From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BFA1D38AC7D; Sat, 12 Sep 2026 15:23:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789226638; cv=none; b=MYoeNCCZFni1zfsUhPbnCiOObRocKhlTr3I/NfN/JfGBcHiROiFoJnOqTs9K0RRVyEl3GpQIOozZXY3UFxhISc+s9jdhB9igsXdVMt8/REE1W2DRzCgv81gkPrUNhtm1TesUZi8cm0dTSgUMOOkAx625lE5CwARXGxX8uOUALN4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789226638; c=relaxed/simple; bh=PbYAJisPbVctkl+TXGAfr5VkZE9orJMjQ8xzYOOpvvs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=O+1N/nEDk2ulXDSP+Y8ITzZBG9iPf41kjIpyyC7ghPI8KoDV1x4o+eudePsenBgRJlQSvjOqEuvPRri+E12bCb7iGFIKmW7oPhw9gCn6SEqzhZNKBubXSnhB++k3t9uTeHScIRmXuS/nyxzJk3q6Mp9omekUudWwLxri4j1GyoQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WcZB+Efu; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="WcZB+Efu" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7ECE91F000FF; Sat, 12 Sep 2026 15:23:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789226630; bh=vAfoFng9tBdxbnAmBW+uKh5nep9iqiwEraCHWQM0AIE=; h=From:To:Cc:Subject:Date; b=WcZB+EfuIzzjEe+M6FV7EcplK6WAuvASPii4d9K9u5cMl3M7lyBO+mfFQNtXvDJs9 eSpJ02jg0By5U62UZIzFyuXqRy10VjoJDmxS+PAxinf9pUGKRZI4XU58Jk4HXxyRxY gTlCsM2uK/OM+r2jtbXB3hnHNa6PGW/DnTlfKr58= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, linux@roeck-us.net, shuah@kernel.org, patches@kernelci.org, lkft-triage@lists.linaro.org, pavel@nabladev.com, jonathanh@nvidia.com, f.fainelli@gmail.com, sudipm.mukherjee@gmail.com, rwarsow@gmx.de, conor@kernel.org, hargar@microsoft.com, broonie@kernel.org, achill@achill.org, sr@sladewatkins.com Subject: [PATCH 6.1 0000/1191] 6.1.188-rc1 review Date: Sat, 12 Sep 2026 08:45:28 +0200 Message-ID: <20260912065548.086904252@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.188-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-6.1.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 6.1.188-rc1 X-KernelTest-Deadline: 2026-09-14T06:56+00:00 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is the start of the stable review cycle for the 6.1.188 release. There are 1191 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 14 Sep 2026 06:54:17 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.188-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman Linux 6.1.188-rc1 Zijun Hu Bluetooth: Devcoredump: Fix storing u32 without specifying byte order issue Xixin Liu nvmet-rdma: fix queue leak when connect backlog is exceeded Eric Dumazet net: hsr: must allocate more bytes for RedBox support Dan Carpenter pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init() Tomas Glozar tools/build: Use SYSTEM_BPFTOOL for system bpftool Catalin Marinas kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c Catalin Marinas kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings Eric Dumazet net: hsr: init prune_proxy_timer sooner Sebastian Andrzej Siewior net: hsr: Use the seqnr lock for frames received via interlink port. MD Danish Anwar net: hsr: enable promiscuous mode on interlink port with fwd offload Nick Chan nvme-apple: Reset q->sq_tail during queue init Nick Chan nvme-apple: Prevent shared tags across queues on Apple A11 Arkadiusz Bokowy Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters Dan Carpenter HID: fix an error code in hid_check_device_match() Duoming Zhou wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() Lorenzo Bianconi wifi: mt76: mt7915: fallback to non-wed mode if platform_get_resource fails in mt7915_mmio_wed_init() Manivannan Sadhasivam arm64: dts: qcom: sm8350: Fix the PCI I/O port range Krzysztof Kozlowski arm64: dts: qcom: sm8350: correct PCI phy unit address Abel Vesa arm64: dts: qcom: sm8550: Fix the aoss_qmp node name Neil Armstrong arm64: dts: qcom: sm8550: fix qup_spi0_cs node Krzysztof Kozlowski arm64: dts: qcom: sm8550: correct pinctrl unit address Konrad Dybcio arm64: dts: qcom: sm8550: Flush RSC sleep & wake votes Konrad Dybcio arm64: dts: qcom: sm8550: Separate out X3 idle state Konrad Dybcio arm64: dts: qcom: sm8550: Update idle state time requirements Abel Vesa arm64: dts: qcom: sm8550: Fix SPMI channels size Konrad Dybcio arm64: dts: qcom: sm8550: Mark QUPs and GPI dma-coherent Manivannan Sadhasivam arm64: dts: qcom: sm8550: Fix the PCI I/O port range Konrad Dybcio arm64: dts: qcom: sm8550: Fix GIC_ITS range length Vladimir Zapolskiy arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller Manivannan Sadhasivam arm64: dts: qcom: sm8550: Mark UFS controller as cache coherent Vladimir Zapolskiy arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes Manivannan Sadhasivam arm64: dts: qcom: sm8550: Fix UFS PHY clocks Neil Armstrong arm64: dts: qcom: sm8550: remove invalid interconnect property from cryptobam Stephan Gerhold arm64: dts: qcom: sm8550: Add missing properties for cryptobam Stephen Boyd clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs Konrad Dybcio clk: qcom: gcc-sm8550: use collapse-voting for PCIe GDSCs Manivannan Sadhasivam clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable() Konrad Dybcio clk: qcom: gcc-sm8550: Mark the PCIe GDSCs votable Konrad Dybcio clk: qcom: gcc-sm8550: Add the missing RETAIN_FF_ENABLE GDSC flag Vladimir Zapolskiy clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs Dmitry Baryshkov clk: qcom: rcg2: add clk_rcg2_shared_floor_ops Dzmitry Sankouski arm64: dts: qcom: Re-enable resin on MSM8998 and SDM845 boards Dmitry Baryshkov arm64: dts: qcom: pm8998: don't use GIC_SPI for SPMI interrupts Chen-Yu Tsai pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers Hao Chang pinctrl: mediatek: Fix new design debounce issue Chen-Yu Tsai pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask() Heiko Carstens s390/con3270: move condev definition Arnd Bergmann Bluetooth: coredump: fix building with coredump disabled Wentao Liang nvme: target: rdma: fix ndev refcount leak on queue connect Sandipan Das perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error Jamal Hadi Salim net/sched: sch_htb: limit htb_classify inner-class filter hops Jiayuan Chen tcp: fix corruption of urgent data on multi-segment retransmit Deepanshu Kartikey usb: atm: usbatm: fix invalid ci_range initialization bui duc phuc net: fec: only stop PTP if it was initialized Eric Dumazet slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() Jamal Hadi Salim net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup Maxime Chevallier net: stmmac: selftests: Account for the UC filter list for filtering tests Maxime Chevallier net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering Maxime Chevallier net: stmmac: dwmac4: Account for the primary MAC address for UC filtering Maxime Chevallier net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering Maxime Chevallier net: stmmac: selftests: Check multiple MMC counters Muhammad Usama Anjum selftests/arm64: Treat KSM merge_across_nodes as optional Muhammad Usama Anjum selftests/arm64: Print missing MTE TAP headers Yang Shi selftests: arm64: add hugetlb mte tests Takashi Iwai ALSA: control: Don't add invalid kcontrols to LED layer Takashi Iwai ALSA: control_led: Use guard() for locking Takashi Iwai ALSA: control: Introduce unlocked version for snd_ctl_find_*() helpers Takashi Iwai ALSA: control: Make snd_ctl_find_id() argument const Pablo Neira Ayuso netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() Marino Dzalto netfilter: xt_HL: add pr_fmt and checkentry validation Michal Koutný netfilter: xt_cgroup: Make it independent from net_cls Pablo Neira Ayuso netfilter: nf_tables: move hardware offload step after building the chain blob Alice Mikityanska virtio-net: Ensure that TCP packets don't overflow gso_segs Maxime Chevallier net: stmmac: selftests: Pass the IP proto mask in the TC selftest bui duc phuc net: ethernet: sun4i-emac: Fix IRQ error handling Aleksandr Nogikh libceph: validate banner payload length HyeongJun An ASoC: dapm: Fix off-by-one check on the second enum channel John Johansen apparmor: policy_int make sure list heads are initialized before fail path Thorsten Blum apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init Ruoyu Wang tpm: st33zp24: Validate locality read result Ruoyu Wang tpm: st33zp24: Return zero on status read failure Victor Nogueira net/sched: sch_teql: restore skb->dev on the slave failure path Jamal Hadi Salim net/sched: sfq: clamp quantum to avoid signed overflow soft lockup Jamal Hadi Salim net/sched: hhf: clamp quantum before hhf_change() to avoid overflow Jamal Hadi Salim net/sched: fq_pie: clamp default quantum to avoid signed overflow Jamal Hadi Salim net/sched: sch_codel: clamp default mtu to avoid disabling CoDel Jamal Hadi Salim net/sched: fq_codel: clamp default quantum and mtu Eric Dumazet net/sched: act_skbmod: fix length calculations and avoid invalid header warnings Eric Dumazet net_sched: act_skbmod: use RCU in tcf_skbmod_dump() Frank Sorenson cifs: fix clearing stats for fastest execution of each smb2 command Allison Henderson net/rds: use wq_has_sleeper() in rds_cong_map_updated() Naveen Mamindlapalli octeontx2-af: Fix TL3/TL2 link config ENA clearing Xiang Mei net: qualcomm: rmnet: restore skb->dev on deaggregated frames Cen Zhang (Microsoft) gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free Hyunwoo Kim Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop Chris Lu Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path Chris Lu Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX Pauli Virtanen Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan Pavel Shpakovskiy Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference Pauli Virtanen Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN Geert Uytterhoeven erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic Dan Carpenter scsi: qla2xxx: Fix an loop timeout test Junrui Luo NFSv4/pnfs: key the data server cache on the NFS version Jeff Layton nfs: move the nfs4_data_server_cache into struct nfs_net Junrui Luo NFSv4.2: fix LAYOUTSTATS send buffer exhaustion Mahanta Jambigi net/smc: free pending qentry in smc_llc_flow_stop() before memset Mahanta Jambigi net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition Eric Dumazet inetpeer: randomize RB-tree node comparison using SipHash Ruoyu Wang net: ipa: balance runtime PM reference on remove error Uwe Kleine-König net: ipa: Convert to platform remove callback returning void Marek Czernohous forcedeth: stop the tx_timeout register dump past the requested window Fan Ye net: thunderbolt: Count delivered packets in rx_packets and rx_bytes Ruoyu Wang net: bridge: Reject descending VLAN tunnel ranges Serhat Kumral RDMA/ucma: Allow path records to exactly fit the output buffer Geert Uytterhoeven clk: visconti: Make sure clk_init_data is fully initialized Geert Uytterhoeven clk: ti: Make sure clk_init_data is fully initialized Bradley Morgan prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator Linkai Gong rtc: gamecube: check return value of devm_rtc_register_device() Biju Das irqchip/renesas-rzg2l: Fix loss of interrupt Pengpeng Hou rtc: zynqmp: Return optional clock lookup errors Yi Ding rtc: pcf8563: fix clock provider leak on unbind Li RongQing vdpa/mlx5: fix wrong list iterated in add_direct_chain error path Michael S. Tsirkin virtio_balloon: disable indirect descriptors Jian-Ming Liao i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode Adrian Hunter i3c: mipi-i3c-hci: Refactor PIO register initialization Adrian Hunter i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() Adrian Hunter i3c: mipi-i3c-hci: Quieten initialization messages Jarkko Nikula i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 Jarkko Nikula i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes Ruoyu Wang bonding: initialize err for empty target lists Nguyen Dinh Phi vsock: use sock_error() to consume sk_err after a failed connect HyeongJun An platform/x86: dell-wmi-sysman: Fix instance ID bounds Karl Mehltretter 8139cp: fix Rx and Tx not being disabled in cp_suspend Xu Rao ALSA: hda: Fix connection list comparison in proc output Weiming Shi fs/ntfs3: validate ef->size covers the record's name and value Konstantin Komarov fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() Baokun Li cuse: wait for pending RCU callbacks on module exit Nikolay Aleksandrov net: bridge: vlan: fix inverted default vlan notification Maximilian Immanuel Brandtner tls: fix RX desync on overlapping skbs Xiang Mei vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes Joas Antonio dos Santos ipvs: fix integer overflow in ftp helper port/address parsing Xin Xie net: hsr: free learned nodes on device setup failure Lukasz Majewski net: hsr: Provide RedBox support (HSR-SAN) Lukasz Majewski net: hsr: Use full string description when opening HSR network device Sebastian Andrzej Siewior hsr: Use a single struct for self_node. Qingfang Deng pppox: drain queued packets on channel handoff Vladimir Oltean net: dsa: b53: fix error propagation from b53_fdb_dump() Junseo Lim net: kcm: Hold RCU read lock while running BPF parser Karl Mehltretter octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap() Mathieu Dubois-Briand clk: ti: mux: resolve parent clocks by DT index, not by name Ethan Carter Edwards clk: ti: use kcalloc() instead of kzalloc() Ruoyu Wang NFSv4: remove callback IDR entry on client allocation failure Arnaud Bonnet nfs: refactor pNFS functions using clear_and_wake_up_bit Arnaud Bonnet nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper Junseo Lim bpf: Reject negative optlen in cgroup getsockopt hook Junseo Lim lwt_bpf: Restore reserved headroom after xmit program ZhangGuoDong smb/server: preserve error status in smb2_handle_negotiate() Guangshuo Li ksmbd: Do not skip lock checks for single-byte ranges Hongyan Xu block: mtip32xx: synchronize ioctls with device removal Niklas Cassel null_blk: serialize configfs attribute updates with device setup Zizhi Wo null_blk: serialize configfs attribute stores with the lock Zizhi Wo null_blk: reject per-device queue resize for shared tag set Zizhi Wo null_blk: free global tag_set on init error path Zizhi Wo null_blk: register configfs subsystem after creating default devices Shin'ichiro Kawasaki null_blk: add configfs variable shared_tags Shin'ichiro Kawasaki null_blk: support read-only and offline zone conditions Zizhi Wo null_blk: use DEFINE_MUTEX for the file-scope mutex Huisong Li mailbox: pcc: Fix command timeout due to missed interrupt Sudeep Holla Revert "mailbox/pcc: support mailbox management of the shared buffer" Adam Young mailbox/pcc: support mailbox management of the shared buffer Sudeep Holla mailbox: pcc: Always map the shared memory communication address Sudeep Holla mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() Sudeep Holla mailbox: pcc: Always clear the platform ack interrupt first Huisong Li mailbox: pcc: Fix the possible race in updation of chan_in_use flag Linmao Li mailbox: rockchip: disable pclk on probe failure and unbind Arnaldo Carvalho de Melo perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() Arnaldo Carvalho de Melo perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() Zhushuai Yin crypto: hisilicon/sec2 - fix CCM algorithm long packet failure Israel Téllez García bpf: Fix pending_pos walk on 32-bit ring position wrap Hongyan Xu ACPI: scan: fix bus ID cleanup on device_add() failures Pengpeng Hou ASoC: SOF: validate topology volume range before allocation Steven Rostedt tracing: Have trace_event_update_all() only handle module that is loading Masami Hiramatsu (Google) tracing: Remove "__attribute__()" from the type field of event format Aleksandr Nogikh ALSA: core: Fix use-after-free in snd_card_do_free() Chandrakanth Patil scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers Phillip Lougher Squashfs: check block offset is not negative Krystian Kaniewski ocfs2: fix circular locking dependency in ocfs2_init_acl() Yuan Chen bpftool: Fix double close in map dump Bijan Tabatabai x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported John Keeping ALSA: seq: midi: Serialize input teardown with event_input Takashi Iwai ALSA: seq: midi: Optimize event_input locking with RCU Yuho Choi clocksource/drivers/armada: Unwind timer clock on init failure Guangshuo Li clocksource/drivers/clps711x: Do not unmap clocksource MMIO Peter Oberparleiter s390/debug: Fix deadlock during unregister Yuho Choi xenbus: Unregister reboot notifier on init failure Henrik Grimler power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address Henrik Grimler power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address Henrik Grimler power: supply: bq27xxx: bq27520g4: fix REG_TTES address Matti Vaittinen power: supply: bd99954: Drop bad register fields Felix Gu spi: img-spfi: don't disable runtime PM on DMA deferred probe Vineet Gupta selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM Pu Lehui selftests/bpf: Add description for running vmtest on RV64 Pu Lehui selftests/bpf: Support local rootfs image for vmtest Pu Lehui selftests/bpf: Limit URLS parsing logic to actual scope in vmtest Mohammad Abu-Khader kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix Ran Hongyun UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC Rosen Penev ASoC: xilinx: formatter_pcm: fix stream_data leak on open error Yuho Choi ubi: Fix rollback for explicit UBI device numbers Zhihao Cheng ubi: fastmap: Add module parameter to control reserving filling pool PEBs Zhihao Cheng ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs Zhihao Cheng ubi: fastmap: Wait until there are enough free PEBs before filling pools Yang Li ubi: Simplify bool conversion ZhaoLong Wang ubi: fastmap: Add fastmap control support for module parameter Zhihao Cheng UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs Zhihao Cheng UBI: Preserve torture flag when rescheduling failed erasures Zhihao Cheng ubi: Replace erase_block() with sync_erase() Zhihao Cheng ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap Zhihao Cheng ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash Zhihao Cheng ubi: fastmap: Fix missed ec updating after erasing old fastmap data block LiangCheng Wang ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready bui duc phuc ASoC: pxa: Use devm_clk_get_optional() for extclk clock Zhu Yanjun RDMA/cma: Fix WARNING in res_to_rt Fan Wu RDMA/cxgb4: Free debugfs on registration failure Guangshuo Li dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal Yun Zhou nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing Linmao Li nfc: digital: Do not dump a NULL response in command completion Yinhao Hu nfc: pn533: hold a reference to the request skb during send_frame Doruk Tan Ozturk nfc: llcp: bound SNL TLV parsing to the skb and add length checks Zhenghang Xiao nfc: nci: fix double completion race in nci_data_exchange_complete Breno Leitao nfc: llcp: read llcp_sock->local under the socket lock in getsockopt Breno Leitao nfc: llcp: avoid userspace overflow on invalid optlen Guixin Liu nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() Sven Peter nvme-apple: Drop the PRP null check chicken bit Nick Chan nvme: apple: Add Apple A11 support Chaitanya Kulkarni nvme-apple: return directly instead of else Sagi Grimberg nvme: introduce nvme_start_request Sven Peter nvme-apple: Never set the opcode in the NVMMU TCB Sven Peter nvme-apple: Don't set a DMA direction for commands without a data transfer Jorijn van der Graaf ASoC: qcom: q6apm: keep the graph start count in sync with the DSP Babanpreet Singh spi: sprd-adi: Fix probe succeeding without registering the controller Michael Walle powerpc/configs: enable CONFIG_RAS to fix EDAC support Weiming Shi SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 Marco Elver arm64: Disable KCSAN instrumentation in delay.o Karl Mehltretter m68k: Fix backtraces for non-running tasks Desnes Nunes iommu/vt-d: Fix UCTP context table slot when copying root entries Danila Chernetsov fbdev: kyro: Validate overlay viewport coordinates Myeonghun Pak fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() Ian Rogers perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads Ian Rogers perf synthetic-events: Fix uninitialized pthread_join Ian Rogers perf stat: Fix evsel_list leak in cmd_stat Namhyung Kim perf stat: Clear screen only if output file is a tty Rosen Penev ARM: dts: helios4: add SATA regulator supplies Rosen Penev ARM: dts: helios4: add vcc-supply to GPIO expander Rosen Penev ARM: dts: helios4: add vcc-supply to EEPROM Tomáš Macholda arm64: dts: turris-mox: fix usb3 phys Victor Nogueira net/sched: cls_api: fix teardown of an adopted proto on insert-race loss Nikhil Gautam iio: light: gp2ap002: re-enable irq if runtime suspend fails Nikhil Gautam iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes Ali Ahmet Memis Bluetooth: MSFT: validate evt_prefix_len against the response length Linmao Li Bluetooth: MGMT: free the mesh send cancel command when it is cancelled Linmao Li Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths Linmao Li Bluetooth: hci_conn: fix the SCO setup context lifetime Luiz Augusto von Dentz Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync Jonas Dreßler Bluetooth: hci_event: Use HCI error defines instead of magic values HyeongJun An Bluetooth: virtio_bt: avoid OOB read of build info string Yang Xiuwei scsi: sd: Fix sd_done() sense handling condition Tanushree Shah perf trace-event: Fix integer truncation in do_read() and skip() Zijun Hu Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() Zijun Hu Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event Ricardo Neri sched/fair: Check CPU capacity before comparing group types during load balance Yuho Choi ACPI: video: Release PCI device reference after lookup Kamal Wadhwa regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling Yeoreum Yun coresight: etm4x: fix underflow for usage of (nrseqstate - 1) James Clark coresight: Change syncfreq to be a u8 Yeoreum Yun coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() Loic Poulain phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Linkai Gong soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() Yichong Chen hugetlbfs: release subpool on fill_super failure Simon Glass pinctrl: rockchip: Reset the pin count when recalculating SoC data Mukesh Ojha firmware_loader: do not queue completed sysfs fallback requests Manish Rangankar scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path Timur Kristóf drm/amdgpu/gfx6: Use PFP on the compute queues too Timur Kristóf drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets Tanushree Shah perf trace-event: Fix buffer overflow in read_string() Gerald Loacker phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table Felix Gu phy: sunplus: fix error handling in sp_uphy_init() Meghana Malladi arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node Jan Kara ext4: fix spurious message about orphan cleanup on RO fs Timur Kristóf drm/amdgpu/gfx6: Fixup emit_cntxcntl() Pengpeng Hou mfd: iqs62x: Reject zero-length firmware records Pengpeng Hou mfd: rave-sp: validate received frame payload lengths Vladimir Murzin arm64: hibernate: Restore DAIF state on error Ada Couprie Diaz arm64: hibernate: mask DAIF before restoring hibernated kernel Felix Fietkau wifi: mac80211: skip default WMM setup for AP_VLAN links Leon Romanovsky RDMA/erdma: restrict the driver to little-endian systems Shuangpeng Bai RDMA/siw: Fix use-after-free in siw_accept() Guoqing Jiang RDMA/siw: Introduce siw_free_cm_id Yehyeong Lee IB/isert: post the full-feature receive buffers after session registration Yehyeong Lee IB/isert: delay the final Login Response until the session is registered Karl Mehltretter cpufreq: imx6q: fix out-of-bounds write when probed more than once Karl Mehltretter cpufreq: imx6q: fix devres accumulation across driver rebind Jernej Skrabec drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz Jernej Skrabec drm/sun4i: dw-hdmi: Drop TCON TOP port reference Jernej Skrabec drm/sun4i: tcon: Drop remote endpoint reference Jernej Skrabec drm/sun4i: crtc: Propagate layer initialization error Jernej Skrabec drm/sun4i: tcon: Drop TCON TOP device reference Jernej Skrabec drm/sun4i: tcon: Set output mux for DSI and LVDS Jernej Skrabec drm/sun4i: tcon-top: Keep mixer routes distinct Geert Uytterhoeven bitfield: Add non-constant field_{prep,get}() helpers Geert Uytterhoeven bitfield: Add less-checking __FIELD_{GET,PREP}() Kuninori Morimoto of: property: add of_graph_get_next_port_endpoint() Kuninori Morimoto of: property: add of_graph_get_next_port() Kuninori Morimoto of: property: use unsigned int return on of_graph_get_endpoint_count() Kuninori Morimoto of: property: add missing kerneldoc for of_graph_get_endpoint_count() Jernej Skrabec drm/sun4i: vi scaler: Fix coefficient selection Cen Zhang ocfs2: synchronize heartbeat callbacks with o2net teardown Joseph Qi ocfs2: use bitmap API in fill_node_map Xie Yuanbin ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults Yehyeong Lee RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ Cheng Xu RDMA/erdma: Hold CQ references when processing EQ events Robertus Diawan Chris modpost: prevent leak when early return no suffix .o in read_symbols() Sergei Litvin scripts/tags.sh: Prevent binary files appearing in cscope.files Jialu Xu scripts/tags.sh: improve compiled sources generation Manivannan Sadhasivam arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies Luca Weiss arm64: dts: qcom: sm7225-fairphone-fp4: move status property down Sayali Patil selftests/mm: fix ternary operator precedence in ksm_tests Mukesh Ojha remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() Mukesh Ojha remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() Mukesh Ojha remoteproc: Move resource table data structure to its own header Andreas Kemnade drm/omap: dsi: Do not copy isr table Yichong Chen fat: release buffer head after rebuilding parent Guangshuo Li rapidio: clear mport->net when rio_add_net() fails Calvin Owens pps-gpio: remove dead capture_clear code Michael Byczkowski pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler Bastien Curutchet pps: clients: gpio: Bypass edge's direction check when not needed Calvin Owens pps: don't try to wait for negative timeouts in PPS_FETCH Bradley Morgan lib/string: fix memchr_inv() for large ranges Tao Cui block/kyber-iosched: flush per-cpu latency buckets over possible CPUs Tao Cui block/blk-iocost: collect per-cpu latency stats over possible CPUs Tao Cui block/blk-stat: drain per-cpu callback stats over possible CPUs Zheng Qixing blk-cgroup: skip dying blkg in blkcg_activate_policy() Breno Leitao phonet: pep: do not write beyond optlen in getsockopt Sang-Heon Jeon iio: light: tsl2583: return zero in write_raw() on success Sang-Heon Jeon iio: light: isl29028: return zero in write_raw() on success Yuanshen Cao iio: light: tsl2772: fix ALS calibscale readback Arnaldo Carvalho de Melo perf intel-bts: Fix off-by-one in auxtrace_info minimum size check Arnaldo Carvalho de Melo perf intel-pt: Fix off-by-one in auxtrace_info minimum size check Arnaldo Carvalho de Melo perf auxtrace: Fix queue grow overflow and old array leak Arnaldo Carvalho de Melo perf thread-stack: Fix heap buffer overflow on branch stack wrap copy Jiancheng Huang HID: lg4ff: validate report length before fixed offsets Ai Chao HID: i2c-hid: Fix "(null)" output when reading report descriptor fails Hans de Goede HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling Hans de Goede HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() Yousef Alhouseen HID: synchronize input before cleaning up a failed probe Dmitry Torokhov HID: ensure timely release of driver-allocated resources Dmitry Torokhov HID: split apart hid_device_probe to make logic more apparent Karl Mehltretter tty: clear cdev pointer after cdev_add() failure Karl Mehltretter serial: amba-pl011: unprepare console clock on unregister Thomas Bogendoerfer MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL Gou Hao powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass Laxman Acharya Padhya firmware: coreboot: Validate table bounds Titouan Ameline de Cadeville firmware: google: Add bounds checks in coreboot_table_populate() Zhao Li wifi: mac80211: skip unused probe response countdown offsets Slawomir Stepien wifi: zd1211rw: reject secondary interfaces to prevent conflicts Zhao Li wifi: mac80211: send TWT teardown to peer after setup TX failure Pranjal Shrivastava iommu/arm-smmu-v3: Convert to use atomic poll timeout Linghui Wu wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump Felix Fietkau wifi: mt76: mt7915: release hif2 reference on probe IRQ failure Felix Fietkau wifi: mt76: mt7915: fix ext PHY use-after-free on register error path Ryder Lee wifi: mt76: mt7915: enable coredump support Ryder Lee wifi: mt76: mt7915: add full system reset into debugfs Bo Jiao wifi: mt76: mt7915: enable full system reset support Bo Jiao wifi: mt76: mt7915: rework mt7915_dma_reset() Felix Fietkau wifi: mt76: mt7915: fix double hif2 init on the non-WED path Felix Fietkau wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement Arnaldo Carvalho de Melo perf machine: Check snprintf truncation for guest kallsyms path Arnaldo Carvalho de Melo perf machine: Free scandir entries in guest kernel map creation Arnaldo Carvalho de Melo perf machine: Reset errno before strtol in guest kernel map creation Arnaldo Carvalho de Melo perf machine: Don't abort guest map creation on first inaccessible dir Arnaldo Carvalho de Melo perf machine: Check snprintf truncation in machines__findnew() Arnaldo Carvalho de Melo perf machine: Use snprintf() for guestmount path construction Arnaldo Carvalho de Melo perf machine: Guard against NULL strlist in machines__findnew() Joy Zou regulator: core: use system_freezable_wq for init complete work Jeff Johnson wifi: ath11k: fix leak in ath11k_service_ready_ext_event() Konrad Dybcio drm/msm/dsi: Drop dev_pm_opp_set_rate(0) Konrad Dybcio drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) Leo Yan perf: arm_spe: Make wakeup range check overflow safe Felix Fietkau wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields Felix Fietkau wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie Felix Fietkau wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss Eason Lai wifi: mt76: mt792x: Fix memory leak in SDIO TX path Zhi-Jun You wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 Lorenzo Bianconi wifi: mt76: mt7915: enable wed for mt7986-wmac chipset Lorenzo Bianconi wifi: mt76: mt7915: enable wed for mt7986 chipset Lorenzo Bianconi wifi: mt76: mt7915: move wed init routines in mmio.c Laxman Acharya Padhya wifi: mt76: mt7921: validate CLC firmware records Devin Wittmayer wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length Yichong Chen fanotify: report full event length for FIONREAD Abdun Nihaal misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() Naveen Kumar Chaudhary locking/lockdep: Fix NULL pointer dereference in __lock_set_class() Adrian Hunter i3c: master: Fix device_register() error path Jakub Kicinski i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices Aneesh Kumar K.V (Arm) iommu/dma: Check atomic pool allocation result directly Vladimir Zapolskiy clk: qcom: Return expected ENOMEM error on dynamic allocation failure Stanislav Kinsburskii lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone Pu Lehui bpf: Fix potential UAF in bpf_netns_link_update_prog Hongyan Xu power: supply: sc2731_charger: cancel work on remove Uwe Kleine-König power: supply: sc2731_charger: Convert to platform remove callback returning void Hongyan Xu power: supply: isp1704_charger: cancel work on remove Manivannan Sadhasivam arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries Manivannan Sadhasivam arm64: dts: qcom: sm8550: Fix the msi-map entries Neil Armstrong arm64: dts: qcom: sm8550: Use GIC-ITS for PCIe0 and PCIe1 Manivannan Sadhasivam arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries Manivannan Sadhasivam arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries Manivannan Sadhasivam arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries Manivannan Sadhasivam arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries Manivannan Sadhasivam arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries Manivannan Sadhasivam arm64: dts: qcom: Remove "iommus" property from PCIe nodes Abel Vesa arm64: dts: qcom: sm8550: Add PCIe PHYs and controllers nodes Abel Vesa arm64: dts: qcom: sm8550: Add UFS host controller and phy nodes Dmitry Baryshkov arm64: dts: qcom: sm8350: add PCIe devices Neil Armstrong arm64: dts: qcom: sm8550: add QCrypto nodes Abel Vesa arm64: dts: qcom: Add base SM8550 dtsi Konrad Dybcio arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en Dmitry Baryshkov clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration Stephen Boyd clk: qcom: gcc-sm8550: Don't park the USB RCG at registration time Konrad Dybcio clk: qcom: gcc-sm8550: Mark RCGs shared where applicable Abel Vesa clk: qcom: Add GCC driver for SM8550 Abel Vesa clk: qcom: Add LUCID_OLE PLL type for SM8550 Abel Vesa dt-bindings: clock: Add SM8550 GCC clocks Konrad Dybcio arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep Dzmitry Sankouski arm64: dts: qcom: sagit: add initial device tree for sagit Itai Handler rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs Valentin Schneider rcu: Rename rcu_momentary_dyntick_idle() into rcu_momentary_eqs() Yue Haibing rcu: Remove unused function declaration rcu_eqs_special_set() Daniel Bristot de Oliveira tracing/osnoise: Add preempt and/or irq disabled options Daniel Bristot de Oliveira tracing/osnoise: Add PANIC_ON_STOP option Daniel Bristot de Oliveira tracing/osnoise: Add OSNOISE_WORKLOAD option Daniel Bristot de Oliveira tracing/osnoise: Add osnoise/options file Cheng-Han Wu selftests/zram: fix kernel_gte() for POSIX sh Sajal Gupta md/raid5-ppl: fix use-after-free in ppl_do_flush() Manivannan Sadhasivam bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET Abdun Nihaal wifi: rtlwifi: pci: fix error path in rtl_pci_probe() Guixin Liu nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request Yehyeong Lee IB/isert: reject login PDUs declaring more data than was received Yehyeong Lee IB/isert: reject PDUs declaring more data than was received Leon Romanovsky RDMA/cxgb4: free STAG index when TPT entry write fails Leon Romanovsky RDMA/mlx5: Send cong param changes to the resolved port mdev Leon Romanovsky RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs David Strahan scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. David Lee nilfs2: prevent out-of-bounds read in super root block parsing Joshua Crofts nilfs2: fix infinite loop in nilfs_clean_segments() longlong yan clk/x86: pmc_atom: add kasprintf return value check Myeonghun Pak clk: palmas: Manage external-control prepare with devm Guangshuo Li clk: tegra: tegra124-emc: put EMC node on register failure Ondrej Jirman arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix Yonatan Nachum RDMA/efa: Fix PBL chunk length computation Weiming Shi fs/ntfs3: reject restart table growth beyond U16_MAX entries Ivy Lopez staging: rtl8723bs: use kfree_sensitive() for key material Bjorn Andersson remoteproc: Prevent crash handling to race with rproc_del() Jingyi Wang remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() Bjorn Andersson remoteproc: Allow shutdown of crashed processors Peng Fan remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown() Babanpreet Singh w1: ds2482: Fix signedness bug in ds2482_w1_triplet() Yichong Chen isofs: release zisofs block pointer buffer head Maher Sanalla RDMA/mlx5: Fix integer overflow of user QP buffer size Can Peng crypto: keembay - publish OF module alias for OCS AES/SM4 Linmao Li crypto: keembay - Initialize completion before requesting IRQ Li Qiang scsi: ufs: debugfs: Reserve space for a string terminator Babanpreet Singh power: supply: sbs-battery: Use a per-device serial number buffer James Clark tools/build: Allow versioning of all LLVM tools defined in Makefile.include Tomas Glozar tools/build: Add bpftool-skeletons feature test Justin Yeh pinctrl: mediatek: free EINT resources on unbind Nícolas F. R. A. Prado pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms Hao Chang pinctrl: mediatek: Fix the invalid conditions Hao Chang pinctrl: mediatek: Add EINT support for multiple addresses Andy Shevchenko pinctrl: mediatek: Use C99 initializers in PINCTRL_PIN_GROUP() Feng Yang selftests/bpf: Fix memory leak on subtest_states reallocation Feng Yang selftests/bpf: Fix incorrect error checking for pthread_create Karl Mehltretter ARM: lpc32xx: only run SoC init on LPC32xx hardware Fabio Estevam arm64: dts: rockchip: Fix Gru WLAN sideband interrupt Weiming Wu fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init Florian Westphal netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet Can Peng drm/tve200: add OF module alias for autoloading Cosmo Chou leds: pca9532: Fix phantom device registration on missing hardware Leo Yan perf cs-etm: Avoid truncating AUX buffer sizes to int Leo Yan perf cs-etm: Flush thread stacks after decoder reset Andre Przywara ARM: dts: allwinner: a10: Fix PMU interrupt Xiang Mei ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() Guanghui Yang <3497809730@qq.com> ext4: fix buffer_head leak in ext4_init_orphan_info Jeff Johnson wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() Jeff Johnson wifi: ath11k: Correctly copy the hint BSSID in WMI scan request Jeff Johnson wifi: ath6kl: avoid buffer overreads in WMI event handlers Baokun Li ext4: drain in-flight DIO before buffered write fallback Pengpeng Hou thermal: intel: int3400: clean up ODVP on probe failures Mukesh Ojha iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() Haoxiang Li iommu/qcom: Remove sysfs device on probe failure path Patrisious Haddad RDMA/core: Fix potential use after free in ib_dealloc_pd_user() Patrisious Haddad RDMA/core: Fix potential use after free in ib_free_cq() Mark Zhang RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() Patrisious Haddad RDMA/core: Fix potential use after free in counter_release() Patrisious Haddad RDMA/core: Fix potential use after free in ib_destroy_srq_user() Patrisious Haddad RDMA/core: Fix potential use after free in ib_destroy_cq_user() Patrisious Haddad RDMA/core: Fix use after free in ib_query_qp() Patrisious Haddad RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations Jason Gunthorpe RDMA/nldev: Fix locking when accessing mr->pd Kalesh AP RDMA/restrack: Fix typos in the comments Chiara Meiohas RDMA/core: Add an option to display driver-specific QPs in the rdmatool Patrisious Haddad RDMA/core: Add support to set privileged QKEY parameter Or Har-Toov RDMA/nldev: Add NULL check to silence false warnings Myeonghun Pak RDMA/erdma: Fix CEQ tasklet use-after-free on removal Leon Romanovsky RDMA/srpt: Pass the mapped task attribute to target_init_cmd() Ricardo B. Marlière libbpf: Search /lib64 and /lib in resolve_full_path() Yun Zhou ext4: skip extra isize expansion during mount to prevent deadlock Xiang Mei ext4: fix out-of-bounds read in ext4_read_inline_dir() Chen Pei ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root Pengpeng Hou ACPI: processor: validate MADT IOAPIC entry bounds Zhu Ling ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer Pengpeng Hou RDMA/nldev: validate dynamic counter attribute length Kemeng Shi irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() Marco Elver kcsan: avoid unintended access checking in NMIs TanZheng RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters Ibrahim Hashimov RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] Danila Chernetsov RDMA/hfi1: Propagate sdma_txinit_ahg() errors Jun Yan arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe Linmao Li ASoC: meson: Keep link pointers valid on realloc failure Koichiro Den dmaengine: dw-edma: Clear stale requests on termination Koichiro Den dmaengine: dw-edma: Serialize channel state checks Koichiro Den dmaengine: dw-edma: Serialize abort state updates Yuho Choi driver core: soc: Unregister bus on early device registration failure Greg Kroah-Hartman driver core: soc: remove layering violation for the soc_bus Alban Bedel software node: Fix software_node_get_reference_args() with index -1 Ian Rogers perf ui hists: Fix uninitialized stack memory free on pstack allocation failure zhouminqiang mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() Ruoyu Wang mtd: mtdswap: Avoid freeing registered blktrans device twice Pengpeng Hou soc: ti: knav_qmss: Remove debugfs file on teardown Md Shofiqul Islam soc: ti: knav_qmss_queue: Implement resource cleanup in remove() Xiang Mei vfio/pci: clear vdev->msi_perm after freeing it on init failure Myeonghun Pak char: xilinx_hwicap: unregister class on init errors Pei Xiao ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Jiri Slaby (SUSE) tty: ipoctal: convert to u8 and size_t Jiri Slaby (SUSE) tty: propagate u8 data to tty_operations::write() Jiri Slaby tty: hvsi: remove an extra variable from hvsi_write() Sven Schnelle s390/con3270: fix formatting issues Sven Schnelle s390/3270: unify con3270 + tty3270 Sven Schnelle s390/tty3270: add tty3270_create_view() Thomas Richter s390/con3215: Fix white space errors Linmao Li ppdev: prevent overflow when setting port timeout Pengpeng Hou misc: ad525x_dpot: use driver core groups for sysfs files Gleb Markov misc: rtsx: add missing write register handling Gui-Dong Han misc: bcm-vk: Use acquire/release for msgq_inited Pavel Zhigulin speakup: keyhelp: guard letter_offsets possible out-of-range indexing Christophe JAILLET accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() Yuho Choi uio: Fix stale info pointer in failed registration path David Lee UDF symlink pathComponent header OOB read Karl Mehltretter tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 Xu Yang usb: gadget: f_uac1_legacy: remove broken string configfs attributes Rafael J. Wysocki ACPI: processor: idle: Expand _LPI package sanity checks Thorsten Blum crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping Pu Lehui bpf: Sync tail_call_reachable with callee state on entry Mikko Perttunen gpu: host1x: Avoid stack over-read in debug output helpers Mikko Perttunen gpu: host1x: Fix offset calculation in trace_write_gather Avraham Stern wifi: iwlwifi: mei: pass correct argument to function Avraham Stern wifi: iwlwifi: mei: check SAP message length before reading it Avraham Stern wifi: iwlwifi: mei: add support for SAP version 4 Avraham Stern wifi: iwlmei: don't send SAP messages if AMT is disabled Emmanuel Grumbach wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser Konrad Dybcio arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO Maoyi Xie drm/bridge: tc358767: clamp the reported AUX read size to the request Uday Khare remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev Zhongqiu Han cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() Rafael J. Wysocki cpufreq: intel_pstate: Fix setting minimum P-state at init time Yuho Choi PCI: xgene: Drop unnecessary OF node reference Marc Zyngier PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN Dan Carpenter cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() John Groves dax: read holder_ops once in dax_holder_notify_failure() Bryam Vargas libnvdimm/labels: Bound the on-media label size before the shift Baochen Qiang wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate Kyle Zeng hfsplus: validate thread record before delete key rebuild Vishnu Santhosh rpmsg: glink: fix deadlock in endpoint destroy during driver detach Srinivas Kandagatla rpmsg: glink: remove duplicate code for rpmsg device remove Xiang Mei isofs: fix out-of-bounds page array access on empty zisofs block James Calligeros ASoC: apple: mca: increase SERDES reset delay Leon Romanovsky RDMA/hfi1: Initialize debugfs after probe completes Leon Romanovsky RDMA/hfi1: Stop flushing the global IB workqueue Leon Romanovsky RDMA/hfi1: Create workqueues before device initialization Leon Romanovsky RDMA/hfi1: Remove redundant PCI device ID validation Leon Romanovsky RDMA/hfi1: Free RX data on late probe failure Leon Romanovsky RDMA/hfi1: Preserve unit 0 on allocation failure Sean Rhodes misc: rtsx_usb: avoid USB I/O in runtime autosuspend Pengpeng Hou pmdomain: bcm: bcm2835: handle genpd provider registration errors Evgenii Burenchev ALSA: hpi: Check transport errors during HPI6000 adapter initialization Xiang Mei xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full Yuho Choi hwrng: ks-sa - Fix runtime PM cleanup on registration failure Martin Kaiser hwrng: ks-sa - access private data via struct hwrng Leon Romanovsky RDMA/ipoib: Drain RCU callbacks during module teardown Leon Romanovsky RDMA/mlx5: Drain RCU callbacks during module teardown Mark Zhang RDMA/mlx: Calling qp event handler in workqueue context Leon Romanovsky RDMA/core: Wait for RCU callbacks before unloading ib_core Mert Seftali iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE Pengpeng Hou bus: qcom-ebi2: use managed resources for clocks and children Yu Peng perf metricgroup: Fix metric expression copy leaks Arnaldo Carvalho de Melo perf metricgroups: Use zfree() to reduce chances of use after free Laxman Acharya Padhya drm/panel: samsung-s6d16d0: Power off on prepare failure Biju Das usb: renesas_usbhs: Fix power-off ordering on unbind Fei Shao usb: mtu3: allow system suspend during active gadget connection Linmao Li platform/surface: acpi-notify: Check ACPI companion before use Linmao Li platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL Gary Guo usb: fix UAF when probe runs concurrent to dyn ID removal Greg Kroah-Hartman USB: make to_usb_driver() use container_of_const() Greg Kroah-Hartman USB: make single lock for all usb dynamic id lists Yajun Deng USB: core: Use device_driver directly in struct usb_driver and usb_device_driver Manish Mandlik Bluetooth: btusb: Add btusb devcoredump support Abhishek Pandit-Subedi Bluetooth: Add support for hci devcoredump Ruoyu Wang usb: gadget: aspeed_udc: check endpoint DMA allocation Uwe Kleine-König usb: gadget: aspeed_udc: Convert to platform remove callback returning void Michael Bommarito usb: gadget: configfs: fix out-of-bounds read of qw_sign Wolfram Sang hwspinlock: propagate errno when registering single lock Armin Wolf platform/x86: dell-wmi-base: Fix resource leak on module load failure Armin Wolf platform/x86: dell-privacy: Fix race condition Cosmo Chou leds: pca9532: Fix inverted GPIO output polarity Wei Wang iommu/amd: Fix false positive in SB IOAPIC IVRS validation Fu Hao iommu/amd: Add support for Hygon family 18h model 4h IOAPIC Wei Wang iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors Vladimir Zapolskiy iommu/msm: Return -ENOMEM on memory allocation failure in probe Akari Tsuyukusa iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX Yuho Choi bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation Sanghyun Park bpf: Fix use-after-free on mm_struct in bpf_find_vma() Breno Leitao efi: fix stale reference to efi_recover_from_page_fault() Daniel Borkmann bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux Aleksandr Nogikh udf: Mark LVID buffer as uptodate before marking it dirty Hongyan Xu usb: gadget: r8a66597: avoid double free of ep0_req in probe error path Dan Carpenter thermal/drivers/rcar: Fix error checking in probe() Daniel Lezcano thermal/hwmon: Do not set no_hwmon before calling thermal_add_hwmon_sysfs() Niklas Söderlund thermal/drivers/rcar_gen3_thermal: Fix device initialization Niklas Söderlund thermal/drivers/rcar_gen3_thermal: Create device local ops struct Niklas Söderlund thermal/drivers/rcar_gen3_thermal: Do not call set_trips() when resuming Herman van Hazendonk clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() Herman van Hazendonk clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains Herman van Hazendonk clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status David Woodhouse timekeeping: Account for monotonicity adjustment in ntp_error Thomas Weißschuh y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 Yuho Choi clocksource: Unregister subsystem on device registration failure Jiangshan Yi selftests: timers: leap-a-day: Fix -w option and update usage comment Kemeng Shi irqchip/gic-v3-its: Fix memleak in its_probe_one() Feng Yang selftests/bpf: Fix memory leak in msg_alloc_iov Malaya Kumar Rout selftests/bpf: Fix memory leak in msg_alloc_iov error path Evgenii Burenchev ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() Dawei Feng staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() Ayush Mukkanwar staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown Ayush Mukkanwar staging: octeon: replace pr_warn with dev_warn in fill and rx paths Ayush Mukkanwar staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions Yuvraj Singh Chauhan staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown Ayush Mukkanwar staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown Dan Carpenter staging: fbtft: Use sysfs_emit_at() to print to sysfs file Bryam Vargas greybus: audio: bound the topology section sizes against the fetched size Ahmet Sezgin Duran staging: sm750fb: gate dualview dataflow using g_dualview Alexander A. Klimov staging: greybus: audio: correct sscanf() return value check Cen Zhang wifi: mac80211_hwsim: avoid NULL skb in stop queue drain Ruoyu Wang bus: qcom-ebi2: Fix clock leak on probe failure Krzysztof Kozlowski bus: qcom-ebi2: Simplify with scoped for each OF child loop Luca Weiss arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name Haowen Tu PM: sleep: Fix off-by-one in wakelocks number limit check Yuho Choi bus: ti-sysc: Fix /chosen node reference leak Shin'ichiro Kawasaki nvmet-rdma: fix response resource leak on queue teardown Shin'ichiro Kawasaki nvmet-rdma: factor out response resource cleanup Guixin Liu nvmet-rdma: use sbitmap to replace rsp free list Hannes Reinecke nvmet-rdma: avoid circular locking dependency on install_queue() Gui-Dong Han nvme-apple: Use acquire/release for queue enabled state Pengpeng Hou crypto: sa2ul - stop probe if context pool creation fails Lothar Rubusch crypto: atmel-sha204a - fix heap info leak on I2C transfer failure Thorsten Blum crypto: atmel-ecc - reject hardware ECDH without a public key Thorsten Blum crypto: atmel-ecc - clean up and improve ECDH comments Thorsten Blum crypto: atmel-ecc - replace min_t with min Giovanni Cabiddu crypto: qat - clear AES key schedule from stack Sandipan Das perf/x86/amd/uncore: Add group validation Sandipan Das perf/x86/amd/uncore: Refactor uncore management Pengpeng Hou wifi: rtw89: fix HE extended capability length check Tzung-Bi Shih platform/chrome: sensorhub: Fix memory overread in ring handler Hisam Mehboob selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check Hanlin Song csky: Fix a4/a5 restoration in syscall trace path Sanjay Chitroda iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure Srinivas Kandagatla soundwire: qcom: Fix port exhaustion check in stream_alloc_ports Vladimir Zapolskiy dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe Suraj Gupta dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Vladimir Zapolskiy dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure Yichong Chen tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands Sahid Orentino Ferdjaoui bpftool: clean-up usage of libbpf_get_error() Quentin Monnet bpftool: Define _GNU_SOURCE only once Yichong Chen tools/bpf/bpftool: Reset vmlinux BTF after map commands Asad Kamal drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup Asad Kamal drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup Ian Rogers perf tests: Fix flakiness in BPF counters test on hybrid systems Namhyung Kim perf test: Fix perf stat --bpf-counters on hybrid machines Tengda Wu perf test: Use sqrtloop workload to test bperf event Veronika Molnarova perf test stat_bpf_counter.sh: Stabilize the test results Ian Rogers perf test bpf-counters: Add test for BPF event modifier Thomas Richter perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test Athira Rajeev perf tests stat_bpf_counters: Fix usage of '==' to address shellcheck warning Sean Young media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define Sean Young media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define Daniel McCarthy pinctrl: bcm2835: Don't remove an unregistered GPIO chip Zide Chen perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails Chen, Yu C sched/fair: Fix overflow in update_tg_cfs_runnable() Henrik Grimler drm/lima: call drm_mm_init() with a valid allocation range Brian Masney clk: imx: scu: drop redundant init.ops variable assignment Weigang He ARM: imx: fix device_node refcount leaks in imx7_src_init() Weigang He ARM: imx: fix device_node refcount leak in imx_src_init() Min zhang clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller Shengjiu Wang ASoC: fsl_audmix: rework runtime PM handling in probe Runyu Xiao ASoC: rt700-sdw: always drain jack work on remove Alexander A. Klimov clk: moxart: remove unused variables, fix refcount leak Myeonghun Pak clk: versaclock7: Fix APLL clock leak on probe failure Gui-Dong Han media: cec-pin: Fix event FIFO ordering Weigang He soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() Michael Bommarito HID: roccat: bound device-supplied profile index Christos Maragkos HID: nintendo: Fix imu_timestamp_us double increment per report Philipp Weber HID: core: quiesce input in hid_hw_stop() to prevent use-after-free Maoyi Xie platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count Prashant Malani platform/chrome: cros_ec_typec: Set parent of partner PD object Prashant Malani usb: typec: Add partner PD object wrapper Konstantin Andreev smack: restrict smackfs/{direct,mapped} values to 0-255 Konstantin Andreev smack: deduplicate smackfs/{direct,mapped} file_operations Dmitry Antipov smack: simplify write handlers of sysfs entries Konstantin Andreev smack: fix incorrect task context in smack_msg_queue_msgrcv Maxime Ripard drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure Nicolas Frattaroli drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format Paul Kocialkowski drm: lcdif: Wait for vblank before disabling DMA SJ Park mm/damon/core: skip aging from repeated aggressive merging Martin Blumenstingl clk: meson: align gxbb_32k_clk_sel number of parents with actual count Arnaldo Carvalho de Melo perf sched: Fix register_pid() overflow, strcpy, and BUG_ON Sven Eckelmann batman-adv: bla: avoid CRC corruption due to parallel claim add Sven Eckelmann batman-adv: dat: atomically update mac addresses Sean Shen ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Norbert Szetei ksmbd: fix overflow in dacloffset bounds check Jian Shen net: hns3: don't auto enable misc vector Jiayuan Chen bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops Zhengchuan Liang net: af_key: zero aligned sockaddr tail in PF_KEY exports Xiang Mei bridge: mrp: reject zero test interval to avoid OOM panic Tobi Gaertner net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check Tobi Gaertner net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check Brian Witte netfilter: nft_counter: serialize reset with spinlock Baokun Li ext4: move ext4_percpu_param_init() before ext4_mb_init() Jonathan Currier net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads Wang Liang net: fix NULL pointer dereference in l3mdev_l3_rcv Manivannan Sadhasivam wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path P Praneesh wifi: ath11k: fix RCU stall while reaping monitor destination ring Jie Wang net: hns3: fix kernel crash when 1588 is sent on HIP08 devices Steve Wahl x86/mm/ident_map: Use gbpages only where full GB page should be mapped. Duoming Zhou ax25: fix use-after-free bugs caused by ax25_ds_del_timer Andrei Matei bpf: Guard stack limits against 32bit overflow SJ Park mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() SJ Park mm/damon/sysfs-schemes: kobject_del() scheme dirs SJ Park mm/damon/vaddr-kunit: check region count in three_regions test SJ Park mm/damon/paddr: drop last same folio access check reuse optimization SJ Park mm/damon/vaddr: drop last same folio access check optimization SJ Park mm/damon/core-kunit: check region count before testing in split_at() Kazuki Hanai nvmet-auth: Synchronize timeout work during SQ teardown Dragos Tatulea net/mlx5e: xsk: Fix unlocked writing to ICOSQ Sechang Lim tcp: clear sock_ops cb flags before force-closing a child socket Arthur Gautier xhci: fix lost bounce buffers on TDs spanning several ring segments Faith Ekstrand drm/nouveau: Use write-combined maps for coherent Sunil Khatri drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT Guangshuo Li drm/amdgpu: fix autosuspend cleanup during removal Yang Wang drm/amdgpu: check thunderbolt before switcheroo registration Thadeu Lima de Souza Cascardo drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used Kavan Smith drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value Tao Yu drm/gud: validate TV mode names before creating enum property Deepanshu Kartikey drm/gud: NUL-terminate TV mode names read from the device David (Ming Qiang) Wu drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check Harry Wentland drm/amd/display: avoid divide-by-zero in __is_lut_linear() Thomas Zimmermann drm/hibmc: Use drm_atomic_helper_check_plane_state() Thomas Zimmermann drm/hibmc: Fix list of formats on the primary plane Wentao Liang drm/sun4i: fix refcount leak in sun4i_backend_init_sat() Deepanshu Kartikey drm/i915: Guard against NULL driver_data in i915_pci_probe() Danilo Krummrich drm: fix race between partial drm_dev_register() failure and ioctl Johan Hovold drm/panel-edp: fix i2c adapter leak on probe failure Johan Hovold drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure Zhan Xusheng f2fs: fix i_size when pinned fallocate partially fails Wenjie Qi f2fs: return writeback error from collapse range Hao-Qun Huang f2fs: reject overlapping move range after len expansion Wenjie Qi f2fs: return symlink writeback errors Nilesh Javali scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Nilesh Javali scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics Nilesh Javali scsi: qla2xxx: Drop vport reference under lock in report ID acquisition Nilesh Javali scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() Nilesh Javali scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read Nilesh Javali scsi: qla2xxx: Avoid double completion in async IOCB timeout Nilesh Javali scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() Nilesh Javali scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path Nilesh Javali scsi: qla2xxx: Don't query firmware state while chip is down Nilesh Javali scsi: qla2xxx: Fix FCE trace enable parsing in debugfs Nilesh Javali scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() Nilesh Javali scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump Nilesh Javali scsi: qla2xxx: Fix cs84xx use-after-free on host teardown Nilesh Javali scsi: qla2xxx: Serialize flash version read in reset handler Nilesh Javali scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation Nilesh Javali scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() Nilesh Javali scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() Nilesh Javali scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() Nilesh Javali scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters Nilesh Javali scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check Nilesh Javali scsi: qla2xxx: Bound i2c->length in I2C bsg handlers Nilesh Javali scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers Ruoyu Wang media: zoran: Avoid freeing a registered video_device twice Arash Golgol media: vimc: fix pixel format lookup in enum_framesizes Uday Khare media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure Mohammed EL Kadiri media: venus: fix payload size calculation in parse_raw_formats() Mohammed EL Kadiri media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() Biren Pandya media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link Ming Qian media: v4l2-ctrls: Allow unknown HDR10 white point and luminance Ilya Krutskih media: tda18250: fix possible integer overflow Guangshuo Li media: saa7164: fix cleanup on resource allocation failure Lei Huang media: s2255: check firmware size before reading trailing marker HyeongJun An media: s2255: bound JPEG frame size before copying into the buffer Valery Borovsky media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure Valery Borovsky media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak Myeonghun Pak media: rc: sunxi-cir: Unregister rc device on probe failure Christian Hewitt media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common Biren Pandya media: i2c: ov7740: fix use-after-destroy in remove Biren Pandya media: i2c: ov02a10: fix endpoint parsing use-after-free Shuangpeng Bai media: go7007: defer the ALSA v4l2 put until card release Jiangong.Han media: em28xx: fix use-after-free of dev_next->devlist on disconnect Diego Fernando Mancera Gomez media: em28xx: defer audio-only extension registration Fan Wu media: cx23885: cancel NetUP CI work before teardown Bryam Vargas media: cx231xx: reject geometry changes while the VBI queue is busy Ruoyu Wang media: cobalt: Avoid freeing ALSA private data twice Dawei Feng media: cedrus: fix memory leak in cedrus_init_ctrls() Ruoyu Wang media: cec: Serialize exclusive follower delivery Yi Ding media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash Valery Borovsky media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref Christian Borntraeger KVM: s390: Restore sigset on error path Christian Borntraeger KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP Christian Borntraeger KVM: s390: Zero initialize irq in reinject_machine_check Christian Borntraeger KVM: s390: Take srcu when importing watchpoint data Christian Borntraeger KVM: s390: Free guest debug data on vcpu destroy Christian Borntraeger KVM: s390: Fix old_data leak in guest debug error path Christian Borntraeger KVM: s390: Fix memory leak in guest debug handling Christian Borntraeger KVM: s390: Fix length check __import_wp_info() Carlos López KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Yosry Ahmed KVM: nVMX: Service local TLB flushes on failed nested VM-Enter Yosry Ahmed KVM: nVMX: Always flush vpid02 on first use Sanjay Chitroda iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() Cong Nguyen iio: srf04: fix pm_runtime handling on probe error path Laxman Acharya Padhya iio: light: gp2ap002: Disable regulators on resume failure Giorgi Tchankvetadze iio: light: cm32181: return zero after writing calibscale Cong Nguyen iio: gyro: mpu3050: fix sign of raw angular velocity readings Erick Henrique iio: dac: m62332: Fix regulator reference count imbalance Linmao Li iio: chemical: sgp30: Handle IAQ thread creation failure Moksh Panicker iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable WenTao Liang ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get Haoxiang Li AsoC: intel: sst: fix PCI device reference leak on probe failure Haoxiang Li ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure Runyu Xiao ASoC: cs35l34: drain threaded IRQ before runtime suspend Runyu Xiao ASoC: cs35l33: drain threaded IRQ before runtime suspend Linkai Gong i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure Stephan Gerhold clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks Stephan Gerhold clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk Stephan Gerhold clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk Stephan Gerhold clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src Stephan Gerhold clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src Stephan Gerhold clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk Stephan Gerhold clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk Sven Eckelmann batman-adv: bla: prevent CRC corruptions after claim flush Sven Eckelmann batman-adv: bla: fix freeing of claims on meshif deletion Sven Eckelmann batman-adv: dat: avoid unaligned fault in IP extraction Zhiling Zou batman-adv: fix stale receive device on merged fragments Pengpeng Hou mtd: rawnand: validate ONFI extended parameter page sections Xu Rao mtd: mtdoops: free page bitmap when the backing MTD is removed Pengpeng Hou mtd: afs: validate v2 image info bounds Anthony Krowiak s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Anthony Krowiak s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed Anthony Krowiak s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove Anthony Krowiak s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Sourabh Jain powerpc/crash: stop watchdogs before booting kdump kernel Sourabh Jain powerpc/pseries: Move H_WATCHDOG definitions to a common header Sourabh Jain powerpc/pseries: Handle and log pseries-wdt registration failures Helge Deller parisc: Fix alignment of asm statements in head.S Pei Xiao parisc: eisa: Fix infinite loop when parsing invalid IRQ value Bryam Vargas nvdimm/btt: reject an arena whose nfree is below the lane count Wupeng Ma mm/hugetlb: fix missing migratable flag on same-node hugetlb migration caina Revert "irqchip/mbigen: Fix mbigen node address layout" Shivam Kumar nvmet-tcp: reject unsolicited H2CData PDUs Shivam Kumar nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU Yehyeong Lee nvme-tcp: check the data direction of a C2HData PDU Takashi Iwai ALSA: pcm: Fix race between non-atomic ops and trigger-start Runyu Xiao ALSA: harmony: initialize locks before requesting IRQ Ahmad Byagowi i2c: mux: Fix channel node leak on adapter add failure Vasileios Almpanis i2c: core: fix debugfs UAF on adapter removal Sizhe Liu perf hisi-ptt: Fix PTT trace TLP header parsing Dapeng Mi perf/x86/intel: Fix kernel address leakages in LBR stack Lad Prabhakar rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers Lad Prabhakar rtc: rzn1: Fix weekday underflow when alarm crosses month boundary Pengpeng Hou Input: aiptek - validate raw macro indices before updating state Masami Hiramatsu (Google) kprobes: Protect kprobe_blacklist with RCU Bradley Morgan ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() Hajo Noerenberg ata: ahci: work around lost interrupts on Marvell 88SE61xx Damien Le Moal block: flag zoned disks with GENHD_FL_NO_PART Linkai Gong cpuidle: dt_idle_genpd: kfree() the original name allocation Koichiro Den dmaengine: dw-edma: Initialize IRQ data before requesting IRQs Koichiro Den dmaengine: dw-edma: Complete descriptors before pausing Mikulas Patocka dm: fix resume-vs-remove race Mikulas Patocka dm: fix race when loading and unloading a table Ibrahim Hashimov HID: wacom: validate report length in wacom_intuos_pro2_bt_irq Wei Jie Law <98lawweijie@gmail.com> HID: rmi: fix OOB access with undersized RMI reports Yao Kai futex: Prevent rcuwait use-after-free during requeue PI SJ Park mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs SJ Park mm/damon/sysfs: kobject_del() region and target (error) dirs Runyu Xiao scsi: pm8001: Use rollback index when freeing MSI-X vectors Sujal Tuladhar scsi: target: iscsi: Reserve a terminator byte for the login payload Can Peng thermal/drivers/qoriq: Disable clock on resume failure Can Peng thermal/drivers/imx: Disable clock on runtime resume failure Muhammad Bilal staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() Muhammad Bilal staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() Jeffin Philip usb: gadget: fix null pointer dereference in usb_put_function_instance() Lovekesh Solanki USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Jameson Thies usb: typec: ucsi: displayport: Fix OOB altmode array index Andy Shevchenko usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() Liu Qi usb-storage: ene_ub6250: fix race between scan work and probe Shuangpeng Bai media: usbtv: keep device alive while ALSA card exists Stephan Gerhold clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset HyeongJun An ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() Griffin Kroah-Hartman usb: image: mdc800: change kmalloc() to kzalloc() Petr Vaganov scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Zi Yan mm/huge_memory: use folio's memcg inside __folio_split() Masami Hiramatsu (Google) tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Steven Rostedt tracing/mmiotrace: Remove reference to unused per CPU data pointer Eric Dumazet vxlan: use pskb_network_may_pull() for transmit path header pulls Koichiro Den net: ntb_netdev: Fix TX busy and drop handling Tzung-Bi Shih ALSA: seq: Fix port lock leak in deliver_to_subscribers() Bryam Vargas selinux: reject an unclaimed class value in security_get_classes() Christian Göttsche selinux: avoid implicit conversions in services code Jinjie Ruan entry: Fix seccomp bypass after ptrace with TSYNC Eric Dumazet tcp: fix potential race in tcp_v6_syn_recv_sock() Youngjae Kwon fsnotify: Fix stale object mask after concurrent mark updates Pablo Neira Ayuso netfilter: nf_tables: make nft_object rhltable per table Günther Noack landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Yuqi Xu openvswitch: Fix CT limit teardown use-after-free Ilya Maximets net: openvswitch: fix kernel-doc warnings in internal headers Norbert Szetei net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() Tzung-Bi Shih platform/chrome: sensorhub: Fix dropped timestamp events and log spam Zhan Xusheng udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner timer: Keep debugobjects state consistent in migrate_timer_list() Bradley Morgan taskstats: fix cpumask parsing cutting off the last character Jann Horn smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan signal: avoid shared siginfo namespace rewrites Myeonghun Pak tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Zi Yan xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye vsock/virtio: flush works in dependency order Runyu Xiao wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Abdun Nihaal wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Stanislaw Gruszka wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam wifi: mwifiex: Detach sync cmd buffer on interrupted wait Abdun Nihaal wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Maoyi Xie i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter i3c: master: Fix info leak and UAF in device unregister path Haotian Zhang dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Kiryl Shutsemau (Meta) x86/tdx: Fix zero-extension for 32-bit port I/O Naman Jain PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Karl Mehltretter cgroup/cpuset: Fix misplaced DL migration reset Takashi Iwai ALSA: virmidi: Check card index validity at probe Takashi Iwai ALSA: serial-u16550: Check card index validity at probe Takashi Iwai ALSA: portman2x4: Check card index validity at probe Runyu Xiao ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai ALSA: mts64: Check card index validity at probe Takashi Iwai ALSA: mpu401: Check card index validity at probe Baul Lee ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai ALSA: aloop: Check card index validity at probe Baul Lee ALSA: 6fire: bound the MIDI event length from the device Zhiling Zou seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao net: fix spurious TX timeout after dev_activate() Zhiling Zou net: cap advertised IP tunnel headroom Hidayath Khan net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan net/smc: fix socket refcount leak in smc_switch_conns() Koichiro Den net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den NTB: ntb_transport: Reject oversized TX buffers Koichiro Den NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den NTB: ntb_transport: Recycle TX entries before client callbacks Xuanqiang Luo net: ravb: avoid dereferencing an invalid PTP clock Ruoyu Wang net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets net: openvswitch: fix flow mask use-after-free on flow deletion Asim Viladi Oglu Manizada net: tun: bound receive headroom Fabio Porcedda net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov slip: fix use-after-free in sl_sync() Weiming Shi xdp: fix zero-copy frame layout Alexandra Winter net/iucv: filter frames in afiucv_hs_rcv() by ingress device Seiji Nishikawa ipmi: si: Fix NULL pointer dereference after failed registration Yousef Alhouseen ipmi: ipmb: validate write message length Kuan-Wei Chiu interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Bryam Vargas platform/chrome: sensorhub: Bound the EC-reported sensor number Ma Ke platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Fan Wu mmc: via-sdmmc: stop card-detect handling on probe failure HyeongJun An platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Kevin Tian iommu/vt-d: Fix no_iommu to disable platform opt-in Krzysztof Wilczyński PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali PCI/MSI: Enable memory decoding before restoring MSI-X messages Krzysztof Wilczyński PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Tim Harvey PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ronald Claveau PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Stefan Haberland s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland s390/dasd: Do not complete a failed ESE read as successful Jianing Li power: supply: max17040: synchronize work cancellation on suspend Fan Wu power: supply: ucs1002: fix use-after-free on remove Maoyi Xie power: supply: twl4030_charger: cancel workers via devm Fan Wu power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu power: supply: bq24257: fix use-after-free on remove Jun Yang sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim sctp: drop a chunk if its transport was removed Hyunwoo Kim sctp: stop processing a packet once its association is deleted Yehyeong Lee nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Yehyeong Lee nvme: zero the discard fallback page Ewan D. Milne nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Michael Bommarito lockd: pin next file across nlm_inspect_file lock-drop Cong Nguyen hwmon: (max6621) fix temperature clamp range Cong Nguyen hwmon: (max6621) fix negative temperature offset and crit readings Christopher Tolang ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter arm64: compat: Fix decrementing LDM/STM alignment emulation Norbert Szetei openvswitch: only skb_tx_error() a packet we are about to drop Ali Ahmet Memis openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng ocfs2: fix readdir position truncation on 32-bit kernels Joseph Qi ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Ibrahim Hashimov ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov ocfs2: always run deallocs on copy-on-write completion Zhiling Zou orangefs: skip leading spaces before parsing client debug masks Yifei Gao orangefs: fix double-free of trailer_buf on readdir copy failure WenTao Liang regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Norbert Szetei RDMA/ucma: Lock the handler in ucma_set_ib_path() Fan Wu RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare qede: Fix NULL pointer dereference in TPA fragment processing Johan Hovold remoteproc: scp: Fix device reference leak on failed lookup Fabio Estevam arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Chunkai Deng rpmsg: glink: smem: order FIFO read after availability check Hao-Qun Huang staging: media: tegra-video: vi: fix probe failure on skipped last port Doruk Tan Ozturk wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee udf: reject VAT indexes equal to the entry count Chris Mason svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason svcrdma: Fix offset arithmetic in read_chunk_range Chuck Lever SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason sunrpc: init gssp_lock before publishing proc entry Chris Mason SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Jeff Layton SUNRPC: always drain cache_cleaner before destroying a cache_detail Jeff Layton sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Harshit Varu mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming mpls: reload header after pskb_may_pull() Coly Li md: do overflow check for sb->bblog_shift in super_1_load() Anup Vishwakarma mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Yuyang Huang ipv6: use RCU iterator to dump route exceptions Zhiling Zou ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Anton Danilov ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Guangshuo Li Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Valentin Kindschi Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973@qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Hui Su cpufreq: schedutil: Fix rate limit overflow Bryam Vargas dm array: reject an array block whose value size is not the caller's Ilya Krutskih dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong dm-era: fix shadowed superblock leak on take-snap failure Jérémy Jean bpf: Harden bloom filter sizing and indexing on 32-bit kernels Jiangshan Yi bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An Bluetooth: eir: Fix OOB read in eir_get_service_data() Christoph Zwerschke Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU Hongyan Xu auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Anirudh Prasad ACPI: pfr_update: fix stack buffer overflow in query_capability() Ivaylo Dimitrov hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Tien Sung Ang fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous forcedeth: fix off-by-one when saving/restoring non-PCI config space Myeonghun Pak fbdev: uvesafb: unregister connector callback on init failure Florian Fuchs fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu fat: restore original value when fat_ent_write failed Ard Biesheuvel efivarfs: Rate limit statfs() handler Yichong Chen ecryptfs: show filename encryption options Yichong Chen ecryptfs: release message context on send failure Yichong Chen ecryptfs: reject too-small tag 70 packets HanQuan ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen ecryptfs: pass packet set buffer size to parser Yichong Chen ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou eCryptfs: bound the packet-length peek to the user buffer Konstantin Komarov fs/ntfs3: bound page_lcns[] index by the log record Samuel Page fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei fs/ntfs3: validate dirty page table on log replay Jiangshan Yi HID: mcp2221: validate report size in mcp2221_raw_event() Haoxiang Li HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao HID: roccat: free buffered reports when destroying device Ibrahim Hashimov HID: picolcd: clamp eeprom debugfs read to bytes actually received Fredric Cover smb: client: harden DFS cache against invalid target hints Frank Sorenson smb: client: fix ALIGN() overflow in symlink_data() error context loop Fredric Cover smb: client: clear ce->tgthint in free_tgts() Frank Sorenson cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Jérémy Jean audit: avoid dropping live tree ref on fsnotify rule autoremove Michael Bommarito ceph: bound xattr value length in __build_xattrs() Michael Bommarito ceph: bound num_export_targets array for mds info v2/v3 Jérémy Jean ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Xiubo Li ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean libceph: reject buckets with mismatched CRUSH ids Chuck Lever NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Jeff Layton nfsd: initialize copy-notify stateid before publishing it Jeff Layton nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton nfsd: fix version mismatch loops in nfsd_acl_init_request() Chris Mason nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton nfsd: check client ownership when cancelling a copy-notify stateid Jeff Layton nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton nfsd: validate symlink target length in NFSv4 CREATE Chuck Lever nfsd: sample writeback error cursor before async COPY loop Jeff Layton nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Chuck Lever nfsd: Reset write verifier when async COPY writeback fails Junrui Luo NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Mike Snitzer NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Chuck Lever NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Ibrahim Hashimov ubifs: fix out-of-bounds read in signature length check Abdurrahman Hussain of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Xingrui Li HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Neill Kapron usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Yun Zhou usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Myeonghun Pak usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan usb: gadget: u_audio: Fix use-after-free on sound card disconnect Johan Hovold USB: phy: fsl-usb: fix missing static keywords Francesco Lavra usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang staging: greybus: hid: fix SET_REPORT return value Hans Verkuil Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski powerpc/powermac: fix OF node refcount Xu Yang device property: fix infinite loop in fwnode_for_each_child_node() Hui Su tracing: Fix use-after-free with same-name named triggers Hui Su tracing: Fix crash passing ERR_PTR to kthread_stop() Sanman Pradhan hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Kiryl Shutsemau (Meta) x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Kiryl Shutsemau (Meta) x86/tdx: Fix off-by-one in port I/O handling Joy H.J. Lee tools/compiler: match glibc 2.42 definition of __attribute_const__ Guopeng Zhang mm: memcg: stop reclaim when a limit update is superseded Breno Leitao mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Breno Leitao mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Jordan R Abrahams-Whitehead include/linux/list.h: mark list_add and __list_add as __always_inline Jérémy Jean timers/itimer: Zero-init old itimerval before copy to userspace Gaurav Batra powerpc/pseries/iommu: switch to Default DMA window during kdump Felix Yan clocksource/drivers/timer-sun4i: Advertise a real minimum delta Matt Turner alpha: don't leak hardware-fabricated FP exception bits to user space Matt Turner alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Cássio Gabriel ALSA: aloop: Fix peer runtime UAF during format-change stop Takashi Iwai ALSA: aloop: Fix racy access at PCM trigger ------------- Diffstat: .../ABI/testing/configfs-usb-gadget-uac1_legacy | 3 - .../devicetree/bindings/clock/qcom,sm8550-gcc.yaml | 62 + Documentation/trace/hisi-ptt.rst | 28 +- Documentation/usb/gadget-testing.rst | 3 - .../media/v4l/ext-ctrls-colorimetry.rst | 12 +- Makefile | 4 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/srmcons.c | 3 +- arch/alpha/kernel/sys_marvel.c | 25 +- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 +- arch/arm/Kconfig | 2 +- arch/arm/boot/dts/armada-388-helios4.dts | 13 + arch/arm/boot/dts/sun4i-a10.dtsi | 2 +- arch/arm/mach-imx/src.c | 3 + arch/arm/mach-lpc32xx/common.c | 5 +- arch/arm/mach-lpc32xx/common.h | 2 + arch/arm/mach-lpc32xx/phy3250.c | 2 + arch/arm/mach-lpc32xx/pm.c | 5 +- arch/arm/mm/fault.c | 16 +- .../boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 4 +- arch/arm64/boot/dts/amlogic/meson-axg-s400.dts | 4 + .../boot/dts/marvell/armada-3720-turris-mox.dts | 3 +- arch/arm64/boot/dts/qcom/Makefile | 1 + arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts | 2 +- arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts | 11 +- .../boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi | 15 +- arch/arm64/boot/dts/qcom/msm8998-xiaomi-sagit.dts | 706 ++++ arch/arm64/boot/dts/qcom/msm8998.dtsi | 24 +- arch/arm64/boot/dts/qcom/pm8998.dtsi | 8 + arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 - arch/arm64/boot/dts/qcom/sc8280xp-crd.dts | 4 +- arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 11 +- arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi | 11 +- arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts | 11 +- .../boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 11 +- arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 11 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 66 +- arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts | 38 +- arch/arm64/boot/dts/qcom/sm8150.dtsi | 10 +- arch/arm64/boot/dts/qcom/sm8250.dtsi | 15 +- arch/arm64/boot/dts/qcom/sm8350.dtsi | 180 +- arch/arm64/boot/dts/qcom/sm8450.dtsi | 10 +- arch/arm64/boot/dts/qcom/sm8550.dtsi | 3865 ++++++++++++++++++++ .../boot/dts/rockchip/rk3399-gru-chromebook.dtsi | 3 +- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 + arch/arm64/boot/dts/ti/k3-am64-main.dtsi | 2 +- arch/arm64/kernel/compat_alignment.c | 4 +- arch/arm64/kernel/hibernate.c | 16 +- arch/arm64/lib/Makefile | 4 + arch/csky/kernel/entry.S | 6 +- arch/m68k/emu/nfcon.c | 3 +- arch/m68k/kernel/traps.c | 4 +- arch/mips/kernel/ptrace.c | 6 +- arch/openrisc/kernel/entry.S | 43 +- arch/parisc/kernel/head.S | 1 + arch/powerpc/configs/85xx-hw.config | 1 + arch/powerpc/include/asm/papr-watchdog.h | 64 + arch/powerpc/kernel/smp.c | 3 + arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 +- arch/powerpc/platforms/pseries/setup.c | 28 +- arch/s390/kernel/debug.c | 10 +- arch/s390/kvm/guestdbg.c | 9 +- arch/s390/kvm/interrupt.c | 2 +- arch/s390/kvm/kvm-s390.c | 15 +- arch/um/drivers/line.c | 2 +- arch/um/drivers/line.h | 3 +- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/amd/uncore.c | 781 ++-- arch/x86/events/intel/lbr.c | 12 +- arch/x86/events/intel/uncore.c | 2 - arch/x86/include/asm/insn-eval.h | 36 + arch/x86/include/asm/pkeys.h | 3 + arch/x86/kvm/emulate.c | 26 +- arch/x86/kvm/hyperv.c | 25 +- arch/x86/kvm/vmx/nested.c | 18 + arch/x86/mm/ident_map.c | 23 +- arch/xtensa/platforms/iss/console.c | 3 +- block/blk-cgroup.c | 2 + block/blk-iocost.c | 2 +- block/blk-stat.c | 2 +- block/genhd.c | 7 + block/kyber-iosched.c | 2 +- drivers/accessibility/speakup/keyhelp.c | 17 +- drivers/accessibility/speakup/kobjects.c | 6 +- drivers/acpi/ec.c | 40 +- drivers/acpi/pci_root.c | 3 +- drivers/acpi/pfr_update.c | 45 +- drivers/acpi/processor_core.c | 31 +- drivers/acpi/processor_idle.c | 28 +- drivers/acpi/scan.c | 13 +- drivers/acpi/video_detect.c | 4 +- drivers/ata/ahci.c | 49 + drivers/ata/libata-scsi.c | 28 +- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 + drivers/base/firmware_loader/fallback.c | 10 + drivers/base/property.c | 19 +- drivers/base/soc.c | 19 +- drivers/base/swnode.c | 2 +- drivers/block/mtip32xx/mtip32xx.c | 7 + drivers/block/mtip32xx/mtip32xx.h | 2 + drivers/block/null_blk/main.c | 116 +- drivers/block/null_blk/null_blk.h | 9 + drivers/block/null_blk/zoned.c | 95 +- drivers/bluetooth/btmtksdio.c | 37 +- drivers/bluetooth/btqca.c | 3 +- drivers/bluetooth/btusb.c | 32 +- drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/bluetooth/virtio_bt.c | 8 +- drivers/bus/mhi/ep/main.c | 15 +- drivers/bus/mhi/host/main.c | 6 + drivers/bus/qcom-ebi2.c | 51 +- drivers/bus/ti-sysc.c | 12 +- drivers/char/hw_random/ks-sa-rng.c | 22 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 1 + drivers/char/ppdev.c | 10 +- drivers/char/tpm/st33zp24/st33zp24.c | 8 +- drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/char/ttyprintk.c | 5 +- drivers/char/xilinx_hwicap/xilinx_hwicap.c | 5 +- drivers/clk/clk-moxart.c | 14 - drivers/clk/clk-palmas.c | 14 +- drivers/clk/clk-versaclock7.c | 2 +- drivers/clk/hisilicon/reset.c | 2 +- drivers/clk/imx/clk-scu.c | 1 - drivers/clk/meson/gxbb.c | 2 +- drivers/clk/qcom/Kconfig | 8 + drivers/clk/qcom/Makefile | 1 + drivers/clk/qcom/clk-alpha-pll.c | 16 + drivers/clk/qcom/clk-alpha-pll.h | 5 + drivers/clk/qcom/clk-rcg.h | 2 + drivers/clk/qcom/clk-rcg2.c | 78 +- drivers/clk/qcom/common.c | 4 +- drivers/clk/qcom/gcc-mdm9607.c | 182 +- drivers/clk/qcom/gcc-msm8916.c | 5 +- drivers/clk/qcom/gcc-msm8939.c | 5 +- drivers/clk/qcom/gcc-qcm2290.c | 12 +- drivers/clk/qcom/gcc-sm8550.c | 3395 +++++++++++++++++ drivers/clk/qcom/gdsc.c | 25 +- drivers/clk/tegra/clk-tegra124-emc.c | 1 + drivers/clk/ti/adpll.c | 4 +- drivers/clk/ti/divider.c | 2 +- drivers/clk/ti/mux.c | 22 +- drivers/clk/visconti/clkc.c | 2 +- drivers/clk/x86/clk-pmc-atom.c | 3 + drivers/clocksource/clps711x-timer.c | 2 +- drivers/clocksource/timer-armada-370-xp.c | 18 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/cpufreq/imx6q-cpufreq.c | 6 +- drivers/cpufreq/intel_pstate.c | 19 +- drivers/cpufreq/spear-cpufreq.c | 4 +- drivers/cpuidle/dt_idle_genpd.c | 3 +- drivers/crypto/atmel-ecc.c | 45 +- drivers/crypto/atmel-sha204a.c | 6 +- drivers/crypto/gemini/sl3516-ce-cipher.c | 8 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 12 +- drivers/crypto/keembay/keembay-ocs-aes-core.c | 5 +- drivers/crypto/qat/qat_common/qat_algs.c | 1 + drivers/crypto/sa2ul.c | 6 +- drivers/dax/super.c | 12 +- drivers/dma/dw-edma/dw-edma-core.c | 37 +- drivers/dma/hisi_dma.c | 2 +- drivers/dma/mediatek/mtk-uart-apdma.c | 2 +- drivers/dma/qcom/bam_dma.c | 1 + drivers/dma/xilinx/xilinx_dma.c | 12 +- drivers/firmware/google/coreboot_table.c | 26 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 74 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 10 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 6 + .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 24 + .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 35 +- .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 2 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 +- drivers/gpu/drm/bridge/tc358767.c | 2 +- drivers/gpu/drm/drm_atomic_uapi.c | 2 + drivers/gpu/drm/drm_drv.c | 34 +- drivers/gpu/drm/gud/gud_connector.c | 12 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 54 +- drivers/gpu/drm/i915/i915_pci.c | 3 + drivers/gpu/drm/lima/lima_device.c | 12 +- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 4 + drivers/gpu/drm/msm/dsi/dsi_host.c | 14 +- drivers/gpu/drm/mxsfb/lcdif_kms.c | 15 +- drivers/gpu/drm/nouveau/nouveau_sgdma.c | 4 +- drivers/gpu/drm/omapdrm/dss/dsi.c | 7 +- drivers/gpu/drm/omapdrm/dss/dsi.h | 2 - drivers/gpu/drm/panel/panel-edp.c | 19 +- drivers/gpu/drm/panel/panel-samsung-s6d16d0.c | 10 +- drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 + drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +- drivers/gpu/drm/sun4i/sun4i_crtc.c | 2 +- drivers/gpu/drm/sun4i/sun4i_tcon.c | 22 +- drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 2 + drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 2 +- drivers/gpu/drm/sun4i/sun8i_tcon_top.c | 71 +- drivers/gpu/drm/sun4i/sun8i_tcon_top.h | 6 + drivers/gpu/drm/sun4i/sun8i_vi_scaler.c | 18 +- drivers/gpu/drm/tve200/tve200_drv.c | 1 + drivers/gpu/host1x/debug.c | 4 +- drivers/gpu/host1x/hw/channel_hw.c | 5 +- drivers/hid/hid-core.c | 127 +- drivers/hid/hid-lg4ff.c | 8 + drivers/hid/hid-mcp2221.c | 7 + drivers/hid/hid-nintendo.c | 1 - drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-rmi.c | 46 +- drivers/hid/hid-roccat-kone.c | 8 +- drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 +- drivers/hid/i2c-hid/i2c-hid-core.c | 95 +- drivers/hid/wacom_wac.c | 13 + drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- drivers/hwspinlock/hwspinlock_core.c | 2 +- drivers/hwtracing/coresight/coresight-etm4x-cfg.c | 2 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 +- .../hwtracing/coresight/coresight-etm4x-sysfs.c | 6 +- drivers/hwtracing/coresight/coresight-etm4x.h | 9 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i2c/i2c-core-base.c | 6 + drivers/i2c/i2c-mux.c | 1 + drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 + drivers/i3c/master.c | 11 +- drivers/i3c/master/dw-i3c-master.c | 10 +- drivers/i3c/master/mipi-i3c-hci/core.c | 30 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 4 +- drivers/i3c/master/mipi-i3c-hci/ext_caps.c | 55 +- drivers/i3c/master/mipi-i3c-hci/pio.c | 54 +- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/iio/accel/dmard09.c | 7 + drivers/iio/chemical/atlas-sensor.c | 6 +- drivers/iio/chemical/sgp30.c | 3 + drivers/iio/dac/m62332.c | 17 +- drivers/iio/gyro/mpu3050-core.c | 2 +- drivers/iio/light/cm32181.c | 2 +- drivers/iio/light/gp2ap002.c | 24 +- drivers/iio/light/isl29028.c | 2 +- drivers/iio/light/tsl2583.c | 2 +- drivers/iio/light/tsl2772.c | 2 +- drivers/iio/orientation/hid-sensor-rotation.c | 20 +- drivers/iio/proximity/srf04.c | 1 + drivers/iio/temperature/hid-sensor-temperature.c | 3 +- drivers/infiniband/core/cma.c | 6 +- drivers/infiniband/core/core_priv.h | 1 + drivers/infiniband/core/counters.c | 5 +- drivers/infiniband/core/cq.c | 14 +- drivers/infiniband/core/device.c | 3 + drivers/infiniband/core/nldev.c | 148 +- drivers/infiniband/core/restrack.c | 186 +- drivers/infiniband/core/restrack.h | 4 + drivers/infiniband/core/ucma.c | 7 +- drivers/infiniband/core/uverbs_cmd.c | 13 +- drivers/infiniband/core/verbs.c | 32 +- drivers/infiniband/hw/cxgb4/device.c | 8 +- drivers/infiniband/hw/cxgb4/mem.c | 4 +- drivers/infiniband/hw/efa/efa_verbs.c | 15 +- drivers/infiniband/hw/erdma/Kconfig | 2 +- drivers/infiniband/hw/erdma/erdma_eq.c | 7 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 12 +- drivers/infiniband/hw/erdma/erdma_verbs.h | 25 +- drivers/infiniband/hw/hfi1/chip.c | 4 +- drivers/infiniband/hw/hfi1/hfi.h | 2 - drivers/infiniband/hw/hfi1/init.c | 44 +- drivers/infiniband/hw/hfi1/user_sdma.c | 13 +- drivers/infiniband/hw/mlx4/main.c | 8 + drivers/infiniband/hw/mlx4/mlx4_ib.h | 3 + drivers/infiniband/hw/mlx4/qp.c | 121 +- drivers/infiniband/hw/mlx5/cong.c | 8 +- drivers/infiniband/hw/mlx5/main.c | 9 + drivers/infiniband/hw/mlx5/qp.c | 144 +- drivers/infiniband/hw/mlx5/qp.h | 2 + drivers/infiniband/hw/mlx5/qpc.c | 3 +- drivers/infiniband/sw/rxe/rxe_req.c | 15 + drivers/infiniband/sw/siw/siw_cm.c | 32 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 + drivers/infiniband/ulp/isert/ib_isert.c | 85 +- drivers/infiniband/ulp/isert/ib_isert.h | 1 + drivers/infiniband/ulp/srp/ib_srp.c | 45 +- drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +- drivers/input/tablet/aiptek.c | 13 +- drivers/interconnect/core.c | 7 +- drivers/iommu/amd/init.c | 42 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 5 +- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 6 +- drivers/iommu/dma-iommu.c | 13 +- drivers/iommu/intel/iommu.c | 16 +- drivers/iommu/msm_iommu.c | 2 +- drivers/iommu/mtk_iommu_v1.c | 2 +- drivers/ipack/devices/ipoctal.c | 74 +- drivers/irqchip/irq-gic-v3-its.c | 15 +- drivers/irqchip/irq-mbigen.c | 20 +- drivers/irqchip/irq-renesas-rzg2l.c | 4 +- drivers/isdn/capi/capi.c | 3 +- drivers/leds/leds-pca9532.c | 18 +- drivers/mailbox/pcc.c | 71 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/mailbox/rockchip-mailbox.c | 17 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/dm.c | 14 +- drivers/md/md.c | 7 + drivers/md/persistent-data/dm-array.c | 16 + drivers/md/raid5-ppl.c | 4 +- drivers/media/cec/core/cec-adap.c | 8 +- drivers/media/cec/core/cec-pin.c | 8 +- drivers/media/cec/platform/meson/ao-cec-g12a.c | 1 + drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 23 +- drivers/media/i2c/ov02a10.c | 12 +- drivers/media/i2c/ov7740.c | 4 +- drivers/media/i2c/video-i2c.c | 8 +- drivers/media/pci/cobalt/cobalt-alsa-main.c | 1 - drivers/media/pci/cx23885/cimax2.c | 1 + drivers/media/pci/saa7164/saa7164-core.c | 8 +- drivers/media/pci/zoran/zoran_card.c | 2 +- drivers/media/platform/qcom/venus/hfi_parser.c | 9 +- drivers/media/rc/sunxi-cir.c | 9 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/test-drivers/vimc/vimc-capture.c | 4 +- drivers/media/tuners/tda18250.c | 4 +- drivers/media/usb/airspy/airspy.c | 19 +- drivers/media/usb/cx231xx/cx231xx-video.c | 4 +- drivers/media/usb/em28xx/em28xx-cards.c | 3 +- drivers/media/usb/em28xx/em28xx-core.c | 2 + drivers/media/usb/go7007/snd-go7007.c | 10 +- drivers/media/usb/s2255/s2255drv.c | 11 + drivers/media/usb/usbtv/usbtv-audio.c | 11 + drivers/media/v4l2-core/v4l2-ctrls-core.c | 49 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/media/v4l2-core/v4l2-fwnode.c | 2 + drivers/mfd/iqs62x.c | 2 +- drivers/mfd/rave-sp.c | 64 +- drivers/misc/ad525x_dpot-i2c.c | 1 + drivers/misc/ad525x_dpot-spi.c | 1 + drivers/misc/ad525x_dpot.c | 177 +- drivers/misc/ad525x_dpot.h | 3 + drivers/misc/bcm-vk/bcm_vk_msg.c | 6 +- drivers/misc/bcm-vk/bcm_vk_tty.c | 4 +- drivers/misc/cardreader/rtsx_pcr.c | 2 + drivers/misc/cardreader/rtsx_usb.c | 23 +- drivers/misc/vmw_vmci/vmci_event.c | 4 +- drivers/mmc/core/sdio_uart.c | 3 +- drivers/mmc/host/via-sdmmc.c | 8 +- drivers/mtd/mtdoops.c | 3 + drivers/mtd/mtdpart.c | 3 +- drivers/mtd/mtdswap.c | 1 + drivers/mtd/nand/raw/nand_onfi.c | 27 +- drivers/mtd/parsers/afs.c | 7 + drivers/mtd/ubi/attach.c | 4 +- drivers/mtd/ubi/build.c | 53 +- drivers/mtd/ubi/cdev.c | 3 +- drivers/mtd/ubi/eba.c | 3 - drivers/mtd/ubi/fastmap-wl.c | 53 +- drivers/mtd/ubi/fastmap.c | 68 +- drivers/mtd/ubi/io.c | 11 +- drivers/mtd/ubi/ubi.h | 12 +- drivers/mtd/ubi/wl.c | 32 +- drivers/mtd/ubi/wl.h | 6 +- drivers/net/bonding/bond_netlink.c | 2 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +- drivers/net/dsa/b53/b53_common.c | 2 +- drivers/net/ethernet/allwinner/sun4i-emac.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/freescale/fec_main.c | 6 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 12 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 3 + .../net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c | 2 +- .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 11 +- drivers/net/ethernet/mellanox/mlx4/qp.c | 14 +- drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c | 2 +- drivers/net/ethernet/nvidia/forcedeth.c | 6 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + .../net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 1 + drivers/net/ethernet/realtek/8139cp.c | 2 +- drivers/net/ethernet/renesas/ravb.h | 1 + drivers/net/ethernet/renesas/ravb_main.c | 3 +- drivers/net/ethernet/renesas/ravb_ptp.c | 15 +- .../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +- .../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 41 +- drivers/net/ethernet/sun/niu.c | 2 + drivers/net/gtp.c | 2 + drivers/net/ipa/ipa_main.c | 29 +- drivers/net/ipvlan/ipvlan_l3s.c | 1 - drivers/net/ntb_netdev.c | 38 +- drivers/net/ppp/pppox.c | 17 + drivers/net/slip/slip.c | 19 +- drivers/net/thunderbolt.c | 6 +- drivers/net/tun.c | 21 +- drivers/net/usb/cdc_ncm.c | 10 +- drivers/net/usb/hso.c | 3 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/vxlan/vxlan_vnifilter.c | 6 +- drivers/net/wireless/ath/ath10k/snoc.c | 9 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 36 +- drivers/net/wireless/ath/ath11k/pci.c | 2 + drivers/net/wireless/ath/ath11k/wmi.c | 11 +- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + drivers/net/wireless/ath/ath6kl/wmi.c | 17 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 2 +- drivers/net/wireless/intel/iwlwifi/mei/iwl-mei.h | 10 + drivers/net/wireless/intel/iwlwifi/mei/main.c | 78 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 +- drivers/net/wireless/mac80211_hwsim.c | 5 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 + drivers/net/wireless/marvell/mwifiex/usb.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7915/Kconfig | 1 + drivers/net/wireless/mediatek/mt76/mt7915/Makefile | 3 +- .../net/wireless/mediatek/mt76/mt7915/coredump.c | 410 +++ .../net/wireless/mediatek/mt76/mt7915/coredump.h | 136 + .../net/wireless/mediatek/mt76/mt7915/debugfs.c | 81 +- drivers/net/wireless/mediatek/mt76/mt7915/dma.c | 169 +- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 29 +- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 360 +- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 22 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 34 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.h | 8 +- drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 201 +- drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 42 +- drivers/net/wireless/mediatek/mt76/mt7915/pci.c | 102 +- drivers/net/wireless/mediatek/mt76/mt7915/regs.h | 55 +- drivers/net/wireless/mediatek/mt76/mt7915/soc.c | 23 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 28 +- drivers/net/wireless/mediatek/mt76/sdio.c | 11 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtlwifi/pci.c | 6 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/net/wireless/realtek/rtw89/mac.c | 2 +- drivers/net/wireless/zydas/zd1211rw/zd_usb.c | 8 + drivers/nfc/pn533/pn533.c | 21 +- drivers/ntb/ntb_transport.c | 38 +- drivers/nvdimm/btt.c | 8 + drivers/nvdimm/label.c | 17 +- drivers/nvme/host/apple.c | 222 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 10 +- drivers/nvme/host/nvme.h | 5 + drivers/nvme/host/pci.c | 2 +- drivers/nvme/host/rdma.c | 2 +- drivers/nvme/host/tcp.c | 54 +- drivers/nvme/target/auth.c | 6 + drivers/nvme/target/core.c | 2 +- drivers/nvme/target/loop.c | 2 +- drivers/nvme/target/nvmet.h | 2 + drivers/nvme/target/rdma.c | 121 +- drivers/nvme/target/tcp.c | 10 + drivers/nvme/target/zns.c | 2 +- drivers/of/base.c | 2 +- drivers/of/property.c | 91 +- drivers/parisc/eisa.c | 5 + drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/pci-xgene.c | 11 +- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 4 +- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 6 +- drivers/perf/arm_spe_pmu.c | 2 +- drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 26 +- drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 2 +- drivers/phy/sunplus/phy-sunplus-usb2.c | 6 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 1 - drivers/pinctrl/mediatek/mtk-eint.c | 340 +- drivers/pinctrl/mediatek/mtk-eint.h | 28 +- drivers/pinctrl/mediatek/pinctrl-moore.h | 12 +- drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 40 +- drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h | 1 + drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 14 +- drivers/pinctrl/mediatek/pinctrl-paris.h | 19 +- drivers/pinctrl/pinctrl-rockchip.c | 10 + drivers/platform/chrome/cros_ec_sensorhub_ring.c | 28 +- drivers/platform/chrome/cros_ec_typec.c | 8 +- drivers/platform/mellanox/mlxbf-pmc.c | 10 +- drivers/platform/surface/surface_acpi_notify.c | 6 +- drivers/platform/x86/dell/dell-wmi-base.c | 17 +- drivers/platform/x86/dell/dell-wmi-privacy.c | 4 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - .../x86/dell/dell-wmi-sysman/dell-wmi-sysman.h | 2 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- drivers/power/supply/bd99954-charger.h | 23 +- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +- drivers/power/supply/bq27xxx_battery.c | 6 +- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/isp1704_charger.c | 1 + drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/max17040_battery.c | 2 +- drivers/power/supply/sbs-battery.c | 7 +- drivers/power/supply/sc2731_charger.c | 8 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/pps/clients/pps-gpio.c | 62 +- drivers/pps/pps.c | 10 +- drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/rapidio/rio-scan.c | 1 + drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/core.c | 6 +- drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-rpmh-regulator.c | 6 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/remoteproc/qcom_common.c | 4 +- drivers/remoteproc/remoteproc_core.c | 156 +- drivers/remoteproc/remoteproc_sysfs.c | 1 - drivers/rpmsg/qcom_glink_native.c | 44 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/rtc/rtc-gamecube.c | 4 +- drivers/rtc/rtc-pcf8563.c | 4 +- drivers/rtc/rtc-rzn1.c | 10 +- drivers/rtc/rtc-zynqmp.c | 7 +- drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +- drivers/s390/block/dasd_erp.c | 3 + drivers/s390/char/Makefile | 1 - drivers/s390/char/con3215.c | 20 +- drivers/s390/char/con3270.c | 651 ---- drivers/s390/char/sclp_tty.c | 2 +- drivers/s390/char/sclp_vt220.c | 2 +- drivers/s390/char/tty3270.c | 411 ++- drivers/s390/char/tty3270.h | 15 - drivers/s390/crypto/vfio_ap_ops.c | 52 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 2 + drivers/scsi/pm8001/pm8001_init.c | 4 +- drivers/scsi/qla2xxx/qla_attr.c | 7 +- drivers/scsi/qla2xxx/qla_bsg.c | 39 +- drivers/scsi/qla2xxx/qla_dbg.c | 2 +- drivers/scsi/qla2xxx/qla_dfs.c | 4 +- drivers/scsi/qla2xxx/qla_edif.c | 3 + drivers/scsi/qla2xxx/qla_gs.c | 4 +- drivers/scsi/qla2xxx/qla_init.c | 44 +- drivers/scsi/qla2xxx/qla_inline.h | 13 + drivers/scsi/qla2xxx/qla_isr.c | 39 +- drivers/scsi/qla2xxx/qla_mbx.c | 26 +- drivers/scsi/qla2xxx/qla_nx2.c | 2 +- drivers/scsi/qla2xxx/qla_os.c | 14 +- drivers/scsi/scsi_lib.c | 2 + drivers/scsi/sd.c | 4 +- drivers/scsi/smartpqi/smartpqi_init.c | 18 + drivers/soc/bcm/bcm2835-power.c | 7 +- drivers/soc/fsl/qe/qe_ic.c | 3 +- drivers/soc/samsung/exynos-pmu.c | 4 +- drivers/soc/ti/knav_qmss.h | 1 + drivers/soc/ti/knav_qmss_queue.c | 14 +- drivers/soundwire/qcom.c | 2 +- drivers/spi/spi-img-spfi.c | 5 +- drivers/spi/spi-sprd-adi.c | 6 + drivers/staging/fbtft/fbtft-sysfs.c | 2 +- drivers/staging/gdm724x/gdm_tty.c | 3 +- drivers/staging/greybus/audio_gb.c | 13 + drivers/staging/greybus/audio_manager_sysfs.c | 2 +- drivers/staging/greybus/hid.c | 2 +- drivers/staging/greybus/uart.c | 3 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +- drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/octeon/ethernet-mem.c | 43 +- drivers/staging/octeon/ethernet-mem.h | 8 +- drivers/staging/octeon/ethernet-rx.c | 53 +- drivers/staging/octeon/ethernet-rx.h | 13 +- drivers/staging/octeon/ethernet-tx.c | 2 + drivers/staging/octeon/ethernet.c | 43 +- drivers/staging/octeon/octeon-ethernet.h | 14 + drivers/staging/rtl8723bs/core/rtw_cmd.c | 8 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 7 + drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 4 +- drivers/staging/sm750fb/sm750.c | 4 +- drivers/target/iscsi/iscsi_target_login.c | 2 +- drivers/thermal/broadcom/bcm2711_thermal.c | 1 - drivers/thermal/broadcom/bcm2835_thermal.c | 1 - drivers/thermal/imx_thermal.c | 9 +- .../intel/int340x_thermal/int3400_thermal.c | 4 +- drivers/thermal/qoriq_thermal.c | 13 +- drivers/thermal/rcar_gen3_thermal.c | 37 +- drivers/thermal/rcar_thermal.c | 20 +- drivers/thermal/rockchip_thermal.c | 1 - drivers/thermal/rzg2l_thermal.c | 1 - drivers/tty/amiserial.c | 2 +- drivers/tty/ehv_bytechan.c | 3 +- drivers/tty/goldfish.c | 6 +- drivers/tty/hvc/Kconfig | 2 +- drivers/tty/hvc/hvc_console.c | 2 +- drivers/tty/hvc/hvcs.c | 3 +- drivers/tty/hvc/hvsi.c | 4 +- drivers/tty/ipwireless/hardware.c | 2 +- drivers/tty/ipwireless/tty.c | 3 +- drivers/tty/mips_ejtag_fdc.c | 4 +- drivers/tty/moxa.c | 8 +- drivers/tty/mxser.c | 2 +- drivers/tty/n_gsm.c | 3 +- drivers/tty/nozomi.c | 5 +- drivers/tty/pty.c | 2 +- drivers/tty/serial/amba-pl011.c | 10 + drivers/tty/serial/kgdb_nmi.c | 2 +- drivers/tty/serial/serial_core.c | 3 +- drivers/tty/synclink_gt.c | 7 +- drivers/tty/tty_io.c | 4 +- drivers/tty/ttynull.c | 3 +- drivers/tty/vcc.c | 3 +- drivers/tty/vt/vt.c | 4 +- drivers/ufs/core/ufs-debugfs.c | 2 +- drivers/uio/uio.c | 5 + drivers/usb/atm/usbatm.c | 4 +- drivers/usb/class/cdc-acm.c | 3 +- drivers/usb/common/common.c | 3 + drivers/usb/core/driver.c | 88 +- drivers/usb/core/usb.c | 2 +- drivers/usb/core/usb.h | 8 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/gadget/configfs.c | 4 +- drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_mass_storage.c | 2 +- drivers/usb/gadget/function/f_tcm.c | 23 +- drivers/usb/gadget/function/f_uac1_legacy.c | 56 - drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 +- drivers/usb/gadget/function/u_serial.c | 2 +- drivers/usb/gadget/function/u_uac1_legacy.h | 3 - drivers/usb/gadget/functions.c | 2 +- drivers/usb/gadget/legacy/inode.c | 3 +- drivers/usb/gadget/udc/aspeed_udc.c | 43 +- drivers/usb/gadget/udc/r8a66597-udc.c | 1 - drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/host/xhci-dbgtty.c | 4 +- drivers/usb/host/xhci-ring.c | 32 +- drivers/usb/image/mdc800.c | 4 +- drivers/usb/misc/onboard_usb_hub.c | 2 +- drivers/usb/mtu3/mtu3_core.c | 11 +- drivers/usb/phy/phy-fsl-usb.c | 52 +- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/renesas_usbhs/common.c | 6 +- drivers/usb/serial/bus.c | 6 +- drivers/usb/serial/usb-serial.c | 9 +- drivers/usb/storage/ene_ub6250.c | 2 + drivers/usb/storage/uas.c | 2 +- drivers/usb/typec/class.c | 19 + drivers/usb/typec/ucsi/displayport.c | 2 +- drivers/usb/usbip/stub_main.c | 8 +- drivers/vdpa/mlx5/core/mr.c | 2 +- drivers/vfio/pci/vfio_pci_config.c | 1 + drivers/video/fbdev/kyro/fbdev.c | 24 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/tdfxfb.c | 2 +- drivers/video/fbdev/uvesafb.c | 2 + drivers/virtio/virtio_balloon.c | 6 + drivers/w1/masters/ds2482.c | 4 + drivers/w1/slaves/w1_ds28e17.c | 8 + drivers/watchdog/pseries-wdt.c | 53 +- drivers/xen/xenbus/xenbus_xs.c | 16 +- fs/ceph/caps.c | 11 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 +- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 +- fs/erofs/Kconfig | 8 +- fs/ext4/file.c | 7 + fs/ext4/inline.c | 11 +- fs/ext4/inode.c | 10 + fs/ext4/namei.c | 2 + fs/ext4/orphan.c | 10 +- fs/ext4/super.c | 10 +- fs/f2fs/file.c | 14 +- fs/f2fs/namei.c | 11 +- fs/fat/misc.c | 4 + fs/fat/nfs.c | 4 +- fs/fuse/cuse.c | 5 + fs/hfsplus/catalog.c | 25 +- fs/hfsplus/hfsplus_fs.h | 6 + fs/hugetlbfs/inode.c | 3 +- fs/isofs/compress.c | 7 +- fs/lockd/svcsubs.c | 53 +- fs/nfs/client.c | 21 +- fs/nfs/filelayout/filelayoutdev.c | 3 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 3 +- fs/nfs/inode.c | 4 +- fs/nfs/internal.h | 1 + fs/nfs/netns.h | 6 +- fs/nfs/nfs4client.c | 1 + fs/nfs/pnfs.c | 36 +- fs/nfs/pnfs.h | 3 +- fs/nfs/pnfs_nfs.c | 39 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/nfs2acl.c | 31 +- fs/nfsd/nfs4proc.c | 39 +- fs/nfsd/nfs4state.c | 206 +- fs/nfsd/nfs4xdr.c | 17 + fs/nfsd/nfscache.c | 2 +- fs/nfsd/nfsfh.c | 4 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 +- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +- fs/nilfs2/direct.c | 4 +- fs/nilfs2/segment.c | 4 + fs/nilfs2/the_nilfs.c | 6 + fs/notify/fanotify/fanotify_user.c | 17 +- fs/notify/inotify/inotify_user.c | 15 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 47 +- fs/ntfs3/fsntfs.c | 8 +- fs/ntfs3/xattr.c | 25 +- fs/ocfs2/acl.c | 141 +- fs/ocfs2/acl.h | 19 +- fs/ocfs2/cluster/heartbeat.c | 201 +- fs/ocfs2/cluster/heartbeat.h | 7 +- fs/ocfs2/cluster/netdebug.c | 2 +- fs/ocfs2/cluster/nodemanager.c | 10 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/cluster/tcp.c | 89 +- fs/ocfs2/cluster/tcp.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmdomain.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/namei.c | 17 +- fs/ocfs2/refcounttree.c | 47 +- fs/ocfs2/stack_o2cb.c | 6 +- fs/ocfs2/xattr.c | 91 +- fs/ocfs2/xattr.h | 9 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/smb/client/cifs_debug.c | 2 +- fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 +- fs/smb/client/smb2file.c | 5 +- fs/smb/server/smb2pdu.c | 15 +- fs/smb/server/smbacl.c | 16 +- fs/smb/server/vfs.c | 3 - fs/squashfs/cache.c | 2 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- fs/udf/super.c | 23 +- fs/udf/symlink.c | 2 + include/acpi/pcc.h | 5 - include/dt-bindings/clock/qcom,sm8550-gcc.h | 231 ++ include/linux/bitfield.h | 95 +- include/linux/efi.h | 4 +- include/linux/hid.h | 1 + include/linux/kprobes.h | 1 + include/linux/list.h | 15 +- include/linux/mlx4/qp.h | 1 + include/linux/nfs_xdr.h | 2 +- include/linux/of_graph.h | 53 +- include/linux/rcutiny.h | 2 +- include/linux/rcutree.h | 3 +- include/linux/remoteproc.h | 284 +- include/linux/rsc_table.h | 364 ++ include/linux/rtsx_usb.h | 3 + include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/tty_driver.h | 3 +- include/linux/usb.h | 29 +- include/linux/usb/typec.h | 4 + include/linux/virtio_net.h | 4 + include/media/rc-map.h | 2 - include/net/bluetooth/coredump.h | 116 + include/net/bluetooth/hci.h | 2 + include/net/bluetooth/hci_core.h | 14 +- include/net/bluetooth/l2cap.h | 5 + include/net/inet_connection_sock.h | 12 +- include/net/inetpeer.h | 4 + include/net/ip_tunnels.h | 11 +- include/net/netfilter/nf_tables.h | 4 +- include/net/pkt_sched.h | 1 + include/net/sctp/structs.h | 2 +- include/net/tc_act/tc_skbmod.h | 1 + include/net/tcp.h | 13 +- include/rdma/ib_verbs.h | 16 +- include/rdma/restrack.h | 7 +- include/sound/control.h | 6 +- include/uapi/linux/if_link.h | 1 + include/uapi/linux/landlock.h | 1 + include/uapi/linux/time_types.h | 2 +- include/uapi/rdma/rdma_netlink.h | 8 + kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/cgroup.c | 2 +- kernel/bpf/net_namespace.c | 17 +- kernel/bpf/ringbuf.c | 2 +- kernel/bpf/task_iter.c | 36 +- kernel/bpf/verifier.c | 30 +- kernel/cgroup/cpuset.c | 4 +- kernel/entry/common.c | 3 + kernel/futex/requeue.c | 12 +- kernel/kcsan/core.c | 12 +- kernel/kprobes.c | 14 +- kernel/locking/lockdep.c | 2 + kernel/power/wakelock.c | 2 +- kernel/rcu/rcutorture.c | 4 +- kernel/rcu/tree.c | 4 +- kernel/rcu/tree_nocb.h | 2 +- kernel/rcu/tree_plugin.h | 16 +- kernel/sched/cpufreq_schedutil.c | 17 +- kernel/sched/fair.c | 27 +- kernel/signal.c | 4 + kernel/stop_machine.c | 2 +- kernel/sys.c | 2 +- kernel/taskstats.c | 3 +- kernel/time/clocksource.c | 8 +- kernel/time/itimer.c | 2 +- kernel/time/timekeeping.c | 6 + kernel/time/timer.c | 1 + kernel/trace/trace.c | 28 +- kernel/trace/trace.h | 4 +- kernel/trace/trace_events.c | 136 +- kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_mmiotrace.c | 24 +- kernel/trace/trace_osnoise.c | 248 +- lib/string.c | 3 +- lib/test_hmm.c | 2 +- lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/damon/core-test.h | 9 +- mm/damon/core.c | 17 +- mm/damon/paddr.c | 21 +- mm/damon/sysfs.c | 24 +- mm/damon/vaddr-test.h | 5 + mm/damon/vaddr.c | 42 +- mm/huge_memory.c | 10 + mm/hugetlb.c | 14 +- mm/memcontrol.c | 6 + mm/migrate.c | 2 +- mm/vmscan.c | 2 +- net/ax25/ax25_dev.c | 2 +- net/batman-adv/bridge_loop_avoidance.c | 80 +- net/batman-adv/distributed-arp-table.c | 66 +- net/batman-adv/main.c | 4 + net/batman-adv/types.h | 2 +- net/bluetooth/Makefile | 2 + net/bluetooth/coredump.c | 536 +++ net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 24 +- net/bluetooth/hci_core.c | 1 + net/bluetooth/hci_event.c | 15 +- net/bluetooth/hci_sync.c | 14 +- net/bluetooth/iso.c | 8 + net/bluetooth/l2cap_sock.c | 36 +- net/bluetooth/mgmt.c | 27 +- net/bluetooth/msft.c | 5 + net/bluetooth/rfcomm/core.c | 12 +- net/bluetooth/rfcomm/tty.c | 2 +- net/bridge/br_mrp_netlink.c | 4 +- net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_vlan.c | 4 +- net/ceph/messenger_v2.c | 5 + net/ceph/osdmap.c | 2 + net/core/filter.c | 6 +- net/core/lwt_bpf.c | 15 +- net/core/skbuff.c | 10 +- net/core/xdp.c | 4 +- net/dccp/dccp.h | 4 +- net/dccp/ipv4.c | 4 +- net/dccp/ipv6.c | 7 +- net/dccp/minisocks.c | 2 +- net/hsr/hsr_device.c | 71 +- net/hsr/hsr_device.h | 4 +- net/hsr/hsr_forward.c | 85 +- net/hsr/hsr_framereg.c | 115 +- net/hsr/hsr_framereg.h | 4 + net/hsr/hsr_main.h | 15 +- net/hsr/hsr_netlink.c | 30 +- net/hsr/hsr_slave.c | 23 +- net/ipv4/inet_connection_sock.c | 9 + net/ipv4/inetpeer.c | 38 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv4/syncookies.c | 2 +- net/ipv4/tcp_fastopen.c | 2 +- net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 2 +- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/ipv6/tcp_ipv6.c | 97 +- net/ipv6/xfrm6_input.c | 2 +- net/iucv/af_iucv.c | 2 + net/kcm/kcmsock.c | 3 + net/key/af_key.c | 52 +- net/mac80211/link.c | 3 +- net/mac80211/s1g.c | 2 +- net/mac80211/tx.c | 3 +- net/mpls/af_mpls.c | 2 + net/mptcp/subflow.c | 6 +- net/mptcp/syncookies.c | 1 + net/netfilter/Kconfig | 2 +- net/netfilter/ipvs/ip_vs_ftp.c | 10 +- net/netfilter/nf_nat_sip.c | 5 + net/netfilter/nf_tables_api.c | 48 +- net/netfilter/nft_counter.c | 20 +- net/netfilter/xt_cgroup.c | 21 +- net/netfilter/xt_hl.c | 27 + net/nfc/digital_core.c | 2 +- net/nfc/llcp_core.c | 29 +- net/nfc/llcp_sock.c | 14 +- net/nfc/nci/data.c | 10 +- net/nfc/nci/rsp.c | 41 +- net/openvswitch/conntrack.c | 130 +- net/openvswitch/conntrack.h | 6 +- net/openvswitch/datapath.c | 60 +- net/openvswitch/datapath.h | 26 +- net/openvswitch/vport.h | 8 + net/phonet/pep.c | 2 +- net/rds/cong.c | 4 +- net/sched/act_skbmod.c | 38 +- net/sched/cls_api.c | 18 +- net/sched/sch_api.c | 7 +- net/sched/sch_codel.c | 2 +- net/sched/sch_fq_codel.c | 6 +- net/sched/sch_fq_pie.c | 3 +- net/sched/sch_generic.c | 2 +- net/sched/sch_hhf.c | 4 + net/sched/sch_htb.c | 7 +- net/sched/sch_sfq.c | 3 +- net/sched/sch_teql.c | 1 + net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 +- net/smc/af_smc.c | 6 +- net/smc/smc_core.c | 14 +- net/smc/smc_llc.c | 3 + net/smc/smc_rx.c | 11 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/svcauth_gss.c | 3 +- net/sunrpc/cache.c | 7 +- net/sunrpc/rpcb_clnt.c | 4 + net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 29 +- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 9 +- net/tls/tls_strp.c | 16 +- net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport.c | 2 +- scripts/mod/modpost.c | 6 +- scripts/tags.sh | 2 +- security/apparmor/lib.c | 20 +- security/integrity/ima/ima_appraise.c | 2 + security/landlock/errata/abi-1.h | 24 + security/landlock/fs.c | 40 +- security/selinux/include/security.h | 4 +- security/selinux/selinuxfs.c | 7 +- security/selinux/ss/services.c | 45 +- security/smack/smack.h | 5 +- security/smack/smack_lsm.c | 67 +- security/smack/smackfs.c | 222 +- sound/core/control.c | 69 +- sound/core/control_compat.c | 2 +- sound/core/control_led.c | 152 +- sound/core/init.c | 4 +- sound/core/oss/mixer_oss.c | 10 +- sound/core/pcm_native.c | 2 + sound/core/seq/seq_clientmgr.c | 1 + sound/core/seq/seq_midi.c | 61 +- sound/drivers/aloop.c | 104 +- sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/parisc/harmony.c | 6 +- sound/pci/asihpi/hpi6000.c | 5 + sound/pci/emu10k1/emufx.c | 2 +- sound/pci/hda/hda_proc.c | 2 +- sound/pci/pcxhr/pcxhr.c | 14 +- sound/pci/via82xx_modem.c | 26 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/apple/mca.c | 6 +- sound/soc/codecs/cs35l33.c | 14 +- sound/soc/codecs/cs35l34.c | 14 +- sound/soc/codecs/rt700-sdw.c | 6 +- sound/soc/fsl/fsl-asoc-card.c | 4 +- sound/soc/fsl/fsl_audmix.c | 24 +- sound/soc/fsl/mpc5200_psc_i2s.c | 1 + sound/soc/intel/atom/sst/sst_pci.c | 4 +- sound/soc/meson/meson-card-utils.c | 17 +- sound/soc/pxa/pxa-ssp.c | 7 +- sound/soc/qcom/qdsp6/q6apm.c | 12 +- sound/soc/samsung/aries_wm8994.c | 1 + sound/soc/soc-dapm.c | 2 +- sound/soc/sof/topology.c | 18 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 14 +- sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- sound/usb/midi.c | 2 + tools/bpf/bpftool/btf.c | 19 +- tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/common.c | 2 + tools/bpf/bpftool/gen.c | 10 +- tools/bpf/bpftool/iter.c | 12 +- tools/bpf/bpftool/jit_disasm.c | 2 + tools/bpf/bpftool/main.c | 7 +- tools/bpf/bpftool/map.c | 29 +- tools/bpf/bpftool/net.c | 2 + tools/bpf/bpftool/perf.c | 2 + tools/bpf/bpftool/prog.c | 12 +- tools/bpf/bpftool/struct_ops.c | 15 +- tools/bpf/bpftool/xlated_dumper.c | 2 + tools/build/Makefile.feature | 3 +- tools/build/feature/Makefile | 3 + tools/include/linux/compiler.h | 2 +- tools/lib/bpf/libbpf.c | 3 +- tools/perf/builtin-sched.c | 40 +- tools/perf/builtin-stat.c | 15 +- tools/perf/tests/shell/stat_bpf_counters.sh | 97 +- tools/perf/ui/browsers/hists.c | 6 +- tools/perf/util/auxtrace.c | 15 +- tools/perf/util/cs-etm.c | 81 +- tools/perf/util/dso.c | 19 +- .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.c | 47 +- .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.h | 12 + tools/perf/util/intel-bts.c | 2 +- tools/perf/util/intel-pt.c | 2 +- tools/perf/util/machine.c | 34 +- tools/perf/util/metricgroup.c | 25 +- tools/perf/util/synthetic-events.c | 6 +- tools/perf/util/thread-stack.c | 2 +- tools/perf/util/trace-event-read.c | 33 +- tools/scripts/Makefile.include | 38 +- tools/testing/kunit/kunit.py | 2 +- tools/testing/kunit/kunit_tool_test.py | 12 + .../selftests/arm64/mte/check_buffer_fill.c | 2 + .../selftests/arm64/mte/check_child_memory.c | 2 + .../selftests/arm64/mte/check_gcr_el1_cswitch.c | 1 + .../selftests/arm64/mte/check_hugetlb_options.c | 298 ++ .../selftests/arm64/mte/check_ksm_options.c | 31 +- .../selftests/arm64/mte/check_mmap_options.c | 2 + .../selftests/arm64/mte/check_tags_inclusion.c | 2 + tools/testing/selftests/arm64/mte/check_user_mem.c | 2 + tools/testing/selftests/bpf/README.rst | 32 +- tools/testing/selftests/bpf/test_progs.c | 11 +- tools/testing/selftests/bpf/test_sockmap.c | 3 +- tools/testing/selftests/bpf/vmtest.sh | 71 +- .../selftests/rseq/rseq-x86-thread-pointer.h | 4 +- tools/testing/selftests/timers/leap-a-day.c | 19 +- tools/testing/selftests/vm/ksm_tests.c | 12 +- tools/testing/selftests/zram/zram_lib.sh | 2 +- 1071 files changed, 22831 insertions(+), 7021 deletions(-)