Skip to content

7.2.4-rc1 review

Greg Kroah-Hartman driver-core linux-patches lkml stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest713 patches 13 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/713drm/amd/display: Skip Update HDCP Config In Transition Statedrivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c+20 -80 replies
2/713ASoC: tegra210_i2s: sort the register default tablesound/soc/tegra/tegra210_i2s.c+1 -10 replies
3/713ASoC: tegra210_i2s: sort the Tegra264 register default tablesound/soc/tegra/tegra210_i2s.c+3 -30 replies
4/713ASoC: tegra210_mixer: sort the register default tablesound/soc/tegra/tegra210_mixer.c+1 -10 replies
5/713ASoC: tegra: Fix the I2S enable default valuesound/soc/tegra/tegra210_i2s.c sound/soc/tegra/tegra210_i2s.h+18 -30 replies
6/713ASoC: tegra: Fix the MIXER enable default valuesound/soc/tegra/tegra210_mixer.c+7 -30 replies
7/713ASoC: tegra: Sort ADMAIF register defaultssound/soc/tegra/tegra210_admaif.c+138 -700 replies
8/713ASoC: tegra: Sort MBDRC register defaultssound/soc/tegra/tegra210_mbdrc.c+21 -210 replies
9/713btrfs: write-protect folios during data writebackfs/btrfs/extent_io.c fs/btrfs/extent_io.h fs/btrfs/inode.c+53 -60 replies
10/713ring-buffer: Fix subbuf resize race with ring buffer readerskernel/trace/ring_buffer.c+106 -610 replies
11/713drm/amd/display: hide Apple Studio Display secondary tiledrivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c drivers/gpu/drm/amd/display/dc/dc_types.h+48 -00 replies
12/713drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tiledrivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c+43 -00 replies
13/713alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionallyarch/alpha/include/uapi/asm/fpu.h+6 -20 replies
14/713iomap: dont free integrity payload that doesnt existfs/iomap/bio.c+1 -10 replies
15/713rust: time: fix as_micros_ceil() rounding near i64::MAXrust/kernel/time.rs+10 -70 replies
16/713alpha: dont leak hardware-fabricated FP exception bits to user spacearch/alpha/kernel/traps.c arch/alpha/math-emu/math.c+80 -140 replies
17/713clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error pathdrivers/clocksource/timer-nxp-pit.c+3 -10 replies
18/713clocksource/drivers/timer-sun4i: Advertise a real minimum deltadrivers/clocksource/timer-sun4i.c+1 -10 replies
19/713fs: fix user path of nested backing filesfs/backing-file.c+1 -10 replies
20/713ovl: fix double end_creating() on the casefold-mismatch pathfs/overlayfs/dir.c+0 -10 replies
21/713pidfd: hold exec_update_lock around namespace ioctlfs/pidfs.c+31 -120 replies
22/713powerpc/pseries/iommu: switch to Default DMA window during kdumparch/powerpc/platforms/pseries/iommu.c+12 -110 replies
23/713rust: fmt: fix {:p} printing stack addressesrust/kernel/fmt.rs+8 -10 replies
24/713timers/itimer: Zero-init old itimerval before copy to userspacekernel/time/itimer.c+1 -10 replies
25/713objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0tools/objtool/check.c+1 -00 replies
26/713rust: kbuild: disambiguate `zerocopy` for `rusttest`rust/Makefile+1 -10 replies
27/713rust: bug: skip arch-specific asm in `testlib` buildsrust/kernel/bug.rs+5 -10 replies
28/713rust: bug: fix warn_on macro build error on UMLrust/kernel/bug.rs+1 -10 replies
29/713rust: bug: prevent dead_code warning from warn_on!s flags constantrust/kernel/bug.rs+22 -40 replies
30/713rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22scripts/rust_is_available.sh scripts/rust_is_available_bindgen_libclang_22.h scripts/rust_is_available_test.py+48 -10 replies
31/713rust: dma: return zero for Coherent reads past EOFrust/kernel/dma.rs+5 -10 replies
32/713rust: devres: fix race between concurrent revokersrust/kernel/devres.rs+16 -20 replies
33/713rust: devres: ensure revocation is complete before device finishes unbindingrust/kernel/devres.rs+7 -00 replies
34/713rust: kbuild: disambiguate `zerocopy_derive` for `rusttest`rust/Makefile+2 -10 replies
35/713rust: kernel: list: fix incorrect pop_back example commentrust/kernel/list.rs+1 -10 replies
36/713objtool/rust: add one more `noreturn` Rust functiontools/objtool/check.c+1 -00 replies
37/713rust: num: restrict bool conversion to unsigned Boundedrust/kernel/num/bounded.rs+21 -90 replies
38/713rust: cfi: disable function merging if CFI is enabledMakefile+2 -10 replies
39/713kbuild: rust: preserve unreachable traps with inline helpersMakefile rust/Makefile scripts/Makefile.build+14 -20 replies
40/713kbuild: rust: keep Rust objects out of Clang LTO with inline helpersrust/Makefile scripts/Makefile.build+2 -20 replies
41/713KEYS: trusted: Fix TPM teardown orderingsecurity/keys/trusted-keys/trusted_tpm1.c+1 -10 replies
42/713apparmor: fix cred UAF caused by begin_current_label_crit_section()security/apparmor/include/cred.h security/apparmor/include/task.h security/apparmor/task.c+39 -90 replies
43/713apparmor: fix out-of-bounds write when null terminating a label vecsecurity/apparmor/include/label.h+3 -30 replies
44/713include/linux/list.h: mark list_add and __list_add as __always_inlineinclude/linux/list.h+11 -40 replies
45/713mm, swap: dont free a hibernation slot that is in the swap cachemm/swapfile.c+8 -10 replies
46/713mm, swap: ratelimit bad swap entry reportsmm/swapfile.c+3 -30 replies
47/713mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()mm/gup.c+8 -20 replies
48/713mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmdmm/huge_memory.c+2 -20 replies
49/713mm/huge_memory: use folios memcg inside __folio_split()mm/huge_memory.c+16 -40 replies
50/713mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pagesmm/hugetlb.c mm/hugetlb_vmemmap.c mm/sparse-vmemmap.c+26 -180 replies
51/713mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlierinclude/linux/hugetlb.h mm/hugetlb.c mm/mm_init.c +1 more+10 -50 replies
52/713mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios()mm/hugetlb_vmemmap.c+3 -30 replies
53/713mm/kmemleak: avoid soft lockup when scanning task stacksmm/kmemleak.c+38 -130 replies
54/713mm/madvise: skip device-private PMDs in cold and pageout walksmm/madvise.c+2 -20 replies
55/713mm/mempolicy: skip non-present PMDs when queueing foliosmm/mempolicy.c+5 -30 replies
56/713mm/mglru: fix and remove redundant unevictable folio handlingmm/vmscan.c+5 -140 replies
57/713mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()mm/migrate.c+1 -10 replies
58/713mm/migrate: use huge_ptep_get() in remove_migration_pte()mm/migrate.c+5 -10 replies
59/713mm/migrate_device: clear stale mapping after freeing swapcachemm/migrate_device.c+13 -00 replies
60/713mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfnmm/mm_init.c+6 -30 replies
61/713mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()mm/page_owner.c+7 -30 replies
62/713mm/page_vma_mapped: use huge_ptep_get() for hugetlbmm/page_vma_mapped.c+7 -10 replies
63/713mm/pagewalk: fix stale walk->action escaping walk_pmd_range()mm/pagewalk.c+2 -40 replies
64/713mm/rmap: use huge_ptep_get() in try_to_unmap_one()include/linux/hugetlb.h mm/rmap.c+12 -60 replies
65/713mm/rmap: use huge_ptep_get() in try_to_migrate_one()mm/rmap.c+9 -60 replies
66/713mm/slub: fix missing debugfs entries for caches created before sysfs initmm/slub.c+48 -280 replies
67/713mm/slub: prevent pfmemalloc objects from entering the barnmm/slub.c+1 -10 replies
68/713mm/vmalloc: make vm_struct.nr_pages an unsigned longinclude/linux/vmalloc.h mm/vmalloc.c+30 -320 replies
69/713mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()mm/vmscan.c+1 -10 replies
70/713mm/zswap: fix global shrinker when memory cgroup is disabledmm/zswap.c+7 -60 replies
71/713mm: compaction: support non-movable compaction for pageblock requestsmm/compaction.c+39 -70 replies
72/713mm: memcg-v1: fix wrong linux-mm list address in deprecation warningsmm/memcontrol-v1.c+3 -30 replies
73/713mm: memcg-v1: fix memsw and TCP failcnt accountingmm/memcontrol.c+2 -00 replies
74/713mm: memcg: stop reclaim when a limit update is supersededmm/memcontrol.c+6 -00 replies
75/713mm: memcontrol: update state_local when flushing NMI statsmm/memcontrol.c+5 -00 replies
76/713mm: mempolicy: fix automatic numa balancing for shmemmm/mempolicy.c+6 -150 replies
77/713mm: page_alloc: __GFP_FS lockdep annotation for direct compactionmm/page_alloc.c+2 -00 replies
78/713mm: page_alloc: move capture_control to the page allocatorinclude/linux/compaction.h mm/compaction.c mm/internal.h +1 more+57 -450 replies
79/713mm: page_alloc: fix non-movable reclaim storm in defrag_modemm/compaction.c mm/internal.h mm/page_alloc.c+33 -60 replies
80/713mm: vmscan: fix node reclaim ignoring swappiness parametermm/vmscan.c+7 -120 replies
81/713tools/compiler: match glibc 2.42 definition of __attribute_const__tools/include/linux/compiler.h+1 -10 replies
82/713x86/locking: Use sfence for wmb() if SSE is availablearch/x86/include/asm/barrier.h+1 -10 replies
83/713x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()arch/x86/include/asm/insn-eval.h arch/x86/kvm/emulate.c+40 -220 replies
84/713x86/tdx: Fix off-by-one in port I/O handlingarch/x86/coco/tdx/tdx.c+2 -20 replies
85/713x86/tdx: Fix zero-extension for 32-bit port I/Oarch/x86/coco/tdx/tdx.c+3 -50 replies
86/713x86/xen: fix init of balloon stats againdrivers/xen/balloon.c+19 -100 replies
87/713hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()drivers/hwtracing/ptt/hisi_ptt.c+13 -70 replies
88/713tracing/user_events: Clear copied tracing state before fork duplicationkernel/trace/trace_events_user.c+3 -00 replies
89/713tracing: Fix crash passing ERR_PTR to kthread_stop()kernel/trace/trace_events.c+2 -00 replies
90/713tracing: Fix logged instance name on creation failurekernel/trace/trace.c+2 -10 replies
91/713tracing: Fix retry exhaustion in simple ring buffer reader swapkernel/trace/simple_ring_buffer.c+2 -20 replies
92/713tracing: Fix use-after-free in trace_pipe read on sub-buffer order changekernel/trace/trace.c+3 -00 replies
93/713tracing: Fix use-after-free with same-name named triggerskernel/trace/trace_events_hist.c+3 -10 replies
94/713cdx: Fix double free when sysfs file creation failsdrivers/cdx/cdx.c+5 -20 replies
95/713debugfs: Fix lockdown check for mmap_preparefs/debugfs/file.c+2 -10 replies
96/713device property: fix infinite loop in fwnode_for_each_child_node()drivers/base/property.c+16 -30 replies
97/713misc: nsm: bound the device-reported response lengthdrivers/misc/nsm.c+1 -10 replies
98/713powerpc/powermac: fix OF node refcountarch/powerpc/platforms/powermac/low_i2c.c+1 -10 replies
99/713rapidio: mport_cdev: fix use-after-free in dma_req_free()drivers/rapidio/devices/rio_mport_cdev.c+7 -30 replies
100/713Revert "media: v4l2-dev: fix error handling in __video_register_device()"drivers/media/v4l2-core/v4l2-dev.c+7 -70 replies
101/713serial: imx: serialize imx_uart_ports[] lifetimedrivers/tty/serial/imx.c+17 -30 replies
102/713staging: greybus: hid: fix SET_REPORT return valuedrivers/staging/greybus/hid.c+1 -10 replies
103/713usb: dwc2: gadget: Exit partial power down state when changing USB pull-updrivers/usb/dwc2/gadget.c+10 -10 replies
104/713usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race conditiondrivers/usb/dwc3/gadget.c+1 -00 replies
105/713usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freeddrivers/usb/gadget/udc/at91_udc.c+19 -10 replies
106/713USB: phy: fsl-usb: fix missing static keywordsdrivers/usb/phy/phy-fsl-usb.c drivers/usb/phy/phy-fsl-usb.h+29 -290 replies
107/713usb: typec: hd3ss3220: fix VBUS regulator error messagedrivers/usb/typec/hd3ss3220.c+1 -10 replies
108/713usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()drivers/usb/typec/tcpm/tcpci.c include/linux/usb/tcpci.h+12 -10 replies
109/713usb: typec: thunderbolt: Disable work before freeing tbt on removedrivers/usb/typec/altmodes/thunderbolt.c+2 -00 replies
110/713usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completiondrivers/usb/typec/ucsi/ucsi.c+2 -10 replies
111/713usb: gadget: u_audio: Fix use-after-free on sound card disconnectdrivers/usb/gadget/function/u_audio.c+18 -60 replies
112/713usb: gadget: snps_udc_plat: clean up PHY on probe deferraldrivers/usb/gadget/udc/snps_udc_plat.c+2 -30 replies
113/713usb: gadget: midi2: remove default configfs groups on teardowndrivers/usb/gadget/function/f_midi2.c+2 -00 replies
114/713usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()drivers/usb/gadget/function/f_tcm.c+12 -110 replies
115/713usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()drivers/usb/gadget/function/uvc_video.c+1 -10 replies
116/713usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()drivers/usb/gadget/function/f_uvc.c+6 -10 replies
117/713usb: gadget: f_fs: Prevent deadlock during ep0 read loopdrivers/usb/gadget/function/f_fs.c+10 -40 replies
118/713cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register readdrivers/cxl/core/ras_rch.c+16 -10 replies
119/713fpga: altera-cvp: Avoid out-of-bounds read in trailing byte writedrivers/fpga/altera-cvp.c+6 -40 replies
120/713HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_featuredrivers/hid/hid-sensor-hub.c+26 -180 replies
121/713i3c: renesas: Fix out-of-bounds access for newdevs maskdrivers/i3c/master/renesas-i3c.c+5 -10 replies
122/713KVM: arm64: GICv2: Dont WARN on out-of-range GICV_DIR INTIDarch/arm64/kvm/vgic/vgic-v2.c+2 -10 replies
123/713lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()lib/ucs2_string.c+1 -10 replies
124/713media: cec: stm32: prevent out-of-bounds write on RX overflowdrivers/media/cec/platform/stm32/stm32-cec.c+2 -10 replies
125/713media: vicodec: fix out-of-bounds write in FWHT encoderdrivers/media/test-drivers/vicodec/vicodec-core.c+2 -20 replies
126/713nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncationfs/nilfs2/bmap.c fs/nilfs2/bmap.h fs/nilfs2/btree.c +1 more+36 -110 replies
127/713of: fix out-of-bounds read in of_alias_scan() stem parserdrivers/of/base.c+1 -10 replies
128/713PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()arch/powerpc/kernel/pci-common.c drivers/pci/pci-sysfs.c+17 -100 replies
129/713phy: rockchip-samsung-dcphy: fix out-of-range max_registerdrivers/phy/rockchip/phy-rockchip-samsung-dcphy.c+1 -10 replies
130/713ubifs: fix out-of-bounds read in signature length checkfs/ubifs/auth.c+1 -10 replies
131/713zram: fix out-of-bounds access in read_block_state()drivers/block/zram/zram_drv.c+3 -10 replies
132/713zram: fix out-of-bounds access in writeback_store()drivers/block/zram/zram_drv.c+5 -20 replies
133/713zram: set default primary compressor in zram_destroy_comps()drivers/block/zram/zram_drv.c+1 -20 replies
134/713zram: validate deflate paramsdrivers/block/zram/backend_deflate.c+9 -10 replies
135/713zsmalloc: account for handle size in class lookupmm/zsmalloc.c+7 -40 replies
136/713NFS/localio: fix ref leak on nfs_uuid_add_file failurefs/nfs_common/nfslocalio.c+15 -10 replies
137/713NFS: fix delegation_hash_table leak when nfs4_server_common_setup() failsfs/nfs/nfs4client.c+12 -50 replies
138/713NFSD: check truncate permission under inode lockfs/nfsd/vfs.c+18 -120 replies
139/713NFSD: Encode only the status in NFS-ACL v2 GETACL error repliesfs/nfsd/nfs2acl.c+15 -160 replies
140/713NFSD: Fix off-by-one in DRC bucket pruning limitfs/nfsd/nfscache.c+1 -10 replies
141/713NFSD: fix up error returned by write_threads()fs/nfsd/nfsctl.c+5 -10 replies
142/713NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lockfs/nfsd/nfs4state.c+25 -190 replies
143/713NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_checkfs/nfsd/nfsfh.c+1 -30 replies
144/713nfsd: guard nfsd_serv deref in nfsd_file_net_disposefs/nfsd/filecache.c+12 -30 replies
145/713NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget pathfs/nfs/pnfs.c+1 -00 replies
146/713pNFS: Fix EBUSY check in pnfs_layout_need_returnfs/nfs/pnfs.c+1 -10 replies
147/713lockd, nfsd: RCU-protect nlmsvc_ops dispatchfs/lockd/svc.c fs/lockd/svc4proc.c fs/lockd/svcproc.c +3 more+64 -180 replies
148/713nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardownfs/nfsd/nfs4callback.c fs/nfsd/nfs4state.c fs/nfsd/state.h +1 more+100 -300 replies
149/713nfsd: release path refs on follow_down() errorfs/nfsd/vfs.c+3 -10 replies
150/713nfsd: Reset write verifier when async COPY writeback failsfs/nfsd/nfs4proc.c+2 -00 replies
151/713nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit pathsfs/nfsd/nfssvc.c+17 -60 replies
152/713nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 typesfs/nfsd/nfs4xdr.c+13 -00 replies
153/713nfsd: sample writeback error cursor before async COPY loopfs/nfsd/nfs4proc.c+1 -10 replies
154/713nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegationsfs/nfsd/nfs4state.c+1 -00 replies
155/713nfsd: size fh_verify server sockaddr slot by xpt_locallenfs/nfsd/trace.h+2 -20 replies
156/713nfsd: validate nseconds in TIME_DELEG decode pathsfs/nfsd/nfs4callback.c fs/nfsd/nfs4xdr.c+8 -00 replies
157/713nfsd: validate sockaddr length per family in listener_setfs/nfsd/nfsctl.c+65 -120 replies
158/713nfsd: validate symlink target length in NFSv4 CREATEfs/nfsd/nfs4xdr.c+4 -00 replies
159/713nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storagefs/nfsd/nfsctl.c+6 -60 replies
160/713nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()fs/nfsd/nfsproc.c+7 -00 replies
161/713nfsd: add filehandle match check to nfsd4_delegreturn()fs/nfsd/nfs4state.c+4 -00 replies
162/713nfsd: add missing read barrier to rpc_status_get dumpit seqcount retryfs/nfsd/nfsctl.c+7 -40 replies
163/713nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL dereffs/nfsd/nfs4proc.c+16 -30 replies
164/713nfsd: cap decoded POSIX ACL count to bound sort costfs/nfsd/nfs4xdr.c+10 -10 replies
165/713nfsd: check client ownership when cancelling a copy-notify stateidfs/nfsd/nfs4state.c+12 -20 replies
166/713nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()fs/nfsd/nfs4proc.c+16 -00 replies
167/713nfsd: clear CALLBACK_RUNNING on failed delegation recall queuefs/nfsd/nfs4state.c+3 -10 replies
168/713nfsd: clear opcnt on compound arg release to prevent OOB readfs/nfsd/nfs4xdr.c+1 -00 replies
169/713nfsd: convert nfsd_net boolean flags to unsigned long flags wordfs/nfsd/netns.h fs/nfsd/nfs4proc.c fs/nfsd/nfs4recover.c +3 more+54 -430 replies
170/713nfsd: dedup nfs4_client_to_reclaim insertsfs/nfsd/netns.h fs/nfsd/nfs4recover.c fs/nfsd/nfs4state.c+89 -140 replies
171/713nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaperfs/nfsd/nfs4state.c+2 -20 replies
172/713nfsd: defer vfree of compound ops to fix rpc_status UAFfs/nfsd/nfs4xdr.c+3 -10 replies
173/713nfsd: dont free session slots that are still in usefs/nfsd/nfs4state.c+16 -10 replies
174/713nfsd: drop the stateid, not the stateowner, on seqid_op replay retryfs/nfsd/nfs4state.c+1 -10 replies
175/713nfsd: ensure nfsd_file_do_acquire() does not use a non-opened filefs/nfsd/filecache.c+4 -40 replies
176/713nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revokefs/nfsd/nfs4layouts.c+9 -30 replies
177/713nfsd: fix clock domain mismatch in clients_still_reclaiming()fs/nfsd/netns.h fs/nfsd/nfs4state.c+3 -10 replies
178/713nfsd: fix cpntf publish race in nfs4_init_cp_statefs/nfsd/nfs4state.c+25 -100 replies
179/713nfsd: fix dentry ref leak on V4ROOT export filehandle lookupfs/nfsd/nfsfh.c+6 -20 replies
180/713nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_netfs/nfsd/filecache.c fs/nfsd/netns.h+24 -560 replies
181/713nfsd: fix FL_SLEEP being set unconditionally for all LOCK typesfs/nfsd/nfs4state.c+5 -40 replies
182/713nfsd: fix layout fence worker double-reference racefs/nfsd/nfs4layouts.c fs/nfsd/state.h+16 -120 replies
183/713nfsd: fix netlink dumpit error handling for rpc_status_getfs/nfsd/nfsctl.c+26 -60 replies
184/713nfsd: fix nfsd_file leak on inter-server COPY setup failurefs/nfsd/nfs4proc.c+4 -60 replies
185/713nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrsfs/nfsd/nfs4proc.c+1 -10 replies
186/713nfsd: fix partial-write detection in nfsd_direct_writefs/nfsd/vfs.c+4 -10 replies
187/713nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()fs/nfsd/nfs4proc.c+8 -40 replies
188/713nfsd: fix refcount leak in nfsd_file_lru_add on insertion failurefs/nfsd/filecache.c+5 -20 replies
189/713nfsd: fix reply size estimate for GET_DIR_DELEGATIONfs/nfsd/nfs4proc.c+1 -10 replies
190/713nfsd: fix stale s2s_cp_stateids IDR entry for async COPYfs/nfsd/nfs4proc.c+4 -30 replies
191/713nfsd: fix UAF in async copy cancel and shutdownfs/nfsd/nfs4proc.c+85 -350 replies
192/713nfsd: fix version mismatch loops in nfsd_acl_init_request()fs/nfsd/nfssvc.c+2 -20 replies
193/713nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutgetfs/nfsd/flexfilelayoutxdr.c+11 -60 replies
194/713nfsd: fix XDR padding calculation in ff_encode_getdeviceinfofs/nfsd/flexfilelayoutxdr.c+2 -10 replies
195/713nfsd: gate nfs2 setacl by argp->maskfs/nfsd/nfs2acl.c+13 -80 replies
196/713nfsd: gate nfs3 setacl by argp->maskfs/nfsd/nfs3acl.c+11 -60 replies
197/713nfsd: hold rcu across localio cmpxchg retryfs/nfsd/localio.c+7 -10 replies
198/713nfsd: initialize copy-notify stateid before publishing itfs/nfsd/nfs4proc.c fs/nfsd/nfs4state.c+18 -80 replies
199/713nfsd: initialize DRC hash table before registering shrinkerfs/nfsd/nfscache.c+2 -20 replies
200/713nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()fs/nfsd/nfsctl.c+5 -40 replies
201/713nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecachefs/nfsd/filecache.c+29 -90 replies
202/713nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create opsfs/nfsd/nfs3proc.c+40 -00 replies
203/713nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATEfs/nfsd/nfsxdr.c+22 -100 replies
204/713nfsd: reject reclaim LOCK after RECLAIM_COMPLETEfs/nfsd/nfs4state.c+3 -00 replies
205/713nfsd: release OPEN-decoded posix ACLs via op_releasefs/nfsd/nfs4proc.c fs/nfsd/nfs4xdr.c+11 -50 replies
206/713nfsd: revoke copy-notify stateids before dropping their referencefs/nfsd/nfs4state.c+62 -160 replies
207/713NFSD: Prevent lock owner use-after-free during client teardownfs/nfsd/nfs4state.c+13 -30 replies
208/713NFSD: Prevent post-shutdown use-after-free in unlock_filesystemfs/nfsd/nfsctl.c+4 -30 replies
209/713NFSD: Prevent client use-after-free during admin state revocationfs/nfsd/nfs4state.c+20 -20 replies
210/713NFSD: Prevent client use-after-free during delegation revokefs/nfsd/netns.h fs/nfsd/nfs4state.c+27 -20 replies
211/713NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanupfs/nfsd/nfs4state.c+6 -00 replies
212/713nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost updatefs/nfsd/nfs4state.c+1 -20 replies
213/713libceph: validate OSD extent maps before cursor advancenet/ceph/osd_client.c+30 -00 replies
214/713libceph: reject buckets with mismatched CRUSH idsnet/ceph/osdmap.c+2 -00 replies
215/713ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlockfs/ceph/caps.c+9 -20 replies
216/713ceph: fix UAF in check_new_map() on session freed during unlockfs/ceph/mds_client.c+6 -00 replies
217/713ceph: force a cap message when a deferred revoke cant be acked immediatelyfs/ceph/caps.c fs/ceph/super.h+61 -70 replies
218/713ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decodefs/ceph/mdsmap.c+4 -00 replies
219/713ceph: bound copied dentry name length in NFS export get_namefs/ceph/export.c+17 -90 replies
220/713ceph: bound MDSCapAuth path and fs_name decode in handle_session()fs/ceph/mds_client.c+6 -20 replies
221/713ceph: bound num_export_targets array for mds info v2/v3fs/ceph/mdsmap.c+6 -10 replies
222/713ceph: bound xattr value length in __build_xattrs()fs/ceph/xattr.c+1 -00 replies
223/713ceph: cap delegated inode count in ceph_parse_deleg_inos()fs/ceph/mds_client.c fs/ceph/mds_client.h fs/ceph/super.h+63 -60 replies
224/713ceph: do not repeat ceph_trim_dentries() if no progress possiblefs/ceph/dir.c+7 -30 replies
225/713ceph: fix leaked inode reference on writeback abort at umountfs/ceph/addr.c+11 -00 replies
226/713btrfs: drop recovered reloc root refs on recovery failurefs/btrfs/relocation.c+27 -40 replies
227/713btrfs: fix extent map leak in NOCOW direct I/O writefs/btrfs/direct-io.c+13 -60 replies
228/713btrfs: do not overwrite NODATASUM flag when removing NODATACOW flagfs/btrfs/ioctl.c+15 -80 replies
229/713audit: avoid dropping live tree ref on fsnotify rule autoremovekernel/auditfilter.c+2 -40 replies
230/713cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsemfs/smb/client/cifsfs.h fs/smb/client/inode.c fs/smb/client/smb2ops.c+23 -110 replies
231/713cifs: call pagecache_isize_extended() in cifs_setsize() when extendingfs/smb/client/inode.c+2 -00 replies
232/713cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()fs/smb/client/inode.c+1 -00 replies
233/713cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0fs/smb/client/cifsfs.c+13 -20 replies
234/713cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNCfs/smb/client/file.c+1 -00 replies
235/713smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensionsfs/smb/client/inode.c+24 -50 replies
236/713smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2fs/smb/client/smb1transport.c+11 -30 replies
237/713smb: client: clear ce->tgthint in free_tgts()fs/smb/client/dfs_cache.c+2 -00 replies
238/713ksmbd: only rebind the reopened files own oplock on durable reconnectfs/smb/server/vfs_cache.c+1 -10 replies
239/713smb: client: fix ALIGN() overflow in symlink_data() error context loopfs/smb/client/smb2file.c+4 -10 replies
240/713smb: client: fix copy-paste error in WSL EA length accounting for $LXDEVfs/smb/client/smb1ops.c+1 -10 replies
241/713smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()fs/smb/client/smb1transport.c+20 -10 replies
242/713smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()fs/smb/client/smb2inode.c+4 -20 replies
243/713smb: client: harden DFS cache against invalid target hintsfs/smb/client/dfs_cache.c+24 -70 replies
244/713smb: client: reject a tree connect response whose byte count is too smallfs/smb/client/cifssmb.c fs/smb/client/trace.h+8 -10 replies
245/713smb: client: restore the data_offset bound in is_valid_oplock_break()fs/smb/client/smb1misc.c+2 -10 replies
246/713HID: apple: preserve keyboard backlight across T2 resumedrivers/hid/hid-apple.c+16 -20 replies
247/713HID: corsair-void: Check size of status and firmware events before reading themdrivers/hid/hid-corsair-void.c+17 -00 replies
248/713HID: picolcd: clamp eeprom debugfs read to bytes actually receiveddrivers/hid/hid-picolcd_debugfs.c+9 -00 replies
249/713HID: roccat: free buffered reports when destroying devicedrivers/hid/hid-roccat.c+11 -20 replies
250/713HID: sensor: custom: Fix field sysfs group cleanup on failuredrivers/hid/hid-sensor-custom.c+8 -10 replies
251/713HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbinddrivers/hid/hid-sony.c+3 -10 replies
252/713HID: universal-pidff: stop the device when force-feedback init failsdrivers/hid/hid-universal-pidff.c+3 -10 replies
253/713HID: mcp2221: stop device IO before hid_hw_stopdrivers/hid/hid-mcp2221.c+2 -00 replies
254/713HID: mcp2221: clear rxbuf after I2C/SMBus transfer completesdrivers/hid/hid-mcp2221.c+6 -20 replies
255/713HID: mcp2221: validate report size in mcp2221_raw_event()drivers/hid/hid-mcp2221.c+7 -00 replies
256/713HID: intel-thc-hid: intel-quickspi: validate report size before copydrivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c+12 -10 replies
257/713HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller bufferdrivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h+15 -50 replies
258/713HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardowndrivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c+1 -00 replies
259/713HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardowndrivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c+1 -00 replies
260/713eventfs: Initialize ei->children and ei->list in init_ei()fs/tracefs/event_inode.c+2 -50 replies
261/713fs/ntfs3: validate dirty page table on log replayfs/ntfs3/fslog.c+19 -00 replies
262/713fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()fs/ntfs3/frecord.c+9 -00 replies
263/713fs/ntfs3: bound page_lcns[] index by the log recordfs/ntfs3/fslog.c+15 -00 replies
264/713ntfs: bound the free-cluster bitmap scan to the volumefs/ntfs/lcnalloc.c fs/ntfs/runlist.c+13 -10 replies
265/713ntfs: reject invalid empty mapping pairsfs/ntfs/runlist.c+19 -00 replies
266/713ntfs: reject invalid MFT LCNs from boot sectorfs/ntfs/super.c+6 -60 replies
267/713ntfs: validate non-resident attribute offsetsfs/ntfs/attrib.c+23 -10 replies
268/713ntfs: verify run length exceeding volume boundaryfs/ntfs/runlist.c+22 -00 replies
269/713eCryptfs: bound the packet-length peek to the user bufferfs/ecryptfs/miscdev.c+3 -20 replies
270/713ecryptfs: fix tag 11 packet exact-fit size checkfs/ecryptfs/keystore.c+1 -10 replies
271/713ecryptfs: hold msg ctx list lock when cleaning daemon queuefs/ecryptfs/messaging.c+2 -00 replies
272/713ecryptfs: pass packet set buffer size to parserfs/ecryptfs/crypto.c fs/ecryptfs/ecryptfs_kernel.h fs/ecryptfs/keystore.c+23 -50 replies
273/713ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packetfs/ecryptfs/keystore.c+12 -20 replies
274/713ecryptfs: reject too-small tag 70 packetsfs/ecryptfs/keystore.c+6 -00 replies
275/713ecryptfs: release message context on send failurefs/ecryptfs/messaging.c+8 -10 replies
276/713ecryptfs: show filename encryption optionsfs/ecryptfs/super.c+7 -00 replies
277/713efivarfs: Rate limit statfs() handlerfs/efivarfs/super.c+24 -60 replies
278/713entry: Fix seccomp bypass after ptrace with TSYNCinclude/linux/entry-common.h+3 -00 replies
279/713erofs: skip sufficiently large global buffers when resizingfs/erofs/zutil.c+2 -00 replies
280/713ext2: Fix lost inode updates for IS_SYNC inodesfs/ext2/inode.c fs/ext2/xattr.c+4 -70 replies
281/713fanotify: fix use-after-free of file range infofs/notify/fanotify/fanotify.c fs/notify/fanotify/fanotify.h fs/notify/fanotify/fanotify_user.c+6 -80 replies
282/713fat: restore original value when fat_ent_write failedfs/fat/misc.c+4 -00 replies
283/713fbdev: omapfb: panel-dsi-cm: initialize lock before registering displaydrivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c+2 -20 replies
284/713fbdev: pvr2fb: correct user pointer annotation and sentinel initializerdrivers/video/fbdev/pvr2fb.c+2 -20 replies
285/713fbdev: ssd1307fb: defer I2C transfers from damage callbacksdrivers/video/fbdev/ssd1307fb.c+67 -50 replies
286/713fbdev: uvesafb: unregister connector callback on init failuredrivers/video/fbdev/uvesafb.c+2 -00 replies
287/713fonts: fixup font.h kernel-doc warningsinclude/linux/font.h+3 -10 replies
288/713forcedeth: fix off-by-one when saving/restoring non-PCI config spacedrivers/net/ethernet/nvidia/forcedeth.c+2 -20 replies
289/713fpga: stratix10-soc: Fix SVC mailbox handling during reconfigurationdrivers/fpga/stratix10-soc.c+12 -90 replies
290/713fsnotify: Fix stale object mask after concurrent mark updatesfs/notify/fanotify/fanotify_user.c fs/notify/inotify/inotify_user.c+8 -190 replies
291/713hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller devicedrivers/hsi/controllers/omap_ssi_core.c+6 -00 replies
292/713hugetlb: only adjust reservation during unmapping if mapcount is 0mm/hugetlb.c+6 -20 replies
293/713accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()drivers/accel/rocket/rocket_job.c+10 -40 replies
294/713accel/rocket: initialize job domain before cleanup pathsdrivers/accel/rocket/rocket_job.c+2 -20 replies
295/713accel/rocket: Fix error path handling in rocket_job_run()drivers/accel/rocket/rocket_job.c+11 -30 replies
296/713acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locksdrivers/acpi/apei/ghes.c drivers/cxl/core/ras.c drivers/cxl/pci.c+33 -190 replies
297/713ACPI: APEI: Fix ERST timeout unit conversiondrivers/acpi/apei/erst.c+1 -10 replies
298/713ACPI: APEI: GHES: fix ARM section length accounting after headerdrivers/acpi/apei/ghes.c+1 -10 replies
299/713ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+drivers/acpi/cppc_acpi.c drivers/cpufreq/cppc_cpufreq.c+17 -20 replies
300/713ACPI: CPPC: Skip desired_perf read in cppc_get_perf()drivers/acpi/cppc_acpi.c+5 -20 replies
301/713ACPI: pfr_update: fix stack buffer overflow in query_capability()drivers/acpi/pfr_update.c+24 -210 replies
302/713ACPI: scan: Avoid registering platform devices with resource overlapsdrivers/acpi/acpi_platform.c+37 -20 replies
303/713ACPI: TAD: Add locking around AML evaluationsdrivers/acpi/acpi_tad.c+29 -190 replies
304/713alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()arch/alpha/kernel/pci-sysfs.c+3 -30 replies
305/713alpha: marvel: Fix irq_set_status_flags to use correct IRQ numberarch/alpha/kernel/sys_marvel.c+2 -20 replies
306/713alpha: marvel: Fix lock ordering in init_io7_irqs()arch/alpha/kernel/sys_marvel.c+12 -130 replies
307/713ARM: 9477/1: Disable broken eBPF JIT on the Risc PCarch/arm/Kconfig+1 -10 replies
308/713ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytesdrivers/ata/libata-scsi.c+14 -140 replies
309/713auxdisplay: charlcd: cancel backlight work on registration failuredrivers/auxdisplay/charlcd.c+14 -70 replies
310/713backlight: aw99706: Fix DT property names to match bindingdrivers/video/backlight/aw99706.c+4 -40 replies
311/713backlight: aw99706: Honor the core blank state in update_status()drivers/video/backlight/aw99706.c+1 -10 replies
312/713block: validate user space vectors during extractionblock/bio.c block/blk-map.c block/fops.c +4 more+74 -80 replies
313/713block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()block/genhd.c+1 -00 replies
314/713Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CUdrivers/bluetooth/btusb.c+4 -00 replies
315/713Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CUdrivers/bluetooth/btusb.c+2 -00 replies
316/713Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728drivers/bluetooth/btrtl.c drivers/bluetooth/btusb.c+8 -130 replies
317/713Bluetooth: eir: Fix OOB read in eir_get_service_data()net/bluetooth/eir.c+2 -10 replies
318/713bnx2x: fix double free in bnx2x_init_firmware() error pathdrivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c+3 -00 replies
319/713bnxt_en: Write doorbell when linearizing skb failsdrivers/net/ethernet/broadcom/bnxt/bnxt.c+2 -50 replies
320/713bpf, x86: Fix per-CPU address resolution into an extended registerarch/x86/net/bpf_jit_comp.c+1 -10 replies
321/713bpf: Disable preemption in __bpf_get_stackkernel/bpf/stackmap.c+3 -00 replies
322/713buffer: avoid tail commit walk for uptodate foliosfs/buffer.c+3 -00 replies
323/713bpf: Harden bloom filter sizing and indexing on 32-bit kernelskernel/bpf/bloom_filter.c+9 -100 replies
324/713dm-io: clone the source bio instead of copying its biovecdrivers/md/dm-io.c+24 -430 replies
325/713dm-io: report non-retryable errors separatedlydrivers/md/dm-bufio.c drivers/md/dm-integrity.c drivers/md/dm-io.c +7 more+83 -540 replies
326/713dm-era: fix shadowed superblock leak on take-snap failuredrivers/md/dm-era-target.c+5 -00 replies
327/713dm raid1: reserve space for NUL-terminator in build_constructor_string()drivers/md/dm-log-userspace-base.c+1 -00 replies
328/713dm array: validate array block headers on readdrivers/md/persistent-data/dm-array.c+29 -80 replies
329/713dm array: reject an array block whose value size is not the callersdrivers/md/persistent-data/dm-array.c+16 -00 replies
330/713coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behaviordrivers/hwtracing/coresight/coresight-etm3x-sysfs.c+4 -110 replies
331/713cpufreq: apple-soc: Fix OPP table cleanupdrivers/cpufreq/apple-soc-cpufreq.c+14 -220 replies
332/713cpufreq: schedutil: Fix rate limit overflowkernel/sched/cpufreq_schedutil.c+13 -20 replies
333/713cxl/features: bound fwctl command payload to the input bufferdrivers/cxl/core/features.c+7 -10 replies
334/713cxl/mce: Make the MCE notifier per-regiondrivers/cxl/core/mbox.c drivers/cxl/core/mce.c drivers/cxl/core/region.c +2 more+30 -580 replies
335/713cxl/pmem: Format the nvdimm serial number as unsigned decimalDocumentation/ABI/testing/sysfs-bus-nvdimm drivers/cxl/core/pmem.c drivers/cxl/cxl.h +1 more+11 -70 replies
336/713cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity registerdrivers/cxl/core/ras_rch.c+5 -50 replies
337/713Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378drivers/bluetooth/hci_bcm4377.c+1 -00 replies
338/713Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negativedrivers/bluetooth/hci_bcm.c+1 -00 replies
339/713Bluetooth: hci_uart: Fix false success return in hci_uart_setup()drivers/bluetooth/hci_ldisc.c drivers/bluetooth/hci_serdev.c+2 -20 replies
340/713Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_readynet/bluetooth/iso.c+8 -00 replies
341/713Bluetooth: RFCOMM: serialize security confirmation handlingnet/bluetooth/rfcomm/core.c+7 -10 replies
342/713Bluetooth: hci_conn: re-enable advertising only for peripheral rolenet/bluetooth/hci_conn.c+2 -10 replies
343/713Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skbnet/bluetooth/hci_core.c+1 -10 replies
344/713Bluetooth: hci_event: clear HCI_LE_ADV only on a created connectionnet/bluetooth/hci_event.c+4 -30 replies
345/713Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negativedrivers/bluetooth/hci_h5.c+3 -10 replies
346/713Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negativedrivers/bluetooth/hci_intel.c+1 -00 replies
347/713Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last requestnet/bluetooth/hci_sync.c+2 -00 replies
348/713kasan: fix cache shrink race with CPU hotplugmm/kasan/quarantine.c+6 -10 replies
349/713kho: fix size calculation in kho_preserved_memory_reserve()kernel/liveupdate/kexec_handover.c+1 -10 replies
350/713jbd2: bound shrinker scans by examined checkpoint buffersfs/jbd2/checkpoint.c+13 -120 replies
351/713jbd2: check need_resched() when skipping busy checkpoint buffersfs/jbd2/checkpoint.c+2 -10 replies
352/713ipip: fix skb leak in collect_md mode when metadata_dst allocation failsnet/ipv4/ipip.c+1 -10 replies
353/713ip: orphan prefetched skbs before multicast forwardingnet/ipv4/ipmr.c net/ipv6/ip6_input.c+4 -00 replies
354/713ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()net/ipv6/ip6_tunnel.c+2 -130 replies
355/713ip6_gre: fix hardware header length for NBMA tunnelsnet/ipv6/ip6_gre.c+4 -90 replies
356/713ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()net/ipv6/exthdrs.c+12 -140 replies
357/713ipv6: use RCU iterator to dump route exceptionsnet/ipv6/route.c+1 -10 replies
358/713landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creationinclude/uapi/linux/landlock.h security/landlock/errata/abi-1.h security/landlock/fs.c+56 -94 replies
359/713libnvdimm/labels: Prevent integer overflow in __nd_label_validate()drivers/nvdimm/label.c+1 -10 replies
360/713mailbox: qcom-ipcc: fix duplicate channel allocation across holesdrivers/mailbox/qcom-ipcc.c+11 -60 replies
361/713md/raid10: fix still_degraded being inverted in raid10_sync_request()drivers/md/raid10.c+1 -10 replies
362/713md: do overflow check for sb->bblog_shift in super_1_load()drivers/md/md.c+7 -00 replies
363/713module: validate string table section typeskernel/module/main.c+13 -10 replies
364/713mpls: reload header after pskb_may_pull()net/mpls/af_mpls.c+2 -00 replies
365/713mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstructionnet/mptcp/syncookies.c+1 -00 replies
366/713module/kallsyms: fix nextval for data symbol lookupkernel/module/kallsyms.c+16 -80 replies
367/713nouveau/gem: reserve the bo in the info ioctl around the vma lookupdrivers/gpu/drm/nouveau/nouveau_gem.c+10 -10 replies
368/713params: fix charp corruption on allocation failurekernel/params.c+8 -60 replies
369/713phy: fsl-imx8mq-usb: fix typec switch leak on probe error pathdrivers/phy/freescale/phy-fsl-imx8mq-usb.c+7 -140 replies
370/713SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflownet/sunrpc/xdr.c+1 -10 replies
371/713SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entrynet/sunrpc/auth_gss/svcauth_gss.c+3 -00 replies
372/713SUNRPC: svcauth_gss: enforce krb5 token minimum lengthnet/sunrpc/auth_gss/svcauth_gss.c+2 -00 replies
373/713sunrpc: route to a populated pool in svc_pool_for_cpu()net/sunrpc/svc.c+28 -10 replies
374/713SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global modenet/sunrpc/svc.c+4 -20 replies
375/713SUNRPC: always drain cache_cleaner before destroying a cache_detailnet/sunrpc/cache.c+3 -40 replies
376/713SUNRPC: Check svc pool percpu counter allocationnet/sunrpc/svc.c+39 -60 replies
377/713SUNRPC: close backchannel before destroying callback servicefs/nfs/callback.c include/linux/sunrpc/bc_xprt.h net/sunrpc/backchannel_rqst.c+39 -80 replies
378/713sunrpc: defer rq_argp and rq_resp free until after RCU grace periodnet/sunrpc/svc.c+10 -30 replies
379/713SUNRPC: fix gssx_dec_option_array error path bugsnet/sunrpc/auth_gss/gss_rpc_xdr.c+6 -30 replies
380/713sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedirnet/sunrpc/clnt.c+17 -50 replies
381/713SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_statnet/sunrpc/auth_gss/svcauth_gss.c+2 -00 replies
382/713SUNRPC: harden gss_krb5_unwrap_v2 against short tokensnet/sunrpc/auth_gss/gss_krb5_wrap.c+9 -20 replies
383/713SUNRPC: harden gss_unwrap_resp_priv length checksnet/sunrpc/auth_gss/auth_gss.c+5 -10 replies
384/713sunrpc: init gssp_lock before publishing proc entrynet/sunrpc/auth_gss/gss_rpc_upcall.c net/sunrpc/auth_gss/gss_rpc_upcall.h net/sunrpc/auth_gss/svcauth_gss.c +1 more+1 -80 replies
385/713SUNRPC: reject duplicate CREDS_VALUE optionsnet/sunrpc/auth_gss/gss_rpc_xdr.c+6 -00 replies
386/713SUNRPC: Reject krb5 v2 wrap tokens with oversized ec fieldnet/sunrpc/auth_gss/gss_krb5_wrap.c+2 -00 replies
387/713SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2net/sunrpc/auth_gss/gss_krb5_unseal.c+3 -00 replies
388/713SUNRPC: wait for in-flight client TLS handshake callbacknet/sunrpc/xprtsock.c+11 -10 replies
389/713svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_idnet/sunrpc/xprtrdma/svc_rdma_transport.c+10 -30 replies
390/713svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement failsnet/sunrpc/xprtrdma/svc_rdma_transport.c+3 -10 replies
391/713svcrdma: Fix offset arithmetic in read_chunk_rangenet/sunrpc/xprtrdma/svc_rdma_rw.c+7 -20 replies
392/713svcrdma: Fix pcl_for_each_segment for empty chunksinclude/linux/sunrpc/svc_rdma_pcl.h+1 -10 replies
393/713svcrdma: Fix unmatched rn_unregister on failed acceptnet/sunrpc/xprtrdma/ib_client.c net/sunrpc/xprtrdma/svc_rdma_transport.c+44 -80 replies
394/713svcrdma: Reject connection when transport allocation failsnet/sunrpc/xprtrdma/svc_rdma_transport.c+10 -60 replies
395/713svcrdma: Reject inline replies that overflow the pull-up buffernet/sunrpc/xprtrdma/svc_rdma_sendto.c+32 -150 replies
396/713svcrdma: Reject oversized Read segments at decode timenet/sunrpc/xprtrdma/svc_rdma_recvfrom.c net/sunrpc/xprtrdma/svc_rdma_rw.c+5 -20 replies
397/713svcrdma: Reject Read lists that exceed the page budgetnet/sunrpc/xprtrdma/svc_rdma_recvfrom.c+9 -30 replies
398/713svcrdma: Reject Write/Reply chunks with segcount 0net/sunrpc/xprtrdma/svc_rdma_pcl.c net/sunrpc/xprtrdma/svc_rdma_recvfrom.c+7 -40 replies
399/713svcrdma: Use svc_xprt_put to free listener on create failurenet/sunrpc/xprtrdma/svc_rdma_transport.c+7 -10 replies
400/713svcrdma: Validate Read chunk positions before reconstructionnet/sunrpc/xprtrdma/svc_rdma_rw.c+30 -80 replies
401/713udf: reject VAT indexes equal to the entry countfs/udf/partition.c+1 -10 replies
402/713wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsetsdrivers/net/wireless/ath/ath6kl/cfg80211.c+5 -00 replies
403/713wifi: mt76: mt7925: cancel pending mlo_pm_workdrivers/net/wireless/mediatek/mt76/mt7925/mac.c drivers/net/wireless/mediatek/mt76/mt7925/main.c drivers/net/wireless/mediatek/mt76/mt7925/pci.c +1 more+5 -00 replies
404/713staging: media: tegra-video: fix of_node_put() on VIP parse errorsdrivers/staging/media/tegra-video/vip.c+3 -70 replies
405/713staging: media: tegra-video: vi: fix probe failure on skipped last portdrivers/staging/media/tegra-video/vi.c+5 -40 replies
406/713media: staging/ipu7: fix async notifier UAF on probe error pathdrivers/staging/media/ipu7/ipu7-isys.c+1 -00 replies
407/713sched/core: Handle pick_task() releasing the rq lockkernel/sched/core.c+19 -80 replies
408/713sched/core: Make core-sched flips wait for in-flight selectionskernel/sched/core.c kernel/sched/sched.h+23 -00 replies
409/713sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict returnkernel/sched/ext/ext.c kernel/sched/sched.h tools/sched_ext/include/scx/enum_defs.autogen.h +2 more+73 -570 replies
410/713sched_ext: Fix this_rq() assumptions in dispatch kfuncskernel/sched/ext/ext.c+35 -230 replies
411/713sched_ext: Fix rq->core_pick corruption under core schedulingkernel/sched/ext/ext.c+78 -80 replies
412/713sched_ext: Count rq lock releases in rq->scx.lock_drop_seqkernel/sched/ext/ext.c kernel/sched/sched.h+39 -20 replies
413/713sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detectiontools/sched_ext/include/scx/compat.bpf.h+3 -30 replies
414/713sched_ext: Fix exit_task leak on fork failure during enablekernel/sched/ext/ext.c+1 -10 replies
415/713sched_ext: Fix inverted ops.core_sched_before() invocationkernel/sched/ext/ext.c tools/sched_ext/scx_qmap.bpf.c+9 -30 replies
416/713sched_ext: Dont BUG_ON a destroyed DSQ in process_deferred_reenq_userskernel/sched/ext/ext.c+7 -20 replies
417/713sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototypetools/sched_ext/include/scx/compat.bpf.h+3 -30 replies
418/713sched_ext: Keep kick_sync waiting on the rqs own CPUkernel/sched/ext/ext.c+17 -20 replies
419/713scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()drivers/scsi/scsi_lib.c+2 -00 replies
420/713scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlockdrivers/scsi/fnic/fip.c+1 -10 replies
421/713rpmsg: glink: smem: order FIFO read after availability checkdrivers/rpmsg/qcom_glink_smem.c+7 -00 replies
422/713Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts+0 -180 replies
423/713arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heaparch/arm64/boot/dts/qcom/kodiak.dtsi+6 -30 replies
424/713arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flagsarch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts+1 -10 replies
425/713arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-onarch/arm64/boot/dts/qcom/x1-dell-thena.dtsi+2 -00 replies
426/713arm64: dts: rockchip: fix eMMC reset polarity on PP-1516arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi+1 -10 replies
427/713arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneckarch/arm64/boot/dts/rockchip/px30-ringneck.dtsi+1 -10 replies
428/713arm64: dts: rockchip: fix emmc reset polarity on px30-cobraarch/arm64/boot/dts/rockchip/px30-cobra.dtsi+1 -10 replies
429/713arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audioarch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts+12 -00 replies
430/713arm64: dts: rockchip: Fix rk3588s-roc-pc audio descriptionarch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts+16 -70 replies
431/713riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltagearch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts+2 -20 replies
432/713riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltagearch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts+2 -20 replies
433/713riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltagearch/riscv/boot/dts/spacemit/k1-musepi-pro.dts+2 -20 replies
434/713riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltagearch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts+2 -20 replies
435/713riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltagearch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts+2 -20 replies
436/713RISC-V: KVM: Fix PMU event info array size overflowarch/riscv/kvm/vcpu_pmu.c+9 -50 replies
437/713riscv: acpi: Handle LPI architectural context loss flagsarch/riscv/include/asm/acpi.h+19 -00 replies
438/713riscv: unaligned: stop using kthread for check_vector_unaligned_access()arch/riscv/kernel/unaligned_access_speed.c+2 -170 replies
439/713remoteproc: scp: Fix device reference leak on failed lookupdrivers/remoteproc/mtk_scp.c+8 -10 replies
440/713ptp: vmclock: prevent read-only mappings from becoming writabledrivers/ptp/ptp_vmclock.c+6 -00 replies
441/713qede: Fix NULL pointer dereference in TPA fragment processingdrivers/net/ethernet/qlogic/qede/qede.h drivers/net/ethernet/qlogic/qede/qede_fp.c+5 -40 replies
442/713RDMA/cxgb4: Cancel reg_work before freeing device on removedrivers/infiniband/hw/cxgb4/device.c+6 -00 replies
443/713RDMA/ionic: Cap eq_count to the eth drivers interrupt vector budgetdrivers/infiniband/hw/ionic/ionic_lif_cfg.c+1 -10 replies
444/713RDMA/ionic: Embed counter driver data in rdma_counter allocationdrivers/infiniband/hw/ionic/ionic_hw_stats.c drivers/infiniband/hw/ionic/ionic_ibdev.h+54 -580 replies
445/713RDMA/ucma: Lock the handler in ucma_set_ib_path()drivers/infiniband/core/ucma.c+4 -10 replies
446/713RDMA/ucma: Lock the handler in ucma_write_cm_event()drivers/infiniband/core/ucma.c+9 -00 replies
447/713RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MRdrivers/infiniband/core/uverbs_std_types_mr.c+4 -20 replies
448/713RDMA/uverbs: Guard legacy bundles without method_elmdrivers/infiniband/core/ib_core_uverbs.c drivers/infiniband/core/uverbs_main.c+4 -00 replies
449/713regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointerdrivers/regulator/as3722-regulator.c+0 -10 replies
450/713regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdatadrivers/regulator/max8998.c+0 -10 replies
451/713regulator: qcom-refgen: correct the regulator type to CURRENTdrivers/regulator/qcom-refgen-regulator.c+2 -20 replies
452/713ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()kernel/trace/ring_buffer.c+1 -10 replies
453/713ring-buffer: Free cpu_buffer::free_page with subbuf_orderkernel/trace/ring_buffer.c+1 -10 replies
454/713ring-buffer: Hold cpu_buffer::lock when resizing a subbufkernel/trace/ring_buffer.c+2 -00 replies
455/713ring-buffer: Make cpu_buffer::free_page a buffer_data_read_pagekernel/trace/ring_buffer.c+10 -100 replies
456/713ring-buffer: Stop remote reader update when page swap failskernel/trace/ring_buffer.c+5 -20 replies
457/713PM: sleep: Unblock runtime PM when device prepare failsdrivers/base/power/main.c+1 -00 replies
458/713orangefs: fix double-free of trailer_buf on readdir copy failurefs/orangefs/devorangefs-req.c+1 -00 replies
459/713orangefs: skip leading spaces before parsing client debug masksfs/orangefs/orangefs-debugfs.c+1 -00 replies
460/713ocfs2: always run deallocs on copy-on-write completionfs/ocfs2/refcounttree.c fs/ocfs2/xattr.c+10 -150 replies
461/713ocfs2: bound namelen in dlm_migrate_request_handlerfs/ocfs2/dlm/dlmmaster.c+6 -00 replies
462/713ocfs2: validate lengths in dlm_mig_lockres_handlerfs/ocfs2/dlm/dlmrecovery.c+9 -00 replies
463/713ocfs2: validate rl_used against rl_count in refcount block validatorfs/ocfs2/refcounttree.c+27 -00 replies
464/713ocfs2: validate directory-index entry counts when reading metadatafs/ocfs2/dir.c+41 -40 replies
465/713ocfs2: cluster: dont sleep while holding o2hb_live_lock in o2hb_region_pin()fs/ocfs2/cluster/heartbeat.c+101 -250 replies
466/713ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_itemfs/ocfs2/cluster/heartbeat.c fs/ocfs2/cluster/nodemanager.c fs/ocfs2/cluster/nodemanager.h+17 -70 replies
467/713ocfs2: cluster: fix o2hb_dependent_users leak on pin failurefs/ocfs2/cluster/heartbeat.c+6 -10 replies
468/713ocfs2: fix cached cluster count after suballocator reclaimfs/ocfs2/suballoc.c+1 -10 replies
469/713ocfs2: fix readdir position truncation on 32-bit kernelsfs/ocfs2/dir.c+1 -10 replies
470/713openrisc: fix arbitrary kernel memory access via or1k_atomic syscallarch/openrisc/kernel/entry.S+39 -40 replies
471/713openvswitch: Fix CT limit teardown use-after-freenet/openvswitch/conntrack.c net/openvswitch/conntrack.h net/openvswitch/datapath.c +1 more+98 -460 replies
472/713openvswitch: only skb_tx_error() a packet we are about to dropnet/openvswitch/datapath.c+1 -20 replies
473/713ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversionsound/core/ump_convert.c+1 -00 replies
474/713arm64: compat: Fix decrementing LDM/STM alignment emulationarch/arm64/kernel/compat_alignment.c+2 -20 replies
475/713arm64: proton-pack: Restore the nospectre_bhb command-line optionarch/arm64/kernel/proton-pack.c+8 -10 replies
476/713ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UCsound/soc/amd/yc/acp6x-mach.c+7 -00 replies
477/713ASoC: codecs: aw88261: only check PLL and clock state at power-upsound/soc/codecs/aw88261.c sound/soc/codecs/aw88261.h+3 -90 replies
478/713dma-contiguous: fix truncation of numa_cma / cma_pernuma sizes >= 2Gkernel/dma/contiguous.c+9 -70 replies
479/713hwmon: (max6621) fix negative temperature offset and crit readingsdrivers/hwmon/max6621.c+2 -20 replies
480/713hwmon: (max6621) fix temperature clamp rangedrivers/hwmon/max6621.c+2 -20 replies
481/713i2c: mxs: fix DMA channel leak on probe errordrivers/i2c/busses/i2c-mxs.c+1 -40 replies
482/713ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()drivers/char/ipmi/ipmi_msghandler.c+1 -00 replies
483/713lockd: pin next file across nlm_inspect_file lock-dropfs/lockd/svcsubs.c+30 -230 replies
484/713lockd: fix NLMv4 GRANTED_MSG handlingfs/lockd/svc4proc.c+2 -10 replies
485/713lockd: fix NULL dereference on lockowner allocation failurefs/lockd/clntproc.c+3 -00 replies
486/713lockd: fix swapped arguments in nlmsvc_match_ip()fs/lockd/lockd.h fs/lockd/svcsubs.c+2 -20 replies
487/713nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error pathdrivers/nvme/host/fc.c+1 -10 replies
488/713nvme: zero the discard fallback pagedrivers/nvme/host/core.c+1 -10 replies
489/713nvme-pci: disable controller on admin queue IRQ setup failuredrivers/nvme/host/pci.c+1 -00 replies
490/713nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alonedrivers/nvme/host/tcp.c+3 -10 replies
491/713nvme-tcp: fix host memory disclosure on R2T for a read commanddrivers/nvme/host/tcp.c+7 -00 replies
492/713nvme-tcp: reject a read that transferred too few bytesdrivers/nvme/host/tcp.c+34 -00 replies
493/713sctp: stop processing a packet once its association is deletednet/sctp/sm_sideeffect.c+4 -00 replies
494/713sctp: drop a chunk if its transport was removednet/sctp/inqueue.c+5 -20 replies
495/713sctp: fix NULL deref on untransmitted RECONF completionnet/sctp/stream.c+1 -10 replies
496/713sctp: distinguish sequence zero from wildcard in reconf lookupnet/sctp/stream.c+6 -50 replies
497/713sctp: fix stream->outcnt underflow on duplicate RECONF responsesinclude/net/sctp/structs.h net/sctp/stream.c+29 -120 replies
498/713power: supply: bq24257: fix use-after-free on removedrivers/power/supply/bq24257_charger.c+9 -70 replies
499/713power: supply: bq256xx: drain usb_work before freeing the chargerdrivers/power/supply/bq256xx_charger.c+15 -140 replies
500/713power: supply: bq25890: Fix power_supply reference leakdrivers/power/supply/bq25890_charger.c+12 -00 replies
501/713power: supply: charger-manager: register regulators before exposing sysfsdrivers/power/supply/charger-manager.c+39 -150 replies
502/713power: supply: cros_usbpd-charger: bound the EC-reported port countdrivers/power/supply/cros_usbpd-charger.c+5 -20 replies
503/713power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTSdrivers/power/supply/cros_usbpd-charger.c+10 -00 replies
504/713power: supply: lp8727: fix use-after-free in lp8727_release_irq()drivers/power/supply/lp8727_charger.c+2 -20 replies
505/713power: supply: lp8788-charger: fix use-after-free on removedrivers/power/supply/lp8788-charger.c+1 -10 replies
506/713power: supply: pf1550: enable charging when battery profile existsdrivers/power/supply/pf1550-charger.c+1 -10 replies
507/713power: supply: qcom_battmgr: fix use-after-freedrivers/power/supply/qcom_battmgr.c+6 -10 replies
508/713power: supply: qcom_battmgr: terminate the strings from firmwaredrivers/power/supply/qcom_battmgr.c+1 -10 replies
509/713power: supply: rt9455: quiesce delayed work before teardowndrivers/power/supply/rt9455_charger.c+17 -40 replies
510/713power: supply: twl4030_charger: cancel workers via devmdrivers/power/supply/twl4030_charger.c+10 -20 replies
511/713power: supply: ucs1002: fix use-after-free on removedrivers/power/supply/ucs1002_power.c+5 -10 replies
512/713power: supply: max17040: propagate register read errorsdrivers/power/supply/max17040_battery.c+21 -50 replies
513/713power: supply: max17040: drop incorrect I2C functionality checkdrivers/power/supply/max17040_battery.c+0 -40 replies
514/713power: supply: max17040: synchronize work cancellation on suspenddrivers/power/supply/max17040_battery.c+1 -10 replies
515/713s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacksarch/s390/kernel/perf_cpum_cf.c+142 -730 replies
516/713s390/percpu: Fix MVIY_PERCPU() with older binutilsarch/s390/include/asm/percpu.h+2 -20 replies
517/713s390/dasd: Do not complete a failed ESE read as successfuldrivers/s390/block/dasd.c+4 -20 replies
518/713s390/dasd: Guard sysfs discipline callbacks against unallocated private datadrivers/s390/block/dasd_eckd.c+38 -20 replies
519/713s390/dasd: Propagate partial completion length across ERP recoverydrivers/s390/block/dasd_erp.c+3 -00 replies
520/713PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchipdrivers/pci/controller/pci-hyperv.c+1 -00 replies
521/713PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirkdrivers/pci/quirks.c+1 -10 replies
522/713PCI: meson: Fix GPIO state while requesting PERST#drivers/pci/controller/dwc/pci-meson.c+1 -10 replies
523/713PCI: starfive: Fix resource leaks on error paths in host_init()drivers/pci/controller/plda/pcie-starfive.c+11 -20 replies
524/713PCI: plda: Fix use-after-free of event IRQs during teardowndrivers/pci/controller/plda/pcie-plda-host.c+21 -30 replies
525/713PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()drivers/pci/controller/plda/pcie-plda-host.c+21 -70 replies
526/713PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]drivers/pci/quirks.c+4 -00 replies
527/713PCI/sysfs: Fix read byte order in pci_read_legacy_io()drivers/pci/pci-sysfs.c+19 -10 replies
528/713PCI/sysfs: Avoid spurious runtime PM wakeup on config space accessesdrivers/pci/pci-sysfs.c+2 -20 replies
529/713PCI/AER: Emit TLP Log only for unmasked errorsdrivers/pci/pcie/aer.c+3 -20 replies
530/713PCI/AER: Fix mapping of errors to agent & layerdrivers/pci/pcie/aer.c+19 -50 replies
531/713PCI/ASPM: Avoid L0s for Realtek RTS525Adrivers/pci/quirks.c+3 -00 replies
532/713PCI/DPC: Allow DPC on all Downstream Ports when OS controls AERdrivers/pci/pcie/portdrv.c+1 -12 replies
533/713PCI/MSI: Enable memory decoding before restoring MSI-X messagesdrivers/pci/msi/msi.c+10 -00 replies
534/713PCI/proc: Avoid spurious runtime PM wakeup on config space accessesdrivers/pci/proc.c+6 -00 replies
535/713PCI/proc: Use file_ns_capable() when checking config space read accessdrivers/pci/proc.c+1 -10 replies
536/713PCI/proc: Warn on writes to kernel-exclusive config space regionsdrivers/pci/proc.c+8 -00 replies
537/713iommu/amd: Put PCI device after handling PPR faultsdrivers/iommu/amd/ppr.c+2 -10 replies
538/713iommu/msm: Unwind probe state on registration failuredrivers/iommu/msm_iommu.c+8 -20 replies
539/713iommu/sva: Set handle->dev before the SVA handle is visibledrivers/iommu/iommu-sva.c+1 -10 replies
540/713iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH fielddrivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c+6 -20 replies
541/713iommu/arm-smmu-v3: Add HAFT support for SVAdrivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h+25 -110 replies
542/713iommu/arm-smmu-v3: Manage teardown with devmdrivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c+40 -160 replies
543/713iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_adddrivers/iommu/iommu.c+1 -10 replies
544/713iommu/vt-d: Fix no_iommu to disable platform opt-indrivers/iommu/intel/iommu.c+3 -30 replies
545/713iommu/vt-d: Force requesting ACS when tboot is enableddrivers/iommu/intel/dmar.c drivers/iommu/intel/iommu.c drivers/iommu/intel/iommu.h+16 -30 replies
546/713iommupt: Return zero for invalid iova_to_phys() rangesdrivers/iommu/generic_pt/iommu_pt.h+1 -10 replies
547/713iommufd: Avoid locking internal accesses during unmapdrivers/iommu/iommufd/device.c+2 -20 replies
548/713iommufd: Release current IOAS on xa_store() failuredrivers/iommu/iommufd/ioas.c+2 -00 replies
549/713iommufd: Fix UAF in selftest IOPF reportingdrivers/iommu/iommufd/selftest.c+30 -10 replies
550/713platform/x86: dell-wmi-sysman: Dont hex dump attribute security bufferdrivers/platform/x86/dell/dell-wmi-sysman/biosattr-interface.c+0 -10 replies
551/713platform/x86: ISST: Validate level in perf mask ioctlsdrivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c+9 -00 replies
552/713platform/x86: ISST: Validate socket ID in clos_assoc ioctldrivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c+3 -10 replies
553/713mmc: via-sdmmc: cancel card-detect work on removedrivers/mmc/host/via-sdmmc.c+4 -00 replies
554/713mmc: via-sdmmc: stop card-detect handling on probe failuredrivers/mmc/host/via-sdmmc.c+7 -10 replies
555/713platform/x86: ISST: Add a NULL check for sst_inst[]drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c+2 -00 replies
556/713platform/x86: ISST: Just allow 2 bits for SST feature enabledrivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c+4 -00 replies
557/713platform/x86: ISST: Use PP level enable maskdrivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c+14 -20 replies
558/713platform/x86: ISST: Validate logical CPU id and clos iddrivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c+13 -00 replies
559/713platform/x86: ISST: Validate max level for set featuredrivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c+3 -00 replies
560/713platform/x86: ISST: Validate parameter for core power statedrivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c+7 -00 replies
561/713platform/x86: ISST: Validate parameter for frequency and prioritydrivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c+12 -00 replies
562/713platform/x86: ISST: Return error during profile additiondrivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c+7 -30 replies
563/713platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6)drivers/platform/x86/hp/hp-wmi.c+4 -00 replies
564/713platform/x86: int1092: Fix potential memory leak in sar_probe()drivers/platform/x86/intel/int1092/intel_sar.c+10 -220 replies
565/713platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error pathdrivers/platform/x86/intel/ishtp_eclite.c+4 -10 replies
566/713platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query responsedrivers/platform/x86/lenovo/ymc.c+7 -10 replies
567/713platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]drivers/platform/x86/panasonic-laptop.c+10 -10 replies
568/713platform/x86: think-lmi: Fix certificate thumbprint sysfs outputdrivers/platform/x86/lenovo/think-lmi.c+7 -10 replies
569/713platform/x86: think-lmi: Free system certificate signaturesdrivers/platform/x86/lenovo/think-lmi.c+4 -00 replies
570/713platform/x86: think-lmi: Fix current password length checkdrivers/platform/x86/lenovo/think-lmi.c+3 -40 replies
571/713platform/chrome: sensorhub: Bound the EC-reported sensor numberdrivers/platform/chrome/cros_ec_sensorhub_ring.c+8 -00 replies
572/713platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error pathsdrivers/platform/x86/amd/pmc/mp1_stb.c+15 -90 replies
573/713platform/x86/amd/pmc: Propagate SMU errors and validate S2D addressdrivers/platform/x86/amd/pmc/mp1_stb.c+20 -110 replies
574/713platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init failsdrivers/platform/x86/amd/pmc/pmc.c+5 -10 replies
575/713platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2()drivers/platform/x86/amd/pmc/mp1_stb.c+14 -90 replies
576/713platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOSdrivers/platform/x86/hp/hp-bioscfg/bioscfg.c drivers/platform/x86/hp/hp-bioscfg/bioscfg.h+11 -30 replies
577/713platform/x86: hp-bioscfg: advance elem past consumed array elementsdrivers/platform/x86/hp/hp-bioscfg/enum-attributes.c drivers/platform/x86/hp/hp-bioscfg/int-attributes.c drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c +2 more+14 -00 replies
578/713platform/x86: hp-bioscfg: bound ordered-list parsing by the package countdrivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c+1 -10 replies
579/713platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c+2 -20 replies
580/713platform/x86: hp-bioscfg: fix heap OOB read on empty password writedrivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c+1 -10 replies
581/713platform/x86: hp-bioscfg: fix new_password_store() overwriting current_passworddrivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c+1 -10 replies
582/713platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()drivers/platform/x86/hp/hp-bioscfg/bioscfg.c+1 -10 replies
583/713platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parseddrivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c+3 -10 replies
584/713platform/x86: hp-bioscfg: pass validated element count to package parsersdrivers/platform/x86/hp/hp-bioscfg/bioscfg.c drivers/platform/x86/hp/hp-bioscfg/bioscfg.h drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c +4 more+27 -70 replies
585/713platform/x86: hp-bioscfg: warn on element type mismatch instead of failingdrivers/platform/x86/hp/hp-bioscfg/enum-attributes.c+4 -30 replies
586/713io_uring/waitid: honor task_work cancellationio_uring/waitid.c+12 -40 replies
587/713io_uring/waitid: avoid siginfo copy during ring teardownio_uring/waitid.c+15 -40 replies
588/713io_uring/query: cap user size passed to copy_struct_to_userio_uring/query.c+3 -00 replies
589/713interconnect: Fix use after free in icc_get() and of_icc_get_by_index()drivers/interconnect/core.c+4 -30 replies
590/713ipmi: ipmb: validate write message lengthdrivers/char/ipmi/ipmb_dev_int.c+3 -20 replies
591/713ipmi: Remove all sysfs files on registration failuredrivers/char/ipmi/ipmi_msghandler.c+1 -00 replies
592/713ipmi: si: Fix NULL pointer dereference after failed registrationdrivers/char/ipmi/ipmi_msghandler.c+1 -00 replies
593/713ipmi:msghandler: Cancel work cleanly on an errordrivers/char/ipmi/ipmi_msghandler.c+1 -00 replies
594/713net/iucv: filter frames in afiucv_hs_rcv() by ingress devicenet/iucv/af_iucv.c+2 -00 replies
595/713xdp: fix zero-copy frame layoutnet/core/xdp.c+2 -20 replies
596/713slip: fix use-after-free in sl_sync()drivers/net/slip/slip.c+8 -30 replies
597/713net: usb: qmi_wwan: add Telit Cinterion FE990D50 compositiondrivers/net/usb/qmi_wwan.c+1 -00 replies
598/713net: tun: bound receive headroomdrivers/net/tun.c+16 -50 replies
599/713net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIOdrivers/net/dsa/realtek/rtl83xx.c+2 -20 replies
600/713net: bnxt: ring the doorbell when SW USO exits earlydrivers/net/ethernet/broadcom/bnxt/bnxt.c drivers/net/ethernet/broadcom/bnxt/bnxt_gso.c+9 -50 replies
601/713net: ibm: emac: mal: fix NAPI lockingdrivers/net/ethernet/ibm/emac/mal.c+10 -30 replies
602/713net: ipa: fix stalled modem TX queue after runtime resumedrivers/net/ipa/ipa_modem.c+17 -10 replies
603/713net: l2tp: do not propagate multicast notification errorsnet/l2tp/l2tp_netlink.c+8 -80 replies
604/713net: mctp: hold a reference to the route device in mctp_route_lookup()net/mctp/route.c+17 -20 replies
605/713net: openvswitch: fix flow mask use-after-free on flow deletionnet/openvswitch/datapath.c+23 -220 replies
606/713net: openvswitch: fix nf_connlabels leak in ovs_ct_initnet/openvswitch/conntrack.c+5 -30 replies
607/713net: phylink: correctly validate returned PCS in phylink_inband_capsdrivers/net/phy/phylink.c+1 -10 replies
608/713net: ravb: avoid dereferencing an invalid PTP clockdrivers/net/ethernet/renesas/ravb.h drivers/net/ethernet/renesas/ravb_main.c drivers/net/ethernet/renesas/ravb_ptp.c+16 -30 replies
609/713net: ravb: serialize PTP clock teardowndrivers/net/ethernet/renesas/ravb.h drivers/net/ethernet/renesas/ravb_main.c drivers/net/ethernet/renesas/ravb_ptp.c+35 -100 replies
610/713net: thunderbolt: Release the Rx HopID that was handed out on mismatchdrivers/net/thunderbolt/main.c+2 -00 replies
611/713net: thunderbolt: Mark the connection down when bringing it up failsdrivers/net/thunderbolt/main.c+10 -00 replies
612/713NTB: ntb_transport: Recycle TX entries before client callbacksdrivers/ntb/ntb_transport.c+14 -90 replies
613/713NTB: ntb_transport: Fail TX enqueue when the QP link is downdrivers/ntb/ntb_transport.c+1 -20 replies
614/713NTB: ntb_transport: Reject oversized TX buffersdrivers/ntb/ntb_transport.c+3 -90 replies
615/713net: ntb_netdev: Fix TX busy and drop handlingdrivers/net/ntb_netdev.c+19 -80 replies
616/713net: ntb_netdev: Avoid double-accounting netif_rx() dropsdrivers/net/ntb_netdev.c+3 -70 replies
617/713net: ntb_netdev: Count packets dropped on RX refill failuredrivers/net/ntb_netdev.c+3 -20 replies
618/713net/mlx5e: do not HW-GRO coalesce small framesdrivers/net/ethernet/mellanox/mlx5/core/en_rx.c+5 -00 replies
619/713net/smc: bound the peer rkey counts in SMC-Rv2 LLC messagesnet/smc/smc_llc.c+16 -00 replies
620/713net/smc: carry oversized SMC-Rv2 LLC messages in the queue entrynet/smc/smc_llc.c net/smc/smc_wr.c+91 -400 replies
621/713net/smc: do not dereference an unset send buffer on the SMC-D teardown pathnet/smc/af_smc.c net/smc/smc_tx.h+7 -20 replies
622/713net/smc: fix socket refcount leak in smc_switch_conns()net/smc/smc_core.c+7 -70 replies
623/713net/smc: fix use-after-free in smc_rx_pipe_buf_release()net/smc/smc_rx.c+5 -60 replies
624/713net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()net/smc/smc_llc.c+5 -40 replies
625/713net/smc: stop killed, freed and out_of_sync sharing a bytenet/smc/smc.h+3 -30 replies
626/713net/smc: unregister the connection before draining the rx taskletnet/smc/smc_core.c+7 -60 replies
627/713net: cap advertised IP tunnel headroominclude/net/ip_tunnels.h net/ipv4/ip_tunnel.c net/ipv6/ip6_gre.c +2 more+21 -80 replies
628/713net: fix spurious TX timeout after dev_activate()net/sched/sch_generic.c+1 -10 replies
629/713net: skbuff: dont touch shared zerocopy state in skb_tx_error()net/core/skbuff.c+4 -10 replies
630/713seg6: reset IP6CB after IPv6 decapsulationnet/ipv6/seg6_local.c+9 -00 replies
631/713hwrng: stm32 - Fix runtime PM cleanup on registration failuredrivers/char/hw_random/stm32-rng.c+3 -70 replies
632/713mfd: cgbc: Fix teardown ordering in cgbc_remove()drivers/mfd/cgbc-core.c+2 -20 replies
633/713mfd: qnap-mcu: keep the reply buffer alive past a command timeoutdrivers/mfd/qnap-mcu.c+7 -60 replies
634/713mfd: sm501: Fix potential memory leaks during removedrivers/mfd/sm501.c+2 -00 replies
635/713ALSA: 6fire: bound the MIDI event length from the devicesound/usb/6fire/comm.c+6 -30 replies
636/713ALSA: aloop: Check card index validity at probesound/drivers/aloop.c+6 -00 replies
637/713ALSA: bcd2000: clear the URB pointers on disconnectsound/usb/bcd2000/bcd2000.c+8 -30 replies
638/713ALSA: FCP: do not copy out an uninitialised init responsesound/usb/fcp.c+3 -10 replies
639/713ALSA: hda/ext: preserve PPLCCTL bits when clearing resetsound/hda/core/ext/stream.c+2 -20 replies
640/713ALSA: mpu401: Check card index validity at probesound/drivers/mpu401/mpu401.c+6 -00 replies
641/713ALSA: mts64: Check card index validity at probesound/drivers/mts64.c+6 -00 replies
642/713ALSA: pcxhr: initialize mutexes before requesting threaded IRQsound/pci/pcxhr/pcxhr.c+7 -70 replies
643/713ALSA: portman2x4: Check card index validity at probesound/drivers/portman2x4.c+6 -00 replies
644/713ALSA: serial-u16550: Check card index validity at probesound/drivers/serial-u16550.c+6 -00 replies
645/713ALSA: virmidi: Check card index validity at probesound/drivers/virmidi.c+6 -00 replies
646/713ALSA: hda/realtek: Add quirk for TongFang XxAF5xxxsound/hda/codecs/realtek/alc269.c+1 -00 replies
647/713ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP rsound/hda/codecs/realtek/alc662.c+1 -00 replies
648/713ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUGsound/hda/codecs/realtek/alc269.c+1 -00 replies
649/713ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk orderingsound/hda/codecs/realtek/alc269.c+4 -10 replies
650/713rust: num: reject Bounded::shr overshifts at build timerust/kernel/num/bounded.rs+1 -00 replies
651/713arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()drivers/base/arch_numa.c+12 -00 replies
652/713dm-stats: fix a crash if allocation of per-cpu data failsdrivers/md/dm-stats.c+4 -20 replies
653/713dm-switch: use WRITE_ONCE() in switch_region_table_write()drivers/md/dm-switch.c+1 -10 replies
654/713dm-pcache: validate geometry fields from on-disk cache_infodrivers/md/dm-pcache/cache.c+14 -00 replies
655/713dm-pcache: validate kset key_num and intra-segment boundsdrivers/md/dm-pcache/cache.h drivers/md/dm-pcache/cache_gc.c drivers/md/dm-pcache/cache_key.c +1 more+38 -90 replies
656/713dm-pcache: validate on-media seg_num against the cache device sizedrivers/md/dm-pcache/cache_dev.c+21 -10 replies
657/713dm-pcache: bound the persisted tail-position offsetdrivers/md/dm-pcache/cache.c+4 -00 replies
658/713dm-pcache: clamp the tail kset read to the segment data regiondrivers/md/dm-pcache/cache_gc.c drivers/md/dm-pcache/cache_key.c drivers/md/dm-pcache/cache_writeback.c+3 -30 replies
659/713dm-pcache: detect a cycle in the last-kset chain during replaydrivers/md/dm-pcache/cache_key.c+6 -10 replies
660/713dm-pcache: only hand out initialized cache segmentsdrivers/md/dm-pcache/cache_segment.c+10 -20 replies
661/713dm-pcache: fix implicit u8 truncation of gc_percent in message handlerdrivers/md/dm-pcache/dm_pcache.c+2 -20 replies
662/713dm-pcache: fix use-after-free and invalid seg operations in kset_replay()drivers/md/dm-pcache/cache_key.c+6 -70 replies
663/713i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()drivers/i3c/device.c drivers/i3c/internals.h drivers/i3c/master.c+6 -70 replies
664/713i3c: master: adi: initialize the lock before enabling interruptsdrivers/i3c/master/adi-i3c-master.c+7 -80 replies
665/713i3c: master: Fix info leak and UAF in device unregister pathdrivers/i3c/master.c+5 -40 replies
666/713i3c: master: svc: bound IBI payload to the requested max_payload_lendrivers/i3c/master/svc-i3c-master.c+9 -10 replies
667/713i3c: master: Fix potential UAF in i3c_device_uevent()drivers/i3c/master.c+1 -20 replies
668/713i3c: renesas: Check that the transfer is valid before accessing itdrivers/i3c/master/renesas-i3c.c+45 -70 replies
669/713i3c: renesas: Clean DATBAS register on detachdrivers/i3c/master/renesas-i3c.c+2 -00 replies
670/713i3c: renesas: Follow the reset deassert order used in probedrivers/i3c/master/renesas-i3c.c+6 -60 replies
671/713i3c: renesas: Reconfigure the DATBAS register on re-attachdrivers/i3c/master/renesas-i3c.c+16 -00 replies
672/713i3c: renesas: Reset the controller on resumedrivers/i3c/master/renesas-i3c.c+8 -20 replies
673/713i3c: renesas: Restore STDBR and EXTBR registers on resumedrivers/i3c/master/renesas-i3c.c+6 -40 replies
674/713i3c: renesas: Perform Dynamic Address Assignment on resumedrivers/i3c/master/renesas-i3c.c+15 -230 replies
675/713wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c+2 -10 replies
676/713wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()drivers/net/wireless/intel/iwlwifi/dvm/main.c+2 -20 replies
677/713wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stopdrivers/net/wireless/realtek/rtl8xxxu/core.c+14 -50 replies
678/713fuse: decouple fuse_ring creation from ent registrationfs/fuse/dev.c fs/fuse/dev.h fs/fuse/dev_uring.c +2 more+22 -230 replies
679/713fuse: copy request headers via a stack buffer for io-uringfs/fuse/dev_uring.c+8 -40 replies
680/713crypto: iaa - unmap dst before software fallback on decompressdrivers/crypto/intel/iaa/iaa_crypto_main.c+12 -150 replies
681/713crypto: atmel-ecc - clean up and improve ECDH commentsdrivers/crypto/atmel-ecc.c+14 -240 replies
682/713crypto: atmel-ecc - avoid stale fallback key after set_secret failuredrivers/crypto/atmel-ecc.c+4 -40 replies
683/713mm/kmemleak: stop the task stack scan early when interruptedmm/kmemleak.c+12 -60 replies
684/713mm/kmemleak: report RCU-tasks quiescent states during the scanmm/kmemleak.c+7 -70 replies
685/713wifi: mwifiex: Detach sync cmd buffer on interrupted waitdrivers/net/wireless/marvell/mwifiex/sta_ioctl.c+12 -00 replies
686/713wifi: rtl818x: initialize eeprom_93cx6 struct to zerodrivers/net/wireless/realtek/rtl818x/rtl8180/dev.c drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c+2 -20 replies
687/713wifi: rtlwifi: rtl8192du: check QoS TID before indexing tidsdrivers/net/wireless/realtek/rtlwifi/rtl8192du/trx.c+2 -10 replies
688/713wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c+9 -30 replies
689/713wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()drivers/net/wireless/realtek/rtw88/tx.c+1 -00 replies
690/713wifi: rtw88: pci: fix resource leak on failed NAPI setupdrivers/net/wireless/realtek/rtw88/pci.c+3 -10 replies
691/713wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on rebootdrivers/net/wireless/realtek/rtw89/core.h drivers/net/wireless/realtek/rtw89/mac80211.c drivers/net/wireless/realtek/rtw89/pci.c +8 more+24 -10 replies
692/713wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutexdrivers/net/wireless/mediatek/mt76/mt7615/main.c+3 -20 replies
693/713wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copydrivers/net/wireless/mediatek/mt76/mt7915/mcu.c+9 -20 replies
694/713wifi: mt76: mt7925: cancel mlo_pm_work on stopdrivers/net/wireless/mediatek/mt76/mt7925/main.c+10 -10 replies
695/713wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copydrivers/net/wireless/mediatek/mt76/mt7996/mcu.c+8 -10 replies
696/713wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req framesdrivers/net/wireless/mediatek/mt76/mt7996/mac.c+25 -10 replies
697/713wifi: mt76: mt7996: validate default EEPROM firmware sizedrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c+6 -00 replies
698/713vsock/virtio: flush works in dependency ordernet/vmw_vsock/virtio_transport.c+1 -10 replies
699/713w1: ds28e17: reject an oversize length on an I2C block readdrivers/w1/slaves/w1_ds28e17.c+8 -00 replies
700/713xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()lib/xarray.c+3 -00 replies
701/713zloop: truncate finished zones to zone capacityDocumentation/admin-guide/blockdev/zoned_loop.rst drivers/block/zloop.c+6 -60 replies
702/713tpm: tpm_i2c_nuvoton: disable IRQ on wait timeoutdrivers/char/tpm/tpm_i2c_nuvoton.c+4 -20 replies
703/713sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]kernel/pid.c kernel/reboot.c+29 -310 replies
704/713sticon/parisc: Detect default STI graphics card for console outputdrivers/video/sticore.c+21 -10 replies
705/713signal: avoid shared siginfo namespace rewriteskernel/signal.c+4 -00 replies
706/713smack: fix cred UAF in smack_file_send_sigiotask()security/smack/smack_lsm.c+1 -10 replies
707/713taskstats: fix cpumask parsing cutting off the last characterkernel/taskstats.c+1 -20 replies
708/713timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()kernel/time/timekeeping.c+5 -30 replies
709/713timer: Keep debugobjects state consistent in migrate_timer_list()kernel/time/timer.c+1 -00 replies
710/713udf: Fix i_lenExtents truncation on 32-bit kernelsfs/udf/inode.c+1 -10 replies
711/713selftests/mm: fix on-fault-limit false failure under sudo-rstools/testing/selftests/mm/run_vmtests.sh+1 -10 replies
712/713ACPI: scan: Do not combine resources that overlap completelydrivers/acpi/acpi_platform.c+7 -10 replies
713/713platform/chrome: sensorhub: Fix dropped timestamp events and log spamdrivers/platform/chrome/cros_ec_sensorhub_ring.c+15 -120 replies

Reviews trailers per patch

369 of 713 patches have a Reviewed-by or Acked-by.

PatchAurabindo PillaiMasami Hiramatsu (Google)Mario LimoncielloSun peng LiDan WheelerWayne LinMagnus LindholmAnuj GuptaKanchan JoshiDarrick J. WongAndreas HindborgIndrek KruusaJernej SkrabecPaul MooreAmir GoldsteinRitesh Harjani (IBM)Alice RyhlGary GuoLink MauveBurak EmirAlexandre CourbotOnur ÖzkanQu WenruoNick DesaulniersKairui SongBarry SongNhat PhamDavid Hildenbrand (Arm)Hugh DickinsJoshua HahnZi YanBalbir SinghGregory PriceBaolin WangLorenzo Stoakes (ARM)Johannes WeinerOscar SalvadorMichal ClapinskiMike Rapoport (Microsoft)Frank van der LindenCatalin MarinasDavidlohr BuesoLance YangOleg NesterovPaul E. McKenneyMuchun SongVlastimil Babka (SUSE)Harry Yoo (Oracle)Hao LiUladzislau Rezki (Sony)Shakeel ButtYosry AhmedMichal HockoTao CuiNeha GholkarSami TolvanenJarkko SakkinenSizhe LiuYicong YangBradley MorganVincent Donnefort[email protected]Nikhil AgarwalNipun GuptaDisha GoelAndy ShevchenkoXu YangAlexander GrafDan CarpenterLaurent PinchartFrank LiThinh NguyenRadhey Shyam PandeyQi ZhengSong HuHeikki KrogerusBadhri Jagan SridharanFedor Pchelkin[email protected]Alison SchofieldXu YilunSrinivas PandruvadaTommaso MerciaiSean ChristophersonKai HuangKuppuswamy SathyanarayananBinbin WuRick EdgecombeJuergen GrossMatthias GoergensSergey SenozhatskyChristoph HellwigJeff LaytonNeilBrownGeert UytterhoevenSebastian ReichelRichard WeinbergerZhihao ChengBenjamin CoddingtonViacheslav DubeykoAlex MarkuzeDavid SterbaFilipe MananaRicardo RobainaNamjae JeonChenXiaoSongEven XuXiubo LiAnisse AstierGao XiangChao YuHyunchul LeeOGAWA HirofumiSimon HormanZhu YanjunBreno LeitaoRik van RielDave JiangJonathan CameronTony LuckHanjun GuoShuai XueZhongqiu HanJulienPaul MenzelLinus WalleijMichael ChanAndy GospodarekEduard ZingermanJan KaraDaniel Thompson (RISCstar)Ming-Hung TsaiJames ClarkJason GunthorpeBen CheathamDan WilliamsRichard ChengSven PeterHannes ReineckeAndrey RyabininZhang YiFernando Fernandez ManceraIdo SchimmelMatthieu Baerts (NGI0)Petr PavluXiang MeiRen WeiStefano BrivioChuck LeverMykola MarzhanYu KuaiAaron TomlinBart Van AsscheKaran Tilak KumarKonrad DybcioVal PackettQuentin SchulzYixun LanAnup PatelSudeep HollaSunil V LHuisong LiJesse TaubeAnirudh SrinivasanPeter Zijlstra (Intel)Joseph QiIlya MaximetsJongmin JangFeng TangMaurizio LombardiLaurence ObermanJustin TeeXin LongBenson LeungLucas StachHeiko CarstensJan HöppnerAditya GargShradha GuptaMichael KelleyManivannan SadhasivamNeil ArmstrongLukas WunnerThomas GleixnerNiklas SchnelleVasant HegdeMukesh OjhaTzung-Bi ShihIlpo JärvinenYahia AhmedMark PearsonNicolin ChenFrancis De BrabandereMario Limonciello (AMD)Lu BaoluKevin TianWillem de BruijnAlvin ŠipragaLuiz Angelo Daros de LucaAaron ConoleGabriel Krisman BertaziVadim FedorenkoMika WesterbergSidraya JayagondTony LuMahanta JambigiNicolai BuchwitzJason XingAndrea MayerNilay ShroffDanilo KrummrichMukesh SavaliyaBernd SchubertJoanne KoongPing-Ke ShihTraocklAndi ShytiDamien Le MoalAlexey GladkovPavel TikhomirovAndrew MortonNathan ChancellorTomasz FigaSJ ParkTakeshi OgasawaraRonald WarsowBrett A C SheffieldMarkus ReicheltShuah KhanMiguel OjedaBarry K. NathanPeter SchneiderRon EconomosBenjamin BoortzJeffrin Jose T
SeriesT-b T-b T-b T-b T-b T-b T-b T-b T-b T-b T-b
1/713R-b
2/713
3/713
4/713
5/713
6/713
7/713
8/713
9/713R-b
10/713A-b
11/713R-b R-b T-b
12/713T-b R-b
13/713R-b T-b
14/713R-b R-b R-b
15/713A-b
16/713R-b T-b
17/713
18/713T-b A-b
19/713T-b
20/713R-b
21/713
22/713R-b
23/713R-b R-b T-b
24/713
25/713T-b
26/713
27/713
28/713
29/713
30/713T-b
31/713R-b R-b
32/713R-b R-b
33/713R-b R-b
34/713
35/713
36/713
37/713R-b
38/713R-b
39/713A-b
40/713A-b
41/713R-b T-b
42/713
43/713
44/713R-b T-b
45/713A-b
46/713A-b R-b R-b A-b
47/713A-b
48/713A-b R-b R-b R-b R-b
49/713R-b A-b A-b
50/713A-b T-b R-b
51/713A-b A-b
52/713A-b R-b
53/713R-b R-b R-b R-b
54/713R-b R-b R-b R-b
55/713A-b R-b R-b R-b R-b
56/713R-b R-b
57/713A-b A-b R-b R-b
58/713A-b A-b
59/713R-b R-b
60/713
61/713R-b R-b
62/713A-b R-b
63/713A-b R-b
64/713A-b R-b
65/713A-b A-b
66/713R-b
67/713R-b R-b
68/713R-b
69/713A-b R-b A-b
70/713A-b A-b
71/713R-b R-b
72/713A-b R-b A-b A-b
73/713A-b A-b A-b R-b
74/713A-b A-b
75/713A-b A-b A-b
76/713A-b A-b R-b T-b
77/713R-b A-b
78/713R-b
79/713R-b
80/713R-b A-b A-b A-b T-b R-b
81/713
82/713
83/713A-b
84/713R-b R-b R-b R-b
85/713R-b
86/713R-b T-b
87/713R-b T-b R-b
88/713R-b
89/713
90/713A-b
91/713R-b
92/713R-b T-b
93/713
94/713A-b A-b
95/713R-b T-b
96/713T-b T-b
97/713R-b
98/713R-b
99/713R-b
100/713R-b
101/713R-b
102/713
103/713
104/713A-b R-b
105/713
106/713
107/713R-b
108/713A-b R-b
109/713A-b
110/713R-b R-b
111/713
112/713
113/713T-b
114/713
115/713R-b
116/713
117/713
118/713R-b
119/713R-b
120/713A-b
121/713R-b T-b
122/713
123/713
124/713
125/713
126/713
127/713R-b
128/713
129/713R-b
130/713R-b R-b
131/713R-b
132/713R-b
133/713
134/713
135/713R-b
136/713
137/713R-b
138/713
139/713
140/713R-b R-b
141/713R-b
142/713
143/713
144/713
145/713
146/713
147/713
148/713
149/713
150/713R-b
151/713
152/713
153/713R-b
154/713R-b
155/713
156/713
157/713
158/713
159/713
160/713
161/713
162/713
163/713
164/713
165/713
166/713
167/713
168/713
169/713
170/713
171/713
172/713
173/713
174/713
175/713R-b R-b
176/713
177/713
178/713
179/713
180/713
181/713
182/713
183/713
184/713
185/713
186/713
187/713R-b R-b
188/713
189/713
190/713
191/713
192/713
193/713
194/713
195/713
196/713
197/713
198/713
199/713
200/713
201/713
202/713R-b
203/713
204/713
205/713R-b
206/713
207/713R-b R-b
208/713R-b
209/713R-b R-b
210/713R-b R-b
211/713R-b R-b
212/713
213/713R-b
214/713R-b
215/713R-b
216/713R-b
217/713R-b
218/713R-b
219/713R-b
220/713R-b
221/713R-b
222/713R-b
223/713R-b
224/713R-b
225/713R-b
226/713R-b
227/713R-b R-b
228/713R-b R-b
229/713R-b T-b
230/713
231/713A-b
232/713
233/713R-b
234/713
235/713
236/713
237/713R-b
238/713R-b
239/713
240/713A-b
241/713
242/713
243/713R-b
244/713R-b
245/713
246/713
247/713
248/713
249/713
250/713A-b
251/713
252/713
253/713
254/713
255/713
256/713R-b
257/713R-b
258/713R-b
259/713R-b
260/713
261/713
262/713
263/713
264/713R-b
265/713
266/713
267/713
268/713
269/713
270/713
271/713
272/713
273/713
274/713
275/713
276/713
277/713R-b
278/713
279/713R-b R-b
280/713
281/713
282/713A-b
283/713
284/713
285/713
286/713
287/713
288/713R-b R-b
289/713R-b
290/713
291/713
292/713R-b R-b
293/713
294/713
295/713
296/713R-b R-b R-b
297/713R-b
298/713R-b
299/713
300/713R-b
301/713
302/713R-b T-b R-b
303/713
304/713T-b R-b A-b
305/713R-b
306/713R-b
307/713R-b
308/713R-b
309/713R-b
310/713R-b
311/713R-b
312/713R-b R-b
313/713R-b
314/713R-b
315/713R-b
316/713
317/713
318/713R-b
319/713R-b R-b
320/713R-b
321/713
322/713R-b
323/713
324/713
325/713
326/713
327/713
328/713R-b
329/713R-b
330/713R-b
331/713
332/713R-b
333/713R-b
334/713R-b R-b
335/713A-b
336/713R-b R-b R-b R-b
337/713R-b
338/713
339/713
340/713
341/713
342/713
343/713
344/713
345/713
346/713
347/713
348/713R-b
349/713
350/713R-b R-b
351/713R-b R-b
352/713R-b
353/713R-b
354/713R-b
355/713R-b
356/713R-b T-b
357/713R-b R-b
358/713
359/713R-b
360/713
361/713R-b R-b R-b
362/713R-b
363/713R-b R-b
364/713R-b
365/713R-b
366/713R-b
367/713
368/713R-b
369/713R-b R-b
370/713R-b
371/713R-b
372/713R-b
373/713
374/713R-b
375/713
376/713R-b
377/713R-b
378/713
379/713R-b
380/713R-b
381/713R-b
382/713R-b
383/713R-b
384/713R-b
385/713R-b
386/713R-b
387/713R-b
388/713R-b
389/713A-b
390/713A-b
391/713A-b
392/713A-b
393/713A-b
394/713A-b
395/713
396/713A-b
397/713
398/713A-b
399/713A-b
400/713A-b
401/713
402/713
403/713
404/713
405/713
406/713
407/713A-b
408/713A-b
409/713
410/713
411/713
412/713
413/713
414/713
415/713
416/713
417/713
418/713
419/713R-b
420/713R-b
421/713R-b
422/713
423/713R-b
424/713R-b
425/713R-b A-b
426/713
427/713
428/713T-b R-b
429/713
430/713
431/713R-b
432/713R-b
433/713R-b
434/713R-b
435/713R-b
436/713R-b
437/713R-b A-b R-b R-b
438/713A-b T-b
439/713
440/713
441/713
442/713
443/713
444/713
445/713
446/713
447/713
448/713
449/713
450/713
451/713R-b
452/713
453/713R-b
454/713
455/713
456/713
457/713
458/713
459/713
460/713R-b
461/713R-b
462/713R-b
463/713R-b
464/713R-b
465/713
466/713
467/713
468/713R-b
469/713R-b
470/713
471/713R-b R-b
472/713R-b T-b
473/713
474/713
475/713
476/713
477/713
478/713R-b
479/713
480/713
481/713R-b
482/713
483/713
484/713R-b
485/713
486/713
487/713R-b R-b R-b
488/713
489/713R-b
490/713
491/713
492/713
493/713A-b
494/713A-b
495/713A-b
496/713A-b
497/713
498/713
499/713
500/713
501/713
502/713R-b
503/713R-b
504/713
505/713
506/713R-b
507/713
508/713
509/713
510/713
511/713R-b
512/713
513/713
514/713
515/713A-b
516/713R-b
517/713R-b
518/713R-b
519/713R-b
520/713R-b R-b R-b
521/713R-b
522/713R-b
523/713
524/713
525/713
526/713
527/713
528/713
529/713
530/713
531/713R-b R-b
532/713R-b R-b
533/713R-b R-b
534/713
535/713
536/713
537/713R-b
538/713R-b
539/713R-b R-b R-b
540/713
541/713R-b
542/713R-b R-b
543/713
544/713
545/713
546/713R-b R-b R-b
547/713R-b R-b
548/713R-b R-b
549/713
550/713R-b
551/713A-b R-b
552/713A-b R-b
553/713
554/713
555/713R-b
556/713R-b
557/713R-b
558/713R-b
559/713R-b
560/713R-b
561/713R-b
562/713R-b
563/713R-b T-b
564/713R-b
565/713A-b R-b
566/713R-b
567/713R-b
568/713R-b R-b
569/713R-b R-b
570/713R-b R-b
571/713
572/713R-b
573/713R-b T-b
574/713R-b T-b
575/713R-b
576/713R-b R-b
577/713R-b
578/713R-b
579/713R-b
580/713R-b
581/713R-b
582/713R-b
583/713R-b
584/713R-b
585/713R-b R-b
586/713
587/713
588/713R-b
589/713
590/713
591/713
592/713
593/713T-b
594/713
595/713
596/713
597/713R-b
598/713R-b
599/713R-b R-b R-b
600/713R-b
601/713R-b
602/713R-b
603/713R-b
604/713
605/713R-b
606/713R-b
607/713
608/713R-b
609/713
610/713R-b A-b
611/713R-b A-b
612/713R-b
613/713R-b
614/713R-b
615/713R-b
616/713
617/713
618/713
619/713R-b
620/713R-b
621/713R-b R-b
622/713R-b R-b
623/713R-b R-b
624/713R-b R-b
625/713R-b R-b
626/713R-b R-b
627/713R-b
628/713R-b R-b
629/713R-b T-b R-b
630/713R-b
631/713R-b
632/713
633/713
634/713
635/713
636/713
637/713
638/713
639/713
640/713
641/713
642/713
643/713
644/713
645/713
646/713
647/713
648/713
649/713
650/713R-b A-b R-b
651/713R-b
652/713
653/713
654/713
655/713
656/713
657/713
658/713
659/713
660/713
661/713
662/713
663/713R-b
664/713R-b
665/713R-b
666/713R-b
667/713R-b A-b
668/713R-b T-b
669/713R-b T-b
670/713R-b T-b
671/713R-b T-b
672/713R-b T-b
673/713R-b T-b
674/713R-b T-b
675/713
676/713
677/713
678/713R-b
679/713R-b R-b
680/713
681/713
682/713
683/713R-b R-b
684/713R-b R-b R-b
685/713
686/713R-b
687/713
688/713A-b
689/713A-b
690/713A-b
691/713A-b
692/713
693/713
694/713T-b
695/713
696/713
697/713
698/713
699/713R-b
700/713R-b A-b
701/713R-b R-b
702/713R-b
703/713R-b A-b R-b
704/713
705/713A-b
706/713
707/713R-b
708/713
709/713
710/713
711/713
712/713R-b T-b
713/713R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 235 reviewers.

Read the v1 thread

Cover letter [PATCH 7.2 000/713] 7.2.4-rc1 review

This is the start of the stable review cycle for the 7.2.4 release. There are 713 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.4-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 7.2.4-rc1

Tzung-Bi Shih <[email protected]>
platform/chrome: sensorhub: Fix dropped timestamp events and log spam

Rafael J. Wysocki <[email protected]>
ACPI: scan: Do not combine resources that overlap completely

Injae Ryou <[email protected]>
selftests/mm: fix on-fault-limit false failure under sudo-rs

Zhan Xusheng <[email protected]>
udf: Fix i_lenExtents truncation on 32-bit kernels

Thomas Gleixner <[email protected]>
timer: Keep debugobjects state consistent in migrate_timer_list()

Thomas Weißschuh (Schneider Electric) <[email protected]>
timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()

Bradley Morgan <[email protected]>
taskstats: fix cpumask parsing cutting off the last character

Jann Horn <[email protected]>
smack: fix cred UAF in smack_file_send_sigiotask()

Bradley Morgan <[email protected]>
signal: avoid shared siginfo namespace rewrites

Helge Deller <[email protected]>
sticon/parisc: Detect default STI graphics card for console output

Oleg Nesterov <[email protected]>

    sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]

Myeonghun Pak <[email protected]>
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

Xu Rao <[email protected]>
zloop: truncate finished zones to zone capacity

Zi Yan <[email protected]>
xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()

Maoyi Xie <[email protected]>
w1: ds28e17: reject an oversize length on an I2C block read

Chengfeng Ye <[email protected]>
vsock/virtio: flush works in dependency order

Laxman Acharya Padhya <[email protected]>
wifi: mt76: mt7996: validate default EEPROM firmware size

Felix Fietkau <[email protected]>
wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames

Bryam Vargas <[email protected]>
wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

Devin Wittmayer <[email protected]>
wifi: mt76: mt7925: cancel mlo_pm_work on stop

Bryam Vargas <[email protected]>
wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

Runyu Xiao <[email protected]>
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex

Yuhang.chen <[email protected]>
wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot

Dawei Feng <[email protected]>
wifi: rtw88: pci: fix resource leak on failed NAPI setup

Abdun Nihaal <[email protected]>
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()

Abdun Nihaal <[email protected]>
wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()

Runyu Xiao <[email protected]>
wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

Stanislaw Gruszka <[email protected]>
wifi: rtl818x: initialize eeprom_93cx6 struct to zero

Fabio Estevam <[email protected]>
wifi: mwifiex: Detach sync cmd buffer on interrupted wait

Breno Leitao <[email protected]>
mm/kmemleak: report RCU-tasks quiescent states during the scan

Breno Leitao <[email protected]>
mm/kmemleak: stop the task stack scan early when interrupted

Thorsten Blum <[email protected]>
crypto: atmel-ecc - avoid stale fallback key after set_secret failure

Thorsten Blum <[email protected]>
crypto: atmel-ecc - clean up and improve ECDH comments

Vinicius Costa Gomes <[email protected]>
crypto: iaa - unmap dst before software fallback on decompress

Xiang Mei <[email protected]>
fuse: copy request headers via a stack buffer for io-uring

Joanne Koong <[email protected]>
fuse: decouple fuse_ring creation from ent registration

Fan Wu <[email protected]>
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop

Dawei Feng <[email protected]>
wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()

Abdun Nihaal <[email protected]>
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()

Claudiu Beznea <[email protected]>
i3c: renesas: Perform Dynamic Address Assignment on resume

Claudiu Beznea <[email protected]>
i3c: renesas: Restore STDBR and EXTBR registers on resume

Claudiu Beznea <[email protected]>
i3c: renesas: Reset the controller on resume

Claudiu Beznea <[email protected]>
i3c: renesas: Reconfigure the DATBAS register on re-attach

Claudiu Beznea <[email protected]>
i3c: renesas: Follow the reset deassert order used in probe

Claudiu Beznea <[email protected]>
i3c: renesas: Clean DATBAS register on detach

Claudiu Beznea <[email protected]>
i3c: renesas: Check that the transfer is valid before accessing it

Adrian Hunter <[email protected]>
i3c: master: Fix potential UAF in i3c_device_uevent()

Maoyi Xie <[email protected]>
i3c: master: svc: bound IBI payload to the requested max_payload_len

Adrian Hunter <[email protected]>
i3c: master: Fix info leak and UAF in device unregister path

Runyu Xiao <[email protected]>
i3c: master: adi: initialize the lock before enabling interrupts

Adrian Hunter <[email protected]>

    i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()

Jianyun Gao <[email protected]>
dm-pcache: fix use-after-free and invalid seg operations in kset_replay()

Jianyun Gao <[email protected]>
dm-pcache: fix implicit u8 truncation of gc_percent in message handler

Bryam Vargas <[email protected]>
dm-pcache: only hand out initialized cache segments

Bryam Vargas <[email protected]>
dm-pcache: detect a cycle in the last-kset chain during replay

Bryam Vargas <[email protected]>
dm-pcache: clamp the tail kset read to the segment data region

Bryam Vargas <[email protected]>
dm-pcache: bound the persisted tail-position offset

Bryam Vargas <[email protected]>
dm-pcache: validate on-media seg_num against the cache device size

Bryam Vargas <[email protected]>
dm-pcache: validate kset key_num and intra-segment bounds

Bryam Vargas <[email protected]>
dm-pcache: validate geometry fields from on-disk cache_info

Haotian Zhang <[email protected]>
dm-switch: use WRITE_ONCE() in switch_region_table_write()

Mikulas Patocka <[email protected]>
dm-stats: fix a crash if allocation of per-cpu data fails

Nathan Chancellor <[email protected]>
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()

Eliot Courtney <[email protected]>
rust: num: reject Bounded::shr overshifts at build time

Zhang Heng <[email protected]>
ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering

Denis Batishchev <[email protected]>
ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG

Ajrat Makhmutov <[email protected]>
ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r

Eckhart Mohr <[email protected]>
ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx

Takashi Iwai <[email protected]>
ALSA: virmidi: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: serial-u16550: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: portman2x4: Check card index validity at probe

Runyu Xiao <[email protected]>
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ

Takashi Iwai <[email protected]>
ALSA: mts64: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: mpu401: Check card index validity at probe

Xu Rao <[email protected]>
ALSA: hda/ext: preserve PPLCCTL bits when clearing reset

Baul Lee <[email protected]>
ALSA: FCP: do not copy out an uninitialised init response

Baul Lee <[email protected]>
ALSA: bcd2000: clear the URB pointers on disconnect

Takashi Iwai <[email protected]>
ALSA: aloop: Check card index validity at probe

Baul Lee <[email protected]>
ALSA: 6fire: bound the MIDI event length from the device

Abdun Nihaal <[email protected]>
mfd: sm501: Fix potential memory leaks during remove

Ali Ahmet Memis <[email protected]>
mfd: qnap-mcu: keep the reply buffer alive past a command timeout

Thomas Richard <[email protected]>
mfd: cgbc: Fix teardown ordering in cgbc_remove()

Can Peng <[email protected]>
hwrng: stm32 - Fix runtime PM cleanup on registration failure

Zhiling Zou <[email protected]>
seg6: reset IP6CB after IPv6 decapsulation

Norbert Szetei <[email protected]>
net: skbuff: don't touch shared zerocopy state in skb_tx_error()

Breno Leitao <[email protected]>
net: fix spurious TX timeout after dev_activate()

Zhiling Zou <[email protected]>
net: cap advertised IP tunnel headroom

Bryam Vargas <[email protected]>
net/smc: unregister the connection before draining the rx tasklet

Hidayath Khan <[email protected]>
net/smc: stop killed, freed and out_of_sync sharing a byte

Yehyeong Lee <[email protected]>
net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()

Hidayath Khan <[email protected]>
net/smc: fix use-after-free in smc_rx_pipe_buf_release()

Hidayath Khan <[email protected]>
net/smc: fix socket refcount leak in smc_switch_conns()

Bryam Vargas <[email protected]>
net/smc: do not dereference an unset send buffer on the SMC-D teardown path

Yehyeong Lee <[email protected]>
net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry

Yehyeong Lee <[email protected]>
net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages

Glenn Judd <[email protected]>
net/mlx5e: do not HW-GRO coalesce small frames

Koichiro Den <[email protected]>
net: ntb_netdev: Count packets dropped on RX refill failure

Koichiro Den <[email protected]>
net: ntb_netdev: Avoid double-accounting netif_rx() drops

Koichiro Den <[email protected]>
net: ntb_netdev: Fix TX busy and drop handling

Koichiro Den <[email protected]>
NTB: ntb_transport: Reject oversized TX buffers

Koichiro Den <[email protected]>
NTB: ntb_transport: Fail TX enqueue when the QP link is down

Koichiro Den <[email protected]>
NTB: ntb_transport: Recycle TX entries before client callbacks

Fan Ye <[email protected]>
net: thunderbolt: Mark the connection down when bringing it up fails

Fan Ye <[email protected]>
net: thunderbolt: Release the Rx HopID that was handed out on mismatch

Xuanqiang Luo <[email protected]>
net: ravb: serialize PTP clock teardown

Xuanqiang Luo <[email protected]>
net: ravb: avoid dereferencing an invalid PTP clock

Christian Marangi <[email protected]>
net: phylink: correctly validate returned PCS in phylink_inband_caps

Ruoyu Wang <[email protected]>
net: openvswitch: fix nf_connlabels leak in ovs_ct_init

Ilya Maximets <[email protected]>
net: openvswitch: fix flow mask use-after-free on flow deletion

Aldo Ariel Panzardo <[email protected]>
net: mctp: hold a reference to the route device in mctp_route_lookup()

Zihan Xi <[email protected]>
net: l2tp: do not propagate multicast notification errors

Jorijn van der Graaf <[email protected]>
net: ipa: fix stalled modem TX queue after runtime resume

Runyu Xiao <[email protected]>
net: ibm: emac: mal: fix NAPI locking

Joe Damato <[email protected]>
net: bnxt: ring the doorbell when SW USO exits early

Ahmad Fatoum <[email protected]>
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO

Asim Viladi Oglu Manizada <[email protected]>
net: tun: bound receive headroom

Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition

Aleksandr Khromov <[email protected]>
slip: fix use-after-free in sl_sync()

Weiming Shi <[email protected]>
xdp: fix zero-copy frame layout

Alexandra Winter <[email protected]>
net/iucv: filter frames in afiucv_hs_rcv() by ingress device

Corey Minyard <[email protected]>
ipmi:msghandler: Cancel work cleanly on an error

Seiji Nishikawa <[email protected]>
ipmi: si: Fix NULL pointer dereference after failed registration

Yuho Choi <[email protected]>
ipmi: Remove all sysfs files on registration failure

Yousef Alhouseen <[email protected]>
ipmi: ipmb: validate write message length

Kuan-Wei Chiu <[email protected]>
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()

Laxman Acharya Padhya <[email protected]>
io_uring/query: cap user size passed to copy_struct_to_user

Hui Su <[email protected]>
io_uring/waitid: avoid siginfo copy during ring teardown

Hui Su <[email protected]>
io_uring/waitid: honor task_work cancellation

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: warn on element type mismatch instead of failing

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: pass validated element count to package parsers

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read on empty password write

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: bound ordered-list parsing by the package count

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: advance elem past consumed array elements

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS

Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2()

Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails

Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Propagate SMU errors and validate S2D address

Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths

Bryam Vargas <[email protected]>
platform/chrome: sensorhub: Bound the EC-reported sensor number

Thorsten Blum <[email protected]>
platform/x86: think-lmi: Fix current password length check

Thorsten Blum <[email protected]>
platform/x86: think-lmi: Free system certificate signatures

Thorsten Blum <[email protected]>
platform/x86: think-lmi: Fix certificate thumbprint sysfs output

Hilgad Montelo <[email protected]>

    platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]

Julian Haarmann <[email protected]>
platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response

Ma Ke <[email protected]>
platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path

Abdun Nihaal <[email protected]>
platform/x86: int1092: Fix potential memory leak in sar_probe()

Krishna Chomal <[email protected]>

    platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6)

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Return error during profile addition

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate parameter for frequency and priority

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate parameter for core power state

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate max level for set feature

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate logical CPU id and clos id

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Use PP level enable mask

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Just allow 2 bits for SST feature enable

Srinivas Pandruvada <[email protected]>

    platform/x86: ISST: Add a NULL check for sst_inst[]

Fan Wu <[email protected]>
mmc: via-sdmmc: stop card-detect handling on probe failure

Fan Wu <[email protected]>
mmc: via-sdmmc: cancel card-detect work on remove

HyeongJun An <[email protected]>
platform/x86: ISST: Validate socket ID in clos_assoc ioctl

HyeongJun An <[email protected]>
platform/x86: ISST: Validate level in perf mask ioctls

HyeongJun An <[email protected]>
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

Peiyang He <[email protected]>
iommufd: Fix UAF in selftest IOPF reporting

Shuai Xue <[email protected]>
iommufd: Release current IOAS on xa_store() failure

Shuai Xue <[email protected]>
iommufd: Avoid locking internal accesses during unmap

Shuai Xue <[email protected]>
iommupt: Return zero for invalid iova_to_phys() ranges

Kevin Tian <[email protected]>
iommu/vt-d: Force requesting ACS when tboot is enabled

Kevin Tian <[email protected]>
iommu/vt-d: Fix no_iommu to disable platform opt-in

Peiyang He <[email protected]>
iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

Shameer Kolothum <[email protected]>
iommu/arm-smmu-v3: Manage teardown with devm

Robin Murphy <[email protected]>
iommu/arm-smmu-v3: Add HAFT support for SVA

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field

Shuai Xue <[email protected]>

    iommu/sva: Set handle->dev before the SVA handle is visible

Weimin Xiong <[email protected]>
iommu/msm: Unwind probe state on registration failure

Shuai Xue <[email protected]>
iommu/amd: Put PCI device after handling PPR faults

Krzysztof Wilczyński <[email protected]>
PCI/proc: Warn on writes to kernel-exclusive config space regions

Krzysztof Wilczyński <[email protected]>
PCI/proc: Use file_ns_capable() when checking config space read access

Krzysztof Wilczyński <[email protected]>
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses

Farhan Ali <[email protected]>
PCI/MSI: Enable memory decoding before restoring MSI-X messages

Darshit Shah <[email protected]>
PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER

Max Lee <[email protected]>
PCI/ASPM: Avoid L0s for Realtek RTS525A

Lukas Wunner <[email protected]>
PCI/AER: Fix mapping of errors to agent & layer

Lukas Wunner <[email protected]>
PCI/AER: Emit TLP Log only for unmasked errors

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Fix read byte order in pci_read_legacy_io()

Tim Harvey <[email protected]>

    PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]

Ali Tariq <[email protected]>
PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()

Ali Tariq <[email protected]>
PCI: plda: Fix use-after-free of event IRQs during teardown

Ali Tariq <[email protected]>
PCI: starfive: Fix resource leaks on error paths in host_init()

Ronald Claveau <[email protected]>
PCI: meson: Fix GPIO state while requesting PERST#

Mohamad Raizudeen <[email protected]>
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk

Naman Jain <[email protected]>
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip

Stefan Haberland <[email protected]>
s390/dasd: Propagate partial completion length across ERP recovery

Stefan Haberland <[email protected]>
s390/dasd: Guard sysfs discipline callbacks against unallocated private data

Stefan Haberland <[email protected]>
s390/dasd: Do not complete a failed ESE read as successful

Karl Mehltretter <[email protected]>
s390/percpu: Fix MVIY_PERCPU() with older binutils

Thomas Richter <[email protected]>
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks

Jianing Li <[email protected]>
power: supply: max17040: synchronize work cancellation on suspend

Jianing Li <[email protected]>
power: supply: max17040: drop incorrect I2C functionality check

Jianing Li <[email protected]>
power: supply: max17040: propagate register read errors

Fan Wu <[email protected]>
power: supply: ucs1002: fix use-after-free on remove

Maoyi Xie <[email protected]>
power: supply: twl4030_charger: cancel workers via devm

Fan Wu <[email protected]>
power: supply: rt9455: quiesce delayed work before teardown

HyeongJun An <[email protected]>
power: supply: qcom_battmgr: terminate the strings from firmware

Fan Wu <[email protected]>
power: supply: qcom_battmgr: fix use-after-free

Xu Rao <[email protected]>
power: supply: pf1550: enable charging when battery profile exists

Fan Wu <[email protected]>
power: supply: lp8788-charger: fix use-after-free on remove

Fan Wu <[email protected]>

    power: supply: lp8727: fix use-after-free in lp8727_release_irq()

Jameson Thies <[email protected]>
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

Bryam Vargas <[email protected]>
power: supply: cros_usbpd-charger: bound the EC-reported port count

Fan Wu <[email protected]>
power: supply: charger-manager: register regulators before exposing sysfs

Ma Ke <[email protected]>
power: supply: bq25890: Fix power_supply reference leak

Fan Wu <[email protected]>
power: supply: bq256xx: drain usb_work before freeing the charger

Fan Wu <[email protected]>
power: supply: bq24257: fix use-after-free on remove

Jun Yang <[email protected]>

    sctp: fix stream->outcnt underflow on duplicate RECONF responses

Jun Yang <[email protected]>
sctp: distinguish sequence zero from wildcard in reconf lookup

Weiming Shi <[email protected]>
sctp: fix NULL deref on untransmitted RECONF completion

Hyunwoo Kim <[email protected]>
sctp: drop a chunk if its transport was removed

Hyunwoo Kim <[email protected]>
sctp: stop processing a packet once its association is deleted

Yehyeong Lee <[email protected]>
nvme-tcp: reject a read that transferred too few bytes

Yehyeong Lee <[email protected]>
nvme-tcp: fix host memory disclosure on R2T for a read command

Yehyeong Lee <[email protected]>
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

Myeonghun Pak <[email protected]>
nvme-pci: disable controller on admin queue IRQ setup failure

Yehyeong Lee <[email protected]>
nvme: zero the discard fallback page

Ewan D. Milne <[email protected]>
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path

Oscar Ou <[email protected]>
lockd: fix swapped arguments in nlmsvc_match_ip()

Shuangpeng Bai <[email protected]>
lockd: fix NULL dereference on lockowner allocation failure

Olga Kornievskaia <[email protected]>
lockd: fix NLMv4 GRANTED_MSG handling

Michael Bommarito <[email protected]>
lockd: pin next file across nlm_inspect_file lock-drop

Yifei Gao <[email protected]>
ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()

Ruoyu Wang <[email protected]>
i2c: mxs: fix DMA channel leak on probe error

Cong Nguyen <[email protected]>
hwmon: (max6621) fix temperature clamp range

Cong Nguyen <[email protected]>
hwmon: (max6621) fix negative temperature offset and crit readings

Alexander Graf <[email protected]>
dma-contiguous: fix truncation of numa_cma / cma_pernuma sizes >= 2G

Jorijn van der Graaf <[email protected]>
ASoC: codecs: aw88261: only check PLL and clock state at power-up

Christopher Tolang <[email protected]>
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC

Karl Mehltretter <[email protected]>
arm64: proton-pack: Restore the nospectre_bhb command-line option

Karl Mehltretter <[email protected]>
arm64: compat: Fix decrementing LDM/STM alignment emulation

HyeongJun An <[email protected]>
ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion

Norbert Szetei <[email protected]>
openvswitch: only skb_tx_error() a packet we are about to drop

Yuqi Xu <[email protected]>
openvswitch: Fix CT limit teardown use-after-free

Ali Ahmet Memis <[email protected]>
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall

Zhan Xusheng <[email protected]>
ocfs2: fix readdir position truncation on 32-bit kernels

Matthias Goergens <[email protected]>
ocfs2: fix cached cluster count after suballocator reclaim

Joseph Qi <[email protected]>
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure

Joseph Qi <[email protected]>
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item

Joseph Qi <[email protected]>
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

Doruk Tan Ozturk <[email protected]>
ocfs2: validate directory-index entry counts when reading metadata

Ibrahim Hashimov <[email protected]>
ocfs2: validate rl_used against rl_count in refcount block validator

Bryam Vargas <[email protected]>
ocfs2: validate lengths in dlm_mig_lockres_handler

Bryam Vargas <[email protected]>
ocfs2: bound namelen in dlm_migrate_request_handler

Dmitry Antipov <[email protected]>
ocfs2: always run deallocs on copy-on-write completion

Zhiling Zou <[email protected]>
orangefs: skip leading spaces before parsing client debug masks

Yifei Gao <[email protected]>
orangefs: fix double-free of trailer_buf on readdir copy failure

Shibo Zhu <[email protected]>
PM: sleep: Unblock runtime PM when device prepare fails

Ivan Immanuel Shaji <[email protected]>
ring-buffer: Stop remote reader update when page swap fails

Vincent Donnefort <[email protected]>
ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page

Vincent Donnefort <[email protected]>
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf

Vincent Donnefort <[email protected]>
ring-buffer: Free cpu_buffer::free_page with subbuf_order

Vincent Donnefort <[email protected]>
ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()

Kathiravan Thirumoorthy <[email protected]>
regulator: qcom-refgen: correct the regulator type to CURRENT

WenTao Liang <[email protected]>
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata

WenTao Liang <[email protected]>
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer

Yuhang Pan <[email protected]>
RDMA/uverbs: Guard legacy bundles without method_elm

Jason Gunthorpe <[email protected]>
RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR

Norbert Szetei <[email protected]>
RDMA/ucma: Lock the handler in ucma_write_cm_event()

Norbert Szetei <[email protected]>
RDMA/ucma: Lock the handler in ucma_set_ib_path()

Abhijit Gangurde <[email protected]>
RDMA/ionic: Embed counter driver data in rdma_counter allocation

Brett Creeley <[email protected]>
RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget

Fan Wu <[email protected]>
RDMA/cxgb4: Cancel reg_work before freeing device on remove

Vaibhav Nagare <[email protected]>
qede: Fix NULL pointer dereference in TPA fragment processing

Abdifatah Suruur <[email protected]>
ptp: vmclock: prevent read-only mappings from becoming writable

Johan Hovold <[email protected]>
remoteproc: scp: Fix device reference leak on failed lookup

Nam Cao <[email protected]>
riscv: unaligned: stop using kthread for check_vector_unaligned_access()

Peixin Xie <[email protected]>
riscv: acpi: Handle LPI architectural context loss flags

Guidong Han <[email protected]>
RISC-V: KVM: Fix PMU event info array size overflow

Aurelien Jarno <[email protected]>
riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage

Aurelien Jarno <[email protected]>
riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage

Aurelien Jarno <[email protected]>
riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage

Aurelien Jarno <[email protected]>
riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage

Aurelien Jarno <[email protected]>
riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage

Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix rk3588s-roc-pc audio description

Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio

Jakob Unterwurzacher <[email protected]>
arm64: dts: rockchip: fix emmc reset polarity on px30-cobra

Quentin Schulz <[email protected]>
arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck

Quentin Schulz <[email protected]>
arm64: dts: rockchip: fix eMMC reset polarity on PP-1516

Michael Scott <[email protected]>
arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on

Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags

Jianping Li <[email protected]>
arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap

Oren Klopfer <[email protected]>
Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"

Chunkai Deng <[email protected]>
rpmsg: glink: smem: order FIFO read after availability check

Linkai Gong <[email protected]>
scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock

Petr Vaganov <[email protected]>
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()

Tejun Heo <[email protected]>
sched_ext: Keep kick_sync waiting on the rq's own CPU

Tejun Heo <[email protected]>
sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype

Tao Cui <[email protected]>
sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users

Tejun Heo <[email protected]>
sched_ext: Fix inverted ops.core_sched_before() invocation

fangqiurong <[email protected]>
sched_ext: Fix exit_task leak on fork failure during enable

fangqiurong <[email protected]>
sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection

Tejun Heo <[email protected]>

    sched_ext: Count rq lock releases in rq->scx.lock_drop_seq

Tejun Heo <[email protected]>

    sched_ext: Fix rq->core_pick corruption under core scheduling

Tejun Heo <[email protected]>
sched_ext: Fix this_rq() assumptions in dispatch kfuncs

Tejun Heo <[email protected]>
sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return

Tejun Heo <[email protected]>
sched/core: Make core-sched flips wait for in-flight selections

Tejun Heo <[email protected]>
sched/core: Handle pick_task() releasing the rq lock

Cong Nguyen <[email protected]>
media: staging/ipu7: fix async notifier UAF on probe error path

Hao-Qun Huang <[email protected]>
staging: media: tegra-video: vi: fix probe failure on skipped last port

Hao-Qun Huang <[email protected]>
staging: media: tegra-video: fix of_node_put() on VIP parse errors

Wentao Guan <[email protected]>
wifi: mt76: mt7925: cancel pending mlo_pm_work

Doruk Tan Ozturk <[email protected]>
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

David Lee <[email protected]>
udf: reject VAT indexes equal to the entry count

Chuck Lever <[email protected]>
svcrdma: Validate Read chunk positions before reconstruction

Chuck Lever <[email protected]>
svcrdma: Use svc_xprt_put to free listener on create failure

Chris Mason <[email protected]>
svcrdma: Reject Write/Reply chunks with segcount 0

Chuck Lever <[email protected]>
svcrdma: Reject Read lists that exceed the page budget

Chuck Lever <[email protected]>
svcrdma: Reject oversized Read segments at decode time

Chuck Lever <[email protected]>
svcrdma: Reject inline replies that overflow the pull-up buffer

Chuck Lever <[email protected]>
svcrdma: Reject connection when transport allocation fails

Chris Mason <[email protected]>
svcrdma: Fix unmatched rn_unregister on failed accept

Chris Mason <[email protected]>
svcrdma: Fix pcl_for_each_segment for empty chunks

Chris Mason <[email protected]>
svcrdma: Fix offset arithmetic in read_chunk_range

Chuck Lever <[email protected]>
svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails

Chuck Lever <[email protected]>
svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id

Jérémy Jean <[email protected]>
SUNRPC: wait for in-flight client TLS handshake callback

Chuck Lever <[email protected]>
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

Chuck Lever <[email protected]>
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field

Chris Mason <[email protected]>
SUNRPC: reject duplicate CREDS_VALUE options

Chris Mason <[email protected]>
sunrpc: init gssp_lock before publishing proc entry

Chris Mason <[email protected]>
SUNRPC: harden gss_unwrap_resp_priv length checks

Chris Mason <[email protected]>
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens

Chris Mason <[email protected]>
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat

Luxiao Xu <[email protected]>
sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Chris Mason <[email protected]>
SUNRPC: fix gssx_dec_option_array error path bugs

Jeff Layton <[email protected]>
sunrpc: defer rq_argp and rq_resp free until after RCU grace period

Chuck Lever <[email protected]>
SUNRPC: close backchannel before destroying callback service

Chuck Lever <[email protected]>
SUNRPC: Check svc pool percpu counter allocation

Jeff Layton <[email protected]>
SUNRPC: always drain cache_cleaner before destroying a cache_detail

Ameer Hamza <[email protected]>
SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode

Jeff Layton <[email protected]>
sunrpc: route to a populated pool in svc_pool_for_cpu()

Chris Mason <[email protected]>
SUNRPC: svcauth_gss: enforce krb5 token minimum length

Chris Mason <[email protected]>
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

Chris Mason <[email protected]>

    SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

Felix Gu <[email protected]>
phy: fsl-imx8mq-usb: fix typec switch leak on probe error path

Jiacheng Yu <[email protected]>
params: fix charp corruption on allocation failure

Dave Airlie <[email protected]>
nouveau/gem: reserve the bo in the info ioctl around the vma lookup

Stanislaw Gruszka <[email protected]>
module/kallsyms: fix nextval for data symbol lookup

Harshit Varu <[email protected]>
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

Qing Ming <[email protected]>
mpls: reload header after pskb_may_pull()

Thiébaud Weksteen <[email protected]>
module: validate string table section types

Coly Li <[email protected]>

    md: do overflow check for sb->bblog_shift in super_1_load()

Yunye Zhao <[email protected]>
md/raid10: fix still_degraded being inverted in raid10_sync_request()

Anup Vishwakarma <[email protected]>
mailbox: qcom-ipcc: fix duplicate channel allocation across holes

Bryam Vargas <[email protected]>
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()

Günther Noack <[email protected]>
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation

Yuyang Huang <[email protected]>
ipv6: use RCU iterator to dump route exceptions

Andrea Mayer <[email protected]>
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()

Zhiling Zou <[email protected]>
ip6_gre: fix hardware header length for NBMA tunnels

Zhiling Zou <[email protected]>
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

Zhiling Zou <[email protected]>
ip: orphan prefetched skbs before multicast forwarding

Anton Danilov <[email protected]>
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails

Max Kellermann <[email protected]>
jbd2: check need_resched() when skipping busy checkpoint buffers

Max Kellermann <[email protected]>
jbd2: bound shrinker scans by examined checkpoint buffers

Pratyush Yadav (Google) <[email protected]>
kho: fix size calculation in kho_preserved_memory_reserve()

Hui Su <[email protected]>
kasan: fix cache shrink race with CPU hotplug

Ibrahim Abdelkader <[email protected]>
Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request

Guangshuo Li <[email protected]>
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative

Guangshuo Li <[email protected]>
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative

Valentin Kindschi <[email protected]>
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection

Xin Chen <[email protected]>
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb

Valentin Kindschi <[email protected]>
Bluetooth: hci_conn: re-enable advertising only for peripheral role

Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: serialize security confirmation handling

Hang Nan <[email protected]>
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

Gongwei Li <[email protected]>
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()

Guangshuo Li <[email protected]>
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative

Lorenzo Stoakes (ARM) <[email protected]>
Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378

Terry Bowman <[email protected]>
cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register

Alison Schofield <[email protected]>
cxl/pmem: Format the nvdimm serial number as unsigned decimal

Dave Jiang <[email protected]>
cxl/mce: Make the MCE notifier per-region

Zhenhao Wan <[email protected]>
cxl/features: bound fwctl command payload to the input buffer

Hui Su <[email protected]>
cpufreq: schedutil: Fix rate limit overflow

Haoxiang Li <[email protected]>
cpufreq: apple-soc: Fix OPP table cleanup

Kuan-Wei Chiu <[email protected]>
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior

Bryam Vargas <[email protected]>
dm array: reject an array block whose value size is not the caller's

Bryam Vargas <[email protected]>
dm array: validate array block headers on read

Ilya Krutskih <[email protected]>
dm raid1: reserve space for NUL-terminator in build_constructor_string()

liyouhong <[email protected]>
dm-era: fix shadowed superblock leak on take-snap failure

Mikulas Patocka <[email protected]>
dm-io: report non-retryable errors separatedly

Keith Busch <[email protected]>
dm-io: clone the source bio instead of copying its biovec

Jérémy Jean <[email protected]>
bpf: Harden bloom filter sizing and indexing on 32-bit kernels

Jia Zhu <[email protected]>
buffer: avoid tail commit walk for uptodate folios

Daniel Borkmann <[email protected]>
bpf: Disable preemption in __bpf_get_stack

Vineet Gupta <[email protected]>
bpf, x86: Fix per-CPU address resolution into an extended register

Joe Damato <[email protected]>
bnxt_en: Write doorbell when linearizing skb fails

Jiangshan Yi <[email protected]>
bnx2x: fix double free in bnx2x_init_firmware() error path

HyeongJun An <[email protected]>
Bluetooth: eir: Fix OOB read in eir_get_service_data()

Junjie Cao <[email protected]>
Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU

Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU

胡连勤 <[email protected]>
block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()

Keith Busch <[email protected]>
block: validate user space vectors during extraction

Junjie Cao <[email protected]>
backlight: aw99706: Honor the core blank state in update_status()

Junjie Cao <[email protected]>
backlight: aw99706: Fix DT property names to match binding

Hongyan Xu <[email protected]>
auxdisplay: charlcd: cancel backlight work on registration failure

Niklas Cassel <[email protected]>
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes

Ethan Nelson-Moore <[email protected]>
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC

Matt Turner <[email protected]>
alpha: marvel: Fix lock ordering in init_io7_irqs()

Matt Turner <[email protected]>
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()

Rafael J. Wysocki <[email protected]>
ACPI: TAD: Add locking around AML evaluations

Rafael J. Wysocki <[email protected]>
ACPI: scan: Avoid registering platform devices with resource overlaps

Anirudh Prasad <[email protected]>
ACPI: pfr_update: fix stack buffer overflow in query_capability()

Christian Loehle <[email protected]>
ACPI: CPPC: Skip desired_perf read in cppc_get_perf()

Christian Loehle <[email protected]>
ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+

TanZheng <[email protected]>
ACPI: APEI: GHES: fix ARM section length accounting after header

Nirmoy Das <[email protected]>
ACPI: APEI: Fix ERST timeout unit conversion

Terry Bowman <[email protected]>
acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks

ZhaoJinming <[email protected]>
accel/rocket: Fix error path handling in rocket_job_run()

Shuvam Pandey <[email protected]>
accel/rocket: initialize job domain before cleanup paths

Muhammad Bilal <[email protected]>
accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()

Guillaume Morin <[email protected]>
hugetlb: only adjust reservation during unmapping if mapcount is 0

Ivaylo Dimitrov <[email protected]>
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device

Youngjae Kwon <[email protected]>
fsnotify: Fix stale object mask after concurrent mark updates

Tien Sung Ang <[email protected]>
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration

Marek Czernohous <[email protected]>
forcedeth: fix off-by-one when saving/restoring non-PCI config space

Randy Dunlap <[email protected]>
fonts: fixup font.h kernel-doc warnings

Myeonghun Pak <[email protected]>
fbdev: uvesafb: unregister connector callback on init failure

Hui Su <[email protected]>
fbdev: ssd1307fb: defer I2C transfers from damage callbacks

Florian Fuchs <[email protected]>
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer

Runyu Xiao <[email protected]>
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

Yemu Lu <[email protected]>
fat: restore original value when fat_ent_write failed

Chengfeng Ye <[email protected]>
fanotify: fix use-after-free of file range info

Jan Kara <[email protected]>
ext2: Fix lost inode updates for IS_SYNC inodes

Nikhil Gurudasani <[email protected]>
erofs: skip sufficiently large global buffers when resizing

Jinjie Ruan <[email protected]>
entry: Fix seccomp bypass after ptrace with TSYNC

Ard Biesheuvel <[email protected]>
efivarfs: Rate limit statfs() handler

Yichong Chen <[email protected]>
ecryptfs: show filename encryption options

Yichong Chen <[email protected]>
ecryptfs: release message context on send failure

Yichong Chen <[email protected]>
ecryptfs: reject too-small tag 70 packets

HanQuan <[email protected]>
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet

Yichong Chen <[email protected]>
ecryptfs: pass packet set buffer size to parser

Yichong Chen <[email protected]>
ecryptfs: hold msg ctx list lock when cleaning daemon queue

Yichong Chen <[email protected]>
ecryptfs: fix tag 11 packet exact-fit size check

Pengpeng Hou <[email protected]>
eCryptfs: bound the packet-length peek to the user buffer

Hongling Zeng <[email protected]>
ntfs: verify run length exceeding volume boundary

Hongling Zeng <[email protected]>
ntfs: validate non-resident attribute offsets

Hyunchul Lee <[email protected]>
ntfs: reject invalid MFT LCNs from boot sector

Hyunchul Lee <[email protected]>
ntfs: reject invalid empty mapping pairs

Bryam Vargas <[email protected]>
ntfs: bound the free-cluster bitmap scan to the volume

Konstantin Komarov <[email protected]>

    fs/ntfs3: bound page_lcns[] index by the log record

Samuel Page <[email protected]>
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

Xiang Mei <[email protected]>
fs/ntfs3: validate dirty page table on log replay

Deepanshu Kartikey <[email protected]>

    eventfs: Initialize ei->children and ei->list in init_ei()

Guangshuo Li <[email protected]>
HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown

Guangshuo Li <[email protected]>
HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown

HyeongJun An <[email protected]>
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer

HyeongJun An <[email protected]>
HID: intel-thc-hid: intel-quickspi: validate report size before copy

Jiangshan Yi <[email protected]>
HID: mcp2221: validate report size in mcp2221_raw_event()

Jiangshan Yi <[email protected]>
HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes

Jiangshan Yi <[email protected]>
HID: mcp2221: stop device IO before hid_hw_stop

Baul Lee <[email protected]>
HID: universal-pidff: stop the device when force-feedback init fails

Doruk Tan Ozturk <[email protected]>
HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind

Haoxiang Li <[email protected]>
HID: sensor: custom: Fix field sysfs group cleanup on failure

Xu Rao <[email protected]>
HID: roccat: free buffered reports when destroying device

Ibrahim Hashimov <[email protected]>
HID: picolcd: clamp eeprom debugfs read to bytes actually received

Stuart Hayhurst <[email protected]>
HID: corsair-void: Check size of status and firmware events before reading them

Andre Eikmeyer <[email protected]>
HID: apple: preserve keyboard backlight across T2 resume

Bryam Vargas <[email protected]>
smb: client: restore the data_offset bound in is_valid_oplock_break()

Bryam Vargas <[email protected]>
smb: client: reject a tree connect response whose byte count is too small

Fredric Cover <[email protected]>
smb: client: harden DFS cache against invalid target hints

Frank Sorenson <[email protected]>
smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()

Frank Sorenson <[email protected]>
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

Frank Sorenson <[email protected]>
smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV

Frank Sorenson <[email protected]>
smb: client: fix ALIGN() overflow in symlink_data() error context loop

Aldo Ariel Panzardo <[email protected]>
ksmbd: only rebind the reopened file's own oplock on durable reconnect

Fredric Cover <[email protected]>

    smb: client: clear ce->tgthint in free_tgts()

Frank Sorenson <[email protected]>
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2

Jiangshan Yi <[email protected]>
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

Frank Sorenson <[email protected]>
cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC

Frank Sorenson <[email protected]>

    cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0

Frank Sorenson <[email protected]>
cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()

Frank Sorenson <[email protected]>
cifs: call pagecache_isize_extended() in cifs_setsize() when extending

Frank Sorenson <[email protected]>
cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem

Jérémy Jean <[email protected]>
audit: avoid dropping live tree ref on fsnotify rule autoremove

Qu Wenruo <[email protected]>
btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag

Shuangpeng Bai <[email protected]>
btrfs: fix extent map leak in NOCOW direct I/O write

Guanghui Yang <[email protected]>
btrfs: drop recovered reloc root refs on recovery failure

Matthew Brown <[email protected]>
ceph: fix leaked inode reference on writeback abort at umount

Max Kellermann <[email protected]>
ceph: do not repeat ceph_trim_dentries() if no progress possible

Michael Bommarito <[email protected]>
ceph: cap delegated inode count in ceph_parse_deleg_inos()

Michael Bommarito <[email protected]>
ceph: bound xattr value length in __build_xattrs()

Michael Bommarito <[email protected]>
ceph: bound num_export_targets array for mds info v2/v3

Michael Bommarito <[email protected]>
ceph: bound MDSCapAuth path and fs_name decode in handle_session()

Michael Bommarito <[email protected]>
ceph: bound copied dentry name length in NFS export get_name

Jérémy Jean <[email protected]>
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode

Max Kellermann <[email protected]>
ceph: force a cap message when a deferred revoke can't be acked immediately

Xiubo Li <[email protected]>
ceph: fix UAF in check_new_map() on session freed during unlock

Xiubo Li <[email protected]>
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock

Jérémy Jean <[email protected]>
libceph: reject buckets with mismatched CRUSH ids

Michael Bommarito <[email protected]>
libceph: validate OSD extent maps before cursor advance

Jeff Layton <[email protected]>
nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update

Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during delegation revoke

Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during admin state revocation

Chuck Lever <[email protected]>
NFSD: Prevent post-shutdown use-after-free in unlock_filesystem

Chuck Lever <[email protected]>
NFSD: Prevent lock owner use-after-free during client teardown

Jeff Layton <[email protected]>
nfsd: revoke copy-notify stateids before dropping their reference

Jeff Layton <[email protected]>
nfsd: release OPEN-decoded posix ACLs via op_release

Jeff Layton <[email protected]>
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE

Robbie Ko <[email protected]>
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

Robbie Ko <[email protected]>
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

Jeff Layton <[email protected]>
nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

Jeff Layton <[email protected]>
nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

Jeff Layton <[email protected]>
nfsd: initialize DRC hash table before registering shrinker

Jeff Layton <[email protected]>
nfsd: initialize copy-notify stateid before publishing it

Chris Mason <[email protected]>
nfsd: hold rcu across localio cmpxchg retry

Chris Mason <[email protected]>

    nfsd: gate nfs3 setacl by argp->mask

Chuck Lever <[email protected]>

    nfsd: gate nfs2 setacl by argp->mask

Jeff Layton <[email protected]>
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

Jeff Layton <[email protected]>
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

Jeff Layton <[email protected]>
nfsd: fix version mismatch loops in nfsd_acl_init_request()

Jeff Layton <[email protected]>
nfsd: fix UAF in async copy cancel and shutdown

Jeff Layton <[email protected]>
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

Jeff Layton <[email protected]>
nfsd: fix reply size estimate for GET_DIR_DELEGATION

Jeff Layton <[email protected]>
nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure

NeilBrown <[email protected]>
nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()

Chris Mason <[email protected]>
nfsd: fix partial-write detection in nfsd_direct_write

Nikol Kuklev <[email protected]>
nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs

Jeff Layton <[email protected]>
nfsd: fix nfsd_file leak on inter-server COPY setup failure

Jeff Layton <[email protected]>
nfsd: fix netlink dumpit error handling for rpc_status_get

Jeff Layton <[email protected]>
nfsd: fix layout fence worker double-reference race

Jeff Layton <[email protected]>
nfsd: fix FL_SLEEP being set unconditionally for all LOCK types

Jeff Layton <[email protected]>
nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

Jeff Layton <[email protected]>
nfsd: fix dentry ref leak on V4ROOT export filehandle lookup

Chris Mason <[email protected]>
nfsd: fix cpntf publish race in nfs4_init_cp_state

Jeff Layton <[email protected]>
nfsd: fix clock domain mismatch in clients_still_reclaiming()

Jeff Layton <[email protected]>
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

NeilBrown <[email protected]>
nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file

Jeff Layton <[email protected]>
nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

Jeff Layton <[email protected]>
nfsd: don't free session slots that are still in use

Jeff Layton <[email protected]>
nfsd: defer vfree of compound ops to fix rpc_status UAF

Jeff Layton <[email protected]>
nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper

Jeff Layton <[email protected]>
nfsd: dedup nfs4_client_to_reclaim inserts

Chris Mason <[email protected]>
nfsd: convert nfsd_net boolean flags to unsigned long flags word

Jeff Layton <[email protected]>
nfsd: clear opcnt on compound arg release to prevent OOB read

Jeff Layton <[email protected]>
nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

Jeff Layton <[email protected]>
nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()

Jeff Layton <[email protected]>
nfsd: check client ownership when cancelling a copy-notify stateid

Chris Mason <[email protected]>
nfsd: cap decoded POSIX ACL count to bound sort cost

Jeff Layton <[email protected]>
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

Jeff Layton <[email protected]>
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry

Jeff Layton <[email protected]>
nfsd: add filehandle match check to nfsd4_delegreturn()

Jeff Layton <[email protected]>
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

Jeff Layton <[email protected]>
nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

Jeff Layton <[email protected]>
nfsd: validate symlink target length in NFSv4 CREATE

Jeff Layton <[email protected]>
nfsd: validate sockaddr length per family in listener_set

Jeff Layton <[email protected]>
nfsd: validate nseconds in TIME_DELEG decode paths

Chris Mason <[email protected]>
nfsd: size fh_verify server sockaddr slot by xpt_locallen

Zhenghang Xiao <[email protected]>
nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

Chuck Lever <[email protected]>
nfsd: sample writeback error cursor before async COPY loop

Jeff Layton <[email protected]>
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types

Jeff Layton <[email protected]>
nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths

Chuck Lever <[email protected]>
nfsd: Reset write verifier when async COPY writeback fails

Chris Mason <[email protected]>
nfsd: release path refs on follow_down() error

Jeff Layton <[email protected]>
nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

Jeff Layton <[email protected]>
lockd, nfsd: RCU-protect nlmsvc_ops dispatch

Tim Menninger <[email protected]>
pNFS: Fix EBUSY check in pnfs_layout_need_return

Junrui Luo <[email protected]>
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path

Chris Mason <[email protected]>
nfsd: guard nfsd_serv deref in nfsd_file_net_dispose

Mike Snitzer <[email protected]>
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

Michael Bommarito <[email protected]>
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

Scott Mayhew <[email protected]>
NFSD: fix up error returned by write_threads()

Chuck Lever <[email protected]>
NFSD: Fix off-by-one in DRC bucket pruning limit

Chuck Lever <[email protected]>
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies

Chuck Lever <[email protected]>
NFSD: check truncate permission under inode lock

Nate Prodromou <[email protected]>
NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails

Chris Mason <[email protected]>
NFS/localio: fix ref leak on nfs_uuid_add_file failure

Longlong Xia <[email protected]>
zsmalloc: account for handle size in class lookup

Sergey Senozhatsky <[email protected]>
zram: validate deflate params

Sergey Senozhatsky <[email protected]>
zram: set default primary compressor in zram_destroy_comps()

Longlong Xia <[email protected]>
zram: fix out-of-bounds access in writeback_store()

Longlong Xia <[email protected]>
zram: fix out-of-bounds access in read_block_state()

Ibrahim Hashimov <[email protected]>
ubifs: fix out-of-bounds read in signature length check

Jason Yang <[email protected]>
phy: rockchip-samsung-dcphy: fix out-of-range max_register

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()

Abdurrahman Hussain <[email protected]>
of: fix out-of-bounds read in of_alias_scan() stem parser

Ryusuke Konishi <[email protected]>
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

Junrui Luo <[email protected]>
media: vicodec: fix out-of-bounds write in FWHT encoder

Weigang He <[email protected]>
media: cec: stm32: prevent out-of-bounds write on RX overflow

Vincent Mailhol <[email protected]>
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

Karl Mehltretter <[email protected]>
KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID

Claudiu Beznea <[email protected]>
i3c: renesas: Fix out-of-bounds access for newdevs mask

Xingrui Li <[email protected]>
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature

Daisuke Matsuda <[email protected]>
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write

Terry Bowman <[email protected]>
cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read

Neill Kapron <[email protected]>
usb: gadget: f_fs: Prevent deadlock during ep0 read loop

Jeffin Philip <[email protected]>
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

Jeffin Philip <[email protected]>
usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()

Yun Zhou <[email protected]>
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()

Joshua Crofts <[email protected]>
usb: gadget: midi2: remove default configfs groups on teardown

Myeonghun Pak <[email protected]>
usb: gadget: snps_udc_plat: clean up PHY on probe deferral

Sonali Pradhan <[email protected]>
usb: gadget: u_audio: Fix use-after-free on sound card disconnect

Huang Wei <[email protected]>
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion

Fan Wu <[email protected]>
usb: typec: thunderbolt: Disable work before freeing tbt on remove

Xu Yang <[email protected]>
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()

Xu Rao <[email protected]>
usb: typec: hd3ss3220: fix VBUS regulator error message

Johan Hovold <[email protected]>
USB: phy: fsl-usb: fix missing static keywords

Fan Wu <[email protected]>
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

Pei Xiao <[email protected]>
usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition

Francesco Lavra <[email protected]>
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up

Hao-Qun Huang <[email protected]>
staging: greybus: hid: fix SET_REPORT return value

Karl Mehltretter <[email protected]>

    serial: imx: serialize imx_uart_ports[] lifetime

Hans Verkuil <[email protected]>
Revert "media: v4l2-dev: fix error handling in __video_register_device()"

James Kim <[email protected]>
rapidio: mport_cdev: fix use-after-free in dma_req_free()

Bartosz Golaszewski <[email protected]>
powerpc/powermac: fix OF node refcount

Bryam Vargas <[email protected]>
misc: nsm: bound the device-reported response length

Xu Yang <[email protected]>
device property: fix infinite loop in fwnode_for_each_child_node()

Chun-Yi Lee <[email protected]>
debugfs: Fix lockdown check for mmap_prepare

Prasanna Kumar T S M <[email protected]>
cdx: Fix double free when sysfs file creation fails

Hui Su <[email protected]>
tracing: Fix use-after-free with same-name named triggers

Deepanshu Kartikey <[email protected]>
tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

Ivan Immanuel Shaji <[email protected]>
tracing: Fix retry exhaustion in simple ring buffer reader swap

Vincent Donnefort <[email protected]>
tracing: Fix logged instance name on creation failure

Hui Su <[email protected]>
tracing: Fix crash passing ERR_PTR to kthread_stop()

Jérémy Jean <[email protected]>
tracing/user_events: Clear copied tracing state before fork duplication

Sanman Pradhan <[email protected]>
hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()

Roger Pau Monne <[email protected]>
x86/xen: fix init of balloon stats again

Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix zero-extension for 32-bit port I/O

Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix off-by-one in port I/O handling

Kiryl Shutsemau (Meta) <[email protected]>
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()

Yao Zi <[email protected]>
x86/locking: Use sfence for wmb() if SSE is available

Joy H.J. Lee <[email protected]>
tools/compiler: match glibc 2.42 definition of __attribute_const__

Ridong Chen <[email protected]>
mm: vmscan: fix node reclaim ignoring swappiness parameter

Johannes Weiner <[email protected]>
mm: page_alloc: fix non-movable reclaim storm in defrag_mode

Vlastimil Babka (SUSE) <[email protected]>
mm: page_alloc: move capture_control to the page allocator

Johannes Weiner <[email protected]>
mm: page_alloc: __GFP_FS lockdep annotation for direct compaction

Johannes Weiner <[email protected]>
mm: mempolicy: fix automatic numa balancing for shmem

Guopeng Zhang <[email protected]>
mm: memcontrol: update state_local when flushing NMI stats

Guopeng Zhang <[email protected]>
mm: memcg: stop reclaim when a limit update is superseded

Guopeng Zhang <[email protected]>
mm: memcg-v1: fix memsw and TCP failcnt accounting

Guopeng Zhang <[email protected]>
mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings

Johannes Weiner <[email protected]>
mm: compaction: support non-movable compaction for pageblock requests

Hao Jia <[email protected]>
mm/zswap: fix global shrinker when memory cgroup is disabled

Breno Leitao <[email protected]>
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()

Artem Lytkin <[email protected]>
mm/vmalloc: make vm_struct.nr_pages an unsigned long

Shengming Hu <[email protected]>
mm/slub: prevent pfmemalloc objects from entering the barn

Li Xiasong <[email protected]>
mm/slub: fix missing debugfs entries for caches created before sysfs init

Dev Jain <[email protected]>
mm/rmap: use huge_ptep_get() in try_to_migrate_one()

Dev Jain <[email protected]>
mm/rmap: use huge_ptep_get() in try_to_unmap_one()

Hyunwoo Kim <[email protected]>

    mm/pagewalk: fix stale walk->action escaping walk_pmd_range()

Dev Jain <[email protected]>
mm/page_vma_mapped: use huge_ptep_get() for hugetlb

Ye Liu <[email protected]>
mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()

Alexander Graf <[email protected]>
mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn

Arvind Yadav <[email protected]>
mm/migrate_device: clear stale mapping after freeing swapcache

Dev Jain <[email protected]>
mm/migrate: use huge_ptep_get() in remove_migration_pte()

Breno Leitao <[email protected]>
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

Kairui Song <[email protected]>
mm/mglru: fix and remove redundant unevictable folio handling

Usama Arif <[email protected]>
mm/mempolicy: skip non-present PMDs when queueing folios

Usama Arif <[email protected]>
mm/madvise: skip device-private PMDs in cold and pageout walks

Breno Leitao <[email protected]>
mm/kmemleak: avoid soft lockup when scanning task stacks

Muchun Song <[email protected]>
mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios()

Muchun Song <[email protected]>
mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier

Muchun Song <[email protected]>
mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages

Zi Yan <[email protected]>
mm/huge_memory: use folio's memcg inside __folio_split()

Usama Arif <[email protected]>
mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd

David Hildenbrand (Arm) <[email protected]>
mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()

Breno Leitao <[email protected]>
mm, swap: ratelimit bad swap entry reports

Youngjun Park <[email protected]>
mm, swap: don't free a hibernation slot that is in the swap cache

Jordan R Abrahams-Whitehead <[email protected]>
include/linux/list.h: mark list_add and __list_add as __always_inline

Hyunwoo Kim <[email protected]>
apparmor: fix out-of-bounds write when null terminating a label vec

Jann Horn <[email protected]>
apparmor: fix cred UAF caused by begin_current_label_crit_section()

Chengfeng Ye <[email protected]>
KEYS: trusted: Fix TPM teardown ordering

Miguel Ojeda <[email protected]>
kbuild: rust: keep Rust objects out of Clang LTO with inline helpers

Miguel Ojeda <[email protected]>
kbuild: rust: preserve unreachable traps with inline helpers

Gary Guo <[email protected]>
rust: cfi: disable function merging if CFI is enabled

Younes Akhouayri <[email protected]>
rust: num: restrict bool conversion to unsigned Bounded

Miguel Ojeda <[email protected]>
objtool/rust: add one more noreturn Rust function

Nikolai Grlica <[email protected]>
rust: kernel: list: fix incorrect pop_back example comment

Miguel Ojeda <[email protected]>
rust: kbuild: disambiguate zerocopy_derive for rusttest

Danilo Krummrich <[email protected]>
rust: devres: ensure revocation is complete before device finishes unbinding

Danilo Krummrich <[email protected]>
rust: devres: fix race between concurrent revokers

Younes Akhouayri <[email protected]>
rust: dma: return zero for Coherent reads past EOF

Miguel Ojeda <[email protected]>

    rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22

FUJITA Tomonori <[email protected]>
rust: bug: prevent dead_code warning from warn_on!'s flags constant

FUJITA Tomonori <[email protected]>
rust: bug: fix warn_on macro build error on UML

FUJITA Tomonori <[email protected]>
rust: bug: skip arch-specific asm in testlib builds

Antoni Boucher <[email protected]>
rust: kbuild: disambiguate zerocopy for rusttest

Miguel Ojeda <[email protected]>
objtool/rust: add one more noreturn Rust function for Rust 1.99.0

Jérémy Jean <[email protected]>
timers/itimer: Zero-init old itimerval before copy to userspace

Ke Sun <[email protected]>
rust: fmt: fix {:p} printing stack addresses

Gaurav Batra <[email protected]>
powerpc/pseries/iommu: switch to Default DMA window during kdump

Chen Linxuan <[email protected]>
pidfd: hold exec_update_lock around namespace ioctl

Vivek Parikh <[email protected]>
ovl: fix double end_creating() on the casefold-mismatch path

Baokun Li <[email protected]>
fs: fix user path of nested backing files

Felix Yan <[email protected]>
clocksource/drivers/timer-sun4i: Advertise a real minimum delta

WenTao Liang <[email protected]>
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path

Matt Turner <[email protected]>
alpha: don't leak hardware-fabricated FP exception bits to user space

FUJITA Tomonori <[email protected]>
rust: time: fix as_micros_ceil() rounding near i64::MAX

Christoph Hellwig <[email protected]>
iomap: don't free integrity payload that doesn't exist

Matt Turner <[email protected]>
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally

Fangzhi Zuo <[email protected]>
drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile

Jerry Zuo <[email protected]>
drm/amd/display: hide Apple Studio Display secondary tile

Vincent Donnefort <[email protected]>
ring-buffer: Fix subbuf resize race with ring buffer readers

Boris Burkov <[email protected]>
btrfs: write-protect folios during data writeback

Jon Hunter <[email protected]>
ASoC: tegra: Sort MBDRC register defaults

Jon Hunter <[email protected]>
ASoC: tegra: Sort ADMAIF register defaults

Jon Hunter <[email protected]>
ASoC: tegra: Fix the MIXER enable default value

Jon Hunter <[email protected]>
ASoC: tegra: Fix the I2S enable default value

Peter Ujfalusi <[email protected]>
ASoC: tegra210_mixer: sort the register default table

Peter Ujfalusi <[email protected]>
ASoC: tegra210_i2s: sort the Tegra264 register default table

Peter Ujfalusi <[email protected]>
ASoC: tegra210_i2s: sort the register default table

Fangzhi Zuo <[email protected]>
drm/amd/display: Skip Update HDCP Config In Transition State

-------------

Diffstat:

 Documentation/ABI/testing/sysfs-bus-nvdimm         |   3 +-
 Documentation/admin-guide/blockdev/zoned_loop.rst  |   9 +-
 Makefile                                           |  17 +-
 arch/alpha/include/uapi/asm/fpu.h                  |   8 +-
 arch/alpha/kernel/pci-sysfs.c                      |   6 +-
 arch/alpha/kernel/sys_marvel.c                     |  25 +-
 arch/alpha/kernel/traps.c                          |   6 +-
 arch/alpha/math-emu/math.c                         |  88 ++++-
 arch/arm/Kconfig                                   |   2 +-
 arch/arm64/boot/dts/qcom/kodiak.dtsi               |   9 +-
 arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts    |   2 +-
 arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi        |   2 +
 arch/arm64/boot/dts/rockchip/px30-cobra.dtsi       |   2 +-
 arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi      |   2 +-
 arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi    |   2 +-
 .../boot/dts/rockchip/rk3399-pinephone-pro.dts     |  18 -
 .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts |  12 +
 arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts    |  23 +-
 arch/arm64/kernel/compat_alignment.c               |   4 +-
 arch/arm64/kernel/proton-pack.c                    |   9 +-
 arch/arm64/kvm/vgic/vgic-v2.c                      |   3 +-
 arch/openrisc/kernel/entry.S                       |  43 ++-
 arch/powerpc/kernel/pci-common.c                   |   9 +-
 arch/powerpc/platforms/powermac/low_i2c.c          |   2 +-
 arch/powerpc/platforms/pseries/iommu.c             |  23 +-
 arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts    |   4 +-
 arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts  |   4 +-
 arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts     |   4 +-
 arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts   |   4 +-
 arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts   |   4 +-
 arch/riscv/include/asm/acpi.h                      |  19 +
 arch/riscv/kernel/unaligned_access_speed.c         |  19 +-
 arch/riscv/kvm/vcpu_pmu.c                          |  14 +-
 arch/s390/include/asm/percpu.h                     |   4 +-
 arch/s390/kernel/perf_cpum_cf.c                    | 221 ++++++++----
 arch/x86/coco/tdx/tdx.c                            |  10 +-
 arch/x86/include/asm/barrier.h                     |   2 +-
 arch/x86/include/asm/insn-eval.h                   |  36 ++
 arch/x86/kvm/emulate.c                             |  26 +-
 arch/x86/net/bpf_jit_comp.c                        |   2 +-
 block/bio.c                                        |  56 ++-
 block/blk-map.c                                    |   2 +-
 block/fops.c                                       |   2 +-
 block/genhd.c                                      |   1 +
 drivers/accel/rocket/rocket_job.c                  |  32 +-
 drivers/acpi/acpi_platform.c                       |  45 ++-
 drivers/acpi/acpi_tad.c                            |  46 ++-
 drivers/acpi/apei/erst.c                           |   2 +-
 drivers/acpi/apei/ghes.c                           |  52 ++-
 drivers/acpi/cppc_acpi.c                           |  24 +-
 drivers/acpi/pfr_update.c                          |  45 +--
 drivers/ata/libata-scsi.c                          |  28 +-
 drivers/auxdisplay/charlcd.c                       |  21 +-
 drivers/base/arch_numa.c                           |  12 +
 drivers/base/power/main.c                          |   1 +
 drivers/base/property.c                            |  19 +-
 drivers/block/zloop.c                              |   3 +-
 drivers/block/zram/backend_deflate.c               |  10 +-
 drivers/block/zram/zram_drv.c                      |  14 +-
 drivers/bluetooth/btrtl.c                          |  13 -
 drivers/bluetooth/btusb.c                          |  14 +
 drivers/bluetooth/hci_bcm.c                        |   1 +
 drivers/bluetooth/hci_bcm4377.c                    |   1 +
 drivers/bluetooth/hci_h5.c                         |   4 +-
 drivers/bluetooth/hci_intel.c                      |   1 +
 drivers/bluetooth/hci_ldisc.c                      |   2 +-
 drivers/bluetooth/hci_serdev.c                     |   2 +-
 drivers/cdx/cdx.c                                  |   7 +-
 drivers/char/hw_random/stm32-rng.c                 |  10 +-
 drivers/char/ipmi/ipmb_dev_int.c                   |   5 +-
 drivers/char/ipmi/ipmi_msghandler.c                |   4 +
 drivers/char/tpm/tpm_i2c_nuvoton.c                 |   6 +-
 drivers/clocksource/timer-nxp-pit.c                |   4 +-
 drivers/clocksource/timer-sun4i.c                  |   2 +-
 drivers/cpufreq/apple-soc-cpufreq.c                |  36 +-
 drivers/cpufreq/cppc_cpufreq.c                     |   2 +-
 drivers/crypto/atmel-ecc.c                         |  46 +--
 drivers/crypto/intel/iaa/iaa_crypto_main.c         |  27 +-
 drivers/cxl/core/features.c                        |   8 +-
 drivers/cxl/core/mbox.c                            |   8 -
 drivers/cxl/core/mce.c                             |  27 +-
 drivers/cxl/core/pmem.c                            |  10 +-
 drivers/cxl/core/ras.c                             |   1 -
 drivers/cxl/core/ras_rch.c                         |  27 +-
 drivers/cxl/core/region.c                          |  43 +--
 drivers/cxl/cxl.h                                  |  11 +-
 drivers/cxl/cxlmem.h                               |   2 -
 drivers/cxl/pci.c                                  |   1 -
 drivers/cxl/pmem.c                                 |   2 +-
 drivers/fpga/altera-cvp.c                          |  10 +-
 drivers/fpga/stratix10-soc.c                       |  21 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  79 ++++
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c |  28 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c  |  11 +
 drivers/gpu/drm/amd/display/dc/dc_types.h          |   1 +
 drivers/gpu/drm/nouveau/nouveau_gem.c              |  11 +-
 drivers/hid/hid-apple.c                            |  18 +-
 drivers/hid/hid-corsair-void.c                     |  17 +
 drivers/hid/hid-mcp2221.c                          |  17 +-
 drivers/hid/hid-picolcd_debugfs.c                  |   9 +
 drivers/hid/hid-roccat.c                           |  13 +-
 drivers/hid/hid-sensor-custom.c                    |   9 +-
 drivers/hid/hid-sensor-hub.c                       |  46 ++-
 drivers/hid/hid-sony.c                             |   4 +-
 drivers/hid/hid-universal-pidff.c                  |   4 +-
 .../intel-thc-hid/intel-quicki2c/pci-quicki2c.c    |   1 +
 .../intel-thc-hid/intel-quickspi/pci-quickspi.c    |  10 +-
 .../intel-thc-hid/intel-quickspi/quickspi-dev.h    |   1 +
 .../intel-thc-hid/intel-quickspi/quickspi-hid.c    |   2 +-
 .../intel-quickspi/quickspi-protocol.c             |  19 +-
 .../intel-quickspi/quickspi-protocol.h             |   2 +-
 drivers/hsi/controllers/omap_ssi_core.c            |   6 +
 drivers/hwmon/max6621.c                            |   8 +-
 .../hwtracing/coresight/coresight-etm3x-sysfs.c    |  15 +-
 drivers/hwtracing/ptt/hisi_ptt.c                   |  20 +-
 drivers/i2c/busses/i2c-mxs.c                       |   5 +-
 drivers/i3c/device.c                               |   2 +-
 drivers/i3c/internals.h                            |   5 +
 drivers/i3c/master.c                               |  18 +-
 drivers/i3c/master/adi-i3c-master.c                |  15 +-
 drivers/i3c/master/renesas-i3c.c                   | 142 +++++---
 drivers/i3c/master/svc-i3c-master.c                |  10 +-
 drivers/infiniband/core/ib_core_uverbs.c           |   3 +
 drivers/infiniband/core/ucma.c                     |  14 +-
 drivers/infiniband/core/uverbs_main.c              |   1 +
 drivers/infiniband/core/uverbs_std_types_mr.c      |   6 +-
 drivers/infiniband/hw/cxgb4/device.c               |   6 +
 drivers/infiniband/hw/ionic/ionic_hw_stats.c       |  95 +++--
 drivers/infiniband/hw/ionic/ionic_ibdev.h          |  11 +-
 drivers/infiniband/hw/ionic/ionic_lif_cfg.c        |   2 +-
 drivers/interconnect/core.c                        |   7 +-
 drivers/iommu/amd/ppr.c                            |   3 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c    |  24 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c        |  65 +++-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h        |   3 +
 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c     |   8 +-
 drivers/iommu/generic_pt/iommu_pt.h                |   2 +-
 drivers/iommu/intel/dmar.c                         |  15 +-
 drivers/iommu/intel/iommu.c                        |   8 +-
 drivers/iommu/intel/iommu.h                        |   2 +
 drivers/iommu/iommu-sva.c                          |   2 +-
 drivers/iommu/iommu.c                              |   2 +-
 drivers/iommu/iommufd/device.c                     |   4 +-
 drivers/iommu/iommufd/ioas.c                       |   2 +
 drivers/iommu/iommufd/selftest.c                   |  31 +-
 drivers/iommu/msm_iommu.c                          |  10 +-
 drivers/mailbox/qcom-ipcc.c                        |  17 +-
 drivers/md/dm-bufio.c                              |  10 +-
 drivers/md/dm-era-target.c                         |   5 +
 drivers/md/dm-integrity.c                          |  32 +-
 drivers/md/dm-io.c                                 |  96 +++--
 drivers/md/dm-kcopyd.c                             |  10 +-
 drivers/md/dm-log-userspace-base.c                 |   1 +
 drivers/md/dm-log.c                                |   4 +-
 drivers/md/dm-pcache/cache.c                       |  18 +
 drivers/md/dm-pcache/cache.h                       |  21 ++
 drivers/md/dm-pcache/cache_dev.c                   |  22 +-
 drivers/md/dm-pcache/cache_gc.c                    |  10 +-
 drivers/md/dm-pcache/cache_key.c                   |  32 +-
 drivers/md/dm-pcache/cache_segment.c               |  12 +-
 drivers/md/dm-pcache/cache_writeback.c             |  10 +-
 drivers/md/dm-pcache/dm_pcache.c                   |   4 +-
 drivers/md/dm-raid1.c                              |  26 +-
 drivers/md/dm-snap-persistent.c                    |   4 +-
 drivers/md/dm-stats.c                              |   6 +-
 drivers/md/dm-switch.c                             |   2 +-
 drivers/md/dm-verity-target.c                      |   2 +-
 drivers/md/dm-writecache.c                         |  14 +-
 drivers/md/md.c                                    |   7 +
 drivers/md/persistent-data/dm-array.c              |  53 ++-
 drivers/md/raid10.c                                |   2 +-
 drivers/media/cec/platform/stm32/stm32-cec.c       |   3 +-
 drivers/media/test-drivers/vicodec/vicodec-core.c  |   4 +-
 drivers/media/v4l2-core/v4l2-dev.c                 |  14 +-
 drivers/mfd/cgbc-core.c                            |   4 +-
 drivers/mfd/qnap-mcu.c                             |  13 +-
 drivers/mfd/sm501.c                                |   2 +
 drivers/misc/nsm.c                                 |   2 +-
 drivers/mmc/host/via-sdmmc.c                       |  12 +-
 drivers/net/dsa/realtek/rtl83xx.c                  |   4 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c   |   3 +
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |  17 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_gso.c      |   4 +-
 drivers/net/ethernet/ibm/emac/mal.c                |  13 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c    |   5 +
 drivers/net/ethernet/nvidia/forcedeth.c            |   4 +-
 drivers/net/ethernet/qlogic/qede/qede.h            |   8 +-
 drivers/net/ethernet/qlogic/qede/qede_fp.c         |   1 +
 drivers/net/ethernet/renesas/ravb.h                |   3 +
 drivers/net/ethernet/renesas/ravb_main.c           |   9 +-
 drivers/net/ethernet/renesas/ravb_ptp.c            |  44 ++-
 drivers/net/ipa/ipa_modem.c                        |  18 +-
 drivers/net/ntb_netdev.c                           |  38 +-
 drivers/net/phy/phylink.c                          |   2 +-
 drivers/net/slip/slip.c                            |  11 +-
 drivers/net/thunderbolt/main.c                     |  12 +
 drivers/net/tun.c                                  |  21 +-
 drivers/net/usb/qmi_wwan.c                         |   1 +
 drivers/net/wireless/ath/ath6kl/cfg80211.c         |   5 +
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |   3 +-
 drivers/net/wireless/intel/iwlwifi/dvm/main.c      |   4 +-
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c   |  12 +
 drivers/net/wireless/mediatek/mt76/mt7615/main.c   |   5 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |  11 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mac.c    |   1 +
 drivers/net/wireless/mediatek/mt76/mt7925/main.c   |  12 +-
 drivers/net/wireless/mediatek/mt76/mt7925/pci.c    |   2 +
 drivers/net/wireless/mediatek/mt76/mt7925/usb.c    |   1 +
 drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c |   6 +
 drivers/net/wireless/mediatek/mt76/mt7996/mac.c    |  26 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c    |   9 +-
 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c |   2 +-
 drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c |   2 +-
 drivers/net/wireless/realtek/rtl8xxxu/core.c       |  19 +-
 .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c    |  12 +-
 .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c   |   3 +-
 drivers/net/wireless/realtek/rtw88/pci.c           |   4 +-
 drivers/net/wireless/realtek/rtw88/tx.c            |   1 +
 drivers/net/wireless/realtek/rtw89/core.h          |   1 +
 drivers/net/wireless/realtek/rtw89/mac80211.c      |   3 +-
 drivers/net/wireless/realtek/rtw89/pci.c           |  13 +
 drivers/net/wireless/realtek/rtw89/pci.h           |   1 +
 drivers/net/wireless/realtek/rtw89/rtw8851be.c     |   1 +
 drivers/net/wireless/realtek/rtw89/rtw8852ae.c     |   1 +
 drivers/net/wireless/realtek/rtw89/rtw8852be.c     |   1 +
 drivers/net/wireless/realtek/rtw89/rtw8852bte.c    |   1 +
 drivers/net/wireless/realtek/rtw89/rtw8852ce.c     |   1 +
 drivers/net/wireless/realtek/rtw89/rtw8922ae.c     |   1 +
 drivers/net/wireless/realtek/rtw89/rtw8922de.c     |   1 +
 drivers/ntb/ntb_transport.c                        |  38 +-
 drivers/nvdimm/label.c                             |   2 +-
 drivers/nvme/host/core.c                           |   2 +-
 drivers/nvme/host/fc.c                             |   2 +-
 drivers/nvme/host/pci.c                            |   1 +
 drivers/nvme/host/tcp.c                            |  45 ++-
 drivers/of/base.c                                  |   2 +-
 drivers/pci/controller/dwc/pci-meson.c             |   2 +-
 drivers/pci/controller/pci-hyperv.c                |   1 +
 drivers/pci/controller/plda/pcie-plda-host.c       |  52 ++-
 drivers/pci/controller/plda/pcie-starfive.c        |  13 +-
 drivers/pci/msi/msi.c                              |  10 +
 drivers/pci/pci-sysfs.c                            |  42 ++-
 drivers/pci/pcie/aer.c                             |  29 +-
 drivers/pci/pcie/portdrv.c                         |   2 +-
 drivers/pci/proc.c                                 |  16 +-
 drivers/pci/quirks.c                               |   9 +-
 drivers/phy/freescale/phy-fsl-imx8mq-usb.c         |  21 +-
 drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c  |   2 +-
 drivers/platform/chrome/cros_ec_sensorhub_ring.c   |  19 +-
 drivers/platform/x86/amd/pmc/mp1_stb.c             |  66 ++--
 drivers/platform/x86/amd/pmc/pmc.c                 |   6 +-
 .../x86/dell/dell-wmi-sysman/biosattr-interface.c  |   1 -
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.c       |  18 +-
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.h       |   8 +
 .../platform/x86/hp/hp-bioscfg/enum-attributes.c   |  15 +-
 .../platform/x86/hp/hp-bioscfg/int-attributes.c    |   6 +-
 .../x86/hp/hp-bioscfg/order-list-attributes.c      |  14 +-
 .../x86/hp/hp-bioscfg/passwdobj-attributes.c       |  14 +-
 .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c |   4 +-
 .../platform/x86/hp/hp-bioscfg/string-attributes.c |   6 +-
 drivers/platform/x86/hp/hp-wmi.c                   |   4 +
 drivers/platform/x86/intel/int1092/intel_sar.c     |  32 +-
 drivers/platform/x86/intel/ishtp_eclite.c          |   5 +-
 .../x86/intel/speed_select_if/isst_tpmi_core.c     |  80 ++++-
 drivers/platform/x86/lenovo/think-lmi.c            |  19 +-
 drivers/platform/x86/lenovo/ymc.c                  |   8 +-
 drivers/platform/x86/panasonic-laptop.c            |  11 +-
 drivers/power/supply/bq24257_charger.c             |  16 +-
 drivers/power/supply/bq256xx_charger.c             |  29 +-
 drivers/power/supply/bq25890_charger.c             |  12 +
 drivers/power/supply/charger-manager.c             |  54 ++-
 drivers/power/supply/cros_usbpd-charger.c          |  17 +-
 drivers/power/supply/lp8727_charger.c              |   4 +-
 drivers/power/supply/lp8788-charger.c              |   2 +-
 drivers/power/supply/max17040_battery.c            |  32 +-
 drivers/power/supply/pf1550-charger.c              |   2 +-
 drivers/power/supply/qcom_battmgr.c                |   9 +-
 drivers/power/supply/rt9455_charger.c              |  21 +-
 drivers/power/supply/twl4030_charger.c             |  12 +-
 drivers/power/supply/ucs1002_power.c               |   6 +-
 drivers/ptp/ptp_vmclock.c                          |   6 +
 drivers/rapidio/devices/rio_mport_cdev.c           |  10 +-
 drivers/regulator/as3722-regulator.c               |   1 -
 drivers/regulator/max8998.c                        |   1 -
 drivers/regulator/qcom-refgen-regulator.c          |   4 +-
 drivers/remoteproc/mtk_scp.c                       |   9 +-
 drivers/rpmsg/qcom_glink_smem.c                    |   7 +
 drivers/s390/block/dasd.c                          |   6 +-
 drivers/s390/block/dasd_eckd.c                     |  40 ++-
 drivers/s390/block/dasd_erp.c                      |   3 +
 drivers/scsi/fnic/fip.c                            |   2 +-
 drivers/scsi/scsi_lib.c                            |   2 +
 drivers/staging/greybus/hid.c                      |   2 +-
 drivers/staging/media/ipu7/ipu7-isys.c             |   1 +
 drivers/staging/media/tegra-video/vi.c             |   9 +-
 drivers/staging/media/tegra-video/vip.c            |  10 +-
 drivers/tty/serial/imx.c                           |  20 +-
 drivers/usb/dwc2/gadget.c                          |  11 +-
 drivers/usb/dwc3/gadget.c                          |   1 +
 drivers/usb/gadget/function/f_fs.c                 |  14 +-
 drivers/usb/gadget/function/f_midi2.c              |   2 +
 drivers/usb/gadget/function/f_tcm.c                |  23 +-
 drivers/usb/gadget/function/f_uvc.c                |   7 +-
 drivers/usb/gadget/function/u_audio.c              |  24 +-
 drivers/usb/gadget/function/uvc_video.c            |   2 +-
 drivers/usb/gadget/udc/at91_udc.c                  |  20 +-
 drivers/usb/gadget/udc/snps_udc_plat.c             |   5 +-
 drivers/usb/phy/phy-fsl-usb.c                      |  52 +--
 drivers/usb/phy/phy-fsl-usb.h                      |   6 +-
 drivers/usb/typec/altmodes/thunderbolt.c           |   2 +
 drivers/usb/typec/hd3ss3220.c                      |   2 +-
 drivers/usb/typec/tcpm/tcpci.c                     |  12 +-
 drivers/usb/typec/ucsi/ucsi.c                      |   3 +-
 drivers/video/backlight/aw99706.c                  |  10 +-
 .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c     |   4 +-
 drivers/video/fbdev/pvr2fb.c                       |   4 +-
 drivers/video/fbdev/ssd1307fb.c                    |  72 +++-
 drivers/video/fbdev/uvesafb.c                      |   2 +
 drivers/video/sticore.c                            |  22 +-
 drivers/w1/slaves/w1_ds28e17.c                     |   8 +
 drivers/xen/balloon.c                              |  29 +-
 fs/backing-file.c                                  |   2 +-
 fs/btrfs/direct-io.c                               |  19 +-
 fs/btrfs/extent_io.c                               |  31 ++
 fs/btrfs/extent_io.h                               |   5 +
 fs/btrfs/inode.c                                   |  23 +-
 fs/btrfs/ioctl.c                                   |  23 +-
 fs/btrfs/relocation.c                              |  31 +-
 fs/buffer.c                                        |   3 +
 fs/ceph/addr.c                                     |  11 +
 fs/ceph/caps.c                                     |  74 +++-
 fs/ceph/dir.c                                      |  10 +-
 fs/ceph/export.c                                   |  26 +-
 fs/ceph/mds_client.c                               |  73 +++-
 fs/ceph/mds_client.h                               |   1 +
 fs/ceph/mdsmap.c                                   |  11 +-
 fs/ceph/super.h                                    |  14 +
 fs/ceph/xattr.c                                    |   1 +
 fs/debugfs/file.c                                  |   3 +-
 fs/ecryptfs/crypto.c                               |   2 +-
 fs/ecryptfs/ecryptfs_kernel.h                      |   3 +-
 fs/ecryptfs/keystore.c                             |  45 ++-
 fs/ecryptfs/messaging.c                            |  11 +-
 fs/ecryptfs/miscdev.c                              |   5 +-
 fs/ecryptfs/super.c                                |   7 +
 fs/efivarfs/super.c                                |  30 +-
 fs/erofs/zutil.c                                   |   2 +
 fs/ext2/inode.c                                    |   7 +-
 fs/ext2/xattr.c                                    |   4 +-
 fs/fat/misc.c                                      |   4 +
 fs/fuse/dev.c                                      |   8 +-
 fs/fuse/dev.h                                      |   2 +-
 fs/fuse/dev_uring.c                                |  38 +-
 fs/fuse/dev_uring_i.h                              |   5 +
 fs/fuse/inode.c                                    |   4 +-
 fs/iomap/bio.c                                     |   2 +-
 fs/iomap/direct-io.c                               |   1 +
 fs/jbd2/checkpoint.c                               |  28 +-
 fs/lockd/clntproc.c                                |   3 +
 fs/lockd/lockd.h                                   |   2 +-
 fs/lockd/svc.c                                     |   4 +-
 fs/lockd/svc4proc.c                                |   7 +-
 fs/lockd/svcproc.c                                 |   4 +-
 fs/lockd/svcsubs.c                                 | 107 ++++--
 fs/nfs/callback.c                                  |   4 +-
 fs/nfs/nfs4client.c                                |  17 +-
 fs/nfs/pnfs.c                                      |   3 +-
 fs/nfs_common/nfslocalio.c                         |  16 +-
 fs/nfsd/filecache.c                                | 143 ++++----
 fs/nfsd/flexfilelayoutxdr.c                        |  20 +-
 fs/nfsd/localio.c                                  |   8 +-
 fs/nfsd/lockd.c                                    |   6 +-
 fs/nfsd/netns.h                                    |  35 +-
 fs/nfsd/nfs2acl.c                                  |  52 +--
 fs/nfsd/nfs3acl.c                                  |  17 +-
 fs/nfsd/nfs3proc.c                                 |  40 +++
 fs/nfsd/nfs4callback.c                             | 113 +++++-
 fs/nfsd/nfs4layouts.c                              |  39 +-
 fs/nfsd/nfs4proc.c                                 | 225 ++++++++----
 fs/nfsd/nfs4recover.c                              |  48 ++-
 fs/nfsd/nfs4state.c                                | 399 ++++++++++++++++-----
 fs/nfsd/nfs4xdr.c                                  |  40 ++-
 fs/nfsd/nfscache.c                                 |   6 +-
 fs/nfsd/nfsctl.c                                   | 156 ++++++--
 fs/nfsd/nfsfh.c                                    |  12 +-
 fs/nfsd/nfsproc.c                                  |   7 +
 fs/nfsd/nfssvc.c                                   |  49 ++-
 fs/nfsd/nfsxdr.c                                   |  32 +-
 fs/nfsd/state.h                                    |   4 +-
 fs/nfsd/trace.h                                    |  18 +-
 fs/nfsd/vfs.c                                      |  39 +-
 fs/nilfs2/bmap.c                                   |   2 +-
 fs/nilfs2/bmap.h                                   |   2 +-
 fs/nilfs2/btree.c                                  |  39 +-
 fs/nilfs2/direct.c                                 |   4 +-
 fs/notify/fanotify/fanotify.c                      |   3 +-
 fs/notify/fanotify/fanotify.h                      |   6 +-
 fs/notify/fanotify/fanotify_user.c                 |  17 +-
 fs/notify/inotify/inotify_user.c                   |  15 +-
 fs/ntfs/attrib.c                                   |  24 +-
 fs/ntfs/lcnalloc.c                                 |   7 +-
 fs/ntfs/runlist.c                                  |  48 +++
 fs/ntfs/super.c                                    |  12 +-
 fs/ntfs3/frecord.c                                 |   9 +
 fs/ntfs3/fslog.c                                   |  34 ++
 fs/ocfs2/cluster/heartbeat.c                       | 150 ++++++--
 fs/ocfs2/cluster/nodemanager.c                     |   6 +
 fs/ocfs2/cluster/nodemanager.h                     |   1 +
 fs/ocfs2/dir.c                                     |  47 ++-
 fs/ocfs2/dlm/dlmmaster.c                           |   6 +
 fs/ocfs2/dlm/dlmrecovery.c                         |   9 +
 fs/ocfs2/refcounttree.c                            |  47 ++-
 fs/ocfs2/suballoc.c                                |   2 +-
 fs/ocfs2/xattr.c                                   |   5 +-
 fs/orangefs/devorangefs-req.c                      |   1 +
 fs/orangefs/orangefs-debugfs.c                     |   1 +
 fs/overlayfs/dir.c                                 |   1 -
 fs/pidfs.c                                         |  43 ++-
 fs/smb/client/cifsfs.c                             |  15 +-
 fs/smb/client/cifsfs.h                             |   1 +
 fs/smb/client/cifssmb.c                            |   6 +
 fs/smb/client/dfs_cache.c                          |  33 +-
 fs/smb/client/file.c                               |   1 +
 fs/smb/client/inode.c                              |  56 ++-
 fs/smb/client/smb1misc.c                           |   3 +-
 fs/smb/client/smb1ops.c                            |   2 +-
 fs/smb/client/smb1transport.c                      |  35 +-
 fs/smb/client/smb2file.c                           |   5 +-
 fs/smb/client/smb2inode.c                          |   6 +-
 fs/smb/client/smb2ops.c                            |   9 +-
 fs/smb/client/trace.h                              |   3 +-
 fs/smb/server/vfs_cache.c                          |   2 +-
 fs/tracefs/event_inode.c                           |   7 +-
 fs/ubifs/auth.c                                    |   2 +-
 fs/udf/inode.c                                     |   2 +-
 fs/udf/partition.c                                 |   2 +-
 include/linux/bio.h                                |   2 +-
 include/linux/compaction.h                         |   3 +-
 include/linux/dm-io.h                              |   6 +-
 include/linux/entry-common.h                       |   3 +
 include/linux/font.h                               |   4 +-
 include/linux/hugetlb.h                            |   7 +
 include/linux/list.h                               |  15 +-
 include/linux/lockd/bind.h                         |  12 +-
 include/linux/sunrpc/bc_xprt.h                     |   5 +
 include/linux/sunrpc/svc_rdma_pcl.h                |   2 +-
 include/linux/uio.h                                |  10 +-
 include/linux/usb/tcpci.h                          |   1 +
 include/linux/vmalloc.h                            |   2 +-
 include/net/ip_tunnels.h                           |  11 +-
 include/net/sctp/structs.h                         |   2 +-
 include/uapi/linux/landlock.h                      |   1 +
 io_uring/query.c                                   |   3 +
 io_uring/waitid.c                                  |  33 +-
 kernel/auditfilter.c                               |   6 +-
 kernel/bpf/bloom_filter.c                          |  19 +-
 kernel/bpf/stackmap.c                              |   3 +
 kernel/dma/contiguous.c                            |  16 +-
 kernel/liveupdate/kexec_handover.c                 |   2 +-
 kernel/module/kallsyms.c                           |  24 +-
 kernel/module/main.c                               |  14 +-
 kernel/params.c                                    |  14 +-
 kernel/pid.c                                       |  31 --
 kernel/reboot.c                                    |  29 ++
 kernel/sched/core.c                                |  49 ++-
 kernel/sched/cpufreq_schedutil.c                   |  15 +-
 kernel/sched/ext/ext.c                             | 342 +++++++++++++-----
 kernel/sched/sched.h                               |   5 +-
 kernel/signal.c                                    |   4 +
 kernel/taskstats.c                                 |   3 +-
 kernel/time/itimer.c                               |   2 +-
 kernel/time/timekeeping.c                          |   8 +-
 kernel/time/timer.c                                |   1 +
 kernel/trace/ring_buffer.c                         | 202 +++++++----
 kernel/trace/simple_ring_buffer.c                  |   4 +-
 kernel/trace/trace.c                               |   6 +-
 kernel/trace/trace_events.c                        |   2 +
 kernel/trace/trace_events_hist.c                   |   4 +-
 kernel/trace/trace_events_user.c                   |   3 +
 lib/iov_iter.c                                     |   9 +-
 lib/ucs2_string.c                                  |   2 +-
 lib/xarray.c                                       |   3 +
 mm/compaction.c                                    |  98 ++---
 mm/gup.c                                           |  10 +-
 mm/huge_memory.c                                   |  24 +-
 mm/hugetlb.c                                       |  38 +-
 mm/hugetlb_vmemmap.c                               |  23 +-
 mm/internal.h                                      |  10 +-
 mm/kasan/quarantine.c                              |   7 +-
 mm/kmemleak.c                                      |  77 ++--
 mm/madvise.c                                       |   4 +-
 mm/memcontrol-v1.c                                 |   6 +-
 mm/memcontrol.c                                    |  13 +
 mm/mempolicy.c                                     |  29 +-
 mm/migrate.c                                       |   8 +-
 mm/migrate_device.c                                |  13 +
 mm/mm_init.c                                       |  10 +-
 mm/page_alloc.c                                    |  76 +++-
 mm/page_owner.c                                    |  10 +-
 mm/page_vma_mapped.c                               |   8 +-
 mm/pagewalk.c                                      |   6 +-
 mm/rmap.c                                          |  31 +-
 mm/slub.c                                          |  80 +++--
 mm/sparse-vmemmap.c                                |   4 +-
 mm/swapfile.c                                      |  15 +-
 mm/vmalloc.c                                       |  58 ++-
 mm/vmscan.c                                        |  40 +--
 mm/zsmalloc.c                                      |  11 +-
 mm/zswap.c                                         |  13 +-
 net/bluetooth/eir.c                                |   3 +-
 net/bluetooth/hci_conn.c                           |   3 +-
 net/bluetooth/hci_core.c                           |   2 +-
 net/bluetooth/hci_event.c                          |   7 +-
 net/bluetooth/hci_sync.c                           |   2 +
 net/bluetooth/iso.c                                |   8 +
 net/bluetooth/rfcomm/core.c                        |   8 +-
 net/ceph/osd_client.c                              |  30 ++
 net/ceph/osdmap.c                                  |   2 +
 net/core/skbuff.c                                  |   5 +-
 net/core/xdp.c                                     |   4 +-
 net/ipv4/ip_tunnel.c                               |   2 +-
 net/ipv4/ipip.c                                    |   2 +-
 net/ipv4/ipmr.c                                    |   3 +
 net/ipv6/exthdrs.c                                 |  26 +-
 net/ipv6/ip6_gre.c                                 |  14 +-
 net/ipv6/ip6_input.c                               |   1 +
 net/ipv6/ip6_tunnel.c                              |  22 +-
 net/ipv6/route.c                                   |   2 +-
 net/ipv6/seg6_local.c                              |   9 +
 net/ipv6/sit.c                                     |   2 +-
 net/iucv/af_iucv.c                                 |   2 +
 net/l2tp/l2tp_netlink.c                            |  16 +-
 net/mctp/route.c                                   |  19 +-
 net/mpls/af_mpls.c                                 |   2 +
 net/mptcp/syncookies.c                             |   1 +
 net/openvswitch/conntrack.c                        | 128 ++++---
 net/openvswitch/conntrack.h                        |   6 +-
 net/openvswitch/datapath.c                         |  60 ++--
 net/openvswitch/datapath.h                         |   8 +-
 net/sched/sch_generic.c                            |   2 +-
 net/sctp/inqueue.c                                 |   7 +-
 net/sctp/sm_sideeffect.c                           |   4 +
 net/sctp/stream.c                                  |  48 ++-
 net/smc/af_smc.c                                   |   3 +-
 net/smc/smc.h                                      |   6 +-
 net/smc/smc_core.c                                 |  27 +-
 net/smc/smc_llc.c                                  | 122 +++++--
 net/smc/smc_rx.c                                   |  11 +-
 net/smc/smc_tx.h                                   |   6 +-
 net/smc/smc_wr.c                                   |   6 +-
 net/sunrpc/auth_gss/auth_gss.c                     |   6 +-
 net/sunrpc/auth_gss/gss_krb5_unseal.c              |   3 +
 net/sunrpc/auth_gss/gss_krb5_wrap.c                |  13 +-
 net/sunrpc/auth_gss/gss_rpc_upcall.c               |   6 -
 net/sunrpc/auth_gss/gss_rpc_upcall.h               |   1 -
 net/sunrpc/auth_gss/gss_rpc_xdr.c                  |  15 +-
 net/sunrpc/auth_gss/svcauth_gss.c                  |   8 +-
 net/sunrpc/backchannel_rqst.c                      |  38 +-
 net/sunrpc/cache.c                                 |   7 +-
 net/sunrpc/clnt.c                                  |  22 +-
 net/sunrpc/sunrpc_syms.c                           |   1 +
 net/sunrpc/svc.c                                   |  93 ++++-
 net/sunrpc/xdr.c                                   |   2 +-
 net/sunrpc/xprtrdma/ib_client.c                    |  24 +-
 net/sunrpc/xprtrdma/svc_rdma_pcl.c                 |   2 +-
 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c            |  21 +-
 net/sunrpc/xprtrdma/svc_rdma_rw.c                  |  52 ++-
 net/sunrpc/xprtrdma/svc_rdma_sendto.c              |  47 ++-
 net/sunrpc/xprtrdma/svc_rdma_transport.c           |  69 +++-
 net/sunrpc/xprtsock.c                              |  12 +-
 net/vmw_vsock/virtio_transport.c                   |   2 +-
 rust/Makefile                                      |   6 +-
 rust/kernel/bug.rs                                 |  34 +-
 rust/kernel/devres.rs                              |  25 +-
 rust/kernel/dma.rs                                 |   6 +-
 rust/kernel/fmt.rs                                 |   9 +-
 rust/kernel/list.rs                                |   2 +-
 rust/kernel/num/bounded.rs                         |  31 +-
 rust/kernel/time.rs                                |  17 +-
 scripts/Makefile.build                             |   3 +-
 scripts/rust_is_available.sh                       |  14 +
 scripts/rust_is_available_bindgen_libclang_22.h    |   5 +
 scripts/rust_is_available_test.py                  |  30 +-
 security/apparmor/include/cred.h                   |   6 +-
 security/apparmor/include/label.h                  |   6 +-
 security/apparmor/include/task.h                   |  15 +-
 security/apparmor/task.c                           |  27 ++
 security/keys/trusted-keys/trusted_tpm1.c          |   2 +-
 security/landlock/errata/abi-1.h                   |  23 ++
 security/landlock/fs.c                             |  41 ++-
 security/smack/smack_lsm.c                         |   2 +-
 sound/core/ump_convert.c                           |   1 +
 sound/drivers/aloop.c                              |   6 +
 sound/drivers/mpu401/mpu401.c                      |   6 +
 sound/drivers/mts64.c                              |   6 +
 sound/drivers/portman2x4.c                         |   6 +
 sound/drivers/serial-u16550.c                      |   6 +
 sound/drivers/virmidi.c                            |   6 +
 sound/hda/codecs/realtek/alc269.c                  |   7 +-
 sound/hda/codecs/realtek/alc662.c                  |   1 +
 sound/hda/core/ext/stream.c                        |   4 +-
 sound/pci/pcxhr/pcxhr.c                            |  14 +-
 sound/soc/amd/yc/acp6x-mach.c                      |   7 +
 sound/soc/codecs/aw88261.c                         |   6 +-
 sound/soc/codecs/aw88261.h                         |   6 -
 sound/soc/tegra/tegra210_admaif.c                  | 210 +++++++----
 sound/soc/tegra/tegra210_i2s.c                     |  24 +-
 sound/soc/tegra/tegra210_i2s.h                     |   1 +
 sound/soc/tegra/tegra210_mbdrc.c                   |  42 +--
 sound/soc/tegra/tegra210_mixer.c                   |  10 +-
 sound/usb/6fire/comm.c                             |   9 +-
 sound/usb/bcd2000/bcd2000.c                        |  11 +-
 sound/usb/fcp.c                                    |   4 +-
 tools/include/linux/compiler.h                     |   2 +-
 tools/objtool/check.c                              |   2 +
 tools/sched_ext/include/scx/compat.bpf.h           |  12 +-
 tools/sched_ext/include/scx/enum_defs.autogen.h    |   1 -
 tools/sched_ext/include/scx/enums.autogen.bpf.h    |   3 -
 tools/sched_ext/include/scx/enums.autogen.h        |   1 -
 tools/sched_ext/scx_qmap.bpf.c                     |   2 +-
 tools/testing/selftests/mm/run_vmtests.sh          |   2 +-
 621 files changed, 7838 insertions(+), 3129 deletions(-)

Read the cover letter in its thread