Skip to content

6.18.47-rc1 review

Greg Kroah-Hartman imx linux-patches lkml stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest94 patches 9 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/94serial: sc16is7xx: rename EFR mutex with generic namedrivers/tty/serial/sc16is7xx.c+13 -130 replies
2/94serial: sc16is7xx: use guards for simple mutex locksdrivers/tty/serial/sc16is7xx.c+8 -150 replies
3/94serial: sc16is7xx: enable THRI before filling TX FIFOdrivers/tty/serial/sc16is7xx.c+3 -00 replies
4/94xfs: add a xchk_ip_set_corrupt helperfs/xfs/scrub/bmap.c fs/xfs/scrub/common.c fs/xfs/scrub/common.h +7 more+38 -360 replies
5/94xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref errorfs/xfs/scrub/rtsummary.c+1 -10 replies
6/94xfs: hoist per-bucket unlinked list check to helperfs/xfs/scrub/agheader.c+41 -210 replies
7/94xfs: dont livelock in scrub on a circular unlinked listfs/xfs/scrub/agheader.c fs/xfs/scrub/agheader_repair.c+51 -100 replies
8/94PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systemsdrivers/pci/controller/pci-host-generic.c drivers/pci/ecam.c include/linux/pci-ecam.h+17 -100 replies
9/94Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup acceptnet/bluetooth/rfcomm/core.c+21 -30 replies
10/94iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardowndrivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c+16 -20 replies
11/94iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pagesdrivers/iommu/iommufd/ioas.c+4 -00 replies
12/94ALSA: FCP: Use a private URB for the notification endpointsound/usb/fcp.c+21 -170 replies
13/94ALSA: scarlett2: Use a private URB for the notification endpointsound/usb/mixer.c sound/usb/mixer.h sound/usb/mixer_scarlett2.c+71 -350 replies
14/94rndis_host: add overflow check in rndis_rx_fixup()drivers/net/usb/rndis_host.c+5 -10 replies
15/94nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()drivers/nvme/target/admin-cmd.c+1 -10 replies
16/94io_uring/futex: dont mark futex wake requests as inflightio_uring/futex.c io_uring/futex.h io_uring/opdef.c+13 -10 replies
17/94ALSA: dummy: Check card index validity at probesound/drivers/dummy.c+6 -00 replies
18/94io_uring/cmd: fix iovec leak when the async cmd is not recycledio_uring/uring_cmd.c+4 -00 replies
19/94io_uring/io-wq: fix worker accounting when canceling creation callbacksio_uring/io-wq.c+6 -30 replies
20/94io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()io_uring/rsrc.c+1 -10 replies
21/94io_uring/uring_cmd: dont skip completion for a synchronous multishot cmdio_uring/uring_cmd.c+0 -40 replies
22/94ocfs2: fix missing metadata reservation for large xattrsfs/ocfs2/xattr.c+12 -60 replies
23/94null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflowsdrivers/block/null_blk/zoned.c+8 -20 replies
24/94kcov: fix data corruption and race conditions on PREEMPT_RTinclude/linux/sched.h kernel/kcov.c lib/Kconfig.debug+58 -450 replies
25/94ext4: stop retrying saturated xattr cache entriesfs/ext4/xattr.c+4 -20 replies
26/94nilfs2: reject invalid block index in GC ioctlfs/nilfs2/ioctl.c+18 -20 replies
27/94ext4: clear error before retrying inode xattr space fallbackfs/ext4/xattr.c+1 -00 replies
28/94ext4: avoid tail write_begin walk for uptodate foliosfs/ext4/inode.c+6 -50 replies
29/94ext4: propagate errors from fast commit range replayfs/ext4/fast_commit.c+12 -40 replies
30/94ext4: dont enable DAX on new encrypted filesfs/ext4/crypto.c fs/ext4/ialloc.c+24 -200 replies
31/94ext4: fix incorrect function call when initializing s_resgidfs/ext4/super.c+1 -10 replies
32/94xfs: validate attr entry pointer before field accessfs/xfs/libxfs/xfs_attr_leaf.c+14 -00 replies
33/94libceph: fix OOB read in decode_watchers() via missing bounds checknet/ceph/osd_client.c+4 -10 replies
34/94nfc: digital: clamp SENSF_RES length to the destination buffernet/nfc/digital_technology.c+2 -00 replies
35/94nfc: fdp: bound the device-reported read length and fix an skb leakdrivers/nfc/fdp/i2c.c+27 -00 replies
36/94nfc: microread: validate target discovery payload lengthsdrivers/nfc/microread/microread.c+29 -20 replies
37/94nfc: llcp: bound the connect_sn TLV walk to the skbnet/nfc/llcp_core.c+6 -40 replies
38/94nfc: llcp: fix OOB read and u8 offset wrap in TLV parsersnet/nfc/llcp_commands.c+16 -20 replies
39/94nfc: llcp: reject PDUs shorter than the LLCP headernet/nfc/llcp_core.c+5 -00 replies
40/94nfc: pn533: purge fragmented skbs during cleanupdrivers/nfc/pn533/pn533.c+1 -00 replies
41/94nfc: st21nfca: validate ATR_REQ length against the received framedrivers/nfc/st21nfca/dep.c+3 -00 replies
42/94nfc: nci: add data_len bound checks to activation parameter extractorsnet/nfc/nci/ntf.c+22 -40 replies
43/94nfc: nci: fix out-of-bounds write in nci_target_auto_activated()net/nfc/nci/ntf.c+6 -00 replies
44/94nfc: nci: fix uninit-value in the RF discover/activated NTF handlersnet/nfc/nci/ntf.c+2 -20 replies
45/94nfc: nci: free destination parameters when closing a connectionnet/nfc/nci/rsp.c+1 -00 replies
46/94drm/xe: Fix DPT allocation paths.drivers/gpu/drm/xe/display/xe_fb_pin.c+8 -240 replies
47/94ipv4: reject undersized MTUs in ip_do_fragment()net/ipv4/ip_output.c+4 -00 replies
48/94ipv6: fix use-after-free in ip6_finish_output2()net/ipv6/ip6_output.c+2 -00 replies
49/94mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()drivers/mailbox/mailbox-mchp-ipc-sbi.c+2 -00 replies
50/94dmaengine: fsl-edma: Add error handling for devm_kasprintfdrivers/dma/fsl-edma-main.c+2 -00 replies
51/94nvmet-auth: zero the AUTH_RECEIVE response bufferdrivers/nvme/target/fabrics-cmd-auth.c+1 -10 replies
52/94nvmet-fc: fix invalid free in LS IOD error pathdrivers/nvme/target/fc.c+1 -10 replies
53/94nvmet-tcp: bound SGL data length before allocating command buffersdrivers/nvme/target/tcp.c+13 -00 replies
54/94nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocationsdrivers/nvme/target/tcp.c+3 -20 replies
55/94nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()drivers/nvme/target/pci-epf.c+6 -30 replies
56/94nvmet: pci-epf: put CQ ref on create_cq mapping failuredrivers/nvme/target/pci-epf.c+1 -00 replies
57/94mptcp: pm: use for_each_subflow helpernet/mptcp/pm.c net/mptcp/pm_kernel.c net/mptcp/pm_userspace.c +1 more+12 -120 replies
58/94mptcp: pm: rename add_entry structure to add_addrnet/mptcp/pm.c net/mptcp/protocol.h+12 -120 replies
59/94mptcp: pm: uniform announced addresses helpersnet/mptcp/options.c net/mptcp/pm.c net/mptcp/pm_kernel.c +3 more+33 -340 replies
60/94mptcp: pm: fix memory leak from alloc-during-teardown racenet/mptcp/pm.c net/mptcp/pm_userspace.c net/mptcp/protocol.h+19 -50 replies
61/94selinux: use u16 for security classessecurity/selinux/ss/policydb.c security/selinux/ss/policydb.h security/selinux/ss/services.c+9 -80 replies
62/94selinux: more strict policy parsingsecurity/selinux/include/security.h security/selinux/ss/avtab.c security/selinux/ss/avtab.h +5 more+233 -600 replies
63/94selinux: require a classs permission values to cover its permission countsecurity/selinux/ss/policydb.c+46 -50 replies
64/94ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accessessound/soc/codecs/lpass-tx-macro.c+2 -20 replies
65/94HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-Cdrivers/hid/hid-input.c drivers/hid/hid-magicmouse.c+21 -10 replies
66/94HID: magicmouse: re-enable multitouch after reset-resumedrivers/hid/hid-magicmouse.c+19 -00 replies
67/94HID: magicmouse: do not keep a stale msc->input if no input is claimeddrivers/hid/hid-magicmouse.c+10 -00 replies
68/94HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_IDdrivers/hid/hid-magicmouse.c+16 -00 replies
69/94HID: core: fix OOB read of field->usage in hid_set_field()drivers/hid/hid-core.c+3 -20 replies
70/94HID: pidff: fix OOB write when hid->inputs is emptydrivers/hid/usbhid/hid-pidff.c+10 -30 replies
71/94net/ionic: avoid OOB TX partner lookup for hwstamp RXQdrivers/net/ethernet/pensando/ionic/ionic_lif.c drivers/net/ethernet/pensando/ionic/ionic_txrx.c+21 -30 replies
72/94xfrm: fix sk_dst_cache double-free in xfrm_user_policy()net/xfrm/xfrm_state.c+2 -20 replies
73/94Input: atkbd - skip deactivate for HONOR FMB-Ps internal keyboarddrivers/input/keyboard/atkbd.c+7 -00 replies
74/94Input: atkbd - skip deactivate for HONOR ZQC-Pdrivers/input/keyboard/atkbd.c+13 -50 replies
75/94futex/pi: Reject cross-mm private futex ownerskernel/futex/core.c kernel/futex/futex.h kernel/futex/pi.c+29 -90 replies
76/94futex: Sanitize and document task_struct::futex::state transitionskernel/futex/core.c kernel/futex/pi.c+73 -400 replies
77/94futex/pi: Plug private futex exec() racefs/exec.c include/linux/futex.h kernel/futex/core.c +1 more+61 -250 replies
78/94futex: Fix race on the initial mm->futex.phash.ref allocationkernel/futex/core.c+10 -60 replies
79/94futex: Fix might_sleep() warning in futex_pivot_pending()include/linux/wait.h include/linux/wait_bit.h kernel/futex/core.c +2 more+54 -40 replies
80/94HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()drivers/hid/hid-nintendo.c+6 -10 replies
81/94HID: nintendo: register input device after capabilities are setdrivers/hid/hid-nintendo.c+4 -40 replies
82/94HID: nintendo: stop device IO before hid_hw_stop on probe failuredrivers/hid/hid-nintendo.c+4 -30 replies
83/94HID: core: fix number/pointer type confusion on long itemsdrivers/hid/hid-core.c+6 -00 replies
84/94HID: sensor: custom: Fix use-after-free in enable_sensordrivers/hid/hid-sensor-custom.c+9 -80 replies
85/94HID: uclogic: fix use-after-free of inrange_timer on removedrivers/hid/hid-uclogic-core.c+11 -10 replies
86/94HID: hyperv: validate initial device info boundsdrivers/hid/hid-hyperv.c+24 -30 replies
87/94drm/xe: Dont hand out the flat CCS storage as usable VRAMdrivers/gpu/drm/xe/xe_vram.c+18 -50 replies
88/94Bluetooth: hci_event: fix LE list UAF on resetnet/bluetooth/hci_event.c+2 -00 replies
89/94Bluetooth: hci_event: validate LE Set CIG Parameters responsenet/bluetooth/hci_event.c+4 -20 replies
90/94Bluetooth: hci_sync: Fix accept list UAF during suspendnet/bluetooth/hci_sync.c+39 -110 replies
91/94Bluetooth: ISO: do not force BT_LISTEN after a failed BIG syncnet/bluetooth/iso.c+22 -80 replies
92/94Bluetooth: ISO: zero the sockaddr before returning it in getnamenet/bluetooth/iso.c+2 -00 replies
93/94Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255net/bluetooth/mgmt.c+8 -00 replies
94/94Bluetooth: hci_aml: validate firmware segment lengthsdrivers/bluetooth/hci_aml.c+16 -20 replies

Reviews trailers per patch

52 of 94 patches have a Reviewed-by or Acked-by.

PatchNicolin ChenJason GunthorpeSimon HormanHannes ReineckeChristoph HellwigNilay ShroffGabriel Krisman BertaziJoseph QiDamien Le MoalAlexander Potapenko[email protected]Jan KaraCarlos MaiolinoDarrick J. WongRitesh Harjani (IBM)Vadim FedorenkoMatthew AuldMatthew BrostIdo SchimmelFrank LiMaurizio LombardiMat MartineauViacheslav DubeykoMatthieu Baerts (NGI0)Stephen SmalleySrinivas KandagatlaAlec HallGünther NoackAlexander LobakinDisha GoelOjaswin MujooSrinivas PandruvadaHans de GoedeRuslan ShevchenkoPeter ZijlstraKyle ZengSilvan JegenSi-Wei LiuShannon NelsonBrett CreeleyPavel Machek (CIP)Florian FainelliShuah KhanRon EconomosWentao GuanBrett A C SheffieldMiguel OjedaPeter SchneiderMark Brown
SeriesT-b T-b T-b T-b T-b T-b T-b T-b T-b
1/94
2/94
3/94
4/94R-b R-b
5/94R-b
6/94R-b
7/94R-b
8/94
9/94
10/94R-b R-b
11/94
12/94
13/94
14/94R-b
15/94R-b R-b R-b
16/94
17/94
18/94
19/94R-b
20/94
21/94
22/94R-b
23/94R-b
24/94R-b
25/94Reported-and-tested-by T-b R-b
26/94
27/94R-b
28/94R-b
29/94R-b
30/94R-b T-b R-b
31/94R-b
32/94R-b
33/94R-b
34/94R-b
35/94
36/94
37/94R-b
38/94R-b
39/94R-b
40/94
41/94R-b
42/94
43/94R-b
44/94
45/94R-b
46/94R-b A-b
47/94R-b
48/94R-b R-b
49/94
50/94R-b
51/94R-b
52/94R-b
53/94R-b
54/94
55/94R-b R-b
56/94R-b
57/94R-b
58/94R-b
59/94R-b
60/94R-b
61/94A-b
62/94A-b
63/94A-b
64/94R-b
65/94
66/94
67/94R-b T-b
68/94R-b
69/94
70/94
71/94R-b R-b R-b R-b
72/94
73/94R-b
74/94T-b
75/94A-b
76/94A-b R-b
77/94A-b R-b
78/94
79/94
80/94R-b
81/94
82/94
83/94
84/94A-b
85/94
86/94
87/94
88/94
89/94
90/94
91/94
92/94
93/94
94/94

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 49 reviewers.

Read the v1 thread

Cover letter [PATCH 6.18 00/94] 6.18.47-rc1 review

This is the start of the stable review cycle for the 6.18.47 release. There are 94 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.47-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.18.47-rc1

Laxman Acharya Padhya <[email protected]>
Bluetooth: hci_aml: validate firmware segment lengths

Ali Ahmet Memis <[email protected]>
Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255

Ali Ahmet Memis <[email protected]>
Bluetooth: ISO: zero the sockaddr before returning it in getname

Ali Ahmet Memis <[email protected]>
Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync

Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Fix accept list UAF during suspend

Laxman Acharya Padhya <[email protected]>
Bluetooth: hci_event: validate LE Set CIG Parameters response

Chengfeng Ye <[email protected]>
Bluetooth: hci_event: fix LE list UAF on reset

Linus Torvalds <[email protected]>
drm/xe: Don't hand out the flat CCS storage as usable VRAM

Michael Bommarito <[email protected]>
HID: hyperv: validate initial device info bounds

Ibrahim Hashimov <[email protected]>
HID: uclogic: fix use-after-free of inrange_timer on remove

Haoxiang Li <[email protected]>
HID: sensor: custom: Fix use-after-free in enable_sensor

Jann Horn <[email protected]>
HID: core: fix number/pointer type confusion on long items

Jiangshan Yi <[email protected]>
HID: nintendo: stop device IO before hid_hw_stop on probe failure

Jiangshan Yi <[email protected]>
HID: nintendo: register input device after capabilities are set

Ibrahim Hashimov <[email protected]>
HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()

Peter Zijlstra <[email protected]>
futex: Fix might_sleep() warning in futex_pivot_pending()

Hyunwoo Kim <[email protected]>

    futex: Fix race on the initial mm->futex.phash.ref allocation

Thomas Gleixner <[email protected]>
futex/pi: Plug private futex exec() race

Thomas Gleixner <[email protected]>
futex: Sanitize and document task_struct::futex::state transitions

Kyle Zeng <[email protected]>
futex/pi: Reject cross-mm private futex owners

Donglin Lyu <[email protected]>
Input: atkbd - skip deactivate for HONOR ZQC-P

Cryolitia PukNgae <[email protected]>
Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard

Xiang Mei (Microsoft) <[email protected]>
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()

Anand Khoje <[email protected]>
net/ionic: avoid OOB TX partner lookup for hwstamp RXQ

Baul Lee <[email protected]>

    HID: pidff: fix OOB write when hid->inputs is empty

Baul Lee <[email protected]>

    HID: core: fix OOB read of field->usage in hid_set_field()

Lee Jones <[email protected]>
HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID

Jose Villaseñor Montfort <[email protected]>

    HID: magicmouse: do not keep a stale msc->input if no input is claimed

Christopher Kodama <[email protected]>
HID: magicmouse: re-enable multitouch after reset-resume

Andrei Fed <[email protected]>
HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C

Dawid Wróbel <[email protected]>
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses

Bryam Vargas <[email protected]>
selinux: require a class's permission values to cover its permission count

Christian Göttsche <[email protected]>
selinux: more strict policy parsing

Christian Göttsche <[email protected]>
selinux: use u16 for security classes

Shardul Bankar <[email protected]>
mptcp: pm: fix memory leak from alloc-during-teardown race

Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: uniform announced addresses helpers

Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: rename add_entry structure to add_addr

Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: use for_each_subflow helper

Yifei Gao <[email protected]>
nvmet: pci-epf: put CQ ref on create_cq mapping failure

Shin'ichiro Kawasaki <[email protected]>
nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()

Greg Kroah-Hartman <[email protected]>
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

Ibrahim Hashimov <[email protected]>
nvmet-tcp: bound SGL data length before allocating command buffers

Jiang HongHui <[email protected]>
nvmet-fc: fix invalid free in LS IOD error path

Bryam Vargas <[email protected]>
nvmet-auth: zero the AUTH_RECEIVE response buffer

Griffin Kroah-Hartman <[email protected]>
dmaengine: fsl-edma: Add error handling for devm_kasprintf

Griffin Kroah-Hartman <[email protected]>
mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()

Luxiao Xu <[email protected]>
ipv6: fix use-after-free in ip6_finish_output2()

Yong Wang <[email protected]>
ipv4: reject undersized MTUs in ip_do_fragment()

Maarten Lankhorst <[email protected]>
drm/xe: Fix DPT allocation paths.

Linmao Li <[email protected]>
nfc: nci: free destination parameters when closing a connection

Samuel Page <[email protected]>
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers

Samuel Page <[email protected]>
nfc: nci: fix out-of-bounds write in nci_target_auto_activated()

Bryam Vargas <[email protected]>
nfc: nci: add data_len bound checks to activation parameter extractors

Doruk Tan Ozturk <[email protected]>
nfc: st21nfca: validate ATR_REQ length against the received frame

Xu Rao <[email protected]>
nfc: pn533: purge fragmented skbs during cleanup

Doruk Tan Ozturk <[email protected]>
nfc: llcp: reject PDUs shorter than the LLCP header

Muhammad Bilal <[email protected]>
nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers

Doruk Tan Ozturk <[email protected]>
nfc: llcp: bound the connect_sn TLV walk to the skb

Pengpeng Hou <[email protected]>
nfc: microread: validate target discovery payload lengths

Bryam Vargas <[email protected]>
nfc: fdp: bound the device-reported read length and fix an skb leak

Doruk Tan Ozturk <[email protected]>
nfc: digital: clamp SENSF_RES length to the destination buffer

Pavitra Jha <[email protected]>
libceph: fix OOB read in decode_watchers() via missing bounds check

Hongling Zeng <[email protected]>
xfs: validate attr entry pointer before field access

Jiazi Liu <[email protected]>
ext4: fix incorrect function call when initializing s_resgid

Eric Biggers <[email protected]>
ext4: don't enable DAX on new encrypted files

Guanghui Yang <[email protected]>
ext4: propagate errors from fast commit range replay

Jia Zhu <[email protected]>
ext4: avoid tail write_begin walk for uptodate folios

Guanghui Yang <[email protected]>
ext4: clear error before retrying inode xattr space fallback

Ryusuke Konishi <[email protected]>
nilfs2: reject invalid block index in GC ioctl

Matthias Goergens <[email protected]>
ext4: stop retrying saturated xattr cache entries

Tetsuo Handa <[email protected]>
kcov: fix data corruption and race conditions on PREEMPT_RT

Rik van Riel <[email protected]>
null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows

Ian Bridges <[email protected]>
ocfs2: fix missing metadata reservation for large xattrs

Jens Axboe <[email protected]>
io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd

Ali Ahmet Memis <[email protected]>
io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()

Vishnu Razdan <[email protected]>
io_uring/io-wq: fix worker accounting when canceling creation callbacks

Woraphat Khiaodaeng <[email protected]>
io_uring/cmd: fix iovec leak when the async cmd is not recycled

Takashi Iwai <[email protected]>
ALSA: dummy: Check card index validity at probe

Jens Axboe <[email protected]>
io_uring/futex: don't mark futex wake requests as inflight

Guixin Liu <[email protected]>
nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()

Griffin Kroah-Hartman <[email protected]>
rndis_host: add overflow check in rndis_rx_fixup()

Geoffrey D. Bennett <[email protected]>
ALSA: scarlett2: Use a private URB for the notification endpoint

Geoffrey D. Bennett <[email protected]>
ALSA: FCP: Use a private URB for the notification endpoint

Peiyang He <[email protected]>
iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages

Shameer Kolothum <[email protected]>
iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown

Ali Ahmet Memis <[email protected]>
Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept

Steffen Persvold <[email protected]>
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

Darrick J. Wong <[email protected]>
xfs: don't livelock in scrub on a circular unlinked list

Darrick J. Wong <[email protected]>
xfs: hoist per-bucket unlinked list check to helper

Darrick J. Wong <[email protected]>
xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error

Christoph Hellwig <[email protected]>
xfs: add a xchk_ip_set_corrupt helper

Luca Fresi <[email protected]>
serial: sc16is7xx: enable THRI before filling TX FIFO

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: use guards for simple mutex locks

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: rename EFR mutex with generic name

-------------

Diffstat:

 Makefile                                         |   4 +-
 drivers/block/null_blk/zoned.c                   |  10 +-
 drivers/bluetooth/hci_aml.c                      |  18 +-
 drivers/dma/fsl-edma-main.c                      |   2 +
 drivers/gpu/drm/xe/display/xe_fb_pin.c           |  32 +--
 drivers/gpu/drm/xe/xe_vram.c                     |  23 ++-
 drivers/hid/hid-core.c                           |  11 +-
 drivers/hid/hid-hyperv.c                         |  27 ++-
 drivers/hid/hid-input.c                          |   3 +
 drivers/hid/hid-magicmouse.c                     |  64 +++++-
 drivers/hid/hid-nintendo.c                       |  22 +-
 drivers/hid/hid-sensor-custom.c                  |  21 +-
 drivers/hid/hid-uclogic-core.c                   |  12 +-
 drivers/hid/usbhid/hid-pidff.c                   |  13 +-
 drivers/input/keyboard/atkbd.c                   |  23 ++-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c      |   2 +
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h      |   1 +
 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c   |  15 +-
 drivers/iommu/iommufd/ioas.c                     |   4 +
 drivers/mailbox/mailbox-mchp-ipc-sbi.c           |   2 +
 drivers/net/ethernet/pensando/ionic/ionic_lif.c  |  17 +-
 drivers/net/ethernet/pensando/ionic/ionic_txrx.c |   7 +-
 drivers/net/usb/rndis_host.c                     |   6 +-
 drivers/nfc/fdp/i2c.c                            |  27 +++
 drivers/nfc/microread/microread.c                |  31 ++-
 drivers/nfc/pn533/pn533.c                        |   1 +
 drivers/nfc/st21nfca/dep.c                       |   3 +
 drivers/nvme/target/admin-cmd.c                  |   2 +-
 drivers/nvme/target/fabrics-cmd-auth.c           |   2 +-
 drivers/nvme/target/fc.c                         |   2 +-
 drivers/nvme/target/pci-epf.c                    |  10 +-
 drivers/nvme/target/tcp.c                        |  18 +-
 drivers/pci/controller/pci-host-generic.c        |  11 +-
 drivers/pci/ecam.c                               |  13 ++
 drivers/tty/serial/sc16is7xx.c                   |  40 ++--
 fs/exec.c                                        |   8 +-
 fs/ext4/crypto.c                                 |  40 ++--
 fs/ext4/fast_commit.c                            |  16 +-
 fs/ext4/ialloc.c                                 |   4 +
 fs/ext4/inode.c                                  |  11 +-
 fs/ext4/super.c                                  |   2 +-
 fs/ext4/xattr.c                                  |   7 +-
 fs/nilfs2/ioctl.c                                |  20 +-
 fs/ocfs2/xattr.c                                 |  18 +-
 fs/xfs/libxfs/xfs_attr_leaf.c                    |  14 ++
 fs/xfs/scrub/agheader.c                          |  94 ++++++---
 fs/xfs/scrub/agheader_repair.c                   |  17 +-
 fs/xfs/scrub/bmap.c                              |   8 +-
 fs/xfs/scrub/common.c                            |  10 +-
 fs/xfs/scrub/common.h                            |   2 +
 fs/xfs/scrub/dir.c                               |   2 +-
 fs/xfs/scrub/dirtree.c                           |   4 +-
 fs/xfs/scrub/metapath.c                          |   6 +-
 fs/xfs/scrub/nlinks.c                            |  12 +-
 fs/xfs/scrub/parent.c                            |   6 +-
 fs/xfs/scrub/rtbitmap.c                          |  12 +-
 fs/xfs/scrub/rtsummary.c                         |  12 +-
 include/linux/futex.h                            |   2 +
 include/linux/pci-ecam.h                         |   3 +
 include/linux/sched.h                            |   8 +
 include/linux/wait.h                             |   1 +
 include/linux/wait_bit.h                         |   1 +
 io_uring/futex.c                                 |  11 +
 io_uring/futex.h                                 |   1 +
 io_uring/io-wq.c                                 |   9 +-
 io_uring/opdef.c                                 |   2 +-
 io_uring/rsrc.c                                  |   2 +-
 io_uring/uring_cmd.c                             |   8 +-
 kernel/futex/core.c                              | 122 +++++++----
 kernel/futex/futex.h                             |   9 +
 kernel/futex/pi.c                                | 125 +++++++++---
 kernel/kcov.c                                    |  90 ++++----
 kernel/sched/wait.c                              |  15 ++
 kernel/sched/wait_bit.c                          |  14 +-
 lib/Kconfig.debug                                |   5 +-
 net/bluetooth/hci_event.c                        |   8 +-
 net/bluetooth/hci_sync.c                         |  46 ++++-
 net/bluetooth/iso.c                              |  32 ++-
 net/bluetooth/mgmt.c                             |   8 +
 net/bluetooth/rfcomm/core.c                      |  24 ++-
 net/ceph/osd_client.c                            |   5 +-
 net/ipv4/ip_output.c                             |   4 +
 net/ipv6/ip6_output.c                            |   2 +
 net/mptcp/options.c                              |   2 +-
 net/mptcp/pm.c                                   |  74 ++++---
 net/mptcp/pm_kernel.c                            |  22 +-
 net/mptcp/pm_userspace.c                         |  10 +-
 net/mptcp/protocol.h                             |  25 +--
 net/mptcp/subflow.c                              |   4 +-
 net/nfc/digital_technology.c                     |   2 +
 net/nfc/llcp_commands.c                          |  18 +-
 net/nfc/llcp_core.c                              |  15 +-
 net/nfc/nci/ntf.c                                |  36 +++-
 net/nfc/nci/rsp.c                                |   1 +
 net/xfrm/xfrm_state.c                            |   4 +-
 security/selinux/include/security.h              |   1 +
 security/selinux/ss/avtab.c                      |  35 +++-
 security/selinux/ss/avtab.h                      |  13 ++
 security/selinux/ss/conditional.c                |  18 +-
 security/selinux/ss/constraint.h                 |   1 +
 security/selinux/ss/policydb.c                   | 248 +++++++++++++++++++----
 security/selinux/ss/policydb.h                   |  31 ++-
 security/selinux/ss/services.c                   |   8 +-
 sound/drivers/dummy.c                            |   6 +
 sound/soc/codecs/lpass-tx-macro.c                |   4 +-
 sound/usb/fcp.c                                  |  38 ++--
 sound/usb/mixer.c                                |   6 +
 sound/usb/mixer.h                                |   2 +
 sound/usb/mixer_scarlett2.c                      |  98 +++++----
 109 files changed, 1533 insertions(+), 570 deletions(-)