6.1.191-rc1 review

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Brauner <[email protected]>

Commit 0e5663856b69219ef2f02e04bac9f5c5be19718a upstream.

io_wq_exit_workers() cancels task work for queued worker creation with task_work_cancel_match(). That has a plain load of task->task_works.

io_queue_worker_create() adds the new entry and tests IO_WQ_BIT_EXIT to cancel it if the workqueue is already on its way out.

That must be ordered. task_work_add() has a full barrier via cmpxchg(). But io_wq_exit_start() sets the bit with set_bit() which doesn't have any memory ordering.

So afaict, on weakly ordered architectures the exiting task may load task_works before the store of the bit is visible. The other side tests the bit before the store is visible as well. So the entry remains queued with worker_refs and the exiting task waits on worker_done indefinitely.

If the task still has rings then io_uring_del_tctx_node() provides the barrier via test_and_set_bit() in io_wq_set_exit_on_idle(). When it has closed all rings though that barrier is gone.

Add the barrier after the set_bit().

---
 io_uring/io-wq.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -1251,6 +1251,8 @@ static bool io_task_work_match(struct ca
 void io_wq_exit_start(struct io_wq *wq)
 {
 	set_bit(IO_WQ_BIT_EXIT, &wq->state);
+	/* Pairs with task_work_add() in io_queue_worker_create(). */
+	smp_mb__after_atomic();
 }
 
 static void io_wq_cancel_tw_create(struct io_wq *wq)

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit 3774e4d4c8533da2caae95556c4d635c7c4f45b8 upstream.

IORING_REGISTER_SYNC_CANCEL waits without a limit if both fields of io_uring_sync_cancel_reg::timeout are -1. io_sync_cancel() compares them with -1UL. They are of type long long. With a long of 32 bits -1UL is 4294967295, which is what it stays when it is converted for the comparison, and the fields are never equal to it.

So { -1, -1 } is taken for a timeout. ktime_set() takes the nanoseconds as an unsigned long, so what becomes of it is -1s + 4294967295ns = 3.29s.

If the request is being run by io-wq and can't be interrupted, the call returns -ETIME after that time, rather than waiting for the request to be gone. On i386, with a buffered read from a null_blk device that takes 4s to complete a request, IOSQE_ASYNC, that is what each call does.

---
 io_uring/cancel.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -306,7 +306,7 @@ int io_sync_cancel(struct io_ring_ctx *c
 	if (ret != -EALREADY)
 		goto out;
 
-	if (sc.timeout.tv_sec != -1UL || sc.timeout.tv_nsec != -1UL) {
+	if (sc.timeout.tv_sec != -1 || sc.timeout.tv_nsec != -1) {
 		struct timespec64 ts = {
 			.tv_sec		= sc.timeout.tv_sec,
 			.tv_nsec	= sc.timeout.tv_nsec

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit fe6ca13c98b1223f6005f32913ebd32e4df64b77 upstream.

A cancellation with IORING_ASYNC_CANCEL_ALL or _ANY goes on until it finds nothing more. A request may stay where it was found for a while after it has been cancelled, so each one that matches is stamped with the sequence number of the cancellation, and is skipped from then on.

io_cancel_cb() does so for io-wq work as well. There is no need to:
pending work is taken off the list, and the workers are looked at once per call. And it does harm. A request that is run by io-wq may be parked while it still is the current work of the worker: poll gets armed for it, or it is put on ->futex_list or ->waitid_list.

io-wq worker io_try_cancel()
io_wq_submit_work()
io_arm_poll_handler()
io_poll_add_hash()
io_async_cancel_one()
io_cancel_cb()
stamps the request
sets IO_WQ_WORK_CANCEL = -EALREADY
io_poll_cancel()
skips the request
= -ENOENT
io_assign_current_work(NULL)

The flag comes too late for the worker to see it, and the search that would have found the request takes it for done. The cancellation returns, and the request stays.

With a multishot poll, IOSQE_ASYNC, and IORING_OP_ASYNC_CANCEL with IORING_ASYNC_CANCEL_ALL up to 63us later, that happens to 4 of 1,000 requests (4 CPUs, KVM).

Take the stamp off again if the work matches. If the request is found on one of the lists it gets a new one, and io_cancel_cb() doesn't match it a second time.

__io_async_cancel() tries the io-wq of the caller twice. So far the stamp has kept it from counting work that is running there the second time. Skip it instead, so that the number that is returned stays the same.

[ 6.1: no ->cancel_seq_set, a request is skipped when ->work.cancel_seq
equals the sequence of the cancellation, so set it back to the one before ]

---
 io_uring/cancel.c |   18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

@@ -69,7 +69,16 @@ static bool io_cancel_cb(struct io_wq_wo
 	struct io_kiocb *req = container_of(work, struct io_kiocb, work);
 	struct io_cancel_data *cd = data;
 
-	return io_cancel_req_match(req, cd);
+	if (!io_cancel_req_match(req, cd))
+		return false;
+	/*
+	 * Pending work is gone once it has matched. Work that is running may
+	 * park the request where the same cancellation looks next. Don't make
+	 * it skip the request as one that it has dealt with.
+	 */
+	if (cd->flags & (IORING_ASYNC_CANCEL_ALL | IORING_ASYNC_CANCEL_ANY))
+		req->work.cancel_seq = cd->seq - 1;
+	return true;
 }
 
 static int io_async_cancel_one(struct io_uring_task *tctx,

@@ -178,9 +187,10 @@ static int __io_async_cancel(struct io_c
 	io_ring_submit_lock(ctx, issue_flags);
 	ret = -ENOENT;
 	list_for_each_entry(node, &ctx->tctx_list, ctx_node) {
-		struct io_uring_task *tctx = node->task->io_uring;
-
-		ret = io_async_cancel_one(tctx, cd);
+		/* has been done above, don't count what is running there */
+		if (all && node->task->io_uring == tctx)
+			continue;
+		ret = io_async_cancel_one(node->task->io_uring, cd);
 		if (ret != -ENOENT) {
 			if (!all)
 				break;

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit 356f92f2412686f822383b784fa102924407457a upstream.

io_wake_function() returns -1 if the waiter it is called for doesn't have enough events yet, which makes __wake_up_common() stop walking the wait queue. That assumes that the waiters behind it can't be satisfied either. Each waiter has its own target though, computed from the min_complete it passed in:

thread A: io_uring_enter(GETEVENTS, min_complete = 10) // queued first thread B: io_uring_enter(GETEVENTS, min_complete = 1)
one CQE is posted: A isn't woken, and B isn't even considered

B keeps sleeping with the event it asked for sitting in the CQ ring, until A's demand is met or a timeout or signal ends the wait.

Return 0 to carry on with the next waiter. Only waiters whose condition is met are woken, like before.

---
 io_uring/io_uring.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -2368,7 +2368,8 @@ static int io_wake_function(struct wait_
 	 */
 	if (io_should_wake(iowq) || io_has_work(ctx))
 		return autoremove_wake_function(curr, mode, wake_flags, key);
-	return -1;
+	/* keep going, a waiter further down may be content with less */
+	return 0;
 }
 
 int io_run_task_work_sig(struct io_ring_ctx *ctx)

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit f2dbe87968a3aef74a11c025776d293b80964d3f upstream.

A file that uses two wait queues for poll, e.g. a tty, gets a second io_poll entry, which IORING_OP_POLL_ADD keeps in ->async_data until the request is freed. io_poll_add() can run more than once for a request
though: IORING_OP_POLL_REMOVE with one of the update flags disarms and rearms it, and io_poll_task_func() reissues it if a wake up turns out to be spurious. The second poll_wait() of the new round then finds *poll_ptr set, with ->head cleared by the disarm, and __io_queue_proc() fails what it takes for a third wait queue with -EINVAL.

For an update that means that the poll request is completed with -ECANCELED, while the update itself reports success. For a spurious wake up, e.g. tcsetattr() on the polled tty, the poll request fails with -EINVAL.

Free the old entry and clear the poll flags before arming, which is what io_arm_apoll() does for internal polling. All entries have been removed from their wait queues at that point.

---
 io_uring/poll.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

@@ -999,6 +999,18 @@ int io_poll_add(struct io_kiocb *req, un
 	if (req->ctx->flags & (IORING_SETUP_SQPOLL|IORING_SETUP_SINGLE_ISSUER))
 		req->flags |= REQ_F_HASH_LOCKED;
 
+	/*
+	 * A poll update or a spurious wake up arms the request again. Forget
+	 * the entries of the previous round like io_arm_apoll() does, a stale
+	 * second entry would be taken for a third wait queue.
+	 */
+	if (req_has_async_data(req)) {
+		kfree(req->async_data);
+		req->async_data = NULL;
+		req->flags &= ~REQ_F_ASYNC_DATA;
+	}
+	req->flags &= ~(REQ_F_SINGLE_POLL | REQ_F_DOUBLE_POLL);
+
 	ret = __io_arm_poll_handler(req, poll, &ipt, poll->events, issue_flags);
 	if (ret > 0) {
 		io_req_set_res(req, ipt.result_mask, 0);

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit 63c103279a95e82280092f2f4232e91e8117a252 upstream.

When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. io_wq_exit_workers() signals every worker, to get it out of an interruptible sleep, and waits for all of them to exit. Before they do, they go through the work that is left. Unbounded work is cancelled. Bounded work is run, as it is expected to end by itself.

Not all of it does. An open has no file yet, so it counts as bounded, and the open of a FIFO waits for the other end. That is what the signal is for. But the workers are signalled once, and a worker that hasn't started the work by then loses the signal:

io_wq_exit_workers() io_worker_handle_work()

    io_wq_worker_wake()
      set TIF_NOTIFY_SIGNAL
                                       io_assign_current_work()
                                         io_run_task_work()
                                           clear TIF_NOTIFY_SIGNAL
                                       io_wq_submit_work()
                                         fifo_open()
                                           wait_for_partner()
    wait_for_completion_timeout()

The thread never gets out of do_exit():

IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC exit of the thread that has submitted it

hangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is killed.

Set TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT set. The bit is set before the workers are signalled, and it is tested after the flag has been cleared, with clear_notify_signal() providing the barrier. So either the flag stays, or the bit is seen.

Work that is started while the io-wq exits is treated like work that is being run at that time: it isn't interrupted unless it waits interruptibly.

---
 io_uring/io-wq.c |    7 +++++++
 1 file changed, 7 insertions(+)

@@ -598,8 +598,15 @@ static void io_worker_handle_work(struct
 
 			next_hashed = wq_next_work(work);
 
+			/*
+			 * io_wq_exit_workers() signals us once, so that we
+			 * don't sleep for ever. If that was before this work
+			 * became the current one, the signal is gone.
+			 */
 			if (unlikely(do_kill) && (work->flags & IO_WQ_WORK_UNBOUND))
 				work->flags |= IO_WQ_WORK_CANCEL;
+			else if (unlikely(do_kill))
+				set_notify_signal(current);
 			wq->do_work(work);
 			io_assign_current_work(worker, NULL);
 

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit 436d48a2ed13112d2d27085325838e5bce6b4507 upstream.

A task that exits cancels its tracked requests and waits until they are gone. io_uring_cancel_generic() looks everywhere a request can be, and goes to sleep if it found nothing to cancel. It is woken up each time one of the requests of the task is completed by task work or freed.

When io-wq is done with a request that has a link, there is a time in which the next request of the link can't be found:

io_worker_handle_work()
io_assign_current_work(worker, NULL)
io_wq_free_work(work)
io_req_find_next() // takes the link off the request
io_free_req() // task work for the task
io_assign_current_work(worker, linked)
io_run_task_work()
cond_resched()
worker->cur_work = linked

It is not pending, it is not the current work of a worker, and it is not yet on the list that it is about to be parked on. If the pass that the exiting task makes because of io_free_req() falls into that time, it finds nothing and the task goes to sleep. The worker then runs the link, which IO_WQ_BIT_EXIT doesn't prevent for bounded work. If that parks the request nothing is completed or freed, and nobody wakes up the task. If it is the process that exits it can't be killed any more either.

NOP, IOSQE_ASYNC | IOSQE_IO_LINK
FUTEX_WAIT, FUTEX2_PRIVATE
exit of the thread, or of the process, up to 63us later

With four of these per round 5 to 8 of 10,000 rounds hang (4 CPUs, KVM):

io_uring_cancel_generic
do_exit

Commit f8b632e89a10 ("io_uring: tighten task exit cancellations") is about the same gap, and makes the task look again for whatever happens before io_free_req().

Free the request once the link is the current work of the worker, or pending. Whoever is woken up by that can find the link, until it is parked where cancellations look as well. To do so split io_wq_free_work() in two.

[ 6.1: io-wq calls back through struct io_wq_data, so the split is a new
->put_work callback next to ->free_work, and io_put_req_find_next() is folded into io_wq_put_work(). io_wq_put_work() keeps the link check of 6.1, without the REQ_F_CQE_SKIP condition that commit 5530a5102e3c adds in 7.3 ]

---
 io_uring/io-wq.c    |   22 ++++++++++++++++++----
 io_uring/io-wq.h    |    4 +++-
 io_uring/io_uring.c |   42 ++++++++++++++++++++++--------------------
 io_uring/io_uring.h |    3 ++-
 io_uring/tctx.c     |    1 +
 5 files changed, 46 insertions(+), 26 deletions(-)

@@ -118,6 +118,7 @@ struct io_wqe {
 struct io_wq {
 	unsigned long state;
 
+	put_work_fn *put_work;
 	free_work_fn *free_work;
 	io_wq_work_fn *do_work;
 

@@ -593,8 +594,9 @@ static void io_worker_handle_work(struct
 		/* handle a whole dependent link */
 		do {
 			bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state);
-			struct io_wq_work *next_hashed, *linked;
+			struct io_wq_work *next_hashed, *linked, *done = work;
 			unsigned int hash = io_get_work_hash(work);
+			bool last;
 
 			next_hashed = wq_next_work(work);
 

@@ -610,7 +612,7 @@ static void io_worker_handle_work(struct
 			wq->do_work(work);
 			io_assign_current_work(worker, NULL);
 
-			linked = wq->free_work(work);
+			last = wq->put_work(work, &linked);
 			work = next_hashed;
 			if (!work && linked && !io_wq_is_hashed(linked)) {
 				work = linked;

@@ -619,6 +621,13 @@ static void io_worker_handle_work(struct
 			io_assign_current_work(worker, work);
 			if (linked)
 				io_wqe_enqueue(wqe, linked);
+			/*
+			 * Not before the link is current or pending work again.
+			 * This may be the last time that a task is woken up
+			 * which exits and looks for requests to cancel.
+			 */
+			if (last)
+				wq->free_work(done);
 
 			if (hash != -1U && !next_hashed) {
 				/* serialize hash clear with wake_up() */

@@ -899,9 +908,13 @@ static void io_run_cancel(struct io_wq_w
 	struct io_wq *wq = wqe->wq;
 
 	do {
+		struct io_wq_work *linked;
+
 		work->flags |= IO_WQ_WORK_CANCEL;
 		wq->do_work(work);
-		work = wq->free_work(work);
+		if (wq->put_work(work, &linked))
+			wq->free_work(work);
+		work = linked;
 	} while (work);
 }
 

@@ -1170,7 +1183,7 @@ struct io_wq *io_wq_create(unsigned boun
 	struct io_wq *wq;
 	cpumask_var_t allowed_mask;
 
-	if (WARN_ON_ONCE(!data->free_work || !data->do_work))
+	if (WARN_ON_ONCE(!data->put_work || !data->free_work || !data->do_work))
 		return ERR_PTR(-EINVAL);
 	if (WARN_ON_ONCE(!bounded))
 		return ERR_PTR(-EINVAL);

@@ -1184,6 +1197,7 @@ struct io_wq *io_wq_create(unsigned boun
 
 	refcount_inc(&data->hash->refs);
 	wq->hash = data->hash;
+	wq->put_work = data->put_work;
 	wq->free_work = data->free_work;
 	wq->do_work = data->do_work;
 

@@ -21,7 +21,8 @@ enum io_wq_cancel {
 	IO_WQ_CANCEL_NOTFOUND,	/* work not found */
 };
 
-typedef struct io_wq_work *(free_work_fn)(struct io_wq_work *);
+typedef bool (put_work_fn)(struct io_wq_work *, struct io_wq_work **);
+typedef void (free_work_fn)(struct io_wq_work *);
 typedef void (io_wq_work_fn)(struct io_wq_work *);
 
 struct io_wq_hash {

@@ -40,6 +41,7 @@ struct io_wq_data {
 	struct io_wq_hash *hash;
 	struct task_struct *task;
 	io_wq_work_fn *do_work;
+	put_work_fn *put_work;
 	free_work_fn *free_work;
 };
 

@@ -70,7 +70,8 @@ int io_do_iopoll(struct io_ring_ctx *ctx
 void io_free_batch_list(struct io_ring_ctx *ctx, struct io_wq_work_node *node);
 int io_req_prep_async(struct io_kiocb *req);
 
-struct io_wq_work *io_wq_free_work(struct io_wq_work *work);
+bool io_wq_put_work(struct io_wq_work *work, struct io_wq_work **linked);
+void io_wq_free_work(struct io_wq_work *work);
 void io_wq_submit_work(struct io_wq_work *work);
 
 void io_free_req(struct io_kiocb *req);

@@ -35,6 +35,7 @@ static struct io_wq *io_init_wq_offload(
 
 	data.hash = hash;
 	data.task = task;
+	data.put_work = io_wq_put_work;
 	data.free_work = io_wq_free_work;
 	data.do_work = io_wq_submit_work;
 

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit 22e643e61b9b6299b42ff7d88bab48bccada8a5d upstream.

io_ring_exit_work() asks each task which has used the ring to remove its tctx node, by task_work, and repeats that until the list is empty. io_tctx_exit_cb() doesn't touch the node while the task is in io_uring_cancel_generic(), which removes all the nodes at its end. So the work item queues the callback again as soon as it has completed, for nothing.

That is more than a waste of time. task_work_run() only returns when it finds the list empty. If the rings are released from inside the cancellation, because requests of other rings held the last references to their files, up to 64 work items keep sending callbacks to the one task which is running them. It never finds the list empty, never gets back to the cancellation, the nodes stay, and so it goes on: a task with 60 pairs of rings which poll each other ran 280000 callbacks in 5 seconds, 20 seconds after exit_group(). It ends when all the senders happen to be late at the same time. Until then the task keeps a CPU and the work items busy.

An exiting task can't be killed meanwhile. execve() cancels the requests in the same way, so a live task can get stuck there as well, for minutes. If it takes more than five, the work items run into the WARN_ON_ONCE(time_after(jiffies, timeout)) of io_ring_exit_work(). No privilege is needed for any of this.

If the callback has met a task in cancellation, wait a little before it is sent again. Nobody has to wake the work item up for that: either the node is gone by then, or it is the turn of the next round.

---
 io_uring/io_uring.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

@@ -2829,6 +2829,7 @@ struct io_tctx_exit {
 	struct callback_head		task_work;
 	struct completion		completion;
 	struct io_ring_ctx		*ctx;
+	bool				in_cancel;
 };
 
 static __cold void io_tctx_exit_cb(struct callback_head *cb)

@@ -2843,7 +2844,8 @@ static __cold void io_tctx_exit_cb(struc
 	 * tctx can be NULL if the queueing of this task_work raced with
 	 * work cancelation off the exec path.
 	 */
-	if (tctx && !atomic_read(&tctx->in_idle))
+	work->in_cancel = tctx && atomic_read(&tctx->in_idle);
+	if (tctx && !work->in_cancel)
 		io_uring_del_tctx_node((unsigned long)work->ctx);
 	complete(&work->completion);
 }

@@ -2931,6 +2933,14 @@ static __cold void io_ring_exit_work(str
 		 * wait is marked as interruptible.
 		 */
 		wait_for_completion_interruptible(&exit.completion);
+		/*
+		 * The task removes the node when it is done with its
+		 * cancellation. Give it the time for that: it doesn't get back
+		 * to it as long as it finds new task_work each time it has run
+		 * the old one, and we may be one of many who send it.
+		 */
+		if (exit.in_cancel)
+			schedule_timeout_idle(HZ / 20);
 		mutex_lock(&ctx->uring_lock);
 	}
 	mutex_unlock(&ctx->uring_lock);

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit ad41f325be1271b22d99353819c90f0d5e45acc8 upstream.

A worker exits if its idle timeout fired and it isn't the last one, if its affinity was changed, or if the wq is marked exit-on-idle. It decides so after it found the work list empty, and until io_worker_exit() is through it stays on the free list and in ->nr_running:

worker io_wq_enqueue()
io_acct_run_queue() == false

                                      queues work
                                      io_acct_activate_free_worker()
                                        wake_up_process(worker)
                                      // found one, nothing to create

acct->nr_workers--
break
io_worker_exit()

Nobody is going to look at the work. If other workers exist, it has to wait until one of them finishes what it is blocked on or hits its idle timeout. If not, which is possible for the affinity and the exit-on-idle case, it sits there until something else is queued. For exit-on-idle it takes a task that closes its last ring and sets up a new one while the workers are on their way out.

Make the worker take itself off the free list when it gives up its ->nr_workers slot, then leave ->nr_running, and only then take the final look at the work list. That look and queueing work are both done under acct->lock, so either the worker sees the work and stays, or the enqueue side sees that the worker is gone and wakes or creates another one. If it wants to stay and finds that its slot has been taken, a worker has been created in its place, which is going to look at the work list, and it can leave after all.

[ 6.1: no exit-on-idle state, per-node io_wqe with ->lock for the
workers and non-atomic worker flags; io_acct_run_queue() drops acct->lock itself here ]

---
 io_uring/io-wq.c |   39 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

@@ -642,6 +642,36 @@ static void io_worker_handle_work(struct
 	} while (1);
 }
 
+/*
+ * The worker has decided to exit, and has given up its ->nr_workers slot and
+ * its place on the free list. io_wqe_enqueue() may have picked it from that
+ * list, or seen it running, after it last looked at the work list. Leave
+ * ->nr_running as well and check again. Returns false if the worker has to
+ * stay.
+ */
+static bool io_worker_retire(struct io_wqe *wqe, struct io_worker *worker)
+{
+	struct io_wqe_acct *acct = io_wqe_get_acct(worker);
+
+	/* turns io_wqe_dec_running() and the scheduler hooks into no-ops */
+	worker->flags &= ~IO_WORKER_F_UP;
+	atomic_dec(&acct->nr_running);
+	if (!io_acct_run_queue(acct))
+		return true;
+
+	raw_spin_lock(&wqe->lock);
+	if (acct->nr_workers >= acct->max_workers) {
+		/* a worker was created in our place, the work is its business */
+		raw_spin_unlock(&wqe->lock);
+		return true;
+	}
+	acct->nr_workers++;
+	raw_spin_unlock(&wqe->lock);
+	atomic_inc(&acct->nr_running);
+	worker->flags |= IO_WORKER_F_UP;
+	return false;
+}
+
 static int io_wqe_worker(void *data)
 {
 	struct io_worker *worker = data;

@@ -670,9 +700,16 @@ static int io_wqe_worker(void *data)
 		 */
 		if (last_timeout && (exit_mask || acct->nr_workers > 1)) {
 			acct->nr_workers--;
+			if (worker->flags & IO_WORKER_F_FREE) {
+				worker->flags &= ~IO_WORKER_F_FREE;
+				hlist_nulls_del_init_rcu(&worker->nulls_node);
+			}
 			raw_spin_unlock(&wqe->lock);
 			__set_current_state(TASK_RUNNING);
-			break;
+			if (io_worker_retire(wqe, worker))
+				break;
+			last_timeout = false;
+			continue;
 		}
 		last_timeout = false;
 		__io_worker_idle(wqe, worker);

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit e231d2e8f80d3649ecd3851b7f2abdfbe606c04b upstream.

A worker that is the last one to go to sleep while work is pending asks for another worker. io_wq_dec_running() bumps ->nr_running on behalf of the new worker and queues create_worker_cb() as task_work for the owner of the io-wq. Until that has run, everybody else takes it that a worker is running which is going to look after the work list: io_wq_enqueue() doesn't create one, and other workers that go to sleep don't find themselves to be the last.

If the worker that made the request exits, io_worker_exit() cancels the task_work, and io_worker_cancel_cb() drops ->nr_running without a look at the work list:

worker A worker B io_wq_enqueue()
blocks, work is pending
nr_running++
queues create_worker_cb()
wakes, handles the work
idle timeout, decides to exit
picks up work 1
queues work 2 B is on the free list
still: wakes B
work 1 blocks
nr_running 2 -> 1
io_worker_exit()
io_worker_cancel_cb()

    nr_running 1 -> 0

Work 2 has to wait for work 1, although there is room for more workers. It takes an owner that doesn't get around to run its task_work for the time of the idle timeout, less if the worker exits because its affinity was changed or the io-wq is marked exit-on-idle.

Let the worker stay around until its request has been dealt with. Only the worker itself sets ->create_state, so it can't be set behind its back once it has decided to leave.

---
 io_uring/io-wq.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

@@ -697,8 +697,12 @@ static int io_wqe_worker(void *data)
 		/*
 		 * Last sleep timed out. Exit if we're not the last worker,
 		 * or if someone modified our affinity.
+		 * Not as long as a request of ours for another worker is
+		 * pending, though. It is accounted as a running worker, which
+		 * others rely on, and io_worker_exit() would cancel it.
 		 */
-		if (last_timeout && (exit_mask || acct->nr_workers > 1)) {
+		if (last_timeout && (exit_mask || acct->nr_workers > 1) &&
+		    !test_bit(0, &worker->create_state)) {
 			acct->nr_workers--;
 			if (worker->flags & IO_WORKER_F_FREE) {
 				worker->flags &= ~IO_WORKER_F_FREE;

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit e9efeb4fc97b0879512a3c3b995ed448f2487e12 upstream.

io_get_next_work() takes all the work items that share a hash off the work list in one go, and the worker runs them one after the other. Only the one it is working on is visible as ->cur_work. The others are neither on the list nor current, so io_wq_cancel_cb() can't find them.

IORING_OP_ASYNC_CANCEL and IORING_REGISTER_SYNC_CANCEL return -ENOENT for a request that has not even been started, e.g. a buffered write queued behind another write to the same file that is blocked, and the request is carried out. The cancellation done for a task or ring that goes away gets there in the end, as it keeps trying, but it has to wait for each item to become current.

Keep a pointer to the remainder of the chain next to ->cur_work, and have io_wq_worker_cancel() look at it. The items on it belong to the worker, which needs ->lock to move on to the next one. Matching work is flagged with IO_WQ_WORK_CANCEL and fails with -ECANCELED when its turn comes. The worker isn't signalled for it, that would interrupt the unrelated work it is busy with. As the request isn't gone yet, it is reported like running work, with -EALREADY.

[ 6.1: ->next_work is the item being picked up here, which
io_wq_worker_cancel() checks next to ->cur_work, so the chain remainder is a new ->chain_work, set when the item is picked up as well. work->flags is not atomic here ]

---
 io_uring/io-wq.c |   20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

@@ -53,6 +53,8 @@ struct io_worker {
 
 	struct io_wq_work *cur_work;
 	struct io_wq_work *next_work;
+	/* rest of the hashed chain ->next_work or ->cur_work came with */
+	struct io_wq_work *chain_work;
 	raw_spinlock_t lock;
 
 	struct completion ref_done;

@@ -548,6 +550,9 @@ static void io_assign_current_work(struc
 	raw_spin_lock(&worker->lock);
 	worker->cur_work = work;
 	worker->next_work = NULL;
+	/* stays valid while in between two items of a chain */
+	if (work)
+		worker->chain_work = wq_next_work(work);
 	raw_spin_unlock(&worker->lock);
 }
 

@@ -584,6 +589,7 @@ static void io_worker_handle_work(struct
 			 */
 			raw_spin_lock(&worker->lock);
 			worker->next_work = work;
+			worker->chain_work = wq_next_work(work);
 			raw_spin_unlock(&worker->lock);
 		} else {
 			break;

@@ -1073,6 +1079,7 @@ static bool __io_wq_worker_cancel(struct
 static bool io_wq_worker_cancel(struct io_worker *worker, void *data)
 {
 	struct io_cb_cancel_data *match = data;
+	struct io_wq_work *work;
 
 	/*
 	 * Hold the lock to avoid ->cur_work going out of scope, caller

@@ -1082,6 +1089,19 @@ static bool io_wq_worker_cancel(struct i
 	if (__io_wq_worker_cancel(worker, match, worker->cur_work) ||
 	    __io_wq_worker_cancel(worker, match, worker->next_work))
 		match->nr_running++;
+	/*
+	 * Hashed work is taken off the work list a chain at a time, what the
+	 * worker hasn't started yet can only be found here. It doesn't move on
+	 * without the lock. Just mark the work, it fails once it is its turn.
+	 */
+	for (work = worker->chain_work; work; work = wq_next_work(work)) {
+		if (match->nr_running && !match->cancel_all)
+			break;
+		if (match->fn(work, match->data)) {
+			work->flags |= IO_WQ_WORK_CANCEL;
+			match->nr_running++;
+		}
+	}
 	raw_spin_unlock(&worker->lock);
 
 	return match->nr_running && !match->cancel_all;

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit 6d2d4c2530e95ff6ddeb98195d49d99dbca14369 upstream.

A request on a pollable file that was forced to io-wq is issued without blocking there. If that ends in -EAGAIN, io_wq_submit_work() arms poll for it and returns. It looks at IO_WQ_WORK_CANCEL once, before it issues the request.

Somebody who wants to cancel the request in between finds it running:

io-wq worker io_try_cancel()
io_wq_submit_work()
IO_WQ_WORK_CANCEL isn't set
io_issue_sqe() = -EAGAIN
io_async_cancel_one()
sets IO_WQ_WORK_CANCEL signals the worker = -EALREADY
io_poll_cancel() = -ENOENT
...
= -ENOENT
io_arm_poll_handler() = IO_APOLL_OK
return

Nobody looks at the flag again, and the signal doesn't matter to a worker that doesn't sleep. The request is armed as if nothing had happened:

- a linked timeout completes with -ENOENT, and the request it was meant to limit waits for as long as it takes.
- IORING_OP_ASYNC_CANCEL returns -EALREADY, and the request stays.
- IORING_REGISTER_SYNC_CANCEL waits for the request to complete if it gets -EALREADY. Since commit 5623eb1ed035 ("io_uring/tctx: add separate lock for list of tctx's in ctx") it doesn't sleep but spins, so its next attempt finds the armed poll.

The same goes for a multishot poll, recv or accept that is armed from io-wq.

With a read of an empty pipe, IOSQE_ASYNC, and a linked timeout of 5ms or a cancel in the same submission, in a guest that is slow enough (TCG, KASAN), the request is lost in 21 of 24 rounds of 40 or 100 attempts.

While it arms poll from io-wq, __io_arm_poll_handler() owns the request. Look at the flag once the request is in the hash table. The table is searched and the request is added with ->uring_lock held, and the flag is set before the search. So either the search finds the request, or it came first and the flag is seen. With the request marked as cancelled, the task work that is queued, right away or because ownership can't be released, fails it with -ECANCELED.

What the canceller is told doesn't change. In this window a linked timeout still completes with -ENOENT rather than -ETIME, a cancel request with -EALREADY, and one with IORING_ASYNC_CANCEL_ALL or _ANY with a count that doesn't include the request. But the request is cancelled, so what is new is a request that completes with -ECANCELED after such a result.

This doesn't help in two cases:

- IORING_ASYNC_CANCEL_ALL and _ANY, if the work is flagged after the test added here, while io-wq still has it as the current work of the worker. io_cancel_cb() stamps it with the sequence of the cancel, so the search of the hash table on behalf of the same cancel takes it for done and skips it.
- requests that are parked elsewhere by io-wq, like IORING_OP_FUTEX_WAIT and IORING_OP_WAITID. They have the same problem.

[ 6.1: work->flags is not atomic here, the hash table has its own locks
]

---
 io_uring/poll.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

@@ -652,6 +652,17 @@ static int __io_arm_poll_handler(struct
 
 	io_poll_add_hash(req);
 
+	/*
+	 * Whoever tried to cancel the request while io-wq was running it has
+	 * flagged the work item. If it searched the hash table before the
+	 * request got there it found nothing, and it won't come back. Both
+	 * the search and the insertion are done with the hash bucket lock
+	 * held, and the flag is set before the search. If the search came
+	 * first, the flag is visible by now.
+	 */
+	if (ipt->owning && (req->work.flags & IO_WQ_WORK_CANCEL))
+		io_poll_mark_cancelled(req);
+
 	if (mask && (poll->events & EPOLLET) &&
 	    io_poll_can_finish_inline(req, ipt)) {
 		__io_poll_execute(req, mask);

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

Commit 8aa0e5db4845fb5ac11abe40d7b1cac0656c3ee3 upstream.

If the request to be cancelled is being run by io-wq, io_async_cancel_one() flags the work, signals the worker and returns -EALREADY. Since commit ccbf726171b7 ("io_uring: perform poll removal even if async work removal is successful") io_try_cancel() goes on regardless, as poll may be armed for the request. If it isn't, and nothing else turns up, the result is the -ENOENT of the last search.

__io_async_cancel() makes up for that. On -ENOENT it tries the io-wq of every task that uses the ring, and that of the caller is one of them. So the work is found a second time, and the result is -EALREADY after all.

Unless the worker is done with it by then. If the work is flagged before io_wq_submit_work() looks at IO_WQ_WORK_CANCEL, all the worker does is to queue the request to be failed by task work. Then it isn't anywhere to be found until the task work has run, and

- IORING_REGISTER_SYNC_CANCEL returns -ENOENT,
- IORING_OP_ASYNC_CANCEL completes with -ENOENT,

for a request that they have just cancelled, and that completes with -ECANCELED.

With a read of an empty pipe, IOSQE_ASYNC, and a sync cancel right behind it, 1 to 3 of 1,000,000 calls return -ENOENT, and 50 to 110 with IORING_SETUP_DEFER_TASKRUN (4 CPUs, KVM). Nothing is written to the pipe, and all of these reads end with -ECANCELED.

Remember that the work was found. IORING_OP_ASYNC_CANCEL completes with -EALREADY, as it does if the worker is a bit slower. For IORING_REGISTER_SYNC_CANCEL it means to try again, which ends with 0.

The result of a linked timeout, which calls io_try_cancel() by itself, and the number that is returned for IORING_ASYNC_CANCEL_ALL and _ANY don't change.

---
 io_uring/cancel.c |   13 ++++++++++++-
 io_uring/cancel.h |    2 ++
 2 files changed, 14 insertions(+), 1 deletion(-)

@@ -114,6 +114,8 @@ int io_try_cancel(struct io_uring_task *
 	 */
 	if (!ret)
 		return 0;
+	if (ret == -EALREADY)
+		cd->running = true;
 
 	ret = io_poll_cancel(ctx, cd, issue_flags);
 	if (ret != -ENOENT)

@@ -162,6 +164,7 @@ static int __io_async_cancel(struct io_c
 	struct io_tctx_node *node;
 	int ret, nr = 0;
 
+	cd->running = false;
 	do {
 		ret = io_try_cancel(tctx, cd, issue_flags);
 		if (ret == -ENOENT)

@@ -185,7 +188,15 @@ static int __io_async_cancel(struct io_c
 		}
 	}
 	io_ring_submit_unlock(ctx, issue_flags);
-	return all ? nr : ret;
+	if (all)
+		return nr;
+	/*
+	 * The worker may be done with the work that was found running, and
+	 * flagged, above. That isn't the same as not having found it.
+	 */
+	if (ret == -ENOENT && cd->running)
+		ret = -EALREADY;
+	return ret;
 }
 
 int io_async_cancel(struct io_kiocb *req, unsigned int issue_flags)

@@ -9,6 +9,8 @@ struct io_cancel_data {
 	u8 opcode;
 	u32 flags;
 	int seq;
+	/* io_try_cancel() has found it being run by io-wq, and flagged it */
+	bool running;
 };
 
 int io_async_cancel_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe);

This is the start of the stable review cycle for the 6.1.191 release. There are 1887 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 30 Oct 2026 17:02:34 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.191-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.1.191-rc1

Alexey Dobriyan <[email protected]>
uapi: stddef.h: Fix header guard location

Xiaolei Wang <[email protected]>
pinctrl: freescale: Fix a memory out of bounds when num_configs is 1

Shenwei Wang <[email protected]>
gpio: mxc: map Both Edge pad wakeup to Rising Edge

Haojie Li <[email protected]>
drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info

Steffen Klassert <[email protected]>
Revert "esp: do not unref managed frag pages in esp_ssg_unref()"

Eric Dumazet <[email protected]>
inet: control sockets should not use current thread task_frag

Damien Le Moal <[email protected]>
scsi: block: Improve ioprio value validity checks

Damien Le Moal <[email protected]>
scsi: block: Introduce ioprio hints

Zhaoyang Huang <[email protected]>
mm: use stack_depot_early_init for kmemleak

Xiaolei Wang <[email protected]>
mm/kmemleak: use object_cache instead of kmemleak_initialized to check in set_track_prepare()

Thomas Zimmermann <[email protected]>
fbdev: Use /* */ comment in initializer macro

Eric Dumazet <[email protected]>
vlan: restore HW VLAN tag insertion with reorder_hdr off

Pablo Neira Ayuso <[email protected]>
netfilter: ctnetlink: do not expose expectation DEAD flag

Nathan Lynch <[email protected]>
seq_buf: Make DECLARE_SEQ_BUF() usable

HyeongJun An <[email protected]>
ALSA: seq: Don't leak the extension cell pointer in the bounce payload

Joseph Qi <[email protected]>
ocfs2: use correct endian in ocfs2_dinode_has_extents

ThangNN99 <[email protected]>
Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

Luiz Augusto von Dentz <[email protected]>

    Bluetooth: hci_core: Print number of packets in conn->data_q

Tejun Heo <[email protected]>
sched/psi: Create the psimon kthread outside of cgroup_mutex

Dan Carpenter <[email protected]>
ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp()

Damien Le Moal <[email protected]>
ata: libata-core: fix cancellation of a port deferred qc work

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring

Ming Qian <[email protected]>
media: verisilicon: Fix kernel panic due to __initconst misuse

Magnus Lindholm <[email protected]>
alpha: do not clear remote MMU contexts in migrate_flush_tlb_page()

Henrique Carvalho <[email protected]>
smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

Mikhail Gavrilov <[email protected]>
drm/amdgpu: replace PASID IDR with XArray

Prike Liang <[email protected]>
drm/amdgpu: fix the idr allocation flags

Pankaj Gupta <[email protected]>
KVM: SEV: Drop FOLL_WRITE for encrypted region registration

Perry Yuan <[email protected]>
drm/amdgpu: ensure no_hw_access is visible before MMIO

Dan Carpenter <[email protected]>
xen/events: fix error code in xen_bind_pirq_msi_to_irq()

Pauli Virtanen <[email protected]>
Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete

Jianpeng Chang <[email protected]>
Bluetooth: MGMT: Fix memory leak in set_ssp_complete

Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

Su Hui <[email protected]>
highmem: fix a memory copy problem in memcpy_from_folio

Moon Hee Lee <[email protected]>
fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

Karl Mehltretter <[email protected]>
virtio_ccw: always take irq_lock in the classic interrupt handler

Namjae Jeon <[email protected]>
ksmbd: fix r_count dec/increment mismatch

Qihang <[email protected]>
ksmbd: pin conn during async oplock break notification

Jason Gunthorpe <[email protected]>
RDMA/mlx5: Follow rb_key.ats when creating new mkeys

Yishai Hadas <[email protected]>
RDMA/mlx5: Fix implicit ODP hang on parent deregistration

Cen Zhang (Microsoft) <[email protected]>
rds: tcp: unregister sysctl before tearing down listen socket

Yihang Li <[email protected]>
scsi: hisi_sas: Remove redundant checks for automatic debugfs dump

Yihang Li <[email protected]>
scsi: hisi_sas: Fix a deadlock issue related to automatic dump

Yihang Li <[email protected]>
scsi: hisi_sas: Check before using pointer variables

Sudeep Holla <[email protected]>
firmware: arm_scmi: Drop handle on protocol bind failures

Sudeep Holla <[email protected]>
firmware: arm_scmi: Fix requested device removal race

Sudeep Holla <[email protected]>
firmware: arm_scmi: Unrequest devices if driver registration fails

Cristian Marussi <[email protected]>
firmware: arm_scmi: Add multiple protocols registration support

Sudeep Holla <[email protected]>
firmware: arm_scmi: Unregister device notifier before IDR teardown

Sudeep Holla <[email protected]>
firmware: arm_scmi: Free transport channel on IDR failure

Sudeep Holla <[email protected]>
firmware: arm_scmi: Protect device request lookup with RCU

Sudeep Holla <[email protected]>
firmware: arm_scmi: Avoid IDR updates while cleaning channels

Sudeep Holla <[email protected]>
firmware: arm_scmi: Reject out of range DT protocol IDs

Sudeep Holla <[email protected]>
firmware: arm_scmi: Use channel ID for transport teardown

Cristian Marussi <[email protected]>
firmware: arm_scmi: Add internal platform/channel identifiers

Cristian Marussi <[email protected]>
firmware: arm_scmi: Move errors defs and code to common.h

Gleb Markov <[email protected]>
drm/amd/display: Remove unused-but-set variable hubp from

Zicheng Qu <[email protected]>

    drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe

Hamza Mahfooz <[email protected]>
drm/amd/display: drop unused function set_abm_event()

Mukesh Ojha <[email protected]>
pinmux: fix race causing mux_owner NULL with active mux_usecount

Yongpeng Yang <[email protected]>
f2fs: fix node_cnt race between extent node destroy and writeback

Cong Wang <[email protected]>
bpf: Fix a potential use-after-free in bpf_link_free()

Filipe Manana <[email protected]>
btrfs: fix race between ordered extent completion and fiemap

Johannes Berg <[email protected]>
net/sched: initialize noop_qdisc owner

Petr Machata <[email protected]>
Documentation: networking: Add a caveat to nexthop_compat_mode sysctl

Mike Tipton <[email protected]>
interconnect: Don't access req_list while it's being manipulated

Song Shuai <[email protected]>
riscv: Remove SHADOW_OVERFLOW_STACK_SIZE macro

Radim Krčmář <[email protected]>
riscv: use lw when reading int cpu in asm_per_cpu

Christian Brauner <[email protected]>
signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL

Christian Brauner <[email protected]>
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper

Christian Brauner <[email protected]>
signal: don't retarget shared signals in a dying thread group

Christian Brauner <[email protected]>
signal: only SIGKILL and the freezers interrupt a coredumping task

Christian Brauner <[email protected]>
coredump: hold RCU while releasing parked threads

Aaron Ahmed <[email protected]>
ftrace: Initialize modname and offset in print_rec()

Weiming Shi <[email protected]>
asymmetric_keys: reject trust keys without IDs

Srish Srinivasan <[email protected]>
keys/trusted_keys: return immediately after TPM unseal failure

Stefano Garzarella <[email protected]>
KEYS: trusted: Fix blob allocation size in tpm2_key_decode()

Adrian Martinez <[email protected]>
KEYS: Fix key_reject_and_link() race with keyring restriction

Cen Zhang <[email protected]>
keys: Protect the read method check against type removal

Kyle Zeng <[email protected]>
keys: make keyring indexes independent of kernel addresses

Cen Zhang <[email protected]>
keys: Protect the type name while describing a key

Cen Zhang <[email protected]>
keys: Check the authorization payload in process keyring searches

Cen Zhang <[email protected]>
keys: Avoid the owner account dereference in named keyring lookup

Lee Jones <[email protected]>
tracing/histograms: Verify event_call identity when updating synth_event refcount

Donggeun Yoo <[email protected]>
tracing: Fix 64-bit and signed histogram fields on 32-bit kernels

Donggeun Yoo <[email protected]>
tracing: Unregister field variable histograms when the command fails

Donggeun Yoo <[email protected]>
tracing: Save the event file instead of the compatible histogram

Kyle Zeng <[email protected]>
tracing: Reject incomplete event filter expressions

Kees Cook <[email protected]>
Compiler Attributes: counted_by: Adjust name and identifier expansion

Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

Pauli Virtanen <[email protected]>

    Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

Kirill A. Shutemov <[email protected]>
mm: split critical region in remap_file_pages() and invoke LSMs in between

Jonas Köppeler <[email protected]>
net_sched: codel: fix stale state for empty flows in fq_codel

Hangbin Liu <[email protected]>
bonding: do not set usable_slaves for broadcast mode

Yun Zhou <[email protected]>
xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

Frank Sorenson <[email protected]>
cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()

Ben Cressey <[email protected]>
dm-integrity: fix infinite loop on discard with large tag size

Dibin Moolakadan Subrahmanian <[email protected]>
drm/i915/dmc: Harden DMC firmware payload parsing

Jann Horn <[email protected]>
futex: Fix mm reuse handling for FUT_OFF_MMSHARED

Wentao Liang <[email protected]>
i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()

Ido Schimmel <[email protected]>
ipv4: udp: Create exceptions before socket matching

Daehyeon Ko <[email protected]>
vsock/virtio: validate packet source for connected sockets

Chen Cheng <[email protected]>
dm-integrity: require stable writes for internal hash modes

Usama Arif <[email protected]>
mm/huge_memory: transfer the pmd dirty bit to the folio on zap

Aviv Vaknin <[email protected]>
pid_namespace: make zap_pid_ns_processes() freezable

Jens Axboe <[email protected]>
exit: move core of do_wait() into helper

Christian Brauner <[email protected]>
ext4: free the sbi after a grace period

Cen Zhang (Microsoft) <[email protected]>
watch_queue: Fix note pool publication race in watch_queue_set_size()

Daniil Stas <[email protected]>
hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur

Lorenzo Stoakes (ARM) <[email protected]>
perf: Track the perf mlock gift separately

Laurence Oberman <[email protected]>
scsi: st: Fix use-after-free race between st_remove() and st_open()

Lee Jones <[email protected]>
tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields

Paulo Alcantara <[email protected]>
smb: client: fix multiuser mount with krb5

Aohan Mei <[email protected]>
net/sched: cls_flower: validate mask pointer after nla_next()

Aleksandr Khromov <[email protected]>
ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in

Aleksandr Khromov <[email protected]>
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION

Aleksandr Khromov <[email protected]>
ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION

Jun Yang <[email protected]>
net: bridge: mcast: don't truncate the port group walk on teardown

Kairui Song <[email protected]>
mm, madvise: fix potential workingset node list_lru leaks

Hyunwoo Kim <[email protected]>
KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots

Matt Fleming <[email protected]>
mm/huge_memory: initialise workingset state before folio split

David Rosca <[email protected]>
drm/amdgpu: Fix VCE 3 ring align_mask

Zihan Xi <[email protected]>
ipv4: avoid divide by zero in fib_rebalance

Niklas Schnelle <[email protected]>
s390/pci: Fix leak of uninitialized kernel data in SCLP report

Aswin Karuvally <[email protected]>
s390/ctcm: Prevent XID null dereference

Florian Schauer <[email protected]>
page_pool: keep frag_offset aligned for odd-sized requests

Charles Vosburgh <[email protected]>
sctp: validate chunk length in the inqueue parser

Chengfeng Ye <[email protected]>
tipc: protect node reset trace dump with node lock

Carlos Maiolino <[email protected]>
xfs: fix capability check in xfs

Bryam Vargas <[email protected]>
net/iucv: fix the recvmsg window update

Genjian Zhang <[email protected]>
dm-ebs: fix incorrect device offset check in ebs_ctr()

Ben Cressey <[email protected]>
dm-crypt: fix a tiny race condition in crypt_dec_pending

Benjamin Marzinski <[email protected]>
dm cache: fix issue with background work locking

Ming-Hung Tsai <[email protected]>
dm cache: fix demotion stats in passthrough mode

Etienne Perot <[email protected]>
cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children

Cen Zhang (Microsoft Security FORGE Labs) <[email protected]>
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)

Cen Zhang (Microsoft Security FORGE Labs) <[email protected]>
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)

Heyang Tan <[email protected]>
wifi: p54: validate firmware record lengths

Tengda Wu <[email protected]>
tracing: Fix hist trigger timestamps for buffered events

Amit Machhiwal <[email protected]>
tracing: Do not initialize tracefs work if tracing is disabled

Donggeun Yoo <[email protected]>
tracing: Fix the shift out of bounds in the log2 histogram modifier

Jesse Zhang <[email protected]>
drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

Timur Kristóf <[email protected]>
drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang

Yehyeong Lee <[email protected]>
scsi: libiscsi: Validate the task named by a management response

Yehyeong Lee <[email protected]>
scsi: libiscsi: Validate the ITT reflected in a Reject PDU

Yehyeong Lee <[email protected]>
scsi: libiscsi: Reject a negative task index from parse_pdu_itt

Yehyeong Lee <[email protected]>
scsi: xen/scsifront: Check for a NULL shadow entry on a backend response

Loic Poulain <[email protected]>
i2c: qcom-cci: Fix HALT_ACK reset request being dropped

Sasha Levin <[email protected]>
tools: gpio: fix building from the top level with O=

Daehyeon Ko <[email protected]>
sctp: revalidate output stream after association connect wait

Mario Limonciello <[email protected]>
pinctrl: amd: Clear S4 wake bits when firmware has _AEI

Aohan Mei <[email protected]>
net: rds: fix uninitialized trans dereference in CM event handler

Jérémy Jean <[email protected]>
net/sched: fix use-after-free in __tcf_action_put()

Kyle Zeng <[email protected]>
fsnotify: prevent mark additions during connector teardown

Amirmohammad Eftekhar <[email protected]>
KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry

Christian Brauner <[email protected]>
unicode: free the map after a grace period

Sung Byeongchan <[email protected]>
autofs: ignore notification errors from a replaced pipe

Peng Fan <[email protected]>
gpio: mxc: fix wakeup_pads bit operations

Alexander Stein <[email protected]>
gpio: mxc: use BIT() macro

Peng Fan <[email protected]>
gpio: mxc: fix both_edges bit operations

Bartosz Golaszewski <[email protected]>
gpio: mxc: use lock guards for the generic GPIO chip lock

Shenwei Wang <[email protected]>
gpio: mxc: enable pad wakeup on i.MX8x platforms

Nicolai Buchwitz <[email protected]>
net: bcmgenet: unshare the skb before writing the control block

Kyle Zeng <[email protected]>
netlink: avoid hashing the network namespace pointer

Xingui Yang <[email protected]>
scsi: libsas: Fix SMP IO deadlock during HA resume

Kyle Zeng <[email protected]>
pipe: preserve existing fasync readers on writer setup failure

Sasha Levin <[email protected]>
samples: pidfd: fix userprogs typo

Cen Zhang <[email protected]>
ocfs2/dlm: Protect the recovery list during debugfs reads

Linfeng Sun <[email protected]>
scsi: target: iscsi: Fix race in discovery auth updates

Laurence Oberman <[email protected]>
scsi: st: Save the visited block for the partition the drive is in

Keith Busch <[email protected]>
nios2: fix __wsum type degradation in csum_fold()

Carlos Jones Jr <[email protected]>
spi: tegra114: assert CS GPIO for every transfer in a message

HyeongJun An <[email protected]>
ASoC: nau8822: Fix the 128x oversampling switch bits

HyeongJun An <[email protected]>
ASoC: wm8978: Fix the 128x oversampling switch bits

HyeongJun An <[email protected]>
ASoC: max98371: Fix the Speaker DHT Min Volume bits

HyeongJun An <[email protected]>
ASoC: pcm3168a: Fix the DAC zero flag polarity bit

HyeongJun An <[email protected]>
ASoC: cs42l52: Fix the NG Type Switch bit

HyeongJun An <[email protected]>
ASoC: cs42l56: Put the Limiter Cushion control on the limiter register

Avi Weiss <[email protected]>
ASoC: stm32: spdifrx: fix synchronization state check

Sergey Tiraspolsky <[email protected]>
ASoC: Intel: avs: Reset the stream unless it is already prepared

Allison Henderson <[email protected]>
net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure

Michal Luczaj <[email protected]>
vsock: treat TCP_CLOSING as once-established

Michael Kelley <[email protected]>
Drivers: hv: Don't reset VMBus connection state on error/exit paths

Waiman Long <[email protected]>
Drivers: hv: Avoid infinite retry loop in init_vp_index()

Xueqin Luo <[email protected]>
power: supply: ds2780: Fix ds2780_get_capacity() returning raw value

Karl Mehltretter <[email protected]>
power: supply: Fix maintenance charge table kernel-doc

Abdul Wasey <[email protected]>
mptcp: move the OoO check back into __mptcp_try_fallback()

Jinu Kim <[email protected]>
KVM: x86: Use active memslots for the per-vCPU MMIO cache

Ilan Dudnik <[email protected]>
ksmbd: fix heap out-of-bounds write in krb5_authenticate()

Matthew Wilcox (Oracle) <[email protected]>
powerpc: Remove initialisation of readpos

Chengfeng Ye <[email protected]>
netfilter: cttimeout: prevent UAF during module unload

David Carlier <[email protected]>
ieee802154: hwsim: serialize pib updates to fix double-free

Zhiling Zou <[email protected]>
ipv6: flowlabel: cap duplicate leases per socket

Xixin Liu <[email protected]>
perf: RISC-V: store available counter mask as bitmap

Kalpan Jani <[email protected]>
mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0

Paulo Alcantara <[email protected]>
smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid

Bjoern Doebel <[email protected]>
smb: client: fail DACL rewrite when the new DACL exceeds 64K

Paulo Alcantara <[email protected]>
smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size

Daeho Jeong <[email protected]>
f2fs: accurately adjust free_sections during free_segment_range

Nilesh Javali <[email protected]>
scsi: qla2xxx: Skip vport under deletion in report ID acquisition

Yuqi Xu <[email protected]>
wifi: cfg80211: reject duplicate wiphy cipher suite entries

Viken Dadhaniya <[email protected]>
spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM

Douglas Anderson <[email protected]>
spi: spi-qcom-qspi: Support pinctrl sleep states

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()

Ilpo Järvinen <[email protected]>
PCI/sysfs: Demacrofy pci_dev_resource_resize_attr(n) functions

Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction

Ping-Ke Shih <[email protected]>
wifi: rtw89: phy: check length before parsing PHY status IE

Candice Li <[email protected]>
drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw

Candice Li <[email protected]>
drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

Stepan Ionichev <[email protected]>

    tty: serial: 8250: protect against NULL uart->port.dev in register

Herve Codina <[email protected]>
driver core: Avoid warning when removing a device while its supplier is unbinding

Sicong Huang <[email protected]>
virt: acrn: Fix irqfd use-after-free during eventfd shutdown

Tao Cui <[email protected]>
RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()

Shiwu Zhang <[email protected]>
drm/amdgpu: fix buffer overflow during vBIOS update

Mario Limonciello <[email protected]>
drm/amd: Use attribute groups for PSP flashing attributes

Lijo Lazar <[email protected]>
drm/amdgpu: Add vbios attribute only if supported

Yongqiang Sun <[email protected]>
drm/amdkfd: fix SMI event cross-process information leak

Mohamed Khalfella <[email protected]>
nvme-fc: Do not cancel requests in io target before it is initialized

Fredric Cover <[email protected]>
smb: client: fix races in cifsd thread creation

Paulo Alcantara <[email protected]>
cifs: get rid of dns resolve worker

David Timber <[email protected]>
exfat: fix handling of damaged volume in exfat_create_upcase_table()

Daniel Yang <[email protected]>
exfat: resolve memory leak from exfat_create_upcase_table()

Xiaogang Chen <[email protected]>
drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl

Peter Zijlstra <[email protected]>
perf: Fix addr_filter_ranges lifetime

Pagadala Yesu Anjaneyulu <[email protected]>
wifi: mac80211: ibss: wait for in-flight TX on disconnect

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: pcie: null RX pointers after free

Huiwen He <[email protected]>
smb/client: flush dirty data before punching a hole

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: validate TX_CMD response layout

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix a possible underflow

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: add a check on the tid coming from the firmware

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif

Namjae Jeon <[email protected]>
ksmbd: preserve VFS inherited POSIX ACL mask

Namjae Jeon <[email protected]>
ksmbd: fix maximum allowed access checks

Val Packett <[email protected]>
remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3

Yun Zhou <[email protected]>
ext4: fix circular lock dependency in ext4_ext_migrate

Gou Hao <[email protected]>
powerpc/xive: propagate IPI init errors to prevent use-after-free

Gou Hao <[email protected]>
powerpc/xive: add error return value to xive_smp_probe()

Rafael J. Wysocki <[email protected]>
ACPI: bus: Introduce acpi_bus_get_primary_device()

Chris Mason <[email protected]>
svcrdma: Reject Write/Reply chunks with segcount 0

Shameer Kolothum <[email protected]>
iommu/arm-smmu-v3: Manage teardown with devm

Adrian Hunter <[email protected]>
i3c: master: Fix recursive locking during device registration

Li Chen <[email protected]>
nvdimm: virtio_pmem: refcount requests for token lifetime

Maíra Canal <[email protected]>

    drm/v3d: Clear queue->active_job when v3d_fence_create() fails

Richard Cheng <[email protected]>
cxl/mbox: Clamp mailbox output allocation to the payload size

Evgenii Burenchev <[email protected]>
drm/amd/display: Fix dangling pointer in plane reset function

Evgenii Burenchev <[email protected]>
drm/amd/display: Fix dangling pointer in CRTC reset function

Leon Hwang <[email protected]>
bpf: Copy per-CPU map value padding in copy_map_value_long()

Gregory Price <[email protected]>
mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug

Alex Bereza <[email protected]>
dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout

Manos Pitsidianakis <[email protected]>
hwrng: core - fix rng list on registration error

Myeonghun Pak <[email protected]>
crypto: keembay - Fix AEAD unregister count in error path

Waiman Long <[email protected]>
cgroup/cpuset: Make nr_deadline_tasks an atomic_t

Chen Ridong <[email protected]>
cgroup/cpuset: move common code to cpuset-internal.h

Chen Ridong <[email protected]>
cgroup/cpuset: introduce cpuset-v1.c

Malaya Kumar Rout <[email protected]>
time/namespace: Validate nanosecond field in proc_timens_set_offset()

Armin Wolf <[email protected]>
platform/x86: dell-wmi-base: Fix handling of ultra performance key

Armin Wolf <[email protected]>
platform/x86: lg-laptop: Fix LED resource handling

Nicholas Dudar <[email protected]>
bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max

Qing Ming <[email protected]>
usb: gadget: uac: validate rate list length before storing

Marco Scardovi <[email protected]>
platform/x86: asus-wmi: fix resource leaks on probe failure

Maher Azzouzi <[email protected]>
esp: do not unref managed frag pages in esp_ssg_unref()

Leon Romanovsky <[email protected]>
RDMA/rvt: Return NULL after port allocation failure

Reinette Chatre <[email protected]>
fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()

Sudeep Holla <[email protected]>
firmware: arm_scmi: Publish channel state before callbacks

Sudeep Holla <[email protected]>
firmware: arm_scmi: Fix SCMI device destroy lifetimes

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments

Ruoyu Wang <[email protected]>
drm/msm: Only fini scheduler after successful init

Philipp Stanner <[email protected]>
drm/sched: Use struct for drm_sched_init() params

Koichiro Den <[email protected]>
dmaengine: dw-edma: Terminate all descriptors without callbacks

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Zero queue and stack outputs on lock failure

Aditya Prakash Srivastava <[email protected]>
ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()

Leon Romanovsky <[email protected]>
RDMA/erdma: complete object teardown when the destroy command fails

Leon Hwang <[email protected]>
bpf: Fix WARNING in bpf_tracing_link_release

Justin Yeh <[email protected]>
pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip

Li Qiang <[email protected]>
scsi: ufs: core: Validate string descriptors

Fan Wu <[email protected]>
spi: oc-tiny: switch to managed controller allocation

Gary Guo <[email protected]>
PCI: Fix UAF when probe runs concurrent to dyn ID removal

Gary Guo <[email protected]>
PCI: Fix dyn_id add TOCTOU

Gary Guo <[email protected]>
PCI: Make pci_match_one_device() match on ID instead of device

Samiullah Khawaja <[email protected]>
PCI: Initialize temporary device in new_id_store()

Ryusuke Konishi <[email protected]>
nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

Leon Romanovsky <[email protected]>
RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()

Fan Wu <[email protected]>
spi: davinci: switch to managed controller allocation

Jeff Johnson <[email protected]>
wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()

Jeff Johnson <[email protected]>
wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()

Pu Lehui <[email protected]>
bpf: Fix potential UAF when reading bpf link info

Kui-Feng Lee <[email protected]>

    bpf: Retire the struct_ops map kvalue->refcnt.

Peter Zijlstra <[email protected]>
x86/ftrace: Remove SYSTEM_BOOTING exceptions

Martin Wilck <[email protected]>
md/raid1: create serial pool adding rdev to array with serialize_policy=1

Muhammad Usama Anjum <[email protected]>
misc: sgi-gru: remove interrupt-context page-table walks

Michael-CY Lee <[email protected]>
wifi: mt76: fix non-AQL packet accounting for MLO stations

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: unwind state on add_interface failure

Christophe JAILLET <[email protected]>
wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface()

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: allocate vif wcid in the same range as stations

Felix Fietkau <[email protected]>
wifi: mt76: cancel reset and rc work on device unregister

Yonghong Song <[email protected]>
bpf, x86: Fix trampoline stack size for 128-bit arguments

Will Deacon <[email protected]>
arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry

Zhao Li <[email protected]>
wifi: nl80211: clean up color-change beacon data on errors

Jason Huang <[email protected]>
wifi: brcmfmac: fix P2P action frame handling without device vif

Zhao Li <[email protected]>
wifi: cfg80211: stop PMSR before P2P and NAN teardown

Karl Mehltretter <[email protected]>
serial: core: do fallible allocations before the console can be registered

Karl Mehltretter <[email protected]>
serial: core: clear freed pointers on uart_register_driver() failure

Karl Mehltretter <[email protected]>
tty: skip cdev_del() when no cdev is registered

Greg Kroah-Hartman <[email protected]>
tty: make tty_class a static const structure

Haoxiang Li <[email protected]>
HID: logitech-hidpp: Fix FF device cleanup on init failure

Vicki Pfau <[email protected]>
HID: steam: Reject short reads

Pu Lehui <[email protected]>
bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed

Rafael J. Wysocki <[email protected]>
thermal: hwmon: Remove hwmon class device along with its parent

Cheng Xu <[email protected]>
RDMA/erdma: Hold QP references for AE and CM processing

Cen Zhang <[email protected]>
ocfs2: o2hb: quiesce negotiate handlers and timeout work

Cen Zhang <[email protected]>
ocfs2/cluster: keep heartbeat local node stable

Yufan Chen <[email protected]>
ocfs2/heartbeat: fix slot mapping rollback leaks on error paths

Jiri Olsa <[email protected]>
bpf: Clear buf on error in __bpf_get_task_stack

Harry Wentland <[email protected]>
drm/amd/display: Resize MST HDCP per-connector arrays to 32

Yeoreum Yun <[email protected]>
coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable

Yang Xiuwei <[email protected]>
scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails

Filipe Manana <[email protected]>
btrfs: defrag: fix deadlock between defrag and delalloc space reservation

Qu Wenruo <[email protected]>
btrfs: always wait for ordered extents to avoid OE races

Sun YangKai <[email protected]>
btrfs: check if root is readonly when setting posix acl

Qu Wenruo <[email protected]>
btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()

Pu Lehui <[email protected]>
bpf, cgroup: Fix storage null-ptr-deref after replacing prog

Sanghyun Park <[email protected]>
bpf: Fix mmap_lock leak in irq_work path

Runyu Xiao <[email protected]>
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

Benjamin Coddington <[email protected]>
Treewide: Stop corrupting socket's task_frag

Guillaume Nault <[email protected]>
net: Introduce sk_use_task_frag in struct sock.

Alexander Aring <[email protected]>
fs: dlm: cleanup listen sock handling

Alexander Aring <[email protected]>
fs: dlm: remove socket shutdown handling

Alexander Aring <[email protected]>
fs: dlm: use listen sock as dlm running indicator

Chuck Lever <[email protected]>
NFS: Return a delegation the client fails to record

Kuniyuki Iwashima <[email protected]>
amt: Don't support cross-netns setup.

Sven Peter <[email protected]>
nvme-apple: Destroy the admin queue on removal

Takashi Sakamoto <[email protected]>
firewire: core: fix memory leak in error path of build_tree()

Marek Szyprowski <[email protected]>
clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type

Maurizio Lombardi <[email protected]>
nvmet: fix max_qid race between configfs and controller allocation

ZhengYuan Huang <[email protected]>
ocfs2: validate orphan slot during inode read

ZhengYuan Huang <[email protected]>
ocfs2: validate DIO orphan slot during inode read

Zhan Xusheng <[email protected]>
fs/ntfs3: fix integer overflow in MFT cluster validation

Zizhi Wo <[email protected]>
null_blk: free zones array on device power-off

Usama Arif <[email protected]>
blk-iolatency: clear delay state when freeing policy data

Usama Arif <[email protected]>
blk-iocost: clear delay state when freeing policy data

Yu Kuai <[email protected]>
blk-cgroup: delay freeing policy data after rcu grace period

John Johansen <[email protected]>
apparmor: fix deadlock in complain-mode change_hat

Yunseong Kim <[email protected]>
ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()

Namjae Jeon <[email protected]>
ksmbd: free preauth sessions on connection teardown

Namjae Jeon <[email protected]>
ksmbd: serialize oplock close with pending break ownership

ZhangGuoDong <[email protected]>
smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()

Ilan Dudnik <[email protected]>
ksmbd: defer publishing granted locks to prevent UAF/double-free race

Gao Xiang <[email protected]>
erofs: fix interlaced ztailpacking pclusters

Namjae Jeon <[email protected]>
ksmbd: safely discard unregistered deferred locks

Namjae Jeon <[email protected]>
ksmbd: detach blocked lock requests before freeing

Hang Nan <[email protected]>
ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size

Ze Tan <[email protected]>
smb/server: fix session leak in ksmbd_session_register()

ZhangGuoDong <[email protected]>
pnfs/blocklayout: Fix device leaks on parse failure

Jeuk Kim <[email protected]>
NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

Zhansong Gao <[email protected]>
NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()

Jiayuan Chen <[email protected]>
bpf, xdp: move offload check into dev_xdp_install()

Baokun Li <[email protected]>
fuse: check for NULL root inode in fuse_fill_super_submount

Nguyen Dinh Phi <[email protected]>
vsock: don't check the listener's sk_err in vsock_accept()

Tetsuo Handa <[email protected]>
net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()

Christopher Lusk <[email protected]>
smb: client: fix request buffer leak in smb2_new_read_req()

Runyu Xiao <[email protected]>
ALSA: mtpav: shut down output timer before card teardown

Pengpeng Hou <[email protected]>
net: qlcnic: validate unified ROM sections before loading

Eric Dumazet <[email protected]>
ip6mr: do not clone dst in ip6mr_cache_report()

Jamal Hadi Salim <[email protected]>
net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue

Eric Dumazet <[email protected]>
net_sched: sch_fifo: implement lockless __fifo_dump()

Nikolay Aleksandrov <[email protected]>
net: bridge: arp/nd proxy: fix reading neigh ha

Nikolay Aleksandrov <[email protected]>
vxlan: fix reading neigh ha

Jérémy Jean <[email protected]>
NFSv4.1: zero referring call lists before decoding

Jamal Hadi Salim <[email protected]>
net/sched: account classifier filter allocations to memcg

Michael Kelley <[email protected]>
Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition

Radek Podgorny <[email protected]>
Bluetooth: do not leak an hci_conn when a second LE connect is rejected

Anshumali Gaur <[email protected]>
octeontx2-vf: fix workqueue and netdev race in probe/remove

Victor Nogueira <[email protected]>
net/sched: act_ife: Only operate on Ethernet frames

Jamal Hadi Salim <[email protected]>
net/sched: fq: add overflow bounds to quantum and initial quantum

Haotian Zhang <[email protected]>
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: skip double clone set expressions on element insert

Doruk Tan Ozturk <[email protected]>
HID: sony: clean up device list on probe failure

Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during close_lru reaping

Jeffin Philip <[email protected]>
usb: gadget: f_midi: initialize work in f_midi_alloc()

Kees Cook <[email protected]>
usb: gadget: f_midi: Annotate struct f_midi with __counted_by

Kees Cook <[email protected]>
Compiler Attributes: Add __counted_by macro

Steven Rostedt <[email protected]>
tracing: Take trace_array reference when opening options file

Baineng Shou <[email protected]>
dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

Aneesh Kumar K.V (Arm) <[email protected]>
dma-direct: return struct page from dma_direct_alloc_from_pool()

Christoph Hellwig <[email protected]>
dma-direct: simplify the use atomic pool logic in dma_direct_alloc

Petr Tesarik <[email protected]>
dma-direct: cleanup parameters to dma_direct_optimal_gfp_mask

Jinjie Ruan <[email protected]>
powerpc/kexec_file: Prevent kexec range truncation

Anthony Krowiak <[email protected]>
s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()

Anthony Krowiak <[email protected]>

    s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL

Anthony Krowiak <[email protected]>
s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

Haoxiang Li <[email protected]>
ASoC: hdac_hda: Fix hlink refcount leak on component registration failure

Vidhu Sarwal <[email protected]>
iio: light: ltrf216a: fix runtime PM reference leak in error path

Shreeya Patel <[email protected]>
iio: light: ltrf216a: Return floating point values

Christian Borntraeger <[email protected]>
KVM: s390: Fix memory corruption by not reinjecting CK machine checks

Fuad Tabba <[email protected]>
KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save

Wenjie Qi <[email protected]>
f2fs: validate MOVE_RANGE destination size

Wenjie Qi <[email protected]>
f2fs: avoid NULL checkpoint thread access in sysfs

Zhiguo Niu <[email protected]>
f2fs: use new ioprio Macro to get ckpt thread ioprio level

Damien Le Moal <[email protected]>
scsi: block: ioprio: Clean up interface definition

Yangtao Li <[email protected]>
f2fs: convert to use sysfs_emit

Daeho Jeong <[email protected]>
f2fs: fix to migrate all curseg types during free_segment_range

Chao Yu <[email protected]>
f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()

Chao Yu <[email protected]>
f2fs: fix to clear dirty flag on folio in error path

Jesse Zhang <[email protected]>
drm/amdgpu: force complete the KIQ ring fences on reset

Priya Hosur <[email protected]>
drm/amdkfd: Add TLB flush after MES queue eviction/suspension

Xiaogang Chen <[email protected]>
drm/amdkfd: Fix error path at svm_migrate_copy_to_ram

Xiaogang Chen <[email protected]>
drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram

Marek Czernohous <[email protected]>
drm/nouveau: unsubscribe the channel-kill event before the fence context

Jiri Olsa <[email protected]>
bpf: Disable preemption in bpf_get_stackid

Farhan Ali <[email protected]>
PCI: Allow per function PCI slots to fix slot reset on s390

Farhan Ali <[email protected]>
PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value

Namjae Jeon <[email protected]>
ksmbd: zero pipe read compound padding

Cen Zhang (Microsoft Security FORGE Labs) <[email protected]>
ksmbd: fix tree connection use-after-free in smb2_tree_connect()

Jann Horn <[email protected]>
apparmor: fix cred UAF caused by begin_current_label_crit_section()

Quanfa Fu <[email protected]>
apparmor: make aa_set_current_onexec return void

Breno Leitao <[email protected]>
mm/kmemleak: avoid soft lockup when scanning task stacks

Jim Cromie <[email protected]>
kmemleak: drop (age <increasing>) from leak record

Zhaoyang Huang <[email protected]>
mm: use stack_depot for recording kmemleak's backtrace

Kairui Song <[email protected]>
mm/mglru: fix and remove redundant unevictable folio handling

Daniel Borkmann <[email protected]>
bpf: Disable preemption in __bpf_get_stack

Chuck Lever <[email protected]>
svcrdma: Reject Read lists that exceed the page budget

Chuck Lever <[email protected]>
svcrdma: Validate Read chunk positions before reconstruction

Jiangshan Yi <[email protected]>
HID: nintendo: register input device after capabilities are set

Eric Farman <[email protected]>
s390/vfio_ccw: Ensure first IDAW remains constant

David Windsor <[email protected]>
bpf: Reject sleepable BPF_LSM_CGROUP programs at load time

Jordan Walters <[email protected]>
Bluetooth: hci_core: Fix UAF in hci_unregister_dev()

Eric Dumazet <[email protected]>
net: watchdog: fix refcount tracking races

Jamie Nguyen <[email protected]>

    fs/ntfs3: resize log->one_page_buf when adopting on-disk page size

Cen Zhang <[email protected]>
Bluetooth: 6lowpan: hold L2CAP conn across debugfs control

Marc Zyngier <[email protected]>
KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling

Kanglong Wang <[email protected]>
LoongArch: Move jump_label_init() before parse_early_param()

Qing Ming <[email protected]>
cgroup/rstat: validate cpu before css_rstat_cpu() access

Florian Westphal <[email protected]>
netfilter: revalidate bridge ports

Damien Riégel <[email protected]>
greybus: raw: fix use-after-free if write is called after disconnect

Yongpeng Yang <[email protected]>
f2fs: fix fsck inconsistency caused by FGGC of node block

Gao Xiang <[email protected]>
erofs: fix inline data read failure for ztailpacking pclusters

Florian Westphal <[email protected]>
netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation

Xingui Yang <[email protected]>
scsi: hisi_sas: Fix NULL pointer exception during user_scan()

Fernando Fernandez Mancera <[email protected]>
ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: clone set on flush only

Peilin Ye <[email protected]>
bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()

Qu Wenruo <[email protected]>
btrfs: avoid NULL pointer dereference if no valid csum tree

Qu Wenruo <[email protected]>
btrfs: avoid NULL pointer dereference if no valid extent tree

Zqiang <[email protected]>
rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()

Alex Hung <[email protected]>

    drm/amd/display: Check link_index before accessing dc->links[]

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: fix TX fifo corruption

Junxian Huang <[email protected]>
RDMA/hns: Fix soft lockup under heavy CEQE load

Gavin Shan <[email protected]>
mm/shmem: disable PMD-sized page cache if needed

Jacob Keller <[email protected]>
ice: Don't process extts if PTP is disabled

Gavin Shan <[email protected]>
mm/filemap: skip to create PMD-sized page cache if needed

Longlong Xia <[email protected]>
zram: fix out-of-bounds access in writeback_store()

Chuck Lever <[email protected]>
NFSD: check truncate permission under inode lock

Jeff Layton <[email protected]>
lockd, nfsd: RCU-protect nlmsvc_ops dispatch

Jeff Layton <[email protected]>
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

Jeff Layton <[email protected]>
nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

Jeff Layton <[email protected]>
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

Chris Mason <[email protected]>

    nfsd: gate nfs3 setacl by argp->mask

Robbie Ko <[email protected]>
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during delegation revoke

Xiubo Li <[email protected]>
ceph: fix UAF in check_new_map() on session freed during unlock

Michael Bommarito <[email protected]>
ceph: cap delegated inode count in ceph_parse_deleg_inos()

Max Kellermann <[email protected]>
ceph: do not repeat ceph_trim_dentries() if no progress possible

Guanghui Yang <[email protected]>
btrfs: drop recovered reloc root refs on recovery failure

Anand Jain <[email protected]>
btrfs: rename err to ret in btrfs_recover_relocation()

Anand Jain <[email protected]>
btrfs: rename ret to ret2 in btrfs_recover_relocation()

Anand Jain <[email protected]>
btrfs: rename ret to err in btrfs_recover_relocation()

Shuangpeng Bai <[email protected]>
btrfs: fix extent map leak in NOCOW direct I/O write

Frank Sorenson <[email protected]>
cifs: call pagecache_isize_extended() in cifs_setsize() when extending

Bryam Vargas <[email protected]>
smb: client: reject a tree connect response whose byte count is too small

Jiangshan Yi <[email protected]>
HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes

Florian Pradines <[email protected]>

    HID: mcp2221: fix OOB write in mcp2221_raw_event()

Jan Kara <[email protected]>
ext2: Fix lost inode updates for IS_SYNC inodes

Hui Su <[email protected]>
fbdev: ssd1307fb: defer I2C transfers from damage callbacks

Thomas Zimmermann <[email protected]>
fbdev/ssd1307fb: Generate deferred I/O ops

Thomas Zimmermann <[email protected]>
fbdev: Add initializer macros for struct fb_ops

Thomas Zimmermann <[email protected]>

    fbdev: Validate info->screen_{base, buffer} in fb_ops implementations

Thomas Zimmermann <[email protected]>

    fbdev: Don't re-validate info->state in fb_ops implementations

Bryam Vargas <[email protected]>
dm array: validate array block headers on read

Heinz Mauelshagen <[email protected]>
dm: correct block comments format.

Zhiling Zou <[email protected]>
ip: orphan prefetched skbs before multicast forwarding

Andrea Mayer <[email protected]>
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()

Chris Mason <[email protected]>
SUNRPC: svcauth_gss: enforce krb5 token minimum length

Chuck Lever <[email protected]>
SUNRPC: Convert unwrap_priv_data() to use xdr_stream

Chuck Lever <[email protected]>
SUNRPC: Rename automatic variables in unwrap_priv_data()

Chuck Lever <[email protected]>
SUNRPC: Fix crasher in unwrap_integ_data()

Jeff Layton <[email protected]>
sunrpc: defer rq_argp and rq_resp free until after RCU grace period

Luxiao Xu <[email protected]>
sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Chuck Lever <[email protected]>
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

Chuck Lever <[email protected]>
svcrdma: Reject connection when transport allocation fails

Chuck Lever <[email protected]>
svcrdma: Handle ADDR_CHANGE CM event properly

Chuck Lever <[email protected]>
svcrdma: Reject inline replies that overflow the pull-up buffer

Chuck Lever <[email protected]>
svcrdma: Use svc_xprt_put to free listener on create failure

Yan Zhen <[email protected]>
sunrpc: xprtrdma: Use ERR_CAST() to return

Chuck Lever <[email protected]>
svcrdma: Refactor the creation of listener CMA ID

Chuck Lever <[email protected]>
svcrdma: Allocate new transports on device's NUMA node

Tejun Heo <[email protected]>
sched/core: Make core-sched flips wait for in-flight selections

Shuangpeng Bai <[email protected]>
lockd: fix NULL dereference on lockowner allocation failure

Fan Wu <[email protected]>
power: supply: charger-manager: register regulators before exposing sysfs

Uwe Kleine-König <[email protected]>
power: supply: charger-manager: Convert to platform remove callback returning void

Fan Wu <[email protected]>
power: supply: lp8788-charger: fix use-after-free on remove

Andrew Davis <[email protected]>
power: supply: lp8788: Use devm_power_supply_register() helper

Uwe Kleine-König <[email protected]>
power: supply: lp8788-charger: Convert to platform remove callback returning void

Jianing Li <[email protected]>
power: supply: max17040: propagate register read errors

Weimin Xiong <[email protected]>
iommu/msm: Unwind probe state on registration failure

Kevin Tian <[email protected]>
iommu/vt-d: Force requesting ACS when tboot is enabled

Lu Baolu <[email protected]>
iommu: Add max_pasids field in struct iommu_device

Abdun Nihaal <[email protected]>
platform/x86: int1092: Fix potential memory leak in sar_probe()

Rafael J. Wysocki <[email protected]>
platform/x86: intel_sar: Check ACPI_HANDLE() against NULL

Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Propagate SMU errors and validate S2D address

Zihan Xi <[email protected]>
net: l2tp: do not propagate multicast notification errors

Xuanqiang Luo <[email protected]>
net: ravb: serialize PTP clock teardown

Fan Ye <[email protected]>
net: thunderbolt: Mark the connection down when bringing it up fails

Fan Ye <[email protected]>
net: thunderbolt: Release the Rx HopID that was handed out on mismatch

Hidayath Khan <[email protected]>
net/smc: stop killed, freed and out_of_sync sharing a byte

Abdun Nihaal <[email protected]>
mfd: sm501: Fix potential memory leaks during remove

Uwe Kleine-König <[email protected]>
mfd: sm501: Convert to platform remove callback returning void

Paul Cercueil <[email protected]>
mfd: sm501: Remove #ifdef guards for PM related functions

Dawei Feng <[email protected]>
wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()

Bryam Vargas <[email protected]>
wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

StanleyYP Wang <[email protected]>
wifi: mt76: mt7915: set correct background radar capability

Eric Dumazet <[email protected]>
vlan: fix skb_under_panic and races when toggling HW VLAN offload

David Rosca <[email protected]>
drm/amdgpu: Fix UVD dpb min size calculation for H264

Srinivasan Shanmugam <[email protected]>
drm/amd/amdgpu: Fix errors & warnings in amdgpu _uvd, _vce.c

Wei Fang <[email protected]>
net: tap: fix wrong transport_header when sending VLAN-tagged frame

Akihiko Odaki <[email protected]>
tap: Keep hdr_len in tap_get_user()

Leon Romanovsky <[email protected]>
ntb: Store original DMA address for future release

Koichiro Den <[email protected]>
NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers

Koichiro Den <[email protected]>
NTB: core: Add .get_dma_dev() callback to ntb_dev_ops

Eric Dumazet <[email protected]>
tipc: avoid busy looping in tipc_exit_net()

Ibrahim Hashimov <[email protected]>
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

Yong Wang <[email protected]>
tcp: clamp route advmss to TCP_MIN_MSS

Kyle Zeng <[email protected]>
net/packet: defer vmalloc TX_RING free until skbs finish

Fourie Zhang <[email protected]>
netfilter: nf_tables: don't queue packet path object notifications

Bryam Vargas <[email protected]>
crypto: virtio - bound the akcipher result length

Lukas Wunner <[email protected]>
crypto: virtio - Drop superfluous [as]kcipher_req pointer

Lukas Wunner <[email protected]>
crypto: virtio - Drop superfluous [as]kcipher_ctx pointer

Lukas Wunner <[email protected]>
crypto: virtio - Drop sign/verify operations

Markus Elfring <[email protected]>
crypto: virtio - Less function calls in __virtio_crypto_akcipher_do_req() after error detection

Thomas Zimmermann <[email protected]>
fbdev: Wrap user-invoked calls to fb_set_var() in helper

Ali Ahmet Memis <[email protected]>
Bluetooth: ISO: zero the sockaddr before returning it in getname

Bryam Vargas <[email protected]>
selinux: reject a permission value exceeding the class permission count

William Palacek <[email protected]>
drm/amdkfd: Add bounds check for CRAT subtype length

Yongqiang Sun <[email protected]>
drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length

Shay Drory <[email protected]>
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock

Luxiao Xu <[email protected]>
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie

Stefan Haberland <[email protected]>
s390/dasd: Fix undersized format-check buffer

Heiko Carstens <[email protected]>
s390: include linux/io.h instead of asm/io.h

Baoquan He <[email protected]>
s390/mm: do not include <asm-generic/io.h> directly

Thomas Richter <[email protected]>
s390/cpum_sf: move functions from header file to source file

Heiko Carstens <[email protected]>
s390/appldata: remove power management callbacks

Yuho Choi <[email protected]>
dmaengine: idxd: fix double free of wq, engine, and group structs

Guenter Roeck <[email protected]>
hwmon: (sht3x) Fix unaligned accesses

Chenguang Zhao <[email protected]>
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller

Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: use conntrack GC to reap expectations

Prasanna Kumar T S M <[email protected]>
soc: xilinx: Shutdown and free rx mailbox channel

Uwe Kleine-König <[email protected]>
soc/xilinx: zynqmp_power: Convert to platform remove callback returning void

Yihang Li <[email protected]>
scsi: hisi_sas: Add slave_destroy interface for v3 hw

Yuho Choi <[email protected]>
media: atomisp: gc2235: fix UAF and memory leak

Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix call trace due to missing release()

Fernando Fernandez Mancera <[email protected]>
netfilter: synproxy: fix unaligned memory access in timestamp adjustment

Fernando Fernandez Mancera <[email protected]>
netfilter: synproxy: adjust duplicate timestamp options

Fernando Fernandez Mancera <[email protected]>
netfilter: synproxy: drop packets if timestamp adjustment fails

Florian Westphal <[email protected]>
netfilter: make nftables drops visible in net dropmonitor

David Carlier <[email protected]>
netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

Weiming Shi <[email protected]>
btrfs: lzo: reject compressed segment that overflows the compressed input

Ratheesh Kannoth <[email protected]>
octeontx2-af: npc: Fix size of entry2cntr_map

Cen Zhang <[email protected]>

    ALSA: seq: oss: Serialize readq reset state with q->lock

James Clark <[email protected]>
coresight: ete: Always save state on power down

Ivan Abramov <[email protected]>

    ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()

Li RongQing <[email protected]>
ACPI: processor_idle: Mark LPI enter functions as __cpuidle

Matthieu Baerts (NGI0) <[email protected]>
mptcp: avoid combining some incoming suboptions

Candice Li <[email protected]>
drm/amdgpu: reject oversized IBs with per-ring packet limits

Eric Farman <[email protected]>
s390/vfio_ccw: Limit the number of channel program segments

Mark Brown <[email protected]>
ASoC: tas2562: Validate values for volume writes

Hongjie Fang <[email protected]>
scsi: core: pair EH runtime PM get and put

Julian Anastasov <[email protected]>
ipvs: revalidate ihl to prevent out-of-bounds access

Jamal Hadi Salim <[email protected]>

    net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain

Victor Nogueira <[email protected]>
net: sched: Add initial TC error skb drop reasons

Victor Nogueira <[email protected]>
net: sched: Move drop_reason to struct tc_skb_cb

Jamal Hadi Salim <[email protected]>
net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config

Daniel Borkmann <[email protected]>
net, sched: Make tc-related drop reason more flexible

Eric Dumazet <[email protected]>
l2tp: fix tunnel and session refcount leak on seq_file release

Mark Tomlinson <[email protected]>
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

Karthikeyan KS <[email protected]>
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read

David Lee <[email protected]>
btrfs: lzo: reject inline extents without valid headers

Chengfeng Ye <[email protected]>
bpf: Fix netns reference imbalance in conntrack kfuncs

Linfeng Sun  <[email protected]>
vhost_iotlb: bound map allocation in add_range

Jamal Hadi Salim <[email protected]>
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers

Xin Long <[email protected]>
net: sched: refine software bypass handling in tc_run

Jianbo Liu <[email protected]>
net: sched: cls_api: fix slab-use-after-free in fl_dump_key

Asbjørn Sloth Tønnesen <[email protected]>
net: sched: cls_api: add filter counter

Asbjørn Sloth Tønnesen <[email protected]>
net: sched: cls_api: add skip_sw counter

Eric Dumazet <[email protected]>
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

Alexandra Winter <[email protected]>
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()

Hongyan Xu <[email protected]>
watchdog: at91sam9_wdt: prevent timer rearm during teardown

Dongli Zhang <[email protected]>

    net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

Jérémy Jean <[email protected]>
tls: rx: restore msg_iter before TLS 1.3 optimistic retry

Sabrina Dubroca <[email protected]>
selftests: tls: add rekey tests

Sabrina Dubroca <[email protected]>
selftests: tls: add test with a partially invalid iov

Sabrina Dubroca <[email protected]>
selftests: tls: add getsockopt test

Zhiling Zou <[email protected]>
mm/page_table_check: skip special zero mappings

Lorenzo Stoakes (ARM) <[email protected]>
mm/ptdump: always stabilise against page table freeing using init_mm

Dongjiang Zhu <[email protected]>
btrfs: skip global block reserve accounting for rescue mounts

Cen Zhang (Microsoft) <[email protected]>
net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds

Eric Dumazet <[email protected]>
net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()

Pauli Virtanen <[email protected]>
Bluetooth: ISO: hold sk properly in iso_conn_ready

Hariprasad Kelam <[email protected]>
octeontx2-af: Block VFs from clobbering special CGX PKIND state

Harald Freudenberger <[email protected]>
s390/zcrypt: Close speculative mem read possibility

Zack Rusin <[email protected]>
drm/vmwgfx: reject DX_BIND_QUERY without a DX context

Werner Kasselman <[email protected]>
drm/radeon: fix integer overflow in radeon_align_pitch()

Wei Zhang <[email protected]>
wifi: ath11k: cancel SSR work items during PCI shutdown

Di Shen <[email protected]>
OPP: Fix race between OPP addition and lookup

Alexander Aring <[email protected]>
dlm: fix add msg handle in send_queue ordered

Prathamesh Deshpande <[email protected]>
IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier

Pengpeng Hou <[email protected]>
tracing: Bound synthetic-field strings with seq_buf

Kees Cook <[email protected]>
seq_buf: Introduce DECLARE_SEQ_BUF and seq_buf_str()

Matthew Wilcox (Oracle) <[email protected]>
tracing: Move readpos from seq_buf to trace_seq

Sergey Senozhatsky <[email protected]>
seq_buf: Add seq_buf_do_printk() helper

Lianfa Weng <[email protected]>
RDMA/hns: Fix log flood after cmd_mbox failure

Takashi Iwai <[email protected]>
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data

Geliang Tang <[email protected]>
nvmet-tcp: fix page fragment cache leak in error path

Michael S. Tsirkin <[email protected]>
vhost: fix vhost_get_avail_idx for a non empty ring

Michael S. Tsirkin <[email protected]>
vhost: move smp_rmb() into vhost_get_avail_idx()

Xianting Tian <[email protected]>
vhost: correct misleading printing information

Zhang Cen <[email protected]>
ocfs2: validate fast symlink target during inode read

Pablo Neira Ayuso <[email protected]>
netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount

Bernard Metzler <[email protected]>
RDMA/siw: Fix endpoint/socket association handling

Guoqing Jiang <[email protected]>
RDMA/siw: Introduce siw_destroy_cep_sock

Filipe Manana <[email protected]>
btrfs: fix deadlock cloning inline extent when using flushoncommit

Larysa Zaremba <[email protected]>
ixgbe: do not configure xps for XDP queues

Aditya Prakash Srivastava <[email protected]>
ext4: fix kernel BUG in ext4_write_inline_data_end

Yun Zhou <[email protected]>
ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT

Cássio Gabriel <[email protected]>
ASoC: topology: Check PCM and DAI name strings before use

HanQuan <[email protected]>
ALSA: seq: Fix kernel heap address leak in bounce_error_event()

Takashi Iwai <[email protected]>
ALSA: seq: Drop superfluous filter argument of get_event_dest_client()

Joe Damato <[email protected]>
bnxt: fix head underflow on XDP head-grow

Cen Zhang <[email protected]>
ALSA: seq: avoid stale FIFO cells during resize

Takashi Iwai <[email protected]>
ALSA: seq: Clean up fifo locking with guard

Takashi Iwai <[email protected]>
ALSA: seq: fifo: Use guard() for locking

Kuniyuki Iwashima <[email protected]>
sockmap: Fix use-after-free in udp_bpf_recvmsg()

Jacob Moroni <[email protected]>
RDMA/irdma: Replace waitqueue and flag with completion

Baoli.Zhang <[email protected]>
soundwire: fix bug in sdw_add_element_group_count found by syzkaller

Yang Erkun <[email protected]>

    nfs: use nfsi->rwsem to protect traversal of the file lock list

Abd-Alrhman Masalkhi <[email protected]>
md/raid1: fix writes_pending and barrier reference leaks on write failures

Abd-Alrhman Masalkhi <[email protected]>
md/raid10: fix writes_pending leak on write request failures

John Garry <[email protected]>
md/raid10: Handle bio_split() errors

Abd-Alrhman Masalkhi <[email protected]>
md/raid10: fix writes_pending and barrier reference leaks on discard failures

Yiyang Chen <[email protected]>
bpf: Guard conntrack opts error writes

Chen Cheng <[email protected]>
md/raid5: avoid R5_Overlap races while breaking stripe batches

Florian Westphal <[email protected]>
netfilter: nft_compat: ebtables emulation must reject non-bridge targets

Eric Dumazet <[email protected]>
net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync

Eric Dumazet <[email protected]>
tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()

Xin Long <[email protected]>
sctp: add INIT verification after cookie unpacking

Xin Long <[email protected]>
sctp: fix addr_wq_timer race in sctp_free_addr_wq()

Haofeng Li <[email protected]>
ksmbd: reject undersized DACLs before parsing ACEs

Michael Bommarito <[email protected]>

    xen/pvcalls: bound backend response req_id before indexing rsp[]

Christian Brauner <[email protected]>
fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid

David Howells <[email protected]>

    afs: Fix reinitialisation of the inode, in particular ->lock_work

Feng Liu <[email protected]>

    net/mlx5e: Fix publication race for priv->channel_stats[]

Jamal Hadi Salim <[email protected]>
net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload

Cen Zhang <[email protected]>
Bluetooth: 6lowpan: avoid untracked enable work

Yuho Choi <[email protected]>
net/liquidio: drop cached VF pci_dev LUT

Sandipan Das <[email protected]>
perf/x86/amd/core: Avoid enabling BRS from the SVM reload path

Eric Dumazet <[email protected]>
ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()

Tamaki Yanagawa <[email protected]>
netfilter: nft_lookup: fix catchall element handling with inverted lookups

Theodor Arsenij Larionov-Trichkine <[email protected]>
netfilter: nft_fib: reject fib expression on the netdev egress hook

Deepanshu Kartikey <[email protected]>
mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

Matthew Wilcox (Oracle) <[email protected]>
fs: Remove NTFS classic

Florian Fuchs <[email protected]>
mtd: maps: vmu-flash: fix fault in unaligned fixup

Ian Bridges <[email protected]>
ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

Deepanshu Kartikey <[email protected]>
ocfs2: validate i_refcount_loc when refcount flag is set

Dmitry Antipov <[email protected]>
ocfs2: add extra consistency checks for chain allocator dinodes

Dmitry Antipov <[email protected]>
ocfs2: add suballoc slot check in ocfs2_validate_inode_block()

Julian Sun <[email protected]>
ocfs2: correct l_next_free_rec in online check

Koichiro Den <[email protected]>
dmaengine: dw-edma-pcie: Reject devices without driver data

Haoxiang Li <[email protected]>
platform/x86: dell-laptop: fix missing cleanups in init error path

Lyndon Sanche <[email protected]>
platform/x86: dell-smbios: Move request functions for reuse

Armin Wolf <[email protected]>
ACPI: battery: Pass battery hook pointer to hook callbacks

Michael Bommarito <[email protected]>
nvmet-auth: reject short AUTH_RECEIVE buffers

Damien Le Moal <[email protected]>
nvmet: Introduce nvmet_req_transfer_len()

Mikulas Patocka <[email protected]>
dm-ioctl: fix a possible overflow in list_version_get_info

Heinz Mauelshagen <[email protected]>
dm: avoid spaces before function arguments or in favour of tabs

Mikulas Patocka <[email protected]>
dm ioctl: a small code cleanup in list_version_get_info

Mikulas Patocka <[email protected]>
dm-verity: fix buffer overflow in FEC calculation

Martin Kaiser <[email protected]>
riscv: probes: save original sp in rethook trampoline

Guoniu Zhou <[email protected]>
pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI

Peng Fan <[email protected]>
pmdomain: imx: Fix i.MX8MP VC8000E power up sequence

Zhao Li <[email protected]>
wifi: ieee80211: validate MLE common info length

Harald Freudenberger <[email protected]>
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning

Amir Goldstein <[email protected]>
ovl: check access to copy_file_range source with src mounter creds

Linmao Li <[email protected]>
drm/vc4: Prevent shader BO mappings from becoming writable

Jamal Hadi Salim <[email protected]>
net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains

George Guo <[email protected]>
LoongArch: Fix address space mismatch in kexec command line lookup

Petr Wozniak <[email protected]>

    xfrm: fix stale skb->prev after async crypto steals a GSO segment

Jacob Moroni <[email protected]>
RDMA/irdma: Prevent user-triggered null deref on QP create

Maoyi Xie <[email protected]>
wifi: mac80211: defer link RX stats percpu free to RCU

Sarika Sharma <[email protected]>
wifi: cfg80211: add link_station_info structure to support MLO statistics

Sarika Sharma <[email protected]>
wifi: mac80211: refactor populating mesh related fields in sinfo

Peddolla Harshavardhan Reddy <[email protected]>
wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock

Cen Zhang <[email protected]>
wifi: cfg80211: use wiphy work for socket owner autodisconnect

Mostafa Saleh <[email protected]>
firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()

Matt Bobrowski <[email protected]>
bpf: Fix UAF in sock clone early bailouts

David Jeffery <[email protected]>
scsi: core: wake eh reliably when using scsi_schedule_eh

Guanghui Feng <[email protected]>
iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()

Weiming Shi <[email protected]>
tipc: serialize udp bearer replicast list updates

Frank Sorenson <[email protected]>
cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths

Frank Sorenson <[email protected]>
cifs: prevent readdir from changing file size due to stale directory metadata

Gregor Herburger <[email protected]>
drm/vc4: hvs/v3d: Fix null dereference in unbind

Gal Pressman <[email protected]>
net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

Tvrtko Ursulin <[email protected]>
drm/amdgpu: Fix context pstate override handling

James Zhu <[email protected]>
drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure

David Francis <[email protected]>
drm/amdkfd: Check bounds on CRIU restore queue type and mqd size

Jani Nikula <[email protected]>
drm/i915/bios: range check LFP Data Block panel_type2

Joonas Lahtinen <[email protected]>
drm/i915/gt: Fix NULL deref on sched_engine alloc failure

Jani Nikula <[email protected]>
drm/i915/mst: limit DP MST ESI service loop

Mario Limonciello <[email protected]>
drm/amdgpu: Release VFCT ACPI table reference

Lijo Lazar <[email protected]>
drm/amdgpu: Add wrapper for freeing vbios memory

Lijo Lazar <[email protected]>
drm/amdgpu: Use dbg level for VBIOS check messages

Srinivasan Shanmugam <[email protected]>
drm/amd/amdgpu: Fix errors & warnings in amdgpu _bios, _cs, _dma_buf, _fence.c

Linmao Li <[email protected]>
drm/vc4: Shut down BO cache timer before teardown

Guangshuo Li <[email protected]>
media: vivid: fix cleanup bugs in vivid_init()

Yuxiang Yang <[email protected]>
tcp: challenge ACK for non-exact RST in SYN-RECEIVED

Asad Kamal <[email protected]>
drm/amdgpu: fix aperture mapping leak

Namjae Jeon <[email protected]>
ksmbd: bound DACL dedup walk to copied ACEs

Davide Ornaghi <[email protected]>
ksmbd: fix path resolution in ksmbd_vfs_kern_path_create

Sean Christopherson <[email protected]>
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state

Taeyang Lee <[email protected]>
perf/core: Detach event groups during remove_on_exec

Cássio Gabriel <[email protected]>
ALSA: hda/cs35l41: Fix firmware load work teardown

Myeonghun Pak <[email protected]>
usb: typec: tcpci_rt1711h: unregister TCPCI port with devres

Breno Leitao <[email protected]>
netpoll: fix a use-after-free on shutdown path

Namjae Jeon <[email protected]>
ksmbd: prevent path traversal bypass by restricting caseless retry

Namjae Jeon <[email protected]>
ksmbd: use opener credentials for delete-on-close

Namjae Jeon <[email protected]>
ksmbd: use opener credentials for ADS I/O

Haofeng Li <[email protected]>
ksmbd: validate NTLMv2 response before updating session key

Ralph Boehme <[email protected]>
smb/client: fix chown/chgrp with SMB3 POSIX Extensions

Dawei Feng <[email protected]>
usb: free iso schedules on failed submit

Xu Rao <[email protected]>
usb: gadget: f_printer: take kref only for successful open

Andrzej Pietrasiewicz <[email protected]>
usb: gadget: function: Simplify diagnostic messaging in printer

Johan Hovold <[email protected]>
USB: iowarrior: fix use-after-free on disconnect race

Bryam Vargas <[email protected]>
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

Tianchu Chen <[email protected]>
nvmet-auth: validate reply message payload bounds against transfer length

Hannes Reinecke <[email protected]>
nvmet: return DHCHAP status codes from nvmet_setup_auth()

Ahsan Atta <[email protected]>
crypto: qat - protect service table iterations with service_lock

Guenter Roeck <[email protected]>
hwmon: (lm90) Add lock protection to lm90_alert

Martin Kaiser <[email protected]>
test_kprobes: clear kprobes between test runs

Jia Zhu <[email protected]>
erofs: fix metabuf leak in inode xattr initialization

Jiajia Liu <[email protected]>

    Bluetooth: btmtk: fix urb->setup_packet leak in error paths

Junyi Liu <[email protected]>
ksmbd: validate SID in parent security descriptor during ACL inheritance

Florian Westphal <[email protected]>
netfilter: ebtables: move to two-stage removal scheme

Florian Westphal <[email protected]>
netfilter: bridge: eb_tables: close module init race

Guenter Roeck <[email protected]>
hwmon: (lm90) Stop work before releasing hwmon device

Xingwang Xiang <[email protected]>
bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

Keith Busch <[email protected]>
blk-mq: pop cached request if it is usable

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_tables: fix dst corruption in same register operation

Phil Sutter <[email protected]>
netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters

Heitor Alves de Siqueira <[email protected]>
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

Greg Kroah-Hartman <[email protected]>
usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers

Greg Kroah-Hartman <[email protected]>

    usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()

Greg Kroah-Hartman <[email protected]>
usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT

Sean Christopherson <[email protected]>
KVM: SEV: Ignore Port I/O requests of length '0'

SeungJu Cheon <[email protected]>
Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring

Ian Bridges <[email protected]>
fbdev: fix use-after-free in store_modes()

Konstantin Khorenko <[email protected]>
gcov: use atomic counter updates to fix concurrent access crashes

Hongling Zeng <[email protected]>
fbdev: omap2: fix use-after-free in omapfb_mmap

Hongling Zeng <[email protected]>
fbdev: omap2: fix inconsistent lock returns in omapfb_mmap

Anna Maniscalco <[email protected]>
drm/msm: always recover the gpu

Alysa Liu <[email protected]>
drm/amdkfd: Add upper bound check for num_of_nodes

Yongpeng Yang <[email protected]>
f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage

Sean Christopherson <[email protected]>
KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying

Harry Wentland <[email protected]>
drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()

Rory Little <[email protected]>
wifi: mt76: mt7921: Place upper limit on station AID

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths

Stylon Wang <[email protected]>
drm/amd/display: Add interface to enable DPIA trace

Erni Sri Satya Vennela <[email protected]>
net: mana: Guard mana_remove against double invocation

Morduan Zang <[email protected]>
net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind

Qu Wenruo <[email protected]>
btrfs: only release the dirty pages io tree after successful writes

Gao Xiang <[email protected]>

    erofs: fix use-after-free on sbi->sync_decompress

Jiayuan Chen <[email protected]>
netfilter: nft_ct: bail out on template ct in get eval

Lee Jones <[email protected]>
l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()

Fedor Pchelkin <[email protected]>
wifi: fix leak if split 6 GHz scanning fails

Yun Zhou <[email protected]>
gpio: mvebu: fix NULL pointer dereference in suspend/resume

Uwe Kleine-König <[email protected]>
gpio: mvebu: Use IS_REACHABLE instead of IS_ENABLED for CONFIG_PWM

Maxime Chevallier <[email protected]>
net: phy: clean the sfp upstream if phy probing fails

Dragos Tatulea <[email protected]>
net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list

Shay Drory <[email protected]>
net/mlx5: Add generic getters for other functions caps

Dragos Tatulea <[email protected]>
net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure

Xin Long <[email protected]>
sctp: validate embedded INIT chunk and address list lengths in cookie

HyungJung Joo <[email protected]>
fs/mbcache: cancel shrink work before destroying the cache

Filipe Manana <[email protected]>
btrfs: fix deadlock between reflink and transaction commit when using flushoncommit

Ritesh Harjani (IBM) <[email protected]>
powerpc/64s: Fix unmap race with PMD migration entries

Zilin Guan <[email protected]>
wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()

Sechang Lim <[email protected]>
bpf: Fix RCU stall in bpf_fd_array_map_clear()

Lang Xu <[email protected]>
bpf: Fix OOB in pcpu_init_value

Xin Long <[email protected]>
sctp: disable BH before calling udp_tunnel_xmit_skb()

Vasant Hegde <[email protected]>
iommu/amd: Fix clone_alias() to use the original device's devid

Deepanshu Kartikey <[email protected]>
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()

Damien Riégel <[email protected]>
greybus: raw: fix use-after-free on cdev close

Jianan Huang <[email protected]>
f2fs: avoid reading already updated pages during GC

Yongpeng Yang <[email protected]>
f2fs: fix data loss caused by incorrect use of nat_entry flag

Gao Xiang <[email protected]>
erofs: unify lcn as u64 for 32-bit platforms

Michal Schmidt <[email protected]>
ice: fix double-free of tx_buf skb

Pablo Neira Ayuso <[email protected]>
netfilter: nat: use kfree_rcu to release ops

Edward Adam Davis <[email protected]>
sched/psi: fix race between file release and pressure write

Amir Goldstein <[email protected]>
fsnotify: fix inode reference leak in fsnotify_recalc_mask()

Viacheslav Dubeyko <[email protected]>
ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size

Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()

Weiming Shi <[email protected]>
tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR

Haixin Xu <[email protected]>
crypto: jitterentropy - replace long-held spinlock with mutex

Stephan Müller <[email protected]>
crypto: jitter - replace LFSR with SHA3-256

D. Wythe <[email protected]>
Revert "net/smc: Introduce TCP ULP support"

Florian Westphal <[email protected]>
netfilter: nf_tables: use list_del_rcu for netlink hooks

Janne Grunau <[email protected]>
media: videobuf2: Set vma_flags in vb2_dma_sg_mmap

Stephen Smalley <[email protected]>
selinux: allow multiple opens of /sys/fs/selinux/policy

Helge Deller <[email protected]>
AppArmor: Allow apparmor to handle unaligned dfa tables

Johan Hovold <[email protected]>
spi: mpc52xx: fix use-after-free on registration failure

Amir Shetaia <[email protected]>
drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure

Johan Hovold <[email protected]>
spi: fsl: fix controller deregistration

Yang Yingliang <[email protected]>
spi: fsl-spi: switch to use modern name

Uwe Kleine-König <[email protected]>
spi: fsl-spi: Convert to platform remove callback returning void

Johan Hovold <[email protected]>
spi: rspi: fix controller deregistration

Uwe Kleine-König <[email protected]>
spi: rspi: Convert to platform remove callback returning void

Benjamin Cheng <[email protected]>
drm/amdgpu/vcn4: Prevent OOB reads when parsing IB

David Rosca <[email protected]>
drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages

David (Ming Qiang) Wu <[email protected]>
drm/amdgpu: limit AV1 to the first instance on VCN4 encode

Johan Hovold <[email protected]>
spi: mpc52xx: fix controller deregistration

Yang Yingliang <[email protected]>
spi: mpc52xx: switch to use modern name

Uwe Kleine-König <[email protected]>
spi: mpc52xx: Convert to platform remove callback returning void

Jason Gunthorpe <[email protected]>
RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

Takashi Iwai <[email protected]>
ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger

Conor Dooley <[email protected]>
spi: microchip-core-qspi: control built-in cs manually

Yosry Ahmed <[email protected]>
KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12

Yosry Ahmed <[email protected]>
KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN

Yosry Ahmed <[email protected]>
KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT

David Howells <[email protected]>
rxrpc: Fix memory leaks in rxkad_verify_response()

David Howells <[email protected]>
rxrpc: Fix conn-level packet handling to unshare RESPONSE packets

Zhang Yi <[email protected]>
ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O

Deepanshu Kartikey <[email protected]>
gfs2: fix memory leaks in gfs2_fill_super error path

Yao Kai <[email protected]>
rcu: Fix rcu_read_unlock() deadloop due to softirq

Lianjie Wang <[email protected]>
hwrng: core - use RCU and work_struct to fix race condition

Lu Baolu <[email protected]>
iommu/vt-d: Clear Present bit before tearing down context entry

Yongjian Sun <[email protected]>
ext4: fix e4b bitmap inconsistency reports

Matthew Wilcox (Oracle) <[email protected]>
ext4: convert bd_buddy_page to bd_buddy_folio

Matthew Wilcox (Oracle) <[email protected]>
ext4: convert bd_bitmap_page to bd_bitmap_folio

Gou Hao <[email protected]>
ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock()

Theodore Ts'o <[email protected]>
ext4: convert some BUG_ON's in mballoc to use WARN_RATELIMITED instead

Kemeng Shi <[email protected]>

    ext4: remove unnecessary e4b->bd_buddy_page check in ext4_mb_load_buddy_gfp

Jie Zhang <[email protected]>
net: stmmac: fix oops when split header is enabled

Boris Burkov <[email protected]>
btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation

Julian Anastasov <[email protected]>
ipvs: do not keep dest_dst if dev is going down

Zhang Yi <[email protected]>
ext4: drop extent cache when splitting extent fails

Lu Baolu <[email protected]>
iommu/vt-d: Clear Present bit before tearing down PASID entry

Helge Deller <[email protected]>
apparmor: Fix & Optimize table creation from possibly unaligned memory

Ryan Lin <[email protected]>
HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients

Even Xu <[email protected]>
HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend

Damien Le Moal <[email protected]>
ata: libata-scsi: avoid Non-NCQ command starvation

Shota Zaizen <[email protected]>
ksmbd: validate inherited ACE SID length

Jiayuan Chen <[email protected]>
bonding: fix type confusion in bond_setup_by_slave()

Chen Ni <[email protected]>
ASoC: amd: acp-mach-common: Add missing error check for clock acquisition

Venkata Prasad Potturu <[email protected]>
ASoC: amd: acp: Refactor i2s clocks programming sequence

Venkata Prasad Potturu <[email protected]>
ASoC: amd: acp: Refactor dai format implementation

Venkata Prasad Potturu <[email protected]>
ASoC: amd: acp: Add setbias level for rt5682s codec in machine driver

Max Kellermann <[email protected]>
ceph: fix memory leaks in ceph_mdsc_build_path()

Vladimir Riabchun <[email protected]>
scsi: qla2xxx: Completely fix fcport double free

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Fix race in DMA ring dequeue

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue

Zide Chen <[email protected]>
perf/x86/intel/uncore: Fix die ID init and look up bugs

Filipe Manana <[email protected]>
btrfs: reserve enough transaction items for qgroup ioctls

Ming Qian <[email protected]>
media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC

Nicolas Dufresne <[email protected]>
media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure

Sebastian Reichel <[email protected]>
media: hantro: Disable multicore support

Filipe Manana <[email protected]>
btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()

Qu Wenruo <[email protected]>
btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()

Jiasheng Jiang <[email protected]>
md-cluster: fix NULL pointer dereference in process_metadata_update

Magnus Lindholm <[email protected]>
alpha: fix user-space corruption during memory compaction

Arnd Bergmann <[email protected]>
arch: turn off -Werror for architectures with known warnings

Ankit Soni <[email protected]>
iommu/amd: move wait_on_sem() out of spinlock

Mario Peter <[email protected]>
usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()

Stefano Stabellini <[email protected]>
9p/xen: protect xen_9pfs_front_free against concurrent calls

Eugenio Pérez <[email protected]>
vhost: move vdpa group bound check to vhost_vdpa

Jiayuan Chen <[email protected]>
kcm: fix zero-frag skb in frag_list on partial sendmsg error

Henrique Carvalho <[email protected]>

    smb: client: prevent races in ->query_interfaces()

Tetsuo Handa <[email protected]>
team: avoid NETDEV_CHANGEMTU event when unregistering slave

Shyam Prasad N <[email protected]>
cifs: Fix locking usage for tcon fields

Ping-Ke Shih <[email protected]>
wifi: rtw89: pci: validate sequence number of TX release report

Cédric Bellegarde <[email protected]>
ASoC: qcom: q6asm: drop DSP responses for closed data streams

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6asm: handle the responses after closing

Nicholas Carlini <[email protected]>
ksmbd: fix signededness bug in smb_direct_prepare_negotiation()

Prashanth K <[email protected]>
usb: dwc3: gadget: Move vbus draw to workqueue context

Tetsuo Handa <[email protected]>
xfrm: always flush state and policy upon NETDEV_UNREGISTER event

Christoph Hellwig <[email protected]>
xfs: remove xfs_attr_leaf_hasname

Harshit Mogalapalli <[email protected]>
ima: verify the previous kernel's IMA buffer lies in addressable RAM

Takashi Iwai <[email protected]>
ALSA: mixer: oss: Add card disconnect checkpoints

Cen Zhang <[email protected]>

    Bluetooth: hci_sync: annotate data-races around hdev->req_status

Filipe Manana <[email protected]>
btrfs: fix zero size inode with non-zero size after log replay

Keenan Dong <[email protected]>
xfrm: account XFRMA_IF_ID in aevent size calculation

Eric Dumazet <[email protected]>
ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()

Steffen Klassert <[email protected]>
xfrm: Wait for RCU readers during policy netns exit

Justin Iurman <[email protected]>
net: ioam6: fix OOB and missing lock

Lee Jones <[email protected]>
HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure

Lee Jones <[email protected]>
HID: core: Mitigate potential OOB by removing bogus memset()

Li Chen <[email protected]>
HID: rate-limit hid_warn to prevent log flooding

Tatsuya S <[email protected]>
HID: core: Add reserved item tag for main items

Sabrina Dubroca <[email protected]>
mpls: add seqcount to protect the platform_label{,s} pair

Guoyu Su <[email protected]>
net: use skb_header_pointer() for TCPv4 GSO frag_off check

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists

Kuniyuki Iwashima <[email protected]>

    bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().

Varun R Mallya <[email protected]>
bpf: Reject sleepable kprobe_multi programs at attach time

Daniel Borkmann <[email protected]>
bpf: Fix incorrect pruning due to atomic fetch precision tracking

Oleh Konko <[email protected]>
Bluetooth: hci_event: move wake reason storage into validated event handlers

Ville Syrjälä <[email protected]>
drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode

Kuen-Han Tsai <[email protected]>
usb: gadget: f_ecm: Fix net_device lifecycle with device_move

Kuen-Han Tsai <[email protected]>
usb: gadget: f_eem: Fix net_device lifecycle with device_move

Kuen-Han Tsai <[email protected]>
usb: gadget: f_subset: Fix net_device lifecycle with device_move

Kuen-Han Tsai <[email protected]>
usb: gadget: f_rndis: Fix net_device lifecycle with device_move

Michael Bommarito <[email protected]>
ksmbd: validate response sizes in ipc_validate_msg()

Michael Bommarito <[email protected]>
ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()

Douya Le <[email protected]>
crypto: af_alg - limit RX SG extraction by receive buffer budget

Yucheng Lu <[email protected]>
net/sched: sch_netem: fix out-of-bounds access in packet corruption

Qi Tang <[email protected]>
xfrm: hold dev ref until after transport_finish NF_HOOK

Jacky Bai <[email protected]>
pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled

Michael Zimmermann <[email protected]>
usb: gadget: f_hid: don't call cdev_init while cdev in use

Sean Christopherson <[email protected]>

    KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock

Ge Yang <[email protected]>
KVM: SEV: Use long-term pin when registering encrypted memory regions

Janosch Frank <[email protected]>
s390/mm: Add missing secure storage access fixups for donated memory

Vladimir Yakovlev <[email protected]>
spi: spi-dw-dma: fix print error log when wait finish transaction

Chaitanya Kulkarni <[email protected]>
nvmet: move async event work off nvmet-wq

Kohei Enju <[email protected]>
iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()

Jiayuan Chen <[email protected]>
team: fix header_ops type confusion with non-Ethernet ports

Guenter Roeck <[email protected]>
hwmon: (pmbus/core) Protect regulator operations with mutex

Eric Huang <[email protected]>
drm/amdgpu: prevent immediate PASID reuse case

Christophe JAILLET <[email protected]>
drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API

Asim Viladi Oglu Manizada <[email protected]>
ksmbd: fix OOB write in QUERY_INFO for compound requests

Namjae Jeon <[email protected]>
ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION

Jiayuan Chen <[email protected]>
serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

Filipe Manana <[email protected]>
btrfs: log new dentries when logging parent dir of a conflicting inode

Allison Henderson <[email protected]>
net/rds: Fix circular locking dependency in rds_tcp_tune

Fuad Tabba <[email protected]>
bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing

Chaitanya Kulkarni <[email protected]>
blktrace: fix __this_cpu_read/write in preemptible context

Juri Lelli <[email protected]>
sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting

Niklas Cassel <[email protected]>
PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry

Jakub Kicinski <[email protected]>
nfc: nci: complete pending data exchange on device close

Davidlohr Bueso <[email protected]>
cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()

Eric Dumazet <[email protected]>
tcp: secure_seq: add back ports to TS offset

Namjae Jeon <[email protected]>
ksmbd: add chann_lock to protect ksmbd_chann_list xarray

Qu Wenruo <[email protected]>
btrfs: reject new transactions if the fs is fully read-only

Perry Yuan <[email protected]>
drm/amd/pm: Disable MMIO access during SMU Mode 1 reset

Edward Adam Davis <[email protected]>
ALSA: usb-audio: Prevent excessive number of frames

Breno Leitao <[email protected]>
spi: tegra210-quad: Protect curr_xfer check in IRQ handler

Nikolay Aleksandrov <[email protected]>
bonding: fix use-after-free due to enslave fail after slave array update

Steven Rostedt <[email protected]>
tracing: Add recursion protection in kernel stack trace recording

Zilin Guan <[email protected]>
of: unittest: Fix memory leak in unittest_data_add()

David Howells <[email protected]>
rxrpc: Fix data-race warning and potential load/store tearing

Trond Myklebust <[email protected]>
pNFS: Fix a deadlock when returning a delegation during open()

Eric Dumazet <[email protected]>
dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

Jie Zhang <[email protected]>
drm/msm: Recover HW before retire hung submit

Cong Nguyen <[email protected]>
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths

Haotian Zhang <[email protected]>
PCI: endpoint: Add missing NULL check for alloc_workqueue()

Konstantin Komarov <[email protected]>
fs/ntfs3: handle attr_set_size() errors when truncating files

Manivannan Sadhasivam <[email protected]>
net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels

Bitterblue Smith <[email protected]>
wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()

Ping-Ke Shih <[email protected]>
wifi: rtw88: debugfs: support multiple adapters debugging

Johannes Berg <[email protected]>
wifi: mac80211: don't WARN for connections on invalid channels

Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection

Lorenzo Bianconi <[email protected]>
iio: imu: st_lsm6dsx: fix LSM6DSV sensor description

Loic Poulain <[email protected]>
phy: qcom-qusb2: Fix NULL pointer dereference on early suspend

Miquel Sabaté Solà <[email protected]>
btrfs: fix NULL dereference on root when tracing inode eviction

Vladimir Oltean <[email protected]>
net: dsa: properly keep track of conduit reference

Nikolay Kuratov <[email protected]>
drm/msm/dpu: Add missing NULL pointer check for pingpong interface

Gregory CLEMENT <[email protected]>
MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits

Al Viro <[email protected]>
functionfs: fix the open/removal races

Al Viro <[email protected]>
functionfs, gadgetfs: use simple_recursive_removal()

Paul Cercueil <[email protected]>
usb: gadget: functionfs: Factorize wait-for-endpoint code

Paul Cercueil <[email protected]>
usb: gadget: Support already-mapped DMA SGs

Linyu Yuan <[email protected]>
usb: gadget: ffs: remove ENTER() macro

Minseong Kim <[email protected]>
Input: lkkbd - disable pending work before freeing device

Joshua Rogers <[email protected]>
svcrdma: bound check rq_pages index in inline path

Duoming Zhou <[email protected]>
Input: alps - fix use-after-free bugs caused by dev3_register_work

Qianchang Zhao <[email protected]>
ksmbd: vfs: fix race on m_flags in vfs_cache

Johan Hovold <[email protected]>
staging: most: remove broken i2c driver

Tony Battersby <[email protected]>
scsi: qla2xxx: Clear cmds after chip reset

Zhu Yanjun <[email protected]>

    RDMA/rxe: Fix null deref on srq->rq.queue after resize failure

Arnaud Lecomte <[email protected]>
bpf: Fix stackmap overflow check in __bpf_get_stackid()

Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data

Duoming Zhou <[email protected]>
scsi: imm: Fix use-after-free bug caused by unfinished delayed work

Horatiu Vultur <[email protected]>
lan966x: Fix sleeping in atomic context

Nitin Rawat <[email protected]>
scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)

Shaurya Rane <[email protected]>
cifs: fix memory leak in smb3_fs_context_parse_param error path

Akiva Goldberger <[email protected]>
mlx5: Fix default values in create CQ

Eric Dumazet <[email protected]>
tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()

Coiby Xu <[email protected]>
ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Do not share the name pointer between components

Oleksij Rempel <[email protected]>
net: stmmac: Correctly handle Rx checksum offload errors

Romain Gantois <[email protected]>
net: stmmac: Prevent DSA tags from breaking COE

Henrique Carvalho <[email protected]>
smb: client: fix potential UAF in smb2_close_cached_fid()

Xiao Ni <[email protected]>
md/raid10: wait barrier before returning discard request with REQ_NOWAIT

Moti Haimovski <[email protected]>
accel/habanalabs: support mapping cb with vmalloc-backed coherent memory

Christian König <[email protected]>
drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM

Lijo Lazar <[email protected]>
drm/amdgpu: Show vram vendor only if available

Edward Adam Davis <[email protected]>
cifs: client: fix memory leak in smb3_fs_context_parse_param

Harini T <[email protected]>
mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop

Ben Levinsky <[email protected]>
mailbox: zynqmp: Move buffered IPI setup to of_match selected routine

Ben Levinsky <[email protected]>
mailbox: zynqmp: Move of_match structure closer to usage

Randy Dunlap <[email protected]>
mailbox: zynqmp-ipi: fix an Excess struct member kernel-doc warning

Rob Herring <[email protected]>
mailbox: Explicitly include correct DT includes

Rob Herring <[email protected]>
of: Move of_device_get_match_data() declaration

Rob Herring <[email protected]>
of: Move of_device_(add|register|unregister) to of_platform.h

Eric Dumazet <[email protected]>
net: use dst_dev_rcu() in sk_setup_caps()

Jason Andryuk <[email protected]>
xen/events: Return -EEXIST for bound VIRQs

Juergen Gross <[email protected]>
xen/events: modify internal [un]bind interfaces

Juergen Gross <[email protected]>
xen/events: drop xen_allocate_irqs_dynamic()

Juergen Gross <[email protected]>
xen/events: remove some simple helpers from events_base.c

Juergen Gross <[email protected]>
xen/events: reduce externally visible helper functions

Juergen Gross <[email protected]>
xen/events: avoid using info_for_irq() in xen_send_IPI_one()

Eric Dumazet <[email protected]>
ipv6: use RCU in ip6_output()

Chao Yu <[email protected]>
f2fs: fix to truncate first page in error path of f2fs_truncate()

Weili Qian <[email protected]>
crypto: hisilicon/qm - request reserved interrupt for virtual function

Chao Yu <[email protected]>
f2fs: fix to avoid overflow while left shift operation

Matthew Wilcox (Oracle) <[email protected]>
f2fs: Use a folio in f2fs_truncate_partial_cluster()

Eric Dumazet <[email protected]>
tcp_metrics: use dst_dev_net_rcu()

Seppo Takalo <[email protected]>
tty: n_gsm: Don't block input queue by waiting MSC

Daniel Starke <[email protected]>
tty: n_gsm: add parameters used with parameter negotiation

Daniel Starke <[email protected]>
tty: n_gsm: introduce macro for minimal unit size

Fangyu Yu <[email protected]>
RISC-V: KVM: Write hgatp register with valid mode bits

I Viswanath <[email protected]>
ptp: Add a upper bound on max_vclocks

Andy Shevchenko <[email protected]>
i915: Move list_count() to list.h as list_count_nodes() for broader use

Duoming Zhou <[email protected]>
net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work

Shuai Xue <[email protected]>
x86/mce: use is_copy_from_user() to determine copy-from-user context

Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix possible UAFs

[email protected] <[email protected]>
wifi: wilc1000: avoid buffer overflow in WID string configuration

Stefan Metzmacher <[email protected]>
smb: client: let recv_done verify data_offset, data_length and remaining_data_length

Stefan Metzmacher <[email protected]>

    smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)

Uladzislau Rezki (Sony) <[email protected]>
mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()

Duoming Zhou <[email protected]>
ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog

Ido Schimmel <[email protected]>
vxlan: Fix NPD when refreshing an FDB entry with a nexthop object

Ido Schimmel <[email protected]>
vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects

Ye Weihua <[email protected]>
trace/fgraph: Fix the warning caused by missing unregister notifier

Sreekanth Reddy <[email protected]>
bnxt_en: Fix memory corruption when FW resources change during ifdown

Aakash Kumar S <[email protected]>
xfrm: Duplicate SPI Handling

Kanglong Wang <[email protected]>
LoongArch: Optimize module load time by optimizing PLT/GOT counting

Jinjiang Tu <[email protected]>
mm/smaps: fix race between smaps_hugetlb_range and migration

Joel Fernandes <[email protected]>
rcu: Fix rcu_read_unlock() deadloop due to IRQ work

Halil Pasic <[email protected]>
s390/ism: fix concurrency management in ism_cmd()

Stefan Raspl <[email protected]>
s390/ism: Introduce struct ism_dmb

Ziyan Xu <[email protected]>
ksmbd: fix refcount leak causing resource not released

Siyang Liu <[email protected]>
drm/amd/display: fix a Null pointer dereference vulnerability

William Liu <[email protected]>
net/sched: Fix backlog accounting in qdisc_dequeue_internal

D. Wythe <[email protected]>
net/smc: fix UAF on smcsk after smc_listen_out()

Al Viro <[email protected]>
habanalabs: fix UAF in export_dmabuf()

Tomer Tayar <[email protected]>
habanalabs: fix dma-buf release handling if dma_buf_fd() fails

Ohad Sharabi <[email protected]>
habanalabs: helper function to validate export params

Ohad Sharabi <[email protected]>
habanalabs: remove support to export dmabuf from handle

Viacheslav Dubeyko <[email protected]>
hfs: fix general protection fault in hfs_find_init()

Matthew Wilcox (Oracle) <[email protected]>
highmem: add memcpy_to_folio() and memcpy_from_folio()

Vishal Moola (Oracle) <[email protected]>
pagemap: add filemap_grab_folio()

Jan Kara <[email protected]>
loop: Avoid updating block size under exclusive owner

Umio Yasuno <[email protected]>
drm/amd/pm: fix null pointer access

Yuezhang Mo <[email protected]>
exfat: add cluster chain loop check for dir

Yuezhang Mo <[email protected]>
exfat: remove unnecessary arguments from exfat_find_dir_entry()

Gabriele Monaco <[email protected]>
rv: Use strings in da monitors tracepoints

Edward Adam Davis <[email protected]>
fs/ntfs3: cancle set bad inode after removing name fails

Heiko Stuebner <[email protected]>
drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port

Al Viro <[email protected]>
xen: fix UAF in dmabuf_exp_from_pages()

Jianbo Liu <[email protected]>
net/mlx5e: Remove skb secpath if xfrm state is not found

Leon Romanovsky <[email protected]>
net/mlx5e: Provide intermediate pointer to access IPsec struct

wenglianfa <[email protected]>
RDMA/hns: Fix double destruction of rsv_qp

David Howells <[email protected]>
rxrpc: Fix bug due to prealloc collision

Maud Spierings <[email protected]>
iio: common: st_sensors: Fix use of uninitialize device structs

Kaustabh Chakraborty <[email protected]>
iio: st_sensors: relax WhoAmI check in st_sensors_verify_id()

Jonathan Cameron <[email protected]>
iio: st_sensors: core and lsm9ds0 switch to devm_regulator_bulk_get_enable()

David Howells <[email protected]>
rxrpc: Fix recv-recv race of completed call

Daniel J. Ogorchock <[email protected]>
HID: nintendo: avoid bluetooth suspend/resume stalls

Sumit Kumar <[email protected]>
bus: mhi: ep: Update read pointer only after buffer is written

Heiko Carstens <[email protected]>
s390/mm: Fix in_atomic() handling in do_secure_storage_access()

Longfang Liu <[email protected]>
hisi_acc_vfio_pci: bugfix live migration function without VF device driver

Jonas Gorski <[email protected]>
net: dsa: b53: do not enable EEE on bcm63xx

Ben Dooks <[email protected]>
riscv: save the SR_SUM status over switches

Ido Schimmel <[email protected]>
bridge: mcast: Fix use-after-free during router port configuration

Yan Zhai <[email protected]>
bnxt: properly flush XDP redirect lists

Paulo Alcantara <[email protected]>
smb: client: fix potential deadlock when reconnecting channels

Harshit Agarwal <[email protected]>
sched/rt: Fix race in push_rt_task

Tianyang Zhang <[email protected]>
LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()

Ronnie Sahlberg <[email protected]>
ublk: santizize the arguments from userspace when adding a device

Yeoreum Yun <[email protected]>
coresight: holding cscfg_csdev_lock while removing cscfg from csdev

Michal Kubiak <[email protected]>
ice: fix Tx scheduler error handling in XDP callback

Miri Korenblit <[email protected]>
wifi: iwlwifi: don't warn when if there is a FW error

Luis de Arquer <[email protected]>
spi-rockchip: Fix register out of bounds access

Christian Bruel <[email protected]>
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops

Michael S. Tsirkin <[email protected]>
virtio: break and reset virtio devices on device_shutdown()

Johannes Berg <[email protected]>
wifi: iwlwifi: fix debug actions order

Johannes Berg <[email protected]>
wifi: iwlwifi: dbg-tlv: fix DRAM data init

Roger Quadros <[email protected]>
dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn

Philippe Simons <[email protected]>
clk: sunxi-ng: h616: Reparent GPU clock during frequency changes

Andre Przywara <[email protected]>
clk: sunxi-ng: h616: Reparent CPU clock during frequency changes

Alexander Gordeev <[email protected]>
kasan: avoid sleepable page allocation from atomic context

Andrey Konovalov <[email protected]>
kasan: use unchecked __memset internally

Matt Johnston <[email protected]>
net: mctp: Don't access ifa_index when missing

Peter Griffin <[email protected]>
scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set

Mikhail Lobanov <[email protected]>
KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception

Namjae Jeon <[email protected]>
ksmbd: prevent rename with empty string

Sean Heelan <[email protected]>
ksmbd: Fix UAF in __close_file_table_ids

Johannes Berg <[email protected]>
um: fix time-travel syscall scheduling hack

Ranjan Kumar <[email protected]>
scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue

Edward Cree <[email protected]>
sfc: fix NULL dereferences in ef100_process_design_param()

Boris Burkov <[email protected]>
btrfs: harden block_group::bg_list against list_del() races

Philip Yang <[email protected]>
drm/amdkfd: debugfs hang_hws skip GPU with MES

Han Xu <[email protected]>
spi: fsl-qspi: use devm function instead of driver remove

Yonghong Song <[email protected]>
bpf: Fix kmemleak warning for percpu hashmap

Lizhi Xu <[email protected]>
fs/ntfs3: Keep write operations atomic

Paulo Alcantara <[email protected]>
smb: client: fix UAF in decryption with multichannel

Frederic Weisbecker <[email protected]>
perf: Fix hang while freeing sigtrap event

Chao Yu <[email protected]>
f2fs: fix potential deadloop in prepare_compress_overwrite()

Chao Yu <[email protected]>
f2fs: convert f2fs_handle_page_eio() to use folio

Boris Burkov <[email protected]>
btrfs: fix block group refcount race in btrfs_create_pending_block_groups()

Murad Masimov <[email protected]>
ax25: Remove broken autobind

Christian Schoenebeck <[email protected]>
fs/9p: fix NULL pointer dereference on mkdir

Antoine Tenart <[email protected]>
net: decrease cached dst counters in dst_release

Dave Marquardt <[email protected]>
net: ibmveth: make veth_pool_store stop hanging

Nick Child <[email protected]>
ibmveth: Always stop tx queues during close

Hengqi Chen <[email protected]>
LoongArch: BPF: Don't override subprog's return value

Namjae Jeon <[email protected]>
ksmbd: fix null pointer dereference in alloc_preauth_hash()

Matt Johnston <[email protected]>
net: mctp: unshare packets when reassembling

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd

Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in ksmbd_free_work_struct

Taehee Yoo <[email protected]>
eth: bnxt: fix truesize for mb-xdp-pass case

Namjae Jeon <[email protected]>
ksmbd: prevent connection release during oplock break notification

Maurizio Lombardi <[email protected]>
nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()

Wei Fang <[email protected]>
net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC

Yishai Hadas <[email protected]>
RDMA/mlx5: Fix the recovery flow of the UMR QP

Shay Drory <[email protected]>
RDMA/mlx5: Implement mkeys management via LIFO queue

Michael Guralnik <[email protected]>
RDMA/mlx5: Introduce mlx5r_cache_rb_key

Michael Guralnik <[email protected]>
RDMA/mlx5: Change the cache structure to an RB-tree

Aharon Landau <[email protected]>
RDMA/mlx5: Remove implicit ODP cache entry

Aharon Landau <[email protected]>
RDMA/mlx5: Don't keep umrable 'page_shift' in cache entries

Yishai Hadas <[email protected]>
RDMA/mlx5: Fix a WARN during dereg_mr for DM type

Kashyap Desai <[email protected]>
RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers

Peter Jones <[email protected]>
efi: Don't map the entire mokvar table to determine its size

Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers

Werner Sembach <[email protected]>
PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1

Mario Limonciello <[email protected]>
x86/PCI: Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4

Kory Maincent <[email protected]>
net: ravb: Fix missing rtnl lock in suspend/resume path

Jakub Kicinski <[email protected]>
net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels

Yishai Hadas <[email protected]>
RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error

Ping-Ke Shih <[email protected]>
wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion

Guixin Liu <[email protected]>
scsi: mpi3mr: Fix possible crash when setting up bsg fails

Patrisious Haddad <[email protected]>
RDMA/mlx5: Fix implicit ODP use after free

Ryan Roberts <[email protected]>
mm: clear uffd-wp PTE/PMD state on mremap()

Paulo Alcantara <[email protected]>
smb: client: fix double free of TCP_Server_Info::hostname

Matthieu Baerts (NGI0) <[email protected]>

    rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy

Bard Liao <[email protected]>
ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params

Niklas Cassel <[email protected]>
PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()

Gaurav Batra <[email protected]>
powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW

Florian Westphal <[email protected]>
xfrm: state: fix out-of-bounds read during lookup

Qu Wenruo <[email protected]>
btrfs: do proper folio cleanup when cow_file_range() failed

Stefano Brivio <[email protected]>
udp: Deal with race between UDP socket address change and rehash

Tvrtko Ursulin <[email protected]>
workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker

Ranjan Kumar <[email protected]>
scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs

Yishai Hadas <[email protected]>
vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()

Paul Aurich <[email protected]>

    smb: Initialize cfid->tcon before performing network ops

Jann Horn <[email protected]>
udmabuf: fix memory leak on last export_udmabuf() error path

Chao Yu <[email protected]>
f2fs: fix to do sanity check on node blkaddr in truncate_node()

Wen Gu <[email protected]>
net/smc: initialize close_work early to avoid warning

David Hildenbrand <[email protected]>
mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM

Hou Tao <[email protected]>
bpf: Call free_htab_elem() after htab_unlock_bucket()

Yihang Li <[email protected]>
scsi: hisi_sas: Create all dump files during debugfs initialization

Yihang Li <[email protected]>
scsi: hisi_sas: Allocate DFX memory during dump trigger

Yihang Li <[email protected]>
scsi: hisi_sas: Directly call register snapshot instead of using workqueue

Xiang Chen <[email protected]>
scsi: hisi_sas: Add function complete_v3_hw()

Xingui Yang <[email protected]>
scsi: hisi_sas: Add SATA_DISK_ERR bit handling for v3 hw

Xingui Yang <[email protected]>
scsi: hisi_sas: Move slot variable definition in hisi_sas_abort_task()

Wander Lairson Costa <[email protected]>
sched/deadline: Fix warning in migrate_enable for boosted tasks

yuan.gao <[email protected]>
mm/slub: Avoid list corruption when removing a slab from the full list

Chao Yu <[email protected]>
f2fs: fix to drop all discards after creating snapshot on lvm device

Sean Anderson <[email protected]>
drm: zynqmp_kms: Unplug DRM device before removal

Phil Sutter <[email protected]>
netfilter: IDLETIMER: Fix for possible ABBA deadlock

Patrisious Haddad <[email protected]>
RDMA/mlx5: Move events notifier registration to be after device registration

Yang Erkun <[email protected]>
nfsd: release svc_expkey/svc_export with rcu_work

Raghavendra Rao Ananta <[email protected]>
KVM: arm64: Get rid of userspace_irqchip_in_use

Pavel Begunkov <[email protected]>
io_uring: check for overflows in io_pin_pages

Paulo Alcantara <[email protected]>
smb: client: fix use-after-free of signing key

Paulo Alcantara <[email protected]>
smb: client: stop flooding dmesg in smb2_calc_signature()

Paul Aurich <[email protected]>
smb: Don't leak cfid when reconnect races with open_cached_dir

Liu Jian <[email protected]>
sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket

Yuezhang Mo <[email protected]>
exfat: fix out-of-bounds access of directory entries

Peng Fan <[email protected]>
pmdomain: imx93-blk-ctrl: correct remove path

Kuniyuki Iwashima <[email protected]>
smb: client: Fix use-after-free of network namespace.

Showrya M N <[email protected]>
RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES

Zijian Zhang <[email protected]>
bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx

David Howells <[email protected]>
afs: Fix lock recursion

Xinqi Zhang <[email protected]>
firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()

Cristian Marussi <[email protected]>
firmware: arm_scmi: Refactor device create/destroy helpers

Cristian Marussi <[email protected]>
firmware: arm_scmi: Move handle get/set helpers

Cristian Marussi <[email protected]>
firmware: arm_scmi: Refactor protocol device creation

Cristian Marussi <[email protected]>
firmware: arm_scmi: Add common notifier helpers

Cristian Marussi <[email protected]>
firmware: arm_scmi: Move protocol registration helpers

Cristian Marussi <[email protected]>
firmware: arm_scmi: Use dedicated devices to initialize channels

Cristian Marussi <[email protected]>
firmware: arm_scmi: Simplify chan_available transport operation

Dan Carpenter <[email protected]>
drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

Namjae Jeon <[email protected]>
ksmbd: check outstanding simultaneous SMB operations

Dan Williams <[email protected]>
cxl/port: Fix use-after-free, permit out-of-order decoder shutdown

Maurizio Lombardi <[email protected]>
nvme-pci: fix race condition between reset and nvme_dev_disable()

Anastasia Belova <[email protected]>
cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Implement bounds check for stream encoder creation in DCN401

Eddie James <[email protected]>
net/ncsi: Disable the ncsi work before freeing the associated structure

James Chapman <[email protected]>
l2tp: prevent possible tunnel refcount underflow

Alex Hung <[email protected]>
drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags

Alex Hung <[email protected]>
drm/amd/display: Check null pointers before using them

Alex Hung <[email protected]>
drm/amd/display: Check null pointers before used

Alex Hung <[email protected]>
drm/amd/display: Check null pointers before multiple uses

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer

Srinivasan Shanmugam <[email protected]>

    drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe

Rodrigo Siqueira <[email protected]>
drm/amd/display: Check null pointer before try to access it

Chunguang.xu <[email protected]>
nvme-rdma: unquiesce admin_q before destroy it

Leon Hwang <[email protected]>
bpf: Prevent tailcall infinite loop caused by freplace

Yunfei Dong <[email protected]>
media: mediatek: vcodec: Fix H264 stateless decoder smatch warning

Devyn Liu <[email protected]>
spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware

Yang Yingliang <[email protected]>
spi: hisi-kunpeng: switch to use modern name

Uwe Kleine-König <[email protected]>
spi: hisi-kunpeng: Convert to platform remove callback returning void

Alex Hung <[email protected]>
drm/amd/display: Avoid overflow from uint32_t to uint8_t

Leon Huang <[email protected]>
drm/amd/display: Refactor ABM feature

Maxime Méré <[email protected]>
crypto: stm32/cryp - call finalize with bh disabled

Mukesh Ojha <[email protected]>

    pinmux: Use sequential access to access desc->pinmux data

Bert Karwatzki <[email protected]>
wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change

Hersen Wu <[email protected]>
drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box

Hersen Wu <[email protected]>
drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range

Lenko Donchev <[email protected]>
drm/amd/display: Use kcalloc() instead of kzalloc()

Jann Horn <[email protected]>
userfaultfd: fix checks for huge PMDs

Larysa Zaremba <[email protected]>
ice: protect XDP configuration with a mutex

Alex Hung <[email protected]>
drm/amd/display: Ensure array index tg_inst won't be -1

Alex Hung <[email protected]>
drm/amd/display: Check index for aux_rd_interval before using

Eric Dumazet <[email protected]>
pktgen: use cpus_read_lock() in pg_net_init()

Filipe Manana <[email protected]>
btrfs: do not BUG_ON() when freeing tree block after error

Chao Yu <[email protected]>
f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC

Chao Yu <[email protected]>
f2fs: fix to cover read extent cache access with lock

Keith Busch <[email protected]>
nvme: apple: fix device reference counting

Aurabindo Pillai <[email protected]>
drm/amd/display: Fix null pointer deref in dcn20_resource.c

Sibi Sankar <[email protected]>
soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove

Manivannan Sadhasivam <[email protected]>
PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()

Steve Wilkins <[email protected]>
spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer

Gavin Shan <[email protected]>
mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray

Xu Yang <[email protected]>
filemap: add helper mapping_max_folio_size()

Jules Irenge <[email protected]>
s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings

Holger Dengler <[email protected]>
s390/pkey: Wipe copies of clear-key structures on failure

Holger Dengler <[email protected]>
s390/pkey: Wipe copies of protected- and secure-keys

Milena Olech <[email protected]>
ice: Fix improper extts handling

George Stark <[email protected]>
leds: an30259a: Use devm_mutex_init() for mutex initialization

Bob Zhou <[email protected]>
drm/amdgpu: fix double free err_addr pointer warnings

Chao Yu <[email protected]>
f2fs: fix to shrink read extent node in batches

Wander Lairson Costa <[email protected]>
sched/deadline: Fix task_struct reference leak

Miaohe Lin <[email protected]>
fork: defer linking file vma until vma is fully initialized

Huacai Chen <[email protected]>
LoongArch: Update cpu_sibling_map when disabling nonboot CPUs

Shashank Sharma <[email protected]>

    drm/amdgpu: change vm->task_info handling

Baokun Li <[email protected]>

    ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()

Baokun Li <[email protected]>
ext4: refactoring to use the unified helper ext4_quotas_off()

Hans de Goede <[email protected]>
platform/x86: x86-android-tablets: Unregister devices in reverse order

Konstantin Komarov <[email protected]>
fs/ntfs3: Check 'folio' pointer for NULL

Aleksandr Mishin <[email protected]>
drm/msm/dpu: Add callback function pointer check before its call

Xiaolei Wang <[email protected]>
net: stmmac: move the EST lock to struct stmmac_priv

Andreas Gruenbacher <[email protected]>
gfs2: Fix potential glock use-after-free on unmount

Stanislav Fomichev <[email protected]>
bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE

Maher Sanalla <[email protected]>
net/mlx5: Reload only IB representors upon lag disable/enable

Sungwoo Kim <[email protected]>
Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()

Rick Edgecombe <[email protected]>
hv_netvsc: Don't free decrypted memory

Peter Xu <[email protected]>
mm/userfaultfd: reset ptes when close() for wr-protected ones

Boris Brezillon <[email protected]>
drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()

Po-Hao Huang <[email protected]>
wifi: rtw89: fix null pointer access when abort scan

Andre Werner <[email protected]>
net: phy: phy_device: Prevent nullptr exceptions on ISR

Adam Ford <[email protected]>
pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain

Abhishek Pandit-Subedi <[email protected]>
usb: typec: ucsi: Limit read size on v1.2

Christian Göttsche <[email protected]>
selinux: avoid dereference of garbage after mount failure

Andrii Nakryiko <[email protected]>
bpf: support deferring bpf_link dealloc to after RCU grace period

Chris Park <[email protected]>
drm/amd/display: Prevent crash when disable stream

Josef Bacik <[email protected]>
btrfs: fix deadlock with fiemap and extent locking

Kory Maincent <[email protected]>
dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup

Dave Airlie <[email protected]>
nouveau: lock the client object tree.

Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend

Nikita Zhandarovich <[email protected]>

    drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: fix memleak in map from abort path

Eric Dumazet <[email protected]>
net/sched: Fix mirred deadlock on device recursion

Dragos Tatulea <[email protected]>
net: esp: fix bad handling of pages from page_pool

Allen Pan <[email protected]>
drm/amd/display: Add a dc_state NULL check in dc_state_release

Yongqiang Liu <[email protected]>
ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses

Fei Wu <[email protected]>
perf: RISCV: Fix panic on pmu overflow handler

Atish Patra <[email protected]>
perf: RISC-V: Define helper functions expose hpm counter width and count

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix possible buffer overflow

Luiz Augusto von Dentz <[email protected]>
Bluetooth: af_bluetooth: Fix deadlock

Mads Bligaard Nielsen <[email protected]>
drm/bridge: adv7511: fix crash on irq during probe

Chao Yu <[email protected]>
f2fs: fix to truncate meta inode pages forcely

Chao Yu <[email protected]>
f2fs: introduce f2fs_invalidate_internal_cache() for cleanup

Yangtao Li <[email protected]>
f2fs: introduce f2fs_is_readonly() for readability

Alexander Sverdlin <[email protected]>
spi: lpspi: Avoid potential use-after-free in probe()

Colin Ian King <[email protected]>
ASoC: qcom: Fix uninitialized pointer dmactl

Jakub Kicinski <[email protected]>
net/sched: act_mirred: use the backlog for mirred ingress

Petr Tesarik <[email protected]>
net: stmmac: protect updates of 64-bit statistics counters

David Howells <[email protected]>
rxrpc: Fix delayed ACKs to not set the reference serial number

Mark Rutland <[email protected]>
arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD

Ido Schimmel <[email protected]>
net/sched: flower: Fix chain template offload

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'

Petr Machata <[email protected]>
net: nexthop: Increase weight to u16

Petr Machata <[email protected]>
net: nexthop: Have all NH notifiers carry NH ID

Benjamin Poirier <[email protected]>
nexthop: Do not return invalid nexthop object during multipath selection

Benjamin Poirier <[email protected]>
nexthop: Factor out neighbor validity check

Benjamin Poirier <[email protected]>
nexthop: Factor out hash threshold fdb nexthop selection

Yu Kuai <[email protected]>
blk-cgroup: dropping parent refcount after pd_free_fn() is done

Rob Clark <[email protected]>
interconnect: Fix locking for runpm vs reclaim

Chao Yu <[email protected]>
f2fs: fix to do sanity check on direct node in truncate_dnode()

Yu Kuai <[email protected]>
block/rq_qos: protect rq_qos apis with a new lock

Kuniyuki Iwashima <[email protected]>
smc: Fix use-after-free in tcp_write_timer_handler().

Marc Kleine-Budde <[email protected]>
can: gs_usb: fix time stamp counter initialization

Chao Yu <[email protected]>
f2fs: don't reset unchangable mount option in f2fs_remount()

Yangtao Li <[email protected]>
f2fs: fix to set flush_merge opt and show noflush_merge

Dragos Tatulea <[email protected]>
net/mlx5e: xsk: Fix crash on regular rq reactivation

Junhao He <[email protected]>

    coresight: Fix memory leak in acpi_buffer->pointer

Jan Kara <[email protected]>
ext4: avoid deadlock in fs reclaim with page writeback

Fei Shao <[email protected]>
media: mediatek: vcodec: Only free buffer VA that is not NULL

Dan Williams <[email protected]>
cxl/port: Fix delete_endpoint() vs parent unregistration race

Jaegeuk Kim <[email protected]>
f2fs: split initial and dynamic conditions for extent_cache

Deepak Gupta <[email protected]>
riscv: VMAP_STACK overflow detection thread-safe

Paulo Alcantara <[email protected]>
smb: client: fix use-after-free in smb2_query_info_compound()

Ilya Bakoulin <[email protected]>
drm/amd/display: Fix hang/underflow when transitioning to ODM4:1

Zhipeng Lu <[email protected]>
SUNRPC: fix a memleak in gss_import_v2_context

Jan Kara <[email protected]>
reiserfs: Avoid touching renamed directory if parent does not change

Jeff Layton <[email protected]>
reiserfs: convert to simple_rename_timestamp

Jeff Layton <[email protected]>
fs: new helper: simple_rename_timestamp

Paloma Arellano <[email protected]>
drm/msm/dpu: Add mutex lock in control vblank irq

Baolin Wang <[email protected]>
mm: migrate: fix getting incorrect page mapping during page migration

Dave Chinner <[email protected]>
xfs: fix unmount hang with unflushable inodes stuck in the AIL

Dave Chinner <[email protected]>
xfs: factor out stale buffer item completion

Dave Chinner <[email protected]>
xfs: rearrange code in xfs_buf_item.c

Dave Chinner <[email protected]>
xfs: catch stale AGF/AGF metadata

Dave Chinner <[email protected]>
xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock

Johan Hovold <[email protected]>
tty: add break_wait kernel-doc

Christian Brauner <[email protected]>
namespace: handle mount locking for automounts correctly

Christian Brauner <[email protected]>
fcntl: refuse F_SET_RW_HINT on an immutable inode

Christian Brauner <[email protected]>
namespace: check the target before walking it in do_mount_setattr()

Christian Brauner <[email protected]>
namespace: don't copy an unmounted mount tree

Christian Brauner <[email protected]>
namespace: unhash a dentry before detaching the mounts on it

Nguyen Ngoc Thang <[email protected]>
drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN

Mikhail Gavrilov <[email protected]>
drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks

Wentao Liang <[email protected]>
drm/vc4: Fix firmware reference leak in vc4_drm_bind()

Ahmed Abdelhaleem Ahmed <[email protected]>
scsi: ch: Do not keep references to data transfer element devices

Shao-Fu Chen <[email protected]>
optee: register TEE devices only once fully initialized

Shawn Lin <[email protected]>
pmdomain: rockchip: propagate subdomain add errors

Shawn Lin <[email protected]>
pmdomain: rockchip: don't ignore clock lookup errors on attach

Ming Qian <[email protected]>
pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains

Shawn Lin <[email protected]>
pmdomain: rockchip: fix clock leak on domain probe failure

Mikulas Patocka <[email protected]>
dm: fix reading free memory in do_resume

Christian Brauner <[email protected]>
namespace: check the mounts before reading their parents in pivot_root()

Christian Brauner <[email protected]>
namespace: don't inherit MNT_UMOUNT in clone_mnt()

Chengfeng Ye <[email protected]>
Bluetooth: ISO: Serialize concurrent connect calls

Zack Rusin <[email protected]>
drm/vmwgfx: validate pitch coming from userspace

Mikhail Gavrilov <[email protected]>
Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex

Weiming Shi <[email protected]>
net: team: stop reusing skb after queue override

Weiming Shi <[email protected]>
net: team: fix NULL pointer dereference in team_xmit during mode change

Marc Harvey <[email protected]>
net: team: Rename port_disabled team mode op to port_tx_disabled

Marc Harvey <[email protected]>
net: team: Remove unused team_mode_op, port_enabled

Felix Fietkau <[email protected]>
netfilter: nf_tables: fix bidirectional offload regression

Tahera Fahimi <[email protected]>
xfrm: prevent policy_hthresh.work from racing with netns teardown

Ramses de Norre <[email protected]>
wireguard: queueing: preserve tstamp_type when encapsulating packet

Lorenzo Stoakes (ARM) <[email protected]>
mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge

Lorenzo Stoakes (ARM) <[email protected]>
mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP

Vishal Badole <[email protected]>
EDAC/amd64: Mask UMC chip select to the four implemented selects

Christian Göttsche <[email protected]>
selinux: fix data race on AVC latest_notif

Tristan Madani <[email protected]>
ice: fix metadata_dst refcount handling on representor teardown

Daehyeon Ko <[email protected]>
ip6_gre: remove obsolete ERSPAN PMTU update

Donggeun Yoo <[email protected]>
tracing: Set the trace clock before registering the histogram trigger

Vicki Pfau <[email protected]>
HID: steam: Clean up locking

Vicki Pfau <[email protected]>
HID: steam: Refactor registration

Vicki Pfau <[email protected]>
HID: steam: Rearrange teardown sequence

Vicki Pfau <[email protected]>
HID: steam: Fully unregister controller when hidraw is opened

Vicki Pfau <[email protected]>
HID: hid-steam: Make client_opened a counter

Dan Carpenter <[email protected]>
HID: hid-steam: Fix cleanup in probe()

Adrian Betschart <[email protected]>
drm/amd/display: Don't replace a sink mode that shares the native totals

Oliver Hartkopp <[email protected]>
can: fix unique skb identifier regression under RPS

Ezrak1e <[email protected]>
dlm: validate length in dlm_search_rsb_tree

Xue Lei <[email protected]>
mtd: fix double free and WARN_ON in add_mtd_device() error paths

Miquel Raynal <[email protected]>
mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters

Alexander Usyskin <[email protected]>
mtd: fix use-after-free in mtd release

Miquel Raynal <[email protected]>
mtd: Clean refcounting with MTD_PARTITIONED_MASTER

Fernando Fernandez Mancera <[email protected]>
net: openvswitch: validate transport header presence in set_ipv6_addr

Li RongQing <[email protected]>
net/mlx5e: Order ICOSQ cc update after CQ doorbell

Eric Dumazet <[email protected]>
flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

Eric Dumazet <[email protected]>

    flow_dissector: avoid u16 truncation of skb->len when computing thoff

Marek Szyprowski <[email protected]>
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM

Alvin Šipraga <[email protected]>
ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes

Alvin Šipraga <[email protected]>
ASoC: adau1372: allow sleepy powerdown GPIOs

Sang-Hoon Choi <[email protected]>
nvmet: use the local P2P device on metadata allocation failure

Sang-Hoon Choi <[email protected]>
cxgb4/ch_ktls: disable softirqs around tid_list erases

Omar Ramadan <[email protected]>
amt: send the relay's General Query directly from the receive path

Jamal Hadi Salim <[email protected]>
net/sched: em_text: reject unterminated algo before autoload

Maíra Canal <[email protected]>
drm/vc4: Free the BO cache size list on teardown

Myeonghun Pak <[email protected]>
drm/aspeed: Balance the display clock enable on teardown

Sang-Hoon Choi <[email protected]>
gpio: exar: initialize the ID before registering its cleanup

Oleg Keri <[email protected]>
drm/dp: don't mark the AUX backlight enabled when enabling failed

Christian Brauner <[email protected]>
namespace: refuse an automount below a mount that is in no namespace

Christian Brauner <[email protected]>
dcache: don't put a mountpoint on a dentry that's being removed

Christian Brauner <[email protected]>
namespace: check a submount for references right before unmounting it

Christian Brauner <[email protected]>
fs: refuse fspick() on internal superblocks

Alex Deucher <[email protected]>
drm/amdgpu: make Mac FB workaround generic

Fan Wu <[email protected]>
drm/vc4: drain the hangcheck timer and works on V3D unbind

Krzysztof Karas <[email protected]>
drm/i915/gt: Unmask interrupts only when ACTIVE is true

Krzysztof Karas <[email protected]>
drm/i915/gem: Prevent overstepping exec array boundary

Sajal Gupta <[email protected]>
drm/gud: don't keep a connector without a CRTC as connector_state

Palla Raghunath <[email protected]>
Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

Maxim Skokov <[email protected]>
Bluetooth: RFCOMM: free the skb when the DLC has no owner

Iaroslav Voitovych <[email protected]>
Bluetooth: MGMT: Fix status of pending commands flushed on power off

Chengfeng Ye <[email protected]>
Bluetooth: hci_sock: Serialize dead-device detachment

Runyu Xiao <[email protected]>
scsi: qedi: Initialize callback state before registration

Abhishek Ojha <[email protected]>
regulator: ltc3676: don't read the write-only HRST and CLIRQ registers

Denis V. Lunev <[email protected]>
openvswitch: fix soft lockup in the netlink flow dump

Karl Bonde Torp <[email protected]>
nvme: fix swapped ZRASF zone state values for full and read only

Fredrik Nyberg <[email protected]>
net: usb: ax88179_178a: fix rx frame length for non-last packets

Sebastien Royen <[email protected]>
net: dsa: microchip: fix KSZ8765 fiber detection

Zixuan Chai <[email protected]>
net: bridge: avoid recursive multicast port cleanup

Chengfeng Ye <[email protected]>
net/smc: protect clcsock lifetime in smc_getname

Quchaosheng <[email protected]>
net/packet: guard the ll header push in packet_rcv_spkt()

Guangshuo Li <[email protected]>
mmc: sdhci-sprd: disable runtime PM on remove

Yibo Tan <[email protected]>
mmc: mtk-sd: Cancel request timeout work on remove

Guangshuo Li <[email protected]>
mmc: cavium-thunderx: destroy slot platform devices on remove

Guangshuo Li <[email protected]>
mmc: cavium-octeon: destroy slot platform devices on remove

Ma Xinmeng <[email protected]>
dm-snap: reject the transient exception store for snapshot-merge

Ben Cressey <[email protected]>
dm-crypt: reject the lmk IV mode with AEAD ciphers

Nguyen Ngoc Thang <[email protected]>
memstick: rtsx_usb_ms: complete requests after eject instead of dropping them

Raj Ojha <[email protected]>
memstick: core: wait for request completion before freeing card

성병찬 <[email protected]>
KEYS: Fix add_key() race with keyring restriction

Karl Mehltretter <[email protected]>
keys: finalize persistent keyring timeout after link attempt

Mingming Cao <[email protected]>
ibmveth: fix TX LTB and filter unwind on open-fail

Mingming Cao <[email protected]>
ibmveth: h_free logical LAN on open-fail after register

Ridham Khurana <[email protected]>
gpio: xilinx: fix runtime PM leak on request error path

Hui Peng <[email protected]>
sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

Stephen Smalley <[email protected]>
selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

Johannes Berg <[email protected]>
Revert "wifi: libertas: reject short monitor TX frames"

Chengfeng Ye <[email protected]>
tipc: hold a reference to nodes found by link name

Yuqi Xu <[email protected]>
tipc: destroy topsrv workqueues before closing connections

Sabrina Dubroca <[email protected]>
strparser: make sure __strp_recv isn't running before tearing down the parser

Josef Bacik <[email protected]>
xen/netfront: don't leak the skb when xennet_fill_frags() fails

Pavankumar Kondeti <[email protected]>
workqueue: Fix NULL current_pwq deref in chained work check

Jason A. Donenfeld <[email protected]>
wireguard: noise: reject response consumption after intermediate initiation

Michele Dionisio <[email protected]>
wifi: brcmfmac: fix P2P device removal race in brcmf_detach()

Palla Raghunath <[email protected]>
dm ioctl: don't let data_start run past the buffer

Wentao Liang <[email protected]>
btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()

Michael Garland <[email protected]>
ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)

Karl Mehltretter <[email protected]>
arm64: irq: exclude the softirq stack switch from KCOV

Daehyeon Ko <[email protected]>
ipv6: do not warn on route notification size race

Daehyeon Ko <[email protected]>
ipv4: do not warn on route notification size race

Daehyeon Ko <[email protected]>
ipv4: stop route notification sizing when nexthop group shrinks

Daehyeon Ko <[email protected]>
ipv4: stop PMTU walk when nexthop group shrinks

Eric Biggers <[email protected]>
crypto: drbg - Fix ineffective sanity check

Karl Mehltretter <[email protected]>
netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting

Jiajia Liu <[email protected]>
Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING

Liew Rui Yan <[email protected]>
mm/damon/core: fix unconditionally skip last region

SeongJae Park <[email protected]>
mm/damon/core: do non-safe region walk on kdamond_apply_schemes()

Carlos Llamas <[email protected]>
HID: uhid: convert to hid_safe_input_report()

Benjamin Tissoires <[email protected]>
HID: core: introduce hid_safe_input_report()

Andrey Misiurov <[email protected]>
scsi: lpfc: Fix use-after-free of mboxq in lpfc_sli4_driver_resource_setup()

HE WEI（ギカク） <[email protected]>
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

Nirbhay Sharma <[email protected]>
fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list

Konstantin Komarov <[email protected]>
fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Konstantin Komarov <[email protected]>
fs/ntfs3: Add more checks in mi_enum_attr (part 2)

Pengpeng Hou <[email protected]>
iio: cdc: ad7150: fix OF matching and publish module aliases

Fabrice Gasnier <[email protected]>
iio: adc: stm32-adc: fix possible division by zero in processed channel

Vladyslav Ivashchenko <[email protected]>
iio: adc: axp288: Add TS bias override for Haier HV103H

Cong Nguyen <[email protected]>
iio: adc: max1363: sign-extend bipolar differential channel reads

Pengpeng Hou <[email protected]>
iio: adc: aspeed: propagate reset deassert errors

Krzysztof Kozlowski <[email protected]>
iio: adc: aspeed: Simplify with dev_err_probe

Fan Wu <[email protected]>
iio: adc: ad_sigma_delta: fix use-after-free on unbind

Paulo Alcantara <[email protected]>
smb: client: discard post-EOF pagecache when extending a file via zero range

Felix Fietkau <[email protected]>

    wifi: mac80211: set info->band for 802.3 encap offload frames

Sean Christopherson <[email protected]>
KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted

Peter Xu <[email protected]>
mm/hugetlb: fix avoid_reserve to allow taking folio from subpool

Matthew Wilcox (Oracle) <[email protected]>
fs: Free any excess xarray nodes in clear_inode()

Zhiling Zou <[email protected]>
wifi: mac80211: count only matching reservations in reserved switch

Zhiling Zou <[email protected]>
wifi: mac80211: keep paired old chanctx alive

Johan Hovold <[email protected]>
tty: port: fix tty_port_tty_vhangup() race

Eric Dumazet <[email protected]>
bnxt_en: fix DMA mapping length for padded small packets

Zhao Li <[email protected]>
wifi: mac80211: account proxy paths against the mesh path limit

Han Xu <[email protected]>
mtd: spinand: Enable QE on all dies

Pei Xiao <[email protected]>
mtd: block2mtd: Fix divide error when erase_size is zero

Johan Hovold <[email protected]>
USB: serial: fix ioctl hangup race

Johan Hovold <[email protected]>
USB: serial: report unsupported break signalling

Johan Hovold <[email protected]>
USB: serial: return errors from break handling

Zhao Li <[email protected]>
wifi: mac80211: keep fallback association elements alive

Zhao Li <[email protected]>
wifi: mac80211: shut down RX BA session timer on teardown

Nuno Sá <[email protected]>
mtd: spinand: fix NULL pointer dereference with no ECC engine

Timur Kristóf <[email protected]>
drm/amd/display: Mark DCE 6.4 as not APU

Johan Hovold <[email protected]>
serial: fix TIOCMIWAIT race

Fan Wu <[email protected]>
tty: serial: max3100: shut down timer before freeing port

Johan Hovold <[email protected]>
tty: tty_port: restore TTY_IO_ERROR on activation failure

Pannarat Wiriyaarritham <[email protected]>
usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41

Runyu Xiao <[email protected]>
USB: dwc2: shut down wakeup timer before freeing HCD state

Myeonghun Pak <[email protected]>
usb: ohci-spear: disable controller wakeup on removal

Chen Ni <[email protected]>
usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()

Francisco Beltrán Millalén <[email protected]>
drm/amdgpu: reset VI ASIC on MacBookPro14,3

Andre Eikmeyer <[email protected]>
drm/amdgpu: reset VI ASIC on MacBookPro15,1

Jiangshan Yi <[email protected]>
drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend

Eric Biggers <[email protected]>
fsverity: add dependency on 64K or smaller pages

Mostafa Saleh <[email protected]>
KVM: arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP

Jinseob Kim <[email protected]>
iio: buffer: serialize buffer teardown with mode claims

Beata Michalska <[email protected]>

    arm64: errata: Add Cortex-A725 erratum 3821522 workaround

Beata Michalska <[email protected]>
arm64: errata: Factor out broken AMU const counter cap

Mark Rutland <[email protected]>
arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems

Zhengchuan Liang <[email protected]>
perf: Require kernel access for text poke events

Johan Hovold <[email protected]>
tty: fix saved termios reset race

Jiazi Liu <[email protected]>
usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

Viken Dadhaniya <[email protected]>
soc: qcom: geni-se: Correct QUP Core ICC vote constants

Andrei Matei <[email protected]>
bpf: Fix accesses to uninit stack slots

Jiangshan Yi <[email protected]>
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

Josef Bacik <[email protected]>
xen/netfront: drop RX packets with a short Ethernet header

Amit Sunil Dhamne <[email protected]>
usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling

Xu Yang <[email protected]>
usb: typec: tcpm: fix debug accessory mode detection for sink ports

Neill Kapron <[email protected]>
usb: gadget: f_fs: Fix Use-After-Free in AIO error path

Gabriel Prostitis <[email protected]>
USB: gadget: ffs: fix mm lifetime handling

Fan Wu <[email protected]>
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

Uwe Kleine-König <[email protected]>
usb: gadget: at91_udc: Convert to platform remove callback returning void

Karl Mehltretter <[email protected]>

    serial: imx: serialize imx_uart_ports[] lifetime

Uwe Kleine-König <[email protected]>
serial: imx: Convert to platform remove callback returning void

Gilberto Conde <[email protected]>
net: usb: qmi_wwan: add Quectel EG120K-EA

Wentao Liang <[email protected]>
wifi: wlcore: Fix runtime PM leak in wlcore_remove()

Uwe Kleine-König <[email protected]>
wifi: wlcore: Convert to platform remove callback returning void

Frank Sorenson <[email protected]>
smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races

Paolo Abeni <[email protected]>
mptcp: prevent race between disconnect() and rtx

Eric Dumazet <[email protected]>

    tcp: introduce icsk->icsk_keepalive_timer

Mehmet Fide <[email protected]>
mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages

Yi Yang <[email protected]>
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF

Chris Mason <[email protected]>
SUNRPC: reject duplicate CREDS_VALUE options

Chris Mason <[email protected]>
SUNRPC: fix gssx_dec_option_array error path bugs

Asad Kamal <[email protected]>
drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read

Aditya Dutt <[email protected]>
jfs: fix array-index-out-of-bounds read in add_missing_indices

Fan Wu <[email protected]>
iio: trigger: cancel reenable_work before freeing trigger

Salah Triki <[email protected]>
iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler

Zhang Jie <[email protected]>
iio: proximity: sx9324: Correct proximity channel resolution

Cong Nguyen <[email protected]>
iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure

Salah Triki <[email protected]>
iio: proximity: isl29501: Fix return type of isl29501_register_write

Hui Su <[email protected]>
iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup

Fan Wu <[email protected]>
iio: light: gp2ap020a00f: drain irq_work after free_irq

Arka Mondal <[email protected]>
iio: imu: adis16480: fix unprotected debugfs reads

Arka Mondal <[email protected]>
iio: imu: adis16400: fix unprotected debugfs reads

Arka Mondal <[email protected]>
iio: gyro: adis16136: fix unprotected debugfs reads

Salah Triki <[email protected]>
iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw()

Jonathan Cameron <[email protected]>
iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

Fan Wu <[email protected]>
iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

Felix Gu <[email protected]>
iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls

Felix Gu <[email protected]>
iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure

Salah Triki <[email protected]>
iio: accel: sca3000: fix frequency divider condition check

Jiale Yao <[email protected]>
iio: accel: kxcjk-1013: reject duplicate event disable

Daehyeon Ko <[email protected]>
thunderbolt: Reject oversized XDomain properties responses

Kurt Lieber <[email protected]>
thunderbolt: Disable CL states for the Anker Prime TB5 dock

Mika Westerberg <[email protected]>
thunderbolt: Fix KASAN reported use-after-free when request is canceled

Ian Lin <[email protected]>
USB: serial: option: add Compal EXC-T1 support

Sebastian Sjoholm <[email protected]>
USB: serial: option: add Quectel RG660QB

Ian Lin <[email protected]>
USB: serial: option: add Compal EXM-G1x support

Carlo Szelinsky <[email protected]>
USB: serial: option: add Quectel EG060W

Zhao Dongdong <[email protected]>
USB: serial: option: add support for SIMCom SIM8260C

Johan Hovold <[email protected]>
USB: serial: fix driver deregistration order

Johan Hovold <[email protected]>
USB: serial: fix dynamic id driver deregistration race

Johan Hovold <[email protected]>
USB: serial: ssu100: fix baud rate overflow

Johan Hovold <[email protected]>
USB: serial: quatech2: fix baud rate overflow

Jérémy Carrat <[email protected]>

    USB: serial: cp210x: add Corsair AX1500i Power Supply

Yuqi Xu <[email protected]>
wifi: mac80211: handle empty FILS association request payload

Zhao Li <[email protected]>
wifi: mac80211: release mesh path quota on failed additions

Yuqi Xu <[email protected]>
wifi: mac80211: minstrel_ht: validate fixed rate index

Zhao Li <[email protected]>
wifi: mac80211: drain PS delivery work during station teardown

Guangshuo Li <[email protected]>
wifi: iwlegacy: 3945: free EEPROM data on remove

Tianchu Chen <[email protected]>
wifi: cw1200: fix TX padding OOB read leaking heap data to device

Nuno Sá <[email protected]>
mtd: spinand: fix zero oobavail when no ECC engine is used

Mehmet Fide <[email protected]>
mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB

Runyu Xiao <[email protected]>
mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ

Weiming Shi <[email protected]>
nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()

Daehyeon Ko <[email protected]>
nvme-multipath: fix underflow in ANA log bounds checks

Zhiling Zou <[email protected]>
ipvs: bound LBLCR and LBLC cache growth

Chandrashekar Devegowda <[email protected]>
Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

Chengfeng Ye <[email protected]>
Bluetooth: hci_core: Serialize fragmented ISO packet queueing

Chengfeng Ye <[email protected]>
Bluetooth: hci_core: Serialize ACL scheduling with channel deletion

Linmao Li <[email protected]>
Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems

Chengfeng Ye <[email protected]>
Bluetooth: hci_conn: Lock parent access during enhanced SCO setup

Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: Fix initial port reference race

Xiang Mei <[email protected]>
ALSA: ua101: reject mismatched capture/playback packet sizes

Kyle Zeng <[email protected]>
ALSA: seq: Serialize compat port-info ioctls

Zimeng Li <[email protected]>
ASoC: qcom: lpass-cpu: use DAI table index for playback constraints

Wentao Liang <[email protected]>
serial: vt8500: Fix clock reference leak in vt8500_serial_probe()

Simon Gassner <[email protected]>
serial: tegra: don't clear the Tx FIFO on an Rx-only reset

Fan Wu <[email protected]>

    serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

Johan Hovold <[email protected]>
tty: abort break signalling on hangup

Viken Dadhaniya <[email protected]>
tty: serial: qcom_geni_serial: Keep console RX functional after deep idle

Joshua Rogers <[email protected]>
tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

Joshua Rogers <[email protected]>
tty: vcc: zero-initialize control packet in vcc_send_ctl()

Johan Hovold <[email protected]>
tty: amiserial: fix broken TIOCMIWAIT

Mingyu Wang <[email protected]>
tty: vt: fix memory leak in vc_allocate()

Jie Deng <[email protected]>
usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe

Fan Wu <[email protected]>
usb: cdns3: fix use-after-free in cdns3_gadget_exit()

Jameson Thies <[email protected]>
usb: typec: ucsi: displayport: Current CAM OOB index fixup

Prashanth K <[email protected]>
usb: typec: ucsi: Get the connector fwnode based on reg value

Radhey Shyam Pandey <[email protected]>
usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()

Amit Sunil Dhamne <[email protected]>
usb: typec: tcpm: recover after failure to start the frs ams

Hui Peng <[email protected]>
usb: core: clear both ep_in and ep_out for non-ep0 control endpoints

Myeonghun Pak <[email protected]>
usb: chipidea: tegra: disable runtime PM on resume failure

Yuchao Zhang <[email protected]>
usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC

Alan Stern <[email protected]>
USB: gadget: dummy-hcd: Fix wait for outstanding request completions

Fan Wu <[email protected]>
usb: gadget: aspeed-vhub: cancel wake work on device removal

Radhey Shyam Pandey <[email protected]>
usb: dwc3: am62: Fix runtime PM usage count leak on probe error path

Linkai Gong <[email protected]>
usb: typec: anx7411 - stop the IRQ before destroying the workqueue

Liu Chao <[email protected]>
usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd

Myeonghun Pak <[email protected]>
usb: ohci-st: disable controller wakeup on removal

Myeonghun Pak <[email protected]>
usb: ohci-s3c2410: disable controller wakeup on removal

Myeonghun Pak <[email protected]>
usb: ohci-da8xx: disable controller wakeup on cleanup