From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793365067; b=P8kFJp+2NuY4p39sG9OQdrolZjtzWB8UmNVHf0QsRixeCFFBDw4mJhIOuTlhpGSyD1xe Rw2usrMGw3cj2MjM9ab//3zNgAHWxADCEPfrKFXfiGU1DNoqI2dQiyqL5qh7N0y4Vw1Zf idascIAl1wvMMJtW88X4UaXeg5asz0ICwsJmAroRJc1tRWG2FCP7+LDv50ceL5PE00snS P5SXruKvcYCxdeq+djQMYsTTYub39Wv4Z64biVHWJ+Y3PUIUF7Ri8+F0L5sA02N/Yc1g5 J9N/w+vXQCVGT0pS/toXswECCAq/JwDWVvIw1TakSzFSSV0WQdDjDnd70NEy0IHOoTA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793365067; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=oaN5Ij6YlNYpDyH5xDmcjO/ZMaMaQUz04FeTJtsUI7M=; b=x+vS238ctDk7oH6Z3f9lZJmRVkXywlo7DZoPUY6WE6IaLZqHeCFgQipW4Ig1Oy+JcP+w q/8Phf1pr/9GE/LykHJzZGJsA/mvPZQJjSd6U5ZguDBdhBKS0LWhl0SNMcG11TlIROPKV MNNsCB3E/x8VKRocDGf97nmRmNh0iuUGM5aix0fw5VEu9uJzWDDNBspp2gwgkvEMhKrbI url5LCIXhoZu7b3+tBEFMdZqHe6ML4Jv+gPStcIUcFpKrrSdUvo5MbLKcPRFiPE2Owb5G ncj1yDGXUkfmoSytu87/GnMKTLk33+PfZE7Nzm9o1iQWLp7GxhN/eAOvC8YeNq8TmDA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=UZueCPPM; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D990606A326; Fri, 30 Oct 2026 12:57:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=UZueCPPM Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2E9241F000C1; Fri, 30 Oct 2026 12:57:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793365066; bh=oaN5Ij6YlNYpDyH5xDmcjO/ZMaMaQUz04FeTJtsUI7M=; h=From:To:Cc:Subject:Date; b=UZueCPPMxTfoBftogYVFyXwSpTsvjuHyTph+Sq//cv1n3xxIKr7p32E0/hxGxsfYH yUKgeSjBjZ+NW6IOcFPjO2XW8CvLrcYG+MPXiW05FqPlL6w3KGNyUKeuYqW52f5ibC YhgmfJnzGC6AykVgY9nzPDOYy6732SpcPDGAEflU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, akpm@linux-foundation.org, torvalds@linux-foundation.org, stable@vger.kernel.org Cc: lwn@lwn.net, jslaby@suse.cz, Greg Kroah-Hartman Subject: Linux 5.15.224 Date: Fri, 30 Oct 2026 13:57:37 +0100 Message-ID: <2026103038-graceless-starboard-a2a7@gregkh> X-Mailer: git-send-email 2.56.0 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I'm announcing the release of the 5.15.224 kernel. All users of the 5.15 kernel series must upgrade. The updated 5.15.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/arm64/silicon-errata.rst | 2 Documentation/networking/strparser.rst | 2 Makefile | 2 arch/arm64/Kconfig | 30 arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 9 arch/arm64/kernel/cpu_errata.c | 24 arch/arm64/kernel/cpufeature.c | 2 arch/arm64/kernel/topology.c | 11 arch/arm64/kvm/mmu.c | 25 arch/arm64/kvm/vgic/vgic-its.c | 8 arch/arm64/mm/fault.c | 17 arch/arm64/tools/cpucaps | 2 arch/nios2/include/asm/checksum.h | 2 arch/s390/kvm/kvm-s390.c | 4 arch/s390/pci/pci_sysfs.c | 3 arch/x86/events/intel/core.c | 10 arch/x86/events/perf_event.h | 2 arch/x86/kvm/mmu/mmu.c | 4 arch/x86/kvm/svm/svm.c | 3 arch/x86/kvm/vmx/nested.c | 4 arch/x86/kvm/x86.h | 4 crypto/drbg.c | 11 drivers/base/property.c | 19 drivers/block/zram/zram_drv.c | 6 drivers/bluetooth/btintel.c | 15 drivers/bluetooth/btqcomsmd.c | 10 drivers/bluetooth/btusb.c | 2 drivers/char/hw_random/stm32-rng.c | 12 drivers/dma/dmaengine.c | 30 drivers/edac/amd64_edac.c | 2 drivers/gpio/gpio-exar.c | 2 drivers/gpio/gpio-xilinx.c | 9 drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 46 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 64 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 17 drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 9 drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c | 25 drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 2 drivers/gpu/drm/amd/amdgpu/vi.c | 21 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 16 drivers/gpu/drm/amd/display/dc/dce60/dce60_resource.c | 1 drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 10 drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomfwctrl.c | 11 drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 39 drivers/gpu/drm/aspeed/aspeed_gfx_drv.c | 5 drivers/gpu/drm/drm_dp_helper.c | 4 drivers/gpu/drm/drm_fb_helper.c | 8 drivers/gpu/drm/gud/gud_pipe.c | 1 drivers/gpu/drm/i915/display/intel_dmc.c | 21 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 2 drivers/gpu/drm/i915/gt/intel_rps.c | 3 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 drivers/gpu/drm/msm/msm_gpu.c | 1 drivers/gpu/drm/nouveau/nouveau_gem.c | 11 drivers/gpu/drm/radeon/radeon_bios.c | 6 drivers/gpu/drm/vc4/vc4_bo.c | 1 drivers/gpu/drm/vc4/vc4_v3d.c | 8 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 22 drivers/hid/hid-alps.c | 21 drivers/hid/hid-core.c | 26 drivers/hid/hid-sony.c | 4 drivers/hid/hid-steam.c | 211 +- drivers/hid/i2c-hid/i2c-hid-core.c | 5 drivers/hid/uhid.c | 8 drivers/hid/usbhid/hid-core.c | 11 drivers/hv/connection.c | 1 drivers/hv/vmbus_drv.c | 1 drivers/hwmon/drivetemp.c | 10 drivers/hwmon/pwm-fan.c | 15 drivers/hwtracing/coresight/coresight-etm3x-sysfs.c | 15 drivers/i2c/busses/i2c-at91-master.c | 8 drivers/i2c/busses/i2c-mxs.c | 5 drivers/i2c/busses/i2c-qcom-cci.c | 4 drivers/i2c/busses/i2c-wmt.c | 2 drivers/i2c/i2c-core-base.c | 14 drivers/i3c/master.c | 20 drivers/iio/accel/kxcjk-1013.c | 2 drivers/iio/accel/sca3000.c | 2 drivers/iio/adc/aspeed_adc.c | 4 drivers/iio/adc/max1363.c | 8 drivers/iio/adc/sun4i-gpadc-iio.c | 10 drivers/iio/gyro/adis16136.c | 2 drivers/iio/imu/adis16400.c | 2 drivers/iio/imu/adis16480.c | 4 drivers/iio/industrialio-buffer.c | 2 drivers/iio/industrialio-trigger.c | 2 drivers/iio/light/gp2ap020a00f.c | 2 drivers/iio/proximity/isl29501.c | 2 drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | 4 drivers/iio/proximity/vcnl3020.c | 24 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 drivers/input/keyboard/atkbd.c | 8 drivers/input/mouse/byd.c | 2 drivers/input/mouse/synaptics.c | 7 drivers/input/serio/i8042-acpipnpio.h | 9 drivers/input/touchscreen/exc3000.c | 10 drivers/input/touchscreen/s6sy761.c | 14 drivers/isdn/capi/capi.c | 8 drivers/md/dm-cache-target.c | 59 drivers/md/dm-crypt.c | 10 drivers/md/dm-ebs-target.c | 3 drivers/md/dm-integrity.c | 5 drivers/md/dm-ioctl.c | 14 drivers/md/dm-snap.c | 14 drivers/md/dm-table.c | 2 drivers/md/md.c | 28 drivers/md/md.h | 2 drivers/md/raid0.c | 16 drivers/md/raid5.c | 41 drivers/media/pci/saa7164/saa7164-core.c | 6 drivers/memstick/core/memstick.c | 8 drivers/memstick/host/rtsx_usb_ms.c | 31 drivers/mmc/host/cavium-octeon.c | 5 drivers/mmc/host/cavium-thunderx.c | 5 drivers/mmc/host/mtk-sd.c | 1 drivers/mmc/host/sdhci-sprd.c | 4 drivers/mmc/host/via-sdmmc.c | 4 drivers/mtd/devices/block2mtd.c | 2 drivers/mtd/maps/vmu-flash.c | 2 drivers/mtd/mtdcore.c | 132 - drivers/mtd/mtdcore.h | 1 drivers/mtd/mtdpart.c | 14 drivers/mtd/nand/raw/cadence-nand-controller.c | 6 drivers/mtd/nand/raw/vf610_nfc.c | 85 drivers/mtd/nand/spi/core.c | 34 drivers/net/bonding/bond_main.c | 27 drivers/net/can/dev/skb.c | 2 drivers/net/can/slcan.c | 1 drivers/net/ethernet/amazon/ena/ena_com.c | 25 drivers/net/ethernet/amazon/ena/ena_com.h | 14 drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 drivers/net/ethernet/broadcom/bcmsysport.c | 4 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 drivers/net/ethernet/brocade/bna/bnad.c | 16 drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | 4 drivers/net/ethernet/ibm/ibmveth.c | 7 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 6 drivers/net/gtp.c | 18 drivers/net/team/team.c | 67 drivers/net/team/team_mode_loadbalance.c | 4 drivers/net/usb/ax88179_178a.c | 6 drivers/net/usb/qmi_wwan.c | 1 drivers/net/vxlan/vxlan_core.c | 12 drivers/net/wireguard/noise.c | 7 drivers/net/wireless/ath/ath11k/mac.c | 1 drivers/net/wireless/ath/wcn36xx/dxe.c | 2 drivers/net/wireless/ath/wcn36xx/smd.c | 4 drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 27 drivers/net/wireless/intel/iwlegacy/3945-mac.c | 1 drivers/net/wireless/intersil/p54/fwio.c | 42 drivers/net/wireless/marvell/libertas/tx.c | 7 drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 19 drivers/net/wireless/st/cw1200/bh.c | 8 drivers/net/wireless/st/cw1200/txrx.c | 14 drivers/net/wireless/ti/wl12xx/main.c | 9 drivers/net/wireless/ti/wl18xx/main.c | 2 drivers/net/wireless/ti/wlcore/main.c | 10 drivers/net/wireless/ti/wlcore/wlcore.h | 2 drivers/net/xen-netfront.c | 16 drivers/nvme/host/core.c | 3 drivers/nvme/host/multipath.c | 5 drivers/nvme/host/tcp.c | 62 drivers/nvme/target/configfs.c | 9 drivers/nvme/target/core.c | 2 drivers/of/irq.c | 14 drivers/of/overlay.c | 17 drivers/opp/core.c | 6 drivers/pci/pci.c | 15 drivers/pinctrl/sunxi/pinctrl-sunxi.c | 197 +- drivers/pinctrl/sunxi/pinctrl-sunxi.h | 100 - drivers/power/supply/ds2780_battery.c | 2 drivers/power/supply/max17040_battery.c | 10 drivers/power/supply/rt9455_charger.c | 26 drivers/regulator/ltc3676.c | 15 drivers/rtc/rtc-spear.c | 11 drivers/s390/net/ctcm_mpc.c | 3 drivers/scsi/ch.c | 30 drivers/scsi/libiscsi.c | 14 drivers/scsi/qedi/qedi_main.c | 3 drivers/scsi/qla2xxx/qla_bsg.c | 47 drivers/scsi/qla2xxx/qla_init.c | 17 drivers/scsi/qla2xxx/qla_iocb.c | 4 drivers/scsi/qla2xxx/qla_isr.c | 27 drivers/scsi/qla2xxx/qla_mbx.c | 4 drivers/scsi/qla2xxx/qla_mid.c | 33 drivers/scsi/qla2xxx/qla_nvme.c | 10 drivers/scsi/qla2xxx/qla_os.c | 13 drivers/scsi/sd_zbc.c | 11 drivers/scsi/st.c | 18 drivers/soc/rockchip/pm_domains.c | 20 drivers/spi/spi-bcm63xx.c | 6 drivers/staging/greybus/uart.c | 10 drivers/staging/media/rkvdec/rkvdec.c | 4 drivers/staging/media/zoran/zoran_card.c | 2 drivers/staging/octeon-usb/octeon-hcd.c | 2 drivers/staging/rtl8723bs/core/rtw_mlme.c | 5 drivers/staging/sm750fb/sm750.c | 2 drivers/staging/sm750fb/sm750.h | 2 drivers/staging/sm750fb/sm750_accel.c | 6 drivers/staging/sm750fb/sm750_accel.h | 4 drivers/target/iscsi/iscsi_target_configfs.c | 26 drivers/tee/optee/core.c | 26 drivers/thunderbolt/ctl.c | 47 drivers/thunderbolt/xdomain.c | 4 drivers/tty/amiserial.c | 9 drivers/tty/serial/8250/8250_bcm7271.c | 2 drivers/tty/serial/imx.c | 25 drivers/tty/serial/kgdboc.c | 9 drivers/tty/serial/max3100.c | 14 drivers/tty/serial/qcom_geni_serial.c | 5 drivers/tty/serial/serial-tegra.c | 18 drivers/tty/serial/serial_core.c | 11 drivers/tty/serial/vt8500_serial.c | 1 drivers/tty/tty_io.c | 925 ++++------ drivers/tty/tty_port.c | 43 drivers/tty/vcc.c | 5 drivers/tty/vt/vc_screen.c | 25 drivers/tty/vt/vt.c | 5 drivers/usb/cdns3/cdns3-gadget.c | 4 drivers/usb/cdns3/cdns3-pci-wrap.c | 5 drivers/usb/class/cdc-acm.c | 45 drivers/usb/class/cdc-acm.h | 1 drivers/usb/core/hub.c | 7 drivers/usb/core/message.c | 8 drivers/usb/dwc2/hcd.c | 3 drivers/usb/dwc3/core.h | 19 drivers/usb/dwc3/ep0.c | 9 drivers/usb/dwc3/gadget.c | 104 + drivers/usb/gadget/function/f_fs.c | 15 drivers/usb/gadget/function/f_mass_storage.c | 3 drivers/usb/gadget/function/f_uac1_legacy.c | 6 drivers/usb/gadget/udc/aspeed-vhub/core.c | 4 drivers/usb/gadget/udc/aspeed-vhub/dev.c | 2 drivers/usb/gadget/udc/aspeed-vhub/hub.c | 5 drivers/usb/gadget/udc/aspeed-vhub/vhub.h | 1 drivers/usb/gadget/udc/at91_udc.c | 33 drivers/usb/gadget/udc/dummy_hcd.c | 4 drivers/usb/host/ohci-da8xx.c | 2 drivers/usb/host/ohci-s3c2410.c | 1 drivers/usb/host/ohci-spear.c | 4 drivers/usb/host/ohci-st.c | 1 drivers/usb/host/xhci.c | 12 drivers/usb/serial/bus.c | 6 drivers/usb/serial/cp210x.c | 1 drivers/usb/serial/generic.c | 10 drivers/usb/serial/option.c | 14 drivers/usb/serial/quatech2.c | 19 drivers/usb/serial/ssu100.c | 18 drivers/usb/serial/usb-serial.c | 166 + drivers/usb/storage/realtek_cr.c | 9 drivers/usb/storage/sierra_ms.c | 7 drivers/usb/typec/tcpm/tcpm.c | 41 drivers/usb/typec/tipd/core.c | 3 drivers/usb/typec/ucsi/displayport.c | 9 drivers/usb/typec/ucsi/ucsi.c | 17 drivers/usb/typec/ucsi/ucsi_acpi.c | 18 drivers/virt/nitro_enclaves/ne_misc_dev.c | 1 drivers/watchdog/cpu5wdt.c | 2 drivers/watchdog/rtd119x_wdt.c | 21 fs/autofs/waitq.c | 25 fs/btrfs/dev-replace.c | 1 fs/btrfs/scrub.c | 4 fs/ceph/export.c | 23 fs/cifs/cifsacl.c | 27 fs/cifs/cifsfs.c | 16 fs/cifs/cifsglob.h | 6 fs/cifs/connect.c | 1 fs/cifs/dir.c | 37 fs/cifs/file.c | 22 fs/cifs/inode.c | 29 fs/cifs/link.c | 15 fs/cifs/misc.c | 7 fs/cifs/smb1ops.c | 21 fs/cifs/smb2misc.c | 9 fs/cifs/smb2ops.c | 102 - fs/cifs/smb2pdu.c | 85 fs/cifs/smb2pdu.h | 6 fs/cifs/transport.c | 62 fs/dcache.c | 4 fs/dlm/lock.c | 2 fs/f2fs/debug.c | 4 fs/f2fs/dir.c | 1 fs/f2fs/f2fs.h | 22 fs/f2fs/gc.c | 33 fs/f2fs/gc.h | 20 fs/f2fs/recovery.c | 33 fs/f2fs/segment.c | 9 fs/f2fs/super.c | 4 fs/f2fs/sysfs.c | 8 fs/fcntl.c | 3 fs/fsopen.c | 3 fs/inode.c | 23 fs/ksmbd/smb2pdu.c | 7 fs/lockd/svcsubs.c | 2 fs/namespace.c | 123 + fs/nfsd/netns.h | 1 fs/nfsd/nfs2acl.c | 21 fs/nfsd/nfs4proc.c | 25 fs/nfsd/nfs4state.c | 3 fs/nfsd/trace.h | 4 fs/nfsd/vfs.c | 4 fs/notify/mark.c | 11 fs/ocfs2/dir.c | 71 fs/ocfs2/dlm/dlmcommon.h | 2 fs/ocfs2/dlm/dlmdebug.c | 5 fs/ocfs2/dlm/dlmrecovery.c | 2 fs/pipe.c | 6 fs/unicode/utf8-core.c | 9 fs/verity/Kconfig | 3 fs/xfs/libxfs/xfs_alloc.c | 45 fs/xfs/libxfs/xfs_ialloc.c | 32 fs/xfs/libxfs/xfs_sb.c | 17 fs/xfs/xfs_bmap_item.c | 2 fs/xfs/xfs_buf_item.c | 380 ++-- fs/xfs/xfs_buf_item.h | 3 fs/xfs/xfs_extfree_item.c | 2 fs/xfs/xfs_icache.c | 10 fs/xfs/xfs_inode.c | 4 fs/xfs/xfs_inode_item.c | 162 + fs/xfs/xfs_inode_item.h | 1 fs/xfs/xfs_log.c | 2 fs/xfs/xfs_log_cil.c | 2 fs/xfs/xfs_refcount_item.c | 2 fs/xfs/xfs_rmap_item.c | 2 fs/xfs/xfs_trace.h | 4 fs/xfs/xfs_trans.c | 2 fs/xfs/xfs_trans.h | 3 include/linux/can/skb.h | 3 include/linux/cgroup-defs.h | 5 include/linux/device-mapper.h | 5 include/linux/dmaengine.h | 7 include/linux/fsnotify_backend.h | 1 include/linux/ftrace.h | 5 include/linux/futex.h | 14 include/linux/hid.h | 6 include/linux/i2c.h | 1 include/linux/if_team.h | 3 include/linux/if_vlan.h | 3 include/linux/key-type.h | 1 include/linux/key.h | 5 include/linux/kprobes.h | 1 include/linux/lockd/lockd.h | 2 include/linux/mm.h | 2 include/linux/mm_types.h | 4 include/linux/mount.h | 2 include/linux/mtd/mtd.h | 2 include/linux/netlink.h | 3 include/linux/nvme.h | 4 include/linux/property.h | 3 include/linux/qcom-geni-se.h | 15 include/linux/sched/signal.h | 5 include/linux/skbuff.h | 12 include/linux/tty.h | 81 include/linux/tty_driver.h | 5 include/linux/tty_port.h | 1 include/linux/unicode.h | 1 include/linux/usb/serial.h | 1 include/net/af_vsock.h | 3 include/net/bluetooth/hci_core.h | 4 include/net/bluetooth/rfcomm.h | 1 include/net/codel_impl.h | 1 include/net/mctpdevice.h | 5 include/net/netfilter/nf_tables.h | 18 include/net/netns/xfrm.h | 1 include/net/strparser.h | 10 include/net/tcp.h | 4 include/uapi/linux/sched.h | 5 io_uring/io-wq.c | 2 io_uring/io_uring.c | 9 kernel/audit_tree.c | 24 kernel/bpf/arraymap.c | 18 kernel/cgroup/cgroup.c | 6 kernel/events/core.c | 18 kernel/fork.c | 20 kernel/futex/core.c | 49 kernel/kprobes.c | 27 kernel/params.c | 59 kernel/ptrace.c | 3 kernel/signal.c | 8 kernel/time/clockevents.c | 33 kernel/time/tick-broadcast.c | 37 kernel/time/tick-internal.h | 2 kernel/trace/ftrace.c | 72 kernel/trace/ring_buffer.c | 6 kernel/trace/trace.h | 4 kernel/trace/trace_events_filter.c | 6 kernel/trace/trace_events_hist.c | 50 kernel/trace/trace_functions.c | 2 kernel/trace/trace_stack.c | 2 kernel/watch_queue.c | 11 kernel/workqueue.c | 2 mm/huge_memory.c | 3 mm/hugetlb.c | 22 mm/mmap.c | 31 mm/mremap.c | 38 mm/rmap.c | 6 mm/vmalloc.c | 45 net/bluetooth/hci_core.c | 12 net/bluetooth/hci_debugfs.c | 2 net/bluetooth/hci_sock.c | 2 net/bluetooth/l2cap_core.c | 7 net/bluetooth/l2cap_sock.c | 59 net/bluetooth/mgmt.c | 9 net/bluetooth/rfcomm/core.c | 134 + net/bluetooth/rfcomm/sock.c | 5 net/bluetooth/rfcomm/tty.c | 16 net/bridge/br_cfm.c | 11 net/bridge/br_device.c | 1 net/bridge/br_input.c | 35 net/bridge/br_mrp.c | 13 net/bridge/br_multicast.c | 45 net/bridge/br_private.h | 26 net/can/af_can.c | 6 net/can/bcm.c | 2 net/can/isotp.c | 11 net/can/j1939/socket.c | 1 net/can/j1939/transport.c | 2 net/can/raw.c | 7 net/core/flow_dissector.c | 26 net/core/page_pool.c | 3 net/hsr/hsr_framereg.c | 4 net/ipv4/fib_semantics.c | 5 net/ipv4/fib_trie.c | 2 net/ipv4/ipconfig.c | 92 net/ipv4/ipmr.c | 3 net/ipv4/ipmr_base.c | 2 net/ipv4/route.c | 2 net/ipv4/tcp.c | 4 net/ipv4/tcp_dctcp.c | 2 net/ipv4/tcp_input.c | 6 net/ipv4/udp.c | 9 net/ipv6/ip6_gre.c | 5 net/ipv6/ip6_output.c | 35 net/ipv6/ip6mr.c | 2 net/ipv6/route.c | 2 net/ipv6/seg6_iptunnel.c | 2 net/iucv/af_iucv.c | 42 net/mac80211/agg-rx.c | 2 net/mac80211/chan.c | 36 net/mac80211/fils_aead.c | 8 net/mac80211/mesh_pathtbl.c | 16 net/mac80211/mlme.c | 5 net/mac80211/rc80211_minstrel_ht.c | 30 net/mac80211/sta_info.c | 6 net/mac80211/tx.c | 6 net/mctp/device.c | 29 net/mctp/neigh.c | 4 net/mctp/route.c | 4 net/netfilter/ipset/ip_set_bitmap_gen.h | 2 net/netfilter/ipvs/ip_vs_conn.c | 3 net/netfilter/ipvs/ip_vs_lblc.c | 4 net/netfilter/ipvs/ip_vs_lblcr.c | 3 net/netfilter/ipvs/ip_vs_sync.c | 33 net/netfilter/nf_tables_api.c | 54 net/netfilter/nf_tables_core.c | 29 net/netfilter/nf_tables_trace.c | 44 net/netfilter/nft_flow_offload.c | 8 net/netfilter/nft_set_bitmap.c | 4 net/netfilter/nft_set_hash.c | 8 net/netfilter/nft_set_pipapo.c | 10 net/netfilter/nft_set_rbtree.c | 10 net/netlink/af_netlink.c | 24 net/netlink/genetlink.c | 28 net/openvswitch/actions.c | 7 net/openvswitch/conntrack.c | 23 net/openvswitch/datapath.c | 8 net/openvswitch/vport-netdev.c | 8 net/packet/af_packet.c | 6 net/rds/rdma_transport.c | 38 net/rds/tcp.c | 9 net/sched/act_api.c | 20 net/sched/cls_api.c | 15 net/sched/cls_flower.c | 5 net/sched/cls_u32.c | 41 net/sched/em_text.c | 3 net/sched/sch_codel.c | 2 net/sched/sch_fq_codel.c | 4 net/sctp/inqueue.c | 6 net/sctp/socket.c | 39 net/smc/af_smc.c | 7 net/strparser/strparser.c | 6 net/sunrpc/auth_gss/gss_rpc_xdr.c | 15 net/tipc/crypto.c | 20 net/tipc/node.c | 12 net/tipc/topsrv.c | 80 net/tls/tls_device.c | 7 net/vmw_vsock/af_vsock.c | 49 net/vmw_vsock/virtio_transport_common.c | 3 net/wireless/lib80211_crypt_tkip.c | 13 net/wireless/scan.c | 29 net/xfrm/xfrm_policy.c | 19 samples/pidfd/Makefile | 2 security/apparmor/include/label.h | 6 security/keys/key.c | 19 security/keys/keyctl.c | 15 security/keys/keyring.c | 153 - security/keys/persistent.c | 55 security/keys/process_keys.c | 5 security/keys/trusted-keys/trusted_tpm1.c | 6 security/keys/trusted-keys/trusted_tpm2.c | 2 security/selinux/avc.c | 5 security/selinux/hooks.c | 9 sound/core/seq/seq_compat.c | 2 sound/soc/codecs/adau1372.c | 18 sound/soc/codecs/cs42l52.c | 2 sound/soc/codecs/cs42l56.c | 2 sound/soc/codecs/max98371.c | 2 sound/soc/codecs/nau8822.c | 4 sound/soc/codecs/pcm3168a.c | 2 sound/soc/codecs/rt274.c | 4 sound/soc/codecs/wm8903.c | 2 sound/soc/codecs/wm8978.c | 4 sound/soc/qcom/lpass-cpu.c | 4 sound/soc/samsung/i2s.c | 8 sound/soc/stm/stm32_spdifrx.c | 2 sound/usb/caiaq/device.c | 3 sound/usb/card.h | 3 sound/usb/endpoint.c | 16 sound/usb/line6/playback.c | 7 sound/usb/misc/ua101.c | 9 sound/usb/quirks.c | 4 sound/virtio/virtio_card.c | 4 tools/gpio/Makefile | 6 tools/perf/tests/bpf.c | 3 tools/perf/util/parse-events.c | 2 tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc | 24 527 files changed, 6076 insertions(+), 3160 deletions(-) Abdurrahman Hussain (4): of/overlay: put property on deadprops only after changeset add succeeds of/overlay: only treat a positive changeset id as registered of/overlay: don't leak fragment references when changeset init fails of/overlay: don't create "//" paths for fragments targeting the root Abhishek Ojha (1): regulator: ltc3676: don't read the write-only HRST and CLIRQ registers Adrian Betschart (1): drm/amd/display: Don't replace a sink mode that shares the native totals Adrian Hunter (2): i3c: master: Do not treat master device as a duplicate target i3c: master: Fix use-after-free of master->this Adrian Martinez (1): KEYS: Fix key_reject_and_link() race with keyring restriction Ahmed Abdelhaleem Ahmed (1): scsi: ch: Do not keep references to data transfer element devices Alan Stern (1): USB: gadget: dummy-hcd: Fix wait for outstanding request completions Aldo Ariel Panzardo (1): Bluetooth: mgmt: fix race in read_unconf_index_list() Aleksandr Khromov (3): ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION Alex Deucher (1): drm/amdgpu: make Mac FB workaround generic Alexander Usyskin (2): mtd: call external _get and _put in right order mtd: fix use-after-free in mtd release Allison Henderson (1): net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure Alvin Šipraga (2): ASoC: adau1372: allow sleepy powerdown GPIOs ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes Amirmohammad Eftekhar (1): KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Amit Pundir (1): arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved Amit Sunil Dhamne (2): usb: typec: tcpm: recover after failure to start the frs ams usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling Andre Eikmeyer (1): drm/amdgpu: reset VI ASIC on MacBookPro15,1 Andrii Nakryiko (1): bpf: fix potential 32-bit overflow when accessing ARRAY map element Andy Shevchenko (5): params: Do not go over the limit when getting the string length params: Use size_add() for kmalloc() params: Sort headers params: Fix multi-line comment style mtd: core: Drop duplicate NULL checks around nvmem_unregister() Angel Iglesias (1): i2c: core: Introduce i2c_client_get_device_id helper function Anjali Kulkarni (1): netlink: Reverse the patch which removed filtering Aohan Mei (5): smb: client: reject userspace cifs.idmap descriptions netfilter: nf_tables: skip expired catchall elements on insert and delete netfilter: nft_flow_offload: drop flowtable reference on init error path net: rds: fix uninitialized trans dereference in CM event handler net/sched: cls_flower: validate mask pointer after nla_next() Arka Mondal (3): iio: gyro: adis16136: fix unprotected debugfs reads iio: imu: adis16400: fix unprotected debugfs reads iio: imu: adis16480: fix unprotected debugfs reads Arnaldo Carvalho de Melo (1): perf test bpf: Address error about non-null argument for epoll_pwait 2nd arg Asad Kamal (1): drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Aswin Karuvally (1): s390/ctcm: Prevent XID null dereference Avi Weiss (1): ASoC: stm32: spdifrx: fix synchronization state check Bastien Nocera (1): HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM Beata Michalska (2): arm64: errata: Factor out broken AMU const counter cap arm64: errata: Add Cortex-A725 erratum 3821522 workaround Ben Cressey (3): dm-crypt: reject the lmk IV mode with AEAD ciphers dm-crypt: fix a tiny race condition in crypt_dec_pending dm-integrity: fix infinite loop on discard with large tag size Bence Csókás (1): dmaengine: Add devm_dma_request_chan() Benjamin Berg (1): wifi: cfg80211: avoid double free if updating BSS fails Benjamin Marzinski (1): dm cache: fix issue with background work locking Benjamin Tissoires (1): HID: core: introduce hid_safe_input_report() Binbin Deng (1): net/mctp: publish the mctp_dev only after it is initialised Bjoern Doebel (3): smb: client: avoid leaking refcount in cifs_queue_oplock_break() smb: client: fix heap overflow in DACL owner/group rewrite smb: client: avoid leaking refcount when cifs_sb_tlink() fails Breno Leitao (1): usb: xhci: bail out of setup if the controller is inaccessible Bryam Vargas (1): net/iucv: fix the recvmsg window update Can Peng (2): hwrng: stm32 - Fix runtime PM cleanup on registration failure spi: bcm63xx: disable clock on resume failure Carlo Szelinsky (1): USB: serial: option: add Quectel EG060W Carlos Llamas (1): HID: uhid: convert to hid_safe_input_report() Cen Zhang (5): ocfs2/dlm: Protect the recovery list during debugfs reads keys: Avoid the owner account dereference in named keyring lookup keys: Check the authorization payload in process keyring searches keys: Protect the type name while describing a key keys: Protect the read method check against type removal Cen Zhang (Microsoft Security FORGE Labs) (1): tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) Cen Zhang (Microsoft) (1): watch_queue: Fix note pool publication race in watch_queue_set_size() Cezary Rojewski (1): ASoC: codecs: rt274: Fix format setting for 44100 rate Chandrashekar Devegowda (1): Bluetooth: btintel: fix buffer over-read in btintel_hw_error() Chao Yu (1): f2fs: embed f2fs_gc_kthread in f2fs_sb_info Charles Vosburgh (1): sctp: validate chunk length in the inqueue parser Chen Changcheng (1): HID: alps: unregister DualPoint Stick input device on remove Chen Cheng (1): dm-integrity: require stable writes for internal hash modes Chen Ni (1): usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() ChenXiaoSong (2): smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() smb/client: pass cifs_open_info_data to SMB2_open() Chengchang Tang (1): RDMA/hns: Fix WQ_MEM_RECLAIM warning Chengfeng Ye (7): KEYS: trusted: Fix TPM teardown ordering Bluetooth: RFCOMM: Fix initial port reference race Bluetooth: hci_core: Serialize ACL scheduling with channel deletion tipc: hold a reference to nodes found by link name net/smc: protect clcsock lifetime in smc_getname Bluetooth: hci_sock: Serialize dead-device detachment tipc: protect node reset trace dump with node lock Chris Mason (4): nfsd: release path refs on follow_down() error nfsd: size fh_verify server sockaddr slot by xpt_locallen SUNRPC: fix gssx_dec_option_array error path bugs SUNRPC: reject duplicate CREDS_VALUE options Christian Borntraeger (1): KVM: s390: Zero initialize data structures for inject_pfault_token Christian Brauner (15): fs: refuse fspick() on internal superblocks namespace: check a submount for references right before unmounting it dcache: don't put a mountpoint on a dentry that's being removed namespace: refuse an automount below a mount that is in no namespace namespace: don't inherit MNT_UMOUNT in clone_mnt() namespace: check the mounts before reading their parents in pivot_root() namespace: unhash a dentry before detaching the mounts on it namespace: don't copy an unmounted mount tree namespace: check the target before walking it in do_mount_setattr() fcntl: refuse F_SET_RW_HINT on an immutable inode namespace: handle mount locking for automounts correctly clone: add CLONE_AUTOREAP unicode: free the map after a grace period io-wq: order the exit bit against worker creation task work signal: don't retarget shared signals in a dying thread group Christian Göttsche (1): selinux: fix data race on AVC latest_notif Christophe JAILLET (2): kernel/params.c: Use kstrtobool() instead of strtobool() watchdog: rtd119x: Use devm_clk_get_enabled() helper Chuck Lever (1): nfsd: gate nfs2 setacl by argp->mask Clément Léger (1): of/irq: add missing of_node_put() for interrupt parent node Cong Nguyen (2): iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure iio: adc: max1363: sign-extend bipolar differential channel reads Daehyeon Ko (10): wifi: libipw: reject TKIP frames without a full MIC nvme-multipath: fix underflow in ANA log bounds checks thunderbolt: Reject oversized XDomain properties responses ipv4: stop PMTU walk when nexthop group shrinks ipv4: stop route notification sizing when nexthop group shrinks ipv4: do not warn on route notification size race ipv6: do not warn on route notification size race ip6_gre: remove obsolete ERSPAN PMTU update sctp: revalidate output stream after association connect wait vsock/virtio: validate packet source for connected sockets Dan Carpenter (2): cifs: fix underflow in parse_server_interfaces() HID: hid-steam: Fix cleanup in probe() Daniil Stas (1): hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur Dapeng Mi (1): perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities Dave Airlie (1): nouveau/gem: reserve the bo in the info ioctl around the vma lookup Dave Chinner (8): xfs: log items should have a xlog pointer, not a mount xfs: aborting inodes on shutdown may need buffer lock xfs: buffer pins need to hold a buffer reference xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock xfs: catch stale AGF/AGF metadata xfs: rearrange code in xfs_buf_item.c xfs: factor out stale buffer item completion xfs: fix unmount hang with unflushable inodes stuck in the AIL David Heidelberg (1): Input: s6sy761 - fix resume ordering and restore sensing David Rosca (1): drm/amdgpu: Fix VCE 3 ring align_mask Denis V. Lunev (1): openvswitch: fix soft lockup in the netlink flow dump Di Shen (1): OPP: Fix race between OPP addition and lookup Dibin Moolakadan Subrahmanian (1): drm/i915/dmc: Harden DMC firmware payload parsing Dmitry Torokhov (1): Input: exc3000 - properly stop timer on shutdown Donggeun Yoo (5): tracing: Set the trace clock before registering the histogram trigger tracing: Fix the shift out of bounds in the log2 histogram modifier tracing: Save the event file instead of the compatible histogram tracing: Unregister field variable histograms when the command fails tracing: Fix 64-bit and signed histogram fields on 32-bit kernels Doruk Tan Ozturk (2): HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind ocfs2: validate directory-index entry counts when reading metadata Dr. David Alan Gilbert (1): net: ena: Remove autopolling mode Duoming Zhou (1): watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger Eric Biggers (2): fsverity: add dependency on 64K or smaller pages crypto: drbg - Fix ineffective sanity check Eric Dumazet (5): ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() bnxt_en: fix DMA mapping length for padded small packets flow_dissector: avoid u16 truncation of skb->len when computing thoff flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() ipv6: use RCU in ip6_xmit() Etienne Perot (1): cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children Ezrak1e (1): dlm: validate length in dlm_search_rsb_tree Fan Wu (13): wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop power: supply: rt9455: quiesce delayed work before teardown mmc: via-sdmmc: cancel card-detect work on remove smb: client: fix cifsFileInfo reference leak in deferred close wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown usb: gadget: aspeed-vhub: cancel wake work on device removal usb: cdns3: fix use-after-free in cdns3_gadget_exit() serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() iio: light: gp2ap020a00f: drain irq_work after free_irq iio: trigger: cancel reenable_work before freeing trigger usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed tty: serial: max3100: shut down timer before freeing port drm/vc4: drain the hangcheck timer and works on V3D unbind Felix Fietkau (2): wifi: mac80211: set info->band for 802.3 encap offload frames netfilter: nf_tables: fix bidirectional offload regression Felix Gu (2): iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls Fernando Fernandez Mancera (1): net: openvswitch: validate transport header presence in set_ipv6_addr Florian Fainelli (1): net: systemport: Fix RUNT MIB counter register offset calculation Florian Schauer (1): page_pool: keep frag_offset aligned for odd-sized requests Florian Westphal (7): netfilter: ipset: do not update comments from kernel-side adds netfilter: nf_tables: avoid skb access on nf_stolen net: add and use skb_get_hash_net netfilter: nf_tables: fix crash when nf_trace is enabled netlink: remove netlink_broadcast_filtered netfilter: nf_tables: always walk all pending catchall elements netfilter: nf_tables: always increment set element count Francisco Beltrán Millalén (1): drm/amdgpu: reset VI ASIC on MacBookPro14,3 Frank Sorenson (8): smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() smb: client: fix potential OOB read in smb3_enum_snapshots() smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races smb: client: reject short Next offsets in parse_server_interfaces() cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() Fredrik Nyberg (1): net: usb: ax88179_178a: fix rx frame length for non-last packets Fuad Tabba (1): KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save Genjian Zhang (1): dm-ebs: fix incorrect device offset check in ebs_ctr() Gilberto Conde (1): net: usb: qmi_wwan: add Quectel EG120K-EA Greg Kroah-Hartman (1): Linux 5.15.224 Guanghui Yang (1): f2fs: fix dentry folio leak in find_in_level Guangshuo Li (7): media: saa7164: fix cleanup on resource allocation failure net: ena: fix MMIO read buffer leak on probe failure wifi: iwlegacy: 3945: free EEPROM data on remove drm/amdgpu: fix ACP MFD device leak on init failure mmc: cavium-octeon: destroy slot platform devices on remove mmc: cavium-thunderx: destroy slot platform devices on remove mmc: sdhci-sprd: disable runtime PM on remove Guo Xuenan (1): xfs: fix super block buf log item UAF during force shutdown Han Xu (1): mtd: spinand: Enable QE on all dies Heyang Tan (1): wifi: p54: validate firmware record lengths Hongjian Dai (1): i2c: at91: release DMA channels when probe defers Hongling Zeng (1): btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() Hugh Dickins (1): arm64: allow pte_offset_map() to fail Hui Peng (2): usb: core: clear both ep_in and ep_out for non-ep0 control endpoints sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute HyeongJun An (7): ASoC: wm8903: Move the DRC QR threshold to the register that holds it ASoC: cs42l56: Put the Limiter Cushion control on the limiter register ASoC: cs42l52: Fix the NG Type Switch bit ASoC: pcm3168a: Fix the DAC zero flag polarity bit ASoC: max98371: Fix the Speaker DHT Min Volume bits ASoC: wm8978: Fix the 128x oversampling switch bits ASoC: nau8822: Fix the 128x oversampling switch bits Hyunwoo Kim (2): apparmor: fix out-of-bounds write when null terminating a label vec KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots Ian Lin (2): USB: serial: option: add Compal EXM-G1x support USB: serial: option: add Compal EXC-T1 support Ido Schimmel (2): bridge: mcast: Fix use-after-free during router port configuration ipv4: udp: Create exceptions before socket matching Ilan Dudnik (1): ksmbd: fix heap out-of-bounds write in krb5_authenticate() Ilkka Lappeteläinen (1): net/packet: prevent TX_RING byte count overflow Ilya Maximets (2): net: openvswitch: conntrack: fix helper UAF due to extensions realloc openvswitch: vport: fix self-deadlock on release of tunnel ports Ilya Titov (1): pinctrl: sunxi: keep a shadow copy of the data register output latches Imre Kaloz (1): drm/radeon: Read the VRAM VBIOS signature with readb() Jamal Hadi Salim (4): net/sched: cls_api: reclaim an empty proto on the error path net/sched: fq_codel: match the no-drop threshold to the packet size net/sched: sch_codel: match the no-drop threshold to the packet size net/sched: em_text: reject unterminated algo before autoload Jameson Thies (1): usb: typec: ucsi: displayport: Current CAM OOB index fixup Jann Horn (1): futex: Fix mm reuse handling for FUT_OFF_MMSHARED Jason A. Donenfeld (1): wireguard: noise: reject response consumption after intermediate initiation Jeff Jo (1): tcp: refresh TS.Recent for accepted old ACKs Jeff Layton (3): nfsd: fix nfsd_file leak on inter-server COPY setup failure nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() nfsd: fix clock domain mismatch in clients_still_reclaiming() Jeffin Philip (1): usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() Jens Axboe (1): io_uring/rw: end write accounting from ->ki_complete Jeremy Kerr (1): mctp: Add refcounts to mctp_dev Jesse Zhang (1): drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr Jiacheng Yu (1): params: fix charp corruption on allocation failure Jiale Yao (1): iio: accel: kxcjk-1013: reject duplicate event disable Jiangshan Yi (2): smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend Jianing Li (1): power: supply: max17040: drop incorrect I2C functionality check Jiayuan Chen (1): tls: device: fix out-of-bounds write in tls_append_frag() Jiazi Liu (1): usb: dwc3: gadget: fix IRQ storm on invalid event buffer count Jie Deng (1): usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe Jinjiang Tu (1): mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish Jinseob Kim (1): iio: buffer: serialize buffer teardown with mode claims Jinu Kim (1): KVM: x86: Use active memslots for the per-vCPU MMIO cache Jiri Slaby (2): tty: reformat kernel-doc in tty_io.c tty: finish kernel-doc of tty_struct members Jiri Slaby (SUSE) (1): tty: introduce and use tty_port_tty_vhangup() helper Johan Hovold (15): USB: cdc-acm: fix racy TIOCMIWAIT implementation USB: serial: fix port tear down use-after-free tty: amiserial: fix broken TIOCMIWAIT USB: serial: quatech2: fix baud rate overflow USB: serial: ssu100: fix baud rate overflow USB: serial: fix dynamic id driver deregistration race tty: fix saved termios reset race tty: tty_port: restore TTY_IO_ERROR on activation failure tty: abort break signalling on hangup serial: fix TIOCMIWAIT race USB: serial: fix ioctl hangup race USB: serial: clean up core error labels USB: serial: fix driver deregistration order tty: port: fix tty_port_tty_vhangup() race tty: add break_wait kernel-doc Johannes Berg (1): Revert "wifi: libertas: reject short monitor TX frames" Jonas Köppeler (1): net_sched: codel: fix stale state for empty flows in fq_codel Jonathan Cameron (1): device property: Add cleanup.h based fwnode_handle_put() scope based cleanup. Josef Bacik (2): xen/netfront: drop RX packets with a short Ethernet header xen/netfront: don't leak the skb when xennet_fill_frags() fails Joseph Qi (1): ocfs2: validate dx_root extent list fields during block read Joshua Rogers (2): tty: vcc: zero-initialize control packet in vcc_send_ctl() tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup Julian Anastasov (3): ipvs: fix missing counter decrement in lblc ipvs: do not create invisible templates ipvs: filter some flags received in the backup server Julian Sun (1): nvmet: preserve device path on allocation failure Jun Yang (2): sctp: check RCV_SHUTDOWN after the sendmsg connect wait net: bridge: mcast: don't truncate the port group walk on teardown Jérémy Carrat (1): USB: serial: cp210x: add Corsair AX1500i Power Supply Jérémy Jean (3): audit: fix exe mark UAF in kill_rules() tipc: prevent GCM nonce reuse on peer key changes net/sched: fix use-after-free in __tcf_action_put() Karl Bonde Torp (1): nvme: fix swapped ZRASF zone state values for full and read only Karl Mehltretter (4): arm64: mm: Fix the lockless page-table walk in show_pte() mtd: core: call _get_device() with the master MTD serial: imx: serialize imx_uart_ports[] lifetime keys: finalize persistent keyring timeout after link attempt Keith Busch (1): nios2: fix __wsum type degradation in csum_fold() Konrad Dybcio (2): drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails Krzysztof Karas (2): drm/i915/gem: Prevent overstepping exec array boundary drm/i915/gt: Unmask interrupts only when ACTIVE is true Kuan-Wei Chiu (1): coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Kuniyuki Iwashima (2): hsr: Remove WARN_ONCE() in hsr_addr_is_self(). vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). Kyle Zeng (7): ALSA: seq: Serialize compat port-info ioctls netlink: reset skb headers before unicast and multicast filtering pipe: preserve existing fasync readers on writer setup failure netlink: avoid hashing the network namespace pointer fsnotify: prevent mark additions during connector teardown tracing: Reject incomplete event filter expressions keys: make keyring indexes independent of kernel addresses Laurence Oberman (2): scsi: st: Save the visited block for the partition the drive is in scsi: st: Fix use-after-free race between st_remove() and st_open() Lee Jones (1): tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields Leon Hwang (1): kprobes: Skip disarmed probes when checking optkprobe overlap Li RongQing (1): net/mlx5e: Order ICOSQ cc update after CQ doorbell Linfeng Sun (1): scsi: target: iscsi: Fix race in discovery auth updates Linmao Li (2): Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems Input: byd - synchronize timer deletion before freeing private data Linus Torvalds (1): security/keys: fix missed RCU read section on lookup Liu Chao (1): usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd Loic Poulain (1): i2c: qcom-cci: Fix HALT_ACK reset request being dropped Longlong Xia (1): zram: fix out-of-bounds access in read_block_state() Lorenzo Stoakes (ARM) (4): mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Lovekesh Solanki (3): Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 usb: hub: use shorter 120ms post resume hold for SS root hubs Luo Gengkun (1): perf: Fix race between perf_event_exit_task() and perf_pending_task() Ma Xinmeng (1): dm-snap: reject the transient exception store for snapshot-merge Maoyi Xie (1): rds_tcp: close NULL deref window in rds_tcp_set_callbacks Marc Harvey (2): net: team: Remove unused team_mode_op, port_enabled net: team: Rename port_disabled team mode op to port_tx_disabled Marcus Folkesson (1): HID: hid-alps: use default remove for hid device Marek Szyprowski (1): ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM Martino Papero (1): Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 Masami Hiramatsu (Google) (1): kprobes: Protect kprobe_blacklist with RCU Matthew Wilcox (Oracle) (1): fs: Free any excess xarray nodes in clear_inode() Maxim Skokov (1): Bluetooth: RFCOMM: free the skb when the DLC has no owner Maíra Canal (1): drm/vc4: Free the BO cache size list on teardown Mehmet Fide (2): mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages Michael Bommarito (1): ceph: bound copied dentry name length in NFS export get_name Michael Kelley (1): Drivers: hv: Don't reset VMBus connection state on error/exit paths Michal Luczaj (1): vsock: treat TCP_CLOSING as once-established Michele Dionisio (1): wifi: brcmfmac: fix P2P device removal race in brcmf_detach() Mika Westerberg (1): thunderbolt: Fix KASAN reported use-after-free when request is canceled Mikhail Gavrilov (2): Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks Mikulas Patocka (1): dm: fix reading free memory in do_resume Ming-Hung Tsai (1): dm cache: fix demotion stats in passthrough mode Mingming Cao (1): ibmveth: h_free logical LAN on open-fail after register Mingyu Wang (1): tty: vt: fix memory leak in vc_allocate() Miquel Raynal (2): mtd: Clean refcounting with MTD_PARTITIONED_MASTER mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters Mostafa Saleh (1): KVM: arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP Muhammad Bilal (2): staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() Myeonghun Pak (7): usb: storage: realtek_cr: fix use-after-free on disconnect bna: prevent IOC timer rearm during teardown usb: ohci-da8xx: disable controller wakeup on cleanup usb: ohci-s3c2410: disable controller wakeup on removal usb: ohci-st: disable controller wakeup on removal usb: ohci-spear: disable controller wakeup on removal drm/aspeed: Balance the display clock enable on teardown Namhyung Kim (1): perf tools: Fix a asan issue in parse_events_multi_pmu_add() Namjae Jeon (1): smb: client: use finish_no_open() for non-regular inodes Narasimharao Vadlamudi (1): media: rkvdec: Propagate platform_get_irq() errors Nguyen Ngoc Thang (3): ALSA: caiaq: unregister the input device when probe fails memstick: rtsx_usb_ms: complete requests after eject instead of dropping them drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN Nickolai Zeldovich (1): exit: fix lost-update race on the child_subreaper bitfields Nicolas Escande (1): wifi: ath11k: reset ar->num_stations on hardware start Niklas Schnelle (1): s390/pci: Fix leak of uninitialized kernel data in SCLP report Nikola Prica (1): PCI: Accept AtomicOps already enabled by the hypervisor Nilesh Javali (11): scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate scsi: qla2xxx: Quiesce response IRQ before freeing request queue scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature scsi: qla2xxx: Initialize NVMe abort_work once at submission scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort Nuno Sá (1): mtd: spinand: fix zero oobavail when no ECC engine is used Oleg Keri (1): drm/dp: don't mark the AUX backlight enabled when enabling failed Oliver Hartkopp (1): can: fix unique skb identifier regression under RPS Orgad Shaneh (1): usb: octeon-hcd: fix the FIFO-flush timeout computation Oscar Ou (1): lockd: fix swapped arguments in nlmsvc_match_ip() Pablo Neira Ayuso (3): netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST netfilter: nf_tables: release flowtable after rcu grace period on error netfilter: nf_tables: unconditionally bump set->nelems before insertion Palla Raghunath (2): dm ioctl: don't let data_start run past the buffer Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown Pannarat Wiriyaarritham (1): usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 Pauli Virtanen (2): Bluetooth: L2CAP: access chan->conn safely in get/setsockopt Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn Paulo Alcantara (3): smb: client: fix file type corruption in cifs_reparse_point_to_fattr() smb: client: fix smbd_connection leak on cifs_get_tcp_session() error smb: client: discard post-EOF pagecache when extending a file via zero range Pavankumar Kondeti (1): workqueue: Fix NULL current_pwq deref in chained work check Pei Xiao (1): mtd: block2mtd: Fix divide error when erase_size is zero Pengpeng Hou (1): iio: adc: aspeed: propagate reset deassert errors Peter Xu (1): mm/hugetlb: fix avoid_reserve to allow taking folio from subpool Prashanth K (1): usb: typec: ucsi: Get the connector fwnode based on reg value Qing Ming (1): gtp: serialize PDP context updates Quchaosheng (1): net/packet: guard the ll header push in packet_rcv_spkt() Radhey Shyam Pandey (1): usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() Raj Ojha (1): memstick: core: wait for request completion before freeing card Raphaël Larocque (1): Input: synaptics - limit T440p InterTouch quirk to LEN0036 Ridham Khurana (1): gpio: xilinx: fix runtime PM leak on request error path Runyu Xiao (4): rtc: spear: initialize IRQ state before requesting alarm IRQ mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ USB: dwc2: shut down wakeup timer before freeing HCD state scsi: qedi: Initialize callback state before registration Ruoyu Wang (2): i2c: mxs: fix DMA channel leak on probe error media: zoran: Avoid freeing a registered video_device twice Sabrina Dubroca (1): strparser: make sure __strp_recv isn't running before tearing down the parser Sai Teja Aluvala (1): Bluetooth: btintel: validate DDC record lengths Sajal Gupta (1): drm/gud: don't keep a connector without a CRTC as connector_state Salah Triki (3): iio: accel: sca3000: fix frequency divider condition check iio: proximity: isl29501: Fix return type of isl29501_register_write iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler Samuel Holland (1): pinctrl: sunxi: Refactor register/offset calculation Sang-Hoon Choi (4): Bluetooth: hci_core: free the HCI ID if naming fails gpio: exar: initialize the ID before registering its cleanup cxgb4/ch_ktls: disable softirqs around tid_list erases nvmet: use the local P2P device on metadata allocation failure Sanghyun Park (1): vxlan: use one headroom snapshot for neighbour replies Sasha Levin (2): samples: pidfd: fix userprogs typo tools: gpio: fix building from the top level with O= Sean Christopherson (1): KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted Sebastian Andrzej Siewior (1): ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() Sebastian Sjoholm (1): USB: serial: option: add Quectel RG660QB Sergey Senozhatsky (1): zram: fixup read_block_state() Shang XiaoJing (1): mtd: core: Fix refcount error in del_mtd_device() Shao-Fu Chen (1): optee: register TEE devices only once fully initialized Shawn Lin (3): pmdomain: rockchip: fix clock leak on domain probe failure pmdomain: rockchip: don't ignore clock lookup errors on attach pmdomain: rockchip: propagate subdomain add errors Simon Gassner (1): serial: tegra: don't clear the Tx FIFO on an Rx-only reset Simon Liebold (1): Revert "scsi: sd: sd_zbc: Use logical blocks as unit when querying zones" Srish Srinivasan (1): keys/trusted_keys: return immediately after TPM unseal failure Stefano Garzarella (1): KEYS: trusted: Fix blob allocation size in tpm2_key_decode() Stephen Smalley (1): selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts Steve French (2): smb3: make query_on_disk_id open context consistent and move to common code smb3: fix for slab out of bounds on mount to ksmbd Steven Rostedt (2): ftrace: Take trace_array reference before accessing its ftrace_ops ftrace: Synchronize the initialization of ftrace_ops Sung Byeongchan (1): autofs: ignore notification errors from a replaced pipe Syed Labeeq Sajid Bukhari (1): usb: storage: sierra_ms: reject short SWoC info transfers Tahera Fahimi (1): xfrm: prevent policy_hthresh.work from racing with netns teardown Takashi Iwai (2): ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices Tengda Wu (1): tracing: Fix hist trigger timestamps for buffered events Tetsuo Handa (1): perf/core: Fix WARN in perf_sigtrap() Thomas Gleixner (1): tick/broadcast: Plug clockevents replacement race Thomas Weißschuh (1): HID: core: remove #ifdef CONFIG_PM from hid_driver Thorsten Blum (1): net: ipconfig: Remove outdated comment and indent code block Tianchu Chen (1): wifi: cw1200: fix TX padding OOB read leaking heap data to device Tibor Harcsa (1): Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table Timur Kristóf (4): drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC drm/amd/pm/si: Fix updating clock limits on AC/DC drm/amd/display: Mark DCE 6.4 as not APU drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang Tomas Winkler (1): mtd: use refcount to prevent corruption Tristan Madani (2): nvme: add missing SRCU grace period in error path wifi: wcn36xx: fix heap overflow from oversized firmware HAL response Tzung-Bi Shih (1): watchdog: rtd119x: Avoid division by zero Usama Arif (1): mm/huge_memory: transfer the pmd dirty bit to the folio on zap Uwe Kleine-König (7): Bluetooth: btqcomsmd: Convert to platform remove callback returning void power: supply: rt9455: Convert to i2c's .probe_new() power: supply: max17040: Convert to i2c's .probe_new() wifi: wl12xx: Drop if with an always false condition wifi: wlcore: Convert to platform remove callback returning void serial: imx: Convert to platform remove callback returning void usb: gadget: at91_udc: Convert to platform remove callback returning void Varun Prakash (1): nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t() Vicki Pfau (5): HID: hid-steam: Make client_opened a counter HID: steam: Fully unregister controller when hidraw is opened HID: steam: Rearrange teardown sequence HID: steam: Refactor registration HID: steam: Clean up locking Victor Nogueira (1): net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode Vijendar Mukunda (1): drm/amdgpu: fix for coding style issues Viken Dadhaniya (2): tty: serial: qcom_geni_serial: Keep console RX functional after deep idle soc: qcom: geni-se: Correct QUP Core ICC vote constants Vishal Badole (1): EDAC/amd64: Mask UMC chip select to the four implemented selects Vivek BalachandharTN (1): staging: rtl8723bs: fix spacing around operators Wang Jianzheng (1): pinctrl: sunxi: Use devm_clk_get_enabled() helpers Weiming Shi (2): net: team: fix NULL pointer dereference in team_xmit during mode change net: team: stop reusing skb after queue override Wenjie Qi (1): f2fs: limit recovery filename logging to stored length Wentao Liang (7): drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() of/irq: Fix remaining refcount leaks in of_irq_init() kgdboc: Fix tty driver reference leak in configure_kgdboc() serial: vt8500: Fix clock reference leak in vt8500_serial_probe() wifi: wlcore: Fix runtime PM leak in wlcore_remove() btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() Willem de Bruijn (1): tcp: prevent collapsing skbs across boundary in rtx queue Willian Oliveira (1): drm/amdgpu/gfx6: fix firmware leak on teardown Xiang Mei (5): ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity vlan: require the MAC header to be present in __vlan_insert_inner_tag() ALSA: line6: reject oversized playback packets ALSA: ua101: reject mismatched capture/playback packet sizes net: bonding: fix use-after-free in bond_xmit_broadcast() Xin Long (1): openvswitch: add nf_ct_is_confirmed check before assigning the helper XingWang Xiang (1): genetlink: pin family module during policy dump Xu Rao (1): Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev Xu Yang (2): device property: fix infinite loop in fwnode_for_each_child_node() usb: typec: tcpm: fix debug accessory mode detection for sink ports Xuanqiang Luo (1): net/sched: act_api: release all action references on NEWACTION failure Xue Lei (1): mtd: fix double free and WARN_ON in add_mtd_device() error paths Xueqin Luo (1): power: supply: ds2780: Fix ds2780_get_capacity() returning raw value Yang Yang (1): openvswitch: defer tunnel netdev_put to RCU release Yehyeong Lee (4): nvme-tcp: fix host memory disclosure on R2T for a read command scsi: libiscsi: Reject a negative task index from parse_pdu_itt scsi: libiscsi: Validate the ITT reflected in a Reject PDU scsi: libiscsi: Validate the task named by a management response Yi Yang (1): vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF Yibo Tan (2): hwmon: (pwm-fan) Stop RPM timer before freeing tach data mmc: mtk-sd: Cancel request timeout work on remove Yu Kuai (1): md: move initialization and destruction of 'io_acct_set' to md.c Yuchao Zhang (1): usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC Yuho Choi (1): ALSA: virtio: reset device before deleting virtqueues Yun Zhou (1): xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf Yuqi Xu (4): net: ipconfig: bound DHCP option construction wifi: mac80211: minstrel_ht: validate fixed rate index wifi: mac80211: handle empty FILS association request payload tipc: destroy topsrv workqueues before closing connections Yuxiao Wang (1): nitro_enclaves: fix use-after-free on SLOT_ALLOC failure Zack Rusin (1): drm/vmwgfx: validate pitch coming from userspace Zev Weiss (1): mtd: core: clear out unregistered devices a bit more Zhang Changzhong (1): net/sched: cls_u32: skip hash tables in u32_bind_class() Zhao Dongdong (1): USB: serial: option: add support for SIMCom SIM8260C Zhao Li (6): wifi: cfg80211: preserve hidden-group beacon IE ownership wifi: mac80211: drain PS delivery work during station teardown wifi: mac80211: release mesh path quota on failed additions wifi: mac80211: shut down RX BA session timer on teardown wifi: mac80211: keep fallback association elements alive wifi: mac80211: account proxy paths against the mesh path limit Zhengchuan Liang (1): perf: Require kernel access for text poke events Zhiling Zou (4): net: bridge: use option bits for CFM/MRP frame handlers ipvs: bound LBLCR and LBLC cache growth wifi: mac80211: keep paired old chanctx alive wifi: mac80211: count only matching reservations in reserved switch Zihan Xi (6): ipmr: account multicast table and route memory smb: client: fix create context out-of-bounds reads smb: client: validate POSIX create context length smb: client: close handle after create-context parsing failure smb: client: close completed creates on compound wait errors ipv4: avoid divide by zero in fib_rebalance Zimeng Li (1): ASoC: qcom: lpass-cpu: use DAI table index for playback constraints Zixuan Chai (1): net: bridge: avoid recursive multicast port cleanup Zizhi Wo (1): vt: skip screen update for DEC alignment test on backgroup consoles 성병찬 (1): KEYS: Fix add_key() race with keyring restriction