
165/609	net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation`drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c`	+8 -0	0 replies
166/609	net: ipv6: fix dif and sdif mismatch in raw6_icmp_error`net/ipv6/raw.c`	+1 -1	0 replies
167/609	bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()`net/ipv4/tcp_bpf.c`	+1 -1	0 replies
168/609	drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()`drivers/gpu/drm/rockchip/cdn-dp-reg.c`	+2 -0	0 replies
169/609	drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers`drivers/gpu/drm/display/drm_dp_mst_topology.c`	+4 -2	0 replies
170/609	drm/dp/mst: fix buffer overflows in sideband chunk accumulation`drivers/gpu/drm/display/drm_dp_mst_topology.c`	+9 -0	0 replies
171/609	drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers`drivers/gpu/drm/display/drm_dp_mst_topology.c`	+4 ~~-13~~	0 replies
172/609	drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT`drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c`	+18 -0	0 replies
173/609	drm/i915/gem: Add missing nospec on parallel submit slot`drivers/gpu/drm/i915/gem/i915_gem_context.c`	+1 -0	0 replies
174/609	drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()`drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c`	+1 -0	0 replies
175/609	drm/radeon: fix r100_copy_blit for large BOs`drivers/gpu/drm/radeon/r100.c`	+9 -4	0 replies
176/609	drm/amdkfd: Check bounds in allocate_event_notification_slot`drivers/gpu/drm/amd/amdkfd/kfd_events.c`	+3 -0	0 replies
177/609	drm/virtio: bound EDID block reads to the response buffer`drivers/gpu/drm/virtio/virtgpu_vq.c`	+2 -1	0 replies
178/609	drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()`drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c`	+2 -2	0 replies
179/609	drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()`drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c`	+2 -2	0 replies
180/609	drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()`drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c`	+2 -2	0 replies
181/609	drm/i915: Return NULL on error in active_instance`drivers/gpu/drm/i915/i915_active.c`	+6 -1	0 replies
182/609	drm/i915/gem: Do not leak siblings[] on proto context error`drivers/gpu/drm/i915/gem/i915_gem_context.c`	+14 -8	0 replies
183/609	drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU`drivers/gpu/drm/i915/gem/i915_gem_context.c`	+1 -1	0 replies
184/609	drm/amdgpu: Fix VFCT bus number matching with soft filter`drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c`	+40 -5	0 replies
185/609	drm/amd/pm/ci: Dont disable MCLK DPM on Bonaire 0x6658 (R7 260X)`drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c`	+2 -5	0 replies
186/609	drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved`drivers/gpu/drm/amd/amdgpu/amdgpu_object.c`	+8 -5	0 replies
187/609	drm/vmwgfx: Validate vmw_surface_metadata::array_size`drivers/gpu/drm/vmwgfx/vmwgfx_surface.c`	+17 -5	0 replies
188/609	media: airspy: Return queued buffers on start_streaming() failure`drivers/media/usb/airspy/airspy.c`	+5 -3	0 replies
189/609	media: aspeed: fix missing of_reserved_mem_device_release() on probe failure`drivers/media/platform/aspeed/aspeed-video.c`	+1 -0	0 replies
190/609	media: cec: seco: unregister adapter on IR probe failure`drivers/media/cec/platform/seco/seco-cec.c`	+5 -1	0 replies
191/609	media: cedrus: clean up media device on probe failure`drivers/staging/media/sunxi/cedrus/cedrus.c`	+3 -2	0 replies
192/609	media: cedrus: Fix missing cleanup in error path`drivers/staging/media/sunxi/cedrus/cedrus.c`	+1 -0	0 replies
193/609	media: cedrus: skip invalid H.264 reference list entries`drivers/staging/media/sunxi/cedrus/cedrus_h264.c`	+3 -0	0 replies
194/609	media: cx231xx: fix devres lifetime`drivers/media/usb/cx231xx/cx231xx-cards.c`	+11 -5	0 replies
195/609	media: cx23885: add ioremap return check and cleanup`drivers/media/pci/cx23885/cx23885-core.c`	+12 -2	0 replies
196/609	media: marvell-cam: fix missing pci_disable_device() on remove`drivers/media/platform/marvell/cafe-driver.c`	+1 -0	0 replies
197/609	media: meson: vdec: Fix memory leak in error path of vdec_open`drivers/staging/media/meson/vdec/vdec.c`	+3 -1	0 replies
198/609	media: msi2500: Return queued buffers on start_streaming() failure`drivers/media/usb/msi2500/msi2500.c`	+24 -8	0 replies
199/609	media: pci: dm1105: Free allocated workqueue`drivers/media/pci/dm1105/dm1105.c`	+1 -0	0 replies
200/609	media: pwc: Drain fill_buf on start_streaming() failure`drivers/media/usb/pwc/pwc-if.c`	+5 -0	0 replies
201/609	media: pwc: Return queued buffers on start_streaming() failure`drivers/media/usb/pwc/pwc-if.c`	+6 -2	0 replies
202/609	media: radio-si476x: Unregister v4l2_device on probe failure`drivers/media/radio/radio-si476x.c`	+1 -0	0 replies
203/609	media: rtl2832: fix use-after-free in rtl2832_remove()`drivers/media/dvb-frontends/rtl2832.c`	+2 -2	0 replies
204/609	media: rtl2832_sdr: Return queued buffers on start_streaming() failure`drivers/media/dvb-frontends/rtl2832_sdr.c`	+14 -5	0 replies
205/609	media: saa7134: Fix a possible memory leak in saa7134_video_init1`drivers/media/pci/saa7134/saa7134-video.c`	+20 -5	0 replies
206/609	media: stm32: dcmi: unregister notifier on probe failure`drivers/media/platform/st/stm32/stm32-dcmi.c`	+1 -0	0 replies
207/609	media: sun4i-csi: Return queued buffers on start_streaming() failure`drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c`	+4 -2	0 replies
208/609	media: tegra-video: vi: fix invalid u32 return value in format lookup`drivers/staging/media/tegra-video/vi.c`	+2 -2	0 replies
209/609	media: ti: vpe: unwind v4l2 device registration on probe error`drivers/media/platform/ti/vpe/vpe.c`	+2 -1	0 replies
210/609	media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()`drivers/media/v4l2-core/v4l2-ctrls-request.c`	+9 -5	0 replies
211/609	media: v4l2-ctrls: validate HEVC active reference counts`drivers/media/v4l2-core/v4l2-ctrls-core.c`	+13 -0	0 replies
212/609	media: vb2: use ssize_t for vb2_read/vb2_write`drivers/media/common/videobuf2/videobuf2-core.c` `include/media/videobuf2-core.h`	+10 ~~-10~~	0 replies
213/609	media: vidtv: fix reference leak on failed device registration`drivers/media/test-drivers/vidtv/vidtv_bridge.c`	+3 -1	0 replies
214/609	media: vimc: fix reference leak on failed device registration`drivers/media/test-drivers/vimc/vimc-core.c`	+1 -0	0 replies
215/609	media: vivid: add vivid_update_reduced_fps()`drivers/media/test-drivers/vivid/vivid-ctrls.c` `drivers/media/test-drivers/vivid/vivid-vid-cap.c` `drivers/media/test-drivers/vivid/vivid-vid-cap.h`	+22 ~~-14~~	0 replies
216/609	media: vivid: check for vb2_is_busy() when toggling caps`drivers/media/test-drivers/vivid/vivid-ctrls.c` `drivers/media/test-drivers/vivid/vivid-vid-cap.c` `drivers/media/test-drivers/vivid/vivid-vid-out.c`	+24 -0	0 replies
217/609	media: vpif_capture: fix OF node reference imbalance`drivers/media/platform/ti/davinci/vpif_capture.c`	+1 -1	0 replies
218/609	ALSA: seq: close a re-opened queue timer in the destructor`sound/core/seq/seq_timer.c`	+12 -1	0 replies
219/609	wifi: ath6kl: fix OOB access from firmware ADDBA window size`drivers/net/wireless/ath/ath6kl/txrx.c`	+6 -4	0 replies
220/609	wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper`drivers/net/wireless/marvell/mwifiex/tdls.c`	+1 -1	0 replies
221/609	wifi: wilc1000: validate assoc response length before subtracting header`drivers/net/wireless/microchip/wilc1000/hif.c`	+5 -0	0 replies
222/609	wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses`drivers/net/wireless/mediatek/mt76/mt7615/mac.c`	+6 -0	0 replies
223/609	wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses`drivers/net/wireless/mediatek/mt76/mt7921/mac.c`	+7 -3	0 replies
224/609	wifi: brcmfmac: make release_scratchbuffers idempotent`drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c`	+6 -2	0 replies
225/609	staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()`drivers/staging/rtl8723bs/core/rtw_ieee80211.c`	+8 -1	0 replies
226/609	staging: rtl8723bs: fix inverted HT40 secondary channel offset`drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c`	+1 -1	0 replies
227/609	Bluetooth: hci_sync: Protect UUID list traversal`net/bluetooth/hci_sync.c`	+11 -2	0 replies
228/609	Bluetooth: RFCOMM: Fix session UAF in set_termios`include/net/bluetooth/rfcomm.h` `net/bluetooth/rfcomm/core.c` `net/bluetooth/rfcomm/tty.c`	+23 -4	0 replies
229/609	exec: fix unsigned loop counter wrap in transfer_args_to_stack()`fs/exec.c`	+1 -1	0 replies
230/609	binfmt_misc: set have_execfd only once the interpreter is opened`fs/binfmt_misc.c`	+2 -3	0 replies
231/609	platform/loongarch: laptop: Explicitly reset bl_powered state when suspend`drivers/platform/loongarch/loongson-laptop.c`	+1 -0	0 replies
232/609	cdrom: fix stack out-of-bounds read in CDROMVOLCTRL`drivers/cdrom/cdrom.c`	+1 -0	0 replies
233/609	x86/boot/compressed: Disable jump tables`arch/x86/boot/compressed/Makefile`	+1 -0	0 replies
234/609	comedi: comedi_parport: deal with premature interrupt`drivers/comedi/drivers/comedi_parport.c`	+10 -3	0 replies
235/609	serial: sc16is7xx: implement gpio get_direction() callback`drivers/tty/serial/sc16is7xx.c`	+12 -0	0 replies
236/609	serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms`drivers/tty/serial/8250/8250_mid.c`	+9 -5	0 replies
237/609	intel_th: fix MSC output device reference leak`drivers/hwtracing/intel_th/core.c` `drivers/hwtracing/intel_th/msu.c`	+2 ~~-10~~	0 replies
238/609	tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev`kernel/trace/trace_mmiotrace.c`	+1 -1	0 replies
239/609	tracing: Fix resource leak on mmiotrace trace_pipe close`kernel/trace/trace_mmiotrace.c`	+1 -1	0 replies
240/609	tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()`kernel/trace/trace_eprobe.c`	+2 -1	0 replies
241/609	tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()`kernel/trace/trace_probe.c`	+5 -4	0 replies
242/609	tracing/probes: Fix potential underflow in LEN_OR_ZERO macro`kernel/trace/trace_probe.c`	+1 -1	0 replies
243/609	tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()`kernel/trace/trace_probe.c`	+1 -1	0 replies
244/609	arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates`arch/arm64/kernel/ptrace.c`	+29 -0	0 replies
245/609	Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"`arch/arm64/kernel/ptrace.c`	+0 ~~-29~~	0 replies
246/609	mptcp: decrement subflows counter on failed passive join`net/mptcp/protocol.c`	+1 -0	0 replies
247/609	mptcp: only set DATA_FIN when a mapping is present`net/mptcp/options.c`	+6 -6	0 replies
248/609	sctp: dont free the ASCONFs own transport in DEL-IP processing`net/sctp/sm_make_chunk.c`	+6 -0	0 replies
249/609	ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()`fs/ceph/caps.c`	+1 -0	0 replies
250/609	libceph: bound get_version reply decode to front len`net/ceph/mon_client.c`	+1 -1	0 replies
251/609	libceph: Fix multiplication overflow in decode_new_up_state_weight()`net/ceph/osdmap.c`	+4 -1	0 replies
252/609	libceph: guard missing CRUSH type name lookup`net/ceph/osdmap.c`	+4 -1	0 replies
253/609	libceph: refresh auth->authorizer_buf{,_len} after authorizer update`net/ceph/auth_x.c`	+8 -1	0 replies
254/609	libceph: Reject monmaps advertising zero monitors`net/ceph/mon_client.c`	+1 -1	0 replies
255/609	libceph: reject zero bucket types in crush_decode`net/ceph/osdmap.c`	+2 -0	0 replies
256/609	libceph: remove debugfs files before client teardown`net/ceph/ceph_common.c`	+2 -2	0 replies
257/609	binfmt_elf_fdpic: only honour the first PT_INTERP`fs/binfmt_elf_fdpic.c`	+4 -0	0 replies
258/609	fscrypt: Add missing superblock check in find_or_insert_direct_key()`fs/crypto/keysetup_v1.c`	+7 -1	0 replies
259/609	ftrace: Add global mutex to serialize trace_parser access`kernel/trace/ftrace.c`	+13 -0	0 replies
260/609	iommu/vt-d: Disallow SVA if page walk is not coherent`drivers/iommu/intel/svm.c`	+1 -1	0 replies
261/609	phonet: pep: fix use-after-free in pep_get_sb()`net/phonet/pep.c`	+2 -0	0 replies
262/609	vxlan: require CAP_NET_ADMIN in the device netns for changelink`drivers/net/vxlan/vxlan_core.c`	+3 -0	0 replies
263/609	net: slip: serialize receive against buffer reallocation`drivers/net/slip/slip.c`	+4 -0	0 replies
264/609	geneve: require CAP_NET_ADMIN in the device netns for changelink`drivers/net/geneve.c`	+3 -0	0 replies
265/609	net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()`net/iucv/af_iucv.c`	+2 -1	0 replies
266/609	net/iucv: fix use-after-free of a severed iucv_path`net/iucv/af_iucv.c`	+14 -0	0 replies
267/609	net/x25: fix use-after-free in x25_kill_by_neigh()`net/x25/af_x25.c`	+6 -2	0 replies
268/609	net: hip04: fix RX buffer leak on build_skb failure`drivers/net/ethernet/hisilicon/hip04_eth.c`	+8 -3	0 replies
269/609	proc: Fix broken error paths for namespace links`fs/proc/namespaces.c`	+3 -1	0 replies
270/609	rbd: Reset positive result codes to zero in object map update path`drivers/block/rbd.c`	+6 -1	0 replies
271/609	ksmbd: defer destroy_previous_session() until after NTLM authentication`fs/smb/server/smb2pdu.c`	+4 -5	0 replies
272/609	ice: use READ_ONCE() to access cached PHC time`drivers/net/ethernet/intel/ice/ice_ptp.c`	+1 -1	0 replies
273/609	ila: reload IPv6 header after pskb_may_pull in checksum adjust`net/ipv6/ila/ila_common.c`	+12 -0	0 replies
274/609	mac802154: llsec: reject frames shorter than the authentication tag`net/mac802154/llsec.c`	+5 -0	0 replies
275/609	mctp: serial: handle zero-length frames to prevent rx buffer overflow`drivers/net/mctp/mctp-serial.c`	+1 -1	0 replies
276/609	pppoe: reload header pointer after dev_hard_header()`drivers/net/ppp/pppoe.c`	+1 -0	0 replies
277/609	tipc: clear sock->sk on the failed-insert path in tipc_sk_create()`net/tipc/socket.c`	+1 -0	0 replies
278/609	drm/amd/pm: make pp_features read-only when scpm is enabled`drivers/gpu/drm/amd/pm/amdgpu_pm.c`	+5 -0	0 replies
279/609	drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()`drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c`	+5 -8	0 replies
280/609	drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()`drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c`	+5 -8	0 replies
281/609	drm/amdgpu/gfx8: drop unecessary BUG_ON()`drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c`	+0 -3	0 replies
282/609	drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()`drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c`	+5 -5	0 replies
283/609	drm/amdgpu/vce: fix integer overflow in image size`drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c`	+14 -3	0 replies
284/609	drm/amdgpu: fix division by zero with invalid uvd dimensions`drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c`	+8 -0	0 replies
285/609	drm/amdgpu: invoke pm_genpd_remove() before freeing genpd`drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c`	+2 -0	0 replies
286/609	RISC-V: KVM: Serialize virtual interrupt pending state updates`arch/riscv/include/asm/kvm_host.h` `arch/riscv/kvm/vcpu.c`	+60 ~~-28~~	0 replies
287/609	i40e: remove read access to debugfs files`drivers/net/ethernet/intel/i40e/i40e_debugfs.c`	+19 ~~-102~~	0 replies
288/609	ipv6: ndisc: fix NULL deref in accept_untracked_na()`net/ipv6/ndisc.c`	+3 -5	0 replies
289/609	tipc: fix use-after-free of the discoverer in tipc_disc_rcv()`net/tipc/core.c` `net/tipc/discover.c`	+17 -2	0 replies
290/609	openvswitch: fix GSO userspace truncation underflow`net/openvswitch/actions.c` `net/openvswitch/datapath.c` `net/openvswitch/datapath.h` +1 more	+21 ~~-23~~	0 replies
291/609	fscrypt: Avoid dynamic allocation in fscrypt_get_devices()`fs/crypto/inline_crypt.c` `fs/f2fs/super.c` `include/linux/fscrypt.h`	+44 ~~-56~~	0 replies
292/609	exfat: validate cluster allocation bits of the allocation bitmap`fs/exfat/balloc.c`	+42 ~~-12~~	0 replies
293/609	bpf: drop bpf_lsm_getselfattr from hook list`kernel/bpf/bpf_lsm.c`	+0 -1	0 replies
294/609	KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug`arch/x86/kvm/svm/svm.c`	+6 -1	0 replies
295/609	io_uring/rw: fix missing ERESTARTSYS conversion in read paths`io_uring/rw.c`	+19 -9	0 replies
296/609	mm/damon/core: validate ranges in damon_set_regions()`mm/damon/core.c`	+6 -0	0 replies
297/609	mm/damon/core: disallow overlapping input ranges for damon_set_regions()`mm/damon/core.c`	+9 -2	0 replies
298/609	netfilter: nf_conntrack_expect: restore helper propagation via expectation`include/net/netfilter/nf_conntrack_expect.h` `net/netfilter/nf_conntrack_broadcast.c` `net/netfilter/nf_conntrack_core.c` +5 more	+39 ~~-12~~	0 replies
299/609	netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()`include/net/neighbour.h` `net/bridge/br_netfilter_hooks.c`	+11 -3	0 replies
300/609	net: mpls: initialize rtm_tos in mpls_getroute()`net/mpls/af_mpls.c`	+1 -0	0 replies
301/609	media: uvcvideo: Implement dual stream quirk to fix loss of usb packets`drivers/media/usb/uvc/uvc_video.c` `drivers/media/usb/uvc/uvcvideo.h`	+31 -1	0 replies
302/609	media: uvcvideo: Fix sequence number when no EOF`drivers/media/usb/uvc/uvc_video.c`	+47 ~~-45~~	0 replies
303/609	gve: fix Rx queue stall on alloc failure`drivers/net/ethernet/google/gve/gve.h` `drivers/net/ethernet/google/gve/gve_main.c` `drivers/net/ethernet/google/gve/gve_rx_dqo.c`	+39 -0	0 replies
304/609	HID: logitech-dj: Standardise hid_report_enum variable nomenclature`drivers/hid/hid-logitech-dj.c`	+6 -6	0 replies
305/609	HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write`drivers/hid/hid-logitech-dj.c`	+10 -0	0 replies
306/609	HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report`drivers/hid/hid-logitech-dj.c`	+2 -1	0 replies
307/609	net: qrtr: ns: Limit the maximum server registration per node`net/qrtr/ns.c`	+16 ~~-10~~	0 replies
308/609	net: qrtr: ns: Raise node count limit to 512`net/qrtr/ns.c`	+3 -2	0 replies
309/609	pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151`drivers/pinctrl/qcom/pinctrl-sc8280xp.c`	+11 ~~-10~~	0 replies
310/609	dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA`drivers/dma/sun6i-dma.c`	+4 -7	0 replies
311/609	ata: sata_mv: accept 1 or 2 resources in platform probe`drivers/ata/sata_mv.c`	+1 -1	0 replies
312/609	ata: libahci_platform: support non-consecutive port numbers`drivers/ata/ahci_brcm.c` `drivers/ata/ahci_ceva.c` `drivers/ata/libahci_platform.c`	+43 -6	0 replies
313/609	ahci: Introduce ahci_ignore_port() helper`drivers/ata/ahci.h` `drivers/ata/ahci_brcm.c` `drivers/ata/ahci_ceva.c` +1 more	+18 -7	0 replies
314/609	ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()`drivers/ata/ahci_ceva.c`	+14 -4	0 replies
315/609	ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup`sound/soc/codecs/max98095.c`	+3 -2	0 replies
316/609	ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup`sound/soc/codecs/max98090.c`	+3 -2	0 replies
317/609	phy: zynqmp: Allow variation in refclk rate`drivers/phy/xilinx/phy-zynqmp.c`	+4 -1	0 replies
318/609	phy-zynqmp: Postpone getting clock rate until actually needed`drivers/phy/xilinx/phy-zynqmp.c`	+37 ~~-33~~	0 replies
319/609	phy: zynqmp: fix clock error handling in xpsgtr_phy_init()`drivers/phy/xilinx/phy-zynqmp.c`	+9 -4	0 replies
320/609	phy: zynqmp: fix runtime PM leak on probe allocation failure`drivers/phy/xilinx/phy-zynqmp.c`	+6 -6	0 replies
321/609	netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()`include/linux/netfilter/nf_conntrack_sip.h` `net/netfilter/nf_conntrack_sip.c` `net/netfilter/nf_nat_sip.c`	+3 -3	0 replies
322/609	drm/mediatek: Check CRTC state before freeing`drivers/gpu/drm/mediatek/mtk_drm_crtc.c`	+3 -3	0 replies
323/609	keys: fix out-of-bounds read in keyring_get_key_chunk()`security/keys/keyring.c`	+5 -4	0 replies
324/609	keys: make keyring key-chunk byte order agree with keyring_diff_objects()`security/keys/keyring.c`	+3 -2	0 replies
325/609	assoc_array: trim the final shortcut word using the current chunk end`lib/assoc_array.c`	+2 -1	0 replies
326/609	netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH`net/netfilter/xt_hashlimit.c`	+15 -1	0 replies
327/609	ipv6: introduce dst_rt6_info() helper`drivers/infiniband/core/addr.c` `drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c` `drivers/net/vrf.c` +27 more	+77 ~~-86~~	0 replies
328/609	ipvs: fix the checksum validations`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_core.c` `net/netfilter/ipvs/ip_vs_proto_sctp.c` +2 more	+74 ~~-86~~	0 replies
329/609	ipvs: fix places with wrong packet offsets`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_app.c` `net/netfilter/ipvs/ip_vs_core.c` +4 more	+97 ~~-93~~	0 replies
330/609	ipvs: do not mangle ICMP replies for non-first fragments`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_core.c` `net/netfilter/ipvs/ip_vs_xmit.c`	+48 ~~-52~~	0 replies
331/609	netfilter: nft_payload: fix mask build for partial field offload`net/netfilter/nft_payload.c`	+1 ~~-11~~	0 replies
332/609	rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled`net/rds/ib.c` `net/rds/ib_cm.c` `net/rds/tcp.c`	+13 -3	0 replies
333/609	rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()`net/rds/tcp.c`	+5 -3	0 replies
334/609	pinctrl-amd: Dont clear S4 wake bits at probe`drivers/pinctrl/pinctrl-amd.c`	+1 -2	0 replies
335/609	scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer`drivers/scsi/libiscsi.c`	+1 -1	0 replies
336/609	scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer`drivers/scsi/libiscsi_tcp.c`	+1 -7	0 replies
337/609	scsi: libsas: Abort all in-flight requests when device is gone`drivers/scsi/libsas/sas_discover.c`	+29 -0	0 replies
338/609	scsi: libsas: Delete struct scsi_core`drivers/scsi/aic94xx/aic94xx_hwi.c` `drivers/scsi/aic94xx/aic94xx_init.c` `drivers/scsi/hisi_sas/hisi_sas_main.c` +14 more	+50 ~~-55~~	0 replies
339/609	scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race`drivers/scsi/hisi_sas/hisi_sas_v3_hw.c` `drivers/scsi/libsas/sas_init.c` `include/scsi/libsas.h`	+19 ~~-29~~	0 replies
340/609	smb: client: fix buffer leaks in SMB1 read and write`fs/smb/client/cifssmb.c`	+9 -3	0 replies
341/609	hwmon: (nct6755) Add support for NCT6799D`drivers/hwmon/nct6775-core.c` `drivers/hwmon/nct6775-i2c.c` `drivers/hwmon/nct6775-platform.c` +1 more	+94 -6	0 replies
342/609	hwmon: (nct6775) Fix IN scaling factors for 6798/6799`drivers/hwmon/nct6775-core.c` `drivers/hwmon/nct6775.h`	+23 -6	0 replies
343/609	hwmon: (nct6775) Increase and reorder ALARM/BEEP bits`drivers/hwmon/nct6775-core.c` `drivers/hwmon/nct6775.h`	+93 ~~-99~~	0 replies
344/609	hwmon: (nct6775) Add support for 18 IN readings for nct6799`drivers/hwmon/nct6775-core.c` `drivers/hwmon/nct6775.h`	+45 ~~-11~~	0 replies
345/609	hwmon: (nct6775) Additional TEMP registers for nct6799`drivers/hwmon/nct6775-core.c` `drivers/hwmon/nct6775.h`	+121 ~~-31~~	0 replies
346/609	hwmon: (nct6775) Fix access to temperature configuration registers`drivers/hwmon/nct6775-core.c`	+12 -2	0 replies
347/609	hwmon: (nct6775-core) Fix number of temperature registers for NCT6116`drivers/hwmon/nct6775-core.c`	+3 -5	0 replies
348/609	hwmon: (lm90) Only report alarms if driver is ready`drivers/hwmon/lm90.c`	+2 -2	0 replies
349/609	hwmon: (nzxt-smart2) DMA-align output buffer`drivers/hwmon/nzxt-smart2.c`	+1 -1	0 replies
350/609	net: do not send ICMP/NDISC Redirects when peer allocation fails`net/ipv4/route.c` `net/ipv6/ip6_output.c` `net/ipv6/ndisc.c`	+3 -3	0 replies
351/609	hwmon: (nct6775-core) Prevent access to unsupported weight registers`drivers/hwmon/nct6775-core.c`	+6 -6	0 replies
352/609	net: bridge: mrp: fix Option TLV length in MRP_Test frames`net/bridge/br_mrp.c`	+1 -1	0 replies
353/609	forcedeth: fix UAF of txrx_stats in nv_remove`drivers/net/ethernet/nvidia/forcedeth.c`	+2 -2	0 replies
354/609	hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors`drivers/hwmon/adt7470.c`	+29 ~~-11~~	0 replies
355/609	hwmon: (adt7470) Fix cache updated before hardware write on I2C error`drivers/hwmon/adt7470.c`	+9 -5	0 replies
356/609	hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread`drivers/hwmon/adt7470.c`	+1 -1	0 replies
357/609	hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()`drivers/hwmon/adt7470.c`	+17 -2	0 replies
358/609	hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks`drivers/hwmon/adt7470.c`	+2 -2	0 replies
359/609	hwmon: (adt7470) Use cached PWM frequency value`drivers/hwmon/adt7470.c`	+18 -2	0 replies
360/609	hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read`drivers/hwmon/adt7470.c`	+10 ~~-13~~	0 replies
361/609	hwmon: (adt7470) Fix PWM auto temp state array and bounds check`drivers/hwmon/adt7470.c`	+6 -1	0 replies
362/609	powerpc/boot: Fix simpleboot CPU node lookup check`arch/powerpc/boot/simpleboot.c`	+1 -1	0 replies
363/609	powerpc/boot: Fix treeboot-currituck CPU node lookup check`arch/powerpc/boot/treeboot-currituck.c`	+1 -1	0 replies
364/609	powerpc/boot: Fix treeboot-akebono CPU node lookup check`arch/powerpc/boot/treeboot-akebono.c`	+1 -1	0 replies
365/609	wifi: mac80211: validate individual TWT params before driver setup`net/mac80211/s1g.c`	+4 -0	0 replies
366/609	hwmon: (pmbus) Fix return value from pmbus_update_byte_data()`drivers/hwmon/pmbus/pmbus_core.c`	+1 -1	0 replies
367/609	Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp`net/bluetooth/l2cap_core.c`	+5 -0	0 replies
368/609	net: phylink: put link_gpio if phylink_create fails`drivers/net/phy/phylink.c`	+15 ~~-14~~	0 replies
369/609	scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req`drivers/s390/scsi/zfcp_aux.c`	+1 -0	0 replies
370/609	scsi: target: Clear cmd_cnt when initial counter enrollment fails`drivers/target/target_core_transport.c`	+10 -2	0 replies
371/609	net: sxgbe: free TX rings on RX allocation failure`drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c`	+4 -5	0 replies
372/609	net: sxgbe: check descriptor ring allocation failures`drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c`	+4 -1	0 replies
373/609	can: isotp: check register_netdevice_notifier() error in module init`net/can/isotp.c`	+9 -4	0 replies
374/609	tracing/mmiotrace: Reset dropped_count in mmio_reset_data()`kernel/trace/trace_mmiotrace.c`	+1 -0	0 replies
375/609	octeontx2-pf: Set correct sequence for carrier off and tx queue stop`drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c`	+1 -1	0 replies
376/609	qede: sync udp_tunnel ports outside qede_lock in the recovery path`drivers/net/ethernet/qlogic/qede/qede_main.c`	+22 ~~-22~~	0 replies
377/609	ksmbd: return success for deferred final close`fs/smb/server/vfs_cache.c`	+3 -1	0 replies
378/609	ksmbd: fix use-after-free in __close_file_table_ids()`fs/smb/server/vfs_cache.c`	+2 -0	0 replies
379/609	ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump`net/ipv6/ip6_fib.c`	+8 -9	0 replies
380/609	af_unix: Give up GC if MSG_PEEK intervened.`include/net/af_unix.h` `net/unix/af_unix.c` `net/unix/garbage.c`	+54 ~~-28~~	0 replies
381/609	rhashtable: clear stale iter->p on table restart`lib/rhashtable.c`	+1 -0	0 replies
382/609	pinctrl: microchip-sgpio: add missing select REGMAP_MMIO`drivers/pinctrl/Kconfig`	+1 -0	0 replies
383/609	pinctrl: devicetree: dont free uninitialized dev_name on error path`drivers/pinctrl/devicetree.c`	+4 -0	0 replies
384/609	pinctrl: bm1880: add missing select GENERIC_PINCONF`drivers/pinctrl/Kconfig`	+1 -0	0 replies
385/609	mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()`mm/percpu-km.c`	+1 -1	0 replies
386/609	mm/hugetlb: fix list corruption in allocate_file_region_entries()`mm/hugetlb.c`	+1 -1	0 replies
387/609	KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active`arch/x86/kvm/svm/avic.c`	+0 -8	0 replies
388/609	KVM: s390: pci: Reject adapter interrupt forwarding if already enabled`arch/s390/kvm/pci.c`	+4 -0	0 replies
389/609	KVM: s390: pci: Fix NULL dereference on AIBV allocation failure`arch/s390/kvm/pci.c`	+8 -0	0 replies
390/609	KVM: s390: pci: Validate AIBV and AISB before pinning guest pages`arch/s390/kvm/pci.c`	+15 -1	0 replies
391/609	sctp: validate Adaptation Indication parameter length`net/sctp/sm_make_chunk.c`	+6 -0	0 replies
392/609	audit: fix potential integer overflow in audit_log_n_string()`kernel/audit.c`	+9 -2	0 replies
393/609	audit: fix potential use-after-free in audit_del_rule()`kernel/auditfilter.c`	+4 -2	0 replies
394/609	Bluetooth: HIDP: reject frames without a transaction header`net/bluetooth/hidp/core.c`	+15 ~~-10~~	0 replies
395/609	Bluetooth: HIDP: validate numbered report payloads`net/bluetooth/hidp/core.c`	+3 -2	0 replies
396/609	bpf: lwt: Fix dst reference leak on reroute failure`net/core/lwt_bpf.c`	+3 -1	0 replies
397/609	ALSA: 6fire: Fix UAF at error handling during probe`sound/usb/6fire/chip.c`	+4 -0	0 replies
398/609	ALSA: lx6464es: fix period byte count for 16-bit streams`sound/pci/lx6464es/lx6464es.c` `sound/pci/lx6464es/lx_core.c`	+2 -8	0 replies
399/609	ALSA: pcm: wake linked drain waiters on unlink`sound/core/pcm_native.c`	+7 -0	0 replies
400/609	ASoC: tas2562: fix DVC coefficient write order`sound/soc/codecs/tas2562.c`	+15 -8	0 replies
401/609	ASoC: tas2562: fix broken entries in the volume lookup table`sound/soc/codecs/tas2562.c`	+4 -3	0 replies
402/609	ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()`sound/usb/midi.c`	+2 -0	0 replies
403/609	ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set`sound/usb/endpoint.c`	+4 -2	0 replies
404/609	ALSA: usb-audio: Clamp frame size in implicit-feedback mode`sound/usb/endpoint.c`	+5 -3	0 replies
405/609	dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+`include/linux/dma/qcom_bam_dma.h`	+16 -5	0 replies
406/609	e1000: fix memory leak in e1000_probe()`drivers/net/ethernet/intel/e1000/e1000_main.c`	+1 -1	0 replies
407/609	igbvf: Fix leak in TX DMA error cleanup`drivers/net/ethernet/intel/igbvf/netdev.c`	+0 -2	0 replies
408/609	ipvs: do not propagate one-packet flag to synced conns`net/netfilter/ipvs/ip_vs_conn.c`	+3 -0	0 replies
409/609	net/smc: fix socket use-after-free during link group termination`net/smc/smc_core.c`	+1 -1	0 replies
410/609	netfilter: ipset: do not update comments from kernel-side hash adds`net/netfilter/ipset/ip_set_hash_gen.h`	+1 -1	0 replies
411/609	tipc: avoid use-after-free in poll trace queue dumps`net/tipc/socket.c`	+1 -1	0 replies
412/609	wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames`drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c`	+1 -1	0 replies
413/609	binfmt_misc: reject a flag character as the field delimiter`fs/binfmt_misc.c`	+4 -0	0 replies
414/609	mm/page_reporting: use system_freezable_wq to fix UAF during suspend`mm/page_reporting.c`	+4 -2	0 replies
415/609	net: bridge: stop fast-leave after deleting a port group`net/bridge/br_multicast.c`	+1 -0	0 replies
416/609	net: ipv6: clear suppressed fib6 rule result`net/ipv6/fib6_rules.c`	+1 -0	0 replies
417/609	powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()`arch/powerpc/platforms/ps3/mm.c`	+1 -0	0 replies
418/609	um: vector: fix use-after-free in vector_mmsg_rx()`arch/um/drivers/vector_kern.c`	+3 -0	0 replies
419/609	vxlan: re-fetch eth header after route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+1 -0	0 replies
420/609	vxlan: unclone skb head before modifying eth header in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+4 -0	0 replies
421/609	vxlan: use neigh_ha_snapshot() in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+4 -2	0 replies
422/609	vxlan: use pskb_network_may_pull() in route_shortcircuit()`drivers/net/vxlan/vxlan_core.c`	+2 -2	0 replies
423/609	ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()`drivers/block/ublk_drv.c`	+9 -0	0 replies
424/609	tracing: Check return value of __register_event() in trace_module_add_events()`kernel/trace/trace_events.c`	+2 -2	0 replies
425/609	tracing/filters: Fix false positive match in regex_match_full()`kernel/trace/trace_events_filter.c`	+3 -0	0 replies
426/609	selftests/clone3: fix wild pointer access of getline due to missing init`tools/testing/selftests/clone3/clone3_set_tid.c`	+1 -1	0 replies
427/609	scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write`drivers/scsi/scsi_debug.c`	+6 -2	0 replies
428/609	sctp: reject stale cookies with mismatched verification tags`net/sctp/sm_make_chunk.c`	+7 -4	0 replies
429/609	sctp: prevent peer transport count overflow`net/sctp/associola.c`	+3 -0	0 replies
430/609	hwmon: (npcm750-pwm-fan): stop fan timer on device detach`drivers/hwmon/npcm750-pwm-fan.c`	+11 -0	0 replies
431/609	i2c: amd-mp2: Unregister callback on adapter add failure`drivers/i2c/busses/i2c-amd-mp2-plat.c`	+3 -1	0 replies
432/609	gpio: pca953x: fix cache_only and IRQ state on restore_context() failure`drivers/gpio/gpio-pca953x.c`	+13 -2	0 replies
433/609	cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()`drivers/cpufreq/powernow-k8.c`	+1 -0	0 replies
434/609	power: supply: bq25890: fix the -10 C NTC lookup entry`drivers/power/supply/bq25890_charger.c`	+1 -1	0 replies
435/609	s390/qeth: Check CAP_NET_ADMIN for private ioctls`drivers/s390/net/qeth_core_main.c`	+3 -0	0 replies
436/609	s390/dasd: Fix potential NULL pointer dereference`drivers/s390/block/dasd_ioctl.c`	+1 -1	0 replies
437/609	s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs`drivers/s390/crypto/zcrypt_api.c`	+1 -1	0 replies
438/609	s390/zcrypt: Validate length for CCA AES cipher key requests`drivers/s390/crypto/zcrypt_ccamisc.c`	+3 -0	0 replies
439/609	s390/zcrypt: Validate length for CCA ECC private key requests`drivers/s390/crypto/zcrypt_ccamisc.c`	+3 -0	0 replies
440/609	phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask`drivers/phy/xilinx/phy-zynqmp.c`	+1 -1	0 replies
441/609	phy: zynqmp: use read-modify-write for SERDES scrambler bypass`drivers/phy/xilinx/phy-zynqmp.c`	+6 -2	0 replies
442/609	phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB`drivers/phy/xilinx/phy-zynqmp.c`	+29 ~~-10~~	0 replies
443/609	net: openvswitch: fix potential UAF on meter attach failure`net/openvswitch/meter.c`	+19 ~~-14~~	0 replies
444/609	net: openvswitch: fix skb leak on flow key update failure during ct`net/openvswitch/actions.c`	+1 -1	0 replies
445/609	ice: wait for reset completion in ice_resume()`drivers/net/ethernet/intel/ice/ice_main.c`	+10 -0	0 replies
446/609	i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock`drivers/i2c/busses/i2c-jz4780.c`	+4 -1	0 replies
447/609	i2c: imx: Fix slave registration race and error handling`drivers/i2c/busses/i2c-imx.c`	+5 -3	0 replies
448/609	i2c: imx: Cancel hrtimer before clearing slave pointer`drivers/i2c/busses/i2c-imx.c`	+1 -0	0 replies
449/609	can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured`drivers/net/can/c_can/c_can_main.c`	+4 -4	0 replies
450/609	can: ems_usb: validate CPC message lengths`drivers/net/can/usb/ems_usb.c`	+43 -0	0 replies
451/609	can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure`drivers/net/can/usb/etas_es58x/es58x_core.c`	+0 -1	0 replies
452/609	can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer`net/can/j1939/transport.c`	+1 -1	0 replies
453/609	can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking`net/can/j1939/bus.c` `net/can/j1939/j1939-priv.h` `net/can/j1939/main.c` +1 more	+11 -4	0 replies
454/609	can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()`drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c`	+1 -0	0 replies
455/609	can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents`drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c`	+11 -2	0 replies
456/609	can: softing: fw_parse(): validate firmware record spans`drivers/net/can/softing/softing_fw.c`	+32 ~~-14~~	0 replies
457/609	can: peak_usb: add bounds check for USB channel index`drivers/net/can/usb/peak_usb/pcan_usb_pro.c`	+16 -4	0 replies
458/609	can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error`drivers/net/can/usb/peak_usb/pcan_usb_core.c`	+0 -1	0 replies
459/609	can: peak_usb: validate uCAN receive record lengths`drivers/net/can/usb/peak_usb/pcan_usb_fd.c`	+39 -1	0 replies
460/609	can: ctucanfd: add missing MODULE_DEVICE_TABLE()`drivers/net/can/ctucanfd/ctucanfd_pci.c`	+1 -0	0 replies
461/609	can: ctucanfd: use self-test mode for PRESUME_ACK`drivers/net/can/ctucanfd/ctucanfd_base.c`	+2 -2	0 replies
462/609	can: ctucanfd: unmap BAR0 using base address`drivers/net/can/ctucanfd/ctucanfd_pci.c`	+1 -1	0 replies
463/609	can: ctucanfd: handle bus error interrupts`drivers/net/can/ctucanfd/ctucanfd_base.c`	+6 -2	0 replies
464/609	can: ctucanfd: mark error-active controller status valid`drivers/net/can/ctucanfd/ctucanfd_base.c`	+1 -1	0 replies
465/609	drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs`drivers/gpu/drm/display/drm_dp_helper.c`	+12 -0	0 replies
466/609	drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size`drivers/gpu/drm/vc4/vc4_irq.c`	+1 -1	0 replies
467/609	drm/vc4: Zero the tile state data array before each BIN job`drivers/gpu/drm/vc4/vc4_validate.c`	+23 -6	0 replies
468/609	drm/amdgpu: restore UMD profile pstate after runtime resume`drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c`	+15 -0	0 replies
469/609	drm/amdgpu: cap GTT size to physical RAM on APUs`drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c`	+12 -0	0 replies
470/609	drm/amdkfd: Handle invalid event type in CRIU event restore`drivers/gpu/drm/amd/amdkfd/kfd_events.c`	+3 -0	0 replies
471/609	drm/amdkfd: hold event_mutex while checkpointing CRIU events`drivers/gpu/drm/amd/amdkfd/kfd_events.c`	+18 -4	0 replies
472/609	drm/vmwgfx: drop dma_buf reference on foreign-fd prime import`drivers/gpu/drm/vmwgfx/ttm_object.c`	+5 -2	0 replies
473/609	drm/vmwgfx: validate DRAW_PRIMITIVES header size before division`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+7 -1	0 replies
474/609	drm/vmwgfx: bound DMA command body size against suffix pointer`drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c`	+6 -0	0 replies
475/609	HID: logitech-dj: Fix maxfield check in DJ short report validation`drivers/hid/hid-logitech-dj.c`	+7 -2	0 replies
476/609	ata: libahci_platform: Do not set mask_port_map when not needed`drivers/ata/libahci_platform.c`	+0 -2	0 replies
477/609	ata: ahci: Make ahci_ignore_port() handle empty mask_port_map`drivers/ata/ahci.h` `drivers/ata/libahci.c`	+7 -2	0 replies
478/609	mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()`mm/hugetlb.c`	+10 -8	0 replies
479/609	mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios`mm/huge_memory.c`	+14 -2	0 replies
480/609	net: openvswitch: fix skb leak on flow key update failure during recirculation`net/openvswitch/actions.c`	+8 -1	0 replies
481/609	firmware: stratix10-svc: fix memory leaks and list corruption bugs`drivers/firmware/stratix10-svc.c`	+6 -4	0 replies
482/609	gpio: pch: use raw_spinlock_t for the register lock`drivers/gpio/gpio-pch.c`	+14 ~~-14~~	0 replies
483/609	Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref`include/net/bluetooth/l2cap.h` `net/bluetooth/l2cap_core.c`	+21 ~~-13~~	0 replies
484/609	Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev`net/bluetooth/6lowpan.c`	+3 ~~-15~~	0 replies
485/609	Bluetooth: hci_conn: fix potential UAF in create_big_sync`include/net/bluetooth/hci_core.h` `net/bluetooth/hci_conn.c`	+36 -1	0 replies
486/609	mount: honour SB_NOUSER in the new mount API`fs/namespace.c`	+5 -0	0 replies
487/609	s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()`drivers/s390/crypto/zcrypt_ccamisc.c`	+13 -7	0 replies
488/609	NFS: Pin the struct nfs_server during a FREE_STATEID call`fs/nfs/nfs4proc.c`	+5 -0	0 replies
489/609	ARM: npcm: Fix OF node refcount leaks in SMP setup`arch/arm/mach-npcm/platsmp.c`	+2 -0	0 replies
490/609	Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"`drivers/net/thunderbolt.c`	+7 -6	0 replies
491/609	bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor`drivers/net/bonding/bond_alb.c`	+6 -4	0 replies
492/609	netfilter: ipset: switch ext_size to atomic64_t`include/linux/netfilter/ipset/ip_set.h` `net/netfilter/ipset/ip_set_bitmap_gen.h` `net/netfilter/ipset/ip_set_core.c` +2 more	+9 -9	0 replies
493/609	ipvs: avoid out-of-bounds write in ip_vs_nat_icmp`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_core.c` `net/netfilter/ipvs/ip_vs_xmit.c`	+36 ~~-35~~	0 replies
494/609	ipvs: return the csum validation for forward hook`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_proto_sctp.c`	+6 ~~-15~~	0 replies
495/609	btrfs: fix memory leak in btrfs_do_encoded_write()`fs/btrfs/inode.c`	+1 -0	0 replies
496/609	bpf: Preserve pointer state for commuted arithmetic`kernel/bpf/verifier.c`	+8 -7	0 replies
497/609	net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()`net/smc/smc_llc.c`	+2 -1	0 replies
498/609	net/sched: cls_route: fix fastmap use-after-free on filter`net/sched/cls_route.c`	+26 -9	0 replies
499/609	net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete`drivers/net/ethernet/hisilicon/hix5hd2_gmac.c`	+0 -1	0 replies
500/609	net/mlx5: fw_tracer, return NULL on create error`drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c`	+7 -9	0 replies
501/609	counter: microchip-tcb-capture: Fix DT channel validation`drivers/counter/microchip-tcb-capture.c`	+2 -2	0 replies
502/609	tcp: add a scheduling point in established_get_first()`net/ipv4/tcp_ipv4.c`	+3 -0	0 replies
503/609	bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch`net/ipv4/tcp_ipv4.c`	+5 -4	0 replies
504/609	bpf: tcp: Make sure iter->batch always contains a full bucket snapshot`net/ipv4/tcp_ipv4.c`	+77 ~~-32~~	0 replies
505/609	bpf: tcp: Get rid of st_bucket_done`net/ipv4/tcp_ipv4.c`	+6 -8	0 replies
506/609	bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items`net/ipv4/tcp_ipv4.c`	+14 ~~-10~~	0 replies
507/609	bpf: tcp: Avoid socket skips and repeats during iteration`net/ipv4/tcp_ipv4.c`	+115 ~~-32~~	0 replies
508/609	bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()`net/ipv4/tcp_ipv4.c`	+24 ~~-19~~	0 replies
509/609	vhost/vdpa: reject overflowing PA map page counts on 32-bit`drivers/vhost/vdpa.c`	+8 -1	0 replies
510/609	udp: fix potential use-after-free in tunnel segmentation`net/ipv4/udp_offload.c`	+3 -1	0 replies
511/609	net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter`net/sched/sch_cake.c`	+0 -1	0 replies
512/609	net/openvswitch: check Ethernet header length in key_extract()`net/openvswitch/flow.c`	+7 -4	0 replies
513/609	hwmon: (nzxt-smart2) Check return value of init_device() in probe`drivers/hwmon/nzxt-smart2.c`	+5 -1	0 replies
514/609	hwmon: (lm25066) Use i2c_get_match_data()`drivers/hwmon/pmbus/lm25066.c`	+3 ~~-11~~	0 replies
515/609	hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations`drivers/hwmon/pmbus/lm25066.c`	+3 -2	0 replies
516/609	selftests/ftrace: refactor eprobes test to fix argument checks`tools/testing/selftests/ftrace/test.d/dynevent/add_remove_eprobe.tc`	+5 ~~-11~~	0 replies
517/609	bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips`drivers/net/ethernet/broadcom/bnxt/bnxt.c` `drivers/net/ethernet/broadcom/bnxt/bnxt.h`	+9 -1	0 replies
518/609	bnxt_en: Disable EOP for TPA on all chips to prevent data corruption`drivers/net/ethernet/broadcom/bnxt/bnxt.c`	+7 -4	0 replies
519/609	bnxt_en: Fix PTP PPS setting bug`drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c`	+5 -2	0 replies
520/609	sctp: fix addip_serial increment on ASCONF_ACK allocation failure`net/sctp/sm_make_chunk.c`	+1 -2	0 replies
521/609	tcp: fix TFO max_qlen accounting across reuseport migration`net/ipv4/inet_connection_sock.c`	+16 -4	0 replies
522/609	net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length`net/ncsi/ncsi-netlink.c`	+4 -0	0 replies
523/609	net: prestera: validate firmware header length`drivers/net/ethernet/marvell/prestera/prestera_pci.c`	+3 -0	0 replies
524/609	net: remove WARN_ON_ONCE() from sk_mc_loop()`net/core/sock.c`	+0 -1	0 replies
525/609	net/smc: fix TOCTOU race between smc_listen_out() and listener close`net/smc/af_smc.c`	+2 -1	0 replies
526/609	net: qrtr: ns: Raise lookup limit to 128`net/qrtr/ns.c`	+1 -1	0 replies
527/609	net: thunderbolt: Tear down DMA paths before stopping the rings`drivers/net/thunderbolt.c`	+15 -5	0 replies
528/609	ata: pata_sl82c105: fix bridge revision use-after-free`drivers/ata/pata_sl82c105.c`	+3 -1	0 replies
529/609	net/atm: fix slab-out-of-bounds read in vcc_setsockopt()`net/atm/common.c`	+9 -5	0 replies
530/609	sctp: clear control chunk transport if it is being removed`net/sctp/associola.c`	+4 -0	0 replies
531/609	tls: dont abort the connection on signal-interrupted sends`net/tls/tls_sw.c`	+1 -1	0 replies
532/609	hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination`drivers/hwmon/corsair-psu.c`	+2 -2	0 replies
533/609	regulator: devres: add API for reference voltage supplies`Documentation/driver-api/driver-model/devres.rst` `drivers/regulator/devres.c` `include/linux/regulator/consumer.h`	+67 -0	0 replies
534/609	hwmon: (ads7828) Fix external VREF regulator handling`drivers/hwmon/ads7828.c`	+6 -5	0 replies
535/609	KVM: x86/mmu: Rename __direct_map() to direct_map()`arch/x86/kvm/mmu/mmu.c` `arch/x86/kvm/mmu/mmu_internal.h` `arch/x86/kvm/mmu/paging_tmpl.h`	+33 ~~-37~~	0 replies
536/609	KVM: x86: Check for invalid/obsolete root after making MMU pages available`arch/x86/kvm/mmu/mmu.c` `arch/x86/kvm/mmu/paging_tmpl.h`	+11 -8	0 replies
537/609	spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers`drivers/spi/spi-fsl-dspi.c`	+7 -6	0 replies
538/609	Input: evdev - sanitize event type index when fetching event masks`drivers/input/evdev.c`	+4 -1	0 replies
539/609	ALSA: usb-audio: fix OOB write on Type II inbound URBs`sound/usb/endpoint.c`	+4 -2	0 replies
540/609	usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()`drivers/usb/atm/cxacru.c`	+2 -0	0 replies
541/609	thunderbolt: icm: Preserve USB4 proxy data-valid bit`drivers/thunderbolt/icm.c`	+1 -1	0 replies
542/609	usb: cdnsp: fix incorrect endian conversions for APB timeout register`drivers/usb/cdns3/cdnsp-gadget.c`	+2 -2	0 replies
543/609	usb: gadget: f_ncm: Use unsigned int for ndp_index`drivers/usb/gadget/function/f_ncm.c`	+1 -1	0 replies
544/609	net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()`drivers/net/usb/ax88179_178a.c`	+3 -1	0 replies
545/609	vt: add permission check for KDSKBMETA ioctl`drivers/tty/vt/vt_ioctl.c`	+2 -0	0 replies
546/609	vt: stabilize tty reference in kbd_keycode with tty_port_tty_get`drivers/tty/vt/keyboard.c`	+4 -1	0 replies
547/609	Input: evdev - fix information leak in evdev_pass_values()`drivers/input/evdev.c`	+12 ~~-10~~	0 replies
548/609	ima: fix out-of-bounds read in xattr_verify()`security/integrity/ima/ima_appraise.c`	+7 -2	0 replies
549/609	ipvs: add totalconns for dest`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_conn.c` `net/netfilter/ipvs/ip_vs_ctl.c` +4 more	+28 ~~-38~~	0 replies
550/609	ipvs: properly update the overload flag on dest edit`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_conn.c` `net/netfilter/ipvs/ip_vs_ctl.c`	+72 ~~-25~~	0 replies
551/609	ipvs: clear IPv4 options after rebasing tunnel ICMP errors`net/netfilter/ipvs/ip_vs_core.c`	+1 -0	0 replies
552/609	net/packet: reset the MAC header on the packet-socket transmit path`net/packet/af_packet.c`	+4 -3	0 replies
553/609	net: openvswitch: reallocate update replies for mismatched IDs`net/openvswitch/datapath.c`	+26 -3	0 replies
554/609	net/sched: reject overly deep qdisc hierarchies`include/net/sch_generic.h` `net/sched/sch_api.c`	+10 -0	0 replies
555/609	net: octeontx2-pf: Fix UB in shift operation`drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c`	+4 -2	0 replies
556/609	net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header`include/linux/netdevice.h`	+0 -5	0 replies
557/609	netfilter: ebt_nflog: pin the NFLOG backend`net/bridge/netfilter/ebt_nflog.c`	+16 -1	0 replies
558/609	net: bridge: mrp: fix uninitialised bytes on the wire`net/bridge/br_mrp.c`	+2 -4	0 replies
559/609	futex: Prevent robust futex exit race some more`kernel/futex/core.c`	+56 ~~-26~~	0 replies
560/609	fortify: refactor test_fortify Makefile to fix some build problems`lib/.gitignore` `lib/Makefile` `lib/test_fortify/.gitignore` +2 more	+33 ~~-35~~	0 replies
561/609	fortify: Disable -Wstringop-overread in tests`lib/test_fortify/Makefile`	+1 -0	0 replies
562/609	pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP`drivers/pinctrl/renesas/pinctrl-rzg2l.c`	+2 -2	0 replies
563/609	RDMA/rxe: Fix a use-after-free problem in rxe_mmap`drivers/infiniband/sw/rxe/rxe_mmap.c`	+16 -3	0 replies
564/609	fscrypt: Replace mk_users keyring with simple list`fs/crypto/fscrypt_private.h` `fs/crypto/keyring.c`	+113 ~~-131~~	0 replies
565/609	selftests/bpf: Adapt sockmap update error handling`tools/testing/selftests/bpf/prog_tests/sockmap_listen.c`	+11 ~~-10~~	0 replies
566/609	selftests/bpf: Fail unbound UDP on sockmap update`tools/testing/selftests/bpf/test_maps.c`	+6 -7	0 replies
567/609	ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops`net/ipv4/fib_semantics.c`	+49 ~~-18~~	0 replies
568/609	ipv4: fix use-after-free in fib_nhc_update_mtu()`include/net/route.h` `net/ipv4/fib_semantics.c` `net/ipv4/route.c`	+42 ~~-23~~	0 replies
569/609	serial: 8250_dma: Clear stale RX state on shutdown`drivers/tty/serial/8250/8250_dma.c`	+7 -5	0 replies
570/609	staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()`drivers/staging/rtl8723bs/core/rtw_ieee80211.c`	+3 -0	0 replies
571/609	staging: rtl8723bs: fix OOB read in WMM_param_handler()`drivers/staging/rtl8723bs/core/rtw_wlan_util.c`	+3 -0	0 replies
572/609	staging: rtl8723bs: fix missing shared-key auth challenge length check`drivers/staging/rtl8723bs/core/rtw_mlme_ext.c`	+1 -1	0 replies
573/609	staging: rtl8723bs: validate monitor transmit frame lengths`drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c`	+4 -0	0 replies
574/609	misc: fastrpc: fix channel ctx ref leak when session alloc fails`drivers/misc/fastrpc.c`	+1 -1	0 replies
575/609	misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free`drivers/misc/fastrpc.c`	+1 -0	0 replies
576/609	ring-buffer: Fix crash passing ERR_PTR to kthread_stop()`kernel/trace/ring_buffer.c`	+1 -1	0 replies
577/609	ALSA: usx2y: bound the hwdep mmap fault offset`sound/usb/usx2y/usX2Yhwdep.c` `sound/usb/usx2y/usx2yhwdeppcm.c`	+4 -0	0 replies
578/609	tracing: Fix race between update_event_fields and, event_define_fields`kernel/trace/trace_events.c`	+2 -0	0 replies
579/609	fbdev: bitblit: bound-check glyph index in bit_cursor()`drivers/video/fbdev/core/bitblit.c`	+7 -2	0 replies
580/609	net: smc: fix splice entry lifetime imbalance in smc_rx_splice`net/smc/smc_rx.c`	+10 -9	0 replies
581/609	ipv6: prevent in6_dev_get() from resurrecting inet6_dev`include/net/addrconf.h`	+2 -2	0 replies
582/609	netfilter: bridge: release template ct on non-IP path`net/bridge/netfilter/nf_conntrack_bridge.c`	+1 -0	0 replies
583/609	net: atlantic: free stranded TX buffers on ring deinit`drivers/net/ethernet/aquantia/atlantic/aq_ring.c` `drivers/net/ethernet/aquantia/atlantic/aq_ring.h` `drivers/net/ethernet/aquantia/atlantic/aq_vec.c`	+31 -1	0 replies
584/609	net: atlantic: free RX pages of consumed but not refilled buffers`drivers/net/ethernet/aquantia/atlantic/aq_ring.c`	+18 -4	0 replies
585/609	net/sched: act_gact, act_police: range check the fallback control action`include/net/act_api.h` `net/sched/act_gact.c` `net/sched/act_police.c`	+30 -0	0 replies
586/609	xdp: reject clones that overrun skb_shared_info tailroom`net/core/xdp.c`	+1 -1	0 replies
587/609	vxlan: do not arm the ageing timer on a device that is down`drivers/net/vxlan/vxlan_core.c`	+1 -1	0 replies
588/609	vsock/virtio: read virtqueues under worker locks`net/vmw_vsock/virtio_transport.c`	+6 -5	0 replies
589/609	vsock/virtio: avoid refilling the RX queue after teardown`net/vmw_vsock/virtio_transport.c`	+2 -1	0 replies
590/609	vhost: reset the vring metadata cache on vring reconfiguration`drivers/vhost/vhost.c`	+8 -0	0 replies
591/609	tipc: read le->link under the node lock in tipc_node_link_down()`net/tipc/node.c`	+10 -5	0 replies
592/609	smb: client: Fix use-after-free in cifs_try_adding_channels()`fs/smb/client/sess.c`	+1 -1	0 replies
593/609	KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page`arch/x86/kvm/mmu/mmu.c`	+3 -0	0 replies
594/609	Revert "thermal/drivers/hwmon: Cleanup coding style a bit"`drivers/thermal/thermal_hwmon.c`	+2 -1	0 replies
595/609	ptp: ocp: Fix board ID over-read`drivers/ptp/ptp_ocp.c`	+3 -1	0 replies
596/609	ring-buffer: Use current_context for safe per-CPU buffer swap`kernel/trace/ring_buffer.c`	+4 -4	0 replies
597/609	ipv6: fix Route Information option length validation`net/ipv6/route.c`	+4 -4	0 replies
598/609	ip6_tunnel: clear skb2->cb[] in ip6ip6_err()`net/ipv6/ip6_tunnel.c`	+3 -0	0 replies
599/609	sched/psi: Shut down rtpoll_timer in psi_cgroup_free()`kernel/sched/psi.c`	+6 -0	0 replies
600/609	bpf, sockmap: Fix sk_redir use-after-free in send verdict`net/ipv4/tcp_bpf.c`	+2 -0	0 replies
601/609	scsi: scsi_debug: Negate wrapped memcmp() result`drivers/scsi/scsi_debug.c`	+2 -2	0 replies
602/609	sctp: keep chunk->transport in step with the list it is queued on`net/sctp/outqueue.c`	+1 -0	0 replies
603/609	sctp: fix use-after-free of cached ASCONF chunk`net/sctp/associola.c` `net/sctp/sm_statefuns.c`	+8 -2	0 replies
604/609	sctp: clear new_transport when removing a peer`net/sctp/associola.c`	+3 -0	0 replies
605/609	thunderbolt: Bound the DROM dual link port number before indexing sw->ports`drivers/thunderbolt/eeprom.c`	+8 -1	0 replies
606/609	bpf: tcp: fix double sock release on batch realloc`net/ipv4/tcp_ipv4.c`	+4 -1	0 replies
607/609	regulator: devres: fix devm_regulator_get_enable_read_voltage() return`drivers/regulator/devres.c`	+1 -1	0 replies
608/609	hwmon: (nct6775) Fix register for nct6799`drivers/hwmon/nct6775-platform.c`	+1 -1	0 replies
609/609	hwmon: (nct6775) Fix non-existent ALARM warning`drivers/hwmon/nct6775-core.c`	+4 -0	0 replies

Reviews trailers per patch

327 of 609 patches have a Reviewed-by or Acked-by.

Patch	Srinivas Pandruvada	Ilpo Järvinen	Frank Li	John Madieu	Tommaso Merciai	Arnd Bergmann	Cheng Xu	Junxian Huang	Bernard Metzler	Florian Westphal	Christian Lamparter	Arend van Spriel	Martin Blumenstingl	Mario Limonciello (AMD)	Qingfang Deng	Ido Schimmel	Hidayath Khan	Salvador Blaya	Johan Hovold	Bartosz Golaszewski	ChenXiaoSong	Qu Wenruo	David Sterba	Johannes Thumshirn	Kuniyuki Iwashima	Jakub Sitnicki	John Fastabend	Alan Stern	Peter Chen	Oleksij Rempel	Lukas Wunner	Daniel Borkmann	Dave Hansen	Namjae Jeon	Toke Høiland-Jørgensen	Baochen Qiang	Rameshkumar Sundaram	[email protected]	Raj Kumar Bhagat	Victor Nogueira	Davide Caratti	David Ahern	Vasanthakumar Thiagarajan	Paulo Alcantara (Red Hat)	Willem de Bruijn	Hangbin Liu	Allison Henderson	Simon Horman	Ioana Ciornei	Francesco Dolcini	Ankit Soni	Patrick Oppenlander	Xin Long	Eelco Chaudron	Tung Nguyen	Lorenzo Bianconi	Taehee Yoo	Stanislaw Gruszka	Joe Damato	Cosmin Ratiu	Carolina Jubran	Pavan Chebbi	Emil Tsalapatis	Chaoyi Chen	Ronak Doshi	Sankararaman Jayaraman	Lyude Paul	Christian König	Matthew Brost	Tvrtko Ursulin	David Yat Sin	Vitaly Prosyak	Vadim Fedorenko	Sebastian Brzezinka	Maarten Lankhorst	Andi Shyti	Alex Deucher	Maaz Mombasawala	Maxime Chevallier	Jakub Raczynski	Fernando Fernandez Mancera	Felix Maurer	Paul Kocialkowski	Luca Ceresoli	Yemike Abhilash Chandra	Nicolas Dufresne	Marek Szyprowski	Jernej Skrabec	Chen-Yu Tsai	David Hildenbrand (Arm)	Yao Zi	Xi Ruoyao	Ard Biesheuvel	Jinjie Ruan	Matthieu Baerts (NGI0)	Viacheslav Dubeyko	Alex Markuze	Ilya Dryomov	Jori Koolstra	Christoph Hellwig	Kevin Tian	Samiullah Khawaja	Jason Gunthorpe	Alexandra Winter	Martin Schiller	Jacob Keller	Magnus Lindholm	Andy Shevchenko	Rinitha S	Antoine Tenart	Eric Dumazet	Tao Zhou	Anup Patel	Dawid Osuchowski	Aleksandr Loktionov	Kunwu Chan	Jiayuan Chen	Ilya Maximets	Aaron Conole	[email protected]	Yuezhang Mo	Sungjong Seo	Srikanth Aithal	K Prateek Nayak	Tom Lendacky	Breno Leitao	Ricardo Ribalda	Laurent Pinchart	Hans de Goede	Jordan Rhee	Przemek Kitszel	Asad Kamal	Niklas Cassel	Leo Liu	Talha Berk Arslan	Chris Leech	Michal Simek	John Garry	Jason Yan	Damien Le Moal	Sebastian Arnhold	Corentin Labbe	Ahmad Khalifa	Nikolay Aleksandrov	Zhu Yanjun	CK Hu	Jarkko Sakkinen	Andrew Lunn	M Nikhil	Chinmaya Kajagar	Nihar Panda	Mike Christie	NeilBrown	Dennis Zhou	Muchun Song	Christian Borntraeger	Matthew Rosato	Shuangpeng Bai	Ritesh Harjani (IBM)	Jozsef Kadlecsik	David Rientjes	Michael S. Tsirkin	Geert Uytterhoeven	Caleb Sander Mateos	Lorenzo Stoakes	Bart Van Assche	Linus Walleij	Viresh Kumar	Zhongqiu Han	Eduard Shishkin	Stefan Haberland	Finn Callies	Harald Freudenberger	Lakshmi Sowjanya D	Dmitry Baryshkov	Dima Ruinskiy	Julian Anastasov	Mahanta Jambigi	Vincent Mailhol	Pavel Pisa	Ankit Nautiyal	Maíra Canal	Iago Toral Quiroga	Hawking Zhang	Yang Wang	David Francis	Kent Russell	Alysa Liu	Kohei Enju	Alexander Nowlin	Ian Forbes	Klaus Kudielka	Josua Mayer	Zi Yan	Baolin Wang	Miaohe Lin	Carlos Song	Filipe Manana	Daniel Wade	Shung-Hsi Yu	Sidraya Jayagond	Dust Li	Santosh Kalluri	Shay Drori	Joshua Crofts	Stanislav Fomichev	Holger Dengler	Andy Gospodarek	Somnath Kotur	Kalesh AP	Elad Nachman	Dan Aloni	Avi Fishman	Mika Westerberg	Jay Vosburgh	Greg Kroah-Hartman	Jamal Hadi Salim	Ratheesh Kannoth	Sunil Goutham	nasm	Isaku Yamahata	Sukhdeep Singh	Mina Almasry	Bobby Eshleman	Lukasz Luba	Johannes Weiner	Matt Fleming	Suren Baghdasaryan	Jordan Rife	Ekansh Gupta	Vincent Donnefort	Masami Hiramatsu (Google)	Peter Schneider	Pavel Machek (CIP)	Florian Fainelli	Ron Economos	Brett A C Sheffield	Mark Brown	Shuah Khan	Miguel Ojeda
Series																																																		T-b																																																																																																																																																																																							T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b
1/609	A-b	R-b
2/609
3/609
4/609						T-b
5/609
6/609
7/609
8/609
9/609
10/609
11/609
12/609
13/609
14/609
15/609
16/609
17/609
18/609
19/609			R-b	T-b	T-b
20/609
21/609
22/609
23/609
24/609
25/609
26/609
27/609
28/609																						R-b	R-b
29/609																						R-b	R-b	R-b
30/609
31/609
32/609							R-b
33/609								R-b
34/609									A-b
35/609									A-b
36/609
37/609
38/609
39/609										R-b
40/609
41/609
42/609
43/609
44/609											A-b
45/609
46/609
47/609
48/609
49/609
50/609
51/609												A-b
52/609
53/609													R-b
54/609														R-b
55/609
56/609
57/609															R-b
58/609																R-b
59/609																	R-b
60/609
61/609
62/609																		T-b
63/609																			R-b	A-b
64/609																					R-b
65/609
66/609																									R-b	R-b	R-b
67/609																														T-b A-b
68/609																																		A-b
69/609
70/609																																								T-b	R-b
71/609
72/609																																										R-b
73/609
74/609																												A-b
75/609			R-b
76/609																												R-b
77/609
78/609																													R-b
79/609
80/609
81/609
82/609
83/609
84/609
85/609
86/609
87/609
88/609																															R-b
89/609
90/609																																A-b
91/609																																A-b	A-b
92/609																																A-b
93/609																																A-b
94/609																																A-b
95/609																																A-b
96/609
97/609
98/609																																			A-b
99/609																																				R-b	R-b
100/609																																						T-b
101/609
102/609
103/609
104/609																																				R-b	R-b
105/609																																				R-b			R-b
106/609
107/609
108/609																																											R-b
109/609											A-b
110/609											A-b
111/609											A-b
112/609																						R-b	R-b
113/609																						R-b
114/609
115/609
116/609																																																										A-b
117/609
118/609
119/609
120/609																																												R-b
121/609
122/609																																													R-b
123/609																																														R-b
124/609																																															R-b T-b
125/609																																																R-b
126/609																																																	R-b T-b
127/609																																																	R-b R-b
128/609																																																R-b
129/609
130/609																																																		R-b
131/609																																																			R-b
132/609
133/609
134/609																																																				T-b
135/609																																																					A-b
136/609																																																					A-b
137/609
138/609																									R-b
139/609																																																						R-b
140/609
141/609																R-b
142/609																																																							R-b R-b
143/609																																																								A-b
144/609
145/609												A-b
146/609																																																R-b									R-b
147/609																																																R-b									R-b
148/609																R-b
149/609																																																																																	R-b	R-b
150/609																																																					A-b
151/609																																																R-b																	R-b	R-b
152/609																																																R-b																									R-b
153/609																																																																															R-b	R-b
154/609																																																																															R-b	R-b
155/609																																																R-b
156/609																																										R-b
157/609																																			R-b
158/609
159/609
160/609															R-b
161/609																																																											R-b
162/609
163/609																																																												R-b
164/609																																																													R-b	R-b
165/609																																																													R-b	R-b
166/609																																																											R-b
167/609																										R-b																																					R-b
168/609																																																																R-b
169/609																																																																			R-b
170/609																																																																			R-b
171/609																																																																			R-b
172/609																																																																				R-b
173/609																																																																					R-b	R-b
174/609
175/609																																																																				A-b
176/609																																																																							R-b
177/609
178/609																																																																								R-b
179/609																																																																								R-b
180/609																																																																								R-b
181/609																																																																										R-b	R-b
182/609																																																																											R-b
183/609																																																																											R-b	R-b
184/609																																																																													R-b
185/609
186/609																																																																				R-b									R-b
187/609																																																																														R-b
188/609
189/609
190/609
191/609																																																																																			R-b
192/609																																																																																			A-b
193/609																																																																																						R-b		A-b	T-b
194/609
195/609
196/609
197/609
198/609
199/609
200/609
201/609
202/609
203/609
204/609
205/609
206/609
207/609
208/609																																																																																				R-b
209/609																																																																																					R-b
210/609
211/609																																																																																						R-b
212/609																																																																																							A-b
213/609
214/609
215/609																																																																																						R-b
216/609																																																																																						R-b
217/609
218/609
219/609																																											R-b
220/609																																																		R-b
221/609
222/609
223/609
224/609												A-b
225/609
226/609
227/609
228/609
229/609																																																																																										R-b
230/609
231/609																																																																																											T-b	T-b
232/609
233/609																																																																																													A-b
234/609
235/609																				A-b
236/609																																																																																																												R-b
237/609																			R-b
238/609
239/609
240/609
241/609
242/609
243/609
244/609																																																																																														R-b T-b
245/609
246/609																																																																																															R-b
247/609																																																																																															R-b
248/609																																																					A-b
249/609																																																																																																R-b
250/609																																																																																																R-b
251/609																																																																																																R-b
252/609																																																																																																R-b
253/609																																																																																																	R-b
254/609																																																																																																		R-b
255/609																																																																																																		R-b
256/609																																																																																																R-b
257/609																																																																																																			R-b
258/609																																																																																																				R-b
259/609
260/609																																																																																																					R-b	R-b	R-b
261/609
262/609																																																																																	R-b
263/609
264/609																																																																																	R-b
265/609																																																																																																								R-b
266/609
267/609																																																																																																									A-b
268/609																																																																																																										R-b
269/609																																																																																																											T-b
270/609																																																																																																		R-b
271/609																																		A-b
272/609																																																R-b																																																													T-b
273/609																																																R-b																																																														R-b
274/609																																																R-b
275/609																																																R-b
276/609																																																																									R-b																																						R-b
277/609																																																R-b							R-b																																																																							R-b
278/609																																																																																																																																				R-b
279/609																																																																								R-b
280/609																																																																								R-b
281/609																																																																								R-b
282/609																																																																								R-b
283/609																																																																													R-b
284/609																																																																													R-b																																																									R-b
285/609																																																																																																																R-b
286/609																																																																																																																	R-b
287/609																																																R-b																																																													T-b					R-b	R-b	R-b
288/609																																																																																																																					R-b
289/609																																																							R-b
290/609																																																																																																																						R-b	R-b
291/609																																																																																																				R-b
292/609																																																																																																																								T-b	R-b	R-b
293/609
294/609																																																																																																																											T-b	R-b	R-b
295/609
296/609
297/609
298/609																																																																																																																						T-b
299/609																R-b
300/609
301/609																																																																																																																															R-b
302/609																																																																																																																																R-b	R-b
303/609																																																																																																																																		R-b	R-b
304/609
305/609
306/609
307/609																																																R-b
308/609
309/609
310/609			R-b																																																																																					A-b
311/609
312/609																																																																																																																																	R-b
313/609																																																																																																																																					R-b
314/609
315/609
316/609
317/609
318/609																																																																																																																																									A-b
319/609																																																																																																																																									R-b
320/609																																																																																																																																									R-b
321/609
322/609																																																																																																																																																		R-b
323/609																																																																																																																																																			R-b T-b
324/609																																																																																																																																																			R-b T-b
325/609																																																																																																																																																			R-b T-b
326/609																																																																																																																																							Reported-and-tested-by
327/609																																										R-b
328/609
329/609
330/609
331/609
332/609																																															R-b
333/609																																															R-b
334/609
335/609																																																																																																																																								A-b
336/609																																																																																																																																								A-b
337/609																																																																																																																																										R-b
338/609																																																																																																																																											R-b	R-b
339/609																																																																																																																																										R-b
340/609
341/609																																																																																																																																													T-b	T-b
342/609
343/609
344/609
345/609
346/609																																																																																																																																															T-b
347/609
348/609
349/609
350/609																R-b
351/609
352/609																																																																																																																																																A-b
353/609																																																																									R-b																																																																								R-b
354/609
355/609
356/609
357/609
358/609
359/609
360/609
361/609
362/609																																																																																																																																																															R-b
363/609																																																																																																																																																															R-b
364/609																																																																																																																																																															R-b
365/609
366/609
367/609
368/609																																																																																																																																																				R-b
369/609																																																																																																																																																					T-b A-b	R-b	R-b
370/609																																																																																																																																																								R-b
371/609																																																																									R-b
372/609																																																																									R-b
373/609
374/609
375/609																																																R-b
376/609																																																																																																										R-b
377/609
378/609
379/609																R-b
380/609
381/609																																																																																																																																																									R-b
382/609																																																																																																												R-b
383/609
384/609
385/609																																																																																																																																																										A-b
386/609																																																																																																																																																											R-b
387/609
388/609																																																																																																																																																												R-b	R-b T-b
389/609																																																																																																																																																												R-b	R-b T-b
390/609																																																																																																																																																												R-b	R-b T-b
391/609																																																					A-b
392/609
393/609
394/609
395/609
396/609
397/609																																																																																																																																																														Reported-and-tested-by
398/609
399/609
400/609
401/609
402/609
403/609
404/609
405/609			R-b																																																																																																																																																																											T-b	R-b
406/609																																																																																																																																																																																R-b
407/609
408/609																																																																																																																																																																																	A-b
409/609																																																																																																																																																																																		R-b
410/609																																																																																																																																																																A-b
411/609																																																							R-b
412/609
413/609
414/609																																																																																										A-b																																																																							A-b	A-b
415/609																																																																																																																																																A-b
416/609																R-b
417/609																																																																																																																																																															R-b				R-b
418/609
419/609																																																																									R-b
420/609
421/609																																																																									R-b
422/609																																																																									R-b
423/609																																																																																																																																																																				R-b
424/609
425/609
426/609																																																																																										A-b																																																																											R-b
427/609																																																																																																																																												R-b																										R-b
428/609																																																					A-b
429/609																																																					A-b
430/609
431/609
432/609																																																																																																																																																																							R-b
433/609																																																																																																																																																																								A-b	R-b
434/609
435/609																																																																																																								R-b																																																				R-b
436/609																																																																																																																																																																										A-b	R-b
437/609																																																																																																																																																																												R-b
438/609																																																																																																																																																																													R-b
439/609																																																																																																																																																																													R-b
440/609																																																																																																																																									A-b
441/609																																																																																																																																									A-b
442/609																																																																																																																																									A-b
443/609																																																						R-b
444/609																																																																																																																							R-b
445/609																																																																																																																			R-b																R-b																																																										R-b	T-b
446/609
447/609			R-b																																																																																																																																																																																																		A-b
448/609			R-b																																																																																																																																																																																																		A-b
449/609
450/609
451/609																																																																																																																																																																																			R-b
452/609
453/609																														A-b
454/609
455/609
456/609
457/609																																																																																																																																																																																			R-b
458/609																																																																																																																																																																																			R-b
459/609
460/609																																																																																																																																																																																				A-b
461/609																																																																																																																																																																																				A-b
462/609																																																																																																																																																																																				A-b
463/609																																																																																																																																																																																				A-b
464/609
465/609																																																																																																																																																																																					R-b
466/609																																																																																																																																																																																						R-b	R-b
467/609																																																																																																																																																																																							R-b
468/609																																																																																																																																																																																								R-b	R-b
469/609																																																																																																																																																																																										R-b
470/609																																																																																																																																																																																											R-b
471/609																																																																																																																																																																																												R-b
472/609																																																																																																																																																																																															R-b
473/609																																																																																																																																																																																															R-b
474/609																																																																																																																																																																																															R-b
475/609
476/609																																																																																																																																																																																																T-b	A-b
477/609																																																																																							T-b
478/609																																																																																										A-b
479/609																																																																																										A-b																																																																																																								R-b	R-b	R-b
480/609																																																																																																																							R-b
481/609
482/609																																																																																																																																																																							R-b
483/609
484/609
485/609
486/609
487/609																																																																																																																																																																																																															R-b
488/609																																																																																																																																																																																																																				T-b
489/609																																																																																																																																																																																																																					R-b
490/609																																																																																																																																																																																																																						A-b
491/609																																																																																																																																																R-b																																																																							A-b
492/609
493/609
494/609
495/609																							R-b																																																																																																																																																																															R-b
496/609																																																																																																																																																																																																							T-b	A-b
497/609																	R-b																																																																																																																																																																																								R-b	R-b
498/609																																								T-b																																																																																																																																																																			T-b
499/609
500/609																																																																																																																																																																																																												R-b
501/609																																																																																																																																																																																																													R-b
502/609																																																R-b
503/609																									R-b																																																																																																																																																																																					A-b
504/609																									R-b																																																																																																																																																																																					A-b
505/609																									R-b																																																																																																																																																																																					A-b
506/609																									R-b																																																																																																																																																																																					A-b
507/609																																																																																																																																																																																																														A-b
508/609																									R-b
509/609																																																																																																																																																																		A-b
510/609																																																																																																														R-b
511/609
512/609																																																						R-b																																																																R-b
513/609
514/609
515/609
516/609
517/609																																																																																																																																																																																																																R-b	R-b
518/609																																																														R-b																																																																																																																																																				R-b
519/609																																																														R-b
520/609																																																					A-b
521/609																									R-b																																																																																						R-b
522/609
523/609																																																																																																																																																																																																																			A-b
524/609
525/609																																																																																																																														R-b																																																				R-b																								R-b
526/609
527/609																																																																																																																																																																																																																						A-b
528/609																																																																																																																																					R-b
529/609
530/609
531/609
532/609
533/609
534/609
535/609																																																																																																																																																																																																																													R-b
536/609
537/609
538/609																																																																																																																																																																																																																								A-b
539/609
540/609
541/609
542/609						A-b
543/609
544/609
545/609
546/609
547/609
548/609
549/609
550/609
551/609																																																																																																																																																																																	A-b
552/609																																													R-b
553/609																																																																																																																						R-b
554/609																																								R-b																																																																																																																																																																																	A-b
555/609																																																																																																																																																																																																																										R-b	R-b
556/609																																													R-b
557/609
558/609																																																																																																																																																A-b
559/609
560/609
561/609
562/609																				R-b																																																																																																																																															R-b T-b
563/609																																																																																																																																																																																																																												Reported-and-tested-by
564/609
565/609																									R-b	R-b
566/609																									R-b	R-b
567/609																R-b
568/609																R-b
569/609
570/609
571/609
572/609
573/609
574/609																																																																																																																																																																															R-b
575/609																																																																																																																																																																																																																																						R-b
576/609																																																																																																																																																																																																																																							R-b	A-b
577/609
578/609
579/609
580/609																																																																																																																																																																																																									R-b	R-b
581/609																R-b
582/609
583/609																																																																																																																																																																																																																														R-b	A-b
584/609																																																																																																																																																																																																																														R-b	A-b
585/609																																								T-b																																																																																																																																																																																	A-b
586/609
587/609																R-b
588/609																																																																																																																																																																																																																																R-b
589/609																																																																																																																																																																																																																																R-b
590/609
591/609																																																							R-b
592/609
593/609
594/609																																																																																																																																																																																																																																	R-b
595/609																																																																									R-b
596/609
597/609																R-b
598/609																R-b
599/609																																																																																																																																																																																																																																		A-b	T-b	A-b
600/609																											R-b																																				R-b
601/609																																																																																																																																										R-b
602/609																																																					A-b
603/609																																																					A-b
604/609																																																					A-b
605/609
606/609																																																																																																															R-b																																																																																																																						R-b
607/609
608/609
609/609

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 240 reviewers.

Read the v1 thread

Cover letter [PATCH 6.1 000/609] 6.1.183-rc1 review

This is the start of the stable review cycle for the 6.1.183 release. There are 609 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.183-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.1.183-rc1

Ahmad Khalifa <[email protected]>
hwmon: (nct6775) Fix non-existent ALARM warning

Ahmad Khalifa <[email protected]>

    hwmon: (nct6775) Fix register for nct6799

David Lechner <[email protected]>
regulator: devres: fix devm_regulator_get_enable_read_voltage() return

Xiang Mei (Microsoft) <[email protected]>
bpf: tcp: fix double sock release on batch realloc

Bryam Vargas <[email protected]>

    thunderbolt: Bound the DROM dual link port number before indexing sw->ports

Qing Ming <[email protected]>
sctp: clear new_transport when removing a peer

Yuxiang Yang <[email protected]>
sctp: fix use-after-free of cached ASCONF chunk

Baul Lee <[email protected]>

    sctp: keep chunk->transport in step with the list it is queued on

Xu Rao <[email protected]>
scsi: scsi_debug: Negate wrapped memcmp() result

Chengfeng Ye <[email protected]>
bpf, sockmap: Fix sk_redir use-after-free in send verdict

Tejun Heo <[email protected]>
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()

Zhiling Zou <[email protected]>

    ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

Yuejie Shi <[email protected]>
ipv6: fix Route Information option length validation

Tengda Wu <[email protected]>
ring-buffer: Use current_context for safe per-CPU buffer swap

Ahmad Byagowi <[email protected]>
ptp: ocp: Fix board ID over-read

Rafael J. Wysocki <[email protected]>
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"

Sean Christopherson <[email protected]>
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page

Shuangpeng Bai <[email protected]>
smb: client: Fix use-after-free in cifs_try_adding_channels()

Jun Yang <[email protected]>

    tipc: read le->link under the node lock in tipc_node_link_down()

Jun Yang <[email protected]>
vhost: reset the vring metadata cache on vring reconfiguration

Weiming Shi <[email protected]>
vsock/virtio: avoid refilling the RX queue after teardown

Weiming Shi <[email protected]>
vsock/virtio: read virtqueues under worker locks

Baul Lee <[email protected]>
vxlan: do not arm the ageing timer on a device that is down

Zhiling Zou <[email protected]>
xdp: reject clones that overrun skb_shared_info tailroom

Hyunjung Ko <[email protected]>
net/sched: act_gact, act_police: range check the fallback control action

Yangyu Chen <[email protected]>
net: atlantic: free RX pages of consumed but not refilled buffers

Yangyu Chen <[email protected]>
net: atlantic: free stranded TX buffers on ring deinit

Zhiling Zou <[email protected]>
netfilter: bridge: release template ct on non-IP path

Kyle Zeng <[email protected]>
ipv6: prevent in6_dev_get() from resurrecting inet6_dev

Daming Li <[email protected]>
net: smc: fix splice entry lifetime imbalance in smc_rx_splice

Rik van Riel <[email protected]>
fbdev: bitblit: bound-check glyph index in bit_cursor()

Michael Wu <[email protected]>
tracing: Fix race between update_event_fields and, event_define_fields

Baul Lee <[email protected]>
ALSA: usx2y: bound the hwdep mmap fault offset

Hui Su <[email protected]>
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()

Eddie Lin <[email protected]>
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free

Anandu Krishnan E <[email protected]>
misc: fastrpc: fix channel ctx ref leak when session alloc fails

Mariano Baragiola <[email protected]>
staging: rtl8723bs: validate monitor transmit frame lengths

Panagiotis Petrakopoulos <[email protected]>
staging: rtl8723bs: fix missing shared-key auth challenge length check

Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in WMM_param_handler()

Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

Cunhao Lu <[email protected]>
serial: 8250_dma: Clear stale RX state on shutdown

Chengfeng Ye <[email protected]>
ipv4: fix use-after-free in fib_nhc_update_mtu()

Zihan Xi <[email protected]>
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops

Michal Luczaj <[email protected]>
selftests/bpf: Fail unbound UDP on sockmap update

Michal Luczaj <[email protected]>
selftests/bpf: Adapt sockmap update error handling

Eric Biggers <[email protected]>
fscrypt: Replace mk_users keyring with simple list

Zhu Yanjun <[email protected]>
RDMA/rxe: Fix a use-after-free problem in rxe_mmap

Claudiu Beznea <[email protected]>
pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP

Nathan Chancellor <[email protected]>
fortify: Disable -Wstringop-overread in tests

Masahiro Yamada <[email protected]>
fortify: refactor test_fortify Makefile to fix some build problems

Keno Fischer <[email protected]>
futex: Prevent robust futex exit race some more

Baul Lee <[email protected]>
net: bridge: mrp: fix uninitialised bytes on the wire

Chengfeng Ye <[email protected]>
netfilter: ebt_nflog: pin the NFLOG backend

Qihang Tang <[email protected]>
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

Sergey V. Frolov <[email protected]>
net: octeontx2-pf: Fix UB in shift operation

Zijie Huang <[email protected]>
net/sched: reject overly deep qdisc hierarchies

Zhiling Zou <[email protected]>
net: openvswitch: reallocate update replies for mismatched IDs

Doruk Tan Ozturk <[email protected]>
net/packet: reset the MAC header on the packet-socket transmit path

Kyle Zeng <[email protected]>
ipvs: clear IPv4 options after rebasing tunnel ICMP errors

Julian Anastasov <[email protected]>
ipvs: properly update the overload flag on dest edit

Julian Anastasov <[email protected]>
ipvs: add totalconns for dest

Lincoln Wallace <[email protected]>
ima: fix out-of-bounds read in xattr_verify()

Dmitry Torokhov <[email protected]>
Input: evdev - fix information leak in evdev_pass_values()

Joshua Rogers <[email protected]>
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get

Joshua Rogers <[email protected]>
vt: add permission check for KDSKBMETA ioctl

Yi Cong <[email protected]>

    net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

Sonali Pradhan <[email protected]>
usb: gadget: f_ncm: Use unsigned int for ndp_index

Pawel Laszczak <[email protected]>
usb: cdnsp: fix incorrect endian conversions for APB timeout register

Xu Rao <[email protected]>
thunderbolt: icm: Preserve USB4 proxy data-valid bit

Aleksandr Nogikh <[email protected]>
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()

Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write on Type II inbound URBs

Dmitry Torokhov <[email protected]>
Input: evdev - sanitize event type index when fetching event masks

Larisa Grigore <[email protected]>
spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers

Sean Christopherson <[email protected]>
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

David Matlack <[email protected]>

    KVM: x86/mmu: Rename __direct_map() to direct_map()

Qingshuang Fu <[email protected]>
hwmon: (ads7828) Fix external VREF regulator handling

David Lechner <[email protected]>
regulator: devres: add API for reference voltage supplies

Wilken Gottwalt <[email protected]>
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination

Maximilian Immanuel Brandtner <[email protected]>
tls: don't abort the connection on signal-interrupted sends

Xin Long <[email protected]>
sctp: clear control chunk transport if it is being removed

Eric Dumazet <[email protected]>
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()

Hongyan Xu <[email protected]>
ata: pata_sl82c105: fix bridge revision use-after-free

Fan XinRan <[email protected]>
net: thunderbolt: Tear down DMA paths before stopping the rings

Łukasz Patron <[email protected]>
net: qrtr: ns: Raise lookup limit to 128

Sidraya Jayagond <[email protected]>
net/smc: fix TOCTOU race between smc_listen_out() and listener close

Eric Dumazet <[email protected]>
net: remove WARN_ON_ONCE() from sk_mc_loop()

Pengpeng Hou <[email protected]>
net: prestera: validate firmware header length

Henry Martin <[email protected]>
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

Jiayuan Chen <[email protected]>
tcp: fix TFO max_qlen accounting across reuseport migration

Qing Luo <[email protected]>
sctp: fix addip_serial increment on ASCONF_ACK allocation failure

Keegan Freyhof <[email protected]>
bnxt_en: Fix PTP PPS setting bug

Michael Chan <[email protected]>
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption

Michael Chan <[email protected]>
bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips

Martin Kaiser <[email protected]>
selftests/ftrace: refactor eprobes test to fix argument checks

Guenter Roeck <[email protected]>
hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations

Rob Herring <[email protected]>

    hwmon: (lm25066) Use i2c_get_match_data()

Qingshuang Fu <[email protected]>
hwmon: (nzxt-smart2) Check return value of init_device() in probe

Cen Zhang (Microsoft) <[email protected]>
net/openvswitch: check Ethernet header length in key_extract()

Toke Høiland-Jørgensen <[email protected]>
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter

Xuanqiang Luo <[email protected]>
udp: fix potential use-after-free in tunnel segmentation

Yousef Alhouseen <[email protected]>
vhost/vdpa: reject overflowing PA map page counts on 32-bit

Jose Fernandez (Anthropic) <[email protected]>
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

Jordan Rife <[email protected]>
bpf: tcp: Avoid socket skips and repeats during iteration

Jordan Rife <[email protected]>
bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items

Jordan Rife <[email protected]>
bpf: tcp: Get rid of st_bucket_done

Jordan Rife <[email protected]>

    bpf: tcp: Make sure iter->batch always contains a full bucket snapshot

Jordan Rife <[email protected]>
bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch

Jian Wen <[email protected]>
tcp: add a scheduling point in established_get_first()

Babanpreet Singh <[email protected]>
counter: microchip-tcb-capture: Fix DT channel validation

Michael Guralnik <[email protected]>
net/mlx5: fw_tracer, return NULL on create error

Jiawen Liu <[email protected]>
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete

Jamal Hadi Salim <[email protected]>
net/sched: cls_route: fix fastmap use-after-free on filter

Mahanta Jambigi <[email protected]>
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()

Yiyang Chen <[email protected]>
bpf: Preserve pointer state for commuted arithmetic

Dmitry Antipov <[email protected]>
btrfs: fix memory leak in btrfs_do_encoded_write()

Julian Anastasov <[email protected]>
ipvs: return the csum validation for forward hook

Julian Anastasov <[email protected]>
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: switch ext_size to atomic64_t

Xiang Mei (Microsoft) <[email protected]>
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor

Fan Ye <[email protected]>
Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"

Yuho Choi <[email protected]>
ARM: npcm: Fix OF node refcount leaks in SMP setup

Anna Schumaker <[email protected]>
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Harald Freudenberger <[email protected]>
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()

Al Viro <[email protected]>
mount: honour SB_NOUSER in the new mount API

David Carlier <[email protected]>
Bluetooth: hci_conn: fix potential UAF in create_big_sync

Luiz Augusto von Dentz <[email protected]>

    Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev

Marco Elver <[email protected]>
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

Junjie Cao <[email protected]>
gpio: pch: use raw_spinlock_t for the register lock

Tze Yee Ng <[email protected]>
firmware: stratix10-svc: fix memory leaks and list corruption bugs

Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during recirculation

Kiryl Shutsemau (Meta) <[email protected]>
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

Kiryl Shutsemau (Meta) <[email protected]>
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()

Niklas Cassel <[email protected]>
ata: ahci: Make ahci_ignore_port() handle empty mask_port_map

Damien Le Moal <[email protected]>
ata: libahci_platform: Do not set mask_port_map when not needed

HyeongJun An <[email protected]>
HID: logitech-dj: Fix maxfield check in DJ short report validation

Zack Rusin <[email protected]>
drm/vmwgfx: bound DMA command body size against suffix pointer

Zack Rusin <[email protected]>
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

Zack Rusin <[email protected]>
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

William Palacek <[email protected]>
drm/amdkfd: hold event_mutex while checkpointing CRIU events

David Francis <[email protected]>
drm/amdkfd: Handle invalid event type in CRIU event restore

Harkirat Gill <[email protected]>
drm/amdgpu: cap GTT size to physical RAM on APUs

Candice Li <[email protected]>
drm/amdgpu: restore UMD profile pstate after runtime resume

Maíra Canal <[email protected]>
drm/vc4: Zero the tile state data array before each BIN job

Jose Maria Casanova Crespo <[email protected]>
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size

Alexander Kaplan <[email protected]>
drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs

Avi Weiss <[email protected]>
can: ctucanfd: mark error-active controller status valid

Avi Weiss <[email protected]>
can: ctucanfd: handle bus error interrupts

Avi Weiss <[email protected]>
can: ctucanfd: unmap BAR0 using base address

Avi Weiss <[email protected]>
can: ctucanfd: use self-test mode for PRESUME_ACK

Pengpeng Hou <[email protected]>
can: ctucanfd: add missing MODULE_DEVICE_TABLE()

Pengpeng Hou <[email protected]>
can: peak_usb: validate uCAN receive record lengths

Maoyi Xie <[email protected]>
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

James Gao <[email protected]>
can: peak_usb: add bounds check for USB channel index

Pengpeng Hou <[email protected]>
can: softing: fw_parse(): validate firmware record spans

Pengpeng Hou <[email protected]>
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

Abdun Nihaal <[email protected]>
can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()

Tetsuo Handa <[email protected]>
can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking

Oleksij Rempel <[email protected]>
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer

Guangshuo Li <[email protected]>
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure

Pengpeng Hou <[email protected]>
can: ems_usb: validate CPC message lengths

Lucas Martins Alves <[email protected]>
can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured

Liem <[email protected]>
i2c: imx: Cancel hrtimer before clearing slave pointer

Liem <[email protected]>
i2c: imx: Fix slave registration race and error handling

H. Nikolaus Schaller <[email protected]>
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock

Aaron Ma <[email protected]>
ice: wait for reset completion in ice_resume()

Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during ct

Ilya Maximets <[email protected]>
net: openvswitch: fix potential UAF on meter attach failure

Nava kishore Manne <[email protected]>
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB

Nava kishore Manne <[email protected]>
phy: zynqmp: use read-modify-write for SERDES scrambler bypass

Nava kishore Manne <[email protected]>
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask

Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA ECC private key requests

Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA AES cipher key requests

Harald Freudenberger <[email protected]>
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

Jan Höppner <[email protected]>
s390/dasd: Fix potential NULL pointer dereference

Aswin Karuvally <[email protected]>
s390/qeth: Check CAP_NET_ADMIN for private ioctls

Xu Rao <[email protected]>
power: supply: bq25890: fix the -10 C NTC lookup entry

Abdun Nihaal <[email protected]>
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()

bui duc phuc <[email protected]>
gpio: pca953x: fix cache_only and IRQ state on restore_context() failure

Myeonghun Pak <[email protected]>
i2c: amd-mp2: Unregister callback on adapter add failure

Hongyan Xu <[email protected]>
hwmon: (npcm750-pwm-fan): stop fan timer on device detach

Asim Viladi Oglu Manizada <[email protected]>
sctp: prevent peer transport count overflow

Yuxiang Yang <[email protected]>
sctp: reject stale cookies with mismatched verification tags

Ibrahim Hashimov <[email protected]>
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

Chris Gellermann <[email protected]>
selftests/clone3: fix wild pointer access of getline due to missing init

Masami Hiramatsu (Google) <[email protected]>
tracing/filters: Fix false positive match in regex_match_full()

Masami Hiramatsu (Google) <[email protected]>
tracing: Check return value of __register_event() in trace_module_add_events()

Ming Lei <[email protected]>
ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

Eric Dumazet <[email protected]>
vxlan: use pskb_network_may_pull() in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: use neigh_ha_snapshot() in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: unclone skb head before modifying eth header in route_shortcircuit()

Eric Dumazet <[email protected]>
vxlan: re-fetch eth header after route_shortcircuit()

Michael Bommarito <[email protected]>
um: vector: fix use-after-free in vector_mmsg_rx()

Thorsten Blum <[email protected]>
powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()

Zhiling Zou <[email protected]>
net: ipv6: clear suppressed fib6 rule result

Zhiling Zou <[email protected]>
net: bridge: stop fast-leave after deleting a port group

Link Lin <[email protected]>
mm/page_reporting: use system_freezable_wq to fix UAF during suspend

Christian Brauner <[email protected]>
binfmt_misc: reject a flag character as the field delimiter

Zhao Li <[email protected]>
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

Zihan Xi <[email protected]>
tipc: avoid use-after-free in poll trace queue dumps

David Lee <[email protected]>
netfilter: ipset: do not update comments from kernel-side hash adds

Xuanqiang Luo <[email protected]>
net/smc: fix socket use-after-free during link group termination

Zhiling Zou <[email protected]>
ipvs: do not propagate one-packet flag to synced conns

Matt Vollrath <[email protected]>
igbvf: Fix leak in TX DMA error cleanup

Dawei Feng <[email protected]>

    e1000: fix memory leak in e1000_probe()

Md Sadre Alam <[email protected]>
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+

Sonali Pradhan <[email protected]>
ALSA: usb-audio: Clamp frame size in implicit-feedback mode

Sonali Pradhan <[email protected]>
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set

Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()

Haidar Lee <[email protected]>
ASoC: tas2562: fix broken entries in the volume lookup table

Haidar Lee <[email protected]>
ASoC: tas2562: fix DVC coefficient write order

Norbert Szetei <[email protected]>
ALSA: pcm: wake linked drain waiters on unlink

Xu Rao <[email protected]>
ALSA: lx6464es: fix period byte count for 16-bit streams

Takashi Iwai <[email protected]>
ALSA: 6fire: Fix UAF at error handling during probe

Xuanqiang Luo <[email protected]>
bpf: lwt: Fix dst reference leak on reroute failure

Sangho Lee <[email protected]>
Bluetooth: HIDP: validate numbered report payloads

Sangho Lee <[email protected]>
Bluetooth: HIDP: reject frames without a transaction header

Luxiao Xu <[email protected]>
audit: fix potential use-after-free in audit_del_rule()

Zhan Xusheng <[email protected]>
audit: fix potential integer overflow in audit_log_n_string()

Charles Vosburgh <[email protected]>
sctp: validate Adaptation Indication parameter length

Farhan Ali <[email protected]>
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

Farhan Ali <[email protected]>
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure

Farhan Ali <[email protected]>
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled

Sean Christopherson <[email protected]>
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active

Xiangfeng Cai <[email protected]>
mm/hugetlb: fix list corruption in allocate_file_region_entries()

Zi Yan <[email protected]>
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()

Benjamin Boortz <[email protected]>
pinctrl: bm1880: add missing select GENERIC_PINCONF

Karl Mehltretter <[email protected]>
pinctrl: devicetree: don't free uninitialized dev_name on error path

Benjamin Boortz <[email protected]>
pinctrl: microchip-sgpio: add missing select REGMAP_MMIO

Cen Zhang (Microsoft) <[email protected]>

    rhashtable: clear stale iter->p on table restart

Kuniyuki Iwashima <[email protected]>
af_unix: Give up GC if MSG_PEEK intervened.

Pengfei Zhang <[email protected]>
ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump

Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in __close_file_table_ids()

Namjae Jeon <[email protected]>
ksmbd: return success for deferred final close

Denis V. Lunev <[email protected]>
qede: sync udp_tunnel ports outside qede_lock in the recovery path

Suman Ghosh <[email protected]>
octeontx2-pf: Set correct sequence for carrier off and tx queue stop

Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()

Minhong He <[email protected]>
can: isotp: check register_netdevice_notifier() error in module init

Chenguang Zhao <[email protected]>
net: sxgbe: check descriptor ring allocation failures

Chenguang Zhao <[email protected]>
net: sxgbe: free TX rings on RX allocation failure

Leon Romanovsky <[email protected]>
scsi: target: Clear cmd_cnt when initial counter enrollment fails

Benjamin Block <[email protected]>
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req

Christian Marangi <[email protected]>
net: phylink: put link_gpio if phylink_create fails

Jiale Yao <[email protected]>
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

Guenter Roeck <[email protected]>
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()

Zhao Li <[email protected]>
wifi: mac80211: validate individual TWT params before driver setup

Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-akebono CPU node lookup check

Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-currituck CPU node lookup check

Thorsten Blum <[email protected]>
powerpc/boot: Fix simpleboot CPU node lookup check

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix PWM auto temp state array and bounds check

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Use cached PWM frequency value

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix cache updated before hardware write on I2C error

Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors

Chenguang Zhao <[email protected]>
forcedeth: fix UAF of txrx_stats in nv_remove

David Corvaglia <[email protected]>
net: bridge: mrp: fix Option TLV length in MRP_Test frames

Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Prevent access to unsupported weight registers

Eric Dumazet <[email protected]>
net: do not send ICMP/NDISC Redirects when peer allocation fails

Guenter Roeck <[email protected]>
hwmon: (nzxt-smart2) DMA-align output buffer

Guenter Roeck <[email protected]>
hwmon: (lm90) Only report alarms if driver is ready

Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116

Guenter Roeck <[email protected]>
hwmon: (nct6775) Fix access to temperature configuration registers

Ahmad Khalifa <[email protected]>
hwmon: (nct6775) Additional TEMP registers for nct6799

Ahmad Khalifa <[email protected]>
hwmon: (nct6775) Add support for 18 IN readings for nct6799

Ahmad Khalifa <[email protected]>
hwmon: (nct6775) Increase and reorder ALARM/BEEP bits

Ahmad Khalifa <[email protected]>

    hwmon: (nct6775) Fix IN scaling factors for 6798/6799

Guenter Roeck <[email protected]>

    hwmon: (nct6755) Add support for NCT6799D

Dawei Feng <[email protected]>
smb: client: fix buffer leaks in SMB1 read and write

Xingui Yang <[email protected]>
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race

John Garry <[email protected]>
scsi: libsas: Delete struct scsi_core

Jason Yan <[email protected]>
scsi: libsas: Abort all in-flight requests when device is gone

HyeongJun An <[email protected]>
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

HyeongJun An <[email protected]>
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

Mario Limonciello <[email protected]>
pinctrl-amd: Don't clear S4 wake bits at probe

Xiang Mei <[email protected]>
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()

Ilia Gavrilov <[email protected]>
rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled

Xiang Mei (Microsoft) <[email protected]>
netfilter: nft_payload: fix mask build for partial field offload

Julian Anastasov <[email protected]>
ipvs: do not mangle ICMP replies for non-first fragments

Julian Anastasov <[email protected]>
ipvs: fix places with wrong packet offsets

Julian Anastasov <[email protected]>
ipvs: fix the checksum validations

Eric Dumazet <[email protected]>
ipv6: introduce dst_rt6_info() helper

Pablo Neira Ayuso <[email protected]>
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

Michael Bommarito <[email protected]>
assoc_array: trim the final shortcut word using the current chunk end

Michael Bommarito <[email protected]>
keys: make keyring key-chunk byte order agree with keyring_diff_objects()

Michael Bommarito <[email protected]>
keys: fix out-of-bounds read in keyring_get_key_chunk()

Ruoyu Wang <[email protected]>
drm/mediatek: Check CRTC state before freeing

Xiang Mei <[email protected]>
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix runtime PM leak on probe allocation failure

Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()

Mike Looijmans <[email protected]>
phy-zynqmp: Postpone getting clock rate until actually needed

Sean Anderson <[email protected]>
phy: zynqmp: Allow variation in refclk rate

Uday Khare <[email protected]>
ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup

Uday Khare <[email protected]>
ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup

Radhey Shyam Pandey <[email protected]>
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()

Damien Le Moal <[email protected]>
ahci: Introduce ahci_ignore_port() helper

Josua Mayer <[email protected]>
ata: libahci_platform: support non-consecutive port numbers

Rosen Penev <[email protected]>
ata: sata_mv: accept 1 or 2 resources in platform probe

Hongling Zeng <[email protected]>
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA

Konrad Dybcio <[email protected]>

    pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151

Youssef Samir <[email protected]>
net: qrtr: ns: Raise node count limit to 512

Manivannan Sadhasivam <[email protected]>
net: qrtr: ns: Limit the maximum server registration per node

Benjamin Tissoires <[email protected]>
HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report

Lee Jones <[email protected]>
HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write

Lee Jones <[email protected]>
HID: logitech-dj: Standardise hid_report_enum variable nomenclature

Eddie Phillips <[email protected]>
gve: fix Rx queue stall on alloc failure

Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix sequence number when no EOF

Isaac Scott <[email protected]>
media: uvcvideo: Implement dual stream quirk to fix loss of usb packets

Yehyeong Lee <[email protected]>
net: mpls: initialize rtm_tos in mpls_getroute()

Lorenzo Bianconi <[email protected]>
netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()

Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: restore helper propagation via expectation

SJ Park <[email protected]>
mm/damon/core: disallow overlapping input ranges for damon_set_regions()

SJ Park <[email protected]>
mm/damon/core: validate ranges in damon_set_regions()

Yitang Yang <[email protected]>
io_uring/rw: fix missing ERESTARTSYS conversion in read paths

Nikunj A Dadhania <[email protected]>
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug

Wentao Guan <[email protected]>
bpf: drop bpf_lsm_getselfattr from hook list

Namjae Jeon <[email protected]>
exfat: validate cluster allocation bits of the allocation bitmap

Eric Biggers <[email protected]>
fscrypt: Avoid dynamic allocation in fscrypt_get_devices()

Kyle Zeng <[email protected]>
openvswitch: fix GSO userspace truncation underflow

Weiming Shi <[email protected]>
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

Weiming Shi <[email protected]>
ipv6: ndisc: fix NULL deref in accept_untracked_na()

Jacob Keller <[email protected]>
i40e: remove read access to debugfs files

Xie Bo <[email protected]>
RISC-V: KVM: Serialize virtual interrupt pending state updates

Ce Sun <[email protected]>
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd

Boyuan Zhang <[email protected]>
drm/amdgpu: fix division by zero with invalid uvd dimensions

Boyuan Zhang <[email protected]>
drm/amdgpu/vce: fix integer overflow in image size

Alex Deucher <[email protected]>
drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx8: drop unecessary BUG_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()

Yang Wang <[email protected]>
drm/amd/pm: make pp_features read-only when scpm is enabled

Daehyeon Ko <[email protected]>

    tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

Asim Viladi Oglu Manizada <[email protected]>
pppoe: reload header pointer after dev_hard_header()

Doruk Tan Ozturk <[email protected]>
mctp: serial: handle zero-length frames to prevent rx buffer overflow

Doruk Tan Ozturk <[email protected]>
mac802154: llsec: reject frames shorter than the authentication tag

Michael Bommarito <[email protected]>
ila: reload IPv6 header after pskb_may_pull in checksum adjust

Sergey Temerkhanov <[email protected]>
ice: use READ_ONCE() to access cached PHC time

James Montgomery <[email protected]>
ksmbd: defer destroy_previous_session() until after NTLM authentication

Raphael Zimmer <[email protected]>
rbd: Reset positive result codes to zero in object map update path

Jann Horn <[email protected]>
proc: Fix broken error paths for namespace links

Fan Wu <[email protected]>
net: hip04: fix RX buffer leak on build_skb failure

David Lee <[email protected]>

    net/x25: fix use-after-free in x25_kill_by_neigh()

Bryam Vargas <[email protected]>
net/iucv: fix use-after-free of a severed iucv_path

Hidayath Khan <[email protected]>
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

Doruk Tan Ozturk <[email protected]>
geneve: require CAP_NET_ADMIN in the device netns for changelink

Sungmin Kang <[email protected]>
net: slip: serialize receive against buffer reallocation

Doruk Tan Ozturk <[email protected]>
vxlan: require CAP_NET_ADMIN in the device netns for changelink

Breno Leitao <[email protected]>
phonet: pep: fix use-after-free in pep_get_sb()

Lu Baolu <[email protected]>
iommu/vt-d: Disallow SVA if page walk is not coherent

Tengda Wu <[email protected]>
ftrace: Add global mutex to serialize trace_parser access

Eric Biggers <[email protected]>
fscrypt: Add missing superblock check in find_or_insert_direct_key()

Christian Brauner <[email protected]>
binfmt_elf_fdpic: only honour the first PT_INTERP

Douya Le <[email protected]>
libceph: remove debugfs files before client teardown

Douya Le <[email protected]>
libceph: reject zero bucket types in crush_decode

Raphael Zimmer <[email protected]>
libceph: Reject monmaps advertising zero monitors

Shuangpeng Bai <[email protected]>

    libceph: refresh auth->authorizer_buf{,_len} after authorizer update

Zhao Zhang <[email protected]>
libceph: guard missing CRUSH type name lookup

Raphael Zimmer <[email protected]>
libceph: Fix multiplication overflow in decode_new_up_state_weight()

Douya Le <[email protected]>
libceph: bound get_version reply decode to front len

Bryam Vargas <[email protected]>
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()

Jun Yang <[email protected]>
sctp: don't free the ASCONF's own transport in DEL-IP processing

Michael Bommarito <[email protected]>
mptcp: only set DATA_FIN when a mapping is present

Chenguang Zhao <[email protected]>
mptcp: decrement subflows counter on failed passive join

Will Deacon <[email protected]>
Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"

Will Deacon <[email protected]>
arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix potential underflow in LEN_OR_ZERO macro

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()

Masami Hiramatsu (Google) <[email protected]>
tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()

deepakraog <[email protected]>
tracing: Fix resource leak on mmiotrace trace_pipe close

Steven Rostedt <[email protected]>

    tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev

Guangshuo Li <[email protected]>
intel_th: fix MSC output device reference leak

Jiangshan Yi <[email protected]>
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: implement gpio get_direction() callback

Ian Abbott <[email protected]>
comedi: comedi_parport: deal with premature interrupt

Nathan Chancellor <[email protected]>
x86/boot/compressed: Disable jump tables

Xu Rao <[email protected]>
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

Zixing Liu <[email protected]>
platform/loongarch: laptop: Explicitly reset bl_powered state when suspend

Christian Brauner <[email protected]>
binfmt_misc: set have_execfd only once the interpreter is opened

Christian Brauner <[email protected]>
exec: fix unsigned loop counter wrap in transfer_args_to_stack()

Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: Fix session UAF in set_termios

Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Protect UUID list traversal

MinJea Kim <[email protected]>
staging: rtl8723bs: fix inverted HT40 secondary channel offset

Moksh Panicker <[email protected]>
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

Fan Wu <[email protected]>
wifi: brcmfmac: make release_scratchbuffers idempotent

Devin Wittmayer <[email protected]>
wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses

Devin Wittmayer <[email protected]>
wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses

Huihui Huang <[email protected]>
wifi: wilc1000: validate assoc response length before subtracting header

Doruk Tan Ozturk <[email protected]>
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB access from firmware ADDBA window size

Norbert Szetei <[email protected]>
ALSA: seq: close a re-opened queue timer in the destructor

Johan Hovold <[email protected]>
media: vpif_capture: fix OF node reference imbalance

Hans Verkuil <[email protected]>
media: vivid: check for vb2_is_busy() when toggling caps

Hans Verkuil <[email protected]>
media: vivid: add vivid_update_reduced_fps()

Guangshuo Li <[email protected]>
media: vimc: fix reference leak on failed device registration

Guangshuo Li <[email protected]>
media: vidtv: fix reference leak on failed device registration

Zile Xiong <[email protected]>
media: vb2: use ssize_t for vb2_read/vb2_write

Pengpeng Hou <[email protected]>
media: v4l2-ctrls: validate HEVC active reference counts

Sergey Shtylyov <[email protected]>
media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()

Myeonghun Pak <[email protected]>
media: ti: vpe: unwind v4l2 device registration on probe error

Hungyu Lin <[email protected]>
media: tegra-video: vi: fix invalid u32 return value in format lookup

Valery Borovsky <[email protected]>
media: sun4i-csi: Return queued buffers on start_streaming() failure

Myeonghun Pak <[email protected]>
media: stm32: dcmi: unregister notifier on probe failure

Ma Ke <[email protected]>
media: saa7134: Fix a possible memory leak in saa7134_video_init1

Valery Borovsky <[email protected]>
media: rtl2832_sdr: Return queued buffers on start_streaming() failure

Deepanshu Kartikey <[email protected]>

    media: rtl2832: fix use-after-free in rtl2832_remove()

Myeonghun Pak <[email protected]>
media: radio-si476x: Unregister v4l2_device on probe failure

Valery Borovsky <[email protected]>
media: pwc: Return queued buffers on start_streaming() failure

Valery Borovsky <[email protected]>
media: pwc: Drain fill_buf on start_streaming() failure

Krzysztof Kozlowski <[email protected]>
media: pci: dm1105: Free allocated workqueue

Valery Borovsky <[email protected]>
media: msi2500: Return queued buffers on start_streaming() failure

Anand Moon <[email protected]>
media: meson: vdec: Fix memory leak in error path of vdec_open

Guangshuo Li <[email protected]>
media: marvell-cam: fix missing pci_disable_device() on remove

Wang Jun <[email protected]>
media: cx23885: add ioremap return check and cleanup

Johan Hovold <[email protected]>
media: cx231xx: fix devres lifetime

Pengpeng Hou <[email protected]>
media: cedrus: skip invalid H.264 reference list entries

Samuel Holland <[email protected]>
media: cedrus: Fix missing cleanup in error path

Myeonghun Pak <[email protected]>
media: cedrus: clean up media device on probe failure

Myeonghun Pak <[email protected]>
media: cec: seco: unregister adapter on IR probe failure

David Carlier <[email protected]>
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure

Valery Borovsky <[email protected]>
media: airspy: Return queued buffers on start_streaming() failure

Ian Forbes <[email protected]>
drm/vmwgfx: Validate vmw_surface_metadata::array_size

Zhu Lingshan <[email protected]>

    drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved

Timur Kristóf <[email protected]>

    drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)

Mario Limonciello <[email protected]>
drm/amdgpu: Fix VFCT bus number matching with soft filter

Joonas Lahtinen <[email protected]>
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU

Joonas Lahtinen <[email protected]>

    drm/i915/gem: Do not leak siblings[] on proto context error

Joonas Lahtinen <[email protected]>
drm/i915: Return NULL on error in active_instance

Alex Deucher <[email protected]>
drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()

Bryam Vargas <[email protected]>
drm/virtio: bound EDID block reads to the response buffer

David Francis <[email protected]>
drm/amdkfd: Check bounds in allocate_event_notification_slot

Pavel Ondračka <[email protected]>
drm/radeon: fix r100_copy_blit for large BOs

Wentao Liang <[email protected]>
drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()

Joonas Lahtinen <[email protected]>
drm/i915/gem: Add missing nospec on parallel submit slot

Timur Kristóf <[email protected]>
drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT

Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers

Ashutosh Desai <[email protected]>
drm/dp/mst: fix buffer overflows in sideband chunk accumulation

Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers

Sergey Shtylyov <[email protected]>
drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()

Chengfeng Ye <[email protected]>
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

Li RongQing <[email protected]>
net: ipv6: fix dif and sdif mismatch in raw6_icmp_error

Alexei Lazar <[email protected]>
net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation

Alexei Lazar <[email protected]>
net/mlx5e: Report zero bandwidth for non-ETS traffic classes

Yael Chemla <[email protected]>
net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule

Aldo Ariel Panzardo <[email protected]>
net: qrtr: restrict socket creation to the initial network namespace

Chenguang Zhao <[email protected]>
hinic: remove unused ethtool RSS user configuration buffers

Eric Dumazet <[email protected]>
ppp: annotate data races in ppp_generic

Qingfang Deng <[email protected]>
ppp: enable TX scatter-gather

Qingfang Deng <[email protected]>
ppp: convert to percpu netstats

Qingfang Deng <[email protected]>
ppp: use IFF_NO_QUEUE in virtual interfaces

Eric Dumazet <[email protected]>
ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup

Suman Ghosh <[email protected]>
octeontx2-vf: set TC flower flag on MCAM entry allocation

Nazim Amirul <[email protected]>
net: stmmac: reset residual action in L3L4 filters on delete

Nazim Amirul <[email protected]>
net: stmmac: fix l3l4 filter rejecting unsupported offload requests

Cen Zhang (Microsoft) <[email protected]>
tipc: fix u16 MTU truncation in media and bearer MTU validation

Harshaka Narayana <[email protected]>
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

Qing Luo <[email protected]>
sctp: auth: verify auth requirement when auth_chunk is NULL

Eric Dumazet <[email protected]>
net: hsr: fix memory leak on slave unregistration by removing synced VLANs

Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: fix vlan range dumps starting with pvid

Michael Bommarito <[email protected]>
amt: make the head writable before rewriting the L2 header

Michael Bommarito <[email protected]>
amt: re-read skb header pointers after every pull

Shelley Yang <[email protected]>
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning

Lorenzo Bianconi <[email protected]>
wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()

Ruoyu Wang <[email protected]>
wifi: mt76: mt7915: guard HE capability lookups

Helen Koike <[email protected]>
tipc: fix infinite loop in __tipc_nl_compat_dumpit

Xiang Mei (Microsoft) <[email protected]>
nexthop: initialize extack in nh_res_bucket_migrate()

Xiang Mei (Microsoft) <[email protected]>
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

Matthieu Baerts (NGI0) <[email protected]>
selftests: openvswitch: add config file

Matthieu Baerts (NGI0) <[email protected]>
selftests: af_unix: add USER_NS config

Kuniyuki Iwashima <[email protected]>
selftest: af_unix: Add Kconfig file.

Cen Zhang (Microsoft) <[email protected]>
sctp: validate stream count in sctp_process_strreset_inreq()

HanQuan <[email protected]>
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

Prashanth Kumar KR <[email protected]>
amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN

Andrew Pope <[email protected]>
wifi: mac80211: recalculate TIM when a station enters power save

Li RongQing <[email protected]>
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()

Pengpeng Hou <[email protected]>
iommu/amd: Bound the early ACPI HID map

HE WEI (ギカク) <[email protected]>
wifi: mwifiex: bound uAP association event IEs to the event buffer

Ruoyu Wang <[email protected]>
wan: wanxl: Only reset hardware after BAR mapping

Ruoyu Wang <[email protected]>
nfp: Check resource mutex allocation

Guangshuo Li <[email protected]>
dpaa2-eth: put MAC endpoint device on disconnect

Vladimir Oltean <[email protected]>

    net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call

Guangshuo Li <[email protected]>
dpaa2-switch: put MAC endpoint device on disconnect

Aldo Ariel Panzardo <[email protected]>
rds: drop incoming messages that cross network namespace boundaries

Zhaolong Zhang <[email protected]>
bonding: fix devconf_all NULL dereference when IPv6 is disabled

David Lee <[email protected]>
net/packet: avoid fanout hook re-registration after unregister

Pengpeng Hou <[email protected]>
hwmon: occ: validate poll response sensor blocks

Yichong Chen <[email protected]>
smb: client: validate DFS referral PathConsumed

Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) add missed handle for ENOMEM

Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) fix EC read intervals

Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) fix looping over banks while reading from EC

Diego Fernando Mancera Gomez <[email protected]>
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect

Shahar Tzarfati <[email protected]>
wifi: iwlwifi: mvm: fix read in wake packet notification handler

Shengjiu Wang <[email protected]>
ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI

Guanghui Yang <[email protected]>
btrfs: free mapping node on duplicate reloc root insert

You-Kai Zheng <[email protected]>
btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8

Tristan Madani <[email protected]>
wifi: carl9170: fix buffer overflow in rx_stream failover path

Tristan Madani <[email protected]>
wifi: carl9170: fix OOB read from off-by-two in TX status handler

Tristan Madani <[email protected]>
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler

Ruoyu Wang <[email protected]>
firewire: net: Fix fragmented datagram reassembly

Manivannan Sadhasivam <[email protected]>
wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET

Dmitry Morgun <[email protected]>
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()

Tzung-Bi Shih <[email protected]>
watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()

Guenter Roeck <[email protected]>
hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop

Guenter Roeck <[email protected]>
hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop

Edward Adam Davis <[email protected]>
hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop

Gaole Zhang <[email protected]>
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin

Cheng Yongkang <[email protected]>
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

Xincheng Zhang <[email protected]>
usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits

Daniel Borkmann <[email protected]>
bpf: Fix ld_{abs,ind} failure path analysis in subprogs

Pawan Gupta <[email protected]>
bpf: Prefer dirty packs for eBPF allocations

Pawan Gupta <[email protected]>
bpf: Prefer packs that won't trigger an IBPB flush on allocation

Pawan Gupta <[email protected]>
bpf: Skip redundant IBPB in pack allocator

Pawan Gupta <[email protected]>
bpf: Restrict JIT predictor flush to cBPF

Pawan Gupta <[email protected]>
x86/bugs: Enable IBPB flush on BPF JIT allocation

Pawan Gupta <[email protected]>
bpf: Support for hardening against JIT spraying

Sasha Levin <[email protected]>
Revert "drm/amd/display: Add missing kdoc for ALLM parameters"

Doruk Tan Ozturk <[email protected]>
crypto: rsa-pkcs1pad: Don't WARN on an empty digest

Chukun Pan <[email protected]>
USB: serial: option: add TDTECH MT5710-CN

Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix data loss on receive throttling

Sunho Park <[email protected]>
USB: serial: io_edgeport: cap received transmit credits

Tim Pambor <[email protected]>
USB: serial: ftdi_sio: add support for E+H FXA291

Muhammad Bilal <[email protected]>
usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer

Fan Wu <[email protected]>
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

Sonali Pradhan <[email protected]>
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()

Johan Hovold <[email protected]>
USB: gadget: fsl-udc: fix device name leak on probe failure

Johan Hovold <[email protected]>
USB: gadget: snps-udc: fix device name leak on probe failure

Melbin K Mathew <[email protected]>
usb: gadget: printer: fix infinite loop in printer_read()

Fan Wu <[email protected]>
usb: gadget: f_midi: cancel pending IN work before freeing the midi object

Jinchao Wang <[email protected]>
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback

Xu Yang <[email protected]>
usb: chipidea: fix usage_count leak when autosuspend_delay is negative

Huang Wei <[email protected]>
USB: storage: add NO_ATA_1X quirk for Longmai USB Key

Huihui Huang <[email protected]>

    wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()

Weiming Shi <[email protected]>
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

Xin Long <[email protected]>
sctp: fix auth_hmacs array size in struct sctp_cookie

Jamal Hadi Salim <[email protected]>
net/sched: act_tunnel_key: Defer dst_release to RCU callback

Emre Cecanpunar <[email protected]>
drm/i915/selftests: Fix GT PM sort comparators

Xiang Mei (Microsoft) <[email protected]>
ksmbd: validate compound request size before reading StructureSize2

Shuhao Fu <[email protected]>
can: j1939: fix lockless local-destination check

Michal Luczaj <[email protected]>
bpf, sockmap: Reject unhashed UDP sockets on sockmap update

Pengpeng Hou <[email protected]>
drm/i915/gt: use correct selftest config symbol

Huiwen He <[email protected]>
smb/client: handle overlapping allocated ranges in fallocate

Xiang Mei <[email protected]>
Bluetooth: qca: fix NVM tag length underflow in TLV parser

Takashi Iwai <[email protected]>
ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered

Bryam Vargas <[email protected]>
net/iucv: take a reference on the socket found in afiucv_hs_rcv()

Weiming Shi <[email protected]>
ipv4: fib: free fib_alias with kfree_rcu() on insert error path

Norbert Szetei <[email protected]>
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

Pushpendra Singh <[email protected]>
firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context

Uday Khare <[email protected]>
ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup

Vijendar Mukunda <[email protected]>
ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()

Christian Hewitt <[email protected]>
ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop

HE WEI (ギカク) <[email protected]>
wifi: cfg80211: bound element ID read when checking non-inheritance

Runyu Xiao <[email protected]>
wifi: brcmfmac: initialize SDIO data work before cleanup

Cen Zhang <[email protected]>
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock

Zhao Li <[email protected]>
wifi: cfg80211: reject unsupported PMSR FTM location requests

Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR FTM preamble range

Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR measurement type data

Zhao Li <[email protected]>
wifi: nl80211: validate nested MBSSID IE blobs

Zhao Li <[email protected]>
wifi: nl80211: free RNR data on MBSSID mismatch

Xiang Mei <[email protected]>
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

Dawei Feng <[email protected]>
wifi: libertas: fix memory leak in helper_firmware_cb()

Bryam Vargas <[email protected]>
wifi: mac80211_hwsim: clamp virtio RX length before skb_put

Abdun Nihaal <[email protected]>
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()

Cen Zhang <[email protected]>
wifi: cfg80211: cancel sched scan results work on unregister

Xiang Mei (Microsoft) <[email protected]>
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

Xiang Mei (Microsoft) <[email protected]>
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

Aleksandrova Alyona <[email protected]>
RDMA/irdma: Prevent overflows in memory contiguity checks

Malaya Kumar Rout <[email protected]>
selftests/alsa: Fix memory leak in find_controls error path

Ruoyu Wang <[email protected]>
RDMA/siw: publish QP after initialization

Guoqing Jiang <[email protected]>

    RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp

Danila Chernetsov <[email protected]>
RDMA/hns: Fix potential integer overflow in mhop hem cleanup

Ruoyu Wang <[email protected]>
RDMA/erdma: initialize ret for empty receive WR lists

Or Gerlitz <[email protected]>
RDMA/cma: Fix hardware address comparison length in netevent callback

Unnathi Chalicheemala <[email protected]>
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()

Filipe Manana <[email protected]>
btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()

Xiang Mei <[email protected]>
btrfs: reject free space cache with more entries than pages

Pengpeng Hou <[email protected]>
mtd: nand: mtk-ecc: stop on ECC idle timeouts

Pengpeng Hou <[email protected]>
mtd: mtdswap: remove debugfs stats file on teardown

Michael Bommarito <[email protected]>
IB/mad: Drop unmatched RMPP responses before reassembly

Sumit Gupta <[email protected]>
arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix logic error in packet reset

Seungjin Bae <[email protected]>
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()

Chuck Lever <[email protected]>
xprtrdma: Clear receive-side ownership pointers on release

Mikko Perttunen <[email protected]>
gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

Claudiu Beznea <[email protected]>
dmaengine: sh: rz-dmac: Move interrupt request after everything is set up

Oliver Hartkopp <[email protected]>

    can: isotp: serialize TX state transitions under so->rx_lock

Oliver Hartkopp <[email protected]>
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER

Oliver Hartkopp <[email protected]>
can: bcm: track a single source interface for ANYDEV timeout/throttle ops

Oliver Hartkopp <[email protected]>
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

Oliver Hartkopp <[email protected]>
can: bcm: fix stale rx/tx ops after device removal

Oliver Hartkopp <[email protected]>
can: bcm: add missing device refcount for CAN filter removal

Oliver Hartkopp <[email protected]>
can: bcm: validate frame length in bcm_rx_setup() for RTR replies

Oliver Hartkopp <[email protected]>
can: bcm: extend bcm_tx_lock usage for data and timer updates

Oliver Hartkopp <[email protected]>
can: bcm: fix CAN frame rx/tx statistics

Oliver Hartkopp <[email protected]>
can: bcm: add locking when updating filter and timer values

Phil Rosenthal <[email protected]>
KVM: x86/mmu: Fix use-after-free on vendor module reload

Hyunwoo Kim <[email protected]>
KVM: nVMX: Hide shadow VMCS right after VMCLEAR

Heiko Carstens <[email protected]>
seqlock: Allow UBSAN_ALIGNMENT to fail optimizing

Peter Zijlstra <[email protected]>
seqlock: Allow KASAN to fail optimizing

Peter Zijlstra <[email protected]>
seqlock: Cure some more scoped_seqlock() optimization fails

Sandipan Das <[email protected]>
perf/x86/amd/brs: Fix kernel address leakage

Kuniyuki Iwashima <[email protected]>
af_unix: Set gc_in_progress to true in unix_gc().

Guixiong Wei <[email protected]>
platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug

-------------

Diffstat:

 Documentation/driver-api/driver-model/devres.rst   |   1 +
 Makefile                                           |   4 +-
 arch/arm/mach-npcm/platsmp.c                       |   2 +
 arch/arm64/boot/dts/nvidia/tegra234.dtsi           |  24 +-
 arch/powerpc/boot/simpleboot.c                     |   2 +-
 arch/powerpc/boot/treeboot-akebono.c               |   2 +-
 arch/powerpc/boot/treeboot-currituck.c             |   2 +-
 arch/powerpc/platforms/ps3/mm.c                    |   1 +
 arch/riscv/include/asm/kvm_host.h                  |  10 +-
 arch/riscv/kvm/vcpu.c                              |  78 ++-
 arch/s390/kvm/pci.c                                |  28 +-
 arch/um/drivers/vector_kern.c                      |   3 +
 arch/x86/boot/compressed/Makefile                  |   1 +
 arch/x86/events/amd/brs.c                          |  10 +-
 arch/x86/include/asm/nospec-branch.h               |   4 +
 arch/x86/kernel/cpu/bugs.c                         |  50 +-
 arch/x86/kvm/mmu/mmu.c                             |  73 +--
 arch/x86/kvm/mmu/mmu_internal.h                    |   3 +-
 arch/x86/kvm/mmu/paging_tmpl.h                     |  14 +-
 arch/x86/kvm/svm/avic.c                            |   8 -
 arch/x86/kvm/svm/svm.c                             |   7 +-
 arch/x86/kvm/vmx/nested.c                          |  11 +-
 arch/x86/net/bpf_jit_comp.c                        |   3 +-
 crypto/rsa-pkcs1pad.c                              |   2 +-
 drivers/ata/ahci.h                                 |  17 +-
 drivers/ata/ahci_brcm.c                            |   3 +
 drivers/ata/ahci_ceva.c                            |  24 +-
 drivers/ata/libahci.c                              |   1 +
 drivers/ata/libahci_platform.c                     |  38 +-
 drivers/ata/pata_sl82c105.c                        |   4 +-
 drivers/ata/sata_dwc_460ex.c                       |   8 +-
 drivers/ata/sata_mv.c                              |   2 +-
 drivers/block/rbd.c                                |   7 +-
 drivers/block/ublk_drv.c                           |   9 +
 drivers/bluetooth/btqca.c                          |   2 +-
 drivers/cdrom/cdrom.c                              |   1 +
 drivers/comedi/drivers/comedi_parport.c            |  13 +-
 drivers/counter/microchip-tcb-capture.c            |   4 +-
 drivers/cpufreq/powernow-k8.c                      |   1 +
 drivers/dma/sh/rz-dmac.c                           |  96 ++--
 drivers/dma/sun6i-dma.c                            |  11 +-
 drivers/firewire/net.c                             |  37 +-
 drivers/firmware/arm_ffa/driver.c                  |   2 +-
 drivers/firmware/arm_scmi/notify.c                 |   6 +-
 drivers/firmware/stratix10-svc.c                   |  10 +-
 drivers/gpio/gpio-pca953x.c                        |  15 +-
 drivers/gpio/gpio-pch.c                            |  28 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c            |   2 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c           |  45 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |  15 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |  13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  30 ++
 drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c            |   8 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c            |  17 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c             |  13 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c             |  13 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c              |   3 -
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |  10 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c             |   4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_events.c            |  26 +-
 .../amd/display/modules/info_packet/info_packet.c  |   2 -
 drivers/gpu/drm/amd/pm/amdgpu_pm.c                 |   5 +
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c     |   7 +-
 drivers/gpu/drm/display/drm_dp_helper.c            |  12 +
 drivers/gpu/drm/display/drm_dp_mst_topology.c      |  32 +-
 drivers/gpu/drm/i915/gem/i915_gem_context.c        |  25 +-
 drivers/gpu/drm/i915/gt/intel_engine_user.c        |   2 +-
 drivers/gpu/drm/i915/gt/selftest_gt_pm.c           |   8 +-
 drivers/gpu/drm/i915/i915_active.c                 |   7 +-
 drivers/gpu/drm/mediatek/mtk_drm_crtc.c            |   6 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c     |   1 +
 drivers/gpu/drm/radeon/r100.c                      |  13 +-
 drivers/gpu/drm/rockchip/cdn-dp-reg.c              |   2 +
 drivers/gpu/drm/vc4/vc4_irq.c                      |   2 +-
 drivers/gpu/drm/vc4/vc4_validate.c                 |  29 +-
 drivers/gpu/drm/virtio/virtgpu_vq.c                |   3 +-
 drivers/gpu/drm/vmwgfx/ttm_object.c                |   7 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c            |  14 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c            |  22 +-
 drivers/gpu/host1x/bus.c                           |   4 +-
 drivers/hid/hid-logitech-dj.c                      |  28 +-
 drivers/hwmon/ads7828.c                            |  11 +-
 drivers/hwmon/adt7470.c                            | 131 +++--
 drivers/hwmon/asus-ec-sensors.c                    |  18 +-
 drivers/hwmon/corsair-cpro.c                       |   1 +
 drivers/hwmon/corsair-psu.c                        |   5 +-
 drivers/hwmon/lm90.c                               |   4 +-
 drivers/hwmon/nct6775-core.c                       | 435 ++++++++++++-----
 drivers/hwmon/nct6775-i2c.c                        |   2 +
 drivers/hwmon/nct6775-platform.c                   |  41 +-
 drivers/hwmon/nct6775.h                            |  33 +-
 drivers/hwmon/npcm750-pwm-fan.c                    |  11 +
 drivers/hwmon/nzxt-smart2.c                        |  10 +-
 drivers/hwmon/occ/common.c                         |  38 +-
 drivers/hwmon/pmbus/lm25066.c                      |  19 +-
 drivers/hwmon/pmbus/pmbus_core.c                   |   2 +-
 drivers/hwtracing/intel_th/core.c                  |  10 -
 drivers/hwtracing/intel_th/msu.c                   |   2 +
 drivers/i2c/busses/i2c-amd-mp2-plat.c              |   4 +-
 drivers/i2c/busses/i2c-imx.c                       |   9 +-
 drivers/i2c/busses/i2c-jz4780.c                    |   5 +-
 drivers/infiniband/core/addr.c                     |   6 +-
 drivers/infiniband/core/cma.c                      |   2 +-
 drivers/infiniband/core/mad.c                      |  30 ++
 drivers/infiniband/hw/erdma/erdma_qp.c             |   2 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |   2 +-
 drivers/infiniband/hw/irdma/verbs.c                |   4 +-
 drivers/infiniband/sw/rxe/rxe_mmap.c               |  19 +-
 drivers/infiniband/sw/siw/siw_verbs.c              |  62 ++-
 drivers/input/evdev.c                              |  27 +-
 drivers/input/misc/ims-pcu.c                       |  32 +-
 drivers/iommu/amd/init.c                           |   6 +
 drivers/iommu/intel/perf.c                         |   2 +-
 drivers/iommu/intel/svm.c                          |   2 +-
 drivers/media/cec/platform/seco/seco-cec.c         |   6 +-
 drivers/media/common/videobuf2/videobuf2-core.c    |  12 +-
 drivers/media/dvb-frontends/rtl2832.c              |   4 +-
 drivers/media/dvb-frontends/rtl2832_sdr.c          |  19 +-
 drivers/media/pci/cx23885/cx23885-core.c           |  14 +-
 drivers/media/pci/dm1105/dm1105.c                  |   1 +
 drivers/media/pci/saa7134/saa7134-video.c          |  25 +-
 drivers/media/platform/aspeed/aspeed-video.c       |   1 +
 drivers/media/platform/marvell/cafe-driver.c       |   1 +
 drivers/media/platform/st/stm32/stm32-dcmi.c       |   1 +
 drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c |   6 +-
 drivers/media/platform/ti/davinci/vpif_capture.c   |   2 +-
 drivers/media/platform/ti/vpe/vpe.c                |   3 +-
 drivers/media/radio/radio-si476x.c                 |   1 +
 drivers/media/test-drivers/vidtv/vidtv_bridge.c    |   4 +-
 drivers/media/test-drivers/vimc/vimc-core.c        |   1 +
 drivers/media/test-drivers/vivid/vivid-ctrls.c     |  15 +-
 drivers/media/test-drivers/vivid/vivid-vid-cap.c   |  38 +-
 drivers/media/test-drivers/vivid/vivid-vid-cap.h   |   1 +
 drivers/media/test-drivers/vivid/vivid-vid-out.c   |   6 +
 drivers/media/usb/airspy/airspy.c                  |   8 +-
 drivers/media/usb/cx231xx/cx231xx-cards.c          |  16 +-
 drivers/media/usb/msi2500/msi2500.c                |  32 +-
 drivers/media/usb/pwc/pwc-if.c                     |  13 +-
 drivers/media/usb/uvc/uvc_video.c                  |  76 ++-
 drivers/media/usb/uvc/uvcvideo.h                   |   4 +
 drivers/media/v4l2-core/v4l2-ctrls-core.c          |  13 +
 drivers/media/v4l2-core/v4l2-ctrls-request.c       |  14 +-
 drivers/misc/fastrpc.c                             |   3 +-
 drivers/mtd/mtdswap.c                              |   5 +-
 drivers/mtd/nand/ecc-mtk.c                         |  16 +-
 drivers/net/amt.c                                  |  87 +++-
 drivers/net/bonding/bond_alb.c                     |  10 +-
 drivers/net/bonding/bond_main.c                    |   3 +-
 drivers/net/can/c_can/c_can_main.c                 |   8 +-
 drivers/net/can/ctucanfd/ctucanfd_base.c           |  14 +-
 drivers/net/can/ctucanfd/ctucanfd_pci.c            |   3 +-
 drivers/net/can/softing/softing_fw.c               |  46 +-
 drivers/net/can/usb/ems_usb.c                      |  43 ++
 drivers/net/can/usb/etas_es58x/es58x_core.c        |   1 -
 drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c  |   1 +
 drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c   |  13 +-
 drivers/net/can/usb/peak_usb/pcan_usb_core.c       |   1 -
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c         |  40 +-
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c        |  20 +-
 drivers/net/ethernet/amd/xgbe/xgbe-mdio.c          |  11 +-
 drivers/net/ethernet/aquantia/atlantic/aq_ring.c   |  51 +-
 drivers/net/ethernet/aquantia/atlantic/aq_ring.h   |   1 +
 drivers/net/ethernet/aquantia/atlantic/aq_vec.c    |   2 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |  12 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.h          |   1 +
 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c      |   7 +-
 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c   |  22 +-
 .../net/ethernet/freescale/dpaa2/dpaa2-switch.c    |   1 +
 drivers/net/ethernet/google/gve/gve.h              |   3 +
 drivers/net/ethernet/google/gve/gve_main.c         |   3 +
 drivers/net/ethernet/google/gve/gve_rx_dqo.c       |  33 ++
 drivers/net/ethernet/hisilicon/hip04_eth.c         |  11 +-
 drivers/net/ethernet/hisilicon/hix5hd2_gmac.c      |   1 -
 drivers/net/ethernet/huawei/hinic/hinic_dev.h      |   2 -
 drivers/net/ethernet/huawei/hinic/hinic_ethtool.c  |  21 -
 drivers/net/ethernet/intel/e1000/e1000_main.c      |   2 +-
 drivers/net/ethernet/intel/i40e/i40e_debugfs.c     | 121 +----
 drivers/net/ethernet/intel/ice/ice_main.c          |  10 +
 drivers/net/ethernet/intel/ice/ice_ptp.c           |   2 +-
 drivers/net/ethernet/intel/igbvf/netdev.c          |   2 -
 .../ethernet/marvell/octeontx2/nic/otx2_flows.c    |   1 +
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |   2 +-
 .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c   |   6 +-
 .../net/ethernet/marvell/prestera/prestera_pci.c   |   3 +
 .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c   |  16 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c |  15 +
 .../ethernet/mellanox/mlx5/core/esw/acl/helper.c   |   2 +-
 .../net/ethernet/mellanox/mlxsw/spectrum_span.c    |   2 +-
 .../ethernet/netronome/nfp/nfpcore/nfp_resource.c  |   3 +
 drivers/net/ethernet/nvidia/forcedeth.c            |   4 +-
 drivers/net/ethernet/qlogic/qede/qede_main.c       |  44 +-
 drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c    |  14 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c    |  35 ++
 drivers/net/geneve.c                               |   3 +
 drivers/net/gtp.c                                  |   5 +-
 drivers/net/mctp/mctp-serial.c                     |   2 +-
 drivers/net/phy/phylink.c                          |  29 +-
 drivers/net/ppp/ppp_generic.c                      | 154 +++---
 drivers/net/ppp/pppoe.c                            |   2 +
 drivers/net/ppp/pptp.c                             |   1 +
 drivers/net/slip/slip.c                            |   4 +
 drivers/net/thunderbolt.c                          |  33 +-
 drivers/net/usb/ax88179_178a.c                     |   4 +-
 drivers/net/vmxnet3/vmxnet3_drv.c                  |  22 +-
 drivers/net/vrf.c                                  |   2 +-
 drivers/net/vxlan/vxlan_core.c                     |  22 +-
 drivers/net/wan/wanxl.c                            |   3 +-
 drivers/net/wireless/ath/ath11k/dp_rx.c            |   3 +
 drivers/net/wireless/ath/ath11k/pci.c              |   4 +
 drivers/net/wireless/ath/ath11k/qmi.c              |  11 +-
 drivers/net/wireless/ath/ath6kl/txrx.c             |  10 +-
 drivers/net/wireless/ath/ath6kl/wmi.c              |  20 +
 drivers/net/wireless/ath/ath9k/hif_usb.c           |   7 +-
 drivers/net/wireless/ath/carl9170/rx.c             |   7 +-
 drivers/net/wireless/ath/carl9170/tx.c             |   2 +-
 drivers/net/wireless/atmel/at76c50x-usb.c          |   7 +-
 .../broadcom/brcm80211/brcmfmac/cfg80211.c         |   2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |   8 +-
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |   2 +-
 drivers/net/wireless/intel/ipw2x00/ipw2100.c       |   8 +-
 drivers/net/wireless/intel/iwlwifi/mvm/d3.c        |   3 +-
 drivers/net/wireless/intersil/p54/txrx.c           |   8 +
 drivers/net/wireless/mac80211_hwsim.c              |   1 +
 drivers/net/wireless/marvell/libertas/firmware.c   |   1 +
 .../net/wireless/marvell/mwifiex/11n_rxreorder.c   |   2 +-
 drivers/net/wireless/marvell/mwifiex/tdls.c        |   2 +-
 drivers/net/wireless/marvell/mwifiex/uap_event.c   |  24 +-
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c    |   6 +
 .../net/wireless/mediatek/mt76/mt76_connac_mcu.c   |   2 +
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |  18 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mac.c    |  10 +-
 drivers/net/wireless/microchip/wilc1000/hif.c      |   5 +
 drivers/phy/xilinx/phy-zynqmp.c                    | 127 +++--
 drivers/pinctrl/Kconfig                            |   2 +
 drivers/pinctrl/devicetree.c                       |   4 +
 drivers/pinctrl/pinctrl-amd.c                      |   3 +-
 drivers/pinctrl/qcom/pinctrl-sc8280xp.c            |  21 +-
 drivers/pinctrl/renesas/pinctrl-rzg2l.c            |   4 +-
 drivers/platform/loongarch/loongson-laptop.c       |   1 +
 .../uncore-frequency/uncore-frequency-common.c     |  11 +-
 drivers/power/supply/bq25890_charger.c             |   2 +-
 drivers/ptp/ptp_ocp.c                              |   4 +-
 drivers/regulator/devres.c                         |  59 +++
 drivers/s390/block/dasd_ioctl.c                    |   2 +-
 drivers/s390/crypto/zcrypt_api.c                   |   2 +-
 drivers/s390/crypto/zcrypt_ccamisc.c               |  26 +-
 drivers/s390/net/qeth_core.h                       |   4 +-
 drivers/s390/net/qeth_core_main.c                  |   3 +
 drivers/s390/scsi/zfcp_aux.c                       |   1 +
 drivers/scsi/aic94xx/aic94xx_hwi.c                 |   2 +-
 drivers/scsi/aic94xx/aic94xx_init.c                |   6 +-
 drivers/scsi/hisi_sas/hisi_sas_main.c              |   6 +-
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c             |  16 +-
 drivers/scsi/isci/host.h                           |   2 +-
 drivers/scsi/isci/init.c                           |   4 +-
 drivers/scsi/libiscsi.c                            |   2 +-
 drivers/scsi/libiscsi_tcp.c                        |   8 +-
 drivers/scsi/libsas/sas_ata.c                      |   8 +-
 drivers/scsi/libsas/sas_discover.c                 |  35 +-
 drivers/scsi/libsas/sas_expander.c                 |   2 +-
 drivers/scsi/libsas/sas_host_smp.c                 |   4 +-
 drivers/scsi/libsas/sas_init.c                     |  51 +-
 drivers/scsi/libsas/sas_phy.c                      |   8 +-
 drivers/scsi/libsas/sas_port.c                     |   6 +-
 drivers/scsi/libsas/sas_scsi_host.c                |  14 +-
 drivers/scsi/mvsas/mv_init.c                       |   4 +-
 drivers/scsi/pm8001/pm8001_init.c                  |   2 +-
 drivers/scsi/scsi_debug.c                          |  12 +-
 drivers/spi/spi-fsl-dspi.c                         |  13 +-
 drivers/staging/media/meson/vdec/vdec.c            |   4 +-
 drivers/staging/media/sunxi/cedrus/cedrus.c        |   6 +-
 drivers/staging/media/sunxi/cedrus/cedrus_h264.c   |   3 +
 drivers/staging/media/tegra-video/vi.c             |   4 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |  12 +-
 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c      |   2 +-
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c     |   3 +
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c  |   6 +-
 drivers/target/target_core_transport.c             |  12 +-
 drivers/thermal/thermal_hwmon.c                    |   3 +-
 drivers/thunderbolt/eeprom.c                       |   9 +-
 drivers/thunderbolt/icm.c                          |   2 +-
 drivers/tty/serial/8250/8250_dma.c                 |  12 +-
 drivers/tty/serial/8250/8250_mid.c                 |  14 +-
 drivers/tty/serial/sc16is7xx.c                     |  12 +
 drivers/tty/vt/keyboard.c                          |   5 +-
 drivers/tty/vt/vt_ioctl.c                          |   2 +
 drivers/usb/atm/cxacru.c                           |   2 +
 drivers/usb/atm/ueagle-atm.c                       |  17 +
 drivers/usb/cdns3/cdnsp-gadget.c                   |   4 +-
 drivers/usb/chipidea/core.c                        |   1 +
 drivers/usb/gadget/function/f_midi.c               |   1 +
 drivers/usb/gadget/function/f_ncm.c                |  19 +-
 drivers/usb/gadget/function/f_printer.c            |  23 +-
 drivers/usb/gadget/function/uvc_v4l2.c             |   2 +
 drivers/usb/gadget/udc/bdc/bdc_core.c              |  20 +
 drivers/usb/gadget/udc/bdc/bdc_udc.c               |   7 +-
 drivers/usb/gadget/udc/dummy_hcd.c                 |  40 +-
 drivers/usb/gadget/udc/fsl_udc_core.c              |   1 -
 drivers/usb/gadget/udc/snps_udc_core.c             |   1 -
 drivers/usb/host/xhci-pci.c                        |   1 +
 drivers/usb/host/xhci.c                            |  15 +-
 drivers/usb/host/xhci.h                            |   1 +
 drivers/usb/serial/ftdi_sio.c                      |   2 +
 drivers/usb/serial/ftdi_sio_ids.h                  |   5 +
 drivers/usb/serial/io_edgeport.c                   |   3 +-
 drivers/usb/serial/keyspan_pda.c                   |  44 +-
 drivers/usb/serial/option.c                        |   1 +
 drivers/usb/storage/unusual_devs.h                 |   7 +
 drivers/vhost/vdpa.c                               |   9 +-
 drivers/vhost/vhost.c                              |   8 +
 drivers/video/fbdev/core/bitblit.c                 |   9 +-
 drivers/watchdog/watchdog_pretimeout.c             |   2 +
 fs/binfmt_elf_fdpic.c                              |   4 +
 fs/binfmt_misc.c                                   |   9 +-
 fs/btrfs/free-space-cache.c                        |   3 +
 fs/btrfs/inode.c                                   |   1 +
 fs/btrfs/relocation.c                              |   2 +
 fs/ceph/caps.c                                     |   1 +
 fs/crypto/fscrypt_private.h                        |  32 +-
 fs/crypto/inline_crypt.c                           |  57 +--
 fs/crypto/keyring.c                                | 212 ++++-----
 fs/crypto/keysetup_v1.c                            |   8 +-
 fs/exec.c                                          |   2 +-
 fs/exfat/balloc.c                                  |  54 ++-
 fs/f2fs/super.c                                    |  25 +-
 fs/namespace.c                                     |   5 +
 fs/nfs/nfs4proc.c                                  |   5 +
 fs/proc/namespaces.c                               |   4 +-
 fs/smb/client/cifssmb.c                            |  12 +-
 fs/smb/client/misc.c                               |  34 +-
 fs/smb/client/sess.c                               |   2 +-
 fs/smb/client/smb2ops.c                            |  25 +-
 fs/smb/server/smb2misc.c                           |   5 +
 fs/smb/server/smb2pdu.c                            |   9 +-
 fs/smb/server/vfs_cache.c                          |   6 +-
 include/linux/dma/qcom_bam_dma.h                   |  21 +-
 include/linux/filter.h                             |  15 +-
 include/linux/fscrypt.h                            |  18 +-
 include/linux/netdevice.h                          |   5 -
 include/linux/netfilter/ipset/ip_set.h             |   2 +-
 include/linux/netfilter/nf_conntrack_sip.h         |   2 +-
 include/linux/ppp_channel.h                        |   3 +-
 include/linux/regulator/consumer.h                 |   7 +
 include/linux/seqlock.h                            |  10 +-
 include/media/videobuf2-core.h                     |   8 +-
 include/net/act_api.h                              |  19 +
 include/net/addrconf.h                             |   4 +-
 include/net/af_unix.h                              |   1 +
 include/net/bluetooth/hci_core.h                   |  18 +
 include/net/bluetooth/l2cap.h                      |   1 +
 include/net/bluetooth/rfcomm.h                     |   3 +
 include/net/ip6_fib.h                              |   6 +-
 include/net/ip6_route.h                            |  11 +-
 include/net/ip_vs.h                                |  56 ++-
 include/net/neighbour.h                            |   8 +-
 include/net/netfilter/nf_conntrack_expect.h        |   5 +-
 include/net/route.h                                |   2 +
 include/net/sch_generic.h                          |   1 +
 include/net/sctp/structs.h                         |   3 +-
 include/scsi/libsas.h                              |   8 +-
 include/uapi/linux/btrfs.h                         |   2 +-
 io_uring/rw.c                                      |  28 +-
 kernel/audit.c                                     |  11 +-
 kernel/auditfilter.c                               |   6 +-
 kernel/bpf/bpf_lsm.c                               |   1 -
 kernel/bpf/core.c                                  |  68 ++-
 kernel/bpf/dispatcher.c                            |   2 +-
 kernel/bpf/verifier.c                              |  32 +-
 kernel/futex/core.c                                |  82 +++-
 kernel/sched/psi.c                                 |   6 +
 kernel/trace/ftrace.c                              |  13 +
 kernel/trace/ring_buffer.c                         |  10 +-
 kernel/trace/trace_eprobe.c                        |   3 +-
 kernel/trace/trace_events.c                        |   6 +-
 kernel/trace/trace_events_filter.c                 |   3 +
 kernel/trace/trace_mmiotrace.c                     |   5 +-
 kernel/trace/trace_probe.c                         |  13 +-
 lib/.gitignore                                     |   2 -
 lib/Makefile                                       |  34 +-
 lib/assoc_array.c                                  |   3 +-
 lib/rhashtable.c                                   |   1 +
 lib/test_fortify/.gitignore                        |   2 +
 lib/test_fortify/Makefile                          |  29 ++
 mm/damon/core.c                                    |  13 +
 mm/huge_memory.c                                   |  16 +-
 mm/hugetlb.c                                       |  20 +-
 mm/page_reporting.c                                |   6 +-
 mm/percpu-km.c                                     |   2 +-
 net/atm/common.c                                   |  14 +-
 net/bluetooth/6lowpan.c                            |  20 +-
 net/bluetooth/hci_conn.c                           |  19 +-
 net/bluetooth/hci_sync.c                           |  13 +-
 net/bluetooth/hidp/core.c                          |  30 +-
 net/bluetooth/l2cap_core.c                         |  38 +-
 net/bluetooth/rfcomm/core.c                        |  17 +
 net/bluetooth/rfcomm/tty.c                         |   7 +-
 net/bridge/br_mrp.c                                |   8 +-
 net/bridge/br_multicast.c                          |   1 +
 net/bridge/br_netfilter_hooks.c                    |   6 +-
 net/bridge/br_netlink_tunnel.c                     |   3 +-
 net/bridge/br_private.h                            |   6 +-
 net/bridge/br_vlan.c                               |  10 +-
 net/bridge/br_vlan_options.c                       |   3 +-
 net/bridge/netfilter/ebt_nflog.c                   |  17 +-
 net/bridge/netfilter/nf_conntrack_bridge.c         |   1 +
 net/can/bcm.c                                      | 528 +++++++++++++++------
 net/can/isotp.c                                    | 295 +++++++++---
 net/can/j1939/bus.c                                |   2 +
 net/can/j1939/j1939-priv.h                         |   3 +
 net/can/j1939/main.c                               |   8 +-
 net/can/j1939/transport.c                          |  22 +-
 net/ceph/auth_x.c                                  |   9 +-
 net/ceph/ceph_common.c                             |   4 +-
 net/ceph/mon_client.c                              |   4 +-
 net/ceph/osdmap.c                                  |  12 +-
 net/core/dst_cache.c                               |   2 +-
 net/core/filter.c                                  |   2 +-
 net/core/lwt_bpf.c                                 |   4 +-
 net/core/sock.c                                    |   1 -
 net/core/sock_map.c                                |   2 +
 net/core/xdp.c                                     |   2 +-
 net/hsr/hsr_slave.c                                |   2 +
 net/ipv4/fib_semantics.c                           | 101 ++--
 net/ipv4/fib_trie.c                                |   2 +-
 net/ipv4/icmp.c                                    |  18 +-
 net/ipv4/inet_connection_sock.c                    |  20 +-
 net/ipv4/ip_tunnel.c                               |   2 +-
 net/ipv4/nexthop.c                                 |   2 +-
 net/ipv4/route.c                                   |  31 +-
 net/ipv4/tcp_bpf.c                                 |   4 +-
 net/ipv4/tcp_ipv4.c                                | 296 +++++++++---
 net/ipv4/udp_offload.c                             |   4 +-
 net/ipv6/fib6_rules.c                              |   1 +
 net/ipv6/icmp.c                                    |   8 +-
 net/ipv6/ila/ila_common.c                          |  12 +
 net/ipv6/ila/ila_lwt.c                             |   4 +-
 net/ipv6/ip6_fib.c                                 |  17 +-
 net/ipv6/ip6_output.c                              |  20 +-
 net/ipv6/ip6_tunnel.c                              |   3 +
 net/ipv6/ip6mr.c                                   |   2 +-
 net/ipv6/ndisc.c                                   |  12 +-
 net/ipv6/ping.c                                    |   2 +-
 net/ipv6/raw.c                                     |   6 +-
 net/ipv6/route.c                                   |  36 +-
 net/ipv6/tcp_ipv6.c                                |   4 +-
 net/ipv6/udp.c                                     |  11 +-
 net/ipv6/xfrm6_policy.c                            |   3 +-
 net/iucv/af_iucv.c                                 |  21 +-
 net/l2tp/l2tp_ip6.c                                |   2 +-
 net/l2tp/l2tp_ppp.c                                |   1 +
 net/mac80211/iface.c                               |   8 +-
 net/mac80211/rx.c                                  |   2 +
 net/mac80211/s1g.c                                 |   4 +
 net/mac802154/llsec.c                              |   5 +
 net/mpls/af_mpls.c                                 |   4 +
 net/mpls/mpls_iptunnel.c                           |   2 +-
 net/mptcp/options.c                                |  12 +-
 net/mptcp/protocol.c                               |   1 +
 net/ncsi/ncsi-netlink.c                            |   4 +
 net/netfilter/ipset/ip_set_bitmap_gen.h            |   4 +-
 net/netfilter/ipset/ip_set_core.c                  |   6 +-
 net/netfilter/ipset/ip_set_hash_gen.h              |   4 +-
 net/netfilter/ipset/ip_set_list_set.c              |   4 +-
 net/netfilter/ipvs/ip_vs_app.c                     |   4 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |  44 +-
 net/netfilter/ipvs/ip_vs_core.c                    | 232 +++++----
 net/netfilter/ipvs/ip_vs_ctl.c                     |  77 ++-
 net/netfilter/ipvs/ip_vs_lc.c                      |   4 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |  21 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  50 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c               |  54 +--
 net/netfilter/ipvs/ip_vs_sync.c                    |   7 +-
 net/netfilter/ipvs/ip_vs_xmit.c                    |  56 ++-
 net/netfilter/nf_conntrack_broadcast.c             |   1 +
 net/netfilter/nf_conntrack_core.c                  |   7 +-
 net/netfilter/nf_conntrack_expect.c                |   1 +
 net/netfilter/nf_conntrack_h323_main.c             |  12 +-
 net/netfilter/nf_conntrack_helper.c                |   5 +
 net/netfilter/nf_conntrack_netlink.c               |  18 +-
 net/netfilter/nf_conntrack_sip.c                   |   4 +-
 net/netfilter/nf_flow_table_core.c                 |   8 +-
 net/netfilter/nf_flow_table_ip.c                   |   4 +-
 net/netfilter/nf_nat_sip.c                         |   2 +-
 net/netfilter/nft_payload.c                        |  12 +-
 net/netfilter/nft_rt.c                             |   2 +-
 net/netfilter/xt_hashlimit.c                       |  16 +-
 net/openvswitch/actions.c                          |  26 +-
 net/openvswitch/datapath.c                         |  54 ++-
 net/openvswitch/datapath.h                         |   2 +-
 net/openvswitch/flow.c                             |  11 +-
 net/openvswitch/meter.c                            |  33 +-
 net/openvswitch/vport.c                            |   2 +-
 net/packet/af_packet.c                             |  13 +-
 net/phonet/pep.c                                   |   2 +
 net/qrtr/af_qrtr.c                                 |   8 +
 net/qrtr/ns.c                                      |  33 +-
 net/rds/ib.c                                       |   4 +
 net/rds/ib_cm.c                                    |   4 +
 net/rds/recv.c                                     |  15 +
 net/rds/tcp.c                                      |  14 +-
 net/sched/act_gact.c                               |   5 +
 net/sched/act_police.c                             |   6 +
 net/sched/act_tunnel_key.c                         |  14 +-
 net/sched/cls_route.c                              |  35 +-
 net/sched/sch_api.c                                |   9 +
 net/sched/sch_cake.c                               |   1 -
 net/sctp/associola.c                               |  14 +-
 net/sctp/auth.c                                    |   2 +-
 net/sctp/ipv6.c                                    |   2 +-
 net/sctp/outqueue.c                                |   1 +
 net/sctp/sm_make_chunk.c                           |  26 +-
 net/sctp/sm_statefuns.c                            |   8 +-
 net/sctp/stream.c                                  |   6 +-
 net/smc/af_smc.c                                   |   3 +-
 net/smc/smc_core.c                                 |   2 +-
 net/smc/smc_llc.c                                  |   3 +-
 net/smc/smc_rx.c                                   |  19 +-
 net/sunrpc/xprtrdma/rpc_rdma.c                     |   4 +
 net/sunrpc/xprtrdma/verbs.c                        |  12 +-
 net/tipc/core.c                                    |   5 +
 net/tipc/discover.c                                |  14 +-
 net/tipc/netlink.c                                 |   6 +-
 net/tipc/netlink_compat.c                          |   4 +
 net/tipc/node.c                                    |  15 +-
 net/tipc/socket.c                                  |   3 +-
 net/tls/tls_sw.c                                   |   2 +-
 net/unix/af_unix.c                                 |   2 +
 net/unix/garbage.c                                 |  81 ++--
 net/vmw_vsock/virtio_transport.c                   |  14 +-
 net/wireless/core.c                                |   1 +
 net/wireless/nl80211.c                             |  20 +-
 net/wireless/pmsr.c                                |  21 +-
 net/wireless/scan.c                                |   2 +-
 net/x25/af_x25.c                                   |   8 +-
 net/xfrm/xfrm_policy.c                             |   7 +-
 scripts/remove-stale-files                         |   2 +
 security/integrity/ima/ima_appraise.c              |   9 +-
 security/keys/keyring.c                            |  14 +-
 sound/core/pcm_native.c                            |   7 +
 sound/core/seq/seq_timer.c                         |  13 +-
 sound/pci/lx6464es/lx6464es.c                      |   5 +-
 sound/pci/lx6464es/lx_core.c                       |   5 +-
 sound/soc/amd/ps/pci-ps.c                          |   2 +-
 sound/soc/codecs/bt-sco.c                          |  10 +-
 sound/soc/codecs/max98090.c                        |   5 +-
 sound/soc/codecs/max98095.c                        |   5 +-
 sound/soc/codecs/tas2562.c                         |  35 +-
 sound/soc/meson/aiu-fifo-spdif.c                   |   5 +
 sound/usb/6fire/chip.c                             |   4 +
 sound/usb/endpoint.c                               |  20 +-
 sound/usb/midi.c                                   |   2 +
 sound/usb/quirks.c                                 |   2 +
 sound/usb/usx2y/usX2Yhwdep.c                       |   2 +
 sound/usb/usx2y/usx2yhwdeppcm.c                    |   2 +
 tools/testing/selftests/alsa/mixer-test.c          |   1 +
 .../selftests/bpf/prog_tests/sockmap_listen.c      |  21 +-
 tools/testing/selftests/bpf/test_maps.c            |  13 +-
 tools/testing/selftests/clone3/clone3_set_tid.c    |   2 +-
 .../ftrace/test.d/dynevent/add_remove_eprobe.tc    |  16 +-
 tools/testing/selftests/net/af_unix/config         |   4 +
 tools/testing/selftests/net/openvswitch/config     |  16 +
 563 files changed, 6112 insertions(+), 2862 deletions(-)

Read the cover letter in its thread