From patchwork Thu Oct 29 03:44:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bruce Ashfield X-Patchwork-Id: 102305 Received: from mail-qt1-f178.google.com (mail-qt1-f178.google.com [209.85.160.178]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4566.1793245510043105161 for ; Wed, 28 Oct 2026 20:45:10 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=qsA4mrRb; spf=pass (domain: gmail.com, ip: 209.85.160.178, mailfrom: bruce.ashfield@gmail.com) Received: by mail-qt1-f178.google.com with SMTP id d75a77b69052e-53394bffe0fso3315481cf.1 for ; Wed, 28 Oct 2026 20:45:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793245509; x=1793850309; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=7l1j5rr7A4ch0y9Ofg+8zcnVm1Y1bFL36IVd2G2/rts=; b=qsA4mrRbRdE7fqeEFkPpiD8VhpSK6VI6ZUyyF2ZWvSb0+Z0laYlWQRWZe3oiedoFtW AXZKky+tLV5bLgDUlpDcBp7GYlZDyms9Jno6+qweRmGt1NJvYmcT/UEGtLYA4WRzL2hq mYrudf9iTc6dzH/Yrfjt2pW0vV81uLLwbyvNOHxsiw3+dVCfNLSFBj1MsNodN+lRiikL dFx5cX5osEEFq1LlhkmnopXArim1YNLo9dUiQSuKdWMqfRuPSlaNYQ1tsOGYUDbQdUzk Buad+aVcF3maPix2nVXeedvc0KZWqV+Bc969XOzhH86XN4ZYKxDkPfDhiNSVucfbCF7k bEeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793245509; x=1793850309; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=7l1j5rr7A4ch0y9Ofg+8zcnVm1Y1bFL36IVd2G2/rts=; b=YgoQFqN/4mOzLWPrs98XF/2m+RCIMIFcvyIbXtdXfFZB2gzYlzSCx93h70S0g9HyFZ Ux2woh3M0xqj7CKJKRRjhdYB1hYrtflKvDISwjmeCefHLlXBOQLw44zxf06+Hl6Rihe2 /U6vBjFl7vaes4G9TP1VlBOaH9QvIeJ5ogn1rxAwFiYND1TQ4VfnQ9T06tvSEz9nGH+H mFQoHDzMUYX5Raa1ArJJ/jZ7uIJu4oohE94njNiv0jgnTImz89tVFH9xGOtJCq31JYRg thDpoaE18XZqYDkoZUv4wDMYCv0ZJvSeThSauq5TUNUoPL1a/21m13qfLBJzeLA3H4kA xIwg== X-Gm-Message-State: AFq9FYKV276LVarO2IThITxeBAfkOxzHZTJTdRhqwr3KVIcFjebwznRT //+hDdcsNM7k5c7zeXaTcGGAhbrIVwHhGs64HASgfOdPmGZ8RmLiuCASx5BWLMMq X-Gm-Gg: AYBFou095mJm3Uxzz15eEtNW3R88xwvFQe6zjnmHbg8aBk1Jaff6tp8vXT+2hP/UQ33 7awHIiNHTeAVqQSgIc8GLHrjnHNq8sVAZpZ1f/JzhHj5Guyk+R8DSqMsfqUmrXVL9O1qSocWKqb O3NMehaN+nF0F9sDul6fDvQdIe8XKazFmpo7knlzvaKZFmyH90+Pp/AN2KyCubjvo2UkItS2iWG z9vJb8z0cC7KCpNvtQ+pqSW9yioiq0QJo3jtzGpmp4FvXXXS8brCx0tuSE91WZUQ67adO+1qG5z kLiZeaChvwTUlI8ns3hdowoEzVfXeZmzPJQekyRJ+l8NqLAa6yu1S6+cJHCZ2SRW4GpDjBVqAFd 7CA0jDtbuI07SIyHP1DWsNIPId5vjHe41zlk5fZtiUPiUGpFFkOgBFniOxdXC3emkV5du0a46+u ywWQoS9F34Sr/a/kLFDtaSSV+xCydRcwEJ5Mz5SQg8Lgc4a/02sjcax+CCPKynHZfKoNNyWno7J jcTC8CJWUCdxWlLv4blBOVSvPgMGmltrNLbc+gC87R7deRYq6TSAAaIOl8s3A3IFTzHHIQDMKV/ DFzUCC8H7MiykYs2q9VsAiSa6uTDK1hp6I8DTBT4hp40priNjaGK5QeMGez5057v0sd3iwUfB5w DoRMW+egFKd8SPR6VToLaLkswOak4lCT2iz0u+8kYHrWNWMnl/DY72zCA4OzTm5CXpZl0u3k2cW /li06Sb1fq6eu7YUSJpb21uzYT+qxGHEY6NrlUhPfGkHIChw== X-Received: by 2002:a05:622a:4292:b0:535:f9dd:a3c9 with SMTP id d75a77b69052e-5411d8434camr21631911cf.6.1793245508191; Wed, 28 Oct 2026 20:45:08 -0700 (PDT) Return-Path: Received: from bruce-XPS-8940.localdomain (pool-174-112-35-248.cpe.net.cable.rogers.com. [174.112.35.248]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91c47c16569sm147542096d6.18.2026.10.28.20.45.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 20:45:06 -0700 (PDT) From: bruce.ashfield@gmail.com To: openembedded-core@lists.openembedded.org Subject: [meta][scarthgap][PATCH 01/07] linux-yocto/6.6: update to v6.6.156 Date: Wed, 28 Oct 2026 23:44:57 -0400 Message-ID: <20261029034503.3153661-2-bruce.ashfield@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261029034503.3153661-1-bruce.ashfield@gmail.com> References: <20261029034503.3153661-1-bruce.ashfield@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 03:45:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248877 From: Bruce Ashfield Updating linux-yocto/6.6 to the latest korg -stable release that comprises the following commits: 8b73de7da85fd Linux 6.6.156 65879e0a452ca usb: usbfs: fix use-after-free of usb_device in usbdev_release() 62cd519ab74ca USB: c67x00: fix use-after-free in c67x00_add_iso_urb() 8e987c4daf4f4 USB: serial: spcp8x5: drop broken carrier detect support 030e3a73d3c3a USB: serial: option: fix slab OOB read in interrupt URB callback f1c05c41d07b8 ALSA: usb-audio: Complete cleanup after system-resume errors 94e4562fcc81b ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() 656bd0ccb9006 usb: core: Strengthen error handling in hub_hub_status() 04ab260407972 usb: core: Add lock to usb_wakeup_notification() 087c19cc60a8c KVM: s390: vsie: zero stale crypto bits fb8110b748b20 crypto: qce - Remove unsafe/deprecated algorithms 1537bd55b4f84 crypto: mxs-dcp - fix source scatterlist length access cc56d2b0d77cf crypto: qce - fix CCM AAD buffer underallocation 4d35a92dd3da5 crypto: atmel-tdes - use scatterlist length before DMA mapping da45847766b52 mm/swap: reject swapon() on filesystem-level encrypted files f52f1e75716d2 ipv6: seg6: clear IPv4 control block on IPIP decapsulation 7c54fd8cfbcf3 net: bridge: mcast: fix use-after-free of a master VLAN's multicast context c8837bbe79225 xfrm: fix xfrm_state_construct() auth-trunc leak f00df8500e5a3 xfrm: ah6: validate routing header segments_left 2dd1609cadff4 xfrm: drop ESP-in-TCP packets with no ingress device ff8dd7a932f34 xfrm: espintcp: fix UAF during close a622167351020 x86/CPU/AMD: Carve out a Zen5 models range 7287cc1211312 x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range fa05e559102ec x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range ed9cf952fdec3 x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5 5953e7a89966f x86/CPU/AMD: Add X86_FEATURE_ZEN5 a832d7cb09da2 tls: device: fix out-of-bounds write in tls_append_frag() ad6f0375d2e93 usb: gadget: f_tcm: keep port count until LUN teardown completes f95e57b66195c usb: usbtest: disable dynamic ID support dcf30a56624c2 fuse: fix invalidate lock leak on open O_TRUNC DAX failure 92588d187ba46 fuse: fix invalidate lock leak on setattr writeback failure c36e7e4eb83e9 xhci: dbgtty: Fix unregister on tty_alloc_driver() failure eaca2814f32b9 xhci: dbgtty: Fix unregister on tty_register_driver() failure d27599347b691 usb: xhci: Handle USB3 port events when there is one roothub daba8d1cd995c accessibility: speakup: unregister tty ldisc on later init failures ba537c32de311 fpga: dfl: fme: add error handling 95f90c6029cae xfs: remove file_path tracepoint data b5181516a9f5c Bluetooth: hci_sync: Fix accept list UAF during suspend b95bc136fe541 Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() 2e0471bf3ab2a HID: pidff: fix OOB write when hid->inputs is empty e9f2ce45b311d HID: pidff: clang-format pass 1acff0590a447 HID: pidff: Support device error response from PID_BLOCK_LOAD 9d77ac82e57ea HID: uclogic: fix use-after-free of inrange_timer on remove 460514d46e889 HID: ft260: fix stack-use-after-return write in I2C read race 3a32b93cff2a3 HID: ft260: validate i2c input report length c023443f0e6cf HID: nintendo: stop device IO before hid_hw_stop on probe failure 25ad03d5c0e85 nvmet-tcp: bound SGL data length before allocating command buffers e4f43b3d85885 nvme: rename CDR/MORE/DNR to NVME_STATUS_* cb8b78b34593b nvme: fix status magic numbers 59d4c2352e823 nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err d16df755b4493 HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() 250cea475827f HID: magicmouse: re-enable multitouch after reset-resume e25b44bd8b8cc nfc: nci: add data_len bound checks to activation parameter extractors a5e776e293758 nilfs2: reject invalid block index in GC ioctl df75b4d1656b5 nilfs2: correct return value kernel-doc descriptions for ioctl functions 267a15c4f994d ext4: propagate errors from fast commit range replay 0b34ea0dc2bb6 ext4: make some fast commit functions reuse extents path e971a37c68cb5 ext4: make state in ext4_mb_mark_bb to be bool 4241e3b406c80 ksmbd: harden file lifetime during session teardown bfd861dadd3a4 crypto: starfive - Do not free stack buffer b300312562fd6 powerpc/hv-gpci: fix preempt count leak in sysfs show paths 2df9641e4b622 net/sched: initialize noop_qdisc owner 524323f52cbfb net/sched: Fix mirred deadlock on device recursion 4f15e7704c335 selinux: switch two allocations to use kzalloc_objs() 9a4d8e559c3c9 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). a698d43ce95b7 ASoC: nau8821: Cancel pending work before suspend b671ba32c5638 Revert "PM: sleep: Use complete() in device_pm_sleep_init()" 66dedb6028c3d riscv: Fix register corruption from uninitialized cregs on error 5662dac41a344 bpf: Fix use-after-free in offloaded map/prog info fill 36fb28fa033f6 ASoC: nau8821: Cancel delayed work on component remove 4f5f52a584293 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). 80d1fd39f4e37 smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). 7b854e68365a8 KVM: arm64: Prevent access to vCPU events before init 302dbed4760bc smc: Fix use-after-free in __pnet_find_base_ndev(). 53ca5b78b69d3 can: j1939: make j1939_sk_bind() fail if device is no longer registered fd8c807f8d5f1 can: j1939: add missing calls in NETDEV_UNREGISTER notification handler 76957b618ce72 can: j1939: implement NETDEV_UNREGISTER notification handler 75194165e6501 mISDN: hfcpci: Fix warning when deleting uninitialized timer 71209954f1e8f media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() ac65f76db9b2f exfat: fix double free in delayed_free a39f811a9f5ed jfs: Fix null-ptr-deref in jfs_ioc_trim 9bc078818ec76 ibmvnic: Use kernel helpers for hex dumps 47a99881ecc50 jfs: add check read-only before txBeginAnon() call 41da1715cd24e jfs: add check read-only before truncation in jfs_truncate_nolock() e217492f6fa22 bpf: Remove tst_run from lwt_seg6local_prog_ops. ce12e1170c0c7 perf: Reject exited events as group leaders c1164f14c6366 bpf: Ensure reg is PTR_TO_STACK in process_iter_arg ff3f428df00bc Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal" eb1e94fee5e27 io_uring/io-wq: fix worker accounting when canceling creation callbacks a13f61ba9b2a7 ext4: don't enable DAX on new encrypted files 429b6f43b4d8c KVM: x86/mmu: Check write tracking in all address spaces f5e6580a3a16a RDMA/rxe: Fix OOB in free_rd_atomic_resources() a4a971135a2ff Linux 6.6.155 3edf721bb4b99 inet: frags: strip GSO state from fragments before reassembly 93e0c9521fa8e Linux 6.6.154 e907bf694ed55 net: gro: properly validate BIG TCP aggregation criteria 26741d178f319 Bluetooth: hci_event: validate LE Set CIG Parameters response 0628cc9b2fa29 Bluetooth: hci_event: fix LE list UAF on reset 334271d3812ab HID: hyperv: validate initial device info bounds 2ce90cfc6646a HID: sensor: custom: Fix use-after-free in enable_sensor abec577de5fc1 HID: core: fix number/pointer type confusion on long items bd397c4123a4b HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() bb32e9a6a9a9f mptcp: pm: fix memory leak from alloc-during-teardown race a5321b00b98ec Input: atkbd - skip deactivate for HONOR ZQC-P 346f0edba1d49 Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard c4cec575a6d6f Bluetooth: hci_sync: Fix advertising data UAFs f0ab9a71167ba xfrm: fix sk_dst_cache double-free in xfrm_user_policy() c1d9c16af51cc HID: core: fix OOB read of field->usage in hid_set_field() 9b3469d162e3a HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID 3d7a7bac4c75f HID: magicmouse: do not keep a stale msc->input if no input is claimed 514a814c74277 HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C 13aa13ce3d653 mptcp: pm: fix data race in add_addr timer callback 48b76879f5bfc ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses 4931c09d83877 ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout 74ec9c120e900 ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err() 5f291adb281ea ASoC: SOF: pcm: Move period/buffer configuration print after platform open 93c9bee226152 ASoC: SOF: Relocate and rework functionality for PCM stream freeing 925cb11b60c14 ASoC: sof: pcm: use snd_pcm_direction_name() 86cc450022473 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations d094582cce9c0 nvmet-fc: fix invalid free in LS IOD error path 8f6363c8d54dd nvmet-auth: zero the AUTH_RECEIVE response buffer 087ee0d914aaa ipv6: fix use-after-free in ip6_finish_output2() b0ea911453ce7 ipv4: reject undersized MTUs in ip_do_fragment() eab3eeb68bfc6 libceph: fix OOB read in decode_watchers() via missing bounds check 28d984a66b9e1 Input: byd - synchronize timer deletion before freeing private data 3a398e09a6c15 ndisc: ndisc_send_redirect() cleanup 790576dc7ccc4 nfc: nci: free destination parameters when closing a connection 7489f59d1ea2d nfc: nci: fix uninit-value in the RF discover/activated NTF handlers 24761d3a5f692 nfc: nci: fix out-of-bounds write in nci_target_auto_activated() 9635507fe8294 nfc: st21nfca: validate ATR_REQ length against the received frame 4a52ec2457ff8 nfc: pn533: purge fragmented skbs during cleanup 3793d768b40f3 nfc: llcp: reject PDUs shorter than the LLCP header a209334ed9299 nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers 1964addc8dd53 nfc: llcp: bound the connect_sn TLV walk to the skb 18f02354ed229 nfc: microread: validate target discovery payload lengths fc3c2bd5b1ec6 nfc: fdp: bound the device-reported read length and fix an skb leak d0756a98277e3 nfc: digital: clamp SENSF_RES length to the destination buffer 77693fb8aec30 drm/amdgpu: check ASPM on the dGPU host link b287812f88a1c drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix 874d1bdda79bc drm/amd/display: Fix BT2020 YCbCr limited/full range input 3227cd5116751 drm/amd/amdgpu: disable ASPM in some situations a3d60ae24183e s390/vfio_ccw: Implement a crw lock f0d189d95eee0 s390/vfio_ccw: Calculate idal length based on idaw type 460b977a4e71c s390/vfio_ccw: Ensure first IDAW remains constant 152fcb74a2680 s390/vfio_ccw: Free all memory if cp_init() fails b6505a4cea45d gpio: ml-ioh: use raw_spinlock_t for the register lock e99120b5944a1 xfs: validate attr entry pointer before field access 46116f574be32 ext4: clear error before retrying inode xattr space fallback a40c45268f435 ext4: stop retrying saturated xattr cache entries a2fb8222cde23 kcov: fix data corruption and race conditions on PREEMPT_RT 075e52fd6d86c null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows 6a009f1e61b11 ocfs2: fix missing metadata reservation for large xattrs b20eb7ecbdaa3 ALSA: dummy: Check card index validity at probe b7528b42813f0 xfs: bounds-check buffer log item's dirty bitmap 2eca18dd026b2 xfs: don't use a xfs_log_iovec for ri_buf in log recovery d3ffb89b29446 inet: frags: publish queues before arming timer bb7488c797d0f inet: frags: save a pair of atomic operations in reassembly 32fa602b5dd6a inet: frags: change inet_frag_kill() to defer refcount updates c69b3593aa735 ipv4: frags: remove ipq_put() 4d40d900ffb2d inet: frags: add inet_frag_putn() helper 4a8887dd3a8a9 serial: sc16is7xx: enable THRI before filling TX FIFO 811b44be278b2 serial: sc16is7xx: use guards for simple mutex locks a289a78f13ab0 serial: sc16is7xx: rename EFR mutex with generic name 7047aa394d6ce serial: sc16is7xx: convert bitmask definitions to use BIT() macro 969e3867ef67e serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants 1606abb7ce8c0 serial: qcom-geni: fix TX DMA buffer flush 80c6054a4c40a perf/core: Fix group leader use-after-free after sibling detach c4ab0d6888022 perf: Unify perf_event_free_task() / perf_event_exit_task_context() c8c8e895f65fb serial: amba-pl011: synchronize DMA teardown fcaf8ba7e56bb NTB: ntb_netdev: Preserve RX queue depth on allocation failure 10a6b99079697 rndis_host: add overflow check in rndis_rx_fixup() 362726c9c6e56 Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept 8d08713ec83a1 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems dc6160265ffc7 Linux 6.6.153 22709117d9ae9 ring-buffer: Use current_context for safe per-CPU buffer swap cf0bc75d1ca9d ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() 171f95d662863 net: harmonize tstats and dstats 2fdf8b07bee5e binfmt_misc: use exe_file_deny_write_access() for the interpreter clone 1fc9f6d2c7c9f net/x25: fix use-after-free of the socket by its timers 74365aef5bf22 erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms ec5a552f4b2d8 net/sched: cls_bpf: reject dev-bound programs bound to a different device 551688b410d3f net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG f60c71deb17ea m68k: Define NR_CPUS to 1 2930f1b49133e m68k: use the coherent DMA code for coldfire without data cache 5904c758e0e95 dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol 19d114b93c94b net/sched: cls_u32: skip hash tables in u32_bind_class() 91d55fd1fdb85 net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain a857e3408be07 net: sched: Add initial TC error skb drop reasons d54e7ec851664 net: sched: Move drop_reason to struct tc_skb_cb 14f679a8d2ddc packet: add a generic drop reason for receive b72e44dc038f2 net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config 69c66cf557906 net, sched: Add tcf_set_drop_reason for {__,}tcf_classify 5599966042e05 net, sched: Make tc-related drop reason more flexible 1fc70b3d513ba af_packet: Don't send zero-byte data in tpacket_snd(). b4ef887bee4d3 ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers 06c2a53604fa1 net/tls: Fail tls_sw_splice_read() after a failed async decrypt e451e20adb869 net: packet: fix wrong transport_header when sending VLAN-tagged frame 28afc87bd8da0 macvlan: inherit needed_headroom and needed_tailroom from lowerdev f3c17ff65f547 ipvlan: inherit needed_headroom and needed_tailroom from phy_dev ccc33e1b2edb4 netfilter: ipset: let destroy callbacks adjust ext mem size eada630d0ae3e netfilter: ipset: fix list type element drift bug d37917e7bebe0 netfilter: flowtable: publish GC-visible tuple last 17c132e18ca5d netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path b891e7a6bb06e netfilter: ipset: fix refcount race between list:set GC and swap 9f4a626420c71 crypto: ccm - Set rfc4309 maxauthsize from child 4f1dde17b1222 arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 f3a874a903053 mm/huge_memory: fix huge_zero_pfn race 28afde1edbd8b KVM: SVM: Serialize accesses to the owner and mirror list with separate lock 76df4edf7d61e mm/ptdump: always stabilise against page table freeing using init_mm 8d7f560f4b048 mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF 56a45fdbe5b25 mm/pagewalk: split walk_page_range_novma() into kernel/user parts 898a44d811cf0 drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini 9efc767335234 drm/amd/pm: fix pptable use-after-free 50cfece0b1c02 drm/amd/pm: fix torn gpu metrics reads 584a5d96b6ebf can: rcar_canfd: change the initializing flow for clocks and resets 441e9c33284c1 i2c: iproc: reset bus after timeout if START_BUSY is stuck b95dd3225eea5 i2c: bcm-iproc: remove printout on handled timeouts bb01c51950c3f vxlan: use pskb_network_may_pull() for transmit path header pulls 1db9041e91ac5 vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS. 72496cf871aa2 vrf: Make pcpu_dstats update functions available to other modules. 7806ff0e8a4d9 net: core,vrf: Change pcpu_dstat fields to u64_stats_t 73e7998c3361c vxlan: Do not alloc tstats manually bbd63ba7961c6 ice: fix VF interrupts cleanup dd9ba32169e73 binfmt_misc: restore write access when removing an entry bf5ed2ef5cdb7 fs: don't block write during exec on pre-content watched files 04958dba44dc7 veth: convert frag_list skbs before running XDP 577443530cb59 net: pktgen: fix proc entry use-after-free b0a3d6d582ec2 net: pktgen: fix code style (WARNING: Block comments) 81e21cb7bd147 ksmbd: reject repeated SMB2 NEGOTIATE requests 5964d1f35402f ksmbd: conn lock to serialize smb2 negotiate a0f16c3376918 igc: remove napi_synchronize() in igc_down() 1f389ecd0c35e ASoC: tas2562: Validate values for volume writes 5b948706f11a9 mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE 94a15b8a8f5a9 btrfs: zoned: fix missing chunk metadata reservation 2c3bd3b6ba701 btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() 76f70daebe757 btrfs: add space_info argument to btrfs_chunk_alloc() 17fe8f41c8c21 btrfs: add debug build only WARN 8b0a3a094f4ca tcp: challenge ACK for non-exact RST in SYN-RECEIVED 6eb6b1d172659 tcp: fast path functions later 6ad63d36f6c5f tcp: Pass flags to __tcp_send_ack d8e5c5672724b ksmbd: validate minimum PDU size for transform requests b9e4b3b9aadbb smb/server: fix minimum SMB2 PDU size ecb45f5c8b0db smb/server: fix minimum SMB1 PDU size 618af5277dcb5 ksmbd: rename smb2_get_msg to smb_get_msg 45e3e87561b4a smb/server: rename include guard in smb_common.h 7964b9ab3baf9 smb: move get_rfc1002_len() to common/smbglob.h bc73642ccd637 smb: move smb_version_values to common/smbglob.h 05536cad35f27 super: fix emergency thaw deadlock on frozen block devices 4131dd0b6f67a net/sched: serialize qdisc_rtab_list against concurrent get/put db3e82da616f5 net: gro: fix double aggregation of flush-marked skbs 2cb6c8b12bda5 net: move skb_gro_receive_list from udp to core 02430f6f729b2 libceph: fix two unsafe bare decodes in decode_lockers() d974b4b786214 userfaultfd: prevent registration of special VMAs d97b01e78ce31 userfaultfd: move vma_can_userfault out of line 896e8884fc2cc mm: userfaultfd: add pgtable_supports_uffd_wp() 48829622212f6 iomap: fix out-of-bounds bitmap_set() with zero-length range 7439dc31f6781 iomap: hold state_lock over call to ifs_set_range_uptodate() a155aa7a52c6f ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP 42bc06c67d94d libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE 7cd7b483893b6 libceph: Amend checking to fix `make W=1` build breakage 34bb4c61948da ceph: Use a folio in ceph_page_mkwrite() e05c315b4da0c ceph: fix hanging __ceph_get_caps() with stale mds_wanted 78af6441b8966 ceph: Remove ceph_writepage() c8a21660c3b90 ceph: avoid fs reclaim while using current->journal_info dbb90d8b21b94 RISC-V: Provide pgtable_l5_enabled on rv32 48552988925d9 xfs: check v5 superblock features early 5b756fbb60b5d xfs: don't swallow dquot recovery verification errors ed8bfb43de712 xfs: fix ilock leak on error in xfs_dq_get_next_id 472cfa4ba2433 xfs: only check mergeability of bnobt records 070229262ede3 drm/amdgpu: disallow multiple FENCE chunks in one submit 60539d517e843 drm/amdgpu: Fix UVD decode image min size calculation fa96c24485942 drm/amdgpu: Fix UVD dpb min size calculation for H264 7cff5d7870a11 drm/amdgpu: Fix UVD min buffer sizes f0f5048d58dec drm/amdgpu: Implement insert_end for VCE 3 8435d41afcf2b drm/amdgpu: Reject UVD message with dimensions above 4096 ce5da474c3ddf drm/amdgpu: validate GEM_CREATE domain combinations a930c54cb6720 drm/amdgpu: Reject UVD message with invalid number of h265 refs f72a51810d494 s390/vfio_ccw: Selectively expand io_mutex f98a9890ca42f s390/vfio_ccw: Move cp cleanup out of not operational af3f80ca4c8b1 s390/vfio_ccw: Fix out of bounds check on CCW array 79ea5e0c4c8a9 s390/vfio_ccw: Ensure index for read/write regions are within range e868ea8be0bc8 s390/vfio_ccw: Cancel existing workqueues 15fb4559a7fdf s390/vfio_ccw: Limit the number of channel program segments 2acbeace14672 drm/radeon: fix autosuspend cleanup during teardown 38d60f808b341 mmc: sdhci: make tuning_err a signed int fc90985bd5d7e mmc: sdhci: unmap the bounce buffer before device release 2d481fc84b589 mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit 762be85fadd97 libceph: tolerate addrvecs with multiple entries of the same type 54aff77ed44ac ceph: fix MDS random selection readiness predicate e2ffeec85201b libceph: Avoid using invalid osd indices from primary_temp 28d9cd72827be Input: sur40 - fix V4L error path cleanup 3e8ed76a4f357 Input: sur40 - fix input device registration ordering b4d73c3848bae openrisc: signal: do not restore privileged SR bits on sigreturn 82f4f07f3f040 ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() 8c6ee5351b264 ftrace: Protect direct_functions in ftrace_find_rec_direct fa4aa86fff0c5 libceph: fix multiple unsafe decodes in decode_locker() de52c713d2180 crypto: qce - fix error path in devm_qce_register_algs ec61ca4e31066 Input: hynitron_cstxxx - validate touch count and finger IDs 2b0403fb7e28f Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue 1d718f1461766 Input: synaptics-rmi4 - block s_input when F54 queue is busy 12be3c6ca9589 Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer 77749685e55da Input: synaptics-rmi4 - zero report size on F54 work error 8e3e0f23f8fd4 powerpc/pseries: lparcfg - fix kbuf[] underflow 5232529eaf57f Input: iforce - validate input packet lengths 9094997f073e9 Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard da6b8b05db0cf Input: psxpad-spi - set driver data before use 81b07470cb293 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet 0739c65e799d4 Input: synaptics-rmi4 - fix F55 transmitter electrode count typo e19b45d5e031a powerpc/pseries: pci - logic bug 142346822c700 Input: xpad - add support for ZENAIM LEVERLESS e5cb281913621 drm/amdgpu: fix aperture iounmap skipped on device removal 42bc07b4e5a3c fbdev: core: Fix pointer desynchronization in fb_io_read() 891129df5de79 ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses ad8b255006580 ASoC: cs35l41: sort the register default table 673348de84471 ASoC: cs35l45: sort the register default table c18fe394ddcce ASoC: cs4265: sort the register default table b270ed3273804 ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() cc423f4105fe1 s390/qeth: validate user buffer length in SNMP and ARP query ioctls f75f174edc865 mptcp: fastopen: only mark MPTFO subflows with SYN data 26dac5c9ffb20 mptcp: options: reset DSS fields in case of unexpected size dc1d8d3eb345c mptcp: avoid combining some incoming suboptions 6e46970fc0001 selftests: mptcp: join: mark tests with data corruption as failed e0285bb152211 selinux: reject an unclaimed class value in security_get_classes() 1acc317d67a75 selinux: do not cancel a policy conversion that never started 2b7ffd7921fcb selinux: reject a class permission count below its inherited common 3161daa3f1e3c selinux: require every boolean value to be defined 6515053335d9f net: mana: Fix EQ leak in mana_remove on NULL port 3e9d5f325e9ce ipvs: separate destination availability state 68e094232dfe5 f2fs: fix UAF issue in f2fs_merge_page_bio() 6f06dbe5012c1 block: stop the timeout timer when releasing a never added disk c610b395b0a51 Linux 6.6.152 1a9e400a19df4 regulator: devres: fix devm_regulator_get_enable_read_voltage() return 2ee4194be09fc net/tcp_sigpool: Use kref_get_unless_zero() 0490d0b862ed5 net/tcp_sigpool: Fix some off by one bugs 7a6a6d2a12786 bpf: tcp: fix double sock release on batch realloc 50f0c8dd8c339 thunderbolt: Bound the DROM dual link port number before indexing sw->ports 31efa656cf6af sctp: clear new_transport when removing a peer dc67d528c2fa9 sctp: fix use-after-free of cached ASCONF chunk 1adf929121e13 sctp: keep chunk->transport in step with the list it is queued on ed935348a9a96 scsi: scsi_debug: Negate wrapped memcmp() result d192cff2a37d5 bpf, sockmap: Fix sk_redir use-after-free in send verdict 310b5a537a78c sched/psi: Shut down rtpoll_timer in psi_cgroup_free() 33b7e810ce099 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() 64e41736a26f3 ip6_tunnel: clear skb2->cb[] in ip6ip6_err() 0b9e02f3bd31c ipv6: fix Route Information option length validation 3d965811be784 ptp: ocp: Fix board ID over-read 999e573212d5f Revert "thermal/drivers/hwmon: Cleanup coding style a bit" b77581b25e213 eventfs: Fix use-after-free in eventfs_remove_rec() f33ecb89d3523 KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page c292d4686f717 smb: client: Fix use-after-free in cifs_try_adding_channels() 47ba70891b10b tipc: read le->link under the node lock in tipc_node_link_down() aa8b14647721b tls: don't leave a full plaintext sk_msg ring unpushed cf363a7a02ce1 vhost: reset the vring metadata cache on vring reconfiguration 2f2a7f3f8b9f1 veth: fix skb length accounting after XDP frag adjustment 9d80a04129a6c vsock/virtio: avoid refilling the RX queue after teardown a1fb0c5b8a7c2 vsock/virtio: read virtqueues under worker locks 619dd29045e43 vxlan: do not arm the ageing timer on a device that is down ba13763d667e0 xdp: reject clones that overrun skb_shared_info tailroom 7380f1bfe9d7e Revert "drm/amdgpu: fix aperture mapping leak" 513478092966d ovl: don't warn when the mount is completed from another user namespace 6bcb8839aa2d6 net/sched: act_gact, act_police: range check the fallback control action 737873a59905a net/sched: act_ct: fix sk_buff leak when the header checks reject a packet ff451bc4290b7 net: atlantic: free RX pages of consumed but not refilled buffers 7a3e1481f4ee6 net: atlantic: free stranded TX buffers on ring deinit 63853eb20bba4 netfilter: nf_conntrack: defer invalid log until after unlock 6ea88401e10e0 netfilter: bridge: release template ct on non-IP path cc5bd568f9b76 ipv6: prevent in6_dev_get() from resurrecting inet6_dev af02c67ce6543 net: smc: fix splice entry lifetime imbalance in smc_rx_splice 94134d70abf92 fbdev: bitblit: bound-check glyph index in bit_cursor() e5f1d301b4bda tracing: Fix race between update_event_fields and, event_define_fields 4208db2453e1e ALSA: usx2y: bound the hwdep mmap fault offset d431941825d35 ALSA: usb: Fix UAF at delayed release of MIDI2 EPs 93e7044b548a7 ring-buffer: Fix crash passing ERR_PTR to kthread_stop() 3ceec39788481 misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free 3f265e405e5ef misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke 97273624f7b35 misc: fastrpc: Remove buffer from list prior to unmap operation a2f5efe0b6ccf misc: fastrpc: fix channel ctx ref leak when session alloc fails c5e5d78743992 staging: rtl8723bs: validate monitor transmit frame lengths 4ba402fd47009 staging: rtl8723bs: fix missing shared-key auth challenge length check 1158b99312073 staging: rtl8723bs: fix OOB read in WMM_param_handler() 0d19f0600fbb6 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() e7a5d792cf64a serial: 8250_dma: Clear stale RX state on shutdown 201b6961f02c6 mei: pull kvfree out of spinlock dfe388da13aa7 ipv4: fix use-after-free in fib_nhc_update_mtu() 7f80ad373ce4a ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops 606612b75d16d selftests/bpf: Adapt sockmap update error handling ce1418fec60e0 fscrypt: Replace mk_users keyring with simple list 401b84010a93a pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP 41cd5a536b3b2 fortify: Disable -Wstringop-overread in tests 4d48c73b0a24b fortify: refactor test_fortify Makefile to fix some build problems aa5c571901c6b futex: Prevent robust futex exit race some more 55a3e01f89480 dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk eefd1214882fa KVM: s390: pci: Fix aisb calculation 0e75b02682188 KVM: s390: pci: Fix resource leak on IRQ registration failure dea31682783ff KVM: s390: pci: Fix missing error codes and memory unaccounting dc7465a364104 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages 06d58b8d2f053 net: bridge: mrp: fix uninitialised bytes on the wire 9d8a94b48b393 netfilter: ebt_nflog: pin the NFLOG backend fe820dcc1d8ff mac802154: fix netdev use-after-free in beacon worker 99df6b7a713f9 net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header eff6343033f57 net: octeontx2-pf: Fix UB in shift operation 8ca8cdb749395 net/sched: reject overly deep qdisc hierarchies 87d0c0040b5d4 net: openvswitch: reallocate update replies for mismatched IDs cf8189b82bb93 packet: synchronize pressure clearing with ring reconfiguration b47ba8fe6e1d2 net/packet: reset the MAC header on the packet-socket transmit path d85d2fd54e901 packet: use consistent hard_header_len in TX_RING send path 91f041451f967 packet: use consistent hard_header_len in non-ring send paths ed246dd85ebf2 ipvs: clear IPv4 options after rebasing tunnel ICMP errors 2061525f3431d ipvs: properly update the overload flag on dest edit bc2cba3662e23 ipvs: add totalconns for dest d5122a2b26011 ipvs: stop estimator after disabled calc phase b6cb134707a21 ima: fix out-of-bounds read in xattr_verify() 06a286b320236 Input: evdev - fix information leak in evdev_pass_values() 38a0aa593ebc2 vt: stabilize tty reference in kbd_keycode with tty_port_tty_get d8ead5083b203 vt: add permission check for KDSKBMETA ioctl 1c63303659a22 net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() 11413d7ed4217 usb: gadget: f_ncm: Use unsigned int for ndp_index 0f770d5edaca2 usb: cdnsp: fix incorrect endian conversions for APB timeout register c81b71b737b47 thunderbolt: icm: Preserve USB4 proxy data-valid bit 993f7677949e3 usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() 6607f85242577 ALSA: usb-audio: fix OOB write on Type II inbound URBs 5db341189bb7f Input: evdev - sanitize event type index when fetching event masks a74a3bc424b75 spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers 1232fd8cc252f net: fec: do not release NULL pages when RX buffer allocation fails 83837e3e827dd hwmon: (ads7828) Fix external VREF regulator handling 4f2f4e9cfbb48 regulator: devres: add API for reference voltage supplies 6ae440fe5ff72 hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination 73c1ff87b63b4 tls: don't abort the connection on signal-interrupted sends 8de65194a04d2 sctp: clear control chunk transport if it is being removed 35f258fee9ed3 net/atm: fix slab-out-of-bounds read in vcc_setsockopt() 8adedc923f821 net/tcp: Add TCP-AO config and structures e2d44d24385a9 net/tcp: Prepare tcp_md5sig_pool for TCP-AO fa0dca89b4fb0 ata: pata_sl82c105: fix bridge revision use-after-free b5a21615f627c net: thunderbolt: Tear down DMA paths before stopping the rings 01865e1ddb126 net/smc: fix TOCTOU race between smc_listen_out() and listener close d2adc4e80b29e net: remove WARN_ON_ONCE() from sk_mc_loop() 6fad06bb793d7 net: prestera: validate firmware header length 43c7d0a691775 net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length 585fc5247d149 tcp: fix TFO max_qlen accounting across reuseport migration 0de370f9bbf35 sctp: fix addip_serial increment on ASCONF_ACK allocation failure dd5d6de4ca86a bnxt_en: Fix PTP PPS setting bug b61c4911204a0 bnxt_en: Disable EOP for TPA on all chips to prevent data corruption b8b4950f331b3 bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips ca84302458977 selftests/ftrace: refactor eprobes test to fix argument checks cbe7aaaa2ac91 hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations a3f598c0bfbed hwmon: (lm25066) Use i2c_get_match_data() 2b316608f521a hwmon: (nzxt-smart2) Check return value of init_device() in probe 34e77d8e3570f net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers 69cba7b704400 net: sched: refine software bypass handling in tc_run 4d1fc1d990f81 net: sched: cls_api: fix slab-use-after-free in fl_dump_key 544cf4801b6cf net: sched: make skip_sw actually skip software f236d51f9caf2 net: sched: cls_api: add filter counter efd3ffa472d68 net: sched: cls_api: add skip_sw counter d8bea341b1831 net/openvswitch: check Ethernet header length in key_extract() 0c4882bff3455 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter 1ae134c012e10 udp: fix potential use-after-free in tunnel segmentation 7bcb21bead667 tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() 893775f29af77 vhost/vdpa: reject overflowing PA map page counts on 32-bit ddbe966b5d1fe bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() f9d22822720b7 bpf: tcp: Avoid socket skips and repeats during iteration 4e3eaa5dce352 bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items beb8ffae319b7 bpf: tcp: Get rid of st_bucket_done 1d7a82c1df5fc bpf: tcp: Make sure iter->batch always contains a full bucket snapshot 524f2d0409706 bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch ccbbbca21ddda counter: microchip-tcb-capture: Fix DT channel validation 9a416f000285a net/mlx5: fw_tracer, return NULL on create error 7b6552e53426e devlink: fix net namespace reference leak in reload 0e6c8440aeb3e net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete b969984b2bdc8 net/sched: cls_route: fix fastmap use-after-free on filter 06734dfeaeba8 net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() 8cb23101a3fcc bpf: Preserve pointer state for commuted arithmetic e2c7e88815edd btrfs: fix memory leak in btrfs_do_encoded_write() f40409265dcb6 ipvs: return the csum validation for forward hook 3c779b258c9c3 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp 2dd0312392d07 netfilter: ipset: switch ext_size to atomic64_t 607adbda01053 net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock dd148539fb474 bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor 5d59e549b9033 Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" 51e32c5555b07 drm/bridge: ps8640: propagate AUX transfer register errors eacc1a5838710 ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt 4f7bb93a59082 ARM: npcm: Fix OF node refcount leaks in SMP setup caee6a68ffaa5 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call 7dd6e556dbfc9 s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() 590d9aec777cb selftests/bpf: Fail unbound UDP on sockmap update 91baa89437961 mount: honour SB_NOUSER in the new mount API Signed-off-by: Bruce Ashfield --- .../linux/linux-yocto-rt_6.6.bb | 6 ++-- .../linux/linux-yocto-tiny_6.6.bb | 6 ++-- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++---------- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb index 1d4f95e42c..e8d1f9da07 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb @@ -14,13 +14,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "eaa4bfd4f99ab0f3cf46ec5a207b73e22fb1c3f9" -SRCREV_meta ?= "dd201eb6ec53179f45836d41610ca68c725d28e2" +SRCREV_machine ?= "f92c1779022032aac8134ccb9e75365b19f6c596" +SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.6.151" +LINUX_VERSION ?= "6.6.156" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb index f2d6e5eef5..03889d329e 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb @@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc # CVE exclusions include recipes-kernel/linux/cve-exclusion_6.6.inc -LINUX_VERSION ?= "6.6.151" +LINUX_VERSION ?= "6.6.156" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "c51e01ecff210644b5d199a4edb30cb1a94a746f" -SRCREV_meta ?= "dd201eb6ec53179f45836d41610ca68c725d28e2" +SRCREV_machine ?= "d9da23dffd2dea6dcfa986e0aad77898a7b373da" +SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb index c1ac8e0a08..2632a4ef2f 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb @@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base" KBRANCH:qemuloongarch64 ?= "v6.6/standard/base" KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "ed7cf749dcade8ded9fda05be53c235a446dcbff" -SRCREV_machine:qemuarm64 ?= "b96d2d770cab02b84c46606fa538ce027bee6b08" -SRCREV_machine:qemuloongarch64 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_machine:qemumips ?= "fcfa6f13ad7894cedda5f59124e7a6f6f0100a67" -SRCREV_machine:qemuppc ?= "89811e5148d2a4c925940684ad9126bd08de9799" -SRCREV_machine:qemuriscv64 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_machine:qemuriscv32 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_machine:qemux86 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_machine:qemux86-64 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_machine:qemumips64 ?= "b6dc41bac21f990565fffb211d470fdc97533291" -SRCREV_machine ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_meta ?= "dd201eb6ec53179f45836d41610ca68c725d28e2" +SRCREV_machine:qemuarm ?= "f05eb652ce405932e2f47a78f721d1c2c5859e80" +SRCREV_machine:qemuarm64 ?= "2f7ef6e4d70eadf8f8b110cd81cfcafb2bb038fb" +SRCREV_machine:qemuloongarch64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_machine:qemumips ?= "1434d63083252688215ad6f5f6af122ead5865ee" +SRCREV_machine:qemuppc ?= "fc69e9d8f99c5c151415f6ba9f1e0428bb7e8e84" +SRCREV_machine:qemuriscv64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_machine:qemuriscv32 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_machine:qemux86 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_machine:qemux86-64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_machine:qemumips64 ?= "7969f6574cf5b126fa6eb28f33d0f2bcd8e7da5e" +SRCREV_machine ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "d27334b2888c10d2b60c954c59b186182d833107" +SRCREV_machine:class-devupstream ?= "8b73de7da85fde281a385e0b26eda9bffd3ca477" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.6/base" @@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.6.151" +LINUX_VERSION ?= "6.6.156" PV = "${LINUX_VERSION}+git" From patchwork Thu Oct 29 03:44:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bruce Ashfield X-Patchwork-Id: 102306 Received: from mail-qv1-f45.google.com (mail-qv1-f45.google.com [209.85.219.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4545.1793245529172720839 for ; Wed, 28 Oct 2026 20:45:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=sNoBTsUD; spf=pass (domain: gmail.com, ip: 209.85.219.45, mailfrom: bruce.ashfield@gmail.com) Received: by mail-qv1-f45.google.com with SMTP id 6a1803df08f44-91b55859245so22536066d6.0 for ; Wed, 28 Oct 2026 20:45:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793245528; x=1793850328; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=DW9wIrf936AOIqnmZe+zB09t2I0hbUvIFHHtQaVHUpo=; b=sNoBTsUDzL2ftGobQIGUG1bIheINb8o1KfStGhHxGhcLoqAbM8Bz2io70C31/Of9lQ NYpd04vyejlts9OoVSDZmAfFqJNOe+UgCX7NPGrv/WIipZUp133kXN1dnLJ2q0asU0E1 ZngDrpXWY4TWHC0oS5Ky7EVXBKS4GxoUKKVECQZ4TMQQdipS7nYKgXVuOWoZg5/K8bM+ NKOZ2Atqkm0zb7+sm8d238bGWaCY/+mgOQ7wAPR4HsFEGIH9YNeUlnkfcpo/VW5xUAzQ cOwAVXg7IvzEZ4vD3UENTtpVja4zLIl3RlLWO5uOa0ImdAx6/X4YGLdZWfwghmajWTlt bq1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793245528; x=1793850328; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=DW9wIrf936AOIqnmZe+zB09t2I0hbUvIFHHtQaVHUpo=; b=UzdRp0CttXmJ6XogJ36aR0ieeRt2V69qSuLeXsLgvZVPSr7UYeg42psmJ6Ku/xrJ8h KjjFclUtRyBfRkxuEEv7OwYjdWFZwD755JqwkjedsDaf8Bkm49Bb3EcEgCuSEGrAUM/L oTgNLTIP5x+UnQSShY8UQs3MvBb+Ry1NIFITVJIRhR+zAssKW1vSlSTt2KxnCUGuDbCK HPzoIsIgPnzDz4stuleaLMQO/G8Ln62n/J36C5kZrQ8iAgcyC3uW/mR1Tz+x+dfMIMiZ hGdqkao9eEOpsgm/twE2F3NnpwRPv91KLtDZvXGFaW2uZ6col8qw8H21LPYoUYV/Pjz7 Y6EA== X-Gm-Message-State: AFq9FYJQiGyguXZFL1fuNCufnykbzfilmmJZ4L0WugujIrr8S2wLu8Td tTr2GeFV2PRi1/yZ4tQGDzyJnr2Iv0vcBpMFSktSYTxJjdBNjYJ4yT1iU2gk6jSD X-Gm-Gg: AYBFou0S5axqKTPIP/mP/HAIdy1UcgEqSWft0EEt8rLkf60XxObzXrGSvZYOrl376vJ FM8gD8/DACBpkWiGuuFGTTtWpQx0y5Wl+wbZcnL3G/XUjcluJUqy5G59HTSJ5yx/1F6jmHjKLCC +mqZ6Ei/zva1pz42GV/xDCTg7bxrdX8vzVidIpXhEQjlVKneWlO8mqsN3QNdnF1zFTbPurBQKhl QzTn0JkqsgqVpkXj3LJvi5Mgmc+zsIYIvHt+c6HoG8CabeUZTsovCNh0t1ZpEGQl/8jb/wa1BF7 v4nJ92H1Qy+5w3GepcYA91r9gqYv6isB/Z/t9kFuxunmKuJCrLAn3QYfem/Fz4g/l3x2ZFTj1rF WPy9Vedev5A4if2c8+PBtVM1AK+iOw3SQLyPC322YCwUKYjP7TJbYD1w/oAJBqgUDIpdi54P0HH nymDJak9trs8cS+OjMrjtHNnHcFf3u0P6xc4UJ8DJEbAA2yt5Cfm/YK6/ezjuowX2e8tNqRiRSe yU8w6u4sjcgcR7yNdwGyzgefFXej/kMVr98DZGggLtukdZqPo8FCNWjNrHPbmL92Dc7/aKzuC3+ QeGdghvjI16kApOVwNUBLDzIJXeYbP/xBFZ7G2WJ+6ZmgTUaO1eORriqqqUjnQ26kdq0yoplHg4 4YghDB79AQRFMSbYbaxDgERxWHUukxeNC4v8g3+h9UuXqmOfA1zAfksgCly4vjN4TvNGsZuP5Rs SZeHDWE7ASCcTEWujF8V0UidnlsiBRl48Q7iwfDCgTq4id6s2aNWJIAkrA+YPQKNo3AK8T X-Received: by 2002:ad4:5c6d:0:b0:91b:c5b2:2096 with SMTP id 6a1803df08f44-91c7d24d595mr69777106d6.54.1793245526157; Wed, 28 Oct 2026 20:45:26 -0700 (PDT) Return-Path: Received: from bruce-XPS-8940.localdomain (pool-174-112-35-248.cpe.net.cable.rogers.com. [174.112.35.248]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91c47c16569sm147542096d6.18.2026.10.28.20.45.08 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 20:45:08 -0700 (PDT) From: bruce.ashfield@gmail.com To: openembedded-core@lists.openembedded.org Subject: [meta][scarthgap][PATCH 02/07] linux-yocto/6.6: update to v6.6.157 Date: Wed, 28 Oct 2026 23:44:58 -0400 Message-ID: <20261029034503.3153661-3-bruce.ashfield@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261029034503.3153661-1-bruce.ashfield@gmail.com> References: <20261029034503.3153661-1-bruce.ashfield@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 03:45:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248878 From: Bruce Ashfield Updating linux-yocto/6.6 to the latest korg -stable release that comprises the following commits: 79643295eba17 Linux 6.6.157 32e598324edc3 nvmet-rdma: fix queue leak when connect backlog is exceeded 6536d707ed924 perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error a77a45fbadd9c net: hsr: must allocate more bytes for RedBox support 4cad6ecdfee8c pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init() dfda4aabd3213 tools/build: Use SYSTEM_BPFTOOL for system bpftool 1fb06c7a5d307 ALSA: control: Fix unannotated kfree() cleanup 42ddedd71536d net: hsr: init prune_proxy_timer sooner 2ea73f9a1fe72 net: hsr: Use the seqnr lock for frames received via interlink port. 4cdb74d35b0e0 net: hsr: enable promiscuous mode on interlink port with fwd offload 7840a2c9c797c wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() 7554d498e4283 wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() ee556d118b11c firmware: arm_scmi: Roll back partial protocol table registration 6f5fb111a0a72 irqdomain: Make build work for CONFIG_GENERIC_IRQ_CHIP=n 712f3268a62d0 nvme: target: rdma: fix ndev refcount leak on queue connect b93f47d5c0288 kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c 6a22da9752591 kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings 08aaba219793b xsk: Fix offset calculation in unaligned mode 85316d624f565 nvme-apple: Reset q->sq_tail during queue init 073b9238fac4d nvme-apple: Prevent shared tags across queues on Apple A11 0f0a317dd9e66 ACPI: processor: Update cpuidle driver check in __acpi_processor_start() a8adb672758fb ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver() d607e038f1024 ACPI: processor: idle: Remove redundant static variable and rename cstate check function 6da7c7a29009f ACPI: processor: idle: Move max_cstate update out of the loop 60e5299f552d4 ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init 49457494d5d97 pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers 944b7b366ce5d pinctrl: mediatek: Fix new design debounce issue d6ba3a2ca3c9d pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask() 010d05df52cec net/sched: sch_htb: limit htb_classify inner-class filter hops 4fd2ee4ac154c tcp: fix corruption of urgent data on multi-segment retransmit 7baa0c92be39e usb: atm: usbatm: fix invalid ci_range initialization 7566789664813 net: fec: only stop PTP if it was initialized a2dbac3fb03b4 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() 82fdbf49b9f75 net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup e4570c6556d47 net: stmmac: selftests: Account for the UC filter list for filtering tests 556b55a209ea0 net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering ee22ca41efdcb net: stmmac: dwmac4: Account for the primary MAC address for UC filtering b7be75bb83add net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering 6315e468ef7e6 net: stmmac: selftests: Check multiple MMC counters 81dd9ed216358 selftests/arm64: Treat KSM merge_across_nodes as optional 3e0e4275b4b12 selftests/arm64: Print missing MTE TAP headers 2c75d9087a8e7 selftests: arm64: add hugetlb mte tests 6030f45bd0656 netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() 87f49ea98c88f netfilter: xt_HL: add pr_fmt and checkentry validation 4fc6882b18350 netfilter: xt_cgroup: Make it independent from net_cls 79eafe22ab0a6 netfilter: nf_tables: move hardware offload step after building the chain blob 339f47ae04dcc virtio-net: Ensure that TCP packets don't overflow gso_segs ae7173188ab06 net: stmmac: selftests: Pass the IP proto mask in the TC selftest 96a4696f8b74c net: ethernet: sun4i-emac: Fix IRQ error handling 7a96b9f6d5ba2 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify 1630774d81d06 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify 3b2e62a7655d3 libceph: validate banner payload length 7a64106070d4b ceph: revalidate ki_pos for O_APPEND writes after cap acquisition faf539af1a595 ASoC: dapm: Fix off-by-one check on the second enum channel 0664c75afe87a apparmor: policy_int make sure list heads are initialized before fail path fc75c2c7001c6 apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init 93c6fe34f22da tpm: st33zp24: Validate locality read result 1bfd5c54e4070 tpm: st33zp24: Return zero on status read failure aa39a790d56b4 net/sched: sch_teql: restore skb->dev on the slave failure path 9d782c662879c net/sched: sfq: clamp quantum to avoid signed overflow soft lockup dea2789a9d5ff net/sched: hhf: clamp quantum before hhf_change() to avoid overflow 435da3734a8e6 net/sched: fq_pie: clamp default quantum to avoid signed overflow 19bc715de421b net/sched: sch_codel: clamp default mtu to avoid disabling CoDel 397e2b1f71d9f net/sched: fq_codel: clamp default quantum and mtu 0675cff3c2924 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings d9a8113a5c152 maple_tree: fix argument name in header bc8be70fdeb94 selftests/mm: skip COW tmpfile cases when fallocate() is unsupported 4498f617a4948 selftests/mm: report unique test names for each cow test 328256478e9f3 selftests/mm/cow: modify the incorrect checking parameters bdd5574a636f9 selftests: mm: cow: flag vmsplice() hugetlb tests as XFAIL d10b6f53483bb selftests/mm/cow: generalize do_run_with_thp() helper 8086709b7f87e cifs: fix clearing stats for fastest execution of each smb2 command 42884bd8b8fd0 net/rds: use wq_has_sleeper() in rds_cong_map_updated() 573c088b6d479 octeontx2-af: Fix TL3/TL2 link config ENA clearing 4bcef54e4a335 net: qualcomm: rmnet: restore skb->dev on deaggregated frames e3b9aa0773abd gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free fc4851ff8dfb5 Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop 0b71a6caaf284 Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path 89d23a0fd43e7 Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX 8765eb64f9deb Bluetooth: btmtk: Do not discard the subsystem reset timeout 7c7ac736b50fa Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan bbd262d2d750b Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference 491e4c6001796 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN 0911a5e777e3b erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic 74e4a43e1b0ea scsi: qla2xxx: Fix an loop timeout test d3c55dcc863f3 rtc: pcf85363: Add error checking to regmap calls in probe() dd5bd091daa48 NFSv4/pnfs: key the data server cache on the NFS version 0faf682964678 nfs: move the nfs4_data_server_cache into struct nfs_net 5aca000630c0f NFSv4.2: fix LAYOUTSTATS send buffer exhaustion 957dba2b8b5ae net/smc: free pending qentry in smc_llc_flow_stop() before memset 056395acb7041 net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition 5f127e3cc9647 inetpeer: randomize RB-tree node comparison using SipHash 9b0a36df7f443 net: add missing ref_tracker_dir_exit() to net_passive_dec() be9ed08140dee net: ipa: balance runtime PM reference on remove error c1ac60ad8c182 net: ipa: Convert to platform remove callback returning void 95428d7d2c712 forcedeth: stop the tx_timeout register dump past the requested window 93c413d953e19 net: thunderbolt: Count delivered packets in rx_packets and rx_bytes 4b0f5b25f1146 net: bridge: Reject descending VLAN tunnel ranges aaebce297efc3 xsk: fix NULL pointer dereference in __xsk_rcv() b9d97ecb89576 xsk: avoid double checking against rx queue being full ba95f77c98687 xsk: Get rid of xdp_buff_xsk::orig_addr e4746c6e60ab1 RDMA/ucma: Allow path records to exactly fit the output buffer c5c7c7b6cfae7 ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup da3c2437df2c6 ALSA: core: Add scoped cleanup helper for card references c2a2036209b37 ALSA: control: Use guard() for locking 478cfdb6844fe ALSA: control: Use automatic cleanup of kfree() 9f756f1965bad clk: visconti: Make sure clk_init_data is fully initialized 73f4671d68193 clk: ti: Make sure clk_init_data is fully initialized 5f74a6e9afc90 prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator 6945acee8677b rtc: gamecube: check return value of devm_rtc_register_device() 68bf51c58479d i2c: ocores: Disable clock on failed resume b5ba8b861b5d8 irqchip/renesas-rzg2l: Fix loss of interrupt 321ef4e8f74e6 rtc: zynqmp: Return optional clock lookup errors 58066940076b9 smb: client: fix request buffer leak in smb2_new_read_req() 7afb8db47c4f1 rtc: pcf8563: fix clock provider leak on unbind eeac2ea4ad265 vdpa/mlx5: fix wrong list iterated in add_direct_chain error path feafa109f031e vdpa_sim: fix cleanup after worker creation failure f20ade5e9739b virtio_balloon: disable indirect descriptors ad22f0605c2d3 i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode fa47845df3626 i3c: mipi-i3c-hci: Refactor PIO register initialization 25c99c36760ec i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() 31d1e6df88c0f i3c: mipi-i3c-hci: Quieten initialization messages 2011e714e5f99 i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 b5e40cceb591c i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes 18a4463528f09 bonding: initialize err for empty target lists 4c2ffe2bbfdb9 mlxbf-bootctl: fix the build error with FIELD_PREP() c224759555a13 platform/x86: hp-bioscfg: fix password encoding bounds check 35364a037c2df vsock: use sock_error() to consume sk_err after a failed connect 93808d9572d40 platform/x86: dell-wmi-sysman: Fix instance ID bounds 48796058a5cd1 net/smc: hash socket only after full initialisation in smc_sk_init() 4944ed85a0e8a 8139cp: fix Rx and Tx not being disabled in cp_suspend f8a9b988e7a7b vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() 7c197d96f053f vxlan: mdb: Add MDB bulk deletion support 2e4fe6c423379 net: Add MDB bulk deletion device operation 94d8313ba1aaa bridge: add MDB state mask uAPI attribute 75ee201a1303f vxlan: mdb: Add MDB get support 88f464358411e net: Add MDB get device operation c9a5c400dfc59 bridge: add MDB get uAPI attributes c2a7f6064dfb5 vxlan: mdb: Factor out a helper for remote entry size calculation 8e4be8729f256 vxlan: mdb: Adjust function arguments 9cf0fc4bb6296 ALSA: hda: Fix connection list comparison in proc output 17120c5bfb168 fuse: check for NULL root inode in fuse_fill_super_submount dc925f22df8ad fuse: check attributes staleness on fuse_iget() 051eaaa875f50 fuse: convert readdir to use folios 358640784ba10 fuse: support folios in struct fuse_args_pages and fuse_copy_pages() a3713498429e4 fuse: use FUSE_ROOT_ID in fuse_get_root_inode() be829860d1dbb fuse: convert to new timestamp accessors d585ed0830890 fs/ntfs3: validate ef->size covers the record's name and value 700973cc65db4 fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() ac5c499413385 cuse: wait for pending RCU callbacks on module exit 9c59ee8d63c42 net: bridge: vlan: fix inverted default vlan notification 59f4ad9b3d1e8 tls: fix RX desync on overlapping skbs 7df3271df8678 net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error 47bfcc871576e vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes deaa88fa010ba ipvs: fix integer overflow in ftp helper port/address parsing 0a340ffd96943 net: hsr: free learned nodes on device setup failure d90e4f72e8d46 net: hsr: Provide RedBox support (HSR-SAN) 9baf4bf4763ce net: hsr: Use full string description when opening HSR network device f3d74ab3f49ea pppox: drain queued packets on channel handoff cbb0879aeaa13 net: dsa: b53: fix error propagation from b53_fdb_dump() b0e94ea63dbdc net: kcm: Hold RCU read lock while running BPF parser 5d6c3f6e90d73 octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap() 642d3bc08c731 clk: ti: mux: resolve parent clocks by DT index, not by name 6b9aedc0b998b clk: ti: use kcalloc() instead of kzalloc() fc95ca82d5ae5 NFSv4: remove callback IDR entry on client allocation failure 788b59a395434 nfs: refactor pNFS functions using clear_and_wake_up_bit a49d54e6cb560 nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper a2051ffe452af ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size 6bf378cfea2de ksmbd: disconnect on SMB3 decryption failure e6fbf0eba87f5 bpf: Reject negative optlen in cgroup getsockopt hook 7d3f15a664d11 m68k: nfcon: Do not call console_is_registered() in nfcon_device() de2b2004e16f2 lwt_bpf: Restore reserved headroom after xmit program ca119d4a6b19e smb/server: preserve error status in smb2_handle_negotiate() 3f8651f6bb521 smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() effcf48d79d8a ksmbd: free preauth sessions on connection teardown c3a8100dbf6bc ksmbd: do not advertise unimplemented CA support 17b7d1a2b4d54 ksmbd: validate ipc response length before dereferencing its fields 4d6fe49fa3e7f smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer 993e0158331d3 ksmbd: Do not skip lock checks for single-byte ranges 9281eb1e4ea31 hwmon: (emc1403) Drop hysteresis for low limit temperature e43ba8be636ab hwmon: (emc1403) Rely on subsystem locking 5efc8eeb33183 hwmon: (emc1403) Add support for EMC1428 and EMC1438. 5eee537872d86 hwmon: (emc1403) Support 11 bit accuracy e33dc202fb6f6 hwmon: (emc1403) Convert to with_info API b92949bc1a099 hwmon: (emc1403) Add support for EMC1442 8283049aa5fcb block: mtip32xx: synchronize ioctls with device removal 7de792b4c48fb null_blk: serialize configfs attribute updates with device setup 88d806d0e1d36 null_blk: serialize configfs attribute stores with the lock fcd53f3e8b758 null_blk: reject per-device queue resize for shared tag set 665c94554ff0d null_blk: free global tag_set on init error path dbcedbe4819ae null_blk: register configfs subsystem after creating default devices b6869f48ddec2 null_blk: add configfs variable shared_tags 349903f7ee72f null_blk: use DEFINE_MUTEX for the file-scope mutex 09372aa5774e3 mailbox: pcc: Fix command timeout due to missed interrupt 81e2b32d1d11d Revert "mailbox/pcc: support mailbox management of the shared buffer" dc14620fe268d mailbox/pcc: support mailbox management of the shared buffer 871b0bf25cc7e mailbox: pcc: Always map the shared memory communication address 82aa56d548f68 mailbox: rockchip: disable pclk on probe failure and unbind 606cbd749ff33 perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() d3231c74c9a9f perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() 4536ff6a67ea9 crypto: hisilicon/sec2 - fix CCM algorithm long packet failure 595dd1c0e1c47 bpf: Fix pending_pos walk on 32-bit ring position wrap f30379b8a4e24 ACPI: scan: fix bus ID cleanup on device_add() failures cd63a1eb677e9 ASoC: SOF: validate topology volume range before allocation 60d98480caafc tracing: Have trace_event_update_all() only handle module that is loading 11755741ff074 tracing: Remove "__attribute__()" from the type field of event format 03c5dabc8f16b ALSA: core: Fix use-after-free in snd_card_do_free() 0441e34ce098c fs/ntfs3: reject out-of-range evcn in mi_enum_attr() f77a8d9fdf58e fs/ntfs3: fix integer overflow in MFT cluster validation b51535ca5eb90 scsi: ufs: core: Set task state before io_schedule_timeout() 5d602d4ebb58c scsi: ufs: core: Remove redundant host_lock calls around UTMRLDBR 7612b5d2c00aa scsi: ufs: core: Remove unnecessary wmb() after ringing doorbell afedf35df054b scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers 5b37a7c2270cb selftests/bpf: Fix for veristat file/prog filters processing 3d2f0cb66c909 Squashfs: check block offset is not negative 8d88f52fbbbcc ocfs2: fix circular locking dependency in ocfs2_init_acl() 340821bc169bc bpftool: Fix double close in map dump 23e5b485da229 x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported 89d986897aff7 ALSA: seq: midi: Serialize input teardown with event_input 679087a7acdc4 ALSA: seq: midi: Optimize event_input locking with RCU a3efa5d4eed38 clocksource/drivers/armada: Unwind timer clock on init failure 3cac7e8adb006 clocksource/drivers/clps711x: Do not unmap clocksource MMIO a08b70ed2d1ec s390/debug: Fix deadlock during unregister 57ec8827f414b xenbus: Unregister reboot notifier on init failure 3a6b43ebc0c2e power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address c86a998bd46da power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address 60e5d928081b7 power: supply: bq27xxx: bq27520g4: fix REG_TTES address f1b4447402fca power: supply: bd99954: Drop bad register fields 49e717f3f3d20 spi: img-spfi: don't disable runtime PM on DMA deferred probe 6746ba44cd04d selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM a4e68a4f68c2a selftests/bpf: Add description for running vmtest on RV64 bfeb336e48a96 selftests/bpf: Support local rootfs image for vmtest c4579f1b7fe17 selftests/bpf: Limit URLS parsing logic to actual scope in vmtest 47a7a4443c6e7 kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix 620549b2775e5 UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC 8c38ae4a46569 ASoC: xilinx: formatter_pcm: fix stream_data leak on open error 552e565ed8846 ubi: Fix rollback for explicit UBI device numbers 3f617214c81a2 ubi: fastmap: Add module parameter to control reserving filling pool PEBs d99591caca984 ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs 2d55fd6170613 ubi: fastmap: Wait until there are enough free PEBs before filling pools 087d820d4bc48 UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs 3c5599d3cf1ab UBI: Preserve torture flag when rescheduling failed erasures 3996be3f5b8a9 ubi: Replace erase_block() with sync_erase() d8307a8bc986b ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap 4e0ab4f291a76 ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash 2a623a56b513b ubi: fastmap: Fix missed ec updating after erasing old fastmap data block eaaeabf566c3c ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready 48cece7b287ec ASoC: pxa: Use devm_clk_get_optional() for extclk clock 30c48da114915 ice: clear the default forwarding VSI rule when releasing a VSI 2a63cb9ea862a RDMA/cma: Fix WARNING in res_to_rt f98e894ec029a RDMA/cxgb4: Free debugfs on registration failure 8980385438975 dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal 5487f04c1ccbf nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing c001abaaa35bc nfc: digital: Do not dump a NULL response in command completion 753bdaf3220fe nfc: pn533: hold a reference to the request skb during send_frame 02030f95820c4 nfc: llcp: bound SNL TLV parsing to the skb and add length checks 9030a1bbe2c6b nfc: nci: fix double completion race in nci_data_exchange_complete fe65727a4a21b nfc: llcp: read llcp_sock->local under the socket lock in getsockopt 35573c6cb081a nfc: llcp: avoid userspace overflow on invalid optlen 7084caabc0370 nvme: reject passthrough of driver-managed Set Features c35cd98eed1a8 nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() ff28a93a89591 nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() ca6b14f01d099 nvme-apple: Drop the PRP null check chicken bit 7256eed48ce7d nvme: apple: Add Apple A11 support eb86b1844a1b4 nvme-apple: Never set the opcode in the NVMMU TCB 5ce74613edd36 nvme-apple: Don't set a DMA direction for commands without a data transfer 5f6f4777b7a86 nvme-apple: Destroy the admin queue on removal 89ff11b72f389 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() cefb177da32fe nvme: Add the DHCHAP maximum HD IDs ac6c240e0f448 nvme: introduce change ptpl and iekey definition cef6c15f8b54d nvme: add reservation command's defines c26fa54201acb ASoC: qcom: q6apm: keep the graph start count in sync with the DSP cd12a36c77fdd spi: sprd-adi: Fix probe succeeding without registering the controller d10e4173d8c2a phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs c653b97b9fefc powerpc/configs: enable CONFIG_RAS to fix EDAC support ed80d009b154a sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE 12bf3e0182ccd SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 3cee888393f6e arm64: Disable KCSAN instrumentation in delay.o e3405bf334b02 m68k: Fix backtraces for non-running tasks 071ac1722fe2e iommu/vt-d: Fix UCTP context table slot when copying root entries e8d4e4cf388da fbdev: kyro: Validate overlay viewport coordinates f3222a7a5e65c fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() 3d0f487661a69 perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads e7a3768a295a0 perf synthetic-events: Fix uninitialized pthread_join ba7a7e1a41c8e perf stat: Fix evsel_list leak in cmd_stat 518c47e2c59f3 ARM: dts: helios4: add SATA regulator supplies 0fb9acbc7fbd3 ARM: dts: helios4: add vcc-supply to GPIO expander 9f8e9aa4b1231 ARM: dts: helios4: add vcc-supply to EEPROM fb9043b5ce0c8 arm64: dts: turris-mox: fix usb3 phys d9ea72c04a1df riscv: cpufeature: Clarify ISA spec version for canonical order bee2208276c8e net/sched: cls_api: fix teardown of an adopted proto on insert-race loss 83db3f0d7982e iio: light: gp2ap002: re-enable irq if runtime suspend fails 8e76ab8131985 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes e804d54a5a99d Bluetooth: MSFT: validate evt_prefix_len against the response length 416fabca9b723 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled 193182c6467f5 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths 9a2ba69cebe3f Bluetooth: hci_conn: fix the SCO setup context lifetime 50dae81942575 Bluetooth: btintel: Fix diagnostics event detection 0e388d805233a Bluetooth: virtio_bt: avoid OOB read of build info string 90e9eae1b5907 btrfs: retry verity reads for not-uptodate Merkle folios a5add36fd9908 scsi: sd: Fix sd_done() sense handling condition 2cd80d83cc1a2 perf trace-event: Fix integer truncation in do_read() and skip() 5317d73c7876c Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices af6f77f20510d Bluetooth: btusb: Record matched usb_device_id into btusb_data 9b0b4fbb8c863 Bluetooth: btusb: refactor endpoint lookup 61df5d818baf3 Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() 32be97642c514 Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event e60f304c65013 sched/fair: Check CPU capacity before comparing group types during load balance 7ac16ee2d3766 ACPI: video: Release PCI device reference after lookup f1bea8cf618b3 regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling ea4fe6a450210 coresight: etm4x: fix leaked trace id be7b2de5b9a96 coresight: etm4x: fix underflow for usage of (nrseqstate - 1) b822e5966d5a3 coresight: Change syncfreq to be a u8 885d831237337 coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() 668d99ba47210 md/raid1: don't set array_frozen in raid1_takeover() cfb75fae75c96 md: avoid stale clone I/O accounting timestamps 9d7490007707f md/raid5: round bitmap stripes with sector division 9b28287c5dea7 phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend 3ddf41938fee3 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend 602059c5128a7 phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend 9e7448bb0e2f0 phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads c9f829195f84a phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*() cf2f1cee7080e soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() 5b7fc7a1ce2a5 hugetlbfs: release subpool on fill_super failure e36eee4fc56cf pinctrl: rockchip: Reset the pin count when recalculating SoC data 5a250bff75a44 firmware_loader: do not queue completed sysfs fallback requests 9b6325fc58ab8 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path b5d1d3e4519dc drm/amdgpu/gfx6: Use PFP on the compute queues too 0d567a5cb347e drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets d5f170189b07a perf trace-event: Fix buffer overflow in read_string() dd9fee2b29e2f phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table 1fce81a40e3b3 phy: sunplus: fix error handling in sp_uphy_init() ba56017b0c04e arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node 9e1efab410a4a ext4: fix spurious message about orphan cleanup on RO fs 4b7623e92545d drm/amdgpu/gfx6: Fixup emit_cntxcntl() e92a83a9a7617 mfd: iqs62x: Reject zero-length firmware records f943448aeae0a mfd: rave-sp: validate received frame payload lengths ad3839fe2114b arm64: hibernate: Restore DAIF state on error 5370853041a3c arm64: hibernate: mask DAIF before restoring hibernated kernel 0ab5739f1f448 wifi: mac80211: skip default WMM setup for AP_VLAN links f82e13c16da63 RDMA/erdma: restrict the driver to little-endian systems b9e7d3d9fdb2b RDMA/siw: Fix use-after-free in siw_accept() b8d5015db908a RDMA/siw: Introduce siw_free_cm_id 9c21a43302221 IB/isert: post the full-feature receive buffers after session registration f84e9adf4d9f4 IB/isert: delay the final Login Response until the session is registered 55864b26c22cb cpufreq: imx6q: fix out-of-bounds write when probed more than once 92e53a5274276 cpufreq: imx6q: fix devres accumulation across driver rebind 53e08b89f7620 drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz 0a3a149d5ac1d drm/sun4i: dw-hdmi: Drop TCON TOP port reference 543cc7dd263b9 drm/sun4i: tcon: Drop remote endpoint reference 1882112124a64 drm/sun4i: crtc: Propagate layer initialization error 4fa22218c2351 drm/sun4i: tcon: Drop TCON TOP device reference 539817f22063d drm/sun4i: tcon: Set output mux for DSI and LVDS f0f5441126f31 of: property: add of_graph_get_next_port_endpoint() afb9faa721d43 of: property: add of_graph_get_next_port() 89a89f7bb2fcc of: property: use unsigned int return on of_graph_get_endpoint_count() 217340d0ebd0f of: property: add missing kerneldoc for of_graph_get_endpoint_count() 24790c3b0d99a drm/sun4i: vi scaler: Fix coefficient selection cbb4efc2f99d6 ocfs2: synchronize heartbeat callbacks with o2net teardown 63e3c958a602d ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults 0e7ba61751490 RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ c0a83f29a24c7 RDMA/erdma: Hold CQ references when processing EQ events d7ef87c7daa9e modpost: prevent leak when early return no suffix .o in read_symbols() 16667c8cabe18 scripts/tags.sh: Prevent binary files appearing in cscope.files 81e425fbd8115 arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies f54b00b223954 selftests/mm: fix ternary operator precedence in ksm_tests 1f53972a5bd40 selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes bdef4a404fab5 selftests/mm: ksm_tests: use kselftest framework 6b117e23481d9 ksm_tests: skip hugepage test when Transparent Hugepages are disabled 46f5382b4eeb9 selftests/mm: add new test cases to the migration test 7eb85d07c15ae selftests: mm: support shmem mTHP collapse testing c2b8653d571e8 selftests/mm/khugepaged: enlighten for multi-size THP 7db5a1d597213 selftests/mm: support multi-size THP interface in thp_settings 750575653bd6c selftests/mm: factor out thp settings management e1e07344d8e19 selftests/mm/kugepaged: restore thp settings at exit e26db0d636e4c bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed c82241a9454b2 remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() 9ca46a1a3e510 remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() 829c24afec9ce remoteproc: Move resource table data structure to its own header 542a6a3ec77cd drm/omap: dsi: Do not copy isr table e38587d98d1ce fat: release buffer head after rebuilding parent 332591a245de9 rapidio: clear mport->net when rio_add_net() fails a1b1ff469e573 pps-gpio: remove dead capture_clear code c66eb07d65a26 pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler 9ee5b718b2cbd pps: clients: gpio: Bypass edge's direction check when not needed 6bc73694cbee5 pps: don't try to wait for negative timeouts in PPS_FETCH 4957320f54311 lib/string: fix memchr_inv() for large ranges 43b18869f8c8f ublk: check for ublk_unmap_io() returning 0 364030e3eefce block/kyber-iosched: flush per-cpu latency buckets over possible CPUs 92865833e8d81 block/blk-iocost: collect per-cpu latency stats over possible CPUs 28104b1636296 block/blk-stat: drain per-cpu callback stats over possible CPUs 1a267295b1ea6 blk-cgroup: skip dying blkg in blkcg_activate_policy() 056eea1a2068a phonet: pep: do not write beyond optlen in getsockopt cf62dd07b08e9 iio: light: tsl2583: return zero in write_raw() on success d7c5a80939e12 iio: light: isl29028: return zero in write_raw() on success 3f701835d082a iio: light: tsl2772: fix ALS calibscale readback 7ac69e177dffe perf intel-bts: Fix off-by-one in auxtrace_info minimum size check 1bdb0e48e9d87 perf intel-pt: Fix off-by-one in auxtrace_info minimum size check 2d31a6271975a perf auxtrace: Fix queue grow overflow and old array leak aa3045fb5faa0 perf thread-stack: Fix heap buffer overflow on branch stack wrap copy 6be9b1284d0c3 HID: lg4ff: validate report length before fixed offsets 178c369b465b5 HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure d3ccef6fb7133 HID: i2c-hid: Fix "(null)" output when reading report descriptor fails d9caf658694d9 HID: i2c-hid: Revert to await reset ACK before reading report descriptor 0cab98ab1f57a HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor a8a1892d18faf HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling c1e5bbba94e16 HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions 69345da556293 HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() 9a3da56aae28e HID: synchronize input before cleaning up a failed probe f54c3219db759 HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver d331c63570af6 tty: clear cdev pointer after cdev_add() failure 8369acce013b1 serial: amba-pl011: unprepare console clock on unregister 0ef4365a01cf7 MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL dcc442a49c0f5 powerpc/irq: Fix missing r2 clobber in PCREL inline assembly f89cccf6f5f4f powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass 88027241c1d2c firmware: coreboot: Validate table bounds f8808b7440c72 firmware: google: Add bounds checks in coreboot_table_populate() 5fc32f53f8486 wifi: mac80211: skip unused probe response countdown offsets a749ab2498238 wifi: zd1211rw: reject secondary interfaces to prevent conflicts aa5ff84ca8c39 wifi: mac80211: send TWT teardown to peer after setup TX failure 11b75fc02d842 perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register a6f2a2d867863 iommu/arm-smmu-v3: Convert to use atomic poll timeout eb946595a58de wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump 04d8fd716d0ee wifi: mt76: mt7915: report RX chain signal for all RX paths 6b3d02b422a5d wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 426825d50c700 wifi: mt76: mt7996: fix reg addr remap when addr is 0 2a434d2637b9c wifi: mt76: mt7915: release hif2 reference on probe IRQ failure ad706fcf62554 wifi: mt76: mt7915: fix ext PHY use-after-free on register error path 927fe8c0eb8c1 wifi: mt76: mt7915: fix double hif2 init on the non-WED path 1bd5c4ed2b904 wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement 4f4fada2d3594 perf machine: Check snprintf truncation for guest kallsyms path 718773cdea4ac perf machine: Free scandir entries in guest kernel map creation 6c903f77f50f7 perf machine: Reset errno before strtol in guest kernel map creation cae1adeb69b94 perf machine: Don't abort guest map creation on first inaccessible dir ac436ad9d47dd perf machine: Check snprintf truncation in machines__findnew() 091cd722190cf perf machine: Use snprintf() for guestmount path construction c8b41333e2c89 perf machine: Guard against NULL strlist in machines__findnew() 3d1f6a9f7f300 perf machine: Fix NULL parent dereference in fork event processing 6d0a2c5e210f2 regulator: core: use system_freezable_wq for init complete work 1296cae530528 wifi: ath11k: fix leak in ath11k_service_ready_ext_event() d3e8355a63cea drm/msm/dsi: Drop dev_pm_opp_set_rate(0) e52a884ecbf3c drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) 78c2c2ae9a8f4 perf: arm_spe: Make wakeup range check overflow safe ccee078503097 ACPI: processor: Unregister cpufreq notifier on init failure 0306624c843dd ACPI: processor: idle: Optimize ACPI idle driver registration 4052a0367fa92 wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields 1d348f96623ec wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV 3106f62809d45 wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config a4587f1098c97 wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie 953357433053a wifi: mt76: mt7996: don't report a zero TX bitrate e63c6291ecddf wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss 9fc7b406a7e5e wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset c2c7f16f2c62f wifi: mt76: mt792x: Fix memory leak in SDIO TX path 8eae5e5aa09da wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 b6e7958602bd1 wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length 1f3e5f4b779d6 fanotify: report full event length for FIONREAD adbdf4837c434 misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() 5c3bff6cf26e6 locking/lockdep: Fix NULL pointer dereference in __lock_set_class() d22ad96f1a0c8 i3c: master: Fix device_register() error path 111f559e5b646 i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices 68bf3ebd8e702 swiotlb: Preserve allocation virtual address for dynamic pools 06dffc9669308 iommu/dma: Check atomic pool allocation result directly 9a5a5eafbf168 clk: qcom: Return expected ENOMEM error on dynamic allocation failure 2636569ea7c19 lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone a5c936ac90476 bpf: Fix potential UAF when reading bpf link info f4ce6803df409 bpf: Fix potential UAF in bpf_netns_link_update_prog 972d88069050d power: supply: sc2731_charger: cancel work on remove dcc6995b17d11 power: supply: sc2731_charger: Convert to platform remove callback returning void c22a9a539c761 power: supply: isp1704_charger: cancel work on remove 76c695d6e9236 arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries 5c28583f58a48 arm64: dts: qcom: sm8550: Fix the msi-map entries 28bfcbc9b7694 arm64: dts: qcom: sm8550: Use GIC-ITS for PCIe0 and PCIe1 de01d783368c5 arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries 4a2efff1ebdbe arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries 9dedefe9d949a arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries 796fcf46d7551 arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries 3c9cbf39055fa arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries 31db9b8610e3f arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries a331e43e9b78f arm64: dts: qcom: sc8180x: drop duplicated PCI iommus property ab813e51988d6 arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID bb7206ebdb1f5 arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en 5a430485d1310 clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration ee4eb4b0db3de arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property 1c3d2e50e7bc4 arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep 29c9c4801f539 rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs d5ba53140ee78 rcu: Rename rcu_momentary_dyntick_idle() into rcu_momentary_eqs() 1d1903d64ba52 rcu: Remove unused function declaration rcu_eqs_special_set() 11d327f0911d3 selftests/zram: fix kernel_gte() for POSIX sh 590d690a9f668 tools/nolibc/powerpc: mark ctr and xer as clobbered by system call e77c80670f2c2 md/raid5-ppl: fix use-after-free in ppl_do_flush() 3018d86da10b4 md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency 55ee71cb96bd3 bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET aef178ffae542 wifi: rtlwifi: pci: fix error path in rtl_pci_probe() 56989e2a9c292 platform/chrome: cros_ec_debugfs: Unregister panic notifier 5ebfc68217b5a platform/chrome: cros_ec_debugfs: Clean up console log on probe failure f760b7d7e4358 wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() 1130f6f42f62b wifi: ath11k: implement handling of P2P NoA event 5ddc08ef072db wifi: ath11k: refactor ath11k_wmi_tlv_parse_alloc() 98e373dc08187 wifi: ath11k: add firmware-2.bin support aff7ced31b937 wifi: ath11k: qmi: refactor ath11k_qmi_m3_load() 29e37f768f355 spi: davinci: switch to managed controller allocation 5db5c788048eb spi: davinci: Unset POWERDOWN bit when releasing resources 27b0a735ca9f8 spi: davinci: Use helper function devm_clk_get_enabled() acc173608ca7a nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request 44fe800ec1338 IB/isert: reject login PDUs declaring more data than was received 2a6b8f88fb7ee IB/isert: reject PDUs declaring more data than was received 5a21e5114cec4 RDMA/cxgb4: free STAG index when TPT entry write fails 08c4a0dede170 RDMA/mlx5: Send cong param changes to the resolved port mdev 0b0122fcc923a RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs f42f0cb6be2e8 scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. 5166a21b12f54 nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch aaee7ff47a47a nilfs2: convert nilfs_page_bug() to nilfs_folio_bug() 25a07d5d97a19 nilfs2: convert nilfs_btnode_commit_change_key to use a folio 62cff5341dfde nilfs2: convert nilfs_btnode_prepare_change_key to use a folio 6fe7f8240fa83 nilfs2: convert to nilfs_folio_buffers_clean() 0787197a858dd nilfs2: convert nilfs_forget_buffer to use a folio 14b101d829fc1 nilfs2: add nilfs_end_folio_io() 7029e70cf86d5 nilfs2: prevent out-of-bounds read in super root block parsing d7afca8e4efbf nilfs2: fix infinite loop in nilfs_clean_segments() b9dd1e691cea8 clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs d9057cb059a50 clk: mediatek: mt8135: Fix inverted gate control for devapc_ck f7bf9b82c77fd clk/x86: pmc_atom: add kasprintf return value check 297b278cc4fd1 clk: palmas: Manage external-control prepare with devm e86e11c11251a clk: tegra: tegra124-emc: put EMC node on register failure 5dbefaa1bbbb2 arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix aadf3f9b5edb7 RDMA/efa: Fix PBL chunk length computation ecde45cd81dc2 fs/ntfs3: reject restart table growth beyond U16_MAX entries aeb16d9686b35 staging: rtl8723bs: use kfree_sensitive() for key material 47de033918cd7 remoteproc: Prevent crash handling to race with rproc_del() 15673e7195681 remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() 166bc60c8d1db remoteproc: Allow shutdown of crashed processors 48cba5968c148 remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown() 5f25e5c95117b w1: ds2482: Fix signedness bug in ds2482_w1_triplet() 5677737c2cedf isofs: release zisofs block pointer buffer head 42fb8aefffff5 RDMA/mlx5: Fix integer overflow of user QP buffer size 0afd2a1d8fd3d crypto: keembay - publish OF module alias for OCS AES/SM4 d52a15c4559b6 crypto: keembay - Initialize completion before requesting IRQ 587be18e09356 scsi: ufs: debugfs: Reserve space for a string terminator cd522340b777c power: supply: sbs-battery: Use a per-device serial number buffer 3b1fa32b00fbf tools/build: Allow versioning of all LLVM tools defined in Makefile.include a241079c175c5 tools/build: Add bpftool-skeletons feature test 903a7cdf63a81 pinctrl: mediatek: free EINT resources on unbind e578bbff98582 pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms e858183aa84e0 pinctrl: mediatek: Fix the invalid conditions 7586766229354 pinctrl: mediatek: Add EINT support for multiple addresses d626407251868 pinctrl: mediatek: Use C99 initializers in PINCTRL_PIN_GROUP() 68edf359b0b45 cxl/region: Fix use-after-free in find_pos_and_ways() error path dd60d57b1fe73 selftests/bpf: Fix memory leak on subtest_states reallocation 123d67513c828 selftests/bpf: Fix incorrect error checking for pthread_create 3f609fc97f22f ARM: lpc32xx: only run SoC init on LPC32xx hardware cf2e767ba2693 arm64: dts: rockchip: Fix Gru WLAN sideband interrupt 94fce1d3e74fe fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init 810da5a635495 netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet 4f10b305da832 drm/tve200: add OF module alias for autoloading 72e12a20e2fe0 leds: pca9532: Fix phantom device registration on missing hardware 0f36ce5987d1f PM: hibernate: Fix memory leak in snapshot_write_next() error path 621871b696b10 xfrm: Fix skb double-free in xfrm_dev_direct_output() 795e59c83c97c perf cs-etm: Avoid truncating AUX buffer sizes to int c2039be327081 perf cs-etm: Flush thread stacks after decoder reset 524e57035af2d firmware: arm_scmi: Unrequest devices if driver registration fails 41714150f3d14 firmware: arm_scmi: Add multiple protocols registration support e75816535da42 ARM: dts: allwinner: a10: Fix PMU interrupt e94676a08af63 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() 74637f7fef030 ext4: fix buffer_head leak in ext4_init_orphan_info 5361fb1e5bc24 RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap 2677fc48dd10d wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() 9784faa6afd26 wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() 6ba901a05ca17 wifi: ath11k: Correctly copy the hint BSSID in WMI scan request a7918f70784a7 wifi: ath12k: Correctly copy the hint BSSID in WMI scan request ea2a77682f9f9 wifi: ath6kl: avoid buffer overreads in WMI event handlers 74eee4ff9698a ext4: drain in-flight DIO before buffered write fallback f82a4929d0ef7 ext4: clear stale xarray tags on folios skipped during writeback 08df725b92751 thermal: intel: int3400: clean up ODVP on probe failures 20068f9cce6d4 iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() 4f408943e79c5 iommu/qcom: Remove sysfs device on probe failure path 2ff7713b7308c firmware: arm_scmi: Fix requested device removal race 7647363fa0204 RDMA/core: Fix potential use after free in ib_dealloc_pd_user() 76f2cb4f72181 RDMA/core: Fix potential use after free in ib_free_cq() 6318be2f1bdd1 RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() d5cc211e8c39e RDMA/core: Fix potential use after free in counter_release() d3d0eabe6e39b RDMA/core: Fix potential use after free in ib_destroy_srq_user() 253c2ed71a532 RDMA/core: Fix potential use after free in ib_destroy_cq_user() a608af8cde3dd RDMA/core: Fix use after free in ib_query_qp() 2001cb7bf6864 RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations 7a0cbb5721a1d RDMA/nldev: Fix locking when accessing mr->pd e61ac671304bc RDMA/restrack: Fix typos in the comments d08cfae802141 RDMA/core: Add an option to display driver-specific QPs in the rdmatool 7670a3a09cd1b RDMA/core: Add support to set privileged QKEY parameter 6e129c1310abf RDMA/erdma: Fix CEQ tasklet use-after-free on removal 7d90d2b7bd961 PCI: j721e: Fix incorrect max_lanes for J7200 74fc33e4fbe93 RDMA/srpt: Pass the mapped task attribute to target_init_cmd() b21c003c8a78b libbpf: Search /lib64 and /lib in resolve_full_path() 7ba09330d9ea6 ext4: skip extra isize expansion during mount to prevent deadlock 1a1dea633b724 ext4: fix out-of-bounds read in ext4_read_inline_dir() 452950461241d ext4: fix circular lock dependency in ext4_ext_migrate 6aaf6dbf54fdf ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root 8e67b58c04990 ACPI: processor: validate MADT IOAPIC entry bounds 13a1ba508507a ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer f8e9315236c8b RDMA/nldev: validate dynamic counter attribute length c4643bcb3bdda irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() 47e59177bfcee selftests/bpf: Silence array bounds warning in global_map_resize e967bde356a8a kcsan: avoid unintended access checking in NMIs f65f45dfa1e6e RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters 750bba6ce9bb0 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] fd6dee13f3857 RDMA/hfi1: Propagate sdma_txinit_ahg() errors 7987dd37eaeae arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe afa5719047522 phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe 41e92e0caa1fe ASoC: meson: Keep link pointers valid on realloc failure 351eceec64355 dmaengine: dw-edma: Clear stale requests on termination b6293a8a38f4d dmaengine: dw-edma: Serialize channel state checks 075de95d7a7cd dmaengine: dw-edma: Serialize abort state updates 65e387b95d385 dmaengine: dw-edma: Terminate all descriptors without callbacks fe644b89b0a8e driver core: soc: Unregister bus on early device registration failure 4ebf96d5f834a software node: Fix software_node_get_reference_args() with index -1 b604d3f453c99 perf ui hists: Fix uninitialized stack memory free on pstack allocation failure a536eb57be584 mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() 0ce48c6ddea1a mtd: mtdswap: Avoid freeing registered blktrans device twice 25cdd2a492d86 vfio/pci: clear vdev->msi_perm after freeing it on init failure ce6c3dd9f1ce7 char: xilinx_hwicap: unregister class on init errors c92ef8fd83452 ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove 5246bf384f74b tty: ipoctal: convert to u8 and size_t f53e742743c46 ppdev: prevent overflow when setting port timeout ec713896189fb cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) 0394902df3827 misc: ad525x_dpot: use driver core groups for sysfs files 362f5e6f8edf3 misc: rtsx: add missing write register handling f7a8f4cbc8ced misc: bcm-vk: Use acquire/release for msgq_inited 2e91ab73f9beb speakup: keyhelp: guard letter_offsets possible out-of-range indexing c5e4c36df3e6a accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() 15340b00e665a uio: Fix stale info pointer in failed registration path 57371e743398e UDF symlink pathComponent header OOB read 0b94b2d1ab3fa tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 fd43eae7d539e usb: gadget: f_uac1_legacy: remove broken string configfs attributes f593c55e3c125 ACPI: processor: idle: Expand _LPI package sanity checks 22a5cf7a4b733 crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping 079e64469bd21 drm/msm/a6xx: Fix stale rpmh votes after suspend 4f9f0afdbdf51 gpu: host1x: Avoid stack over-read in debug output helpers cfe1b2fa40d24 gpu: host1x: Fix offset calculation in trace_write_gather f22ad9d1077c8 wifi: iwlwifi: mei: pass correct argument to function 11dde137f1258 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments b90ebae632318 wifi: iwlwifi: mei: check SAP message length before reading it 2541d4f165960 wifi: iwlwifi: mei: add support for SAP version 4 5bcc933c6d47d wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser 8d74cb5fbb7a0 wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs c862282b5f4c3 perf jevents: Add more components to the metric sorting order 489765bfa715e arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table 533a26a2d6b29 arm64: dts: qcom: sm8250: sort out Iris power domains 91b0528b4220a arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO 982caa744fce7 drm/bridge: tc358767: clamp the reported AUX read size to the request 61b393c2de9d8 remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev 63d929c6035ca cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() e9c60c62b3fa8 cpufreq: intel_pstate: Fix setting minimum P-state at init time dbe2842194426 media: i2c: rdacm21: Fix missing media_entity_cleanup() 3d39757ef791f irqchip/renesas-irqc: Fix generic interrupt chip leak on remove aafec4a897d54 irqdomain: Add support for generic irq chips creation before publishing a domain 917c6432f7272 genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips() b359b1fe21434 irqdomain: Introduce init() and exit() hooks 6e6a1e3f3c3f6 irqdomain: Handle domain hierarchy parent in irq_domain_instantiate() c2a5d22b10f42 irqdomain: Handle additional domain flags in irq_domain_instantiate() 2a8a3c8867f08 irqdomain: Introduce irq_domain_instantiate() 804e2374b4cc2 irqdomain: Introduce irq_domain_free() 572624cc59dc4 PCI: xgene: Drop unnecessary OF node reference bff8e14aa442f PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN dc40f9f4f21c6 cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() 0a42180d5410c dax: read holder_ops once in dax_holder_notify_failure() 1c94430cab25f libnvdimm/labels: Bound the on-media label size before the shift 0f860db24ee95 firmware: arm_scmi: Drop handle on protocol bind failures 0f4edd93d7089 firmware: arm_scmi: Protect device request lookup with RCU fe2aeb5c50683 firmware: arm_scmi: Use channel ID for transport teardown 8eb2ab2095705 firmware: arm_scmi: Reject out of range DT protocol IDs aed24a3c63920 firmware: arm_scmi: Avoid IDR updates while cleaning channels ae7980c9af698 firmware: arm_scmi: Free transport channel on IDR failure 70a26b3738984 firmware: arm_scmi: Unregister device notifier before IDR teardown fb7b9a7209f83 wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate e20f3b749ad24 hfsplus: validate thread record before delete key rebuild 7e9aee7e4d976 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() 1083c7dca912a fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list 4ff4b6b9e85cf fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() e3256df116f0a fs/ntfs3: Add more checks in mi_enum_attr (part 2) 5b8d40df72c55 cxl/pci: Honor -EPROBE_DEFER from component register setup 4347681957c55 cxl/pci: Store the endpoint's Component Register mappings in struct cxl_dev_state 86771c105293c cxl/mbox: Break poison list loop on an empty payload 48f55b90f0d71 rpmsg: glink: fix deadlock in endpoint destroy during driver detach db196a8962a53 rpmsg: glink: remove duplicate code for rpmsg device remove c7201bd08cad7 media: v4l2-async: Unregister sub-device if asc_list is empty 601eb7f556810 media: v4l: async: Drop useless list move operation 85904076cece7 isofs: fix out-of-bounds page array access on empty zisofs block 648cdd16d633d ASoC: apple: mca: increase SERDES reset delay 554261c9858a4 RDMA/hfi1: Initialize debugfs after probe completes 506e333b1410c RDMA/hfi1: Stop flushing the global IB workqueue 3f5e501f1ac47 RDMA/hfi1: Create workqueues before device initialization 3471c19584d0d RDMA/hfi1: Remove redundant PCI device ID validation 10e5e37495096 RDMA/hfi1: Free RX data on late probe failure 3f1e196eb66b8 RDMA/hfi1: Preserve unit 0 on allocation failure 695562587466d misc: rtsx_usb: avoid USB I/O in runtime autosuspend b0c8786242a77 pmdomain: bcm: bcm2835: handle genpd provider registration errors 0f34ac40201e8 ALSA: hpi: Check transport errors during HPI6000 adapter initialization bdcda866c89f9 xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full 9e76202a1befe hwrng: ks-sa - Fix runtime PM cleanup on registration failure 2016f01404c7d hwrng: ks-sa - access private data via struct hwrng c319b986a88ce RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state 7bc08d7f9338c RDMA/ipoib: Drain RCU callbacks during module teardown 2f946e7839f67 RDMA/mlx5: Drain RCU callbacks during module teardown 7853af5f15738 RDMA/core: Wait for RCU callbacks before unloading ib_core 39bb722b7e2c9 iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE 682cb826b1ec5 bus: qcom-ebi2: use managed resources for clocks and children fb9738bf09514 soc: qcom: rpmh-rsc: manage PM notifiers with devres a8e5a6cff427c perf metricgroup: Fix metric expression copy leaks c582d79c8559a drm/panel: samsung-s6d16d0: Power off on prepare failure 02e4a3088f21a usb: renesas_usbhs: Fix power-off ordering on unbind b76061c76d8c6 usb: mtu3: allow system suspend during active gadget connection f276b62f2ce1c platform/surface: acpi-notify: Check ACPI companion before use bf1e0cc5cc1d4 platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL 44904468e58d3 usb: fix UAF when probe runs concurrent to dyn ID removal 767ccd38e02eb USB: make to_usb_driver() use container_of_const() 6ee22ab55856e USB: make single lock for all usb dynamic id lists 85c8cb5c0be4a USB: core: Use device_driver directly in struct usb_driver and usb_device_driver 4aaad88f85749 usb: gadget: aspeed_udc: check endpoint DMA allocation bdac0e8594a0c usb: gadget: aspeed_udc: Convert to platform remove callback returning void a28c486434634 usb: gadget: configfs: fix out-of-bounds read of qw_sign 52c423309d461 serial: ma35d1: Fix OF node reference leaks in console init 84a286a72228f hwspinlock: propagate errno when registering single lock a73cfa80f1ec6 remoteproc: qcom_q6v5_adsp: Fix reference leak for device node 62b24e1c338f5 platform/x86: dell-wmi-base: Fix resource leak on module load failure a22beeb90475b platform/x86: dell-privacy: Fix race condition 374e8007ba86c leds: pca9532: Fix inverted GPIO output polarity 6347259f70172 iommu/amd: Fix false positive in SB IOAPIC IVRS validation 9f06a7264aeda iommu/amd: Add support for Hygon family 18h model 4h IOAPIC ae2acdee5f8cf iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors c9dfb82df6fee iommu/msm: Return -ENOMEM on memory allocation failure in probe b201d43112589 iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX 51ddb831a3610 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation 8e1101fc41180 bpf: Fix use-after-free on mm_struct in bpf_find_vma() 68f2007738db7 efi: fix stale reference to efi_recover_from_page_fault() 978524ecfc1c5 bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux 8034ddf4751d9 udf: Mark LVID buffer as uptodate before marking it dirty 150d3f3c46134 usb: gadget: r8a66597: avoid double free of ep0_req in probe error path fb7393519908b usb: typec: ucsi: unregister debugfs entries on teardown 810875c5996f7 thermal/drivers/rcar: Fix error checking in probe() 78c5da6150ded perf data convert json: Fix trace_seq memory leak in process_sample_event() 4f65a8939518d arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes 30dfa367086be arm64: dts: qcom: sc8180x: Enable the power key 574a1124ab6fd arm64: dts: qcom: sc8180x-lenovo-flex-5g: move pinctrl to appropriate nodes f43f9bd3ece31 arm64: dts: qcom: sc8180x-primus: Rename regulator nodes 0f4733f5fc6b6 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() 3b110cd72a534 clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains ed07e0adfed4a clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status 0c3104e7ada4d timekeeping: Account for monotonicity adjustment in ntp_error dd29cd572958e y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 4d76e99010940 clocksource: Unregister subsystem on device registration failure 98ea7a6cffa01 selftests: timers: leap-a-day: Fix -w option and update usage comment 8aa8e8f5e236d irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its() 8c701506a3896 irqchip/gic-v3-its: Fix memleak in its_probe_one() 36d2cf0a9044d selftests/bpf: Fix memory leak in msg_alloc_iov fb17bee6b42c6 selftests/bpf: Fix memory leak in msg_alloc_iov error path dd4454dbe038d ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() 4520d673d49da staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() 98f9036b2254c staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown 65374d46e5507 staging: octeon: replace pr_warn with dev_warn in fill and rx paths a082526531f19 staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions 03725a114fb42 staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown b6365e4186322 staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown b631de4efcc17 staging: fbtft: Use sysfs_emit_at() to print to sysfs file 52daf9de692eb greybus: audio: bound the topology section sizes against the fetched size 6ddc6239b80de staging: sm750fb: gate dualview dataflow using g_dualview 7b34f757e63c9 staging: greybus: audio: correct sscanf() return value check c40ba47f2ba19 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain c2d446de9c7d0 bus: qcom-ebi2: Fix clock leak on probe failure aca12925ca316 bus: qcom-ebi2: Simplify with scoped for each OF child loop c75aed7464f63 arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name 8d89d53927ca2 PM: sleep: Fix off-by-one in wakelocks number limit check 9118429571290 bus: ti-sysc: Fix /chosen node reference leak 9584b3c30e4ee nvmet-rdma: fix response resource leak on queue teardown 3220b338d5c79 nvmet-rdma: factor out response resource cleanup d130a12a80ca8 nvmet-rdma: use sbitmap to replace rsp free list 85a79da286b65 nvmet-rdma: avoid circular locking dependency on install_queue() 86782a72c6d8c nvme-apple: Use acquire/release for queue enabled state 27ec91c29ee15 crypto: keembay - Fix AEAD unregister count in error path a22dc48d58ef4 crypto: rk3288 - fail ahash requests on HASH idle timeout 04c46784ec249 crypto: sa2ul - stop probe if context pool creation fails 28cc179252347 crypto: atmel-sha204a - fix heap info leak on I2C transfer failure 6457162f74f45 crypto: atmel-ecc - reject hardware ECDH without a public key 70933a1cac1fc crypto: atmel-ecc - clean up and improve ECDH comments c0615c85eabf9 crypto: atmel-ecc - replace min_t with min 892f34dc1819c crypto: qat - clear AES key schedule from stack a8aa89686e705 perf/x86/amd/uncore: Add group validation e0e7c57c8f654 perf/x86/amd/uncore: Refactor uncore management 64463f1901d33 perf cs-etm: Fix thread leaks on trace queue init failure 99d3245941659 perf cs-etm: Queue context packets for frontend 8e5df43a45788 perf cs-etm: Create decoders after both AUX and HW_ID search passes 96d80b8319b3d perf cs-etm: Fix incorrect or missing decoder for raw trace 655c4401c18d7 wifi: rtw89: fix HE extended capability length check 7780d93ae28f3 platform/chrome: sensorhub: Fix memory overread in ring handler c3d0e87485242 selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check e71a3dc5b8d2e csky: Fix a4/a5 restoration in syscall trace path 8d32795f0a49f iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure f80c31231f85e soundwire: qcom: Fix port exhaustion check in stream_alloc_ports aaff22cc321a3 dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe fdaf297ab275c dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers 2c6bb2f286369 dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure 953e85da53541 bpf: Copy per-CPU map value padding in copy_map_value_long() 9004fc411a4c5 tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands c2dae438fe530 tools/bpf/bpftool: Reset vmlinux BTF after map commands b349dcf061a6d drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup 745297208d312 drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup 28f70e0aa767a regulator: tps6594: Fix device node reference leaks in multiphase loop 017cee438fff6 regulator: tps6594-regulator: refactor variant descriptions e8d3e15b9dd68 regulator: tps6594-regulator: remove hardcoded buck config 23a18b7506a10 regulator: tps6594-regulator: remove interrupt_count 75ab28f275538 regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type ac25127d2f353 regulator: tps6594-regulator: Fix the number of irqs for TPS65224 and TPS6594 54308f24ce510 regulator: tps6594-regulator: Add TI TPS65224 PMIC regulators d9c48f4e68615 mfd: tps6594: Add register definitions for TI TPS65224 PMIC 1f27602b20119 perf tests: Fix flakiness in BPF counters test on hybrid systems a223216745ed4 perf test: Fix perf stat --bpf-counters on hybrid machines c292f2c183254 perf test: Use sqrtloop workload to test bperf event ff43d641b3bfb perf test stat_bpf_counter.sh: Stabilize the test results 30db36f6e1503 perf test bpf-counters: Add test for BPF event modifier a04531eb40eb9 perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test 203514384ea3c perf tests: Skip metrics validation if system-wide recording lacks permission 6ccaa141be258 perf test: Do not skip when some metrics tests succeeded db1ce7949a1cc perf test all metrics: Fully ignore Default metric failures ce09d02a597cb perf test metrics: Update all metrics for possibly failing default metrics e386dedc41094 perf tests metrics: Permission related fixes 1437d124d2ede perf test stat_all_metrics: Ensure missing events fail test a379a49b88d14 perf test: Update all metrics test like metricgroups test 361c06583eb3b perf test: Simplify metric value validation test final report 3db8b4f7f4eaf media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define 68f283e4d2202 media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define 3b978fd0a3092 pinctrl: bcm2835: Don't remove an unregistered GPIO chip ff48a41a242f2 perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails 69fafae4eb2c9 sched/fair: Fix overflow in update_tg_cfs_runnable() f5ec164e733b9 mm/mm_init: fix incorrect node_spanned_pages 788917ba77f5d drm/lima: call drm_mm_init() with a valid allocation range 0c90fe8d8039f clk: imx: scu: drop redundant init.ops variable assignment 3f0ebe8f8ae31 ARM: imx: fix device_node refcount leaks in imx7_src_init() 01a854226f5d1 ARM: imx: fix device_node refcount leak in imx_src_init() d3d51e874f7c0 clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller 1bb23c9d68312 ASoC: rt700-sdw: always drain jack work on remove b550b77f34f19 clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic 25f46d2536332 clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate() 418401f2a872d clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc 828a90dadda6c clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation 6956464d233a7 clk: moxart: remove unused variables, fix refcount leak 909f1b54d5a09 clk: versaclock7: Fix APLL clock leak on probe failure b37e82a046e73 media: cec-pin: Fix event FIFO ordering 111f1311bbdbe soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() 4b29be4b23bc2 HID: roccat: bound device-supplied profile index e45631bf607fa HID: nintendo: Fix imu_timestamp_us double increment per report 92cca302a4eaf HID: core: quiesce input in hid_hw_stop() to prevent use-after-free 4e37371cb4e3b platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count c0e090bd67085 x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE() 02e095247f0a9 smack: restrict smackfs/{direct,mapped} values to 0-255 c7bb74fa9c382 smack: deduplicate smackfs/{direct,mapped} file_operations 6d4addf839b94 smack: simplify write handlers of sysfs entries ec47f4177046d smack: fix incorrect task context in smack_msg_queue_msgrcv 139460b7723ca drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure a008506e55e33 drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format 8504b0e1acef9 drm: lcdif: Wait for vblank before disabling DMA 9ed9a94c1a41d drm: Remove unused header in drm_dumb_buffers.c 6d79a939e284e mm/damon/core: skip aging from repeated aggressive merging a886ad5f6348f usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion 404079d124d75 clk: meson: align gxbb_32k_clk_sel number of parents with actual count 29639f00bfa49 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON a3e07db74f22a batman-adv: bla: avoid CRC corruption due to parallel claim add 1674855a5b6ea batman-adv: dat: atomically update mac addresses d161c4456672f ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size 5e641e4ee0bc1 ksmbd: fix durable reconnect error path file lifetime f0ff7f12398e8 ksmbd: fix use-after-free in smb2_open during durable reconnect 64eaf4ecda007 bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops 2120bd8546cd6 bridge: mrp: reject zero test interval to avoid OOM panic de6601f1374fa netfilter: nft_counter: serialize reset with spinlock e2e9599f3503d bpf: Reject narrower access to pointer ctx fields c9a129c82ddf8 ceph: fix oops due to invalid pointer for kfree() in parse_longname() 4b9aee707c458 parse_longname(): strrchr() expects NUL-terminated string 0afd48b173beb net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads 97aabdbf7ba82 ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" 73f074fb5e139 ksmbd: fix overflow in dacloffset bounds check 9c6c85ae77efb net: libwx: fix Tx L4 checksum 5eaf57fdfa37c md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb 7493b9baf0e54 wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path 9d213ca0cb49e net: hns3: fix kernel crash when 1588 is sent on HIP08 devices 7f1fe43907a63 net: hns3: don't auto enable misc vector 2b844d952e23d mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() 1acb6d1ece3bc mm/damon/core-kunit: handle region split failure in filter_out() 9b7cf02158d93 mm/damon/vaddr-kunit: check region count in three_regions test 072d538e9d8c5 mm/damon/paddr: drop last same folio access check reuse optimization 2b48a84d31dc3 mm/damon/vaddr: drop last same folio access check optimization 94c4828bee3da mm/damon/core-kunit: check region count before testing in split_at() c3c126a6142a1 nvmet-auth: Synchronize timeout work during SQ teardown f3d8c2fd591bb net/mlx5e: xsk: Fix unlocked writing to ICOSQ 9fffa6465851a tcp: clear sock_ops cb flags before force-closing a child socket 43239fc6dfb62 xhci: fix lost bounce buffers on TDs spanning several ring segments a129b2b875c14 drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE ba42d8a1c2c76 drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE f02aefbc43bd7 drm/nouveau: Use write-combined maps for coherent 0f47c47b45738 drm/amdkfd: Reject zero-sized AQL queue allocations after size halving b4c90c78f420c drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT 5d501f7279451 drm/amdgpu: fix autosuspend cleanup during removal 84a8012601b9a drm/amdgpu: check thunderbolt before switcheroo registration e2f27b5ed9084 drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used 4f966558c188b drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value 082e378886547 drm/gud: validate TV mode names before creating enum property 89210cb5ff8fd drm/gud: NUL-terminate TV mode names read from the device 6dceaeceaa7c8 drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check 4d5ee095a5846 drm/amd/display: avoid divide-by-zero in __is_lut_linear() 6fa33b32783e9 drm/hibmc: Use drm_atomic_helper_check_plane_state() 1f0b71afd81de drm/hibmc: Fix list of formats on the primary plane 5296c567cbacc drm/sun4i: fix refcount leak in sun4i_backend_init_sat() 4a0236fe97732 drm/i915: Guard against NULL driver_data in i915_pci_probe() a0a7e2e177f2f drm: fix race between partial drm_dev_register() failure and ioctl 8d9e6dffaea9b drm/panel-edp: fix i2c adapter leak on probe failure c0cbdb43e0c65 drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure 6882d458d2e40 f2fs: fix to zero post-EOF data when extending file size d7a07c9ac1e71 f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() e601926015e03 f2fs: fix i_size when pinned fallocate partially fails 694565c0c14c9 f2fs: return writeback error from collapse range 4c0c610b480cf f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() ca1a602d4f73c f2fs: reject overlapping move range after len expansion 4aa12ba10cbff f2fs: return symlink writeback errors 2935b730211c5 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started 947c6bfcf7f5e scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak 9c00b89160406 scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics e8f1b0cb97823 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition e72c9eb93c5f1 scsi: qla2xxx: Drop vport reference under lock in report ID acquisition af8650037eec2 scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort d79376fbd2a07 scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() be75ab791c9b3 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read 6e217a9482eab scsi: qla2xxx: Avoid double completion in async IOCB timeout 7ac5be2a86096 scsi: qla2xxx: Quiesce response IRQ before freeing request queue 6e3f129538c32 scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() 8f0e31e7a4137 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path b6a30baa29695 scsi: qla2xxx: Don't query firmware state while chip is down 5762d992dddaf scsi: qla2xxx: Fix FCE trace enable parsing in debugfs 2f847f06bb223 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() 6003e79148eca scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump ae09260be7454 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown 9cef42a073a0b scsi: qla2xxx: Serialize flash version read in reset handler e80adfeac61b4 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation 7eb618877503e scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject 047f1f7ee6f85 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() 5b8ed910c392c scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() b403700ac62fb scsi: qla2xxx: Initialize NVMe abort_work once at submission f8d2eb510c063 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() 55f8698a6caf8 scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters de0c8ef3b900c scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check 9a756f277eb89 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers 84bde5ce4038d scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers c4acac8cdc005 media: zoran: Avoid freeing a registered video_device twice ca87a19381ae6 media: vimc: fix pixel format lookup in enum_framesizes 3d1b10d81fe54 media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure 7c0212041fab2 media: venus: fix payload size calculation in parse_raw_formats() fdf1eb47a60db media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() ef609b3ce456f media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link ea5a921d4d277 media: v4l2-ctrls: Allow unknown HDR10 white point and luminance d273571e53140 media: v4l2-async: avoid deleting unlinked ASC entry on link error 593b1172e5d54 media: tda18250: fix possible integer overflow 77f216f8de622 media: saa7164: fix cleanup on resource allocation failure 5626785b0e466 media: s2255: check firmware size before reading trailing marker 79f58f900dd22 media: s2255: bound JPEG frame size before copying into the buffer c91e8ae2b39c6 media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure 053581d4657c6 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak 826763adbd8bd media: rc: sunxi-cir: Unregister rc device on probe failure c817f24410626 media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks e9fe8e3f758f8 media: nxp: imx8-isi: Correct color map between V4L2 and ISI 94666ec4ae770 media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing 680a89683197c media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common 7512838a19af0 media: i2c: ov7740: fix use-after-destroy in remove 4c2988bf1ad27 media: i2c: ov02a10: fix endpoint parsing use-after-free 1c9fdd9465211 media: go7007: defer the ALSA v4l2 put until card release 20aacd87550be media: em28xx: fix use-after-free of dev_next->devlist on disconnect 4e11c45dfdc72 media: em28xx: defer audio-only extension registration ec82b0cf7f75f media: cx23885: cancel NetUP CI work before teardown 54ac6df8b8d97 media: cx231xx: reject geometry changes while the VBI queue is busy 42e00371f83c3 media: cobalt: Avoid freeing ALSA private data twice 22441be29ec27 media: cedrus: fix memory leak in cedrus_init_ctrls() 271e57a936dcd media: cec: Serialize exclusive follower delivery cf3bf86f32371 media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash 954ee95a03b4d media: cec: core: Fix kmemleak due to missed rc_free_device() call 6e4ea90fdc660 media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref ff40e597d5d98 LoongArch: Avoid preempt count underflow without probe a03b5e7483ad2 LoongArch: Do not save/restore percpu base register in rethook trampoline 9c55a7d4e521c KVM: s390: Restore sigset on error path 1914499556464 KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP 934b7b2b76d34 KVM: s390: Zero initialize irq in reinject_machine_check f8e3a9997d5ec KVM: s390: Take srcu when importing watchpoint data 544a5a665019c KVM: s390: Free guest debug data on vcpu destroy 5fbf319137735 KVM: s390: Fix old_data leak in guest debug error path 5940418e4232a KVM: s390: Fix memory leak in guest debug handling fec89d327d9b2 KVM: s390: Fix length check __import_wp_info() 8e19ded843368 KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock 312cdb6d89408 KVM: nVMX: Service local TLB flushes on failed nested VM-Enter 62604376c3131 KVM: nVMX: Always flush vpid02 on first use ee2d20a386668 iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask 7a1be6e7a857e iio: light: opt4001: Reject integration times with a non-zero seconds part 0f9f6d0ee5a59 iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() 170904917dc8d iio: light: opt4001: Fix power down clearing bits of the wrong register 9b75d89fd1e3d iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() e44b2af0c14e2 iio: srf04: fix pm_runtime handling on probe error path d97f4e012ba37 iio: pressure: mpl115: Fix runtime PM cleanup a32a39da18e01 iio: pressure: dps310: fix NULL pointer dereference on ACPI probe da41c3e0e67a3 iio: light: gp2ap002: Disable regulators on resume failure 82c27dabc391b iio: light: cm32181: return zero after writing calibscale 7dfbbb2f219fd iio: gyro: mpu3050: fix sign of raw angular velocity readings f5acb824277a9 iio: dac: m62332: Fix regulator reference count imbalance 3462c13bb0f50 iio: chemical: sgp30: Handle IAQ thread creation failure f64b437641b5a iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF 72daa7eb7fc62 iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable ed43e34f431d1 ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get 4dc91d0dadfe2 AsoC: intel: sst: fix PCI device reference leak on probe failure 6150b04ce8474 ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure f4bfd755c52df ASoC: cs35l34: drain threaded IRQ before runtime suspend 614c2616ea677 ASoC: cs35l33: drain threaded IRQ before runtime suspend 52f7ce8896d6e i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure 0c4c642b4d03e clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks ad3436ad31b83 clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk c93a8c7064b33 clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk 0c0609c1da0df clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src 0944e2cd198f6 clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src 1e2465ee57a3a clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src ce6f40f8dc66b clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk a2c156d22c3db clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk b89701e1fae14 batman-adv: bla: prevent CRC corruptions after claim flush 76aedcde5a248 batman-adv: bla: fix freeing of claims on meshif deletion c74a4acf41d19 batman-adv: dat: avoid unaligned fault in IP extraction 6df64825f8b19 batman-adv: fix stale receive device on merged fragments ddb6ddf5be742 mtd: rawnand: validate ONFI extended parameter page sections f25c804947e0a mtd: mtdoops: free page bitmap when the backing MTD is removed da740539e8f37 mtd: afs: validate v2 image info bounds 58f6f9125e74d s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object 4ba8a08f5f26e s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap 31fa0a8a3c337 s390/vfio-ap: Fix NULL deref in status_show() during queue probe 3a9b049bbdc40 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed 5e932abfcce61 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL 02e72909453de s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove 1f54efd800320 s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove eb6cc898501a0 s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() 114b6ce2cf864 powerpc/crash: stop watchdogs before booting kdump kernel 9c8e0e526b769 powerpc/pseries: Move H_WATCHDOG definitions to a common header b0cf5aceafb4b powerpc/pseries: Handle and log pseries-wdt registration failures b96be860673f9 powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population f5e9bea0d7c15 parisc: Fix alignment of asm statements in head.S 62d88e93ef5e1 parisc: eisa: Fix infinite loop when parsing invalid IRQ value f9bf05c63b77d nvdimm/btt: reject an arena whose nfree is below the lane count 6eddedb1a3009 mm/hugetlb: fix missing migratable flag on same-node hugetlb migration 0fb7c549357c1 Revert "irqchip/mbigen: Fix mbigen node address layout" 9fb527103e53f nvmet-tcp: reject unsolicited H2CData PDUs cf5f39d2b58f9 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU 0673a2affe45c nvme-tcp: check the data direction of a C2HData PDU ad29779736cfd ALSA: pcm: Fix race between non-atomic ops and trigger-start 7dc239edb6d58 ALSA: harmony: initialize locks before requesting IRQ 08d931a0a850a arm64: mm: Fix the lockless page-table walk in show_pte() 0927153f2abf4 i2c: mux: Fix channel node leak on adapter add failure f9094ace03e0a i2c: core: fix debugfs UAF on adapter removal ca19a175e89b7 perf/x86/intel: Fix kernel address leakages in LBR stack 341ec28243f16 rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers 5548f41e2f8dc rtc: rzn1: Fix weekday underflow when alarm crosses month boundary a098e2cecd9d2 Input: aiptek - validate raw macro indices before updating state 630ed8734a02b kprobes: Protect kprobe_blacklist with RCU 30b5c0e17dcad ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() 23a969a2df8de ata: ahci: work around lost interrupts on Marvell 88SE61xx 642b76f92bc42 block: flag zoned disks with GENHD_FL_NO_PART a38caa9ed0d5c cpuidle: dt_idle_genpd: kfree() the original name allocation 17ef63843c0fc dmaengine: dw-edma: Initialize IRQ data before requesting IRQs 8bc87a50fd0ea dmaengine: dw-edma: Complete descriptors before pausing 718ee263a60d5 dmaengine: dw-edma: Fix HDMA channel status register access 94f3d399c1ddb dm: fix resume-vs-remove race 0ea6e5ad4a581 dm: fix race when loading and unloading a table 96dd0af7597ab HID: wacom: validate report length in wacom_intuos_pro2_bt_irq a8be8bbf0952b HID: rmi: fix OOB access with undersized RMI reports 81aadbd09bf1d futex: Prevent rcuwait use-after-free during requeue PI 2bf705699fd72 mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs c97ded32334d9 mm/damon/sysfs: kobject_del() region and target (error) dirs ffab414fc5e06 mm/damon/sysfs-schemes: kobject_del() scheme region dirs 0e4aa31ab32a3 mm/damon/sysfs-schemes: kobject_del() scheme filter dirs b33f9b0184159 mm/damon/sysfs-schemes: kobject_del() scheme dirs 2853ce9c88e0e scsi: pm8001: Use rollback index when freeing MSI-X vectors 6b589ef9d5f6c scsi: target: iscsi: Reserve a terminator byte for the login payload 635b2bddea565 spi: bcmbca-hsspi: disable clocks on resume failure d45f27903f945 spi: bcm63xx: disable clock on resume failure 5597b4ffd0bec spi: bcm63xx-hsspi: disable clocks on resume failure be41733c24be5 ublk: clear VM_MAYWRITE on read-only ublk char device mmap d3018aaa5e3b1 thermal/drivers/qoriq: Disable clock on resume failure 03ff03e5c95a5 thermal/drivers/imx: Disable clock on runtime resume failure 0b7f64c7bb966 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() fd5e24ea83733 staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() 7a4f4ca7ff32a usb: gadget: fix null pointer dereference in usb_put_function_instance() 162178ca83c3d USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() f9bdf4c4f6410 usb: gadget: f_midi2: fix use-after-free in string attribute show path 51ddc55c75087 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs 58e0ee293ec5e usb: typec: ucsi: displayport: Fix OOB altmode array index 0b69b166852db usb: typec: qcom-pmic: cancel reset_work on stop dbbb3bb0bf2f3 usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() 9481bc04a8c35 usb-storage: ene_ub6250: fix race between scan work and probe 67374e3a00814 media: usbtv: keep device alive while ALSA card exists d91993f4c7635 clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset 1d4add2b832b5 ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() 553c375e86a49 usb: image: mdc800: change kmalloc() to kzalloc() 4c5b61b9df6ab drm/amd/display: fix division by zero in get_estimated_bw() 28ed5343666ff scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() 2df964d141270 tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions 517ed2f9ea7d9 tracing/mmiotrace: Remove reference to unused per CPU data pointer 7ab40f7577d88 net: ntb_netdev: Fix TX busy and drop handling 23001ee5d8631 entry: Fix seccomp bypass after ptrace with TSYNC cd644e6dc72ee tcp: fix potential race in tcp_v6_syn_recv_sock() 343ae18e960f6 fsnotify: Fix stale object mask after concurrent mark updates b4bf67cc0871b wifi: mt76: mt7996: validate default EEPROM firmware size dfb10d9890561 landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation 680f20d5937fa openvswitch: Fix CT limit teardown use-after-free d7c2b66bc5527 net: openvswitch: fix kernel-doc warnings in internal headers 8069643ae64df net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() e34ff3f882292 platform/chrome: sensorhub: Fix dropped timestamp events and log spam 8395cff0b286d udf: Fix i_lenExtents truncation on 32-bit kernels 51e368f723aa5 timer: Keep debugobjects state consistent in migrate_timer_list() 2252f8ccc3085 taskstats: fix cpumask parsing cutting off the last character f9c7b1f2b9d8f smack: fix cred UAF in smack_file_send_sigiotask() 6b1de022304ef signal: avoid shared siginfo namespace rewrites 262b805219157 sticon/parisc: Detect default STI graphics card for console output b0dc3f18af01b tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout 6c1a8685be6a7 xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() 0f6496b34cc29 w1: ds28e17: reject an oversize length on an I2C block read b9cb4e8ba71c9 vsock/virtio: flush works in dependency order ef2ec8b537c3a wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex c86199357a93b wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() 2610885f70861 wifi: rtl818x: initialize eeprom_93cx6 struct to zero f2134d6ff30cd wifi: mwifiex: Detach sync cmd buffer on interrupted wait 7704f6ba2a8c4 wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() 35aa6730b8c56 i3c: master: svc: bound IBI payload to the requested max_payload_len ef72ff6650c4e i3c: master: Fix info leak and UAF in device unregister path 42ea423a50ae1 dm-switch: use WRITE_ONCE() in switch_region_table_write() 389a50d094e13 dm-stats: fix a crash if allocation of per-cpu data fails d1361d4a42bbd arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() d18bbf8262516 x86/tdx: Fix zero-extension for 32-bit port I/O 0444f2803b963 PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip 342d8d63f653c cgroup/cpuset: Fix misplaced DL migration reset 368c521503e38 ALSA: virmidi: Check card index validity at probe 487ede9b648fc ALSA: serial-u16550: Check card index validity at probe 64898e9bd8b7b ALSA: portman2x4: Check card index validity at probe ede25b7fea0d7 ALSA: pcxhr: initialize mutexes before requesting threaded IRQ 9cd7c59a106e7 ALSA: mts64: Check card index validity at probe 26a25fb4ef4ba ALSA: mpu401: Check card index validity at probe 6c07aad8a7c9e ALSA: bcd2000: clear the URB pointers on disconnect 6fe7d13608a9d ALSA: aloop: Check card index validity at probe 00e84a9ff2d43 ALSA: 6fire: bound the MIDI event length from the device 96c74420ac929 seg6: reset IP6CB after IPv6 decapsulation 6ec22afc82a3c net: skbuff: don't touch shared zerocopy state in skb_tx_error() bfb1c9e6297b4 net: fix spurious TX timeout after dev_activate() 84783961cb8bd net: cap advertised IP tunnel headroom b6b6ac713ee82 net/smc: unregister the connection before draining the rx tasklet df441f3efbb50 net/smc: fix use-after-free in smc_rx_pipe_buf_release() 09d7a9e162ee1 net/smc: fix socket refcount leak in smc_switch_conns() ab26e12dd5d2f net/smc: do not dereference an unset send buffer on the SMC-D teardown path 746681f9e8773 net: ntb_netdev: Count packets dropped on RX refill failure 965c4452bfe34 net: ntb_netdev: Avoid double-accounting netif_rx() drops b6db88cde0fb5 NTB: ntb_transport: Reject oversized TX buffers e6cc541fab010 NTB: ntb_transport: Fail TX enqueue when the QP link is down 81fbd4021ca93 NTB: ntb_transport: Recycle TX entries before client callbacks e0d4a17afde5a net: thunderbolt: Mark the connection down when bringing it up fails 47981eb66461b net: thunderbolt: Release the Rx HopID that was handed out on mismatch bf3308416a2be net: ravb: avoid dereferencing an invalid PTP clock 06323666c4e2b net: openvswitch: fix nf_connlabels leak in ovs_ct_init 64051fe200c7c net: openvswitch: fix flow mask use-after-free on flow deletion 010eee265d6bd net: tun: bound receive headroom 98610769784d0 net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition 70e20456bcbf7 slip: fix use-after-free in sl_sync() 6de17275b3ccd xdp: fix zero-copy frame layout 0a5af67e7184c net/iucv: filter frames in afiucv_hs_rcv() by ingress device d377bf743f29b ipmi: si: Fix NULL pointer dereference after failed registration 7d66d54b974cf ipmi: ipmb: validate write message length fedea72e8f312 interconnect: Fix use after free in icc_get() and of_icc_get_by_index() dfdee7ceff6a5 platform/x86: hp-bioscfg: warn on element type mismatch instead of failing 467e53f231f77 platform/x86: hp-bioscfg: pass validated element count to package parsers fe837a99e4e31 platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed 8f5aa1506cddd platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() 62f6f04abc64a platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password 21243c15e1d31 platform/x86: hp-bioscfg: fix heap OOB read on empty password write 81db79fed1156 platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() 1bf0a07a2ea4b platform/x86: hp-bioscfg: bound ordered-list parsing by the package count 27a93d0fe2398 platform/x86: hp-bioscfg: advance elem past consumed array elements d8690d44f1b0d platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS d1b4add68dabf platform/chrome: sensorhub: Bound the EC-reported sensor number f2a9289a65d35 platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path 0d601126c7afd platform/x86: ISST: Validate logical CPU id and clos id 649024043d23f platform/x86: ISST: Just allow 2 bits for SST feature enable dde5b9c91e9fc mmc: via-sdmmc: stop card-detect handling on probe failure c847ea4851ecf platform/x86: ISST: Validate socket ID in clos_assoc ioctl beb22ebf76c04 platform/x86: ISST: Validate level in perf mask ioctls 44ec7f1113309 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer 579eb867d3da6 iommu/vt-d: Force requesting ACS when tboot is enabled d5db80b68ee5c iommu/vt-d: Fix no_iommu to disable platform opt-in a6a4cee09b154 PCI/proc: Warn on writes to kernel-exclusive config space regions e7730acd6a01c PCI/proc: Use file_ns_capable() when checking config space read access d6895710703ea PCI/proc: Avoid spurious runtime PM wakeup on config space accesses d0631a0ab18ad PCI/MSI: Enable memory decoding before restoring MSI-X messages 131900a246137 PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses 838e146ae4cd8 PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] 5a072fc80a753 PCI: meson: Fix GPIO state while requesting PERST# dcaf13f2f4688 PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk f735b9710f0c8 s390/dasd: Propagate partial completion length across ERP recovery 57db27ccc162a s390/dasd: Guard sysfs discipline callbacks against unallocated private data 55f4df40178cd s390/dasd: Do not complete a failed ESE read as successful 991be92489bc7 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks 23783db5642a7 power: supply: max17040: synchronize work cancellation on suspend f46465aefa911 power: supply: max17040: drop incorrect I2C functionality check 2ec4d203ecb06 power: supply: ucs1002: fix use-after-free on remove c46c205bab0df power: supply: twl4030_charger: cancel workers via devm 442c60c08ec23 power: supply: rt9455: quiesce delayed work before teardown c06028db62085 power: supply: qcom_battmgr: terminate the strings from firmware 6f0ce09d60a0e power: supply: lp8727: fix use-after-free in lp8727_release_irq() 3262977a05b23 power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS 2746d502b12b3 power: supply: cros_usbpd-charger: bound the EC-reported port count 976c10d883a02 power: supply: bq25890: Fix power_supply reference leak 2cfb59dc9df8b power: supply: bq256xx: drain usb_work before freeing the charger 6d2eb93975c07 power: supply: bq24257: fix use-after-free on remove 092acd3c55a40 sctp: fix stream->outcnt underflow on duplicate RECONF responses b55c2561d3fec sctp: distinguish sequence zero from wildcard in reconf lookup b2d6d873b4dfb sctp: fix NULL deref on untransmitted RECONF completion 928fd7920ba37 sctp: drop a chunk if its transport was removed 5c0b2dbbdafc9 sctp: stop processing a packet once its association is deleted fca3ebb63e5c8 nvme-tcp: reject a read that transferred too few bytes bc4013c7cce58 nvme-tcp: fix host memory disclosure on R2T for a read command b96e1ff75e5c0 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone 313b05de246a1 nvme-pci: disable controller on admin queue IRQ setup failure 66b5af23b6f95 nvme: zero the discard fallback page da7555248e9bb nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path 350087f231c11 lockd: pin next file across nlm_inspect_file lock-drop 697d946853e7e hwmon: (max6621) fix temperature clamp range 7d69a2747441f hwmon: (max6621) fix negative temperature offset and crit readings 213a32146337d ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC 9df45b83d6f68 arm64: compat: Fix decrementing LDM/STM alignment emulation 8a2ec0eb2c5b3 ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion 4d5c460ef8754 openvswitch: only skb_tx_error() a packet we are about to drop 574ae2ac2b314 openrisc: fix arbitrary kernel memory access via or1k_atomic syscall f9dd5cad8d091 ocfs2: fix readdir position truncation on 32-bit kernels 1507c5586ebd3 ocfs2: cluster: fix o2hb_dependent_users leak on pin failure da279037473ae ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item c9be4de77f97f ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() 97584e93fc49a ocfs2: validate rl_used against rl_count in refcount block validator 77686fa5bba13 ocfs2: validate lengths in dlm_mig_lockres_handler 24989909d3413 ocfs2: bound namelen in dlm_migrate_request_handler a4adaa722977f ocfs2: always run deallocs on copy-on-write completion ce748ae1181d0 orangefs: skip leading spaces before parsing client debug masks 9c9eacc47c618 orangefs: fix double-free of trailer_buf on readdir copy failure c4c338dcd38b9 regulator: qcom-refgen: correct the regulator type to CURRENT c998890091065 regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata eda08b6bd64f0 regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer 71dc206f2e2a6 RDMA/ucma: Lock the handler in ucma_set_ib_path() 3265d558dfafa RDMA/cxgb4: Cancel reg_work before freeing device on remove a5e1fdc126ab3 qede: Fix NULL pointer dereference in TPA fragment processing 6ca338cf2d386 remoteproc: scp: Fix device reference leak on failed lookup a2e0e01a7fbf0 arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio bfc3e5fe778c9 arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck 28cf91db44ce1 rpmsg: glink: smem: order FIFO read after availability check 46101fb96aff2 staging: media: tegra-video: vi: fix probe failure on skipped last port a3783800c9475 staging: media: tegra-video: fix of_node_put() on VIP parse errors 6deb4d7a0c3d9 wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets b77b83f5529a2 udf: reject VAT indexes equal to the entry count 06d0390c37fa6 svcrdma: Fix pcl_for_each_segment for empty chunks cba8543c18cf4 svcrdma: Fix offset arithmetic in read_chunk_range fb43997407bc1 SUNRPC: wait for in-flight client TLS handshake callback 4abb44a29bb51 SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field 89c8e0733e8c4 sunrpc: init gssp_lock before publishing proc entry 81fd7654a8429 SUNRPC: harden gss_unwrap_resp_priv length checks f2591660e0eb2 SUNRPC: harden gss_krb5_unwrap_v2 against short tokens ef948257d1211 SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat 57ac7d899409b SUNRPC: Check svc pool percpu counter allocation 6d74ecc2be120 SUNRPC: always drain cache_cleaner before destroying a cache_detail edb20e8c03aeb sunrpc: route to a populated pool in svc_pool_for_cpu() 0ea5b0c7f212c SUNRPC: svcauth_gss: enforce krb5 token minimum length 56b29d62017c7 SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry 4bf59cb0ea5b0 SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow e05c28bd6043d nouveau/gem: reserve the bo in the info ioctl around the vma lookup 9df36a4846375 mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction d9640239827d6 mpls: reload header after pskb_may_pull() 0a03f9541c06f md: do overflow check for sb->bblog_shift in super_1_load() 792515b2b77cc mailbox: qcom-ipcc: fix duplicate channel allocation across holes 93967bfb17dab libnvdimm/labels: Prevent integer overflow in __nd_label_validate() 3665abc3d2ae8 ipv6: use RCU iterator to dump route exceptions c3457a5aae5fb ip6_gre: fix hardware header length for NBMA tunnels defa0adeff132 ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() c4dc23de4cc75 ipip: fix skb leak in collect_md mode when metadata_dst allocation fails 7cd164f0e1bab kasan: fix cache shrink race with CPU hotplug d90a166ac55c1 Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request faf331d3f2145 Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative 7df825df95cf9 Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative 6ebb6d1756820 Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection d5eef07470719 Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb ff76a63e9524b Bluetooth: hci_conn: re-enable advertising only for peripheral role 82425b14f0fb2 Bluetooth: RFCOMM: serialize security confirmation handling d47b8f8c02a3d Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready 1a7196c4fffb3 Bluetooth: hci_uart: Fix false success return in hci_uart_setup() 1c4b02a810329 Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative 1353679268b3c cxl/pmem: Format the nvdimm serial number as unsigned decimal aa436b021e505 cpufreq: schedutil: Fix rate limit overflow 522fa26da24cc dm array: reject an array block whose value size is not the caller's 01a0276706c7b dm raid1: reserve space for NUL-terminator in build_constructor_string() dc731d7fddfd6 dm-era: fix shadowed superblock leak on take-snap failure 80551bf8912c4 bpf: Harden bloom filter sizing and indexing on 32-bit kernels ac280f6872e75 bnx2x: fix double free in bnx2x_init_firmware() error path 1a28aae7f1fc8 Bluetooth: eir: Fix OOB read in eir_get_service_data() 0725f93b395f7 Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU 1b5fb9c40e301 Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 958cfdc655f7c block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() 6eaed64a32e55 auxdisplay: charlcd: cancel backlight work on registration failure 977554ed91b54 ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes 3a6f8d3adbd6f ARM: 9477/1: Disable broken eBPF JIT on the Risc PC 1712e99ddeb19 alpha: marvel: Fix lock ordering in init_io7_irqs() 748d3e1dcecf5 alpha: marvel: Fix irq_set_status_flags to use correct IRQ number a12408ff9a948 alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() c5a31b4e7e37c ACPI: pfr_update: fix stack buffer overflow in query_capability() 9963a65be2bef hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device 827ded884dbd6 fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration c4d5953582463 forcedeth: fix off-by-one when saving/restoring non-PCI config space 9eb7b3cbe99c9 fbdev: uvesafb: unregister connector callback on init failure 237924f5b9afc fbdev: ssd1307fb: defer I2C transfers from damage callbacks 74de052b4399d fbdev: pvr2fb: correct user pointer annotation and sentinel initializer 302d19fbc7dc7 fbdev: omapfb: panel-dsi-cm: initialize lock before registering display 35b3334800103 fat: restore original value when fat_ent_write failed 3cd611c9f1dbc efivarfs: Rate limit statfs() handler a980ac04ada51 ecryptfs: show filename encryption options 30845ed227475 ecryptfs: release message context on send failure 414a0f04feb06 ecryptfs: reject too-small tag 70 packets 33e050cac8414 ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet 749fa08d8f1b3 ecryptfs: pass packet set buffer size to parser ec1627bcb5b51 ecryptfs: hold msg ctx list lock when cleaning daemon queue 7abf2992c61e8 ecryptfs: fix tag 11 packet exact-fit size check 70fa0cf82e435 eCryptfs: bound the packet-length peek to the user buffer 61ca8cbbf68f7 fs/ntfs3: bound page_lcns[] index by the log record 77d8efd04745c fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() d23155634a4bc fs/ntfs3: validate dirty page table on log replay 069729282fbec eventfs: Initialize ei->children and ei->list in init_ei() c1c508e892391 HID: mcp2221: validate report size in mcp2221_raw_event() 85d963499f1fe HID: mcp2221: stop device IO before hid_hw_stop 2409779f3096f HID: sensor: custom: Fix field sysfs group cleanup on failure 4cb3ff31d237a HID: roccat: free buffered reports when destroying device 4daf432c94a42 HID: picolcd: clamp eeprom debugfs read to bytes actually received 6cb7f9fed8f40 smb: client: harden DFS cache against invalid target hints 735abe4932355 smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV b89d678f9eafc smb: client: fix ALIGN() overflow in symlink_data() error context loop 3ff9462bb7a06 smb: client: clear ce->tgthint in free_tgts() 7f62817fe049b cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 01b0ec8c397be audit: avoid dropping live tree ref on fsnotify rule autoremove 61f085cb8976c ceph: bound xattr value length in __build_xattrs() eb3e1a1cb1634 ceph: bound num_export_targets array for mds info v2/v3 a294064e0e0f8 ceph: bound copied dentry name length in NFS export get_name c4addccd05bac ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode 19f16f04c2b01 ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock 6e5c6ce252b1e libceph: reject buckets with mismatched CRUSH ids 94ae5145c5206 libceph: validate OSD extent maps before cursor advance 1ce74d1b7770e NFSD: Prevent lock owner use-after-free during client teardown caddbeffab1ea nfsd: revoke copy-notify stateids before dropping their reference 70290db6c9802 nfsd: reject reclaim LOCK after RECLAIM_COMPLETE 1db456ffc22e0 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE 9caad13b7cfe9 nfsd: initialize copy-notify stateid before publishing it 3be1d8611dae4 nfsd: gate nfs3 setacl by argp->mask 8e4422b05f410 nfsd: gate nfs2 setacl by argp->mask 88bce7e326c36 nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo bee826c00ac90 nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget 59416992d1f58 nfsd: fix version mismatch loops in nfsd_acl_init_request() bfeac42d9074e nfsd: fix cpntf publish race in nfs4_init_cp_state 75268f6cfe26b nfsd: check client ownership when cancelling a copy-notify stateid 977e6f006a7a3 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref 9e8924bef5b50 nfsd: add filehandle match check to nfsd4_delegreturn() d823bf9285cdf nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() 3ef5e7a01a4d7 nfsd: validate symlink target length in NFSv4 CREATE 322422d66d1a0 nfsd: sample writeback error cursor before async COPY loop f8914ba102d7e nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types 6b13d26cc21b6 nfsd: Reset write verifier when async COPY writeback fails 085cfde7c2186 nfsd: release path refs on follow_down() error a080bb69d30f1 NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path 2ef1313239995 NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check 60680ae7243b2 NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock bfd1004ab1237 NFSD: Fix off-by-one in DRC bucket pruning limit 07615c1eb1d00 NFSD: Encode only the status in NFS-ACL v2 GETACL error replies 37a9d25a563f5 ubifs: fix out-of-bounds read in signature length check da7a80ddc610a of: fix out-of-bounds read in of_alias_scan() stem parser b313edfbc0c2a nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation e21cccc29b840 media: vicodec: fix out-of-bounds write in FWHT encoder 1b4fdefd788db media: cec: stm32: prevent out-of-bounds write on RX overflow 60c74f42f5abd lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() c5c60260a07e6 HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature 8f3365ed2a5db fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write b0a6bfac0c3c3 usb: gadget: f_fs: Prevent deadlock during ep0 read loop bec7708eb3b52 usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() eef3e62f90d86 usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() 79dbedf40ad93 usb: gadget: midi2: remove default configfs groups on teardown 95cf1b50ba6b7 usb: gadget: snps_udc_plat: clean up PHY on probe deferral 891a8d11f4d5e usb: gadget: u_audio: Fix use-after-free on sound card disconnect d82cfb853c5d4 USB: phy: fsl-usb: fix missing static keywords f09b3f48ff650 usb: dwc2: gadget: Exit partial power down state when changing USB pull-up c881f5b175fdb staging: greybus: hid: fix SET_REPORT return value 2ac009a65d238 Revert "media: v4l2-dev: fix error handling in __video_register_device()" bd8881c24a952 rapidio: mport_cdev: fix use-after-free in dma_req_free() 261c958b6acb1 powerpc/powermac: fix OF node refcount f4ae79b5f0013 device property: fix infinite loop in fwnode_for_each_child_node() 3a8534664426c tracing: Fix use-after-free with same-name named triggers ceb1707aef582 tracing: Fix crash passing ERR_PTR to kthread_stop() 33ce55b368b64 tracing/user_events: Clear copied tracing state before fork duplication 3eaf78e6571d2 hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() f3ed36a608d8b x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() 220011fe95fc7 x86/tdx: Fix off-by-one in port I/O handling f668affa147a5 tools/compiler: match glibc 2.42 definition of __attribute_const__ 8bf21ad365730 mm: memcg: stop reclaim when a limit update is superseded 029c9408049f7 mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() 4757542649af5 mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() f93f15541f224 include/linux/list.h: mark list_add and __list_add as __always_inline bdfda99c57638 timers/itimer: Zero-init old itimerval before copy to userspace da268a44d773a powerpc/pseries/iommu: switch to Default DMA window during kdump ebba4d0aeba0e clocksource/drivers/timer-sun4i: Advertise a real minimum delta 7b5771d0bf176 alpha: don't leak hardware-fabricated FP exception bits to user space e5038d7f36037 alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally 184870af0e73f perf/x86/intel/uncore: Fix die ID init and look up bugs d258cdce50ff3 ALSA: aloop: Fix peer runtime UAF during format-change stop 0e6245b2424d1 ALSA: aloop: Fix racy access at PCM trigger e150f273cd8ed ipv4: start using dst_dev_rcu() 40acb0537963f net: dst: introduce dst->dev_rcu 49b02a9d11c73 ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] 19ccd78a4e7c0 net: dst: add four helpers to annotate data-races around dst->dev 73b7a11814838 Revert "arm64: mm: Don't remap pgtables for allocate vs populate" Signed-off-by: Bruce Ashfield --- .../linux/linux-yocto-rt_6.6.bb | 6 ++-- .../linux/linux-yocto-tiny_6.6.bb | 6 ++-- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++---------- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb index e8d1f9da07..8a31bbfd09 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb @@ -14,13 +14,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "f92c1779022032aac8134ccb9e75365b19f6c596" -SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" +SRCREV_machine ?= "9b87590f4fb1e0d54ae9153f9e4fe84cec61f13e" +SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.6.156" +LINUX_VERSION ?= "6.6.157" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb index 03889d329e..3904ba1d1c 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb @@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc # CVE exclusions include recipes-kernel/linux/cve-exclusion_6.6.inc -LINUX_VERSION ?= "6.6.156" +LINUX_VERSION ?= "6.6.157" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "d9da23dffd2dea6dcfa986e0aad77898a7b373da" -SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" +SRCREV_machine ?= "a56c1dbe33dcd7b71df3b2703ceb95692edd9579" +SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb index 2632a4ef2f..da3c5dd6ea 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb @@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base" KBRANCH:qemuloongarch64 ?= "v6.6/standard/base" KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "f05eb652ce405932e2f47a78f721d1c2c5859e80" -SRCREV_machine:qemuarm64 ?= "2f7ef6e4d70eadf8f8b110cd81cfcafb2bb038fb" -SRCREV_machine:qemuloongarch64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_machine:qemumips ?= "1434d63083252688215ad6f5f6af122ead5865ee" -SRCREV_machine:qemuppc ?= "fc69e9d8f99c5c151415f6ba9f1e0428bb7e8e84" -SRCREV_machine:qemuriscv64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_machine:qemuriscv32 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_machine:qemux86 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_machine:qemux86-64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_machine:qemumips64 ?= "7969f6574cf5b126fa6eb28f33d0f2bcd8e7da5e" -SRCREV_machine ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" +SRCREV_machine:qemuarm ?= "f762f9a437240aebfb663b9f08166b6978411ad3" +SRCREV_machine:qemuarm64 ?= "efde6579b1968f396f4718ad939aeb6859f17012" +SRCREV_machine:qemuloongarch64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_machine:qemumips ?= "d7bc8d3db82714ebe46bde3e69f9dcbef7ae6e48" +SRCREV_machine:qemuppc ?= "b8bafdf6f040163a1fe0eb91c7b419452e3590b4" +SRCREV_machine:qemuriscv64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_machine:qemuriscv32 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_machine:qemux86 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_machine:qemux86-64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_machine:qemumips64 ?= "fa48e020815730c4ff228c0e8d42836d68ac4b4b" +SRCREV_machine ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "8b73de7da85fde281a385e0b26eda9bffd3ca477" +SRCREV_machine:class-devupstream ?= "79643295eba17affbd16ca97f3ef04c90266b28c" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.6/base" @@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.6.156" +LINUX_VERSION ?= "6.6.157" PV = "${LINUX_VERSION}+git" From patchwork Thu Oct 29 03:44:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bruce Ashfield X-Patchwork-Id: 102307 Received: from mail-qv1-f42.google.com (mail-qv1-f42.google.com [209.85.219.42]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4573.1793245547806136111 for ; Wed, 28 Oct 2026 20:45:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=EiIXoLoq; spf=pass (domain: gmail.com, ip: 209.85.219.42, mailfrom: bruce.ashfield@gmail.com) Received: by mail-qv1-f42.google.com with SMTP id 6a1803df08f44-917bab38b14so19303356d6.3 for ; Wed, 28 Oct 2026 20:45:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793245547; x=1793850347; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=jnPr8d8NJGOlTOVXBs34aam142XSd0ihmRKOqLJe8+w=; b=EiIXoLoqr1oXHfxWpGc0RdYWrMbQ7x3YQ0nTLGkAR0FrAGVlgNepHUL4unpQmETBOy +D99g43Xx3LN5KuRK84ITi7GuT5WZMoq7066x+NZIV2ctIVmKZQdGiHrgVWmQHsUi/te M9yXzNF+xDNUFrsuH5ZTkVQudQANmexH7LbbdSDXYKAKBYoFDGBbZpln7hzCaFa+MKXI KCA7Qhu4CcZLlGCqTX3M5hMGA7AndVflYkifmh+8v+0iIuXegl47czJTaly0ZgC5O4mL dqjxFjSXOdh5WfuSzHDyt4Uz9Dfpn0BKo79945IFjRhLD3cMFESIceJCkeGmob7+cqI/ 6w/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793245547; x=1793850347; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=jnPr8d8NJGOlTOVXBs34aam142XSd0ihmRKOqLJe8+w=; b=vRjThHfNQecVGFY8iGzOKy718u/yPwkP0cRNJIL6DNkYBSzTrdWhqHERj6fxIxyYRo vsjxwnldrJXG2gAustcaVTgM0bdu5JKCM5zabW5dObO+B2BRNOXbLcSULrEDxiiF3EJ2 ImjmzhzUa8Or6k55TmGymWh0VuzhTueekbtHWTiy4S1lkUb/w+B23vngbJcgjwfVFYSr 36Dmf0sikax2Jqy0s+Dt/xTUACvWwJ+Vg8RNAU13cTsxrJHFruxrOaNU9EZ/ypnDY6UR 71fJLZojzlrFZJCSobUMqFMs2gfUkE/Ksk0bQJOD/y02pcM9xAwGg7UOm3g5C9UcK8hj rjXA== X-Gm-Message-State: AFq9FYIuQP6YwJVen6bN4E6SAY6kx4/K7z2we0Adpagcz1ghTuJEaGHt oN5UmD7DxJkr2RYWUABtO/o7YboRTB0WsW0bXfsk+EAsBjzOk4GRWoND3/cCurSv X-Gm-Gg: AYBFou0tAQSIGQAu7inJ785pN8AIpQc38NpnPEXHKsFjBdC3TThV2rbtMxQ/dIP5gKC O6QrMXZm+KyAHwhAkGv5UMwNIlx1VZn78Zm8+doLO95eVTnY0QfhZ7ZqRLcgL/LqichlAmIEEAk VHlGLTkyV7cYy5cafUwb7AbBlkDYkhiLb5VVooj/2GH9pDEO0vhXj68qRgKyrFKaUIZN+5/yPY8 OvHkiGMJwKYRDq9j0lSWPrrEopnNVOgUj30bXxiEp5I38JucDwb0sTlXu1speL1TOUUjasKh/kd 8F/gLnFN9NPi+Q0DeXgfZPSUyXkj6yqBNuziAjlR9CTC48NQNfoLeHjn/3AaPNxX/CeUJfYe95x +WlzgdqCzDOoLi9O/XpqktTVYTAKlLY3agImBXymHbARSqoyvxq7hHiwZHtd9EhlMEnBpEwFyRA QqLNzL154ZazuKvfk5AeOLrAhUbsVaAhpWv3Od1LnSTlA8zNrdJRz60POEYtmBvNRPT9lXi2xrr NBXOJfiyU2i3F1VxiW3gnL0ehg1/0XvYdSgg0Uxq7RtbA3II+HhUWOBS9Qg6bOry2rerDGTOMAB 2b9FKSjWG2jsYioZs//t3eAdmBCbEUsdHaPLahKe5vN0uQdgh7DkvM6rsWAF/9wezx962il0dQM 9yly5C28A69dYXzTurUd8RgEFe52e5yDsA4Y0/+ZeN9mbVPP/ZNwqw8k0p/wNSxGNg+NNLrQlQw 8uuF63YJJxGIGDSqLecGvNq1oeeZ9TNyeO+IhcEHIrd7E0Uw== X-Received: by 2002:a05:6214:3a86:b0:912:517b:9753 with SMTP id 6a1803df08f44-91c7d1f2729mr60589986d6.45.1793245545046; Wed, 28 Oct 2026 20:45:45 -0700 (PDT) Return-Path: Received: from bruce-XPS-8940.localdomain (pool-174-112-35-248.cpe.net.cable.rogers.com. [174.112.35.248]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91c47c16569sm147542096d6.18.2026.10.28.20.45.26 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 20:45:26 -0700 (PDT) From: bruce.ashfield@gmail.com To: openembedded-core@lists.openembedded.org Subject: [meta][scarthgap][PATCH 03/07] linux-yocto/6.6: update to v6.6.159 Date: Wed, 28 Oct 2026 23:44:59 -0400 Message-ID: <20261029034503.3153661-4-bruce.ashfield@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261029034503.3153661-1-bruce.ashfield@gmail.com> References: <20261029034503.3153661-1-bruce.ashfield@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 03:45:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248879 From: Bruce Ashfield Updating linux-yocto/6.6 to the latest korg -stable release that comprises the following commits: cecd39af8a1ab Linux 6.6.159 742f73df544e0 ipv4: free inet_opt and ireq_opt after an RCU grace period a65f69e0f38ff ipv4: validate checksum_start before completing checksum 33aa3b7f4afbd netfilter: nfnetlink_queue: unbreak SCTP traffic a91a6aa9253c6 Linux 6.6.158 81e82340170ae net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling 3c83e90204359 crypto: atmel-ecc - avoid stale fallback key after set_secret failure 6989f298103f5 netfilter: nf_tables: don't queue packet path object notifications f268099fc0e38 netfilter: nf_tables: place base_seq in struct net 7b74a4f71ca50 netfilter: nft_set_rbtree: Remove unused variable nft_net bd33cb19bcb43 crypto: virtio - bound the akcipher result length ca84bef594538 crypto: virtio - Drop superfluous [as]kcipher_req pointer 895ab908ade68 crypto: virtio - Drop superfluous [as]kcipher_ctx pointer ba7b5b5e35407 crypto: virtio - Drop sign/verify operations 9efc6119bfbe1 crypto: virtio - Less function calls in __virtio_crypto_akcipher_do_req() after error detection b38d7a4bc9c17 vlan: fix skb_under_panic and races when toggling HW VLAN offload 7eca6b809c1d4 vlan: defer real device state propagation to netdev_work debf9f50140b3 net/packet: defer vmalloc TX_RING free until skbs finish b4ac2a5ce5a96 gtp: serialize PDP context updates 301f4a3303b21 usb: xhci: bail out of setup if the controller is inaccessible 9e85ecc77ffa0 usb: xhci: simplify handling of Structural Parameters 1 values 608efac1ba6fb usb: xhci: use cached HCSPARAMS1 value aa709b4f370e0 usb: xhci: implement USB Port Register Set struct 4687b927c6ab5 usb: xhci: add USB Port Register Set struct c02a85ecd92db usb: xhci: add helper to read PORTSC register ade5ca589d2f5 usb: xhci: add tracing for PORTSC register writes 1c3f4b15eb185 ALSA: hda: Fix missing pointer check in hda_component_manager_init function 73853208a497a drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() 6b38ca1c9dd47 lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected 0c5b7a12e1751 lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected b4a3e1bb94091 tools/thermal/tmon: Fix compilation warning for wrong format cc91c461cf390 nvme-fabrics: use reserved tag for reg read/write command a99d4f0c43eaa perf test: Change all remaining #!/bin/sh to #!/bin/bash fb05e973698f4 drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() e2379b2e343e3 drm/amd/display: Validate function returns 336bc3461b1c7 drm/amd/display: Check null pointers before using them 15403445b873a drm/amd/display: Ensure array index tg_inst won't be -1 3218df42ff3b1 drm/amd/display: Add a dc_state NULL check in dc_state_release 9a38ba5561d96 wifi: ath12k: check M3 buffer size as well whey trying to reuse it 7e323cb557053 wifi: ath12k: fix kernel crash during resume 8c78593cf1229 net: tls: fix silent data drop under pipe back-pressure bc262c6d32b6c cxl/mem: Fix no cxl_nvd during pmem region auto-assembling 5eaa11c500ed0 bpf: Defer work in bpf_timer_cancel_and_free 4b48228eebce2 bpf: Fail verification for sign-extension of packet data/data_end/data_meta 5be32f1ca915c xfs: fix blockgc group quota scanning when usrquota isn't enforced a40671025e915 smb: client: validate POSIX create context length e4c49012708c9 smb: client: fix create context out-of-bounds reads 84ae3cfd7d3a6 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO 524e0450dd9a3 Bluetooth: mgmt: fix race in read_unconf_index_list() 8c7556c7cd17e Bluetooth: L2CAP: validate frame length before control and FCS access ff28e6c67143c Bluetooth: ISO: balance the parent hold in hci_bind_bis() 68f0bcc4e16e3 Bluetooth: hci_sock: reject out-of-range OCF values dca25c204f71b Bluetooth: hci_sock: validate event length before filtering 10f959cb43521 Bluetooth: hci_conn: fix CIS hold ownership on reuse c5efcbf06d648 RISC-V: KVM: Fix HSM hart status error propagation 2af03b606aada RISC-V: KVM: Synchronize hrtimer callback during teardown dbf30e661ceb9 s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() c0ba61180d153 pinctrl: single: free the IRQ on domain creation failure de96dc11aee0d scsi: libiscsi_tcp: Check the data direction of a Data-In PDU 144ad477c381e nfc: port100: reject frames whose declared length exceeds the received data 066205553a010 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() 19bcfc2a56d0b nfc: fix use-after-free in nfc_get_local_general_bytes b89249819a7d6 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read f49da48bd679c netfilter: ip6t_rpfilter: reject routes without inet6_dev b895bd3267e5a net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() 9a7140ea89a09 net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist 1d8c85359b507 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read 57b55367b6e3a net: atl1c: fix soft lockup on out-of-range tpd_cons read de41ee24f77b0 net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry 2f57cef1a17cb net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() 632cd7b81cb7b net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read 1b08c5c3ac27c net: arp: terminate device name before lookup 6c9f07bf88001 net/sched: reject IDR error pointers when deleting actions ff384b1bd7228 net/mlx5e: advertise MACsec offload only when supported 288721013605b net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() 65e7c4b5366b7 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() f4c21a259b4f3 HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard 5a8ad63158165 HID: alps: fix use-after-free on input2 registration failure ccd32fa3489cb PCI: of_property: Omit bus properties without a subordinate bus 822e8a473391e gpio: tps65219: Fix GPIO input value reads 9571ab7493561 drm/virtio: fix NULL pointer dereference on fence allocation failure 43bfe2b60c149 drm/virtio: fix memory leak of fence event on execbuffer failure 9924c1d64405b drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() 74485cdc34306 drm/nouveau: Fix gem reference leak in validate_init() f09f4a536935b drm/nouveau: fix double-free in nvif_vmm_dtor ac4f1d28498b9 drm/nouveau: Fix bridge reference leak in nv1a_ram_new() 1971720e6a979 drm/nouveau: fix autosuspend cleanup during teardown 5c857b2e6e755 drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() 2c1a643942caa drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() 96833fbf28c03 drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() daeac72644124 drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() c53db9cc24521 drm/i915: fix incorrect RCU teardown order 49ba5ed012990 rds: ib: Clear the sg list when mapping an MR fails 1937222c2511a llc: reserve device headroom for allocated frames 25c08be2a5e77 gpio: zynq: fix runtime PM leak on request error path 9d8d6cddcb7c0 gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() 66bf65fa10932 ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST dc92cb972e867 ipv6: do not let ipv6_find_hdr() return an offset past the packet end e560bdf62b11d fsl/fman: Fix clk reference leak in read_dts_node() ebf1555ad2821 writeback: report a Tasks-RCU quiescent state per cgwb drain pass 513121e693886 workqueue: Fix NULL current_pwq deref in flush dependency check c96b4d1628868 writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes 3bcc1624cc1cd fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT c698f6deabf68 ata: libata-scsi: bound the ATA passthru sense descriptor writes be1aacff399d5 af_packet: fix integer overflow in prb_calc_retire_blk_tmo() 1cd246b214dc9 sctp: discard the rest of the packet on a stale-cookie error 80a9ccfc24d37 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow fc8df272af64f x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 301bdc558a5eb af_unix: Drop all SCM attributes for SOCKMAP. 00e370627f2e1 netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase 3c5a6fa3fa004 rculist: add list_splice_rcu() for private lists d989c14cd70ab mptcp: return sk_wait_data() errors from recvmsg() a8f50c545ea5f perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs() 599491e83e459 perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused ed7ba11ed0859 perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED 5bce700da0580 perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits a58593b501b7b autofs: fix sbi->pipe file reference leak in autofs_kill_sb() ca797491f0ae4 vlan: ensure sufficient headroom in vlan_dev_hard_header() f623fe69f210d net/sched: sch_teql: fix shadowed err in __teql_resolve() 1f4ac6ef54579 bridge: check llc_mac_hdr_init() return value in br_send_bpdu() d360b31f1a366 llc: fix skb UAF and leaks on llc_mac_hdr_init() failure b7d285a28a6dd net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails c691d78c33da5 tipc: Fix a data race on mon->peer_cnt in mon_timeout() 00a59600ae72d net/smc: fix UAF on lgr list traversal in smcr_port_err() c1b1639fb138d nfp: hold IPsec RX state under the XArray lock 71d45049b0d63 tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() bd172580e624b net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 90464d595eb95 bonding: crypto offload enabled, non-offload slave failover, rekey failed 9e841723ba482 net: xps: reject an out of range traffic class 45a67662bf8ce vxlan: use one headroom snapshot for neighbour replies da2e0cfbb620b ip_gre: Reject enabling collect metadata through changelink 97bb73b5a4672 net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT 075dca2b60dae net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr f1fd173aea9b7 net: bcmgenet: do not skip WoL power up on GENET V1 8055a4c6b9e38 net: bcmgenet: allow return of power up status b086fb2c4952e net: bcmgenet: move bcmgenet_power_up into resume_noirq ad0660587da4f net: bcmgenet: initialize u64 stats seq counter for all queues a61c0324e6187 net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems f187490352414 tg3: use random MAC address when tg3_get_device_address fails 4092f59d1ce47 driver core: Add device probe log helper dev_warn_probe() 7a527c6b27ba9 driver core: Make dev_err_probe() silent for -ENOMEM 65451eb5a4599 driver core: Better advertise dev_err_probe() edf51b8dea6e9 bpf: Fix BSWAP 32 and 16 on MIPS64 beeae92e70e70 bpf: Fix immediate JMP JEQ/JNE on MIPS32 7d20eab09eb43 vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets b2da5ed3d8c75 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() f0e8dba8c2249 veth: manage XDP program pointers during channel resize 290c4a021dd59 net/sched: act_gate: budget the per-entry list in get_fill_size ea82b75767932 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() 75bfd9ef4da2f nfc: llcp: fix slab-out-of-bounds reads when logging service names 6fad2c34d451d nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() 6295a085cb91d nfc: llcp: fix -ENOMEM on connect with zero-length service name 9fa21b0f78adb nfc: st21nfca: validate ISO15693 inventory length e43ec0191c163 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure f3083512a5bb5 nfc: virtual_ncidev: Add missing ioctl compat handler 9ba32ddb1cf91 selftests/nci: Fix out-of-bounds store on thread join 3b52335611593 selftests: nci: Fix uninitialized family ID on missing attribute 41256821762a7 nfc: llcp: Fix race condition in accept_queue lifecycle f2550d8a37878 selftests: nci: Correct pthread_create return value check c1e9ed52a6697 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() d4008c3499dba nfc: st21nfca: validate received frame size a4e56f57dd04d nfc: nfcmrvl: validate helper command length before pull e57f041943615 bpf: Reject dev-bound-only programs on other devices ad5b7fd1434a2 net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K 1d1d9e4f9541e net: stmmac: selftests: Capture all packets for vlan checks 27bd3b0ce2001 net: stmmac: selftests: Check the dev->features for S-TAG offload testing ddcc8b626b08d net: stmmac: selftests: Support running selftests on DSA conduits 9d3d39da05447 sctp: hold asoc or transport before mod_timer() in timer handlers 66ae85e15f1c6 net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports 6020d85204742 net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports 909f761868fda bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc ea4dc96c902cc bpf: Fix bpf_sock context code generation 1b923538598be bpf: Fix bounds check for skb-backed dynptrs 062849d19dd31 genetlink: report the real command id for dump-only ops in policy dumps 91be8331501f1 net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error 33f706884821d s390/debug: Fix NULL pointer dereference in debug_info_copy() 34cf1535a78b9 s390/debug: Do not register views for failed static debug areas e766321288b50 tg3: clean up PHYLIB resources on probe failure e1f5b74edccf4 net: usb: sr9700: include receive overhead in the length check c25587fa26761 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() 035f9b1809861 Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough 77a43e00c5748 drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach a9bb8f8fd5694 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors 88c60c06a2a52 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() 77dee8e9106d6 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() e2edd2d78d2cf drm/virtio: fix object leak when drm_gem_handle_create() fails e8f9979286f70 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget 21e206dd88b3d net: usb: catc: bound the RX packet length in catc_rx_done() 83b1a7f9e7188 sctp: avoid livelock while updating retransmit path 2731601ad277a ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). 245bea0c7ab27 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure d5d57501f543f net: mediatek: mtk_eth_sock: allocate dummy net_device dynamically 34c6214d0df49 net: create a dummy net_device allocator 88530b58fe0b3 net: core: Fix documentation 9767e57504739 net: Do not return value from init_dummy_netdev() 1d664be4ca49d net: gue: reject invalid REMCSUM offsets d512c484bd93a net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure 999a6c71a6aa0 drm/nouveau/clk: don't clobber reclock status when restoring volt/fan a867abcfa85ab drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update 15f52cbc35d4c ocfs2: make ocfs2_calc_xattr_init() return void fddc90d4af455 arm64: io: Reject non-user protection in ioremap_prot() 5128b8b0bdb24 netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name 2c23d95517547 ipvs: revalidate ihl before icmp_send d52caee4f0fcd netfilter: nft_synproxy: use the family-aware checksum helper d559e06a5ab7c netfilter: nfnetlink_queue: hold nfnl mutex in event notifier caa82500e231e netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation e20701843032c netfilter: flowtable: publish HW_DEAD after worker is done e87687b967dcd libbpf: Reject truncated ldimm64 CO-RE relocations a0b79cdfcf34b bpf: Restrict CO-RE poisoning to relocatable instructions 0fac292d93fdb net/sched: cls_u32: fix manual hash table handle IDR aliasing c251ed48bd906 bpf: Skip unsettled links in link iterator 123f90f394ca4 xsk: Use a 32-bit compare in xsk_map_gen_lookup 937cbeca0554a s390/cio: Guard PMCW field accesses with dnv check e364f5c677e81 s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points 0f0e459ccf390 s390/cio: Fix cio_update_schib() to not cache invalid schib 396d4b0be238a s390/pci/docs: Fix sriov_numvfs attribute name 5cf766c9cca44 docs: s390/pci: Improve and update PCI documentation 77d5f05ef79be scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() f8174bd3822c5 selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode 8fd91aa0cf78a cgroup: selftests: Move memcontrol specific helpers out of common cgroup_util.c 718a8ffa180d4 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel 5b467087928c5 Bluetooth: SMP: reject Security Request over BR/EDR c68e0068a236f squashfs: Add dictionary size range check to prevent shift-out-of-bounds 144d60ed22735 KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0 62cdbb3e096f9 KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save 2df1bc50a6633 KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry sizes 5ff24aa7af0bc HID: amd_sfh: Validate PCI BAR size before mapping a78414ede1dc6 pinctrl: meson: Fix typo in s4 group name dc98def81e3c6 bpf, sockmap: Fix self-redirect copied_seq double-counting a8a9becbac93a bpf: Fix out-of-bounds read of rtt_min in sock_ops 77a3b52b4455e bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() 911818b449196 HID: elecom: fix bus type for M-XGL20DLBK 23da88d1597ee tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context 5b4eb82475ae1 bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() 934e9ba9f8d05 bpf: Fix divide-by-zero in btf_struct_walk() f831c7bf53e91 selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc df0072be6fc37 bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL 7e748e6e007b5 bpf: Fix bpf_skb_change_tail wrt csum partial skbs 1572c4a24120f remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage 670fb8b0dbe0f netfilter: nf_tables: Simplify chain netdev notifier becc1f5adc77c netfilter: nf_tables: Tolerate chains with no remaining hooks 0c415aaaffbf8 apparmor: Fix 8-byte alignment for initial dfa blob streams 662e391e85af5 apparmor: Fix memory leak in unpack_profile() 7e3717466403b apparmor: free the allocated pdb objects 0b895b8faca11 erofs: fix large folio race in erofs_fscache_req_complete 17309187f12d7 spi: zynqmp-gqspi: Use devm_spi_alloc_host() 1ba2ffa759c5b selftests/landlock: Add layout1.refer_mount_root 8706e18922fb9 spi: spi-zynqmp-gqspi: stop the controller on shutdown 57230a74cf07d ksmbd: fix partial normalized name responses c3343cd7ec870 ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() ac51321d3b239 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() 5b24c8f815a44 ipv6: mcast: Don't hold RTNL for MCAST_ socket options. 776668d3424c3 ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP. 7157a0865debe ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. 8355220e6166a ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec(). d91b9a3b2b38e smb: client: fix missing iov bounds check in parse_posix_sids() 6f5f4785b98c9 smb: client: fix missing lower-bound check on DFS referral string offsets e78fc1d240b27 smb: client: fix server->total_read for compound encrypted PDUs 74995ee8305a7 smb: client: fix potential OOB read in smb3_enum_snapshots() 491e33144dee8 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs e3344bb0ff5ec smb: client: fix smbd_connection leak on cifs_get_tcp_session() error 53d82794f890a smb: client: reject short Next offsets in parse_server_interfaces() b5f924ffbfa97 smb: client: fix rlist race and missing initialization 180380272f116 smb: client: cancel reconnect work in clean_demultiplex_info() c46c47aef4982 drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure 48e46ea9b2c6a drm/msm/adreno: fix autosuspend cleanup during teardown 5f5e565410b49 drm/gud: fix out-of-bounds write in gud_plane_atomic_check() 0d1700394e9f5 wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver 16abf3f5d727a wifi: mwifiex: validate action frame fixed fields c4943323fda22 wifi: mwifiex: validate scan response extents 2402c9e2644b7 wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length bc83c04be042f wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST 42f4b03971f9d wifi: p54: validate curve data length in the calibration curve converters 612ed9224eae7 wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() 491df93b10d76 wifi: wilc1000: fix out-of-bounds read in P2P public action frames 05b5e297bbf46 wifi: wlcore: release runtime PM ref on regdomain config failure 00bea35892556 wifi: rsi: fix heap OOB write on key removal 41b1a4d545ec3 wifi: libertas_tf: fix UAF in lbtf_free_adapter() 85d847ff71fe7 wifi: iwlegacy: fix broadcast stations deallocation 856dabd5f2617 wifi: brcmsmac: fix UAF in brcms_free_timer() ef3c2aef001a6 watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() 135cf929db55d watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() 757c721545b9f watchdog: rtd119x: Avoid division by zero c52ba8375ff9c watchdog: msc313e: Propagate error code in resume() 1c4aabc88fee1 watchdog: msc313e: Fix premature reset during timeout update 08c58739c9984 watchdog: digicolor: Avoid division by zero c30b419c7e6fb watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog b81989ecf97d1 hwmon: (w83793) release probe data through kref f6e2ab72f32d1 hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove 3040bfd935599 hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 1209d2330bab3 hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding 66368f682a53f hwmon: (pmbus/core) increase number of phases and add new mask b6b2a638aa36c hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() c5e573bb095d5 Input: zero ff_effect before compat copy in input_ff_effect_from_user e2b6703465c1c Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound d06f72350d5d5 Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) 42c7afc0e5f5b Input: soc_button_array - check btns_desc->package.count fd9bc6c1e5c0d Input: soc_button_array - fix MS Surface Pro 11 probe failure 50dd585bee766 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() 84f863866adb0 Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P af5f7130cbf39 Input: evdev - zero absinfo before partial copy in EVIOCSABS b172c69e67bc7 Input: cyttsp5 - clamp the HID report size before memcpy e08c459870a65 Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 b266cbbad1a7a Input: adp5588-keys - cache GPIO state before registering the gpiochip 7e1c98cb7249e mmc: sdhci_am654: Reset command and data lines on failed tuning da4929ee78ee7 mmc: spi: reset bytes_xfered before retrying CRC failures 4adbd609686d5 mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt 72f4c2b7a4842 mmc: sdio_uart: fix xmit_fifo leak when the port table is full b84d29f2541c8 mmc: sdhci-of-aspeed: Remove children before releasing SDC resources cd19ae28eb545 mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 ae10838a7cdf0 mmc: mxcmmc: cancel data work and watchdog on remove c50d6515bffb1 mmc: hsq: Fix use-after-free in retry work ee47e50011c20 mmc: core: Fix OF node reference leak on card add failure 0bf3d168a2cc2 mmc: core: Cancel SDIO IRQ work before freeing host e77461af13eab selinux: always fill AVC decision in avc_has_perm_noaudit() 4d50ebe5a2772 selinux: recheck intermediate backing files on mprotect() caa1b913d90d5 selinux: preserve user SID across nested backing files 535530bb2ea52 IB/hfi1: Fix the PIO_CRED credit-return mmap 1b352c95a49a3 IB/hfi1: Resolve the credit-return buffer through the send context's node cf20d7476754c IB/mlx4: Fix use-after-free on pkey sysfs registration failure bf0252e908448 i2c: imx: disable autosuspend on remove ad793059a419f i2c: imx: release DMA channels on probe error 2f5e42edbd232 i2c: atr: fix dangling adapter pointer on add failure 3cb8ae257292f i2c: at91: release DMA channels on remove and probe error 3fd487c69ad31 KEYS: trusted: Fix tpm2_load_cmd() boundary check 6ecc3fef3db53 keys: translate request_key_auth pid for the reading procfs instance ce6009f753485 mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() 19c3da6621a25 memstick: ms_block: destroy io_queue workqueue on removal 937108dc0258d xfrm: serialize state GC with device state flush 39491a1ae9305 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() 6106fb1246ead net/packet: avoid truncating TPACKET_V3 private size 23cd30498891d net/packet: clear RX owner on VNET header error d8e2f1f0263b7 net/sched: hhf: cap hh_flows_limit at change time dd136f1fdd105 net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value 19b5e8dd884a5 net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain fba45070e25ab net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() a58024835c704 net: lan743x: fix RX checksum use-after-free 60459c670329d ipv6: xfrm: use full sockets in local error paths 89f5414660724 dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() aacd1c4cbe06a dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status b4025915131c6 dmaengine: sun6i: fix non-atomic read of DMA position registers 560ed4373c06a Bluetooth: hci_sync: Serialize local codec list cleanup a6da782fefae6 Bluetooth: hci_codec: validate vendor codec count length 3a640fee27ce4 Bluetooth: eir: validate service data length before reading UUID 063d409c54703 Bluetooth: btusb: fix NXP IW610 composite device handling df4920b133343 arm64: percpu: Fix this_cpu_and() mask generation 9397a97eba3d5 arm64: percpu: Fix this_cpu_write() casting 0b2144175502d arm64: dts: renesas: r8a779f0: Set UFS lane count 909e92423db72 arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc a8b826076a41e kselftest/arm64: Fix size of thread_data values for pthread_join() 8f282d12550e3 HID: logitech-hidpp: fix race condition when accessing stale stack pointer b2b84e73e0386 net: xfrm: reject unrepresentable espintcp transport headers 579d87ec1e1e8 openvswitch: avoid reallocating confirmed conntrack labels 2fbac8a56004b RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() ae805d204cf1f RDMA/ucma: Serialize join and leave on copy_to_user failure 1c8448db5cf35 tcp: exclude old ACKs from tcp fast path b5c9f2951d330 rds: ib: use rds_conn_drop() on protocol version mismatch 6f1977cea3e85 exec: Cleanup POSIX timers right after de_thread() 0338489960dda cifs: Fix server use-after-free in cifs_chan_skip_or_disable() a5a8b4737f68b ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY 6507055733a9d ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type 830012feadc22 ALSA: virtio: reset device before deleting virtqueues 5658739b54f5e Input: xpad - fix PDP Marvel Xbox 360 controller 1fb92056c8fcc Input: xpad - add support for Azeron devices 2e74f1f22a0e3 Input: xpad - add support for Victrix Pro BFG Controller 93e3eb481be0f wifi: rtw88: Fix the random "error beacon valid" messages for USB f689260c48fb4 wifi: rtw88: TX QOS Null data the same way as Null data fa252fe7dc329 net: cpsw: Execute ndo_set_rx_mode callback in a work queue 74852715757d9 net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue 7e22e5bcbfacf mm/huge_memory: use folio's memcg inside __folio_split() 2605eb9ba3bbd btrfs: abort transaction on failure to update inode for hole punching and reflinking 71d45a04ea99c btrfs: remove redundant root argument from btrfs_update_inode() a66b626d3b4b7 btrfs: simplify error check condition at btrfs_dirty_inode() b7c7f07a40037 drm/amdgpu: check ras and obj before dereference 6569fd85b0ef9 net: mvpp2: prevent buffer overflow in page_pool allocation afaddc3fbf2ae net: macb: fix ordering around PTP timestamp read 472493d1d3334 net: ethernet: cortina: Ack RX overrun interrupt correctly 17b2a1eb97fdb net: lock the socket in sock_gettstamp() c10101baba9d3 net: netsec: fix device_node reference leak on phy_np aeec38e773c66 ASoC: hdmi-codec: Report a change when the channel status moves 9cc2fae796b79 ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments d6a1779129d93 powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba c41088b2765af KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure e37fba1ba6938 KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() d54a044136b12 drop_monitor: fix out-of-bounds write in reset_per_cpu_data() 86f1151aa6ac3 drop_monitor: synchronize tracepoint unregistration on error path ffc448eb54f5b pppoatm: ensure a writable skb header and linear data c741977e413f5 Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup 3b00027c71345 Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown ad13c739dedcc Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events ea8a262662be6 Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() 4a33886057e6d dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() a444c0115665a ksmbd: keep compound responses on query info errors 2107d60053c88 ksmbd: fix partial file information responses 39685131e5bda ksmbd: return buffer overflow for partial filesystem info 9a4f49bf8d2da tcp: do not let tcp_rmem be set below 4096 b727e3d58cb90 tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). 6b431b6321985 net: bridge: mst: move switchdev call outside rcu 50b1adbb39fc0 wifi: brcmfmac: fix lost 802.1x TX completion wakeup 822903ed99197 net: fddi: skfp: fix NULL deref when setting the MAC address while down 83aa83f81a8fe ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup 5130afa025c95 seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation 35cbe34c3704c drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL a7cd161e4ba2b btrfs: tree-checker: print dev extent offset in error message 0a52ba6d3b268 ALSA: hda: trace PCM open only after assigning a stream b6beee927e7f4 drm/vc4: Use managed KMS polling to fix UAF on unbind f1a232fdc1012 drm/ast: Automatically clean up poll helper e8304e25c6dab wifi: virt_wifi: don't transfer operstate before register 246de677552fe ALSA: 6fire: fix OOB write from device-reported iso length 8b8559aeaba2e ALSA: usb: 6fire: Avoid embedded URBs 910bde5a7f188 ALSA: 6fire: Clean ups with guard() aff058605007c Input: trackpoint - fix the inertia attribute name in the ABI document 686c7a6af1eea ALSA: pcm: set timer->private_data before registering the PCM timer d54a90f2b9376 phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting 5d6c7370d515e phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow c83d6b0a65f7b ALSA: bcd2000: Fix race between rawmidi and disconnect 3d5f7e77b2e1b keys: fix lost wakeup when reaping a dead key type 780716e2e0191 drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr 136cb27bf8f5b perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations a43cd2b67b91e netfilter: flowtable: hold reference on ct until flow is released e4982c489ee35 netfilter: nft_nat: fully initialise new_addr in netmap setup eb4d7a9469704 RDMA/siw: Bound fragmented header copies by the remaining length c767e2812cac8 RDMA/efa: Keep EQ resources alive while IRQ is registered 00f7df59543cc RDMA/efa: Keep admin queues alive while IRQ is registered 87793933dc54f dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA 209cf79a4f8a6 dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order aaf4ae1730d40 scsi: qla2xxx: Fix the ql2xfc2target parameter description 7343f2575868f mm: memblock: show all region flags in debugfs 420fcc2fdeae6 wifi: mac80211: set up the TX info early to fix failure paths 7e32c6ed25548 wifi: mac80211: rework ack_frame_id handling a bit b51f5a310bd68 wifi: mac80211: mesh: release the channel if start fails be7bfdea1ec9b wifi: mac80211: add HE 6 GHz capability in the scan elems len f17a3fb26beca wifi: mac80211: don't access the TSF of a down interface e4bb995f61e23 wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set ed8d5f5b74d0f wifi: mac80211: don't allow link changes when iface is down d0afa5395c46d wifi: mac80211: require a peer station for TDLS setup confirm 7775759e3cb35 wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown c4e4fe330294e wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping 20a56e96a6f7b wifi: mac80211: unlist vifs when their netdev is unregistered 06f1c819700db wifi: mac80211: suppress chanctx warning for debugfs reset 790221efbfece wifi: mac80211: don't offload TC setup on AP_VLAN interfaces 65fdb973bd905 wifi: cfg80211: don't filter by BSS type when removing stale entries 73365b81630b5 wifi: cfg80211: only group hidden BSSes with beacon entries 8577a5ec4f7e0 dmaengine: wait for RCU readers before releasing dma_device 07eb075b60d56 dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() 7c3f4ce651d43 dmaengine: Fix device kref underflow in dma_chan_put() cee7e641245c3 dma-coherent: report a failed reserved memory assignment c9cee0989b55d dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask dd579fd27593d MIPS: Octeon: apply USB FDT fixups also when USB is modular c58a21667bd5e soundwire: cadence_master: wait and cancel cdns->work before clock stop 12c0abd4d1c1b wifi: cfg80211: check IP header size in cfg80211_classify8021d() 326f7d34bd7e6 IB/IPoIB: Avoid restoring OPER_UP after multicast flush 46aa75291056b wifi: libipw: reject too-short association responses 14ae269c13060 wifi: libipw: reject too-short beacon and probe responses 2761b21cb896b wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 36727a702cf8e wifi: virt_wifi: free skb when disconnected 3eff16074d061 dmaengine: sprd: Fix runtime PM reference leak in probe 6f8020fe7465f RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted aacfef2480876 RDMA/irdma: Enforce local fence for IB_WR_REG_MR 752b30e9d3390 RDMA/mad: Fix receive buffer leak when PKey enforcement fails 505b242d93516 IB/isert: wait for deferred control PDU completions before releasing the connection 9d145a2d8d6f8 IB/iser: reject a remote invalidation of an unregistered direction 45c60ffc79771 RDMA/core: Reject unregistering netdevs in ib_get_eth_speed 1c4cc9f0d8f45 net: convert dev->reg_state to u8 c79a789aa1518 RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds 56b7a9d89c679 clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate f17865332cc4c firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS b7d2118660545 RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access 08f12745cb729 RDMA/rxe: validate access flags before swapping the MR's PD 030306bbb9273 RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept 70d509b6bdf74 RDMA/siw: Cleanup siw_accept 0b6ac53b6bd5f RDMA/siw: Introduce siw_cep_set_free_and_put 5219c5652b2f3 ARM: socfpga: select the PL310 erratum 753970 workaround 69a768c12398c esp: downgrade zerocopy managed frags before mutating skb frags 0cda8273265d3 xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() 2b63341e2ebc9 xfrm: fix compat ALLOCSPI request use-after-free 60610a5dab6ed xfrm: avoid RCU warnings around the per-netns netlink socket f1fde49cabc90 ipv6: Honor oif when choosing nexthop for locally generated traffic 8a13003b50b97 ipv6: Select best matching nexthop object in fib6_table_lookup() 4bc97d3bf5d72 media: video-i2c: fix buffer queue ordering 04317f3fb8be2 sunvdc: fix -EIO issue due to lack of retries 9a622ea3662c8 selftests/landlock: Add tests for whiteout object creation b6e45216aecc8 Revert "alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally" f5d1ea9bb08d9 Revert "alpha: don't leak hardware-fabricated FP exception bits to user space" c337c14afcf7e selftests/landlock: Add disconnected leafs and branch test suites b15ec9fef1b16 selftests/landlock: Add tests for access through disconnected paths 82e198df9c252 Revert "hwmon: (emc1403) Rely on subsystem locking" e08063fb0d02f Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature" 0a926b5df8efd mptcp: close race between scheduler and state change 1962841387087 mptcp: avoid unneeded actions on subflow reset ddbf9f03c1cc7 mptcp: fix bad accounting in __mptcp_subflow_push_pending() cf6e04377bdde Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config 9107e43ba1e03 workqueue: Update documentation as per system_percpu_wq naming 1100e075a0e09 netfilter: nft_set_pipapo_avx2: add missing vzeroupper 2c8fa22997892 crypto: sun8i-ce - Remove crypto_rng interface a41e4ba94ad45 crypto: sun8i-ss - Remove crypto_rng interface 99f4d3120b244 fou: Fix use-after-free in fou_create() 542c1dd41e1b0 net: appletalk: fix NULL pointer dereference in aarp_send_ddp() df077253f6405 i2c: smbus: reject oversized block transfers in the common path 938e8d6cee8d3 ALSA: us122l: Prevent write upgrades for read mappings 05d47f540d85c net: usb: pegasus: don't rely on id table pointer arithmetic be5996349328b media: as102: do not rely on id table address comparison 0bbcbe9f7cfce usb: serial: spcp8x5: don't store usb_device_id 367af2b4d5168 usb: usbtmc: don't store usb_device_id 8cb99d4a71593 wifi: ath9k_htc: don't store usb_device_id 5086f5639197f usb: xusbatm: don't rely on id table pointer arithmetic 8f4422c14d6a2 perf evsel: Add per-thread warning for EOPNOTSUPP open failues 44441aa9630fa Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems" a3ca496b63fb9 Revert "selftests/mm: report unique test names for each cow test" 289dfa824fb24 Revert "selftests/mm: skip COW tmpfile cases when fallocate() is unsupported" ad1be9fe255b4 Revert "nvme: apple: Add Apple A11 support" 187187eea3441 Revert "nvme-apple: Drop the PRP null check chicken bit" eb51cbf1b091c Revert "nvme-apple: Prevent shared tags across queues on Apple A11" b66ef13b72f4f Revert "nvme-apple: Reset q->sq_tail during queue init" f91df9f3ed6ca Revert "arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries" bddd4544e80b2 Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries" 492c1a89a5c94 Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries" a0441be048ddd Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries" 654a2e749883b Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries" 91d04c96ef14b Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries" 6805046d2db02 Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries" c2bf1299aeff6 xfs: bail out on bitmap errors in xrep_agfl_fill 2cc0af2204070 xfs: count escaped corruption errors in scrub stats 201995b1e9839 xfs: signal inode btree xref error if get_rec returns an error 6e55aac5a1008 xfs: snapshot old AGFL before rewriting it e0873cce0e132 xfs: snapshot scrub stats when rendering them d5cea6766ae18 smb: client: fix heap overflow in DACL owner/group rewrite e9c5bcc88b833 smb: client: avoid leaking refcount when cifs_sb_tlink() fails de2a6bcff2659 smb: client: avoid leaking refcount in cifs_queue_oplock_break() f73341e1ef134 smb: client: fix file type corruption in wsl_to_fattr() 0f723c20d2ced smb: client: fix file type corruption in cifs_reparse_point_to_fattr() ff411fcbfc55e smb: client: fix one-byte OOB read in smb2_parse_native_symlink() 3c9acc9835c30 smb: client: pin DFS superblock in iterator callback 17c93bcd17755 smb: client: reject userspace cifs.idmap descriptions f00c31be52f5c selftests: mptcp: fix an UAF in mptcp_connect.c 360d99258a640 mptcp: syncookies: remember the request backup flag a2431bea521ef mptcp: subflow: no need to copy thmac during ulp_clone 654381b0b176e mptcp: options: handle MPC data + csum reqd + no csum c3eb07e78e628 bnxt_en: Propagate RX ring init failures in bnxt_init_nic() cfec9e7f15a56 bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() aae9a450af63e bnxt_en: Only restore LRO if the device supports TPA 1afaf85c4990f media: v4l2-ctrls: validate AV1 tile counts 724915535558b media: v4l2-ctrls: validate HEVC tile counts 95ee48eb17c91 media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity 8659e5fc21a82 media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer 279fb47254f37 media: v4l2-h264: Fix memcmp() size in B1 reference list comparison f19acf00818a9 media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity 2887a98c03d97 media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity 98018ea5a682a media: hevc: add bounded tile-count helpers 137c1b88507a4 hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS e9fc7d53b2eb3 hwmon: (gpio-fan) Fix use-after-free in alarm work 716beceaf70c1 hwmon: (applesmc) fix key backlight workqueue leak on register failure 991c875310254 s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm b3f8200ec5285 s390/qeth: allow bridgeport queries despite OS_MISMATCH 5f33ae947f52f KVM: PPC: Book3S HV: Set irqfd->producer only on success 4826fd8373f68 mac802154: fix use-after-free of sdata via queued RX frames 652d9caa5ac92 ipvs: reject invalid states in connection template sync records 3080f9e653d8c ipv4: fib: bound automatic table ID allocation e3b4681197aa0 ieee802154: hwsim: serialize pib updates to fix double-free 543994fa03c36 ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink ff83367cda8ee inet: frags: invalidate queues before flushing them de5a0eda59fe4 fbdev: vfb: defer cleanup until the last reference b534dca2db93c scripts/sorttable: Mark long_size as __maybe_unused f464fde4fd880 vdpa: solidrun: Free IRQs after request failure 123acfd63d767 vdpa: ifcvf: Put device on unsupported feature error b6204011c79eb netfilter: report NLM_F_DUMP_FILTERED when all is filtered out 90166834b7dc6 netfilter: nf_log: unregister loggers before per-net teardown 76678217cdabc net: openvswitch: fix use-after-free of the flow table mask array 0b3425fd0ecd5 net: mpls: clear inner_protocol when the last label is popped f7d76b84b9206 net: mana: Reserve extra CQ slot for the fence completion CQE 84ba968d7b35c net: hso: fix TIOCMIWAIT race 9e28471d22a49 ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() 362c42720259f drm/i915: Fix memory leak in query_perf_config_list() 506cfed91e50c drm/drm_exec: fix up contended obj when num_objects is 0 3feb4020bfb7c exec: do_close_on_exec() before taking exec_update_lock b22193eea2ce3 cpufreq: initialize policy rwsem before sysfs publication 06f273d29e5e0 cpufreq: zero-initialize policy cpumask before sysfs publication ba96047bba4a6 Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 45021eb562114 ASoC: sti: initialize IRQ lock before requesting IRQ 1467e3989c6ed ASoC: sprd: validate compress buffer sizes against fixed allocations fe05eeed27128 tracing: Keep the entry count when the histogram stats allocation fails 01966c9569230 tracing: Let histogram values keep the percent and graph modifiers 3d42fed18b2c5 tracing: Free histogram the field rejected for a bad modifier b513a4c60a7aa tracing: Free histogram var refs regardless of how often they are referenced 4924328d6991f tracing: Free histogram the var ref when its initialization fails a3d9b8b7c8f36 tracing/user_events: Don't destroy fields when event removal fails 757aa9f548c18 tick/broadcast: Plug clockevents replacement race 7cd398799eeb6 tunnels: Drop stale dst when building an ICMP error for PMTUD 58c0c414b2b8d ufs: validate cylinder group metadata before caching it cd21f1ff74b1c ufs: create the root dentry after loading cylinder metadata c9e4a2c11ff61 watchdog: sunxi_wdt: preserve boot-enabled watchdog c42eadbcf68ca dm/amdgpu: fix malformed link_settings debugfs output d170cfbe38c88 ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf 3570468cc34e7 ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough 98da3379cdee3 tracing: Fix memory corruption from the histogram stacktrace modifier 14fdaba201fdf ipv6: fix fib6 walker UAF on seq stop b5dec6dfb593d x86/mm: Fix user-space data loss with MADV_FREE and THP b0c201a596816 crypto: x86/aria - add missing vzeroupper in AVX-512 code 3dee28df79cb7 crypto: x86/aria - add missing vzeroupper in AVX2 code 460fab22b6513 powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver e52bf7c4f2b2e powerpc/ps3: Fix repository.c build failure fd636a87161de ksmbd: prevent out-of-bounds reads in share config responses 9c777f8e0cb04 scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands b0de6463667e9 sunvdc: unmap LDC cookies when the descriptor send fails 4cd165b5f3eae openvswitch: fix wrong flag value in get_ipv6_ext_hdrs() 348492de88bc6 net/rds: fix tcp stream corruption with large pages 5c353c5a76e30 octeontx2-af: fix PF/CGX debugfs PCI bus lookup c622bbc212207 net: hinic: fix mailbox segment buffer overflow 5aab3e8d71644 net: sun4i-emac: fix missing of_node_put() for phy_node 96c2fc5daf983 net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). 2cad4a521942d net/sched: cls_route: Fix in-place replace 3d4c403aa780b net/sched: cls_route: make netlink errors meaningful cec2052fcecc2 net/sched: cls_route: Reject handle aliasing 41e94079200aa net/sched: cls_route: free emptied bucket on filter move 7fd4a45ee721d perf/x86/intel: Correct pt_regs->flags update for PEBS path 82e79fdbf68ca perf/x86/intel/ds: Factor out PEBS group processing code to functions e2e2ca292449e perf/x86/intel/ds: Remove redundant assignments to sample.period 421bc24582a36 perf/x86/intel/ds: Clarify adaptive PEBS processing 85382012bbc33 perf/core: Check sample_type in perf_sample_save_callchain b799264c7b1f7 selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value 79fb5bcc50996 net: stmmac: initialize ptp_lock at probe time 7953946f68262 ppp_synctty: ensure a writeable skb header 16c5c8ea50179 octeontx2-pf: reset HTB scheduler topology before freeing queues 3b90136e3df4f hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors 4a641ec4a73a6 hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() ce3479e4a647b net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down 01a3ec43ad635 net/micrel: Fix typos in micrel driver code comments 4afef977f36da watchdog: msc313e: Sync timeout value if WDT was running at boot 079c8c2891d35 watchdog: msc313e: Fix undefined behavior aea1af21e3028 watchdog: msc313e: Fix spurious reset on suspend b4f3a54fd1949 watchdog: msc313e: Enable clock before accessing hardware registers a1dd0817776ea watchdog: msc313e: Fix clock leak and spurious timer in settimeout() 660571b082331 watchdog: msc313e: Avoid division by zero 0a1c1f26c68b1 watchdog: fix hrtimer start when pretimeout is zero c1de1e7b51ab2 net: macb: destroy the phylink instance on the probe error path 5242050195a71 Bluetooth: btusb: Fix UAF of btusb_data by rx_work c075a91fe5762 ice: add missing xa_destroy for sched_node_ids e56a339e3de5e ALSA: hda: Report a change when only the channel status bytes move 621a4bb3ec3c2 ALSA: hda/common: Use guard() for mutex locks 934b404b6063d ALSA: hda/common: Use cleanup macros for PM controls 3fe9102ae0a82 ALSA: hda: Introduce auto cleanup macros for PM 4bc6df61a100a drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER f2de9df262c47 net: ethernet: cortina: Count RX descriptors for freeq refill 742f06928960c net: ethernet: cortina: Count RX drops once per frame dd792f4154b69 net: ethernet: cortina: No mapping is a dropped rx e858b9b1ea3cb net: ethernet: cortina: Count dropped frames as NAPI work d2541cfbd41cd net: ethernet: cortina: Finish RX updates before NAPI completion 4ca84049c6428 net: ethernet: cortina: Fix budget accounting 565be2ffa33fe net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward 1dd562f301901 net: ipv6: Fix UDP length overflow with PMTU discover and big MTU 550aa32d46f2a ipv6: lockless IPV6_MTU implementation 20c41165e8efd ipv6: lockless IPV6_MULTICAST_HOPS implementation c79c67de42d6e ipv6: lockless IPV6_MULTICAST_LOOP implementation e6c6b0059d624 ipv6: lockless IPV6_UNICAST_HOPS implementation 81073bca2062c virtio_input: stop callbacks before unregistering input device 16c90260ae7ae virtio_input: reset device if input_register_device() fails fa2ec3f48a679 virtio-pci: return IRQ_HANDLED after non-zero ISR 1b803d382cde6 vdpa_sim_net: check TX pull result before RX copy 000c6300776ce vdpa_sim_blk: reject out-of-range sector starts 59fc7c1c6b4d3 vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx 4875c65ca5379 vhost/vdpa: reject VRING_NUM larger than device max bd94e2ba56d02 vhost-vdpa: clean iotlb map during reset for older userspace b46594205234a vdpa: introduce .compat_reset operation callback dc74887a56e58 vhost-vdpa: introduce IOTLB_PERSIST backend feature bit fde77a9a589f3 vdpa: introduce .reset_map operation callback c147d62316ce0 vhost-vdpa: introduce descriptor group backend feature d76182012a5df vdpa: introduce dedicated descriptor group for virtqueue 2e40c69b9c344 virtio_console: do not free control-out buffers on remove 74bdd312e78d0 ASoC: mt6351: Publish the OF module alias 0f7dcaaff3b24 netfilter: ip6_tables: set F_PROTO when proto value is nonzero 3161186a2ff81 netfilter: nfnetlink_log: cope with concurrent instance destruction 79d93d8b49f05 ASoC: Intel: SST: Publish the PCI module aliases ebae165ad8352 ASoC: bcm: bcm63xx: Publish the OF module aliases 671037b282eb7 ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev 2ff38b3552af5 bpf: Reject non-scalar bpf_loop iteration counts 054ad8e66025e net: macb: fix NULL pointer dereference on unbind with fixed-link 2efc0d08fda24 net: macb: rename bp->sgmii_phy field to bp->phy 94b12a42cf8e8 workqueue: Introduce from_work() helper for cleaner callback declarations 226d2702e74a5 net/sched: ets: clamp quantum in parse and fallback paths b464affe9f9df net/sched: drr: clamp quantum in change class 3685934a0620f net/sched: pie: clamp psched_mtu in pie_drop_early 6570f326a6a96 net/sched: hhf: clamp quantum in change and init paths e4192bcf83aaa net/sched: sfq: clamp quantum in change path 215df1e953ae7 net/sched: fq_pie: clamp quantum in change path 439a3dc17964e net_sched: sch_fq_pie: implement lockless fq_pie_dump() 5a2b87dfceccf net/mlx5: E-Switch, prevent mc_list repopulation during vport disable a5833fdf53350 net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put 8267e46d14e84 net/mlx5e: Fix use-after-free race in sample_restore_put() 1886540daeaff net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% 874e90f3d8806 net/mlx5e: Fix setting RS FEC after remapping 6a1b49bb9fdf9 net/sched: defer qdisc freeing after failed creation 04a6cdb3fd13e powerpc/kexec_file: Use inclusive range checks in add_usable_mem() 0bf9f3bae3c4b pds_core: fix cmd_regs access racing BAR unmap on reset c2362c500931e net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations b2a8e165ddb6c vxlan: reject dynamic fdb entries that reference a nexthop id 90f6f5cb331af s390/ism: folio_put() after error 59bf9e94bdc49 net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow e5f4a054b9dc4 octeontx2-af: mcs: Clear stale X2P calibration state before calibration 37cb9a81600da net: bridge: mcast: properly convert mglist to rcu c5b5c52b6524c net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size f5e93162b3dd1 net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size f24eb5bd870ca bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() 17acbcd4c5a6c nexthop: Initialize extack in remove_nh_grp_entry() 8d282b2703899 selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0 0ba57948dc23a selftests/bpf: Update tests for new ct zone opts for nf_conntrack kfuncs b843ab43ac9d2 bpf: Mark bpf_btf_find_by_name_kind() as sleepable 990df1ba4d080 net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times 1e213ba7cb3b9 net: bcmasp: clear txcb->last before writing each descriptor a16ca1987ce86 ASoC: Intel: avs: Clean up the bus when fetching ML caps fails aec0a9c1579eb bpf: Fix NULL-ptr-deref in btf_var_show() 86d86f9fcf62d bpf: Fix NULL-ptr-deref when showing a void BTF type 75b20534d7a37 ALSA: caiaq: Fix potential double-free at error path 401aedb4632ae selftests/alsa: Fix the step check for INTEGER controls 92748cdff7388 net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset 0ec75c69918b7 net/rds: don't let rds_conn_shutdown() consume a concurrent drop 2e46248e375a5 net/rds: acquire the fastpath locks in rds_conn_shutdown() d184e6dd4b8f3 net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() 51164c0597405 net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown b8a8b6d25e742 net/rds: clear cp_flags bits individually in rds_conn_path_reset() 14d0a842e1696 net/rds: use clear_bit_unlock() in release_refill() 3d401934b7edb net/rds: use wq_has_sleeper() in release_in_xmit() 7b435c69a30b4 bonding: do not clear curr_active_slave prematurely when releasing all slaves 8cb75f7ada25b bpf: reject BPF_PSEUDO_FUNC reference to the main program 9379e193826f2 tracing/probes: Fix use-after-free on field name/type of events with multiple probes c6beb08b1a9fd netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() 677ff8ab30a66 ipvs: fix reversed sequence option serialization 7caaae233a55e btrfs: do not force reloc root creation during qgroup_account_snapshot() 02ebc4d4e5d73 btrfs: send: fix lost error return value in will_overwrite_ref() d043c43d2b4eb btrfs: fix the possible bioc_list memory leak during error 81116d3c6b27d btrfs: directly return 0 on no error code in btrfs_insert_raid_extent() 089d9c45ea49f btrfs: fix transaction use-after-free in raid stripe insertion 77a771b5083c7 ASoC: ux500: Program the MSP FIFO watermarks 507f239aacedd ASoC: ux500: Request the MSP MMIO resource 737e29e7dbf6e mfd: db8500-prcmu: Fold dbx500 header into db8500 f30aae1a465f2 arm: Handle KCOV __init vs inline mismatches 3f87eece1edde mfd: db8500-prcmu: Remove needless return in three void APIs 2e5e878e321f1 ASoC: ux500: Validate MSP DAI configuration 054396ce4a4eb ASoC: ux500: Correct MSP frame and bit clock setup 3b2d65cadf1f6 ASoC: ux500: Propagate MSP setup errors 80c65fbc57d21 ASoC: ux500: Fix MSP stream lifecycle handling d6f9af093dc91 ALSA: ump: do not touch legacy_rmidi before it exists d2baaf94766e2 ALSA: ump: Update rawmidi name per EP name update b8ca1a95e9c52 ALSA: ump: Copy safe string name to rawmidi ee432ab0658c8 ALSA: ump: Copy FB name string more safely 5447926ddbe75 ALSA: rawmidi: Show substream activity in info ioctl 210a9fc6678ce ALSA: rawmidi: Expose the tied device number in info ioctl 6bc345f6d81eb locking/lockdep: Invalidate stale class_cache entries for zapped classes c049f114bcb9e perf/core: Skip empty AUX records with only format flags 7bcce856c79c1 scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() 7adb1bf25b0c5 bonding: alb: fix uninitialized transport header access in alb_determine_nd() 0a0ee38ad6324 btrfs: restore active device pointers after failed sprout 7fe9dfbca4346 btrfs: detach failed sprout device from transaction update list d356c188a653d ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() d744a26619bc9 ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits 65736547074cb s390/boot: Fix physical memory search range 68e920cb06ddd ALSA: hda: restore MFG widget enumeration after core split 02f8dcb5c9be4 ALSA: hda/core: Use guard() for mutex locks 10cc145b87367 staging: fbtft: make dirty_lock IRQ-safe 2b9fa12fbdbfc af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). af08f62b5a5a4 ipv6: sr: restore network header before routing and forwarding b5344e459996a tipc: fix NULL deref in tipc_named_node_up() on empty publication list f614c83fd7664 ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit faaa80fad1f5d ppp: ppp_async: simplify tty disc_data access 84223baf21bc9 net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted 6245425c04be5 ASoC: ab8500: Validate and program TDM slots correctly 780e00c41886a ASoC: ab8500: Correct digital interface format setup 84ce73fefeb17 ASoC: ab8500: Repair the DAPM capture graph a2db840c01162 ASoC: ab8500: Reset the audio block before configuring it b67584161b7f9 Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() a8841f6653164 Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM 0e1fc7cab95ad Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan 593e64f64a20b Bluetooth: hci_core: Fix race condition during device registration e9cf7f175c00d Bluetooth: btintel: validate version TLV value lengths 17b61f59914b5 Bluetooth: btintel: Export few static functions b9b36a0e3d77a Bluetooth: btintel: Print firmware SHA1 abf3623af5d67 workqueue: reject watchdog thresholds that overflow jiffies 198734bee7945 workqueue: replace use of system_wq with system_percpu_wq 41647864e62b2 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block 030e88812435f s390/ipl: Fix NULL deref in kdump without re-IPL parm block 948d0090e7250 s390/os_info: Introduce value entries b0fc13ff74a13 s390/checksum: provide and use cksm() inline assembly 581896f229b39 s390/checksum: call instrument_read() instead of kasan_check_read() 486876f957456 ksmbd: rate limit unmapped SID errors cbadf2575d25e ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF dcaa77d10ea19 OPP: of: Fix potential multiplication overflow when calculating freq a135415be5683 watchdog: msc313e: Fix NULL pointer dereference in PM callbacks 069d5527bb0f2 vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() c60066fa5e2fe net: amd-xgbe: discard rx packets with bad FCS e3f4ffbde379c raw: annotate disconnect-side IPv4 match writers 4548d843e7b29 sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration 377e01e4f3104 smb: client: transport: Fix debug printing in __release_mid() 60a93d9f0fa06 smb/client: mark file sparse before emulating insert range 58e3d2fbc8c91 scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() c848a1bbe1104 scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() 09e7f9290d631 sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START 1ea521961c110 net/sched: act_api: fix skb sizing and action leak on reoffload delete 5fe7f53543e85 net/sched: act_api: conditional notification of events 4587ff1844ebb net/sched: act_api: don't open code max() 8611126b2637d rtnl: add helper to send if skb is not null 52a6bb47ef80d net/sched: act_api: size the RTM_GETACTION reply from the actions 606c29451264d net/sched: act_api: budget all shared attributes in notify skbs 99654b651c6d5 net: icmp: avoid invalid transport header access in icmp_send tracepoint 2a0e7bcff3fa6 drm/cirrus-qemu: Validate BAR0 size during probe 6a8aa0068d476 drm/cirrus: Use video aperture helpers 5b269f6682a7f ufs: do not treat unreadable directory blocks as empty 364e65b2e81ed ufs: Convert ufs_get_page() to ufs_get_folio() 1ca5c166deeac ufs: Convert ufs_get_page() to use a folio f8f3d946fe4b0 ufs: convert to new timestamp accessors 23d2429aecd6f selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter 965804b20c0f0 nvme-rdma: fix -EIO cleanup order in queue_rq 5807a65f301b6 accel/qaic: Address potential out-of-bounds read in resp_worker() 3fe8a33715265 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() 541fc6f733b32 EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation 9a5b471f95dd4 EDAC/igen6: Fix channel address decode for non-hash mode c359c9c9c9f8a EDAC/igen6: Fix channel selection hash 149df8bf827f3 EDAC/igen6: Fix interleave boundary condition d019542ed3324 ARM: ensure interrupts are enabled in __do_user_fault() ec9f166e6573c ARM: 9484/1: enable interrupts when unhandled user faults are triggered 881c5b1faf110 Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU" 8a69620b23e7b Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU" 5b0953f86d658 mm/damon/core: avoid infinite kdamond_merge_regions() internal loop 258d54030481f of: dynamic: Fix overlayed devices not probing because of fw_devlink 6fda5c51b8e43 af_unix: Unlink scc_entry in unix_del_edge(). 5a0367bf5ce42 ksmbd: use memcmp() to compare ClientGUIDs 90703664dbc5a ASoC: meson: aiu: Validate written enum values c405b07246bf1 ASoC: topology: Check PCM and DAI name strings before use 7907a395701b3 ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). ff6c5ee77dcc9 bpf: Guard __get_user acesss with access_ok for uprobe_multi data 00444baa8f74d RDMA/bnxt_re: Proper rollback if the ioremap fails dd3c9e1c9858c coresight: platform: defer connection counter increment until alloc succeeds 43ddbcdc0ed74 sctp: fix err_chunk memory leaks in INIT handling 6181239115e19 bpf: Mask pseudo pointer values in verifier logs 7250b6b5ba9b7 Bluetooth: ISO: fix malformed ISO_END/CONT handling 93580911f02d1 tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() 3c0bc7dcc5f92 net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD 0da8f531336b2 drop_monitor: fix size calculations for 64-bit attributes 3454c729ee8aa drop_monitor: perform u64_stats updates under IRQ-disabled section c4bb894362d22 ppp_async: drop the errored frame instead of resetting its headroom 16110d1a0e95a wifi: mt76: mt7921: skip unknown CLC firmware records 740272d46ffc8 wifi: mt76: mt7921: validate CLC firmware records 5ffe08b81a74d tracing/histograms: Simplify last_cmd_set() 9cd6d714d3ca0 ksmbd: remove stale channels from all sessions on teardown a2ac6a057409d firmware: stratix10-svc: fix FCS SMC call kernel-doc 3b9aa62d78ce8 netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state 8138a6951111d ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx 6b450c277c106 scsi: core: Do not block on tag allocation in scsi_eh_lock_door() 7c8b6b4d6f9de ASoC: rt5645: Perform the initial jack detect at probe 64f3ffba03b37 spi: dw: fix wrong RX_SAMPLE_DLY setting after resume 0737441d20b34 hwmon: (corsair-psu) Fix linear11 calculation be2636e1b21fe vhost-scsi: flush backend after device ioctls 37d743def9b6b ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx 887c8a9635dcb Drivers: hv: vmbus: add VTL2 redirect connection ID b44293b1598fa ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) 30d1d9f349546 Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame d01f1600e8b07 wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() 3a4a34a732e8a cifs: validate idmap key payload length cf8497dc74b3c powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash 07c121859d49e ice: pass the return value of skb_checksum_help() ce1b98bfe0cdb ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx b0cd3daf4710e ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 f4e8477e7af81 phonet: check register_netdevice_notifier() error in phonet_device_init() 8add43887cca1 drm/gma500: return errors from Oaktrail HDMI I2C reads 4a19bb1c45667 ksmbd: preserve VFS inherited POSIX ACL mask 6f6368b20f8c9 wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO 97aa48806d90e regulator: core: clamp voltage constraints before applying apply_uV cf87ef1e62ed3 smb: client: bound dirent name against end of SMB response in cifs_filldir 063b26637dcb2 wifi: mwifiex: replace one-element arrays with flexible array members a273c0336699e ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE 9096509e63ddd wifi: iwlwifi: acpi: validate WGDS table revision index a5af3b3e76760 ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless 4cfadb2e01566 wifi: iwlwifi: bound aligned TLV advance in FW parser e9b2633918c73 ALSA: hda/realtek: Add quirk for HP Pavilion x360 2750f52b58d92 drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized c8e84e292ed4c arm64: kprobes: Allow reentering kprobes while single-stepping 35f991d685fea wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif 0f690fd3b5535 wifi: iwlwifi: mvm: add a check on the tid coming from the firmware 861bd61732148 arm64: fixmap: Allow 256K early_ioremap() at any offset 3ea815f401652 wifi: iwlwifi: mvm: fix a possible underflow 216e469586057 smb/client: flush dirty data before punching a hole c3650be82ef6e blk-cgroup: fix leaks and online flag on radix_tree_insert failure 7e307cbae23d9 ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs 05f79cea3b15c wifi: iwlwifi: mvm: fix sched scan IE sizing 7a2d4efea2c41 wifi: iwlwifi: mvm: fix an off-by-1 boundary check 0bc25f0a2d1b3 btrfs: fix reloc root cleanup in merge_reloc_roots() f9938eb95e2dd wifi: iwlwifi: mvm: validate sta_id in BA window status notif 091e097c2f829 spi: dw-dma: Wait for controller idle before completing Tx a01837ae174a2 btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() 6d04872f36e83 btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr() 8db6d96ac93f4 ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series 631b292f93a3d smb/client: reduce fallocate zero buffer allocation f08d7f3c91633 wifi: rsi: validate beacon length before fixed buffer copy ecb48c6b9edc7 netfilter: ipset: mark the rcu locked areas properly 0b61c465ea620 wifi: libipw: fix key index receive bound checks fbbdda4753ec3 gpio: dwapb: Mask interrupts at hardware initialization 6bdf4dcff98df wifi: cfg80211: validate rx/tx MLME callback frame lengths before access 9c4ace62a7511 ksmbd: validate SID namespace before mapping IDs e790f72f2c99e ksmbd: mark invalid session responses as signed 47b018dba6ec7 ksmbd: find bound sessions during reauthentication 71be658246c90 wifi: cfg80211: validate assoc response length before status and IE access b657cc98d7936 wifi: libertas: reject short monitor TX frames 5207727e53fba wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers a78689e2beed2 wifi: mac80211: validate deauth frame length before reason access 6acaf2d10ad1c wifi: ralink: RT2X00: init EEPROM properly 319393151367e ALSA: usb-audio: caiaq: validate EP1 reply lengths 58b767c74930a ksmbd: fix credit charge calculation for SMB2 QUERY_INFO 717db0d436875 drm/amdgpu: flush pending RCU callbacks on module unload 4a69504f5d691 ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table 246098a2b8e88 cachefiles: Fix double fput 720554c04acba xen/gntalloc: validate grant count before allocation 7ada9807e3710 freevxfs: don't BUG() on unknown typed-extent type ac97b55d9e989 xen/front-pgdir-shbuf: free grant reference head on errors edc17db830856 ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling aa9bd2c8513e4 ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr 43658ba7f701e drm/arm/komeda: fix error handling for clk_prepare_enable() and callers c866c3314a685 ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr b7f3ee925aee9 netfilter: nf_conntrack_expect: zero at allocation time 223bf70736b49 drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend 4cb41f07685f8 btrfs: tree-checker: validate INODE_REF's namelen 1cc84ca8599b8 spi: core: Abort active target transfer on controller suspend 2b3c4c381fb23 fbdev: pm2fb: unwind WC setup on probe failure 69aea5ee498fb eth: mlx5: fix macsec dependency 42a37f4a89665 rtc: bq32000: add delay between RTC reads e6a404ac2a1e8 blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat() e1b5a13249975 net: au1000: move free_irq out of the close-time spinlocked section 8efa52abbff2e regulator: da9121: Use subvariant ids in the I2C table 249be9b5704d4 PCI/sysfs: Use kstrtobool() to parse the ROM attribute input aa1ad3c1f3976 PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() 4114c357386d7 ksmbd: treat read-control opens as stat opens only for leases 3df8918da4630 ksmbd: break RH leases before delete-on-close 9e2cccbbf3b63 ksmbd: start file id allocation at 1 5c37c7275d757 ksmbd: deny renaming directory with open children 52bceb4629bf4 ksmbd: apply create security descriptor first 58a0a1c399a08 ksmbd: treat unnamed DATA stream as base file 3b64cae18fd79 ksmbd: use connection ClientGUID for lease lookup 3281d27b4d974 ksmbd: align SMB2 oplock break ack handling 223a923582afa ksmbd: validate SMB2 lease create contexts 17699905a3816 ksmbd: fix lease break and ack state handling 52fa4ba4268ce rtc: aspeed: add AST2700 compatible aee4e6de71ca7 f2fs: validate inline dentry name lengths before conversion 2fdc51228d9a8 md/raid5: let stripe batch bm_seq comparison wrap-safe fc0fab337d554 md/raid5: account discard IO 31e33dcc89652 PCI: mediatek: Protect root bus removal with rescan lock 5d566ac3a055f PCI: rockchip: Protect root bus removal with rescan lock 4b69c63cc247f PCI: altera: Protect root bus removal with rescan lock aaf4153caed9f PCI: iproc: Protect root bus removal with rescan lock 53da3557621a3 ALSA: usb-audio: Add quirk for YAMAHA CDS3000 67a5885f846b0 drm/amdgpu: Use system unbound workqueue for soft IH ring 89ed4a0ce8beb drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap d51841bb5ceee drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl af84fb6ac0cb7 mfd: rsmu: Add 8a34002 support 9e54c47bc8407 mfd: tps65219: Make poweroff handler conditional on system-power-controller 31aab1e3d0f3a leds: pca9532: Don't stop blinking for non-zero brightness 9f0d6bb71a6bc leds: uleds: Return -EFAULT on copy_to_user() failure 804302aca977b ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 e26aa709454d4 tls: reject the combination of TLS and sockmap 1d8050de0ca2a ALSA: usb-audio: Add quirk flags for SC13A 359b3442e66c5 spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() 12e4118b5b4f8 gpio: pisosr: Read "ngpios" as u32 111b36e7b6dc6 scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() f58daade5963a fuse: set ff->flock only on success 5d7637f4d050d HID: hidpp: fix potential UAF in hidpp_connect_event() 97313af1820db ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT 71fcc902af9c2 sparc: Disable compat support with LLD 737a90fcd99d1 i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA cfa09f63e75cf smb: client: fix races in cifsd thread creation ea0af96a1b939 net/sched: act_csum: don't mangle UDP tunnel GSO packets f948534a042fa e1000e: limit endianness conversion to boundary words 76e678bdc5170 vsock: use sk_acceptq_is_full() helper in all transports af16e8f97c622 ptp: ocp: add shutdown callback 74dbb85a6a254 net: stmmac: xgmac2: disable RBUE in default RX interrupt mask 665089ff4f8a2 sparc64: uprobes: add missing break 01e350c0641f5 Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV 98deaf6117195 ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure 1994a4bdaa7fc ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence 7f0fd754c7087 ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt 72e26293a231f Bluetooth: L2CAP: validate connectionless PSM length c8d249de9e97d Bluetooth: btusb: Add support for TP-Link TL-UB250 e86071156ea99 Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV fa9d74b9bb0cd spi: xilinx: let transfers timeout in case of no IRQ 23f05d42f189d hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i 3c8c0c786f3f0 dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc 58d882c723ae9 PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems f2db152beb06c sctp: Unwind address notifier registration on failure 5488e2706c584 nvme-fc: Do not cancel requests in io target before it is initialized 8cd46f24e8411 platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table 4ecbe6a5ac28e ata: libata-pmp: add JMicron JMS562 quirk 58ae36b6f20c7 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 21730289e0af9 ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC ba180821a4e23 vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add() a432bf58906b7 net: dsa: qca8k: Add support for force mode for fixed link topology 86ace5b321108 hwmon: (adt7462) Add of_match_table to support devicetree 1a6c92aa7242a btrfs: protect sb_write_pointer() with invalidate lock d51ba5fe3459b wifi: mt76: transform aspm_conf for pci_disable_link_state 466e727a3481b platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table 7521c2e260855 tls: Flush backlog before waiting for a new record f0399b3e21274 net: ibm: emac: mal: fix potential system hang in mal_remove() f38f5acb4942f configfs_depend_prep(): pass configfs_dirent instead of dentry 0d099caebc3e0 xprtrdma: Add request-pool slack for delayed recycling b042b4947752d RDMA/rtrs-srv: Fix integer underflow in process_read and process_write f556c3d4d64dc NFS: fix eof updates after NFSv4.2 fallocate/zero-range ba6c4fc662853 btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF 81a664ed8b1a4 btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() 0d5ad732e4fdc netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() 91c97a7969dae ALSA: es18xx: check control allocation before private data setup a7625d408f7f0 net: microchip: sparx5: clean up PSFP resources on flower setup failure 016b8eaca53bf hsr: broadcast netlink notifications in the device's net namespace 8af61d5bd87fd net: cpsw_new: unregister devlink on port registration failure 31377675c3d75 bpf: NUL-terminate replaced sysctl value b1e111f93deef RDMA/mlx5: Fix state and counter desync on loopback enable failure e9bbb5f5349ef RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() 2095eceaedddf wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications 641be20110cdf drm/amdkfd: Unwind debug trap enable on copy_to_user failure 5eade80288a03 ipmi: si: Use platform_get_irq_optional() to retrieve interrupt 3b389d479f831 ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP fd36e829eb3c1 clk: keystone: don't cache clock rate 0e646d3912ff5 net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition 025293b9d0cf6 RDMA/irdma: Fix typo in SQ completions generation 4a1b0a4c5acbe drm/amdgpu: fix buffer overflow during vBIOS update 9b5cb2e4eb297 drm/amd/pm: bound pp_dpm_set_pp_table() memcpy 090b51e2dabf8 drm/amdkfd: fix UAF race in destroy_queue_cpsch fec259e46d443 xhci: Prevent queuing new commands if xhci is inaccessible 97c2c0b1233b3 thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries c996faba71fc4 dpaa2-switch: fix handling of NAPI on the remove path d0e54098c072b net: dsa: sja1105: flower: reject cross-chip redirect 259ad6093204b dpaa2-switch: fix the error path in dpaa2_switch_rx() dc626f2abb305 dpaa2-switch: rework FDB management on the bridge leave path 2922cf2583e59 ALSA: seq: oss: Reject reads that cannot fit the next event a92d497bc768e ASoC: codecs: rk3328: Use managed GPIO and clock helpers 2f7d0ec8c10dc ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() d564a885219a6 fs/ntfs3: validate index entry key bounds fdc9f65aa6631 fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib fce90e41601e3 iommu/rockchip: disable fetch dte time limit 356a4983340df net: wwan: t7xx: Add delay between MD and SAP suspend f76a39c45182d net: qrtr: fix node refcount leak on ctrl packet alloc failure 6b6be7328f2b2 ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach 6d29b91164424 ata: ahci: fail probe if BAR too small for claimed ports 0ccf0d4dddbe5 ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive 43cb6295c3a6d ASoC: qcom: q6apm: return error code to consumers on failures b4ef30f1d107a wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi b511b56f63daa net: ibm: emac: Reserve VLAN header in MJS limit bc6e3444a6d7a libbpf: Also reset {insn,data}_cur on realloc failure da92b1a8560a5 iio: accel: mma8452: switch to non-devm request_threaded_irq() d85b5591ea459 perf/ftrace: Fix WARNING in __unregister_ftrace_function 2c2d63f410557 iio: light: stk3310: Deal with the ps interrupt issue in PM b5fa000eaf6bb mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC 3657383a477ab tracing: Disable KCOV instrumentation for trace_irqsoff.o 345b1dfa73be0 mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC cfc0b65a29b41 mmc: davinci: fix mmc_add_host order in probe 86ac37d42a8b1 soundwire: only handle alert events when the peripheral is attached c8abef7c07c10 gfs2: page poisoning fix 26532163b3cef soundwire: dmi-quirks: Disable ghost Realtek devices 5cdfd851fa205 libbpf: Add __NR_bpf definition for LoongArch 1bdf84bbe14a7 ASoC: Intel: catpt: Complete coredump handling feb1ad41281ae drm/nouveau/gsp: add SEC2 to GA100 chip table c6ad6451f88f0 scripts: modpost: detect and report truncated buf_printf() output 74bd1f05d9ba2 host1x: bus: Fix missing ops null check in error teardown 37acac6d2d6d3 pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP 1ca2411d90c85 hfs: rework hfsplus_readdir() logic 38ee32a9ace6f ACPICA: add boundary checks in two places 50a11e2f3dc8a ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() 08c5dee5da1d8 ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() e301b6132be06 ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() 26dd27000e954 ACPICA: Add validation for node in acpi_ns_build_normalized_path() 2442772fd79a4 ACPICA: Add package limit checks in parser functions 254e304f68dc0 ACPICA: validate handler object type in two places 72d75287bc6d6 ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() 4532c9cf006bb ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) c2cf936b07b0a ACPICA: Prevent adding invalid references 6e0d26e6ec903 ACPICA: validate byte_count in acpi_ps_get_next_package_length() 7d97ecf2a4c7a ACPICA: add boundary checks in acpi_ps_get_next_field() 63ca6f67816a2 ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() 4c22c9842c53b ACPICA: Fix condition check in acpi_ps_parse_loop() 121352772b326 drm/amd/pm/si: Fix updating clock limits from power states c8bc44a1d86d5 net: thunderx: fix PTP device ref leak in nicvf_probe() f601ec5c92b32 ipv6: addrconf: fix temp address generation after prefix deprecation f5d3088e1a9f3 net: hsr: require valid EOT supervision TLV 52c61420923e4 ALSA: usb-audio: Add quirk for Novation Mininova 4761493dd6634 irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed 566b1fc9a4fb8 iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind df904e01b710f mips: cps: Assemble jr.hb with an R2 ISA level cf82a9d15ae69 drm/panel: simple: Add AM-1280800W8TZQW-T00H a643ce49ddcdb thermal/drivers/tegra/soctherma: Switch to devm cooling device registration 99a1ae9c1e058 clk: socfpga: agilex: implement l3_main_free_clk ff8e9b793effc s390/zcore: Removed unused variables 2e6b5c4b59351 rds: annotate data-race around rs_seen_congestion 65fae4b42269d rds: filter RDS_INFO_* getsockopt by caller's netns 4892962af7896 netlabel: fix IPv6 unlabeled address add error handling 4cf3a3f61c88c wifi: rtw89: pci: enable LTR based on pcie control register df2f6c977a94a rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks() 47850643464ba char/nvram: Remove redundant nvram_mutex cd4f278f30021 usb: host: add ARCH_AIROHA in XHCI MTK dependency 03ed804a0ddc3 serial: 8250: fix possible ISR soft lockup 99fcf2d8daf24 usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue c055449f384b1 USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set a018d4195114c usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log d0291fb4d9198 usb: core: hcd: fix possible deadlock in rh control transfers 517c353e5358b usbip: vhci_hcd: fix NULL deref in status_show_vhci 28d1f6aa14f59 isofs: handle set_blocksize failures 29186cd17bb5f omfs: handle set_blocksize failures 0451927f42b02 hpfs: handle set_blocksize failures 87d6852f06c5a jfs: handle set_blocksize failures f83e416c2242f qnx4: handle set_blocksize failures 8e788c14b72d6 minix: handle set_blocksize failures 8a96010d230a8 bfs: handle set_blocksize failures ea8a4a9f3cc10 affs: handle set_blocksize failures df9dac4dbe557 ntfs3: handle set_blocksize failures ceb89faa8ead6 befs: handle set_blocksize failures 07a348d48e589 net/rds: Don't sleep inside rds_ib_conn_path_shutdown 4fc0430de152f net/sched: sch_drr: make cl->quantum lockless f0018acf0b66f net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() 513cab0e49ebe net: usb: qmi_wwan: add MeiG SRM813Q ac8cc00c0fb60 nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl b4d8264ca70f3 bitfield: wire __bf_shf to __builtin_ctzll 85cbb946b9c59 thunderbolt: Verify Router Ready bit is set after router enumeration 5428342dd66ed thunderbolt: Increase timeout for Configuration Ready bit c0742f23ec13f firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size 1bbe431fc5970 firmware: arm_scmi: Validate SENSOR_UPDATE payload size 7496466121155 thunderbolt: Improve multi-display DisplayPort tunnel allocation a13e408c554be thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() de4b7f9bfee2c bridge: Add missing READ_ONCE() annotations around FDB destination port 4904370513ad6 9p: use kvzalloc for readdir buffer c2319e1cfb78c arm64/daifflags: Make local_daif_*() helpers __always_inline b6b5175b4da92 9p: invalidate readdir buffer on seek 3167b620815c4 sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity d04cff45c9d2a ALSA: usx2y: Drain pending US-428 pipe-4 output commands 3d2ddfc9b361b drm/amdkfd: Check bounds on allocate_doorbell e2bef0f168be4 drm/amdkfd: Fix OOB memory exposure in get_wave_state() 25e1b29ecc8da drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id c1797a31c5fe8 PCI: Wait for device readiness after D3hot -> D0uninitialized transition bb42eed92e401 mailbox: Make mbox_send_message() return error code when tx fails 91c6fdcdf22bd RDMA/mlx5: Use QP port when decoding responder CQEs 0a996ad14fbbb media: imon: Add iMON VFD HID OEM v1.2 key mappings c4f2d6c924263 crypto: atmel-ecc - add support for atecc608b bec33e03d2244 crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y 3b3ae5517658a scsi: pm8001: Reject non-fatal dump when controller is crashed cb789c65aa703 scsi: pm8001: Reject firmware update in fatal error state e4fe7a56992ee clk: samsung: exynos850: mark APM I3C clocks as critical 959913c0d51e1 soundwire: intel: Move suspend tracking from trigger to pm suspend c0cbb58df7d21 drivers/of: validate status properties in reconfig state changes a6ce8632fbdc0 integrity: Check for NULL returned by asymmetric_key_public_key 32ff92cc9f91e net: dsa: realtek: rtl8365mb: add support for RTL8367SB 72bf6944e336d wifi: rtw89: phy: check length before parsing PHY status IE b7afb0c24a761 media: video-i2c: use vb2_video_unregister_device on driver removal 3d2ac2f6ed2e2 drm/gud: Add RCade Display Adapter VID/PID pair 9eb4ca55f5b61 net: phy: motorcomm: use device properties for firmware tuning bfdb4d0fab516 hfsplus: rework hfsplus_readdir() logic 03505f0c7c277 PCI: intel-gw: Enable clock before PHY init dc4fd6c0d9323 drm/amd/display: Fix CRC open failure during active rendering 3c5e3e5badbf0 mmc: davinci: avoid NULL deref of host->data in IRQ handler a8283f7d93f0d mmc: core: Add validation for host-provided max_segs 120c4c6e07f94 ASoC: ti: omap3pandora: update board check to use DT compatible 38570c33dc367 drm/bridge: tc358768: Set pre_enable_prev_first for reverse order 1b793329699b5 clk: renesas: cpg-mssr: Add number of clock cells check 827c30511b02a crypto: omap - add omap_des_unregister_algs helper 8c37bc8d6a6f7 crypto: ixp4xx - fix buffer chain unwind on allocation failure c75237294a70d media: em28xx-video: fix missing res_free() on init_usb_xfer failure 0d252fe2012d9 net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family 2381e99226b53 net: dsa: mv88e6xxx: define .pot_clear() for 6321 c43bc7bd2e68a PCI: switchtec: Add Gen6 Device IDs d2c97bf5b1ff2 net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family b6327023dcc74 media: dm1105: fix missing error check for dma_alloc_coherent bed89ef877c9e thunderbolt: Don't create multiple DMA tunnels on firmware connection manager 83d1af5b1b6e6 thunderbolt: Set tb->root_switch to NULL when domain is stopped b61a4ae2ec6a0 thunderbolt: Keep the domain reference while processing hotplug 57359bb31526c thunderbolt: Keep XDomain reference during the lifetime of a service 9d6657674919b thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() f5e6286350c86 media: rc: mceusb: Add support for 04eb:e033 d9fa79ccd0920 spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM 71ab6046cb940 soundwire: validate DT compatible before parsing it 827d1eebd5f24 bridge: Do not suppress ARP probes and DAD NS unconditionally b9efc7bdadca8 firmware: stratix10-svc: change get provision data to async SMC call ad65a12f6a0a4 kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() 0b58a5ac9170a wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() adf23deb60387 wifi: mac80211: always allow transmitting null-data on TXQs 8fe5eb7b68d76 wifi: nl80211: reject beacons with bad HE operation 5a46a1b5dcbae hfsplus: fix issue of direct writes beyond end-of-file 0f8a92c198893 PCI: Stop setting cached power state to 'unknown' on unbind 5a99d68c32927 tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang e9260bc729335 tee: optee: Allow MT_NORMAL_TAGGED shared memory 11c633d24780a usb: gadget: udc: skip pullup() if already connected 8c77312728d07 ima: return error early if file xattr cannot be changed c6dfcaea6d3ae ALSA: usb-audio: Propagate write errors in generic mixer put callbacks 5a7c355f83c63 drm/amd/pm: Check SMUv13.0.6/12 metrics integrity e0ae7248bae11 drm/panel: jadard-jd9365da-h3: set prepare_prev_first 3ad0c3cf4a163 drm/amd/display: Fix DPMS using partially updated pipe context 82f51c4addcac bus: fsl-mc: wait for the MC firmware to complete its boot 30cd0f44e983e drm/gem: Consider GEM object reclaimable if shrinking fails 892f643b141ae ksmbd: fix use-after-free in oplock break notification Signed-off-by: Bruce Ashfield --- .../linux/linux-yocto-rt_6.6.bb | 6 ++-- .../linux/linux-yocto-tiny_6.6.bb | 6 ++-- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++---------- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb index 8a31bbfd09..3c91a4ba7a 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb @@ -14,13 +14,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "9b87590f4fb1e0d54ae9153f9e4fe84cec61f13e" -SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" +SRCREV_machine ?= "aafd2f2dba2b549d89a66f79826d770742d968ab" +SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.6.157" +LINUX_VERSION ?= "6.6.159" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb index 3904ba1d1c..1b06d1e35f 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb @@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc # CVE exclusions include recipes-kernel/linux/cve-exclusion_6.6.inc -LINUX_VERSION ?= "6.6.157" +LINUX_VERSION ?= "6.6.159" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "a56c1dbe33dcd7b71df3b2703ceb95692edd9579" -SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" +SRCREV_machine ?= "7d022d231f699d2c767d88bb1fa305550ca68e01" +SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb index da3c5dd6ea..601eb92595 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb @@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base" KBRANCH:qemuloongarch64 ?= "v6.6/standard/base" KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "f762f9a437240aebfb663b9f08166b6978411ad3" -SRCREV_machine:qemuarm64 ?= "efde6579b1968f396f4718ad939aeb6859f17012" -SRCREV_machine:qemuloongarch64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_machine:qemumips ?= "d7bc8d3db82714ebe46bde3e69f9dcbef7ae6e48" -SRCREV_machine:qemuppc ?= "b8bafdf6f040163a1fe0eb91c7b419452e3590b4" -SRCREV_machine:qemuriscv64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_machine:qemuriscv32 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_machine:qemux86 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_machine:qemux86-64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_machine:qemumips64 ?= "fa48e020815730c4ff228c0e8d42836d68ac4b4b" -SRCREV_machine ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" +SRCREV_machine:qemuarm ?= "9d17d5c9ac32b38ca5186199ed824b43f3d4308b" +SRCREV_machine:qemuarm64 ?= "857114866d2445d49024c9ef1ec710a7ef291a5b" +SRCREV_machine:qemuloongarch64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:qemumips ?= "2349f4c462400a8fb6f95c6bc0fbbdf959b2cb18" +SRCREV_machine:qemuppc ?= "47e791b3b9f786f926e66a672c524c1e858c76c1" +SRCREV_machine:qemuriscv64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:qemuriscv32 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:qemux86 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:qemux86-64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:qemumips64 ?= "a77a45b7cea3e691d2dafca4d9bdbaa60d134617" +SRCREV_machine ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "79643295eba17affbd16ca97f3ef04c90266b28c" +SRCREV_machine:class-devupstream ?= "cecd39af8a1ab81373fd9fa765b2f7ab73becaad" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.6/base" @@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.6.157" +LINUX_VERSION ?= "6.6.159" PV = "${LINUX_VERSION}+git" From patchwork Thu Oct 29 03:45:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bruce Ashfield X-Patchwork-Id: 102309 Received: from mail-qv1-f49.google.com (mail-qv1-f49.google.com [209.85.219.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4575.1793245549854950189 for ; Wed, 28 Oct 2026 20:45:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=Ivj0U8of; spf=pass (domain: gmail.com, ip: 209.85.219.49, mailfrom: bruce.ashfield@gmail.com) Received: by mail-qv1-f49.google.com with SMTP id 6a1803df08f44-917aca1aee5so22017006d6.2 for ; Wed, 28 Oct 2026 20:45:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793245549; x=1793850349; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=tIv/BEaPYVxxsUccv+XldX6ljqWVedGG0f9IoczzuAQ=; b=Ivj0U8ofyyt/5GR8LAQp3q7WiLCfQJurW2V4Rsap2T4/AbLrHE66Z5kloXdXfGnMw/ AgJ3/At6647ODDV+KBuX2WmHDjcee4RhyT+ILP7CsMvU55i6TOiPH29DRj9pANIcDtdK ugDQ9UF587A4jQETD8OJBkjufGPGK0uCxFHdURW1uDDps7jViJbadVGxEuvT3wakY/zy a2KJf9jBA1JrOGS5mMQ3h9PzB4MkGP1ctD5WKSMWJpYiO93hdZoZXdVf+MSQEY3IakC4 Kiykwsy4ez5BFNL2ApM1GqwAuWxkgp/05KYGf8zjjmhcibFEjOgbBn9HXWVWsi36fXUL Zc7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793245549; x=1793850349; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=tIv/BEaPYVxxsUccv+XldX6ljqWVedGG0f9IoczzuAQ=; b=gcyhnQgPh3gzY3ZKQz9izj+I00WoNlb9NN2mU7BSDEfMpnJhAi8EBjMGMfXpCocvB4 kuKB7Xhv0YSzvLqeL91HhkBRPUyo8P3q0SXYo+sGpAXQMYpdmTvWybbDdtn8VRZYWULB 7eCHmagn4mNtdpt1UTn/w6hMtAs5D+jBu0/x4ICKi2Z11oqZIEF602yqMqp/nxz8FKv/ XZxQTw8SMi6MVVHNrR9eeXII+awXQvTpXEwLnu0jroyu8caZD4lu4bICMXRsrljNsa0X uyOVZF5MrlOcix4hHiRoJc3/0f2vlbhGTgKpf0iSA0+9rpJxUFFW3GIMojsbGp3IuPVW 2TCw== X-Gm-Message-State: AFq9FYK8nZ8WhfyCncJUZpw6sL90Dt4Iecfu6zdqCIIYZCZXd55BffAe tuqXqvAiiPjcylDy+fefd7s4JwHU5D0jPLgfl7kWKT9+0QrQKdDserD3DpWvf4aY X-Gm-Gg: AYBFou2dX1Zc0kUf1tXnTf/l3wveL4zn+lyLXr0HrvrsTlQi+1Uh9VF4pJBP45K0bZI le4SbbbVVF8o2wn+w12PbfkfpHpDXvAVo2hte+bpRRjOPAMWK0xBrEmiIbHUFGIkPe/waijhyyX EaBtpjtXp5DCziI7QeYzj7dmMjZb9m9tf2GiCHMJ9lwQn06sID3+Yd/+BQduAxZCM1Wyk4G7FFN d1SEkbtL+f7ZRClElJGxDNnEBPegg0+6pG0sezgPAvGiDESmRDmXB4GcY0334vQB/MzGNTGT/zP muyd7krgJuL433Lq63vheRAsuQkEBaIKDAKjPzr2YuttQNVGs4C5D3yr+eFCY8cgN8YrlL6vWXR JVgU5BxcO4UWV8MJPjtd6zRjwIgRWn42SxBLwDs/rF2Y2aM36i0GNj9ahCGyhwyqaqHcBu3C2fs 7ExNbnyR758zI0xx3vHKr1f0QcjgVF9q4IkrqlO06IRkJhIGhNzKD/ataRDbxkjgPAXR5qHnrSS iS5pHBPqKctrDKEqkQdbiRM+Zj3/+Uah6eAgC0vkpeVg/hoSK+3QYS7/1/WkucRV3QF56Dm38bq 9yA5MYkD4yyD0kjyWYzHejcz8yaai/FQGvQo3UBbQ5WfnyLTv4bkqLk0tYCTHrdL+fvOh7UZCOE EVuiBFdWReKkm8ifhVZD/NT8F3a6ow6722wKEm39arFFSPIyl4eUxJz/Wgz/Zh14jwbZegEus3+ 2qFkm763XOES+vCPViHWMKV/YukMy/nzyW8YDianr66715Cg== X-Received: by 2002:a05:6214:e83:b0:91c:914c:890 with SMTP id 6a1803df08f44-91c914c0c83mr21869176d6.22.1793245546741; Wed, 28 Oct 2026 20:45:46 -0700 (PDT) Return-Path: Received: from bruce-XPS-8940.localdomain (pool-174-112-35-248.cpe.net.cable.rogers.com. [174.112.35.248]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91c47c16569sm147542096d6.18.2026.10.28.20.45.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 20:45:45 -0700 (PDT) From: bruce.ashfield@gmail.com To: openembedded-core@lists.openembedded.org Subject: [meta][scarthgap][PATCH 04/07] linux-yocto/6.6: update to v6.6.160 Date: Wed, 28 Oct 2026 23:45:00 -0400 Message-ID: <20261029034503.3153661-5-bruce.ashfield@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261029034503.3153661-1-bruce.ashfield@gmail.com> References: <20261029034503.3153661-1-bruce.ashfield@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 03:45:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248881 From: Bruce Ashfield Updating linux-yocto/6.6 to the latest korg -stable release that comprises the following commits: 0aebf2870d53a Linux 6.6.160 a63f79d9da946 KVM: x86: Use active memslots for the per-vCPU MMIO cache 59c6dcc5dd9da ksmbd: fix heap out-of-bounds write in krb5_authenticate() db00b8cc243f1 bpf, sockmap: Account for receive queue in FIONREAD without a verdict program cec182231e528 xfs: fix unmount hang with unflushable inodes stuck in the AIL a72b0af5610ce xfs: factor out stale buffer item completion be1999582bd10 xfs: rearrange code in xfs_buf_item.c 67f0af99e2905 xfs: catch stale AGF/AGF metadata dda32083f6393 xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock fb2cc53273997 bpf: abort verification if env->cur_state->loop_entry != NULL 8010212197d4a Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained dbea82c4c81db Revert "mm/filemap: avoid buffered read/write race to read inconsistent data" 791f7e65d6299 Revert "ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev()" a102a92462b97 ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 f2d8e2e64fb2b r8169: remove original workaround for RTL8125 broken rx issue fa0c45986fc60 smb/server: fix tree connection leak in smb2_tree_connect() 22d1f4dcdc9c6 nvdimm: pmem: keep PREFLUSH before data writes 32e999ccf5f64 drm/virtio: use the DMA API for resource backing on Xen ce7da178f1af4 drm/gud: validate GUD_ROTATION_0 is present in supported rotations d51cd486930f5 bpf: check_cond_jmp_op(): properly infer if register is null b7f2e33d9f5db smb/client: validate new EOF for insert range 5fbd8848f2e25 smb/client: validate new EOF for zero range 52dd721b3de57 smb/client: fix stale page cache in insert/collapse range cc7202a51b877 smb/client: invalidate fscache for fallocate range operations 99ae165acf633 ksmbd: propagate DACL parsing errors fabc5e04f1232 Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect 01131daffc4b6 igmp: convert struct ip_sf_list to RCU 0e3e3cec28c4d ipv6: mcast: use rcu_assign_pointer() for __rcu list updates 3dbb628cfc592 tipc: Dont send random pad bytes in RESET/ACTIVATE messages 19cca7c360559 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge 1ac58dab0a83d bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks 433d52b196a68 btrfs: zoned: finish active block group cleanup if call_zone_finish() fails 14d982762945d btrfs: zstd: fix lost wakeup when waiting for a workspace 54772bf503dd0 net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). 4c85e4a0e8b07 net: plumb extack in __dev_change_net_namespace() dcc5e6c9e4d06 erofs: disable LZ4 rolling decompression for now 9496d857205e6 bpf: Mark syscall helpers as sleepable e6a94b2c4c80a nvme: remove stale namespaces by NSID range during scan c57506918b078 nvme_core: scan namespaces asynchronously 8b414dbe97fce bpf: Don't infer non-NULL from a pointer with an unbounded offset 6e15449865367 bpf: Don't predict JMP32 pointer vs zero comparisons 53ab1d12e52aa bpf: generalize is_scalar_branch_taken() logic ca7ade93a622c bpf: unify 32-bit and 64-bit is_branch_taken logic 4ea5273a22e47 bpf: generalize is_branch_taken to handle all conditional jumps in one place e3991f2c54e7f bpf: move is_branch_taken() down 82798ed5889f0 bpf: generalize is_branch_taken() to work with two registers e97cb20239d10 bpf: rename is_branch_taken reg arguments to prepare for the second one f5b2c23341b79 bpf: Improve JEQ/JNE branch taken logic 86a3171c90bfc bpf: Mark NULL kptr stores precise cf85e4f94d7fe bpf: Preserve inner map identity in callback frames 26ee5f99ffe7a net: reject oversized tx_queue_len at netlink parse time febbb66e682d8 bpf: mark a NULL call argument precise 8b95269d7a43b iommu/amd: Do not reallocate GA log buffers on resume 5ad081761a1f0 virtio_ring: fix stale descriptor flags after a failed packed add 914c7cc2e3d10 vhost-vdpa: protect config_ctx from being freed under the config callback 582fec8ebce99 eventfd: simplify eventfd_signal() 650bac9c73d3b vduse: validate virtqueue alignment 021bf73731f7a vhost: invalidate vring access on IOTLB transitions bd91dc313afe2 af_unix: Update last skb marker in manage_oob(). 385aa7dbc6af1 eth: ice: don't dereference pointers from TP_printk() 55b76500546e5 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() fb78beb64e0e7 vxlan: initialize _md in vxlan_xmit_one() d552beb9d278a net/mlx5e: Move representor vnic reporter to eswitch devlink port 9882068ed242f perf/x86/intel: Prevent drain_pebs() reentry 09c30547da2c4 net: stmmac: fix TX descriptor availability check for TSO traffic a44744454eafb configfs: pin the symlink target's dirent instead of chasing ->ci_dentry bc5f32f36724b configfs:get_target() - release path as soon as we grab configfs_item reference db6d0b2f307f0 path: add cleanup helper b315d86566076 configfs: unhash the dentry before dropping the item in rmdir 0c1a966bc047a reboot: fix cad_pid use-after-free race 61894ea0d2a1a tracing: Take trace_array reference when opening a tracer options file c3576cb77b527 ALSA: usbusx2y: validate URB actual_length in interrupt callback 4d87cf94eba53 ALSA: usx2y: Use standard print API e5c5dad169fb5 tracing: Take the reference before publishing the named histogram trigger 880712b6f4810 tracing: Undo the registration when enabling the histogram trigger fails 962e565f45dbe accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr 07d4190d75021 accel/ivpu: Validate firmware log buffer metadata 3d9365093f16b accel/ivpu: Limit firmware log name prints to field size 97be05f33f793 bootconfig: Fix integer overflow in initrd size check f664e06699829 netfilter: cttimeout: prevent UAF during module unload 0159f716d8adb ipv6: flowlabel: cap duplicate leases per socket 5a1b6379eed5b perf: RISC-V: store available counter mask as bitmap 189d60057e5f3 mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 be6eccccec867 smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid 284877c6189fd smb: client: fail DACL rewrite when the new DACL exceeds 64K 604feb3e8141b smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() 674d783f2e80d scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size 64a7ed42e9766 f2fs: accurately adjust free_sections during free_segment_range 40dcd4a71a524 scsi: qla2xxx: Skip vport under deletion in report ID acquisition 6c71726cdfda9 scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock 925a9129a514b scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error d12e92e72db91 wifi: cfg80211: reject duplicate wiphy cipher suite entries 971b40e3ca127 fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() 493a029c205a9 wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] dc5778dbd0b6c ocfs2: validate external xattr entries when reading metadata 45c534c5bf43a firewire: core: fix memory leak in error path of build_tree() e6c3a43d0a41f nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net 3861eeabaebe2 svcrdma: Validate Read chunk positions before reconstruction c4c71368bc5c5 iommu/sva: Set handle->dev before the SVA handle is visible 6e5333ec3bd8f iommu: Pass domain to remove_dev_pasid() op 80eaeae0e4b1e md/raid1,raid10: fix error-path detection with md_cloned_bio() 91d0fc000d8cc md/raid1,raid10: fix bio accounting for split md cloned bios 50d1a47fb3c4f btrfs: fix deadlock cloning inline extent when using flushoncommit bce2eec05bce5 Bluetooth: hci_core: Fix UAF in hci_unregister_dev() 441250eea8460 cxl/region: Resolve region deletion races b869e3e4ce199 net/handshake: hand off the pinned file reference to accept_doit 59db5d8bcc65e erofs: fix use-after-free on sbi->sync_decompress 98cc0403f546c netfilter: revalidate bridge ports 966b941ca469f greybus: raw: fix use-after-free if write is called after disconnect f65a96fe2467a ceph: fix num_ops off-by-one when crypto allocation fails bca0597272f97 KVM: SVM: Add missing save/restore handling of LBR MSRs 1cde96d5d53b9 hwrng: core - use RCU and work_struct to fix race condition aead84bdacd77 netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation f988fbf0536b4 media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC 690145822dd73 media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure 0870f10cbdaa7 media: hantro: Disable multicore support 414396c42ef20 ASoC: qcom: q6asm: drop DSP responses for closed data streams 253523cd4dd7d ASoC: qcom: q6asm: handle the responses after closing 8c24b5179af26 RDMA/efa: Fix use of completion ctx after free 127c5e6e2d6fa ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS d4bee74b7cb93 drm/msm: Recover HW before retire hung submit a75e5de593ef1 ACPI: platform: Use acpi_bus_get_primary_device() c4672bdc4730d net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work ba8bc644f1685 xen: fix UAF in dmabuf_exp_from_pages() d3c8519f85b78 HID: nintendo: avoid bluetooth suspend/resume stalls 155bc8f94d52c net: dsa: b53: do not enable EEE on bcm63xx b101fc9ac18d1 scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set 41168ed90f98e bpf: Mark raw_tp arguments with PTR_MAYBE_NULL d02dd7ce8e52b PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() bb2b3e6047163 PCI/sysfs: Demacrofy pci_dev_resource_resize_attr(n) functions a8adf64fe7fd5 genirq/proc: Size interrupt directory names for 10-digit interrupt numbers 482ba972f9638 pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction 8ddda06ae356f drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw 0786b38af822f drm/amdgpu: Bound GPIO I2C table entry count from VBIOS 445835710fd0e drm/amdgpu: rework i2c init and fini 5db7d4e7c980f drm/amdgpu/atombios: drop empty function 079ec13f481cc drm/amdgpu: Remove unused amdgpu_i2c functions d2ea99884793c wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed 68059b6e9f729 tty: serial: 8250: protect against NULL uart->port.dev in register 59442ba701d3a serial: 8250: invert serial8250_register_8250_port() CIR condition d5eb39d6178ca driver core: Avoid warning when removing a device while its supplier is unbinding 6e9e007ee1dfb virt: acrn: Fix irqfd use-after-free during eventfd shutdown 7c9fee40fc8d8 RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() 50bf37362362c wifi: iwlwifi: mvm: fix P2P-Device binding handling 567d7c3f93f8d drm/amdgpu: harden FRU PIA parsing with bounded helpers cf1dadc5d24ee drm/amdgpu: Refactor FRU product information c1f2f34d681a0 drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq 6fc7ab7fcd7ee drm/amdkfd: fix SMI event cross-process information leak 84fc3f30b87e0 pds_core: quiesce DMA before freeing resources 29723256fccf4 exfat: fix handling of damaged volume in exfat_create_upcase_table() af3c9c0bf8542 exfat: resolve memory leak from exfat_create_upcase_table() 1d8e1e99b063d perf: Fix addr_filter_ranges lifetime 8e4a07ed82bae wifi: mac80211: ibss: wait for in-flight TX on disconnect 2c5db82778f56 smb/client: zero-initialize stack-allocated cifs_open_info_data c422d5d53f135 wifi: iwlwifi: pcie: null RX pointers after free 5e871c03506c5 wifi: iwlwifi: mvm: validate TX_CMD response layout 88767bf9fd2e7 wifi: iwlwifi: mvm: remove mvm prefix from iwl_mvm_tx_resp* 7c293e83d86cf ksmbd: fix maximum allowed access checks d46b67c245229 ksmbd: remove redundant DACL check in smb_check_perm_dacl 190f3bdfaef8d perf/x86/intel/pt: Fix stop/start with no update 7abab59d6c99b remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 e36b1c2eafcaa powerpc/xive: propagate IPI init errors to prevent use-after-free d929980d771f8 powerpc/xive: add error return value to xive_smp_probe() 50ddd82b88b1d ACPI: bus: Introduce acpi_bus_get_primary_device() bf75f14d755f9 memcg: make the v1 soft limit knob inert 28c5a3a572f6c svcrdma: Reject Write/Reply chunks with segcount 0 94b450977c602 nfsd: convert nfsd_net boolean flags to unsigned long flags word e7c1923c5f30a mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() 64b1a9384db9c iommu/arm-smmu-v3: Manage teardown with devm 6640f778aa3d4 i3c: master: Fix recursive locking during device registration 41b2025709ec1 nvdimm: virtio_pmem: refcount requests for token lifetime 1f661f42beb55 drm/v3d: Clear queue->active_job when v3d_fence_create() fails d2d40574b9b27 cxl/mbox: Clamp mailbox output allocation to the payload size cda8af27b787d drm/amd/display: Fix dangling pointer in plane reset function ef3293c87a79f drm/amd/display: Fix dangling pointer in CRTC reset function 4dda09e7ca0bf mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug 06bdccd50bb9a mm: name the anonymous MMOP enum as enum mmop 5b1ebdc12131e mm: change type of state in struct memory_block 2ba67aa183a3c dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout e37c67f768234 hwrng: core - fix rng list on registration error 642648fa75952 cgroup/cpuset: Make nr_deadline_tasks an atomic_t f048044ad2e5f cgroup/cpuset: move common code to cpuset-internal.h 2294a8302bacb cgroup/cpuset: introduce cpuset-v1.c 94033c193bc38 bpf: Reject MEM_ALLOC BTF accesses past object bounds 5b8a40de738b7 time/namespace: Validate nanosecond field in proc_timens_set_offset() 56f92fecd8041 bpf: Reject writes through untrusted BTF pointers 30674a7bbf203 platform/x86: dell-wmi-base: Fix handling of ultra performance key fc45f6e4b86c2 platform/x86: lg-laptop: Fix LED resource handling 2147065d3a4e1 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max 72888d54bae36 usb: gadget: uac: validate rate list length before storing 959ed35f8c8f0 platform/x86: asus-wmi: fix resource leaks on probe failure 0c57c1aede122 platform/x86: asus-wmi: disable USB0 hub on ROG Ally before suspend 201bdf10ae92e esp: do not unref managed frag pages in esp_ssg_unref() b7129930d1ec4 RDMA/rvt: Return NULL after port allocation failure e835bd88ce9dd firmware: arm_scmi: Clean up channels on setup failure d8ecdceeb90cd firmware: arm_scmi: Fix SCMI device destroy lifetimes bd2a5a876904e drm/msm: Only fini scheduler after successful init f3eddc7913e14 drm/sched: Use struct for drm_sched_init() params a6090eeb289c5 bpf: Zero queue and stack outputs on lock failure 7285f004293e7 riscv, bpf: Fix memory leak in bpf_jit_free 28dbc73272283 bpf: remove unused parameter in bpf_jit_binary_pack_finalize 0ee638956cc08 powerpc/bpf: rename powerpc64_jit_data to powerpc_jit_data 29a2a166450a3 ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() 3886d944b506e RDMA/erdma: complete object teardown when the destroy command fails a5c6316052f0f bpf: Fix WARNING in bpf_tracing_link_release dc6e5d802c884 pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip 566109f1ee4e3 scsi: ufs: core: Validate string descriptors dc884df788e60 scsi: ufs: core: Convert string descriptor format macros to enum 9265fa8190312 spi: oc-tiny: switch to managed controller allocation 6e3e93bc718c4 clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path d867db0a26029 PCI: Fix UAF when probe runs concurrent to dyn ID removal ec023f18ace20 PCI: Fix dyn_id add TOCTOU 65b1fb5670e46 PCI: Make pci_match_one_device() match on ID instead of device e1b23f264f360 PCI: Initialize temporary device in new_id_store() 68c1d2c085f20 RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() d4aec20f3a846 wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() 79c6f4f7d16ee wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() b2ecd548f89a4 wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() c9c1e3da0a206 firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published 0b187e14dab45 md/raid1: create serial pool adding rdev to array with serialize_policy=1 5a540ced720b4 misc: sgi-gru: remove interrupt-context page-table walks e086ef5a0e310 mm/treewide: replace pmd_large() with pmd_leaf() 2c321f86846ea wifi: mt76: fix non-AQL packet accounting for MLO stations 7198d8fcfdd3e wifi: mt76: mt7915: unwind state on add_interface failure 3d079589add6e wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface() a582b1d54313d wifi: mt76: mt7915: allocate vif wcid in the same range as stations bc4f4389f439e wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER 5dd845c6388c6 wifi: mt76: cancel reset and rc work on device unregister 7f96bf0d24b2a bpf, x86: Fix trampoline stack size for 128-bit arguments 332c9c1a148d0 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry 5f47c9bc4a62e wifi: nl80211: clean up color-change beacon data on errors 51423d370739a wifi: nl80211: check link is beaconing for color change 66b89c6a7da47 wifi: brcmfmac: fix P2P action frame handling without device vif 9374943fc5a45 wifi: cfg80211: stop PMSR before P2P and NAN teardown e2ddbfd826836 serial: core: do fallible allocations before the console can be registered a9c0ffe5930c9 serial: core: clear freed pointers on uart_register_driver() failure ea3d2fae7c1d6 tty: skip cdev_del() when no cdev is registered 360a49fc53acd HID: logitech-hidpp: Fix FF device cleanup on init failure 37cb84b992718 HID: steam: Reject short reads 17c18a0df70c2 blk-cgroup: fix race between policy activation and blkg destruction 7f97c762b5f6e ublk: check import_ubuf() return value 7dec19f6bafe4 ocfs2: validate inline xattrs during inode block validation df002834cfd88 thermal: hwmon: Remove hwmon class device along with its parent 233f1b7fe2980 RDMA/erdma: Hold QP references for AE and CM processing b672d4de13247 ocfs2: o2hb: quiesce negotiate handlers and timeout work d64708cc119db ocfs2/cluster: keep heartbeat local node stable c0da108b346db ocfs2/heartbeat: fix slot mapping rollback leaks on error paths 4acc761b4e3fe bpf: Clear buf on error in __bpf_get_task_stack a3205bd1f2180 module/dups: Fix use-after-free in kmod_dup_req lifetime handling decea8279bec5 drm/amd/display: Resize MST HDCP per-connector arrays to 32 ba63c62d4252f coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable 710a2448a06a8 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails c97277aa6ce8a btrfs: defrag: fix deadlock between defrag and delalloc space reservation 043b6fd9706e4 btrfs: always wait for ordered extents to avoid OE races 20b2c2f3316e8 btrfs: check if root is readonly when setting posix acl 202ac9e469b78 btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() 0fa448369c87e Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind 98666d8feb514 Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero 16c8321ee40c4 bpf, cgroup: Fix storage null-ptr-deref after replacing prog b6c9daf6097f9 bpf: Fix mmap_lock leak in irq_work path 9e71e332fa2c7 NFS: Return a delegation the client fails to record a457ff1189f22 amt: Don't support cross-netns setup. 8f823b47eb889 clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type af811970da4f0 nvmet: fix max_qid race between configfs and controller allocation f535a34831f83 ocfs2: validate orphan slot during inode read eacdd27ca8297 ocfs2: validate DIO orphan slot during inode read 08a31a2cc3d1c null_blk: free zones array on device power-off 53ccb4b967edc blk-iolatency: clear delay state when freeing policy data 6b59f976db5de blk-iocost: clear delay state when freeing policy data 7166d3d60606e blk-cgroup: delay freeing policy data after rcu grace period 5f1fedccf3f7a apparmor: fix deadlock in complain-mode change_hat 67223b1150a9e ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() 7148a6c06ddf1 ksmbd: serialize oplock close with pending break ownership 5ffd180307a5e smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request() b68d4bb6b03a6 ksmbd: defer publishing granted locks to prevent UAF/double-free race 795dca34a4154 erofs: fix interlaced ztailpacking pclusters ecdcfa15b3d79 ksmbd: safely discard unregistered deferred locks d20d3f6ad8b0b ksmbd: detach blocked lock requests before freeing 3deefd5fb1368 ksmbd: scope session state changes to bound connections 988f99bfddda4 smb/server: fix session leak in ksmbd_session_register() 51d162dfb618f pnfs/blocklayout: Fix device leaks on parse failure 336b6da10021c NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers e25e5b4a76463 NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() 742d0884a1c95 filelock: add some new helper functions 64348c55dd759 vsock: don't check the listener's sk_err in vsock_accept() 45be87c5195f3 net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() 793163e134028 ALSA: mtpav: shut down output timer before card teardown 43451ec94fb67 net: qlcnic: validate unified ROM sections before loading 7f8287f606c8c ip6mr: do not clone dst in ip6mr_cache_report() c5ca770248125 net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue a23a464fb58eb net_sched: sch_fifo: implement lockless __fifo_dump() 490c72868443f net: bridge: arp/nd proxy: fix reading neigh ha 6093baf2b2c57 vxlan: fix reading neigh ha ed54460caf5b5 NFSv4.1: zero referring call lists before decoding 5fbb06d4f3d4c net/sched: account classifier filter allocations to memcg 4cc1ba2b31065 Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition 19e154d794eb4 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt a78d16530c153 Bluetooth: do not leak an hci_conn when a second LE connect is rejected bdc530baf079e octeontx2-vf: fix workqueue and netdev race in probe/remove b951dd2fd5ede net/sched: act_ife: Only operate on Ethernet frames fd63409b669f9 net/sched: fq: add overflow bounds to quantum and initial quantum e85f039cf271c net_sched: export pfifo_fast prio2band[] 87ec1c55104a1 net_sched: sch_fq: change how @inactive is tracked 3e613afdc2c0c net_sched: sch_fq: struct sched_data reorg 9cbf6da967ec8 netfilter: nf_tables: skip double clone set expressions on element insert 7ee50d42a6d5c HID: sony: clean up device list on probe failure adc34b5df5c5d NFSD: Prevent client use-after-free during close_lru reaping 0d53a47c913d0 NFSD: Prevent client use-after-free during blocked-lock reaping 7a50e138fa28e usb: dwc3: clear forceRM when issuing EndTransfer 5212f8f452b87 usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior 13e9f5a913609 usb: gadget: f_midi: initialize work in f_midi_alloc() 0729ac4976410 usb: gadget: f_midi: Annotate struct f_midi with __counted_by 8cc9c5a8c559d tracing: Take trace_array reference when opening options file ad61defb3e66a dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds 6e904f9e8cb0e mm/huge_memory: transfer the pmd dirty bit to the folio on zap ffbdc2a3834a3 powerpc/kexec_file: Prevent kexec range truncation 22dc712c170ef s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects 4bf5525c6ff4a iio: light: ltrf216a: fix runtime PM reference leak in error path 49ab1dd9051d4 iio: light: ltrf216a: Return floating point values 1759a565a25c8 KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU 5c63e2ed840c8 KVM: s390: Fix memory corruption by not reinjecting CK machine checks 50fbc294e4e96 LoongArch: BPF: Refactor jump offset calculation in tail call 22760e3e9cecb f2fs: avoid NULL checkpoint thread access in sysfs ac1284f16d560 f2fs: use new ioprio Macro to get ckpt thread ioprio level d358d2fc6be11 f2fs: fix to migrate all curseg types during free_segment_range 58ca9f0648045 f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() 21b7f66716b4f f2fs: fix to clear dirty flag on folio in error path 668cfb8ab3e22 drm/amdgpu: avoid force-completing uninitialized UVD rings 11adb2bae30a3 drm/amdgpu: force complete the KIQ ring fences on reset 5bbd7f283312d drm/amdkfd: Add TLB flush after MES queue eviction/suspension 44cad7ea3532f drm/amdkfd: Fix error path at svm_migrate_copy_to_ram 6e1a6f3ddb87d drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram 5db663fbff7b8 drm/nouveau: unsubscribe the channel-kill event before the fence context 42085d8ff5bbf drm/nouveau: remove chan->drm 5362be1dc65e4 drm/nouveau: remove nouveau_chan.device 2549b61ea1a32 drm/gpuvm: rename struct drm_gpuva_manager to struct drm_gpuvm e79a70c2e97ae bpf: Disable preemption in bpf_get_stackid b4a80e9e639cf PCI: Allow per function PCI slots to fix slot reset on s390 76ca11e31884b PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value 134d980491b43 ksmbd: zero pipe read compound padding ca3a3984bf445 ksmbd: fix tree connection use-after-free in smb2_tree_connect() f1cd6c4c35243 mm/kmemleak: avoid soft lockup when scanning task stacks b1d7c69e6c7d3 mm/mglru: fix and remove redundant unevictable folio handling 92db780dd6445 mm/migrate_device: clear stale mapping after freeing swapcache c2745e657f097 zram: fix out-of-bounds access in writeback_store() a5fda7def04d9 zram: set default primary compressor in zram_destroy_comps() 52d0c5bdfe232 NFSD: check truncate permission under inode lock 64b3baebaf945 nfsd: Pass 'cred' instead of 'rqstp' to some functions. 43943532c105e lockd, nfsd: RCU-protect nlmsvc_ops dispatch d12af460df278 nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke 172d038b7c4d3 nfsd: split sc_status out of sc_type 02b0532d4e5a6 NFSD: Clean up nfsd4_encode_layoutreturn() ec55ebe19a4b1 NFSD: Clean up nfsd4_encode_stateid() 2d4f845dffca7 NFSD: Add simple u32, u64, and bool encoders bdce362f49410 nfsd: fix stale s2s_cp_stateids IDR entry for async COPY 98fc1d21a7b80 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops 94f0c73797c30 NFSD: Prevent client use-after-free during delegation revoke 352a278d5a196 ceph: fix UAF in check_new_map() on session freed during unlock 8194d8e61ef0b ceph: cap delegated inode count in ceph_parse_deleg_inos() dd2e9824e5e7d ceph: do not repeat ceph_trim_dentries() if no progress possible 7b8c6af172878 btrfs: drop recovered reloc root refs on recovery failure 772d39c658543 btrfs: rename err to ret in btrfs_recover_relocation() 152610f284de4 btrfs: rename ret to ret2 in btrfs_recover_relocation() 64b870dff9fed btrfs: rename ret to err in btrfs_recover_relocation() cb732d302245b btrfs: fix extent map leak in NOCOW direct I/O write 5463d96cd2e46 cifs: call pagecache_isize_extended() in cifs_setsize() when extending b70bc592afd19 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() d837645a71915 smb: client: reject a tree connect response whose byte count is too small bd146a8ff107c HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes 61f7f4fdc0a83 HID: mcp2221: fix OOB write in mcp2221_raw_event() b879565effd88 ext2: Fix lost inode updates for IS_SYNC inodes 719e69421de28 bpf: Disable preemption in __bpf_get_stack 0e3b8f371c385 dm array: validate array block headers on read de932ab28a17c jbd2: use shrink_type type instead of bool type for __jbd2_journal_clean_checkpoint_list() 882212d317a7c ip: orphan prefetched skbs before multicast forwarding 62b63a505c10e ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() fe3746b41d491 ipv6: annotate data-races around devconf->rpl_seg_enabled f99fedfd1dbff sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir b2e9e10f5a536 SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 5bf47bbea3c22 svcrdma: Reject connection when transport allocation fails 5cd069ad1cf7f svcrdma: Handle ADDR_CHANGE CM event properly 8068358f445a1 svcrdma: Reject inline replies that overflow the pull-up buffer beb4e9801f636 svcrdma: Reject Read lists that exceed the page budget 2e35ec558b8ce svcrdma: Use svc_xprt_put to free listener on create failure 38bd18764b766 sunrpc: xprtrdma: Use ERR_CAST() to return 45746d4536ce1 svcrdma: Refactor the creation of listener CMA ID a2a16896ed530 sched/core: Make core-sched flips wait for in-flight selections 6db5af172ccc3 lockd: fix NULL dereference on lockowner allocation failure e5e213ddd69e3 lockd: adapt to breakup of struct file_lock 977ab74712aec filelock: split common fields into struct file_lock_core 6e1645a6ee85d power: supply: charger-manager: register regulators before exposing sysfs 3cda6fe44ec6a power: supply: charger-manager: Convert to platform remove callback returning void 4e3d3923976a9 power: supply: lp8788-charger: fix use-after-free on remove 5625c186f4088 power: supply: lp8788: Use devm_power_supply_register() helper fee7e9a801d1d power: supply: lp8788-charger: Convert to platform remove callback returning void bcdcbef9c5e69 power: supply: max17040: propagate register read errors 6a1ae47211376 iommu/msm: Unwind probe state on registration failure f7c9370dd1d3c platform/x86: ISST: Add a NULL check for sst_inst[] d680ce2b39f9a platform/x86: int1092: Fix potential memory leak in sar_probe() 380b305ad7e34 platform/x86: intel_sar: Check ACPI_HANDLE() against NULL 85ef9d4c384c1 platform/x86/amd/pmc: Propagate SMU errors and validate S2D address 7efe1c31e0903 net: l2tp: do not propagate multicast notification errors b917f37bfcce9 net: ravb: serialize PTP clock teardown 297e96f38d3e4 net/smc: stop killed, freed and out_of_sync sharing a byte 5fa0e71d66636 net/smc: Address spelling errors b78e34ed7e977 mfd: sm501: Fix potential memory leaks during remove b0b8ddaf15110 mfd: sm501: Convert to platform remove callback returning void 7be73911d979b wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() ab403b9db6f71 wifi: iwlwifi: dvm: pair transport op-mode enter/leave d6774f6af3711 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy 3a2d2115ed890 wifi: mt76: mt7915: set correct background radar capability d0c240f25e654 io_uring: defer eventfd signaling when queued from a wakeup handler c0376820922d2 net: tap: fix wrong transport_header when sending VLAN-tagged frame 11ff7642740e6 tap: Keep hdr_len in tap_get_user() 2b9ddb7311c79 ntb: Store original DMA address for future release 4a62c07dd7c15 NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers e85074045bab5 NTB: core: Add .get_dma_dev() callback to ntb_dev_ops 99b82c8452887 tipc: avoid busy looping in tipc_exit_net() 82257379061c0 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp 0464d55734f85 RDMA/rxe: Merge request and complete tasks 603e0ae0bea60 RDMA/rxe: Remove redundant scheduling of rxe_completer 788fbbf7d61f9 tcp: clamp route advmss to TCP_MIN_MSS 3130e7bf43ecf fbdev: Wrap user-invoked calls to fb_set_var() in helper 90be10604936c Bluetooth: ISO: zero the sockaddr before returning it in getname 9a1bd9fd13266 selinux: reject a permission value exceeding the class permission count fef8c8afcb85d drm/amdkfd: Add bounds check for CRAT subtype length 2cbc1fbfc57b1 drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length 5702e4c259809 bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie 07b52a4176572 drm/amd/display: use proper context for logging 84cf00b1376c7 dmaengine: idxd: fix double free of wq, engine, and group structs c41fa44be44e4 hwmon: (sht3x) Fix unaligned accesses a9133c4d335e4 net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller f0a544ef6e38e Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks a1656234a4a2d Drivers: hv: vmbus: use generic driver_override infrastructure 3d7b808ec3529 netfilter: nf_conntrack_expect: use conntrack GC to reap expectations d031617045dc7 cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size 75ed49f973d79 soc: xilinx: Shutdown and free rx mailbox channel b447688f492b8 soc/xilinx: zynqmp_power: Convert to platform remove callback returning void c305853027c04 scsi: hisi_sas: Add slave_destroy interface for v3 hw 592a0e78ab08f media: atomisp: gc2235: fix UAF and memory leak fa9560b6d3f66 EDAC/igen6: Fix call trace due to missing release() 95cda0446f510 netfilter: synproxy: fix unaligned memory access in timestamp adjustment 370c79e93f0f0 netfilter: synproxy: adjust duplicate timestamp options 1c6cb2838f82e netfilter: synproxy: drop packets if timestamp adjustment fails f03312dad6abe netfilter: make nftables drops visible in net dropmonitor 1b52aeb40c9f0 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag d9b17f9ce67d0 btrfs: lzo: reject compressed segment that overflows the compressed input 30e5ee98e86ad octeontx2-af: npc: Fix size of entry2cntr_map bf862fdee4831 ALSA: seq: oss: Serialize readq reset state with q->lock 31633ba13cc49 coresight: ete: Always save state on power down c67e70202cfd6 ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() 24a753a49d068 tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg 67a5d905c17a5 drm/amdgpu: reject oversized IBs with per-ring packet limits 1ec5f6aa38ea9 scsi: core: pair EH runtime PM get and put 4a4410de8dc69 sctp: validate cookie AUTH state before use 2512289cbf587 ipvs: revalidate ihl to prevent out-of-bounds access bd897e414451f l2tp: fix tunnel and session refcount leak on seq_file release 3770a4794a143 firewire: ohci: fix NULL pointer dereference in ar_context_release 5d05c4252c09c gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock b87c0d24386ed soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read 5d00c9c1c951a btrfs: lzo: reject inline extents without valid headers fb22bedf0c4f4 bpf: Fix netns reference imbalance in conntrack kfuncs 96da3e1439e7d vhost_iotlb: bound map allocation in add_range ce443f6827b97 hwmon: (pmbus) Fix type confusion in notification logic 4db3b48a966ed netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() 950dac9e8c4e3 s390/ism: Fix UAF of sba and ieq during ism_dev_exit() a9e0efcb1125e watchdog: at91sam9_wdt: prevent timer rearm during teardown 61dd022c55c73 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() cc325ce1c40a1 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx c71bacacd5916 tls: rx: restore msg_iter before TLS 1.3 optimistic retry e3738530ad9c9 selftests: tls: add rekey tests bea345a8d2f02 selftests: tls: add test with a partially invalid iov 25d27d5fa8645 eventfs: Use children field for rcu head and add memory barriers f6cf9832e677e mm/page_table_check: skip special zero mappings ca05d9abde219 btrfs: skip global block reserve accounting for rescue mounts 71714a2cec6c6 netfilter: nf_tables: make nft_object rhltable per table c24b3379c0ff0 xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx 724c8edbacf12 net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds 52c753b462652 net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() 44590dc53c9e9 Bluetooth: ISO: hold sk properly in iso_conn_ready 1106b26e86ac1 octeontx2-af: Block VFs from clobbering special CGX PKIND state dd1a334523ba5 s390/zcrypt: Close speculative mem read possibility f82d42577ee4a wifi: ath11k: cancel SSR work items during PCI shutdown 932ebfad767be OPP: Fix race between OPP addition and lookup a6c5f5d98719e RDMA/hns: Fix log flood after cmd_mbox failure bc963e193b314 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data fc11e3f0daaad nvmet-tcp: fix page fragment cache leak in error path 3f5e8fa9ae290 net: introduce page_frag_cache_drain() bc53b85adb103 nvmet-tcp: allocate socket file cc1c1682fa593 nvmet-tcp: make nvmet_tcp_alloc_queue() a void function 923a6f3172a36 md/raid1,raid10: fix deadlock in read error recovery path d960cd5dbcc6a wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() 0fe5ca2d56f01 vhost: fix vhost_get_avail_idx for a non empty ring 578a4ee936b40 vhost: move smp_rmb() into vhost_get_avail_idx() 9cb2db3791df9 vhost: correct misleading printing information dcabbf7da4382 ocfs2: validate fast symlink target during inode read 394317e96702a ocfs2: add extra consistency checks for chain allocator dinodes 1241e459a1bd1 netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount ff584d3735b13 RDMA/siw: Fix endpoint/socket association handling 7b17fdbfb5c9e RDMA/siw: Introduce siw_destroy_cep_sock 628a469d2a73e bpf: Clear rb node linkage when freeing bpf_rb_root f0a49d16804d3 bpf: Reject sleepable BPF_LSM_CGROUP programs at load time ec485257ccbc7 ixgbe: do not configure xps for XDP queues 663f184b51492 ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT eae296065ede4 ALSA: seq: Fix kernel heap address leak in bounce_error_event() 7d07df8a200ca ALSA: seq: Drop superfluous filter argument of get_event_dest_client() 8efa9fcc1d31b cxl/region: Block region delete during region creation 3e8f3959a7fd2 bnxt: fix head underflow on XDP head-grow 2fc2c92320272 net: watchdog: fix refcount tracking races ae429220c7f97 ALSA: seq: avoid stale FIFO cells during resize 348a52e50a462 ALSA: seq: Clean up fifo locking with guard a0024ab97592a ALSA: seq: fifo: Use guard() for locking 6b59007d95aee sockmap: Fix use-after-free in udp_bpf_recvmsg() 88baaa8ca3731 RDMA/bnxt_re: Initialize dpi variable to zero 8e59bd37d6d63 RDMA/bnxt_re: Avoid repeated requests to allocate WC pages 7d89bff21c12e RDMA/irdma: Replace waitqueue and flag with completion a2275dce05e6d soundwire: fix bug in sdw_add_element_group_count found by syzkaller a562485c359d0 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE 921e2baa626d1 md/raid1: fix writes_pending and barrier reference leaks on write failures f076460c5205c md/raid10: fix writes_pending leak on write request failures 6d21a3fed9be4 md/raid10: Handle bio_split() errors 80ac31cce5543 md/raid10: fix writes_pending and barrier reference leaks on discard failures 669bc3b345712 bpf: Guard conntrack opts error writes d0282a1546e75 bpf: net: netfilter: drop dead NULL checks 158a5480d5196 md/raid5: avoid R5_Overlap races while breaking stripe batches f49ed02fd8c98 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync 6aeb4ba4fb098 tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() 81892d83cc897 sctp: add INIT verification after cookie unpacking cd0e037130806 hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() 5098308ad72f8 sctp: fix addr_wq_timer race in sctp_free_addr_wq() 72e27ef70a202 xen/pvcalls: bound backend response req_id before indexing rsp[] 2e7888bb635d9 afs: Fix reinitialisation of the inode, in particular ->lock_work f72176bde0cc0 HID: bpf: Fix hid_bpf_get_data() range check 268869794170a net/mlx5e: Fix publication race for priv->channel_stats[] 333a39f134dd0 Bluetooth: 6lowpan: avoid untracked enable work e3b20de8d7c06 net/liquidio: drop cached VF pci_dev LUT 3b0aa139ba09a perf/x86/amd/core: Avoid enabling BRS from the SVM reload path db2b40dc12cd6 gpio: mvebu: free generic chips on unbind 2d0effadf8d2c ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() 65d35cb555f40 netfilter: nft_lookup: fix catchall element handling with inverted lookups eb74f3feb68e6 KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling 043c509f24880 mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch 6626fb859f4c4 fs: Remove NTFS classic 1dc6653c47147 mtd: maps: vmu-flash: fix fault in unaligned fixup c286319746cef ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec df99ca9b5b8e2 ocfs2: validate i_refcount_loc when refcount flag is set b8fa4d063e3b0 ocfs2: add suballoc slot check in ocfs2_validate_inode_block() f4cd214883d77 ocfs2: correct l_next_free_rec in online check 584d7d14d9b40 nvmet-auth: reject short AUTH_RECEIVE buffers 0bdb510cd7c4b nvmet: Introduce nvmet_req_transfer_len() 374775626c327 dm-verity: fix buffer overflow in FEC calculation face65f80c694 mmc: vub300: fix use-after-free on probe failure 181b46e76a218 wifi: ieee80211: validate MLE common info length d0951ed366710 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey 7e13e5b087375 ovl: check access to copy_file_range source with src mounter creds 98ca831065c4d net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 3b71f51fa3a24 LoongArch: Fix address space mismatch in kexec command line lookup aa24049ce2fc9 loongarch, kexec: change dependency of object files 4927ab8a8acc8 xfrm: fix stale skb->prev after async crypto steals a GSO segment d52ff592abfcd RDMA/irdma: Prevent user-triggered null deref on QP create a5afc00280986 wifi: mac80211: defer link RX stats percpu free to RCU 88f31eac74b9d wifi: cfg80211: add link_station_info structure to support MLO statistics 0246df249c04e wifi: mac80211: refactor populating mesh related fields in sinfo 30c67926d41c4 wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock c55590e4c69e0 wifi: cfg80211: use wiphy work for socket owner autodisconnect d312a71b19bb8 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() f6814814b3bdd bpf: Fix UAF in sock clone early bailouts 95ddf04135a78 bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c 8faa3deda8d06 rcu: add rcu_read_lock_dont_migrate() c0131f007dd29 bpf: Disable migration when cloning sock storage bba24ce0e5299 bpf: Disable migration when destroying sock storage 4827c824a203e scsi: core: wake eh reliably when using scsi_schedule_eh 3ff6b534d2082 tipc: serialize udp bearer replicast list updates bac237c2aedb8 pds_core: fix use-after-free on workqueue during remove 895b3f83f030c pds_core: Clean up init/uninit flows to be more readable c004f1985c570 pds_core: Don't assign interrupt index/bound_intr to notifyq c968b2417f6a1 cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths 9e904b3608444 cifs: prevent readdir from changing file size due to stale directory metadata 3be8dcc1a5854 drm/vc4: hvs/v3d: Fix null dereference in unbind c8a4acc19dcdc net/mlx5: Fix MCIA register buffer overflow on 32 dword reads 3531910845165 drm/amdgpu: Fix context pstate override handling 2b817c0dfc653 drm/amdkfd: Check bounds on CRIU restore queue type and mqd size dc30139679354 drm/i915/bios: range check LFP Data Block panel_type2 bedeee4612afc drm/i915/gt: Fix NULL deref on sched_engine alloc failure fae63319ad397 drm/i915/mst: limit DP MST ESI service loop 1748043b5114c drm/amdgpu: Release VFCT ACPI table reference 8151bfd641384 drm/amdgpu: Add wrapper for freeing vbios memory 9ed82f9cb1d6c drm/amdgpu: Use dbg level for VBIOS check messages cf55c6f1b62a8 drm/vc4: Shut down BO cache timer before teardown ae6ccae32f51f media: vivid: fix cleanup bugs in vivid_init() 1d0b99ef7fcb6 LoongArch: Move jump_label_init() before parse_early_param() a2516be690488 ksmbd: fix path resolution in ksmbd_vfs_kern_path_create 3350acfa72b2e vfs: make LAST_XXX private to fs/namei.c 3100f7fc873bb ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name a7bf4f5b19965 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state 9174992ee1045 Bluetooth: eir: Fix stack OOB write when prepending the Flags AD 22e371a93563c net/handshake: Take a long-lived file reference at submit 3e339c88b8c30 ALSA: hda/cs35l41: Fix firmware load work teardown eec1dd2586c40 ksmbd: prevent path traversal bypass by restricting caseless retry 2ad5509dd576a ksmbd: use opener credentials for ADS I/O a6a951416b55e ksmbd: validate NTLMv2 response before updating session key 6825a45f6b8ef smb/client: fix chown/chgrp with SMB3 POSIX Extensions 0f012938f2130 cpufreq: qcom-cpufreq-hw: Fix possible double free 203016396f00b cpufreq: Make cpufreq_driver->exit() return void 41401e2f4c175 cpufreq: pcc: Remove empty exit() callback 4e7d3c98fed73 USB: iowarrior: fix use-after-free on disconnect race 8ae9bb92fc9a7 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page 11d48f777cf8f crypto: qat - protect service table iterations with service_lock 02b88fa993582 hwmon: (lm90) Add lock protection to lm90_alert bdad77438cc2b drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() 3812cfe6cb0a5 erofs: fix metabuf leak in inode xattr initialization 8efbea0253b7f ksmbd: validate SID in parent security descriptor during ACL inheritance 5fe97797412aa wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb 55b170713aa54 wifi: mac80211: fix missing RX bitrate update for mesh forwarding path 5ea15e7823225 netfilter: x_tables: allocate hook ops while under mutex 2a5defedd154a netfilter: x_tables: allow initial table replace without emitting audit log message 124f5187c3dd5 netfilter: Use kmemdup_array instead of kmemdup for multiple allocation ff9ecefd488a4 mm/util: Introduce kmemdup_array() 6fe4c808b6cdb netfilter: ebtables: move to two-stage removal scheme 5fc488f46086d netfilter: bridge: eb_tables: close module init race 1fe96176636cb hwmon: (lm90) Stop work before releasing hwmon device b28b862b07257 cgroup/rstat: validate cpu before css_rstat_cpu() access 14dbf22c397b7 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure ee4b2ba9d3015 net/handshake: Drain pending requests at net namespace exit 7b81c1378b79c Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close 6bacd22e1eae7 usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers 816c6251409db usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() bbd3a27e4f99f KVM: SEV: Ignore Port I/O requests of length '0' e35cf322897dd drm/amdgpu: fix amdgpu_hmm_range_get_pages 525cc9df65436 drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring b0f7bd5eeb903 gcov: use atomic counter updates to fix concurrent access crashes bcc9df992f3cb f2fs: read COW data with the original inode during atomic write 5e10b1747547c fbdev: omap2: fix use-after-free in omapfb_mmap 2d60e3b176a4b fbdev: omap2: fix inconsistent lock returns in omapfb_mmap 01930f94b8b13 drm/msm: always recover the gpu a632474c793b7 drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() 9d63dd026644f wifi: mt76: mt7921: Place upper limit on station AID 1cad9afbb2d55 drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths 793bf1f4e469c net: mana: Guard mana_remove against double invocation 4255c8f756b78 net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind 7107b047e709a btrfs: only release the dirty pages io tree after successful writes 312ecea13b677 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() 87484866cae91 wifi: fix leak if split 6 GHz scanning fails 3bad189a31eb7 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure f51a7b611bd97 tools: ynl: extend netdev sample to dump xdp-rx-metadata-features 8cb3a5ecef999 bpf: make it easier to add new metadata kfunc dd75066882ecc sctp: validate embedded INIT chunk and address list lengths in cookie d95edbbf7830d staging: rtl8723bs: fix buffer over-read in rtw_update_protection 94ea9dc65fae4 staging: rtl8723bs: clean up redundant & parentheses f90cda7f7ae75 Staging: rtl8723bs: Delete dead code from update_current_network() 890083673a623 Staging: rtl8723bs: Remove dead code from _rtw_free_network() 18143799ad51a staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction 6cdcf0d16c809 nvmem: core: fix use-after-free bugs in error paths 38434334a32c6 nvmem: core: Rework layouts to become regular devices cc7ce6736b237 nvmem: Move of_nvmem_layout_get_container() in another header 18ca42f07ad00 of: device: Export of_device_make_bus_id() cbdd6f0fb19a0 fs/mbcache: cancel shrink work before destroying the cache 1034251715a34 btrfs: fix deadlock between reflink and transaction commit when using flushoncommit fdfa287956d00 PCI: use generic driver_override infrastructure 4005cb89139f7 vdpa: use generic driver_override infrastructure dbba371b19129 bus: fsl-mc: use generic driver_override infrastructure 7bedc489611f0 wifi: ath11k: fix memory leaks in beacon template setup e9d197c248e70 powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy 6f571bf37da84 powerpc/64s: Fix unmap race with PMD migration entries a2af91af95369 wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() 533b1a9fa0128 wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() 5895cfc76924a net: pull headers in qdisc_pkt_len_segs_init() 7f0062c40781f sctp: disable BH before calling udp_tunnel_xmit_skb() 166a08644aa50 iommu/amd: Fix clone_alias() to use the original device's devid e4d07fd4e3002 greybus: raw: fix use-after-free on cdev close c260c874a6d57 f2fs: avoid reading already updated pages during GC 0645fa4d48e9b f2fs: fix data loss caused by incorrect use of nat_entry flag 359906450690a ice: fix double-free of tx_buf skb ede973d62d26d netfilter: nat: use kfree_rcu to release ops d8ddbc3330fa6 sched/psi: fix race between file release and pressure write 926ec3937b28d fsnotify: fix inode reference leak in fsnotify_recalc_mask() 759053333a40c libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() 37d028a473b08 tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR 74d33525db50d Revert "net/smc: Introduce TCP ULP support" e327021bd73b1 RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE 2405730fde96f netfilter: nf_tables: use list_del_rcu for netlink hooks d8cafd0226d5d selinux: allow multiple opens of /sys/fs/selinux/policy ef8b71a0fc692 iio: frequency: admv1013: fix NULL pointer dereference on str 7afabc08721ec iio: frequency: admv1013: add dev variable f1f4cac657f86 iio: frequency: admv1013: Use devm_regulator_get_enable_read_voltage() 58f9d54a8109f device property: Add fwnode_property_match_property_string() 3e8cdf184646c coresight: tmc-etr: Fix race condition between sysfs and perf mode d772e8570f19a drm/amd/display: Fix dc_link NULL handling in HPD init dd74a790818eb spi: mpc52xx: fix use-after-free on registration failure c6e3b9f5dcb80 spi: mpc52xx: fix controller deregistration 125a7eb177a94 spi: mpc52xx: switch to use modern name 2d8b30b496bc5 RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() d1820a5814ead f2fs: fix fsck inconsistency caused by FGGC of node block 8f3a5dc4055e1 riscv: kvm: fix vector context allocation leak 783dc000b8be6 spi: microchip-core-qspi: control built-in cs manually 03348b440f694 dm-verity-fec: fix reading parity bytes split across blocks (take 3) fcef67506c023 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 165b08d2d1346 KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 b1a45e8a59bcf KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN 2e661773890e6 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT 33deba9bf5c34 RDMA/mlx5: Fix UMR hang in LAG error state unload 4db5e4c8f1103 gfs2: fix memory leaks in gfs2_fill_super error path ab4aeab2d630e iommu/vt-d: Clear Present bit before tearing down context entry 237e0524a5381 erofs: fix inline data read failure for ztailpacking pclusters 107e169f96392 net: stmmac: fix oops when split header is enabled 12addb8ab5eec btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation 8e1623e7d61fa bpf: Fix tcx/netkit detach permissions when prog fd isn't given 11d35b1101344 ipvs: do not keep dest_dst if dev is going down b0dd8637fbaae netfilter: nf_tables: revert commit_mutex usage in reset path c36b0515c6445 iommu/vt-d: Clear Present bit before tearing down PASID entry cde7f709d1025 HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients 63f67e525be21 HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend 53aaf083de197 gfs2: Fix slab-use-after-free in qd_put 32d7120a499d4 list_lru: allow explicit memcg and NUMA node selection 60310ed5d3d3a mm: list_lru: Update kernel documentation to follow the requirements 6451ea47d60a8 net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ 1106412414dc3 net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ a71ce398347fe ASoC: amd: acp-mach-common: Add missing error check for clock acquisition baabbd2919151 scsi: qla2xxx: Completely fix fcport double free 73bb6b15f1fd7 i3c: mipi-i3c-hci: Fix race in DMA ring dequeue 04b2853fdbb2e i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue 320942ce316a1 btrfs: reserve enough transaction items for qgroup ioctls 0e77f1c8ebf5b btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() a35b38cb4b0dd btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() 87fc584a72bc4 drm/amdgpu: Skip vcn poison irq release on VF 3cd7a71958c9f drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels 5593c9b255ae7 alpha: fix user-space corruption during memory compaction a91476c7b4091 arch: turn off -Werror for architectures with known warnings aad97c92119cb usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() 480aa6ffd4ac7 9p/xen: protect xen_9pfs_front_free against concurrent calls 566899af05324 vhost: move vdpa group bound check to vhost_vdpa 6f129a251c279 kcm: fix zero-frag skb in frag_list on partial sendmsg error 1cf0ef7399188 team: avoid NETDEV_CHANGEMTU event when unregistering slave c0da84e308a0b wifi: rtw89: pci: validate sequence number of TX release report 5efde07521309 net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query 68fe91df6ea82 netconsole: avoid OOB reads, msg is not nul-terminated 56eab82fa6fb5 ksmbd: fix signededness bug in smb_direct_prepare_negotiation() 5cc021586420c wifi: iwlwifi: fix 22000 series SMEM parsing 759e44a6cba8e xfs: remove xfs_attr_leaf_hasname d60f09d2d16c4 ntfs3: fix circular locking dependency in run_unpack_ex bd5e7ba28a49b fs/ntfs3: Accumulated refactoring changes c939bfa67d221 btrfs: fix zero size inode with non-zero size after log replay cff22dd364b24 btrfs: tree-log: don't use token set/get accessors in fill_inode_item() f03cd10a3513e btrfs: convert to new timestamp accessors 20b98d9ffb097 srcu: Use irq_work to start GP in tiny SRCU 3ff29beb3b82e irqwork: Move data struct to a types header 94ad192f7b9b5 types: move struct rcuwait into types.h f8f3bb89ab677 xfrm: account XFRMA_IF_ID in aevent size calculation 34b8390ac0ba5 ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() a05a85779c257 net: ioam6: fix OOB and missing lock 73c2dc2c14d6a x86-64: rename misleadingly named '__copy_user_nocache()' function 3d6de8467236c Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers df966f0def875 HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure 218b93b7e284d HID: core: Mitigate potential OOB by removing bogus memset() ca27733152dbd HID: rate-limit hid_warn to prevent log flooding 556a757847aed HID: core: Add reserved item tag for main items 0d377825548fe mpls: add seqcount to protect the platform_label{,s} pair 5057502630fbc net: use skb_header_pointer() for TCPv4 GSO frag_off check dfee8da127baf Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists 1aac6b271e0a8 bpf: Fix incorrect pruning due to atomic fetch precision tracking 1e4b738dd0d0f Bluetooth: hci_event: move wake reason storage into validated event handlers 481f7a463ae4b drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode fdc3aa4c23d3e usb: gadget: f_ecm: Fix net_device lifecycle with device_move b1d854462510f usb: gadget: f_eem: Fix net_device lifecycle with device_move edb0804705188 usb: gadget: f_subset: Fix net_device lifecycle with device_move 9701a98f4459b usb: gadget: f_rndis: Fix net_device lifecycle with device_move ad7d18df7423c ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() 7e345de2e6947 crypto: af_alg - limit RX SG extraction by receive buffer budget 94439cbe478b5 xfrm: hold dev ref until after transport_finish NF_HOOK adc2fe90827e0 xfrm: hold device only for the asynchronous decryption a516594c502fd net: adopt skb_network_offset() and similar helpers a229a4dc87302 net: lan966x: fix page pool leak in error paths 808a34cdbe8ce rxrpc: proc: size address buffers for %pISpc output 3aa77f5da0ecb usb: gadget: f_hid: don't call cdev_init while cdev in use 777a8ebd2da35 KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock f554953cf4fab KVM: SEV: Use long-term pin when registering encrypted memory regions 1eb35c54cd81c s390/mm: Add missing secure storage access fixups for donated memory bac13309339b6 spi: spi-dw-dma: fix print error log when wait finish transaction a8a3fb2888e2c nvmet: move async event work off nvmet-wq 18a4543c1750f ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() b1f62588ab1be cxl/port: Fix use after free of parent_port in cxl_detach_ep() c5e2de193831a net: bcmasp: fix double free of WoL irq d5dcca707f56c iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() 6e8eb467bed6a spi: use generic driver_override infrastructure f69491478e3de drm/amdgpu: prevent immediate PASID reuse case 6ea2a79faed97 drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API 1df0123f96f37 ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION 3bba71395ad45 fs: super_set_uuid() c9e845014723d serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN f5a41b61b5faa bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing 44f6b01693b87 bpf, arm64: Enable the inline of bpf_kptr_xchg() f2b29bbe35522 ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz ce6253fe71881 sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting 5e2fc90018635 PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry 3555e41737c0f cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() da5f0166cef3d net: add xmit recursion limit to tunnel xmit functions e873e8c16b2fb tcp: secure_seq: add back ports to TS offset 43ad494ac6e94 ksmbd: add chann_lock to protect ksmbd_chann_list xarray 34614f5dd26c8 btrfs: reject new transactions if the fs is fully read-only b2b9ac2bb2c5b drm/amd/pm: Disable MMIO access during SMU Mode 1 reset 152fc4f7b4a8a ALSA: usb-audio: Prevent excessive number of frames 513587caec66b spi: tegra210-quad: Protect curr_xfer check in IRQ handler 4c7ad40c285ab of: unittest: Fix memory leak in unittest_data_add() 17260b5215d4c staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths 015f9fbcf3382 bpf: Mark bpf_refcount field as unique 11e78304b0113 PCI: endpoint: Add missing NULL check for alloc_workqueue() ab0bdaf7a7f4f net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels d57e31c8df7b8 wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() 13f96c3b73a84 wifi: rtw88: debugfs: support multiple adapters debugging c02b1d244a5d7 wifi: mac80211: don't WARN for connections on invalid channels 863b9b7be824a md: suspend array while updating raid_disks via sysfs 2ad6c244d65a8 md: add new helpers to suspend/resume and lock/unlock array 2284eab166f2d md: add new helpers to suspend/resume array f150854e9a0bc mips: unhide uasm_in_compat_space_p() declaration 9cfda98cf02ea MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits 585a656283c95 functionfs: fix the open/removal races f68515eb8f3cf functionfs, gadgetfs: use simple_recursive_removal() 9aa31e353d9f4 usb: gadget: functionfs: Factorize wait-for-endpoint code 61c3f32b425ab usb: gadget: Support already-mapped DMA SGs 8cf889d45bbc8 Input: lkkbd - disable pending work before freeing device 8fdbc6f9a994e shmem: fix recovery on rename failures b9d8cfd6d77f5 Input: alps - fix use-after-free bugs caused by dev3_register_work 0d0a1a267c1ee scsi: qla2xxx: Clear cmds after chip reset abfbceda0d239 wifi: ath12k: Fix MSDU buffer types handling in RX error path d6028caa0ee39 bpf: Fix stackmap overflow check in __bpf_get_stackid() 5d5d130835b41 coresight: ETR: Fix ETR buffer use-after-free issue dc6d1249ee35c md: fix rcu protection in md_wakeup_thread a17d1bca5aba1 md: fix stopping sync thread 66eb53cecc5f8 gfs2: Prevent recursive memory reclaim 9a8e531543535 scsi: imm: Fix use-after-free bug caused by unfinished delayed work 2eb6a5f6adb7d tty: serial: ip22zilog: Use platform device for probing 79693f738680d serial: ip22zilog: Use port lock wrappers 1c963811b0824 scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) 51713b285096a scsi: ufs: qcom : Refactor phy_power_on/off calls f0ee42f47cc1b drm/amdgpu: fix gpu page fault after hibernation on PF passthrough 1e00721013ff9 drm/amdgpu: Restore partition mode after reset 1a7865e3e4de2 mlx5: Fix default values in create CQ b68d1f321119b drm/amdgpu: remove two invalid BUG_ON()s e61dfd906ad02 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() 6776866cffbc2 media: nxp: imx8-isi: Fix streaming cleanup on release 0a187ea7a5b4e ASoC: Intel: avs: Do not share the name pointer between components 29c742ff222dd md/raid10: wait barrier before returning discard request with REQ_NOWAIT 3d608e67b966c drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM 8a0fc82502321 drm/amdgpu: Show vram vendor only if available 31d6c9216aa1b Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete 47a92030422d0 mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop 69f35d8d17b31 mailbox: zynqmp: Move buffered IPI setup to of_match selected routine 5db5e21b6cd58 mailbox: zynqmp: Move of_match structure closer to usage daa680de4eb91 mailbox: zynqmp-ipi: fix an Excess struct member kernel-doc warning 9f22b5f7f1a32 net: use dst_dev_rcu() in sk_setup_caps() 423895685f367 ipv6: use RCU in ip6_output() 5f75857ed634d crypto: hisilicon/qm - request reserved interrupt for virtual function 7012bea562239 tcp_metrics: use dst_dev_net_rcu() 8b6e327736db0 RISC-V: KVM: Write hgatp register with valid mode bits da513f2ad1b1b ptp: Add a upper bound on max_vclocks dfbff47f120e4 bpf: Check the helper function is valid in get_helper_proto 145b8f1776e5b bpf: add a get_helper_proto() utility function b467ebabf16c9 bpf: improve error message for unsupported helper 3b32cf6e27959 iommu/s390: Make attach succeed when the device was surprise removed 8729dc4eeb502 ice: fix Rx page leak on multi-buffer frames 891ab8c695419 dm-stripe: fix a possible integer overflow 53707bc68fdc7 dm-stripe: limit chunk_sectors to the stripe size fd677c1f51c57 dm: stop using blk_limits_io_{min,opt} fea5d52f89f4f dm-verity: provide dma_alignment limit in io_hints f23d5c6b7540e smb: client: let recv_done verify data_offset, data_length and remaining_data_length dc5aad078abc4 ceph: fix race condition validating r_parent before applying state 9598c83a50a5f mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() 6d40c15d70c2d wifi: mt76: mt7915: fix list corruption after hardware restart e2a6eabe5304a ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog 18e4b315e359f vxlan: Fix NPD when refreshing an FDB entry with a nexthop object 8ba034c41b20d vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects aa977309397fe trace/fgraph: Fix the warning caused by missing unregister notifier dc797a4bbbcac bnxt_en: Fix memory corruption when FW resources change during ifdown 74d3b91f1598e crypto: x86/aegis - Add missing error checks 6758b816ffed5 crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT cbab09ae85675 crypto: x86/aegis128 - improve assembly function prototypes 3223bb62918e5 crypto: x86/aegis128 - optimize length block preparation using SSE4.1 67ddb169e1528 crypto: x86/aegis128 - eliminate some indirect calls f76089018b34d mm/smaps: fix race between smaps_hugetlb_range and migration 1f45a710c82b2 wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() f6510c2eae93e wifi: ath11k: mac: fix struct ieee80211_sband_iftype_data handling 0d9f4f202de15 drm/amd/display: fix a Null pointer dereference vulnerability 7874179a229af drm/amd/display: switch DC over to the new DRM logging macros dcfed7251e23c net/sched: Fix backlog accounting in qdisc_dequeue_internal d26058c2349d7 habanalabs: fix UAF in export_dmabuf() 29a15e06a3d41 drm/amd/pm: fix null pointer access 5c432da1ee191 wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() 3bf99140d7b77 wifi: iwlwifi: return ERR_PTR from opmode start() dcae71222c8b9 rv: Use strings in da monitors tracepoints be27a11a42b21 wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() 45be183b9944f drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port 067ca15be8b83 RDMA/hns: Fix double destruction of rsv_qp ea2e6c1503800 wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 9bcfbd58fc5a0 s390/mm: Fix in_atomic() handling in do_secure_storage_access() e98ce4b70beab Bluetooth: eir: Fix possible crashes on eir_create_adv_data 920c2db46ca44 wifi: ath12k: fix invalid access to memory 2d9a8022009d2 bpf: Do not include stack ptr register in precision backtracking bookkeeping 1b63cdc0d63ae riscv: save the SR_SUM status over switches 1cd09aaf47a57 coresight: holding cscfg_csdev_lock while removing cscfg from csdev 20d00e9b53091 wifi: iwlwifi: don't warn when if there is a FW error 761db4ca3a469 PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops acdfe206be6c7 virtio: break and reset virtio devices on device_shutdown() 3dfbbf72de6b6 virtio: hookup irq_get_affinity callback 9f71fb768d55e driver core: bus: add irq_get_affinity callback to bus_type fc3f1cbf8b1ec virtio: make virtio_bus const b7867e55cbcba bpf: copy_verifier_state() should copy 'loop_entry' field 40d66e0adde4b dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn 47a0da0c80749 clk: sunxi-ng: h616: Reparent GPU clock during frequency changes 8f1b0a4f1ad15 clk: sunxi-ng: h616: Reparent CPU clock during frequency changes c33a7fe6dda59 kasan: avoid sleepable page allocation from atomic context 1c320f6ccc884 um: fix time-travel syscall scheduling hack 52cdc47cf6519 drm/amd/display: prevent hang on link training fail 31dad8d385953 scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue cf3bf87aba2a2 scsi: mpi3mr: Debug ability improvements ae9909d12735b scsi: mpi3mr: Split off bus_reset function from host_reset a9703b006a475 sfc: fix NULL dereferences in ef100_process_design_param() 455a0ba90d0d9 sfc: rip out MDIO support df8a35e8bcea2 sfc: Implement ndo_hwtstamp_(get|set) 9039afe6240ae btrfs: harden block_group::bg_list against list_del() races 53ac3b8ac1d88 btrfs: stop reserving excessive space for block group item insertions 716e065e74f8b btrfs: stop reserving excessive space for block group item updates 9e025844756fd btrfs: remove pointless loop from btrfs_update_block_group() f8f0873dd8975 btrfs: stop doing excessive space reservation for csum deletion 210493962d0ae btrfs: remove pointless initialization at btrfs_delayed_refs_rsv_release() 3e8a465bf1ae4 btrfs: reserve space for delayed refs on a per ref basis 85abb0e726cc0 btrfs: allow to run delayed refs by bytes to be released instead of count 25014e3dfa6d2 bpf: Fix kmemleak warning for percpu hashmap 7af81befc0428 fs/ntfs3: Keep write operations atomic 457a034fcb04b fs/ntfs3: Separete common code for file_read/write iter/splice 2bb0e21c84f20 fs/ntfs3: Use function file_inode to get inode from file ab41bf5a211fb ublk: fix handling recovery & reissue in ublk_abort_queue() 08160de2a6522 smb: client: fix UAF in decryption with multichannel c8c6af46286a5 smb: client: allocate crypto only for primary server aae58a39ac4c6 perf: Fix hang while freeing sigtrap event 0554373bc9acc wifi: ath12k: Avoid memory leak while enabling statistics 47297d133eea9 wifi: ath12k: Avoid explicit type cast in monitor status parse handler 2f129230ac7d6 wifi: ath12k: fix incorrect TID updation in DP monitor status path 90c782bc9e8d0 wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info ccb4eaf078697 wifi: ath12k: refactor DP Rxdma ring structure 731e0d5dcbafd wifi: ath12k: avoid explicit HW conversion argument in Rxdma replenish e976114d81746 wifi: ath12k: avoid explicit RBM id argument in Rxdma replenish 27d472b86c19b wifi: ath12k: avoid explicit mac id argument in Rxdma replenish e762406e13446 wifi: ath12k: Remove unnecessary (void*) conversions ce906c4ae5725 RISC-V: KVM: Teardown riscv specific bits after kvm_exit ddfb25dfb16d8 RISC-V: KVM: Add kvm_vcpu_config ec97bd5378c59 wifi: ath11k: update channel list in reg notifier instead reg worker e2f45bfeef5ff wifi: ath11k: fix misspelling of "dma" in num_rxmda_per_pdev 8b7c9c5fec37c wifi: ath11k: add support to select 6 GHz regulatory type 4513843d58d8f f2fs: fix potential deadloop in prepare_compress_overwrite() 9b5e2f1ade251 f2fs: convert f2fs_handle_page_eio() to use folio 77fd40b7ed0c3 btrfs: fix block group refcount race in btrfs_create_pending_block_groups() b6d27f4869c9c ext4: avoid journaling sb update on error if journal is destroying 735c0e603cf25 ext4: define ext4_journal_destroy wrapper f364eb60987a5 ax25: Remove broken autobind b17edabd91714 fs/9p: fix NULL pointer dereference on mkdir 616b4f2d1556c fs/9p: convert mkdir to use get_new_inode 3d0281d071395 net: mctp: unshare packets when reassembling 924ef5959b7cf eth: bnxt: fix truesize for mb-xdp-pass case 9d22cf5cc94cd nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() 6088e11c9aed1 RDMA/mlx5: Fix the recovery flow of the UMR QP 6e59f56161ccc RDMA/mlx5: Fix a WARN during dereg_mr for DM type d63d73d045e48 RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers 50e44aa5f9905 bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT 4ace6fb49c8be btrfs: do proper folio cleanup when cow_file_range() failed 545d6893d3a34 btrfs: do proper folio cleanup when run_delalloc_nocow() failed 6105f0d9cc7be net: ravb: Fix missing rtnl lock in suspend/resume path e2ef3fa31353b net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels 7368f88b2e62d wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion bf66ec718e687 scsi: mpi3mr: Fix possible crash when setting up bsg fails 8458c686d50a8 nilfs2: do not force clear folio if buffer is referenced a306dfff6b76a RDMA/mlx5: Fix implicit ODP use after free 8e2f6ba256dd1 mm: clear uffd-wp PTE/PMD state on mremap() a852466354667 net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue 33b3e09a489a3 rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy 01aaa7935af30 PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() 57d90fe7aab16 powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW 1e9dfe15404dd powerpc/iommu: Move pSeries specific functions to pseries/iommu.c 2855445a1870b udp: Deal with race between UDP socket address change and rehash 6a97bfc0293db RDMA/siw: Remove direct link to net_device 30fc8f6d33bb2 PCI: imx6: Fix suspend/resume support on i.MX6QDL d7dade716905b scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs 465e06ffbb681 vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() e469922fbdf6a udmabuf: fix memory leak on last export_udmabuf() error path 2384a29db79bd udmabuf: change folios array from kmalloc to kvmalloc 0015d54a47995 virtiofs: use pages instead of pointer for kernel direct IO f9f621c5a26e0 fuse: Fix missing FOLL_PIN for direct-io 0335fb698ab04 drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe 1a0aecabff72a io_uring: check for overflows in io_pin_pages 82dc96f0f4eec exfat: fix out-of-bounds access of directory entries 41d73ca1fe161 exfat: convert to new timestamp accessors 9ada9ff6339d4 afs: Fix lock recursion 00872dcc2a3e4 drm/amd/display: Implement bounds check for stream encoder creation in DCN401 64704f231d5de net/ncsi: Disable the ncsi work before freeing the associated structure 98691b2e28a6c l2tp: prevent possible tunnel refcount underflow 692e9a20018da drm/amd/display: Check null pointers before used 4f51f6d23c585 drm/amd/display: Check null pointers before multiple uses 180280f3c4621 drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer 45f2bbe7bc08d bpf: Fix a sdiv overflow issue 7299868253c0e mm, slub: avoid zeroing kmalloc redzone 694eea36e3e16 mm/slub: avoid zeroing outside-object freepointer for single free 6158dbcba6986 slub, kasan: improve interaction of KASAN and slub_debug poisoning f8ba0d22afa61 bpf: Prevent tailcall infinite loop caused by freplace 6fc6ef4cd858a drm/amd/display: Avoid overflow from uint32_t to uint8_t 29ec422b32c69 scsi: lpfc: Change lpfc_vport fc_flag member into a bitmask 6a80b818c63e0 scsi: lpfc: Protect vport fc_nodes list with an explicit spin lock 3543cdaf0185b scsi: lpfc: Change nlp state statistic counters into atomic_t 148b39768ff2b scsi: lpfc: Remove shost_lock protection for fc_host_port shost APIs 2d0dfb1f2fad2 scsi: lpfc: Fix failure to delete vports when discovery is in progress 117df33ecfd8a drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range 0c1e8a6f7ce9b drm/amd/display: Use kcalloc() instead of kzalloc() 7eed5b3115ce9 pktgen: use cpus_read_lock() in pg_net_init() 2a0ba376cdf72 serial: sc16is7xx: fix TX fifo corruption 97cee643a8258 PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init() 2011c0ebaf710 mm/huge_memory: avoid PMD-size page cache if needed 6d1f6dd02a2d7 mm: simplify thp_vma_allowable_order 88f520120f999 mm/thp: fix "mm: thp: kill __transhuge_page_enabled()" acf609843a848 gve: Account for stopped queues when reading NIC stats 7d5711e03cefd s390/pkey: Wipe copies of protected- and secure-keys 3732398dcf65d s390/pkey: harmonize pkey s390 debug feature calls 1f7f63f7165d1 ice: Fix improper extts handling 1eb6c4a0d83d1 drm/amdgpu: fix double free err_addr pointer warnings 9aa83a5eb013f ice: Don't process extts if PTP is disabled 2bbfffa802adc bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() c20d0fa873039 bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() d35130036d327 sched: fix warning in sched_setaffinity f8005214946fd sched/deadline: Fix task_struct reference leak 251840f22eff3 drm/amdgpu: change vm->task_info handling 2860d59e4ce2b net: nexthop: Increase weight to u16 942ae3d64c3ce net: nexthop: Have all NH notifiers carry NH ID f6dd625053726 drm/msm/dpu: Add mutex lock in control vblank irq fee05f14bf747 drm/msm/dpu: shift IRQ indices by 1 ec2e11c1d36db tty: add break_wait kernel-doc 5e8f3ac8fa3d4 namespace: handle mount locking for automounts correctly 55d7433e26c79 fcntl: refuse F_SET_RW_HINT on an immutable inode b98dd4af91ade namespace: check the target before walking it in do_mount_setattr() 86a2d56b19607 namespace: don't copy an unmounted mount tree db90eecbde319 namespace: unhash a dentry before detaching the mounts on it 013c060b2f122 drm/vc4: Fix firmware reference leak in vc4_drm_bind() 45f2d1a6edf1c scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() 49dd29ce73653 scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock() cce865a62cec3 scsi: ufs: core: Add debug log for MCQ command timeout 4813a6624ce48 scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe() 40589a91c7b9b scsi: ufs: mcq: Remove unused parameters ec6ecab1b7577 scsi: ch: Do not keep references to data transfer element devices 37a0d6e81a42e scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ 262062c01f5a8 optee: register TEE devices only once fully initialized cf59abb49e91f wifi: ath12k: copy M3 firmware when reusing the buffer 4af250fc84828 wifi: ath12k: fix reusing m3 memory 2be324c89993c ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params 60b5824ae259a ASoC: hdac_hda: Fix hlink refcount leak on component registration failure 3b8a540b36aa0 ALSA: control: Don't add invalid kcontrols to LED layer c17fe25dcb55a ACPI: processor_idle: Mark LPI enter functions as __cpuidle 444b0e44aa430 net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv 7b3b902320214 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv 04474009a2ea7 most: core: fix leak on early registration failure 82f42a13e3d7a most: core: fix resource leak in most_register_interface error paths a56d4f8f8f4c5 namespace: check the mounts before reading their parents in pivot_root() 99698cfa34e49 namespace: don't inherit MNT_UMOUNT in clone_mnt() 9b6ed57eb8c89 Bluetooth: ISO: Serialize concurrent connect calls db6fbc2b77849 drm/vmwgfx: validate pitch coming from userspace 4dc3d5a004b8f Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex f01cbddfb4273 Bluetooth: hci_sync: Fix command skb lifetime during scan setup b21f20320fa2f net: team: stop reusing skb after queue override 9486377e5e971 net: team: fix NULL pointer dereference in team_xmit during mode change 84600e7b30fc1 net: team: Rename port_disabled team mode op to port_tx_disabled 85cf6665154de net: team: Remove unused team_mode_op, port_enabled 4f46ac83d87a4 netfilter: nf_tables: fix bidirectional offload regression 089f10b47843a apparmor: fix cred UAF caused by begin_current_label_crit_section() 20c52a7041409 ALSA: mixer: oss: Add card disconnect checkpoints c937a494901df ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger d9df965284abd ALSA: pcm: oss: Fix setup list UAF on proc write error 8f27d152b2a59 nvme-tcp: sanitize request list handling 604cf76a6a7e8 llist: add interface to check if a node is on a list. 24120e90d4638 mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge 522fd1a6efd0a mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP 1f26323565177 ice: fix metadata_dst refcount handling on representor teardown b14a682ad7d45 ip6_gre: remove obsolete ERSPAN PMTU update 578d39ab420b1 tracing: Set the trace clock before registering the histogram trigger cbf9961602ffb HID: steam: Clean up locking 3c2f97343d4df HID: steam: Refactor registration d2587923d50c8 HID: steam: Rearrange teardown sequence 5f135cfc1d68c HID: steam: Fully unregister controller when hidraw is opened 0aa096eec8d87 HID: hid-steam: Make client_opened a counter dd7a39f644373 drm/amd/display: Don't replace a sink mode that shares the native totals 8ed6cf7f77915 can: fix unique skb identifier regression under RPS 2deafd015ea9a dlm: validate length in dlm_search_rsb_tree 99b8bd6323e6f wifi: mt76: mt7603: initialize global station WCID 63ec518b737c4 netfilter: flowtable: fix offloaded ct timeout never being extended 5d3ee9fc5fb08 netfilter: conntrack: fix erronous removal of offload bit b7b80d204abdc net: openvswitch: validate transport header presence in set_ipv6_addr 41ad5bcf0219a mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() 3e531d85b7823 net/mlx5e: Order ICOSQ cc update after CQ doorbell 194685b13dc9e veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down c44c02c930c65 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() 774856241e7dc net/sched: cls_route: reject change with no routing attribute d9e08836d06c8 flow_dissector: avoid u16 truncation of skb->len when computing thoff 2c64c30d493d8 ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM 2cb098262ce2f ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes 58905982b0d91 ASoC: adau1372: allow sleepy powerdown GPIOs 50deef6dc4dd4 wifi: mt76: mt792x: pick the SAR table layout from the table itself 26f0504432add wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit 7a53bb4668b31 btrfs: fix xattr replace when multiple xattrs are packed in the same item 3c231142c4f4b nvmet: use the local P2P device on metadata allocation failure 8739f06e3f82c cxgb4/ch_ktls: disable softirqs around tid_list erases 95114e4211962 amt: send the relay's General Query directly from the receive path 00bcc303000ba net/sched: em_text: reject unterminated algo before autoload bf2848e50bd73 drm/vc4: Free the BO cache size list on teardown ad8a96a9e0fee drm/aspeed: Balance the display clock enable on teardown bf3d841ef12fc gpio: exar: initialize the ID before registering its cleanup f424fc191ec2b drm/dp: don't mark the AUX backlight enabled when enabling failed 95fb7c259b86f namespace: refuse an automount below a mount that is in no namespace 5e6bfd9f249f2 dcache: don't put a mountpoint on a dentry that's being removed f639428183449 namespace: check a submount for references right before unmounting it cae49d34f0cd1 fs: refuse fspick() on internal superblocks d63df57e738a3 drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs b5f813f500c44 drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks 067c88010df80 drm/amdgpu: make Mac FB workaround generic 037796d9ca1da drm/amdgpu: serialize vblank counter reads against GPU reset 8a2b420ee227a drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info 4a86f0a696f48 drm/amdkfd: align SDMA doorbell base for shader doorbell writes 17c5fa371de2d drm/vc4: drain the hangcheck timer and works on V3D unbind 77abc1837c965 drm/i915/gt: Unmask interrupts only when ACTIVE is true 24c04e80c35ff drm/i915/gem: Prevent overstepping exec array boundary a5ce29550386f drm/gud: don't keep a connector without a CRTC as connector_state 4a2006c675758 drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN d5c372ad03330 Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown a54ce160e3ef7 Bluetooth: RFCOMM: free the skb when the DLC has no owner 44ce36c5789ac Bluetooth: MGMT: Fix status of pending commands flushed on power off 37cef0c8fb537 Bluetooth: hci_sock: Serialize dead-device detachment 8181a1a45c706 scsi: qedi: Initialize callback state before registration a613e4fafb47c iio: light: Drop ROHM BU27034 7e90b11a4f699 pmdomain: rockchip: propagate subdomain add errors 1b476b9a90ac9 pmdomain: rockchip: fix clock leak on domain probe failure b94c6104c4949 pmdomain: rockchip: don't ignore clock lookup errors on attach 3601dd1cdc97c pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains 1ea151615a82f regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 fd376d8374111 regulator: ltc3676: don't read the write-only HRST and CLIRQ registers c995c52eba192 openvswitch: fix soft lockup in the netlink flow dump ab0d2a6fe87e8 nvme: fix swapped ZRASF zone state values for full and read only c128173919a65 net: usb: ax88179_178a: fix rx frame length for non-last packets 1e4d51d903ecf net: dsa: microchip: fix KSZ8765 fiber detection 695a5a4c69c92 net: bridge: avoid recursive multicast port cleanup e607017a553d2 net/smc: protect clcsock lifetime in smc_getname d8a24b9e1774a net/packet: guard the ll header push in packet_rcv_spkt() 605a59639abb9 mmc: sdhci-sprd: disable runtime PM on remove 9e799f25c420e mmc: mtk-sd: Cancel request timeout work on remove 5d4cdd4a15075 mmc: cavium-thunderx: destroy slot platform devices on remove a1019e0722049 mmc: cavium-octeon: destroy slot platform devices on remove 281f68d6cf8ac dm: fix reading free memory in do_resume bcfb26658e0fa dm-snap: reject the transient exception store for snapshot-merge 9a0dab8a9d997 dm-crypt: reject the lmk IV mode with AEAD ciphers f2c181e1d58e9 memstick: rtsx_usb_ms: complete requests after eject instead of dropping them c3ab92542475d memstick: core: wait for request completion before freeing card 305f1828b871d KEYS: Fix add_key() race with keyring restriction f7bff12d5de4b keys: finalize persistent keyring timeout after link attempt c2e0cbb587a8a ibmveth: fix TX LTB and filter unwind on open-fail decb4d4ead2c7 ibmveth: h_free logical LAN on open-fail after register b07b3925f6766 gpio: xilinx: fix runtime PM leak on request error path ce45166daf6bd EDAC/amd64: Mask UMC chip select to the four implemented selects be0167091542e sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute a545def625860 selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts a07d325ebb37a selinux: fix data race on AVC latest_notif af4b3d33f2ff5 Revert "wifi: libertas: reject short monitor TX frames" b60259d4047fb tipc: hold a reference to nodes found by link name 7f796bb3b440d tipc: destroy topsrv workqueues before closing connections dbee987ecf312 swiotlb: fix default_swiotlb_limit() for non-growable default pool a18dd388045dc strparser: make sure __strp_recv isn't running before tearing down the parser 5051df0311447 xen/netfront: don't leak the skb when xennet_fill_frags() fails 3dc61af2998cf workqueue: Fix NULL current_pwq deref in chained work check fb5ce4c7790c3 wireguard: noise: reject response consumption after intermediate initiation b261dbed0c538 wireguard: queueing: preserve tstamp_type when encapsulating packet 7b79131e357c4 wifi: brcmfmac: fix P2P device removal race in brcmf_detach() 3ad7606400f38 usb: f81604: fix struct f81604_int_data size mismatch 98195e822343a dm ioctl: don't let data_start run past the buffer 41cabfbf3532e btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() 496a45b7c6705 ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) e35becbd03191 arm64: irq: exclude the softirq stack switch from KCOV 1eeeb4d315401 Input: xpad - add support for Corsair Novablade Pro 8a3b935b6b603 ipv6: do not warn on route notification size race 088ba80eef85f ipv4: do not warn on route notification size race 72d9d17092bb3 ipv4: stop route notification sizing when nexthop group shrinks 7fd60d3c9a1e1 ipv4: stop PMTU walk when nexthop group shrinks 408c78e50feab crypto: drbg - Fix ineffective sanity check 8f1215a370e89 netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting 80861f424fe5c Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING 45adb04a8ad0c mm/damon/core: fix unconditionally skip last region e3c206de1fcba mm/damon/core: do non-safe region walk on kdamond_apply_schemes() 82ecc6b5af65d f2fs: fix to reset all pinned status during fggc 9f5510b0452ba f2fs: fix to shrink gc_lock coverage in f2fs_gc_range() f4ee42c35022a f2fs: fix to reclaim space in f2fs_allocate_pinning_section() 7d7ad2bea4eed HID: uhid: convert to hid_safe_input_report() b9d2deecddae7 HID: core: introduce hid_safe_input_report() f1dc59675d542 wifi: cfg80211: release locks on error in cfg80211_wext_siwgenie() 909b31661be70 iio: cdc: ad7150: fix OF matching and publish module aliases a2df3f13f00b3 smb: client: only require read lease for size-extending preallocate 55f1cebee909c iio: adc: stm32-adc: fix possible division by zero in processed channel b950ad53ca6ea iio: adc: axp288: Add TS bias override for Haier HV103H f66a164ea6bd4 iio: adc: max1363: sign-extend bipolar differential channel reads 9f503cda04f2c iio: adc: aspeed: propagate reset deassert errors 3d8019516f028 iio: adc: aspeed: Simplify with dev_err_probe 975b09bc680ac iio: adc: ad_sigma_delta: fix use-after-free on unbind 3df27277f8f95 smb: client: discard post-EOF pagecache when extending a file via zero range 6535f7084d958 wifi: mac80211: set info->band for 802.3 encap offload frames 40d7e969b6f15 wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() 84da7a0e92207 KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted b1ac8181a59ab mm/hugetlb: fix avoid_reserve to allow taking folio from subpool 6a2baff6fecae net: mana: remove double CQ cleanup in mana_create_rxq error path cd9c62753becf net: mana: Skip WQ object destruction for uninitialized RXQ 263d45141069a net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() f3a52e2ec2788 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry 32bbb870078d4 net/mlx5e: Prevent stale XSK buffer release on refill retry f1c966eb6ed5e fs: Free any excess xarray nodes in clear_inode() 2a74f30a7bb30 iio: health: max30102: fix NULL dereference in interrupt handler b76f068b2d3d0 iio: core: add accessors 'masklength' 4ae6ed5b6074d wifi: mac80211: count only matching reservations in reserved switch 47864a9092fd6 wifi: mac80211: keep paired old chanctx alive 6b5366ba63a58 jbd2: bound shrinker scans by examined checkpoint buffers dc7ece0b827fe jbd2: check need_resched() when skipping busy checkpoint buffers 6198123cac2ff gpio: rockchip: fix generic IRQ chip leak on remove 77b6ff33c8f56 gpio: rockchip: teardown bugs and resource leaks d4cf99c7ea95a firmware: arm_scmi: Unwind TX receiver mailbox setup failure 50e38091a657a firmware: arm_scmi: Publish channel state before callbacks b1a86a5ab0d44 fbdev: hyperv_fb: Allow graceful removal of framebuffer 3a489c3bbf5ed fbdev: hyperv_fb: Simplify hvfb_putmem 18f9f3ddbf2ed erofs: unify lcn as u64 for 32-bit platforms b18a82503a67a erofs: avoid infinite loops due to corrupted subpage compact indexes 6b6b47c1aa717 ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers 796207e63c51f ASoC: SOF: topology: Parse DAI type token for dspless mode ce220b4cdf62f tty: port: fix tty_port_tty_vhangup() race cf8530a25ae92 bnxt_en: fix DMA mapping length for padded small packets b4f2a7ae80ed4 mtd: spinand: Enable QE on all dies bff83b723e93a mtd: block2mtd: Fix divide error when erase_size is zero 057320c36c5a2 block2mtd: prevent direct access of bd_inode 8736c49d6ff27 mtd: block2mtd: Convert to bdev_open_by_dev/path() de77b0f681421 wifi: mac80211: keep fallback association elements alive d0da6ab1fc53a wifi: mac80211: shut down RX BA session timer on teardown 77c449c9c946f mtd: spinand: fix NULL pointer dereference with no ECC engine 1fbc4b24c7443 apparmor: Fix & Optimize table creation from possibly unaligned memory bd00629b52788 AppArmor: Allow apparmor to handle unaligned dfa tables 122b1fdcd26b5 drm/amd/display: Mark DCE 6.4 as not APU 04c259eaceba4 i2c: xiic: preserve PEC byte length in SMBus block read setup 7b42e4a70f8c4 i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode 4ae00993e6d92 ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 3cdad0c541f89 serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() 0af044c47a957 serial: ma35d1: Convert to platform remove callback returning void 2f973fe58d70e serial: fix TIOCMIWAIT race 158a07da2da72 tty: serial: max3100: shut down timer before freeing port b71f75408c466 tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2 16032c980d8f7 tty: tty_port: restore TTY_IO_ERROR on activation failure 402b1aceabfb4 usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 5a206e64ae8ab drm/amd/display: Preserve eDP mode on initial ASSR failure 82cc242da6d62 USB: dwc2: shut down wakeup timer before freeing HCD state 4f35e6be2f86b usb: ohci-spear: disable controller wakeup on removal 7037a6a567223 usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() c1e3aed32da03 drm/amdgpu: reset VI ASIC on MacBookPro14,3 79c4721c17fbc drm/amdgpu: reset VI ASIC on MacBookPro15,1 29302964ef583 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend 12dace1387d3c fsverity: add dependency on 64K or smaller pages 0a5c76eb3950a KVM: arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP e786386c882d5 arm64: errata: Add Cortex-A725 erratum 3821522 workaround fb8b57d0321f6 arm64: errata: Factor out broken AMU const counter cap 94afa17d6bfd5 Bluetooth: Serialize SMP remote OOB data access f997e03e2ef58 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown 052acee988011 arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems 8c38cb055f6a9 perf: Require kernel access for text poke events 6b4e15cccfbe0 tty: fix saved termios reset race 6cd82563bb270 usb: dwc3: gadget: fix IRQ storm on invalid event buffer count bc992b73f7af6 drm/amd/display: Fix fast updates on DCE 8.1 3f3b0898557a9 fs,fsverity: remove check for fsverity being enabled in setattr_prepare() a4ca8102e70e1 fs,fsverity: reject size changes on fsverity files in setattr_prepare 0542d213253ee xen/netfront: drop RX packets with a short Ethernet header 5ea733af79616 usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling 424e4d0bc47f0 usb: typec: tcpm: fix debug accessory mode detection for sink ports 0a2f71ccf9c20 usb: gadget: f_fs: Fix Use-After-Free in AIO error path aee2fde0f39e2 USB: gadget: ffs: fix mm lifetime handling 723d73b245843 usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed 09ddd44db0a84 usb: gadget: at91_udc: Convert to platform remove callback returning void abc17fd508a51 serial: imx: serialize imx_uart_ports[] lifetime 4663bded2e49a serial: imx: Convert to platform remove callback returning void dd34630226211 net: usb: qmi_wwan: add Quectel EG120K-EA ffac3399bf627 wifi: wlcore: Fix runtime PM leak in wlcore_remove() 8435103a82aa7 wifi: wlcore: Convert to platform remove callback returning void 75b3b30ae4ee6 mptcp: prevent race between disconnect() and rtx 0f7668bcf6685 tcp: introduce icsk->icsk_keepalive_timer 9116b5ef5a5b3 mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages c073d01f6f536 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF 4b5ebb4f91a61 SUNRPC: reject duplicate CREDS_VALUE options 8c56a46db3b75 SUNRPC: fix gssx_dec_option_array error path bugs 574af7c61f2be drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read dd0c3e6c03e3b KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save c873363497808 jfs: fix array-index-out-of-bounds read in add_missing_indices ac5d26a46c90f iio: trigger: cancel reenable_work before freeing trigger 42eb8c2cf1744 iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler 2272efb10096e iio: proximity: sx9324: Correct proximity channel resolution 2c8211eef9892 iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure 59ab2f302548d iio: proximity: isl29501: Fix return type of isl29501_register_write 05ef1af381a0f iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup 85c20d1cf3f01 iio: light: gp2ap020a00f: drain irq_work after free_irq 8a78224497271 iio: imu: adis16480: fix unprotected debugfs reads d3078aaef8af4 iio: imu: adis16400: fix unprotected debugfs reads b62c3944c006c iio: gyro: adis16136: fix unprotected debugfs reads 2bde96b2857aa iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() b4f53cec8cc94 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. 6a728408ff522 iio: buffer: serialize buffer teardown with mode claims 012451d72c122 iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind d94d2ec25ff26 iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls 53473b0556296 iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure 01d20048ab0e2 iio: adc: stm32-adc: fix check on internal channel availability 57628402e9cbf iio: accel: sca3000: fix frequency divider condition check 137c35cff4d4d iio: accel: kxcjk-1013: reject duplicate event disable 3b8e7928cf192 smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races b270c1074860d thunderbolt: Reject oversized XDomain properties responses 7bca83bf8ba00 thunderbolt: Disable CL states for the Anker Prime TB5 dock b70b9c41f240c thunderbolt: Fix KASAN reported use-after-free when request is canceled 4375b5d91db4d USB: serial: option: add Compal EXC-T1 support 992a471458f96 USB: serial: option: add Quectel RG660QB 85750b58e8d4f USB: serial: option: add Compal EXM-G1x support 9c910016df78c USB: serial: option: add Quectel EG060W bb5487f3aadbe USB: serial: option: add support for SIMCom SIM8260C 24d6edb6bd7f7 USB: serial: fix ioctl hangup race e7ad832b1144d USB: serial: fix driver deregistration order 2917216123615 USB: serial: fix dynamic id driver deregistration race f8e290609546a USB: serial: ssu100: fix baud rate overflow 7ee47aea0baca USB: serial: quatech2: fix baud rate overflow e7fa5128bcc4f USB: serial: cp210x: add Corsair AX1500i Power Supply 0b1e4a7eeb6a3 wifi: mac80211: handle empty FILS association request payload ebb7cba623d38 wifi: mac80211: fix mesh fast xmit path deletion UAF 57bfaa8b28534 wifi: mac80211: release mesh path quota on failed additions eebc70f132041 wifi: mac80211: minstrel_ht: validate fixed rate index c66ab4b94bb04 wifi: mac80211: account proxy paths against the mesh path limit cbff71fe689f3 wifi: mac80211: drain PS delivery work during station teardown 3ebc529726c0c wifi: iwlegacy: 3945: free EEPROM data on remove b66539a4dab12 wifi: cw1200: fix TX padding OOB read leaking heap data to device 951fce1510645 KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy 40d855d6ad463 mtd: spinand: fix zero oobavail when no ECC engine is used e238c19826cc9 mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB c69d8aceda362 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ ef4dfad231a78 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() e7188a268c356 nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT 3045128294d34 nvme-multipath: fix underflow in ANA log bounds checks 5a2b9cc53719b net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules fdbd83c2d929e net: extend IPv6 exthdr detection of tunneled packets 3776f34fbce99 HID: multitouch: stop the release timer from being rearmed on remove bc9ff8e64771c ipvs: bound LBLCR and LBLC cache growth be58b239d2be5 Bluetooth: btintel: fix buffer over-read in btintel_hw_error() 545fa70f730eb Bluetooth: hci_core: Serialize fragmented ISO packet queueing 780affacd9297 Bluetooth: hci_core: Serialize ACL scheduling with channel deletion b208818492cde Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems 70b55855eecb4 Bluetooth: hci_conn: Lock parent access during enhanced SCO setup ddc9edb244cc8 Bluetooth: hci_sync: Fix inquiry cache use-after-free 55d162aa00d1e Bluetooth: RFCOMM: Fix initial port reference race 48f0e0bcf683f i2c: xiic: don't clobber msg->len to signal block-read completion ada5ded765f05 ALSA: ua101: reject mismatched capture/playback packet sizes 2db234e163f0d ALSA: seq: Serialize compat port-info ioctls 775df6a27e843 ASoC: qcom: lpass-cpu: use DAI table index for playback constraints 30a60e74ee71d ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type a756c93fae312 ASoC: codecs: max98363: fix uninitialized stream_config->type 3d9faec1da7e8 serial: vt8500: Fix clock reference leak in vt8500_serial_probe() 2c4ddc8ed0d87 serial: tegra: don't clear the Tx FIFO on an Rx-only reset dd81650bec58a serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() 6c9c9367351a4 tty: abort break signalling on hangup a42d96e8101ca tty: serial: qcom_geni_serial: Keep console RX functional after deep idle 57753441ef84b tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup 4b59afc8af314 tty: vcc: zero-initialize control packet in vcc_send_ctl() 674b1c890322f tty: amiserial: fix broken TIOCMIWAIT bdda8d889accc tty: vt: fix memory leak in vc_allocate() dbdd0ca9a7eac usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe efdf0ddaed011 usb: cdns3: fix use-after-free in cdns3_gadget_exit() 9a86cdb675949 usb: typec: ucsi: displayport: Current CAM OOB index fixup abe93f73639da usb: typec: ucsi: Get the connector fwnode based on reg value a39d53f70e637 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() ae8aae45a39fc usb: typec: tcpm: recover after failure to start the frs ams 198d74dcfa129 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints 40fef138eb6c1 usb: chipidea: tegra: disable runtime PM on resume failure 06ac8609d6d18 usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC 6849e51b89de5 USB: gadget: dummy-hcd: Fix wait for outstanding request completions 0d39ac4f65f93 usb: gadget: aspeed-vhub: cancel wake work on device removal be347590e188d usb: dwc3: am62: Fix runtime PM usage count leak on probe error path a789838675afa usb: typec: anx7411 - stop the IRQ before destroying the workqueue da841c1511a61 usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd 18138d9f19cf6 usb: gadget: midi2: Fix the jack descriptor array sizes 61db743284896 usb: ohci-st: disable controller wakeup on removal 203094415f85c usb: ohci-s3c2410: disable controller wakeup on removal 2cf192041c00b usb: ohci-da8xx: disable controller wakeup on cleanup ba0f023cee31c usb: octeon-hcd: fix the FIFO-flush timeout computation e4df763ba3c4f usb: hub: use shorter 120ms post resume hold for SS root hubs 4faaad69f1833 usb: storage: sierra_ms: reject short SWoC info transfers e4a6883ad9b46 USB: serial: fix port tear down use-after-free d86775e79838d USB: cdc-acm: skip URB restart in port_shutdown if disconnected 451ded3b33bef USB: cdc-acm: fix racy TIOCMIWAIT implementation 4cea8e5b6c593 soc: qcom: geni-se: Correct QUP Core ICC vote constants 8bde6f643ab6f nitro_enclaves: fix use-after-free on SLOT_ALLOC failure d74220bb59af0 Input: synaptics - limit T440p InterTouch quirk to LEN0036 a2300ca8797eb Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 9ef8a8de8717d Input: s6sy761 - fix resume ordering and restore sensing dee75ece52b6a Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 a71adc66e8401 Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 69b1ed4acc56c kgdboc: Fix tty driver reference leak in configure_kgdboc() a7329ea53d04f binder: fix leaked fd fixups on TF_UPDATE_TXN supersede e9b364e46d594 binder: fix is_failure flag for superseded transaction cleanup d700c26ed64bd drm/amdgpu: fix ACP MFD device leak on init failure f6364e7284a13 drm/amdgpu: fix IP instance memory leak on kobject add failure 4a0ae61067671 drm/mediatek: Fix pdev reference leak in mtk_drm_bind() 03fb1c657028c drm/mediatek: Fix ovl adaptor platform device leak f0ffb09cf1bf2 drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device bc7255b8623de drm/radeon: Read the VRAM VBIOS signature with readb() 2aee72150b0ea drm/amdgpu/gfx6: fix firmware leak on teardown e28008f8d5020 drm/amd/pm/si: Fix updating clock limits on AC/DC 48ab11f054267 drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC e0c2f42f7c608 PCI: Accept AtomicOps already enabled by the hypervisor a2047aff72ce5 ALSA: ice1712: Fix the error handling via auto-cleanup at probe 80c7c10debd3a ALSA: core: Define auto-cleanup for snd_card_free() 655acfa713bce perf: Fix race between perf_event_exit_task() and perf_pending_task() 22efeebe688fe i2c: at91: release DMA channels when probe defers 4ab37e4f4a33c ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() 963e11f65c1be net: add and use skb_get_hash_net 68f35f8ffa803 net: sparx5: make ports inherit the switch base mac address type ef82f57fc999e net: microchip: vcap: stop scanning after deleting key field f7e292f3c8c85 netfilter: flowtable: generalize pending status bit 28c2a0ed2657b netfilter: conntrack: rework offload nf_conn timeout extension logic b6aefccb76489 netfilter: conntrack: remove skb argument from nf_ct_refresh 752492947be31 netfilter: bpf: reject invalid NAT manipulation types d7d33c9efa9d1 ipvs: filter some flags received in the backup server 1c68bfde05276 ipvs: do not create invisible templates 0632541dbfa43 ipvs: fix missing counter decrement in lblc 0c52040a3f69f tcp: refresh TS.Recent for accepted old ACKs efc91ab1d97bd net: ethernet: mtk_eth_soc: allocate dummy netdev sooner 213ff02ab26a4 net: bcmgenet: fix NULL dereference in set_coalesce before first open 41583c7d80ea6 net/sched: sch_codel: match the no-drop threshold to the packet size 5172124684e12 net/sched: fq_codel: match the no-drop threshold to the packet size a85a3dce4b6c7 tipc: prevent GCM nonce reuse on peer key changes f9531e8331790 octeontx2-af: mcs: Fix SC resource cleanup loop 5b353908e3be9 net: systemport: Fix RUNT MIB counter register offset calculation 96a2b04205155 net: systemport: Fix buffer overflow in bcm_sysport_get_stats() b11acfcb5925e Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister 71d660ec3c5d4 netfilter: ipset: do not update comments from kernel-side adds 44b6c6a3d10ac ipv6: fix prefix route expiry in modify_prefix_route() 0fc74e7d97d23 net/sched: cls_api: reclaim an empty proto on the error path 288ef37e0c463 net/mctp: publish the mctp_dev only after it is initialised 7df748aa9f9ec Bluetooth: btintel: validate DDC record lengths bb5d897e1c5e8 Bluetooth: hci_core: free the HCI ID if naming fails 0edda2d686666 ASoC: codecs: rt274: Fix format setting for 44100 rate d7b0b90517d23 ASoC: codecs: rt286: Revert delay value for jack setup 2fe08c8ff2684 wifi: mac80211: prevent AP VLAN tx from other interfaces 8c01127f8940e wifi: mac80211: Add 802.3 multicast encapsulation offload support 2d822b7b09828 wifi: mac80211: Add multicast to unicast support for 802.3 path 5617d53288390 wifi: cfg80211: preserve hidden-group beacon IE ownership ab741d1b714b4 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() a2215eb3cbbd3 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak 60142eb2afda3 wifi: ath11k: reset ar->num_stations on hardware start a7223b725905d ASoC: tegra: Fix ASRC Stream6 input threshold control 819d4c1323e2a wifi: wfx: validate MIB read length before copying to caller c881b1e4e9249 ASoC: wm8903: Move the DRC QR threshold to the register that holds it cd68146459b10 of/overlay: don't create "//" paths for fragments targeting the root 702b5db6e7b38 of/overlay: don't leak fragment references when changeset init fails 287a399310045 nvmet: preserve device path on allocation failure d94731cafa57e mtd: core: call _get_device() with the master MTD 714d8f0b1c616 iio: accel: kionix-kx022a: Fix array boundary check 84f8401d9bc5b mm/damon/core: don't skip damos_adjust_quota() while esz is not zero 4cea59e43e3cc perf/core: Fix WARN in perf_sigtrap() 51fba083e454f mm/secretmem: properly account locked pages 933d8ac23388e ALSA: line6: reject oversized playback packets df2787819bd13 ALSA: caiaq: unregister the input device when probe fails 2fc4e71aefab5 vt: skip screen update for DEC alignment test on backgroup consoles 786b74335c219 rds_tcp: close NULL deref window in rds_tcp_set_callbacks 1130350c8975a wifi: cfg80211: avoid double free if updating BSS fails c6d8cce685d60 scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info 8ec545537c110 scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr 7ceb6f7cb8f8f smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions 1bef1944ef15a sctp: check RCV_SHUTDOWN after the sendmsg connect wait aeda50d645bbb rtc: spear: initialize IRQ state before requesting alarm IRQ e77c5fc1f39fd rtc: ac100: Assign .num before accessing .hws ae169d318d5d2 net/packet: prevent TX_RING byte count overflow 1d27214fd9a4d netfilter: nft_flow_offload: drop flowtable reference on init error path ec96aa3ade2eb net: fix checksum offsets in skb_splice_from_iter() cc688475c56d3 of/overlay: only treat a positive changeset id as registered 936f1ffcb87a1 of/overlay: put property on deadprops only after changeset add succeeds b5f488c2a9ed3 of/irq: Fix remaining refcount leaks in of_irq_init() 3f968dcdf0188 kprobes: Skip disarmed probes when checking optkprobe overlap 9aee3caeff4dd audit: fix exe mark UAF in kill_rules() 8b417c887ac82 ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices 7ed1062d154ec mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() 47a948ba653a4 xfs: fix cursor and pointer handling when recovering iunlink buckets 8afc80156b1d9 smb: client: close completed creates on compound wait errors eaa97a196a107 smb: client: close handle after create-context parsing failure 2f8118f4c4313 smb/client: pass cifs_open_info_data to SMB2_open() b63f09fdcb523 smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() bd9571812d022 HID: alps: unregister DualPoint Stick input device on remove 37dc19c454191 HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM 74cbf0acf9de5 HID: core: remove #ifdef CONFIG_PM from hid_driver a35160b2c75bf Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table bd06033625ec2 bpf, xdp: move offload check into dev_xdp_install() 43d61b442a0a1 RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr() d8ec34618e710 drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op 045532f920d86 smb: client: use finish_no_open() for non-regular inodes fbe8c7c940a7c perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification 2e4c5400f489e perf/x86/intel: Update event constraints and cache_extra_regsfor ADL 5e20b39aa7844 netfilter: nf_tables: skip expired catchall elements on insert and delete ab8dfb330c907 netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST a0f5fd7a285f4 net: ena: fix MMIO read buffer leak on probe failure 33b32efafb729 net: ena: Remove autopolling mode d4bd24339b505 perf/core: Run sched_task() for PMUs with only CPU-wide events fa360a018369f perf/core: Allow list_del during perf_event_overflow() 98181f9721f75 perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() 403d8e4d52f5f perf: Supply task information to sched_task() 38a6a118260eb net: ipconfig: bound DHCP option construction f770bd77c6e15 net: ipconfig: Remove outdated comment and indent code block a9d9819a7d239 PCI: Fix BAR resize for devices on a root bus bf58ea4958118 PCI: Fix Resizable BAR restore order 4ab3655384e1d super: make iterate_supers_type() deletion-safe 6c2bcf6b173d4 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration 3486ce08c383e RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr() 18866dc1f525f net: openvswitch: conntrack: fix helper UAF due to extensions realloc 7ecaa9628b05a net: openvswitch: conntrack: remove 'add_helper' dead code 7ce66bca55e37 openvswitch: prepare for stolen verdict coming from conntrack and nat engine c812bb4aea13d net/sched: act_ct: avoid modifying shared unconfirmed ct entry 31f5fe29a5720 net/sched: act_ct: fix helper UAF due to extensions realloc cf73ef2a761df mm/hugetlb: preserve mremap address delta when skipping page tables 465e222815c88 mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish 34d9dffaf0ff4 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM 8a8d16d19207d drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc() 070a004d9d752 perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities 9e2a2f98e8c01 tcp: prevent collapsing skbs across boundary in rtx queue f04cbdfac9b82 bna: prevent IOC timer rearm during teardown aa00eead258e4 smb: client: fix reparse buffer bounds in cifs_query_reparse_point() ffc88169f4fac smb/client: send lease break ACKs thru correct session for multiuser mounts 15e59e377facc wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown d073d306e587c hwmon: (pwm-fan) Stop RPM timer before freeing tach data 93a025166495c btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() 525c225e23d61 smb: client: fix cifsFileInfo reference leak in deferred close 11cff5518f798 mptcp: do not reschedule the RTX timer for fallback sockets 3fe0b4b1aed10 mptcp: pm: reset retrans_time when ADD_ADDR entry is reused 518fb6a834258 mptcp: pm: userspace: fix address ID overflow c003c9ab21406 mptcp: use sock_kmemdup for address entry f116f8462c8c2 sock: add sock_kmemdup helper 48bf542f03cf0 mptcp: pm: drop match in userspace_pm_append_new_local_addr a92e0910f5fb8 erofs: add sysfs feature entry for xattr prefixes db0c3465b54a1 erofs: preserve LZMA decoders on resize failure 1b5730a1c7def net/sched: act_api: release all action references on NEWACTION failure b2eb38377671a virtio_mmio: disable IRQ wake before free_irq cbfd5d11311bb virtio-mmio: Remove virtqueue list from mmio device 21e0749e8ef27 ipmr: account multicast table and route memory 8ca55a476af2d drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug 0cec951667a62 drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation 110dd054fd4af drm/sysfb: simpledrm: Improve stride validation 52f36434159e4 drm/sysfb: simpledrm: Improve panel-size validation b6c0e77d950bf f2fs: fix dentry folio leak in find_in_level e754120f8ede5 f2fs: limit recovery filename logging to stored length 428e244dd4066 scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature 2df8c86309047 scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot 8b6565f19423a scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs 9d69eed95b841 scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate 5e0d6ffabbbd8 scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path bbe692466399a media: rkvdec: Propagate platform_get_irq() errors 7cdb1e2d3b0e5 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup d20ef2b13a2e0 mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP 461dbac2056bb clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs 3ce0e9b43f355 nvme-fabrics: fix DHCHAP secret leak on parse failure 68cb1f5d4aa50 rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm 16dbe1300ebad ftrace: Synchronize the initialization of ftrace_ops abdc98e67d7db tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member aa4e177ae7108 staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() f4f0fe3ab47ed usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() 4892be1ef0bbe wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy 027679d613ea7 i3c: master: Fix use-after-free of master->this 7b25b755d5907 i3c: master: Do not treat master device as a duplicate target 73f3697a7b1c1 hwrng: stm32 - Fix runtime PM cleanup on registration failure 35964ed01e10b power: supply: qcom_battmgr: fix use-after-free 98d0b8a1bfd9a platform/x86: ISST: Validate max level for set feature 8bae4ab7a4c84 platform/x86: ISST: Validate parameter for core power state 55d71c70f11d9 mmc: via-sdmmc: cancel card-detect work on remove 4fe2db296c9cd lockd: fix swapped arguments in nlmsvc_match_ip() 730bb75ed5f66 i2c: mxs: fix DMA channel leak on probe error 6c6ec0f6be517 dmaengine: Add devm_dma_request_chan() 2064fdbec82ec ASoC: codecs: aw88261: only check PLL and clock state at power-up c45851fc674be ASoC: codecs: aw88261: reduce log spam 31b41ea8383d5 params: fix charp corruption on allocation failure 29144aa486899 params: Fix multi-line comment style 75f9f1e0b4082 params: Sort headers 641d864ba4d0d params: Use size_add() for kmalloc() 710c30766efd8 params: Do not go over the limit when getting the string length 88b11059bb23f ACPI: TAD: Add locking around AML evaluations d4a76ed0d9b4c ACPI: TAD: Split three functions to untangle runtime PM handling 156fbd020ae36 ACPI: TAD: Rearrange RT data validation checking 12b54e5aab7c0 cpufreq: apple-soc: Fix OPP table cleanup 6b1c1130fcbfa coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior 04c3e4456fe76 nfsd: fix clock domain mismatch in clients_still_reclaiming() 2d8a8ed4f9d86 nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() 1c6a4d6c20fd4 nfsd: size fh_verify server sockaddr slot by xpt_locallen f5e9f3a75efc7 zram: fix out-of-bounds access in read_block_state() a5dda540c113c zram: fixup read_block_state() 81dfc6c665547 KEYS: trusted: Fix TPM teardown ordering 7e6ff8c58985f ethtool: fail closed if we can't get max channel used in indirection tables 0e58d7070eef1 media: av7110: fix a spectre vulnerability 705a8b8cc5a44 kvm: s390: Reject memory region operations for ucontrol VMs d233c8da8b70f drm/i915/hdcp: Add encoder check in hdcp2_get_capability df17aa6038f96 drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability 017bea876eca3 pinctrl: sunxi: keep a shadow copy of the data register output latches 3d531429524df vlan: require the MAC header to be present in __vlan_insert_inner_tag() 61812323c037a smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() ee0d8f83d68f6 smb: client: fix use-after-free of iface in cifs_try_adding_channels() d8bc505cabfba smb: mark the new channel addition log as informational log with cifs_info f448b267968d0 wifi: libipw: reject TKIP frames without a full MIC 8b637ab10e40e ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity 72399eb8bfaa2 ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling 48fc1c74052c9 landlock: Fix use-after-free of the source's parent directory 4a1ba62a486a4 ieee802154: cc2520: fix FIFOP work use-after-free 260f99b355a44 net: bridge: use option bits for CFM/MRP frame handlers ed1cead97afb9 io_uring/rw: end write accounting from ->ki_complete 1a345d95e59a9 genetlink: pin family module during policy dump aaa7f676418e1 Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev b88e69064588e Bluetooth: btqcomsmd: Convert to platform remove callback returning void c94985e4fd77e tracing: Fix memory corruption from a "STACKTRACE" histogram key cc004a1107e2c f2fs: embed f2fs_gc_kthread in f2fs_sb_info 54c587f3f95ce f2fs: validate MOVE_RANGE destination size 5f33efe046589 scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] 9bd063c082ef0 scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown 2e6f60adf609c scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking 2ecc30066c228 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak ab1a8a3c99712 KVM: s390: Zero initialize data structures for inject_pfault_token 3868476cd3916 nvme: add missing SRCU grace period in error path 29266da8ee1d9 ftrace: Take trace_array reference before accessing its ftrace_ops 716850842d2f1 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() 5a55352d30ad3 staging: rtl8723bs: fix spacing around operators c1e7e35100eff usb: storage: realtek_cr: fix use-after-free on disconnect 5aade99d72ede udf: Fix data loss when converting inline inodes to out of line 17d5ae5897312 wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop aad3129b8e915 ocfs2: validate directory-index entry counts when reading metadata 1ecc0a9f100a7 ocfs2: validate dx_root extent list fields during block read 66358f5789c9a HID: universal-pidff: stop the device when force-feedback init fails 56ef23198bdd5 HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind 6eb70b78e48b0 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() 23c5cc9652c6e ceph: properly decrypt filenames in vmalloc() buffers ab949252fdf10 nfsd: fix nfsd_file leak on inter-server COPY setup failure b9f5bde07c0f9 x86/xen: fix init of balloon stats again 4a138cd221545 xen/balloon: improve accuracy of initial balloon target for dom0 b17c8f5dcb36a apparmor: fix out-of-bounds write when null terminating a label vec cf79df1770660 x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client edb9a302cc938 net: ena: Add validation for completion descriptors consistency 70eca80d98a44 net/mlx5e: Fix netif state handling 1743d5a678048 ocfs2: Avoid touching renamed directory if parent does not change 08f3e29665c31 xfrm: prevent policy_hthresh.work from racing with netns teardown 7801e616fbe36 dma-direct: return struct page from dma_direct_alloc_from_pool() 9f1262802008b dma-direct: simplify the use atomic pool logic in dma_direct_alloc Signed-off-by: Bruce Ashfield --- .../linux/linux-yocto-rt_6.6.bb | 6 ++-- .../linux/linux-yocto-tiny_6.6.bb | 6 ++-- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++---------- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb index 3c91a4ba7a..dbd7894eab 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb @@ -14,13 +14,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "aafd2f2dba2b549d89a66f79826d770742d968ab" -SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" +SRCREV_machine ?= "5d98280cab593fe037ee0dc56c451b48fa549507" +SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.6.159" +LINUX_VERSION ?= "6.6.160" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb index 1b06d1e35f..ba598063ef 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb @@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc # CVE exclusions include recipes-kernel/linux/cve-exclusion_6.6.inc -LINUX_VERSION ?= "6.6.159" +LINUX_VERSION ?= "6.6.160" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "7d022d231f699d2c767d88bb1fa305550ca68e01" -SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" +SRCREV_machine ?= "67b2cec31617d8d448fdb6b9786a0bf90bb49bcb" +SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb index 601eb92595..ac5c593f1b 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb @@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base" KBRANCH:qemuloongarch64 ?= "v6.6/standard/base" KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "9d17d5c9ac32b38ca5186199ed824b43f3d4308b" -SRCREV_machine:qemuarm64 ?= "857114866d2445d49024c9ef1ec710a7ef291a5b" -SRCREV_machine:qemuloongarch64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:qemumips ?= "2349f4c462400a8fb6f95c6bc0fbbdf959b2cb18" -SRCREV_machine:qemuppc ?= "47e791b3b9f786f926e66a672c524c1e858c76c1" -SRCREV_machine:qemuriscv64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:qemuriscv32 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:qemux86 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:qemux86-64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:qemumips64 ?= "a77a45b7cea3e691d2dafca4d9bdbaa60d134617" -SRCREV_machine ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" +SRCREV_machine:qemuarm ?= "6f024f9863d3f9bd5a3e40b24e65b355e0ff57f6" +SRCREV_machine:qemuarm64 ?= "edbaaeea3aa5ea133a35962f75ba32fab5ffaa25" +SRCREV_machine:qemuloongarch64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:qemumips ?= "657fdce3e983f75a5a21e0399651a2bbdc034c12" +SRCREV_machine:qemuppc ?= "75f8fea793b8611a220cfaba666a59a9aecc8f3c" +SRCREV_machine:qemuriscv64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:qemuriscv32 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:qemux86 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:qemux86-64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:qemumips64 ?= "cfed5cc4b70b7c7d59f45b1bc8d58b4f4e4c1a95" +SRCREV_machine ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "cecd39af8a1ab81373fd9fa765b2f7ab73becaad" +SRCREV_machine:class-devupstream ?= "0aebf2870d53a8d97e02a99e2103ea0b38950c1b" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.6/base" @@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.6.159" +LINUX_VERSION ?= "6.6.160" PV = "${LINUX_VERSION}+git" From patchwork Thu Oct 29 03:45:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bruce Ashfield X-Patchwork-Id: 102308 Received: from mail-qv1-f47.google.com (mail-qv1-f47.google.com [209.85.219.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4574.1793245549343575854 for ; Wed, 28 Oct 2026 20:45:49 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=eTRxnU51; spf=pass (domain: gmail.com, ip: 209.85.219.47, mailfrom: bruce.ashfield@gmail.com) Received: by mail-qv1-f47.google.com with SMTP id 6a1803df08f44-91b8306b9f8so24123056d6.3 for ; Wed, 28 Oct 2026 20:45:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793245548; x=1793850348; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=EkFvdlbxct9rda2qggD3wCKVWrEFgaFBfW2FrlZxqRk=; b=eTRxnU51QoAr5RSK+xEFjYEvsGwQocXswVnWA9dQUEfZy9xh+ttmi5ZyhhbeR+R+iC dj+G7fWXY08Ibw4n8JNLlsk/7Q9SpMEDspqB1gbHiLr5kHTUODDkFlpXEGDCG/fQQRD0 vqDcNy3zg4uEhOBTDAbvIKuzZvUD3ohRjsiZlJUVJMkm4IfocpLo1jNrGVB5vATrHe50 hSgUQ36su/M2o2kqAni8A9PxTfEw15uZBUMS6sZBac3LKKOgKdhjDHStMRba8ifyKBoC auElE2OfMQINJggaQnWMokNS9IxWtTnZQA8b2clMBasP2hpdVLORLwCAjIJ7htZxzZCp Oizw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793245548; x=1793850348; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=EkFvdlbxct9rda2qggD3wCKVWrEFgaFBfW2FrlZxqRk=; b=l8yzQ7wYuvbxNTlhLFJC4bl58ILUIQjOpWp1i/5FRkTGk6dAHS0Ja4wshReutWdY+z aZUVQLZ22mlNRwJSHfFO8TGFXBNEtmtAuhSE/t/DrA1LPxq9UPSc0Ms5jrKzK7Ke/zYP msgENG56XEAxj8E4uQ0yQ0bGEhMlNbca8MiWVchB37nF8AVUA5yjZ9Gen4aTHBDKhUtA C+7x2AsgLT5490AlFrhOb4vDbOW5AjlO/L7E5P9lKYGUOX1cycRWHVnh2PlbhxE5bJ8H Dg8V/eAk2PiKJI+PXCelnVBuD8FaA8+OMnPOl6QGRsljVbW2lwwht9AUiPxLvVUWB2Ew Dd5w== X-Gm-Message-State: AFq9FYIEnMj7YmINfhbzxf/jZs7GV5PqKvkZlLreXsOaidtxdfuahZCU XkXSqMS25Eiw+elOfyYsDKEuCIuHWcbdUYGXyJgoozxv5ruLan7kwqFbMUk2NS/y X-Gm-Gg: AYBFou1cXaOS0+emMnILe7o1l6BrfAm2iAJDjHlAndI1y/amF7crqguzdlvX77V58da RejywmEbhDNQMTKVhBXnYxXXg8l7OuO3FZqN5JxdHtoJ0jDdiuyzrlDOJYKOdMfltSf6smDgV8n vsSYLOi4ukjyob1JGilZhMCqa8EeTkyI8I5JccnSTvbZke8AnH0GVtKKH41bEdrkBIr6Q0gQ3D1 xq71JIVIazIW4+kqFORbcPLaoexalK7WSmzNHGTN2PCpaWCFGtLijzSXCLMchBX6hzttK5/DVQ7 1myWo7H0ed36tcHedvlO9/7ZmPBnHV8DJKJaZmPcvi2g0KMWUuGzAnSsjrJq6TPJbLlVESaIfMe mvPfidnIkSwuvwUJS7ocw14uG75ehClt6qrDjtStKWRdj6uej1selaf6pb8SWEFfA/i4ymA3VN5 k250TAM/8tyly8e8Jp1u/F1zG/xf10+NXFdBq2N4yhvafU3v7l0KFY+6Qwz4spXRi/tQkbeBK9+ oqy41NIgE4fMzGu8GyJgFkodLdxExgjRS+7sYYOEBhDxGOxHO0RmnKb0YZp24HLLIO/x6Wb4oIS xu0V+eaY4GxKklUetkJDSfrMUVIJf0QIzUtMA438HD9Vk2+IvjOlN/P1jhUZjO4GdkTXmGm6eUi G0Giqq+Wnng//A/lrd2Q+R5TGVLqHJ8AkIq6aDH7AIUmjlW+oFpks+DXScnI6+aAkMKqlPOW6Ze S8CmWvnhnZbsgZNVWIKMAG1T7Z9yGvkAC1SP9VucJvg4zcOA== X-Received: by 2002:a05:6214:230e:b0:91c:7a04:e7d with SMTP id 6a1803df08f44-91c7ce0eb51mr67469216d6.4.1793245548060; Wed, 28 Oct 2026 20:45:48 -0700 (PDT) Return-Path: Received: from bruce-XPS-8940.localdomain (pool-174-112-35-248.cpe.net.cable.rogers.com. [174.112.35.248]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91c47c16569sm147542096d6.18.2026.10.28.20.45.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 20:45:47 -0700 (PDT) From: bruce.ashfield@gmail.com To: openembedded-core@lists.openembedded.org Subject: [meta][scarthgap][PATCH 05/07] linux-yocto/6.6: aufs: refresh to upstream aufs6.6.84 Date: Wed, 28 Oct 2026 23:45:01 -0400 Message-ID: <20261029034503.3153661-6-bruce.ashfield@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261029034503.3153661-1-bruce.ashfield@gmail.com> References: <20261029034503.3153661-1-bruce.ashfield@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 03:45:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248880 From: Bruce Ashfield Integrating the following commit(s) to linux-yocto/6.6: 1/4 [ Author: Bruce Ashfield Email: bruce.ashfield@gmail.com Subject: aufs: update to upstream aufs6.6.84 Date: Tue, 27 Oct 2026 12:19:23 -0400 Refresh the in-tree aufs from the aufs6.5-era snapshot (6.5-20230918) to the current upstream aufs-standalone aufs6.6.84 snapshot (6.6.84-20250414, 31c39fd5). This moves v6.6 onto the native aufs6.6 series, which handles the 6.6 VFS ctime accessors directly and already carries the allyesconfig build fixes in debug.c/sysrq.c, superseding our carried adaptations for those. aufs6.6.84 is the newest aufs6.6 point branch and targets the v6.6.84+ stable API, matching linux-yocto's v6.6 stable base. Signed-off-by: Bruce Ashfield ] 2/4 [ Author: Bruce Ashfield Email: bruce.ashfield@gmail.com Subject: aufs6: fix magic.mk include path Date: Thu, 6 Jul 2023 11:34:59 -0400 commit 482d7131560c51da3ca [aufs stdalone: make it standalone] in the aufs upstream changes the way that the .mk file is included. This doesn't work properly with all kernel build processes, so we restore the use of srctree/src to locate the file. Signed-off-by: Bruce Ashfield (cherry picked from commit c4342d979bf213fcf2168f60c5f8fbdc76d1ac4d) ] 3/4 [ Author: Bruce Ashfield Email: bruce.ashfield@gmail.com Subject: mm/mmap: aufs: drop prfile reference on remap_file_pages -EINTR path Date: Tue, 27 Oct 2026 12:19:34 -0400 remap_file_pages() takes references on both vma->vm_file and the aufs vma->vm_prfile via vma_get_file(). Every exit path releases both, except the mmap_write_lock_killable() failure path, which only does fput(file) and leaks the vm_prfile reference whenever the mapping is backed by aufs. Release prfile there as well, matching the security_mmap_file() failure and normal exit paths (upstream aufs6.6.84 uses vma_fput(vma) on this path for the same reason). Signed-off-by: Bruce Ashfield ] 4/4 [ Author: Bruce Ashfield Email: bruce.ashfield@gmail.com Subject: splice: aufs: drop stale do_splice_to() declaration Date: Tue, 27 Oct 2026 12:19:48 -0400 The aufs6 base integration added an extern declaration for do_splice_to() to . Upstream since folded do_splice_to() into vfs_splice_read(), so there is no longer any definition or user of it in the tree, leaving a dangling prototype. Upstream aufs6.6.84 dropped it from its base patch; drop it here too. Signed-off-by: Bruce Ashfield ] Signed-off-by: Bruce Ashfield --- .../linux/linux-yocto-rt_6.6.bb | 4 ++-- .../linux/linux-yocto-tiny_6.6.bb | 4 ++-- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 24 +++++++++---------- 3 files changed, 16 insertions(+), 16 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb index dbd7894eab..51a4e9703c 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb @@ -14,8 +14,8 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "5d98280cab593fe037ee0dc56c451b48fa549507" -SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" +SRCREV_machine ?= "bbef8f873c0872eaa717fb9b043b7b428de82c92" +SRCREV_meta ?= "111e66d07f015c08755ae564c4a2f4a7710863ef" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb index ba598063ef..14f0a62d79 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb @@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "67b2cec31617d8d448fdb6b9786a0bf90bb49bcb" -SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" +SRCREV_machine ?= "ada4ee01eb1897a0f2a46b9b3ceeb94690f9e619" +SRCREV_meta ?= "111e66d07f015c08755ae564c4a2f4a7710863ef" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb index ac5c593f1b..13fe981462 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb @@ -18,18 +18,18 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base" KBRANCH:qemuloongarch64 ?= "v6.6/standard/base" KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "6f024f9863d3f9bd5a3e40b24e65b355e0ff57f6" -SRCREV_machine:qemuarm64 ?= "edbaaeea3aa5ea133a35962f75ba32fab5ffaa25" -SRCREV_machine:qemuloongarch64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_machine:qemumips ?= "657fdce3e983f75a5a21e0399651a2bbdc034c12" -SRCREV_machine:qemuppc ?= "75f8fea793b8611a220cfaba666a59a9aecc8f3c" -SRCREV_machine:qemuriscv64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_machine:qemuriscv32 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_machine:qemux86 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_machine:qemux86-64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_machine:qemumips64 ?= "cfed5cc4b70b7c7d59f45b1bc8d58b4f4e4c1a95" -SRCREV_machine ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" +SRCREV_machine:qemuarm ?= "e67812bab0b383dea8ae786005a5ec642e6b860a" +SRCREV_machine:qemuarm64 ?= "dce83a630a519666f8c5599478cd8db87cf772c2" +SRCREV_machine:qemuloongarch64 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_machine:qemumips ?= "e74bfb3fbb54e475fea2371332942c68ab7edc8e" +SRCREV_machine:qemuppc ?= "a384bf5c01fda52c362015fb31815f41193f9e3b" +SRCREV_machine:qemuriscv64 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_machine:qemuriscv32 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_machine:qemux86 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_machine:qemux86-64 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_machine:qemumips64 ?= "14d15eae8d97e33895da68333b4347af334e5c65" +SRCREV_machine ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_meta ?= "111e66d07f015c08755ae564c4a2f4a7710863ef" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same From patchwork Thu Oct 29 03:45:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bruce Ashfield X-Patchwork-Id: 102310 Received: from mail-qt1-f176.google.com (mail-qt1-f176.google.com [209.85.160.176]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4576.1793245550745351692 for ; Wed, 28 Oct 2026 20:45:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=Dog9yqWm; spf=pass (domain: gmail.com, ip: 209.85.160.176, mailfrom: bruce.ashfield@gmail.com) Received: by mail-qt1-f176.google.com with SMTP id d75a77b69052e-5365f9a04c5so25249001cf.1 for ; Wed, 28 Oct 2026 20:45:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793245550; x=1793850350; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=DjIR6d1mbvxBt4eSiZurhzj/4VZt9kehPSGKU/AmKxQ=; b=Dog9yqWmi7KCvrsj7LS1YKT2SATG6t/9P8Mc6CriBLwix63Ev4zPu9gTc0S4qhYI8f HoLvREccglsLCR4MFeB3pdoE3PUXhBdqEd2b3b4D3WSNMHeqWOG5k/S4SjFzKoQfPHqe ZMAN+dRPs84Gjn0wtYOHGamtBCzqlde/ZcKd/2RZhCSTrSEzVrJrK/Yyjc1kyljzc4WU 5/g/Ltwknv4wkAOvj+ZgEPmnifzDVUsvAHihaFbyLD1J3xCIkKv+zDFlfaNGzpXL5Z/s jzT7FzaQIS2KNM78+4+2XWny8A3ZR5tYEiKaoWI1jFLmWOvQ7Hymr6Wdqt5uwi0t86MW RCQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793245550; x=1793850350; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=DjIR6d1mbvxBt4eSiZurhzj/4VZt9kehPSGKU/AmKxQ=; b=Q6C3EAzQWbTy7X7JCozq/A3fY12mw44mSGQObT6EWUxV2nxLvNfMDEUUdTsYdCxdBk G8RU0KRlulm0XilTapckG6s8tH87EPX7HZ+4kaM3FDqCYT32fZlI0KTvgzWCLgCq4NL9 MhH335hoLFAydsPEvUj/NTSs0Q6iuvXhwbikOZ6hZbb/VXrM7NmTjRB2lmVUSYu6mkQz jXoXxinQCcD6SsBM36KeoO9hPn7ZLGGQ4lxCHYqMRdIQTeiXl4Y/7ZywI2ogLO6r3ArY WLm0kq17Ap3xqEK6Vc0U4naFmq7m603QiuY8ko0CcBEeF34+FPet8uV3CDOFvjVowSoC qG7w== X-Gm-Message-State: AFq9FYJ5P5q+uLuDqEI/6g1tq4DXSMF1ucb4Gvr8WqLTZQYdL3PSNM9x HjONSXzjg0B7oQjwi29sfshQND7dU0F4CXryCxJiBlAEUQ1OqhOUtH2PBAungmFz X-Gm-Gg: AYBFou2AZ85rJ6tAVgt2pY/j/WHlmBMyvxaiNX9Czvrz5SemU9+v/aj7tgBE2H6K0Nf EqirgN3T1WFQGENwF1PIvZW5J34lDwCmVmRr5RQ3DZdQqWYffzHEqMJl+Fxkn3fvB+w2SCmxxdL YmW7vbaSg3WFlqkB3J9fl7D7HC8H7T2O5nI1rJBp1Z/Wg4N0l0zOrSRnuIAjjgJVLRHgp9Xw2mQ NFmvotaT4bUYPkWZNZZjrTZY+pXZCLoTCKqlErVPuPZlnPMiVq1cc46qlPSAdTUsr/kKvE5ds/q HRSQPlKP76EN+jKLNklb6kdg2gpU4wlDU8kj42CyXcZ4T+HWCR6oixNcuDnUNWEkn34Yl8Ds4/6 ju4QVGVIE6eWVNzD0/EAqUQXCaCi8neyAUUTUtlMHX4DB+i1UWCQeMOUhN3YbuFwXktoAk+yKxH 8YVopfMGkm7ZP4DCtRRTgScfYq29B4yCjr5cAztWLHZFYCDUUx+K2z09gkejW/AnWfHL3sNnHVZ /ZpTQrCVd3RM9EzbetpefhGKvXRMa1MAH/j0TP4UoouARjUGPi/qoZe2OuRp3LChzqYXBDsUOMp ZByVKhXBBqcfOBmaHokqWJYQsk+9MhkNDBUADq2i44DXmg+dnOXDi9Wf92k2TKq8efQym7Sv2pv oxrfC7PH/w/UMXfMLRvSwMuLw2LFytpgHvrdW5W3BLkHT6d51x7U6kObRrnI88t8Q/HX0UFc6Fi aUsvO5hmDMatYLxgfTLr38zB4+X2RTo6+LTqwEdrNG0zy42w== X-Received: by 2002:a05:622a:4a8f:b0:535:e0d5:f3ac with SMTP id d75a77b69052e-53fcbfe1ce1mr70196661cf.54.1793245549539; Wed, 28 Oct 2026 20:45:49 -0700 (PDT) Return-Path: Received: from bruce-XPS-8940.localdomain (pool-174-112-35-248.cpe.net.cable.rogers.com. [174.112.35.248]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91c47c16569sm147542096d6.18.2026.10.28.20.45.48 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 20:45:48 -0700 (PDT) From: bruce.ashfield@gmail.com To: openembedded-core@lists.openembedded.org Subject: [meta-yocto-bsp][scarthgap][PATCH 06/07] yocto-bsps: update to v6.6.159 Date: Wed, 28 Oct 2026 23:45:02 -0400 Message-ID: <20261029034503.3153661-7-bruce.ashfield@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261029034503.3153661-1-bruce.ashfield@gmail.com> References: <20261029034503.3153661-1-bruce.ashfield@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 03:45:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248882 From: Bruce Ashfield Updating linux-yocto/6.6 to the latest korg -stable release that comprises the following commits: cecd39af8a1ab Linux 6.6.159 742f73df544e0 ipv4: free inet_opt and ireq_opt after an RCU grace period a65f69e0f38ff ipv4: validate checksum_start before completing checksum 33aa3b7f4afbd netfilter: nfnetlink_queue: unbreak SCTP traffic Signed-off-by: Bruce Ashfield --- .../recipes-kernel/linux/linux-yocto_6.6.bbappend | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.6.bbappend b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.6.bbappend index 3f33ec991d..7196df5efc 100644 --- a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.6.bbappend +++ b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.6.bbappend @@ -12,10 +12,10 @@ KMACHINE:genericx86 ?= "common-pc" KMACHINE:genericx86-64 ?= "common-pc-64" KMACHINE:beaglebone-yocto ?= "beaglebone" -SRCREV_machine:genericx86 ?= "06644f0d7193d7ec39d7fe41939a21953e7a0c65" -SRCREV_machine:genericx86-64 ?= "06644f0d7193d7ec39d7fe41939a21953e7a0c65" -SRCREV_machine:beaglebone-yocto ?= "06644f0d7193d7ec39d7fe41939a21953e7a0c65" +SRCREV_machine:genericx86 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:genericx86-64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:beaglebone-yocto ?= "297689603c5961261abe13480351a125365ab025" -LINUX_VERSION:genericx86 = "6.6.21" -LINUX_VERSION:genericx86-64 = "6.6.21" -LINUX_VERSION:beaglebone-yocto = "6.6.21" +LINUX_VERSION:genericx86 = "6.6.159" +LINUX_VERSION:genericx86-64 = "6.6.159" +LINUX_VERSION:beaglebone-yocto = "6.6.159" From patchwork Thu Oct 29 03:45:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bruce Ashfield X-Patchwork-Id: 102311 Received: from mail-qv1-f52.google.com (mail-qv1-f52.google.com [209.85.219.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4547.1793245554870391103 for ; Wed, 28 Oct 2026 20:45:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=She8+KCi; spf=pass (domain: gmail.com, ip: 209.85.219.52, mailfrom: bruce.ashfield@gmail.com) Received: by mail-qv1-f52.google.com with SMTP id 6a1803df08f44-917bab38b14so19305306d6.3 for ; Wed, 28 Oct 2026 20:45:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793245554; x=1793850354; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=U5c9vYulHMSebHfoZCITQw50gHNZpv85+8IhRrptuC8=; b=She8+KCi3UNHGiOgV8qQgAx2QzyKkmT4qNhlQscCG3Q427yG1r1uKimAP+ApFtaWBe cL7OVcJzv2scyC1Ry7eRSqNmgnUbiBFL1MVfRQbMESaIXuWI0gDaJv+TZpmnLGgsUIfA DQ5TMohnjCGxobgVSD6u0s+iQrWkWDMKM8GfA7n9r+c6Lt5aiT31qiP+Ci+O11MjNipj 7LAfxSe6BqJqDJ2bajd8PNHjeIk2In8rejOqcFzEQPXUBiCSRuC+RVOib1mA52i9w1Ev QRyTaRpBcTosMU5nX7xj9H5fRhAkv3oTUjfeNhrOcP/StUL2eJJ6G31la3WZymKusUy7 7lOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793245554; x=1793850354; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=U5c9vYulHMSebHfoZCITQw50gHNZpv85+8IhRrptuC8=; b=LUeyG4D1Ofi6kujcRO+OM+m98yZWWrtfECa8iY/pZKSm2nUqxGMkHlaGawF1OX9Xnh 1l3BOIQiHLEN9IF1lnXrtwvpiDlfpu2ozgD8JZ8F0YE+d88UR2q47FkEMQxQ0VQXIDXh CHG92KL5KyCmcQBpIM6iyzyHjenbVaT0OXiGEnnrRowxwR3ogIjnMdhw6+yyRBg2DU0s y5OiZqXMytfKIHWsXxSYVljUBNLzUiavFQSAXdVMYs2sQxWisrkC1QB7Fop+kfezYm3A q2cl7oZ6RFeSDKpS7aojrWrFpjKWBOiQa+AZ2/bYuAgDrFDy26gCw65o5O7fvQB4D+dW 9m3w== X-Gm-Message-State: AFq9FYJ66he7txla2zdz6IuQiWJgD8Dd7iWR3j2KxNUAOH1qTVZAHpeT 8i7UpYsyi9JzjBCrhGEFUjnCD8YntjPyxrclH0bc5EXYZwCR2eGXhuTaA1MOz9Jr X-Gm-Gg: AYBFou3NcyeWb90gEJ+8+3SVEyUC6yJUVnfqAiU2v5UeW8qWoGcaJR0Tr/t7zrWZoG2 Jz7Tl+/sL08ry5/mCxmhA6kKh/sHIQXTuYpsqGSKMdDqlgE2BlM/sMml2JjSpCIhvetgcxJwuky EZqcwYrJWRgtJpL1FNmXki9QS3pQwPvB8ZJfRbE2Dg9SJcp14mc6nR/LYcyidj7fInWFGlLkCnT zb2FuPDf2Df/aeI3nmmLIBsuFWypKfvVVSXzIJQiCVbXILLggUWZxFdQib8KOm6Xve9xjccZQ0o 1jEcwcJjEqg39ndfDSVeoSSR7JbX5eYrxpQKVel9cJvM97nDf6j86h8fVuC0D3s+KlZDGSbcOlJ GTVFMJVWeMXkAJ2bXGUz8R9EVvirsWdQxdsmV0/gO//QWmwvF8gSvi1NeMauaABhf80d2JSvzwR M+aQt7FByoa+VIXi+5d8ms5kRW+K3daddGjz3gHzesYROKWr1QGhQF0ZnGMSXL1CYMjI4qK//LM N/bbGdgbvMKbiUUUtJ9HrNHJEI4aUaeiusEj8vKMASJpMVEct6Go7uZNhpDM9k3+X2ODoMcQ1id jUdOG4s4SCBG2+xZY39bOjWjtszJlntdfBGW8XQQhs486V1lvUR3i4UdbOAfXqxYagR8t1bYlhO wHhDB6L6N/DCvsV9ivB/i1qcx4ouQLZK1tRwFpkj2ZWOvoC1SdjfzX5mawoNh5QjWxHl05RO5yi pAN63CAFWdOtHF6+AHR7oAoBtpPHmHWpHSli/S/iO89jsILg== X-Received: by 2002:a0c:e094:0:b0:91c:8632:691f with SMTP id 6a1803df08f44-91c86326be3mr43123656d6.51.1793245552044; Wed, 28 Oct 2026 20:45:52 -0700 (PDT) Return-Path: Received: from bruce-XPS-8940.localdomain (pool-174-112-35-248.cpe.net.cable.rogers.com. [174.112.35.248]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91c47c16569sm147542096d6.18.2026.10.28.20.45.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 20:45:49 -0700 (PDT) From: bruce.ashfield@gmail.com To: openembedded-core@lists.openembedded.org Subject: [meta-yocto-bsp][scarthgap][PATCH 07/07] yocto-bsps: update to v6.6.160 Date: Wed, 28 Oct 2026 23:45:03 -0400 Message-ID: <20261029034503.3153661-8-bruce.ashfield@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261029034503.3153661-1-bruce.ashfield@gmail.com> References: <20261029034503.3153661-1-bruce.ashfield@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 03:46:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248883 From: Bruce Ashfield Updating linux-yocto/6.6 to the latest korg -stable release that comprises the following commits: 0aebf2870d53a Linux 6.6.160 a63f79d9da946 KVM: x86: Use active memslots for the per-vCPU MMIO cache 59c6dcc5dd9da ksmbd: fix heap out-of-bounds write in krb5_authenticate() db00b8cc243f1 bpf, sockmap: Account for receive queue in FIONREAD without a verdict program cec182231e528 xfs: fix unmount hang with unflushable inodes stuck in the AIL a72b0af5610ce xfs: factor out stale buffer item completion be1999582bd10 xfs: rearrange code in xfs_buf_item.c 67f0af99e2905 xfs: catch stale AGF/AGF metadata dda32083f6393 xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock fb2cc53273997 bpf: abort verification if env->cur_state->loop_entry != NULL 8010212197d4a Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained dbea82c4c81db Revert "mm/filemap: avoid buffered read/write race to read inconsistent data" 791f7e65d6299 Revert "ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev()" a102a92462b97 ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 f2d8e2e64fb2b r8169: remove original workaround for RTL8125 broken rx issue fa0c45986fc60 smb/server: fix tree connection leak in smb2_tree_connect() 22d1f4dcdc9c6 nvdimm: pmem: keep PREFLUSH before data writes 32e999ccf5f64 drm/virtio: use the DMA API for resource backing on Xen ce7da178f1af4 drm/gud: validate GUD_ROTATION_0 is present in supported rotations d51cd486930f5 bpf: check_cond_jmp_op(): properly infer if register is null b7f2e33d9f5db smb/client: validate new EOF for insert range 5fbd8848f2e25 smb/client: validate new EOF for zero range 52dd721b3de57 smb/client: fix stale page cache in insert/collapse range cc7202a51b877 smb/client: invalidate fscache for fallocate range operations 99ae165acf633 ksmbd: propagate DACL parsing errors fabc5e04f1232 Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect 01131daffc4b6 igmp: convert struct ip_sf_list to RCU 0e3e3cec28c4d ipv6: mcast: use rcu_assign_pointer() for __rcu list updates 3dbb628cfc592 tipc: Dont send random pad bytes in RESET/ACTIVATE messages 19cca7c360559 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge 1ac58dab0a83d bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks 433d52b196a68 btrfs: zoned: finish active block group cleanup if call_zone_finish() fails 14d982762945d btrfs: zstd: fix lost wakeup when waiting for a workspace 54772bf503dd0 net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). 4c85e4a0e8b07 net: plumb extack in __dev_change_net_namespace() dcc5e6c9e4d06 erofs: disable LZ4 rolling decompression for now 9496d857205e6 bpf: Mark syscall helpers as sleepable e6a94b2c4c80a nvme: remove stale namespaces by NSID range during scan c57506918b078 nvme_core: scan namespaces asynchronously 8b414dbe97fce bpf: Don't infer non-NULL from a pointer with an unbounded offset 6e15449865367 bpf: Don't predict JMP32 pointer vs zero comparisons 53ab1d12e52aa bpf: generalize is_scalar_branch_taken() logic ca7ade93a622c bpf: unify 32-bit and 64-bit is_branch_taken logic 4ea5273a22e47 bpf: generalize is_branch_taken to handle all conditional jumps in one place e3991f2c54e7f bpf: move is_branch_taken() down 82798ed5889f0 bpf: generalize is_branch_taken() to work with two registers e97cb20239d10 bpf: rename is_branch_taken reg arguments to prepare for the second one f5b2c23341b79 bpf: Improve JEQ/JNE branch taken logic 86a3171c90bfc bpf: Mark NULL kptr stores precise cf85e4f94d7fe bpf: Preserve inner map identity in callback frames 26ee5f99ffe7a net: reject oversized tx_queue_len at netlink parse time febbb66e682d8 bpf: mark a NULL call argument precise 8b95269d7a43b iommu/amd: Do not reallocate GA log buffers on resume 5ad081761a1f0 virtio_ring: fix stale descriptor flags after a failed packed add 914c7cc2e3d10 vhost-vdpa: protect config_ctx from being freed under the config callback 582fec8ebce99 eventfd: simplify eventfd_signal() 650bac9c73d3b vduse: validate virtqueue alignment 021bf73731f7a vhost: invalidate vring access on IOTLB transitions bd91dc313afe2 af_unix: Update last skb marker in manage_oob(). 385aa7dbc6af1 eth: ice: don't dereference pointers from TP_printk() 55b76500546e5 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() fb78beb64e0e7 vxlan: initialize _md in vxlan_xmit_one() d552beb9d278a net/mlx5e: Move representor vnic reporter to eswitch devlink port 9882068ed242f perf/x86/intel: Prevent drain_pebs() reentry 09c30547da2c4 net: stmmac: fix TX descriptor availability check for TSO traffic a44744454eafb configfs: pin the symlink target's dirent instead of chasing ->ci_dentry bc5f32f36724b configfs:get_target() - release path as soon as we grab configfs_item reference db6d0b2f307f0 path: add cleanup helper b315d86566076 configfs: unhash the dentry before dropping the item in rmdir 0c1a966bc047a reboot: fix cad_pid use-after-free race 61894ea0d2a1a tracing: Take trace_array reference when opening a tracer options file c3576cb77b527 ALSA: usbusx2y: validate URB actual_length in interrupt callback 4d87cf94eba53 ALSA: usx2y: Use standard print API e5c5dad169fb5 tracing: Take the reference before publishing the named histogram trigger 880712b6f4810 tracing: Undo the registration when enabling the histogram trigger fails 962e565f45dbe accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr 07d4190d75021 accel/ivpu: Validate firmware log buffer metadata 3d9365093f16b accel/ivpu: Limit firmware log name prints to field size 97be05f33f793 bootconfig: Fix integer overflow in initrd size check f664e06699829 netfilter: cttimeout: prevent UAF during module unload 0159f716d8adb ipv6: flowlabel: cap duplicate leases per socket 5a1b6379eed5b perf: RISC-V: store available counter mask as bitmap 189d60057e5f3 mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 be6eccccec867 smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid 284877c6189fd smb: client: fail DACL rewrite when the new DACL exceeds 64K 604feb3e8141b smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() 674d783f2e80d scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size 64a7ed42e9766 f2fs: accurately adjust free_sections during free_segment_range 40dcd4a71a524 scsi: qla2xxx: Skip vport under deletion in report ID acquisition 6c71726cdfda9 scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock 925a9129a514b scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error d12e92e72db91 wifi: cfg80211: reject duplicate wiphy cipher suite entries 971b40e3ca127 fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() 493a029c205a9 wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] dc5778dbd0b6c ocfs2: validate external xattr entries when reading metadata 45c534c5bf43a firewire: core: fix memory leak in error path of build_tree() e6c3a43d0a41f nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net 3861eeabaebe2 svcrdma: Validate Read chunk positions before reconstruction c4c71368bc5c5 iommu/sva: Set handle->dev before the SVA handle is visible 6e5333ec3bd8f iommu: Pass domain to remove_dev_pasid() op 80eaeae0e4b1e md/raid1,raid10: fix error-path detection with md_cloned_bio() 91d0fc000d8cc md/raid1,raid10: fix bio accounting for split md cloned bios 50d1a47fb3c4f btrfs: fix deadlock cloning inline extent when using flushoncommit bce2eec05bce5 Bluetooth: hci_core: Fix UAF in hci_unregister_dev() 441250eea8460 cxl/region: Resolve region deletion races b869e3e4ce199 net/handshake: hand off the pinned file reference to accept_doit 59db5d8bcc65e erofs: fix use-after-free on sbi->sync_decompress 98cc0403f546c netfilter: revalidate bridge ports 966b941ca469f greybus: raw: fix use-after-free if write is called after disconnect f65a96fe2467a ceph: fix num_ops off-by-one when crypto allocation fails bca0597272f97 KVM: SVM: Add missing save/restore handling of LBR MSRs 1cde96d5d53b9 hwrng: core - use RCU and work_struct to fix race condition aead84bdacd77 netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation f988fbf0536b4 media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC 690145822dd73 media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure 0870f10cbdaa7 media: hantro: Disable multicore support 414396c42ef20 ASoC: qcom: q6asm: drop DSP responses for closed data streams 253523cd4dd7d ASoC: qcom: q6asm: handle the responses after closing 8c24b5179af26 RDMA/efa: Fix use of completion ctx after free 127c5e6e2d6fa ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS d4bee74b7cb93 drm/msm: Recover HW before retire hung submit a75e5de593ef1 ACPI: platform: Use acpi_bus_get_primary_device() c4672bdc4730d net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work ba8bc644f1685 xen: fix UAF in dmabuf_exp_from_pages() d3c8519f85b78 HID: nintendo: avoid bluetooth suspend/resume stalls 155bc8f94d52c net: dsa: b53: do not enable EEE on bcm63xx b101fc9ac18d1 scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set 41168ed90f98e bpf: Mark raw_tp arguments with PTR_MAYBE_NULL d02dd7ce8e52b PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() bb2b3e6047163 PCI/sysfs: Demacrofy pci_dev_resource_resize_attr(n) functions a8adf64fe7fd5 genirq/proc: Size interrupt directory names for 10-digit interrupt numbers 482ba972f9638 pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction 8ddda06ae356f drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw 0786b38af822f drm/amdgpu: Bound GPIO I2C table entry count from VBIOS 445835710fd0e drm/amdgpu: rework i2c init and fini 5db7d4e7c980f drm/amdgpu/atombios: drop empty function 079ec13f481cc drm/amdgpu: Remove unused amdgpu_i2c functions d2ea99884793c wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed 68059b6e9f729 tty: serial: 8250: protect against NULL uart->port.dev in register 59442ba701d3a serial: 8250: invert serial8250_register_8250_port() CIR condition d5eb39d6178ca driver core: Avoid warning when removing a device while its supplier is unbinding 6e9e007ee1dfb virt: acrn: Fix irqfd use-after-free during eventfd shutdown 7c9fee40fc8d8 RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() 50bf37362362c wifi: iwlwifi: mvm: fix P2P-Device binding handling 567d7c3f93f8d drm/amdgpu: harden FRU PIA parsing with bounded helpers cf1dadc5d24ee drm/amdgpu: Refactor FRU product information c1f2f34d681a0 drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq 6fc7ab7fcd7ee drm/amdkfd: fix SMI event cross-process information leak 84fc3f30b87e0 pds_core: quiesce DMA before freeing resources 29723256fccf4 exfat: fix handling of damaged volume in exfat_create_upcase_table() af3c9c0bf8542 exfat: resolve memory leak from exfat_create_upcase_table() 1d8e1e99b063d perf: Fix addr_filter_ranges lifetime 8e4a07ed82bae wifi: mac80211: ibss: wait for in-flight TX on disconnect 2c5db82778f56 smb/client: zero-initialize stack-allocated cifs_open_info_data c422d5d53f135 wifi: iwlwifi: pcie: null RX pointers after free 5e871c03506c5 wifi: iwlwifi: mvm: validate TX_CMD response layout 88767bf9fd2e7 wifi: iwlwifi: mvm: remove mvm prefix from iwl_mvm_tx_resp* 7c293e83d86cf ksmbd: fix maximum allowed access checks d46b67c245229 ksmbd: remove redundant DACL check in smb_check_perm_dacl 190f3bdfaef8d perf/x86/intel/pt: Fix stop/start with no update 7abab59d6c99b remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 e36b1c2eafcaa powerpc/xive: propagate IPI init errors to prevent use-after-free d929980d771f8 powerpc/xive: add error return value to xive_smp_probe() 50ddd82b88b1d ACPI: bus: Introduce acpi_bus_get_primary_device() bf75f14d755f9 memcg: make the v1 soft limit knob inert 28c5a3a572f6c svcrdma: Reject Write/Reply chunks with segcount 0 94b450977c602 nfsd: convert nfsd_net boolean flags to unsigned long flags word e7c1923c5f30a mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() 64b1a9384db9c iommu/arm-smmu-v3: Manage teardown with devm 6640f778aa3d4 i3c: master: Fix recursive locking during device registration 41b2025709ec1 nvdimm: virtio_pmem: refcount requests for token lifetime 1f661f42beb55 drm/v3d: Clear queue->active_job when v3d_fence_create() fails d2d40574b9b27 cxl/mbox: Clamp mailbox output allocation to the payload size cda8af27b787d drm/amd/display: Fix dangling pointer in plane reset function ef3293c87a79f drm/amd/display: Fix dangling pointer in CRTC reset function 4dda09e7ca0bf mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug 06bdccd50bb9a mm: name the anonymous MMOP enum as enum mmop 5b1ebdc12131e mm: change type of state in struct memory_block 2ba67aa183a3c dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout e37c67f768234 hwrng: core - fix rng list on registration error 642648fa75952 cgroup/cpuset: Make nr_deadline_tasks an atomic_t f048044ad2e5f cgroup/cpuset: move common code to cpuset-internal.h 2294a8302bacb cgroup/cpuset: introduce cpuset-v1.c 94033c193bc38 bpf: Reject MEM_ALLOC BTF accesses past object bounds 5b8a40de738b7 time/namespace: Validate nanosecond field in proc_timens_set_offset() 56f92fecd8041 bpf: Reject writes through untrusted BTF pointers 30674a7bbf203 platform/x86: dell-wmi-base: Fix handling of ultra performance key fc45f6e4b86c2 platform/x86: lg-laptop: Fix LED resource handling 2147065d3a4e1 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max 72888d54bae36 usb: gadget: uac: validate rate list length before storing 959ed35f8c8f0 platform/x86: asus-wmi: fix resource leaks on probe failure 0c57c1aede122 platform/x86: asus-wmi: disable USB0 hub on ROG Ally before suspend 201bdf10ae92e esp: do not unref managed frag pages in esp_ssg_unref() b7129930d1ec4 RDMA/rvt: Return NULL after port allocation failure e835bd88ce9dd firmware: arm_scmi: Clean up channels on setup failure d8ecdceeb90cd firmware: arm_scmi: Fix SCMI device destroy lifetimes bd2a5a876904e drm/msm: Only fini scheduler after successful init f3eddc7913e14 drm/sched: Use struct for drm_sched_init() params a6090eeb289c5 bpf: Zero queue and stack outputs on lock failure 7285f004293e7 riscv, bpf: Fix memory leak in bpf_jit_free 28dbc73272283 bpf: remove unused parameter in bpf_jit_binary_pack_finalize 0ee638956cc08 powerpc/bpf: rename powerpc64_jit_data to powerpc_jit_data 29a2a166450a3 ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() 3886d944b506e RDMA/erdma: complete object teardown when the destroy command fails a5c6316052f0f bpf: Fix WARNING in bpf_tracing_link_release dc6e5d802c884 pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip 566109f1ee4e3 scsi: ufs: core: Validate string descriptors dc884df788e60 scsi: ufs: core: Convert string descriptor format macros to enum 9265fa8190312 spi: oc-tiny: switch to managed controller allocation 6e3e93bc718c4 clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path d867db0a26029 PCI: Fix UAF when probe runs concurrent to dyn ID removal ec023f18ace20 PCI: Fix dyn_id add TOCTOU 65b1fb5670e46 PCI: Make pci_match_one_device() match on ID instead of device e1b23f264f360 PCI: Initialize temporary device in new_id_store() 68c1d2c085f20 RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() d4aec20f3a846 wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() 79c6f4f7d16ee wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() b2ecd548f89a4 wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() c9c1e3da0a206 firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published 0b187e14dab45 md/raid1: create serial pool adding rdev to array with serialize_policy=1 5a540ced720b4 misc: sgi-gru: remove interrupt-context page-table walks e086ef5a0e310 mm/treewide: replace pmd_large() with pmd_leaf() 2c321f86846ea wifi: mt76: fix non-AQL packet accounting for MLO stations 7198d8fcfdd3e wifi: mt76: mt7915: unwind state on add_interface failure 3d079589add6e wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface() a582b1d54313d wifi: mt76: mt7915: allocate vif wcid in the same range as stations bc4f4389f439e wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER 5dd845c6388c6 wifi: mt76: cancel reset and rc work on device unregister 7f96bf0d24b2a bpf, x86: Fix trampoline stack size for 128-bit arguments 332c9c1a148d0 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry 5f47c9bc4a62e wifi: nl80211: clean up color-change beacon data on errors 51423d370739a wifi: nl80211: check link is beaconing for color change 66b89c6a7da47 wifi: brcmfmac: fix P2P action frame handling without device vif 9374943fc5a45 wifi: cfg80211: stop PMSR before P2P and NAN teardown e2ddbfd826836 serial: core: do fallible allocations before the console can be registered a9c0ffe5930c9 serial: core: clear freed pointers on uart_register_driver() failure ea3d2fae7c1d6 tty: skip cdev_del() when no cdev is registered 360a49fc53acd HID: logitech-hidpp: Fix FF device cleanup on init failure 37cb84b992718 HID: steam: Reject short reads 17c18a0df70c2 blk-cgroup: fix race between policy activation and blkg destruction 7f97c762b5f6e ublk: check import_ubuf() return value 7dec19f6bafe4 ocfs2: validate inline xattrs during inode block validation df002834cfd88 thermal: hwmon: Remove hwmon class device along with its parent 233f1b7fe2980 RDMA/erdma: Hold QP references for AE and CM processing b672d4de13247 ocfs2: o2hb: quiesce negotiate handlers and timeout work d64708cc119db ocfs2/cluster: keep heartbeat local node stable c0da108b346db ocfs2/heartbeat: fix slot mapping rollback leaks on error paths 4acc761b4e3fe bpf: Clear buf on error in __bpf_get_task_stack a3205bd1f2180 module/dups: Fix use-after-free in kmod_dup_req lifetime handling decea8279bec5 drm/amd/display: Resize MST HDCP per-connector arrays to 32 ba63c62d4252f coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable 710a2448a06a8 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails c97277aa6ce8a btrfs: defrag: fix deadlock between defrag and delalloc space reservation 043b6fd9706e4 btrfs: always wait for ordered extents to avoid OE races 20b2c2f3316e8 btrfs: check if root is readonly when setting posix acl 202ac9e469b78 btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() 0fa448369c87e Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind 98666d8feb514 Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero 16c8321ee40c4 bpf, cgroup: Fix storage null-ptr-deref after replacing prog b6c9daf6097f9 bpf: Fix mmap_lock leak in irq_work path 9e71e332fa2c7 NFS: Return a delegation the client fails to record a457ff1189f22 amt: Don't support cross-netns setup. 8f823b47eb889 clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type af811970da4f0 nvmet: fix max_qid race between configfs and controller allocation f535a34831f83 ocfs2: validate orphan slot during inode read eacdd27ca8297 ocfs2: validate DIO orphan slot during inode read 08a31a2cc3d1c null_blk: free zones array on device power-off 53ccb4b967edc blk-iolatency: clear delay state when freeing policy data 6b59f976db5de blk-iocost: clear delay state when freeing policy data 7166d3d60606e blk-cgroup: delay freeing policy data after rcu grace period 5f1fedccf3f7a apparmor: fix deadlock in complain-mode change_hat 67223b1150a9e ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() 7148a6c06ddf1 ksmbd: serialize oplock close with pending break ownership 5ffd180307a5e smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request() b68d4bb6b03a6 ksmbd: defer publishing granted locks to prevent UAF/double-free race 795dca34a4154 erofs: fix interlaced ztailpacking pclusters ecdcfa15b3d79 ksmbd: safely discard unregistered deferred locks d20d3f6ad8b0b ksmbd: detach blocked lock requests before freeing 3deefd5fb1368 ksmbd: scope session state changes to bound connections 988f99bfddda4 smb/server: fix session leak in ksmbd_session_register() 51d162dfb618f pnfs/blocklayout: Fix device leaks on parse failure 336b6da10021c NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers e25e5b4a76463 NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() 742d0884a1c95 filelock: add some new helper functions 64348c55dd759 vsock: don't check the listener's sk_err in vsock_accept() 45be87c5195f3 net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() 793163e134028 ALSA: mtpav: shut down output timer before card teardown 43451ec94fb67 net: qlcnic: validate unified ROM sections before loading 7f8287f606c8c ip6mr: do not clone dst in ip6mr_cache_report() c5ca770248125 net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue a23a464fb58eb net_sched: sch_fifo: implement lockless __fifo_dump() 490c72868443f net: bridge: arp/nd proxy: fix reading neigh ha 6093baf2b2c57 vxlan: fix reading neigh ha ed54460caf5b5 NFSv4.1: zero referring call lists before decoding 5fbb06d4f3d4c net/sched: account classifier filter allocations to memcg 4cc1ba2b31065 Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition 19e154d794eb4 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt a78d16530c153 Bluetooth: do not leak an hci_conn when a second LE connect is rejected bdc530baf079e octeontx2-vf: fix workqueue and netdev race in probe/remove b951dd2fd5ede net/sched: act_ife: Only operate on Ethernet frames fd63409b669f9 net/sched: fq: add overflow bounds to quantum and initial quantum e85f039cf271c net_sched: export pfifo_fast prio2band[] 87ec1c55104a1 net_sched: sch_fq: change how @inactive is tracked 3e613afdc2c0c net_sched: sch_fq: struct sched_data reorg 9cbf6da967ec8 netfilter: nf_tables: skip double clone set expressions on element insert 7ee50d42a6d5c HID: sony: clean up device list on probe failure adc34b5df5c5d NFSD: Prevent client use-after-free during close_lru reaping 0d53a47c913d0 NFSD: Prevent client use-after-free during blocked-lock reaping 7a50e138fa28e usb: dwc3: clear forceRM when issuing EndTransfer 5212f8f452b87 usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior 13e9f5a913609 usb: gadget: f_midi: initialize work in f_midi_alloc() 0729ac4976410 usb: gadget: f_midi: Annotate struct f_midi with __counted_by 8cc9c5a8c559d tracing: Take trace_array reference when opening options file ad61defb3e66a dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds 6e904f9e8cb0e mm/huge_memory: transfer the pmd dirty bit to the folio on zap ffbdc2a3834a3 powerpc/kexec_file: Prevent kexec range truncation 22dc712c170ef s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects 4bf5525c6ff4a iio: light: ltrf216a: fix runtime PM reference leak in error path 49ab1dd9051d4 iio: light: ltrf216a: Return floating point values 1759a565a25c8 KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU 5c63e2ed840c8 KVM: s390: Fix memory corruption by not reinjecting CK machine checks 50fbc294e4e96 LoongArch: BPF: Refactor jump offset calculation in tail call 22760e3e9cecb f2fs: avoid NULL checkpoint thread access in sysfs ac1284f16d560 f2fs: use new ioprio Macro to get ckpt thread ioprio level d358d2fc6be11 f2fs: fix to migrate all curseg types during free_segment_range 58ca9f0648045 f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() 21b7f66716b4f f2fs: fix to clear dirty flag on folio in error path 668cfb8ab3e22 drm/amdgpu: avoid force-completing uninitialized UVD rings 11adb2bae30a3 drm/amdgpu: force complete the KIQ ring fences on reset 5bbd7f283312d drm/amdkfd: Add TLB flush after MES queue eviction/suspension 44cad7ea3532f drm/amdkfd: Fix error path at svm_migrate_copy_to_ram 6e1a6f3ddb87d drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram 5db663fbff7b8 drm/nouveau: unsubscribe the channel-kill event before the fence context 42085d8ff5bbf drm/nouveau: remove chan->drm 5362be1dc65e4 drm/nouveau: remove nouveau_chan.device 2549b61ea1a32 drm/gpuvm: rename struct drm_gpuva_manager to struct drm_gpuvm e79a70c2e97ae bpf: Disable preemption in bpf_get_stackid b4a80e9e639cf PCI: Allow per function PCI slots to fix slot reset on s390 76ca11e31884b PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value 134d980491b43 ksmbd: zero pipe read compound padding ca3a3984bf445 ksmbd: fix tree connection use-after-free in smb2_tree_connect() f1cd6c4c35243 mm/kmemleak: avoid soft lockup when scanning task stacks b1d7c69e6c7d3 mm/mglru: fix and remove redundant unevictable folio handling 92db780dd6445 mm/migrate_device: clear stale mapping after freeing swapcache c2745e657f097 zram: fix out-of-bounds access in writeback_store() a5fda7def04d9 zram: set default primary compressor in zram_destroy_comps() 52d0c5bdfe232 NFSD: check truncate permission under inode lock 64b3baebaf945 nfsd: Pass 'cred' instead of 'rqstp' to some functions. 43943532c105e lockd, nfsd: RCU-protect nlmsvc_ops dispatch d12af460df278 nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke 172d038b7c4d3 nfsd: split sc_status out of sc_type 02b0532d4e5a6 NFSD: Clean up nfsd4_encode_layoutreturn() ec55ebe19a4b1 NFSD: Clean up nfsd4_encode_stateid() 2d4f845dffca7 NFSD: Add simple u32, u64, and bool encoders bdce362f49410 nfsd: fix stale s2s_cp_stateids IDR entry for async COPY 98fc1d21a7b80 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops 94f0c73797c30 NFSD: Prevent client use-after-free during delegation revoke 352a278d5a196 ceph: fix UAF in check_new_map() on session freed during unlock 8194d8e61ef0b ceph: cap delegated inode count in ceph_parse_deleg_inos() dd2e9824e5e7d ceph: do not repeat ceph_trim_dentries() if no progress possible 7b8c6af172878 btrfs: drop recovered reloc root refs on recovery failure 772d39c658543 btrfs: rename err to ret in btrfs_recover_relocation() 152610f284de4 btrfs: rename ret to ret2 in btrfs_recover_relocation() 64b870dff9fed btrfs: rename ret to err in btrfs_recover_relocation() cb732d302245b btrfs: fix extent map leak in NOCOW direct I/O write 5463d96cd2e46 cifs: call pagecache_isize_extended() in cifs_setsize() when extending b70bc592afd19 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() d837645a71915 smb: client: reject a tree connect response whose byte count is too small bd146a8ff107c HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes 61f7f4fdc0a83 HID: mcp2221: fix OOB write in mcp2221_raw_event() b879565effd88 ext2: Fix lost inode updates for IS_SYNC inodes 719e69421de28 bpf: Disable preemption in __bpf_get_stack 0e3b8f371c385 dm array: validate array block headers on read de932ab28a17c jbd2: use shrink_type type instead of bool type for __jbd2_journal_clean_checkpoint_list() 882212d317a7c ip: orphan prefetched skbs before multicast forwarding 62b63a505c10e ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() fe3746b41d491 ipv6: annotate data-races around devconf->rpl_seg_enabled f99fedfd1dbff sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir b2e9e10f5a536 SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 5bf47bbea3c22 svcrdma: Reject connection when transport allocation fails 5cd069ad1cf7f svcrdma: Handle ADDR_CHANGE CM event properly 8068358f445a1 svcrdma: Reject inline replies that overflow the pull-up buffer beb4e9801f636 svcrdma: Reject Read lists that exceed the page budget 2e35ec558b8ce svcrdma: Use svc_xprt_put to free listener on create failure 38bd18764b766 sunrpc: xprtrdma: Use ERR_CAST() to return 45746d4536ce1 svcrdma: Refactor the creation of listener CMA ID a2a16896ed530 sched/core: Make core-sched flips wait for in-flight selections 6db5af172ccc3 lockd: fix NULL dereference on lockowner allocation failure e5e213ddd69e3 lockd: adapt to breakup of struct file_lock 977ab74712aec filelock: split common fields into struct file_lock_core 6e1645a6ee85d power: supply: charger-manager: register regulators before exposing sysfs 3cda6fe44ec6a power: supply: charger-manager: Convert to platform remove callback returning void 4e3d3923976a9 power: supply: lp8788-charger: fix use-after-free on remove 5625c186f4088 power: supply: lp8788: Use devm_power_supply_register() helper fee7e9a801d1d power: supply: lp8788-charger: Convert to platform remove callback returning void bcdcbef9c5e69 power: supply: max17040: propagate register read errors 6a1ae47211376 iommu/msm: Unwind probe state on registration failure f7c9370dd1d3c platform/x86: ISST: Add a NULL check for sst_inst[] d680ce2b39f9a platform/x86: int1092: Fix potential memory leak in sar_probe() 380b305ad7e34 platform/x86: intel_sar: Check ACPI_HANDLE() against NULL 85ef9d4c384c1 platform/x86/amd/pmc: Propagate SMU errors and validate S2D address 7efe1c31e0903 net: l2tp: do not propagate multicast notification errors b917f37bfcce9 net: ravb: serialize PTP clock teardown 297e96f38d3e4 net/smc: stop killed, freed and out_of_sync sharing a byte 5fa0e71d66636 net/smc: Address spelling errors b78e34ed7e977 mfd: sm501: Fix potential memory leaks during remove b0b8ddaf15110 mfd: sm501: Convert to platform remove callback returning void 7be73911d979b wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() ab403b9db6f71 wifi: iwlwifi: dvm: pair transport op-mode enter/leave d6774f6af3711 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy 3a2d2115ed890 wifi: mt76: mt7915: set correct background radar capability d0c240f25e654 io_uring: defer eventfd signaling when queued from a wakeup handler c0376820922d2 net: tap: fix wrong transport_header when sending VLAN-tagged frame 11ff7642740e6 tap: Keep hdr_len in tap_get_user() 2b9ddb7311c79 ntb: Store original DMA address for future release 4a62c07dd7c15 NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers e85074045bab5 NTB: core: Add .get_dma_dev() callback to ntb_dev_ops 99b82c8452887 tipc: avoid busy looping in tipc_exit_net() 82257379061c0 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp 0464d55734f85 RDMA/rxe: Merge request and complete tasks 603e0ae0bea60 RDMA/rxe: Remove redundant scheduling of rxe_completer 788fbbf7d61f9 tcp: clamp route advmss to TCP_MIN_MSS 3130e7bf43ecf fbdev: Wrap user-invoked calls to fb_set_var() in helper 90be10604936c Bluetooth: ISO: zero the sockaddr before returning it in getname 9a1bd9fd13266 selinux: reject a permission value exceeding the class permission count fef8c8afcb85d drm/amdkfd: Add bounds check for CRAT subtype length 2cbc1fbfc57b1 drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length 5702e4c259809 bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie 07b52a4176572 drm/amd/display: use proper context for logging 84cf00b1376c7 dmaengine: idxd: fix double free of wq, engine, and group structs c41fa44be44e4 hwmon: (sht3x) Fix unaligned accesses a9133c4d335e4 net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller f0a544ef6e38e Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks a1656234a4a2d Drivers: hv: vmbus: use generic driver_override infrastructure 3d7b808ec3529 netfilter: nf_conntrack_expect: use conntrack GC to reap expectations d031617045dc7 cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size 75ed49f973d79 soc: xilinx: Shutdown and free rx mailbox channel b447688f492b8 soc/xilinx: zynqmp_power: Convert to platform remove callback returning void c305853027c04 scsi: hisi_sas: Add slave_destroy interface for v3 hw 592a0e78ab08f media: atomisp: gc2235: fix UAF and memory leak fa9560b6d3f66 EDAC/igen6: Fix call trace due to missing release() 95cda0446f510 netfilter: synproxy: fix unaligned memory access in timestamp adjustment 370c79e93f0f0 netfilter: synproxy: adjust duplicate timestamp options 1c6cb2838f82e netfilter: synproxy: drop packets if timestamp adjustment fails f03312dad6abe netfilter: make nftables drops visible in net dropmonitor 1b52aeb40c9f0 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag d9b17f9ce67d0 btrfs: lzo: reject compressed segment that overflows the compressed input 30e5ee98e86ad octeontx2-af: npc: Fix size of entry2cntr_map bf862fdee4831 ALSA: seq: oss: Serialize readq reset state with q->lock 31633ba13cc49 coresight: ete: Always save state on power down c67e70202cfd6 ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() 24a753a49d068 tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg 67a5d905c17a5 drm/amdgpu: reject oversized IBs with per-ring packet limits 1ec5f6aa38ea9 scsi: core: pair EH runtime PM get and put 4a4410de8dc69 sctp: validate cookie AUTH state before use 2512289cbf587 ipvs: revalidate ihl to prevent out-of-bounds access bd897e414451f l2tp: fix tunnel and session refcount leak on seq_file release 3770a4794a143 firewire: ohci: fix NULL pointer dereference in ar_context_release 5d05c4252c09c gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock b87c0d24386ed soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read 5d00c9c1c951a btrfs: lzo: reject inline extents without valid headers fb22bedf0c4f4 bpf: Fix netns reference imbalance in conntrack kfuncs 96da3e1439e7d vhost_iotlb: bound map allocation in add_range ce443f6827b97 hwmon: (pmbus) Fix type confusion in notification logic 4db3b48a966ed netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() 950dac9e8c4e3 s390/ism: Fix UAF of sba and ieq during ism_dev_exit() a9e0efcb1125e watchdog: at91sam9_wdt: prevent timer rearm during teardown 61dd022c55c73 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() cc325ce1c40a1 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx c71bacacd5916 tls: rx: restore msg_iter before TLS 1.3 optimistic retry e3738530ad9c9 selftests: tls: add rekey tests bea345a8d2f02 selftests: tls: add test with a partially invalid iov 25d27d5fa8645 eventfs: Use children field for rcu head and add memory barriers f6cf9832e677e mm/page_table_check: skip special zero mappings ca05d9abde219 btrfs: skip global block reserve accounting for rescue mounts 71714a2cec6c6 netfilter: nf_tables: make nft_object rhltable per table c24b3379c0ff0 xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx 724c8edbacf12 net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds 52c753b462652 net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() 44590dc53c9e9 Bluetooth: ISO: hold sk properly in iso_conn_ready 1106b26e86ac1 octeontx2-af: Block VFs from clobbering special CGX PKIND state dd1a334523ba5 s390/zcrypt: Close speculative mem read possibility f82d42577ee4a wifi: ath11k: cancel SSR work items during PCI shutdown 932ebfad767be OPP: Fix race between OPP addition and lookup a6c5f5d98719e RDMA/hns: Fix log flood after cmd_mbox failure bc963e193b314 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data fc11e3f0daaad nvmet-tcp: fix page fragment cache leak in error path 3f5e8fa9ae290 net: introduce page_frag_cache_drain() bc53b85adb103 nvmet-tcp: allocate socket file cc1c1682fa593 nvmet-tcp: make nvmet_tcp_alloc_queue() a void function 923a6f3172a36 md/raid1,raid10: fix deadlock in read error recovery path d960cd5dbcc6a wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() 0fe5ca2d56f01 vhost: fix vhost_get_avail_idx for a non empty ring 578a4ee936b40 vhost: move smp_rmb() into vhost_get_avail_idx() 9cb2db3791df9 vhost: correct misleading printing information dcabbf7da4382 ocfs2: validate fast symlink target during inode read 394317e96702a ocfs2: add extra consistency checks for chain allocator dinodes 1241e459a1bd1 netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount ff584d3735b13 RDMA/siw: Fix endpoint/socket association handling 7b17fdbfb5c9e RDMA/siw: Introduce siw_destroy_cep_sock 628a469d2a73e bpf: Clear rb node linkage when freeing bpf_rb_root f0a49d16804d3 bpf: Reject sleepable BPF_LSM_CGROUP programs at load time ec485257ccbc7 ixgbe: do not configure xps for XDP queues 663f184b51492 ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT eae296065ede4 ALSA: seq: Fix kernel heap address leak in bounce_error_event() 7d07df8a200ca ALSA: seq: Drop superfluous filter argument of get_event_dest_client() 8efa9fcc1d31b cxl/region: Block region delete during region creation 3e8f3959a7fd2 bnxt: fix head underflow on XDP head-grow 2fc2c92320272 net: watchdog: fix refcount tracking races ae429220c7f97 ALSA: seq: avoid stale FIFO cells during resize 348a52e50a462 ALSA: seq: Clean up fifo locking with guard a0024ab97592a ALSA: seq: fifo: Use guard() for locking 6b59007d95aee sockmap: Fix use-after-free in udp_bpf_recvmsg() 88baaa8ca3731 RDMA/bnxt_re: Initialize dpi variable to zero 8e59bd37d6d63 RDMA/bnxt_re: Avoid repeated requests to allocate WC pages 7d89bff21c12e RDMA/irdma: Replace waitqueue and flag with completion a2275dce05e6d soundwire: fix bug in sdw_add_element_group_count found by syzkaller a562485c359d0 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE 921e2baa626d1 md/raid1: fix writes_pending and barrier reference leaks on write failures f076460c5205c md/raid10: fix writes_pending leak on write request failures 6d21a3fed9be4 md/raid10: Handle bio_split() errors 80ac31cce5543 md/raid10: fix writes_pending and barrier reference leaks on discard failures 669bc3b345712 bpf: Guard conntrack opts error writes d0282a1546e75 bpf: net: netfilter: drop dead NULL checks 158a5480d5196 md/raid5: avoid R5_Overlap races while breaking stripe batches f49ed02fd8c98 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync 6aeb4ba4fb098 tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() 81892d83cc897 sctp: add INIT verification after cookie unpacking cd0e037130806 hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() 5098308ad72f8 sctp: fix addr_wq_timer race in sctp_free_addr_wq() 72e27ef70a202 xen/pvcalls: bound backend response req_id before indexing rsp[] 2e7888bb635d9 afs: Fix reinitialisation of the inode, in particular ->lock_work f72176bde0cc0 HID: bpf: Fix hid_bpf_get_data() range check 268869794170a net/mlx5e: Fix publication race for priv->channel_stats[] 333a39f134dd0 Bluetooth: 6lowpan: avoid untracked enable work e3b20de8d7c06 net/liquidio: drop cached VF pci_dev LUT 3b0aa139ba09a perf/x86/amd/core: Avoid enabling BRS from the SVM reload path db2b40dc12cd6 gpio: mvebu: free generic chips on unbind 2d0effadf8d2c ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() 65d35cb555f40 netfilter: nft_lookup: fix catchall element handling with inverted lookups eb74f3feb68e6 KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling 043c509f24880 mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch 6626fb859f4c4 fs: Remove NTFS classic 1dc6653c47147 mtd: maps: vmu-flash: fix fault in unaligned fixup c286319746cef ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec df99ca9b5b8e2 ocfs2: validate i_refcount_loc when refcount flag is set b8fa4d063e3b0 ocfs2: add suballoc slot check in ocfs2_validate_inode_block() f4cd214883d77 ocfs2: correct l_next_free_rec in online check 584d7d14d9b40 nvmet-auth: reject short AUTH_RECEIVE buffers 0bdb510cd7c4b nvmet: Introduce nvmet_req_transfer_len() 374775626c327 dm-verity: fix buffer overflow in FEC calculation face65f80c694 mmc: vub300: fix use-after-free on probe failure 181b46e76a218 wifi: ieee80211: validate MLE common info length d0951ed366710 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey 7e13e5b087375 ovl: check access to copy_file_range source with src mounter creds 98ca831065c4d net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 3b71f51fa3a24 LoongArch: Fix address space mismatch in kexec command line lookup aa24049ce2fc9 loongarch, kexec: change dependency of object files 4927ab8a8acc8 xfrm: fix stale skb->prev after async crypto steals a GSO segment d52ff592abfcd RDMA/irdma: Prevent user-triggered null deref on QP create a5afc00280986 wifi: mac80211: defer link RX stats percpu free to RCU 88f31eac74b9d wifi: cfg80211: add link_station_info structure to support MLO statistics 0246df249c04e wifi: mac80211: refactor populating mesh related fields in sinfo 30c67926d41c4 wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock c55590e4c69e0 wifi: cfg80211: use wiphy work for socket owner autodisconnect d312a71b19bb8 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() f6814814b3bdd bpf: Fix UAF in sock clone early bailouts 95ddf04135a78 bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c 8faa3deda8d06 rcu: add rcu_read_lock_dont_migrate() c0131f007dd29 bpf: Disable migration when cloning sock storage bba24ce0e5299 bpf: Disable migration when destroying sock storage 4827c824a203e scsi: core: wake eh reliably when using scsi_schedule_eh 3ff6b534d2082 tipc: serialize udp bearer replicast list updates bac237c2aedb8 pds_core: fix use-after-free on workqueue during remove 895b3f83f030c pds_core: Clean up init/uninit flows to be more readable c004f1985c570 pds_core: Don't assign interrupt index/bound_intr to notifyq c968b2417f6a1 cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths 9e904b3608444 cifs: prevent readdir from changing file size due to stale directory metadata 3be8dcc1a5854 drm/vc4: hvs/v3d: Fix null dereference in unbind c8a4acc19dcdc net/mlx5: Fix MCIA register buffer overflow on 32 dword reads 3531910845165 drm/amdgpu: Fix context pstate override handling 2b817c0dfc653 drm/amdkfd: Check bounds on CRIU restore queue type and mqd size dc30139679354 drm/i915/bios: range check LFP Data Block panel_type2 bedeee4612afc drm/i915/gt: Fix NULL deref on sched_engine alloc failure fae63319ad397 drm/i915/mst: limit DP MST ESI service loop 1748043b5114c drm/amdgpu: Release VFCT ACPI table reference 8151bfd641384 drm/amdgpu: Add wrapper for freeing vbios memory 9ed82f9cb1d6c drm/amdgpu: Use dbg level for VBIOS check messages cf55c6f1b62a8 drm/vc4: Shut down BO cache timer before teardown ae6ccae32f51f media: vivid: fix cleanup bugs in vivid_init() 1d0b99ef7fcb6 LoongArch: Move jump_label_init() before parse_early_param() a2516be690488 ksmbd: fix path resolution in ksmbd_vfs_kern_path_create 3350acfa72b2e vfs: make LAST_XXX private to fs/namei.c 3100f7fc873bb ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name a7bf4f5b19965 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state 9174992ee1045 Bluetooth: eir: Fix stack OOB write when prepending the Flags AD 22e371a93563c net/handshake: Take a long-lived file reference at submit 3e339c88b8c30 ALSA: hda/cs35l41: Fix firmware load work teardown eec1dd2586c40 ksmbd: prevent path traversal bypass by restricting caseless retry 2ad5509dd576a ksmbd: use opener credentials for ADS I/O a6a951416b55e ksmbd: validate NTLMv2 response before updating session key 6825a45f6b8ef smb/client: fix chown/chgrp with SMB3 POSIX Extensions 0f012938f2130 cpufreq: qcom-cpufreq-hw: Fix possible double free 203016396f00b cpufreq: Make cpufreq_driver->exit() return void 41401e2f4c175 cpufreq: pcc: Remove empty exit() callback 4e7d3c98fed73 USB: iowarrior: fix use-after-free on disconnect race 8ae9bb92fc9a7 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page 11d48f777cf8f crypto: qat - protect service table iterations with service_lock 02b88fa993582 hwmon: (lm90) Add lock protection to lm90_alert bdad77438cc2b drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() 3812cfe6cb0a5 erofs: fix metabuf leak in inode xattr initialization 8efbea0253b7f ksmbd: validate SID in parent security descriptor during ACL inheritance 5fe97797412aa wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb 55b170713aa54 wifi: mac80211: fix missing RX bitrate update for mesh forwarding path 5ea15e7823225 netfilter: x_tables: allocate hook ops while under mutex 2a5defedd154a netfilter: x_tables: allow initial table replace without emitting audit log message 124f5187c3dd5 netfilter: Use kmemdup_array instead of kmemdup for multiple allocation ff9ecefd488a4 mm/util: Introduce kmemdup_array() 6fe4c808b6cdb netfilter: ebtables: move to two-stage removal scheme 5fc488f46086d netfilter: bridge: eb_tables: close module init race 1fe96176636cb hwmon: (lm90) Stop work before releasing hwmon device b28b862b07257 cgroup/rstat: validate cpu before css_rstat_cpu() access 14dbf22c397b7 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure ee4b2ba9d3015 net/handshake: Drain pending requests at net namespace exit 7b81c1378b79c Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close 6bacd22e1eae7 usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers 816c6251409db usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() bbd3a27e4f99f KVM: SEV: Ignore Port I/O requests of length '0' e35cf322897dd drm/amdgpu: fix amdgpu_hmm_range_get_pages 525cc9df65436 drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring b0f7bd5eeb903 gcov: use atomic counter updates to fix concurrent access crashes bcc9df992f3cb f2fs: read COW data with the original inode during atomic write 5e10b1747547c fbdev: omap2: fix use-after-free in omapfb_mmap 2d60e3b176a4b fbdev: omap2: fix inconsistent lock returns in omapfb_mmap 01930f94b8b13 drm/msm: always recover the gpu a632474c793b7 drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() 9d63dd026644f wifi: mt76: mt7921: Place upper limit on station AID 1cad9afbb2d55 drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths 793bf1f4e469c net: mana: Guard mana_remove against double invocation 4255c8f756b78 net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind 7107b047e709a btrfs: only release the dirty pages io tree after successful writes 312ecea13b677 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() 87484866cae91 wifi: fix leak if split 6 GHz scanning fails 3bad189a31eb7 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure f51a7b611bd97 tools: ynl: extend netdev sample to dump xdp-rx-metadata-features 8cb3a5ecef999 bpf: make it easier to add new metadata kfunc dd75066882ecc sctp: validate embedded INIT chunk and address list lengths in cookie d95edbbf7830d staging: rtl8723bs: fix buffer over-read in rtw_update_protection 94ea9dc65fae4 staging: rtl8723bs: clean up redundant & parentheses f90cda7f7ae75 Staging: rtl8723bs: Delete dead code from update_current_network() 890083673a623 Staging: rtl8723bs: Remove dead code from _rtw_free_network() 18143799ad51a staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction 6cdcf0d16c809 nvmem: core: fix use-after-free bugs in error paths 38434334a32c6 nvmem: core: Rework layouts to become regular devices cc7ce6736b237 nvmem: Move of_nvmem_layout_get_container() in another header 18ca42f07ad00 of: device: Export of_device_make_bus_id() cbdd6f0fb19a0 fs/mbcache: cancel shrink work before destroying the cache 1034251715a34 btrfs: fix deadlock between reflink and transaction commit when using flushoncommit fdfa287956d00 PCI: use generic driver_override infrastructure 4005cb89139f7 vdpa: use generic driver_override infrastructure dbba371b19129 bus: fsl-mc: use generic driver_override infrastructure 7bedc489611f0 wifi: ath11k: fix memory leaks in beacon template setup e9d197c248e70 powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy 6f571bf37da84 powerpc/64s: Fix unmap race with PMD migration entries a2af91af95369 wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() 533b1a9fa0128 wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() 5895cfc76924a net: pull headers in qdisc_pkt_len_segs_init() 7f0062c40781f sctp: disable BH before calling udp_tunnel_xmit_skb() 166a08644aa50 iommu/amd: Fix clone_alias() to use the original device's devid e4d07fd4e3002 greybus: raw: fix use-after-free on cdev close c260c874a6d57 f2fs: avoid reading already updated pages during GC 0645fa4d48e9b f2fs: fix data loss caused by incorrect use of nat_entry flag 359906450690a ice: fix double-free of tx_buf skb ede973d62d26d netfilter: nat: use kfree_rcu to release ops d8ddbc3330fa6 sched/psi: fix race between file release and pressure write 926ec3937b28d fsnotify: fix inode reference leak in fsnotify_recalc_mask() 759053333a40c libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() 37d028a473b08 tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR 74d33525db50d Revert "net/smc: Introduce TCP ULP support" e327021bd73b1 RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE 2405730fde96f netfilter: nf_tables: use list_del_rcu for netlink hooks d8cafd0226d5d selinux: allow multiple opens of /sys/fs/selinux/policy ef8b71a0fc692 iio: frequency: admv1013: fix NULL pointer dereference on str 7afabc08721ec iio: frequency: admv1013: add dev variable f1f4cac657f86 iio: frequency: admv1013: Use devm_regulator_get_enable_read_voltage() 58f9d54a8109f device property: Add fwnode_property_match_property_string() 3e8cdf184646c coresight: tmc-etr: Fix race condition between sysfs and perf mode d772e8570f19a drm/amd/display: Fix dc_link NULL handling in HPD init dd74a790818eb spi: mpc52xx: fix use-after-free on registration failure c6e3b9f5dcb80 spi: mpc52xx: fix controller deregistration 125a7eb177a94 spi: mpc52xx: switch to use modern name 2d8b30b496bc5 RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() d1820a5814ead f2fs: fix fsck inconsistency caused by FGGC of node block 8f3a5dc4055e1 riscv: kvm: fix vector context allocation leak 783dc000b8be6 spi: microchip-core-qspi: control built-in cs manually 03348b440f694 dm-verity-fec: fix reading parity bytes split across blocks (take 3) fcef67506c023 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 165b08d2d1346 KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 b1a45e8a59bcf KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN 2e661773890e6 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT 33deba9bf5c34 RDMA/mlx5: Fix UMR hang in LAG error state unload 4db5e4c8f1103 gfs2: fix memory leaks in gfs2_fill_super error path ab4aeab2d630e iommu/vt-d: Clear Present bit before tearing down context entry 237e0524a5381 erofs: fix inline data read failure for ztailpacking pclusters 107e169f96392 net: stmmac: fix oops when split header is enabled 12addb8ab5eec btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation 8e1623e7d61fa bpf: Fix tcx/netkit detach permissions when prog fd isn't given 11d35b1101344 ipvs: do not keep dest_dst if dev is going down b0dd8637fbaae netfilter: nf_tables: revert commit_mutex usage in reset path c36b0515c6445 iommu/vt-d: Clear Present bit before tearing down PASID entry cde7f709d1025 HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients 63f67e525be21 HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend 53aaf083de197 gfs2: Fix slab-use-after-free in qd_put 32d7120a499d4 list_lru: allow explicit memcg and NUMA node selection 60310ed5d3d3a mm: list_lru: Update kernel documentation to follow the requirements 6451ea47d60a8 net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ 1106412414dc3 net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ a71ce398347fe ASoC: amd: acp-mach-common: Add missing error check for clock acquisition baabbd2919151 scsi: qla2xxx: Completely fix fcport double free 73bb6b15f1fd7 i3c: mipi-i3c-hci: Fix race in DMA ring dequeue 04b2853fdbb2e i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue 320942ce316a1 btrfs: reserve enough transaction items for qgroup ioctls 0e77f1c8ebf5b btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() a35b38cb4b0dd btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() 87fc584a72bc4 drm/amdgpu: Skip vcn poison irq release on VF 3cd7a71958c9f drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels 5593c9b255ae7 alpha: fix user-space corruption during memory compaction a91476c7b4091 arch: turn off -Werror for architectures with known warnings aad97c92119cb usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() 480aa6ffd4ac7 9p/xen: protect xen_9pfs_front_free against concurrent calls 566899af05324 vhost: move vdpa group bound check to vhost_vdpa 6f129a251c279 kcm: fix zero-frag skb in frag_list on partial sendmsg error 1cf0ef7399188 team: avoid NETDEV_CHANGEMTU event when unregistering slave c0da84e308a0b wifi: rtw89: pci: validate sequence number of TX release report 5efde07521309 net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query 68fe91df6ea82 netconsole: avoid OOB reads, msg is not nul-terminated 56eab82fa6fb5 ksmbd: fix signededness bug in smb_direct_prepare_negotiation() 5cc021586420c wifi: iwlwifi: fix 22000 series SMEM parsing 759e44a6cba8e xfs: remove xfs_attr_leaf_hasname d60f09d2d16c4 ntfs3: fix circular locking dependency in run_unpack_ex bd5e7ba28a49b fs/ntfs3: Accumulated refactoring changes c939bfa67d221 btrfs: fix zero size inode with non-zero size after log replay cff22dd364b24 btrfs: tree-log: don't use token set/get accessors in fill_inode_item() f03cd10a3513e btrfs: convert to new timestamp accessors 20b98d9ffb097 srcu: Use irq_work to start GP in tiny SRCU 3ff29beb3b82e irqwork: Move data struct to a types header 94ad192f7b9b5 types: move struct rcuwait into types.h f8f3bb89ab677 xfrm: account XFRMA_IF_ID in aevent size calculation 34b8390ac0ba5 ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() a05a85779c257 net: ioam6: fix OOB and missing lock 73c2dc2c14d6a x86-64: rename misleadingly named '__copy_user_nocache()' function 3d6de8467236c Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers df966f0def875 HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure 218b93b7e284d HID: core: Mitigate potential OOB by removing bogus memset() ca27733152dbd HID: rate-limit hid_warn to prevent log flooding 556a757847aed HID: core: Add reserved item tag for main items 0d377825548fe mpls: add seqcount to protect the platform_label{,s} pair 5057502630fbc net: use skb_header_pointer() for TCPv4 GSO frag_off check dfee8da127baf Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists 1aac6b271e0a8 bpf: Fix incorrect pruning due to atomic fetch precision tracking 1e4b738dd0d0f Bluetooth: hci_event: move wake reason storage into validated event handlers 481f7a463ae4b drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode fdc3aa4c23d3e usb: gadget: f_ecm: Fix net_device lifecycle with device_move b1d854462510f usb: gadget: f_eem: Fix net_device lifecycle with device_move edb0804705188 usb: gadget: f_subset: Fix net_device lifecycle with device_move 9701a98f4459b usb: gadget: f_rndis: Fix net_device lifecycle with device_move ad7d18df7423c ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() 7e345de2e6947 crypto: af_alg - limit RX SG extraction by receive buffer budget 94439cbe478b5 xfrm: hold dev ref until after transport_finish NF_HOOK adc2fe90827e0 xfrm: hold device only for the asynchronous decryption a516594c502fd net: adopt skb_network_offset() and similar helpers a229a4dc87302 net: lan966x: fix page pool leak in error paths 808a34cdbe8ce rxrpc: proc: size address buffers for %pISpc output 3aa77f5da0ecb usb: gadget: f_hid: don't call cdev_init while cdev in use 777a8ebd2da35 KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock f554953cf4fab KVM: SEV: Use long-term pin when registering encrypted memory regions 1eb35c54cd81c s390/mm: Add missing secure storage access fixups for donated memory bac13309339b6 spi: spi-dw-dma: fix print error log when wait finish transaction a8a3fb2888e2c nvmet: move async event work off nvmet-wq 18a4543c1750f ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() b1f62588ab1be cxl/port: Fix use after free of parent_port in cxl_detach_ep() c5e2de193831a net: bcmasp: fix double free of WoL irq d5dcca707f56c iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() 6e8eb467bed6a spi: use generic driver_override infrastructure f69491478e3de drm/amdgpu: prevent immediate PASID reuse case 6ea2a79faed97 drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API 1df0123f96f37 ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION 3bba71395ad45 fs: super_set_uuid() c9e845014723d serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN f5a41b61b5faa bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing 44f6b01693b87 bpf, arm64: Enable the inline of bpf_kptr_xchg() f2b29bbe35522 ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz ce6253fe71881 sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting 5e2fc90018635 PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry 3555e41737c0f cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() da5f0166cef3d net: add xmit recursion limit to tunnel xmit functions e873e8c16b2fb tcp: secure_seq: add back ports to TS offset 43ad494ac6e94 ksmbd: add chann_lock to protect ksmbd_chann_list xarray 34614f5dd26c8 btrfs: reject new transactions if the fs is fully read-only b2b9ac2bb2c5b drm/amd/pm: Disable MMIO access during SMU Mode 1 reset 152fc4f7b4a8a ALSA: usb-audio: Prevent excessive number of frames 513587caec66b spi: tegra210-quad: Protect curr_xfer check in IRQ handler 4c7ad40c285ab of: unittest: Fix memory leak in unittest_data_add() 17260b5215d4c staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths 015f9fbcf3382 bpf: Mark bpf_refcount field as unique 11e78304b0113 PCI: endpoint: Add missing NULL check for alloc_workqueue() ab0bdaf7a7f4f net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels d57e31c8df7b8 wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() 13f96c3b73a84 wifi: rtw88: debugfs: support multiple adapters debugging c02b1d244a5d7 wifi: mac80211: don't WARN for connections on invalid channels 863b9b7be824a md: suspend array while updating raid_disks via sysfs 2ad6c244d65a8 md: add new helpers to suspend/resume and lock/unlock array 2284eab166f2d md: add new helpers to suspend/resume array f150854e9a0bc mips: unhide uasm_in_compat_space_p() declaration 9cfda98cf02ea MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits 585a656283c95 functionfs: fix the open/removal races f68515eb8f3cf functionfs, gadgetfs: use simple_recursive_removal() 9aa31e353d9f4 usb: gadget: functionfs: Factorize wait-for-endpoint code 61c3f32b425ab usb: gadget: Support already-mapped DMA SGs 8cf889d45bbc8 Input: lkkbd - disable pending work before freeing device 8fdbc6f9a994e shmem: fix recovery on rename failures b9d8cfd6d77f5 Input: alps - fix use-after-free bugs caused by dev3_register_work 0d0a1a267c1ee scsi: qla2xxx: Clear cmds after chip reset abfbceda0d239 wifi: ath12k: Fix MSDU buffer types handling in RX error path d6028caa0ee39 bpf: Fix stackmap overflow check in __bpf_get_stackid() 5d5d130835b41 coresight: ETR: Fix ETR buffer use-after-free issue dc6d1249ee35c md: fix rcu protection in md_wakeup_thread a17d1bca5aba1 md: fix stopping sync thread 66eb53cecc5f8 gfs2: Prevent recursive memory reclaim 9a8e531543535 scsi: imm: Fix use-after-free bug caused by unfinished delayed work 2eb6a5f6adb7d tty: serial: ip22zilog: Use platform device for probing 79693f738680d serial: ip22zilog: Use port lock wrappers 1c963811b0824 scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) 51713b285096a scsi: ufs: qcom : Refactor phy_power_on/off calls f0ee42f47cc1b drm/amdgpu: fix gpu page fault after hibernation on PF passthrough 1e00721013ff9 drm/amdgpu: Restore partition mode after reset 1a7865e3e4de2 mlx5: Fix default values in create CQ b68d1f321119b drm/amdgpu: remove two invalid BUG_ON()s e61dfd906ad02 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() 6776866cffbc2 media: nxp: imx8-isi: Fix streaming cleanup on release 0a187ea7a5b4e ASoC: Intel: avs: Do not share the name pointer between components 29c742ff222dd md/raid10: wait barrier before returning discard request with REQ_NOWAIT 3d608e67b966c drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM 8a0fc82502321 drm/amdgpu: Show vram vendor only if available 31d6c9216aa1b Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete 47a92030422d0 mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop 69f35d8d17b31 mailbox: zynqmp: Move buffered IPI setup to of_match selected routine 5db5e21b6cd58 mailbox: zynqmp: Move of_match structure closer to usage daa680de4eb91 mailbox: zynqmp-ipi: fix an Excess struct member kernel-doc warning 9f22b5f7f1a32 net: use dst_dev_rcu() in sk_setup_caps() 423895685f367 ipv6: use RCU in ip6_output() 5f75857ed634d crypto: hisilicon/qm - request reserved interrupt for virtual function 7012bea562239 tcp_metrics: use dst_dev_net_rcu() 8b6e327736db0 RISC-V: KVM: Write hgatp register with valid mode bits da513f2ad1b1b ptp: Add a upper bound on max_vclocks dfbff47f120e4 bpf: Check the helper function is valid in get_helper_proto 145b8f1776e5b bpf: add a get_helper_proto() utility function b467ebabf16c9 bpf: improve error message for unsupported helper 3b32cf6e27959 iommu/s390: Make attach succeed when the device was surprise removed 8729dc4eeb502 ice: fix Rx page leak on multi-buffer frames 891ab8c695419 dm-stripe: fix a possible integer overflow 53707bc68fdc7 dm-stripe: limit chunk_sectors to the stripe size fd677c1f51c57 dm: stop using blk_limits_io_{min,opt} fea5d52f89f4f dm-verity: provide dma_alignment limit in io_hints f23d5c6b7540e smb: client: let recv_done verify data_offset, data_length and remaining_data_length dc5aad078abc4 ceph: fix race condition validating r_parent before applying state 9598c83a50a5f mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() 6d40c15d70c2d wifi: mt76: mt7915: fix list corruption after hardware restart e2a6eabe5304a ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog 18e4b315e359f vxlan: Fix NPD when refreshing an FDB entry with a nexthop object 8ba034c41b20d vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects aa977309397fe trace/fgraph: Fix the warning caused by missing unregister notifier dc797a4bbbcac bnxt_en: Fix memory corruption when FW resources change during ifdown 74d3b91f1598e crypto: x86/aegis - Add missing error checks 6758b816ffed5 crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT cbab09ae85675 crypto: x86/aegis128 - improve assembly function prototypes 3223bb62918e5 crypto: x86/aegis128 - optimize length block preparation using SSE4.1 67ddb169e1528 crypto: x86/aegis128 - eliminate some indirect calls f76089018b34d mm/smaps: fix race between smaps_hugetlb_range and migration 1f45a710c82b2 wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() f6510c2eae93e wifi: ath11k: mac: fix struct ieee80211_sband_iftype_data handling 0d9f4f202de15 drm/amd/display: fix a Null pointer dereference vulnerability 7874179a229af drm/amd/display: switch DC over to the new DRM logging macros dcfed7251e23c net/sched: Fix backlog accounting in qdisc_dequeue_internal d26058c2349d7 habanalabs: fix UAF in export_dmabuf() 29a15e06a3d41 drm/amd/pm: fix null pointer access 5c432da1ee191 wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() 3bf99140d7b77 wifi: iwlwifi: return ERR_PTR from opmode start() dcae71222c8b9 rv: Use strings in da monitors tracepoints be27a11a42b21 wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() 45be183b9944f drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port 067ca15be8b83 RDMA/hns: Fix double destruction of rsv_qp ea2e6c1503800 wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 9bcfbd58fc5a0 s390/mm: Fix in_atomic() handling in do_secure_storage_access() e98ce4b70beab Bluetooth: eir: Fix possible crashes on eir_create_adv_data 920c2db46ca44 wifi: ath12k: fix invalid access to memory 2d9a8022009d2 bpf: Do not include stack ptr register in precision backtracking bookkeeping 1b63cdc0d63ae riscv: save the SR_SUM status over switches 1cd09aaf47a57 coresight: holding cscfg_csdev_lock while removing cscfg from csdev 20d00e9b53091 wifi: iwlwifi: don't warn when if there is a FW error 761db4ca3a469 PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops acdfe206be6c7 virtio: break and reset virtio devices on device_shutdown() 3dfbbf72de6b6 virtio: hookup irq_get_affinity callback 9f71fb768d55e driver core: bus: add irq_get_affinity callback to bus_type fc3f1cbf8b1ec virtio: make virtio_bus const b7867e55cbcba bpf: copy_verifier_state() should copy 'loop_entry' field 40d66e0adde4b dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn 47a0da0c80749 clk: sunxi-ng: h616: Reparent GPU clock during frequency changes 8f1b0a4f1ad15 clk: sunxi-ng: h616: Reparent CPU clock during frequency changes c33a7fe6dda59 kasan: avoid sleepable page allocation from atomic context 1c320f6ccc884 um: fix time-travel syscall scheduling hack 52cdc47cf6519 drm/amd/display: prevent hang on link training fail 31dad8d385953 scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue cf3bf87aba2a2 scsi: mpi3mr: Debug ability improvements ae9909d12735b scsi: mpi3mr: Split off bus_reset function from host_reset a9703b006a475 sfc: fix NULL dereferences in ef100_process_design_param() 455a0ba90d0d9 sfc: rip out MDIO support df8a35e8bcea2 sfc: Implement ndo_hwtstamp_(get|set) 9039afe6240ae btrfs: harden block_group::bg_list against list_del() races 53ac3b8ac1d88 btrfs: stop reserving excessive space for block group item insertions 716e065e74f8b btrfs: stop reserving excessive space for block group item updates 9e025844756fd btrfs: remove pointless loop from btrfs_update_block_group() f8f0873dd8975 btrfs: stop doing excessive space reservation for csum deletion 210493962d0ae btrfs: remove pointless initialization at btrfs_delayed_refs_rsv_release() 3e8a465bf1ae4 btrfs: reserve space for delayed refs on a per ref basis 85abb0e726cc0 btrfs: allow to run delayed refs by bytes to be released instead of count 25014e3dfa6d2 bpf: Fix kmemleak warning for percpu hashmap 7af81befc0428 fs/ntfs3: Keep write operations atomic 457a034fcb04b fs/ntfs3: Separete common code for file_read/write iter/splice 2bb0e21c84f20 fs/ntfs3: Use function file_inode to get inode from file ab41bf5a211fb ublk: fix handling recovery & reissue in ublk_abort_queue() 08160de2a6522 smb: client: fix UAF in decryption with multichannel c8c6af46286a5 smb: client: allocate crypto only for primary server aae58a39ac4c6 perf: Fix hang while freeing sigtrap event 0554373bc9acc wifi: ath12k: Avoid memory leak while enabling statistics 47297d133eea9 wifi: ath12k: Avoid explicit type cast in monitor status parse handler 2f129230ac7d6 wifi: ath12k: fix incorrect TID updation in DP monitor status path 90c782bc9e8d0 wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info ccb4eaf078697 wifi: ath12k: refactor DP Rxdma ring structure 731e0d5dcbafd wifi: ath12k: avoid explicit HW conversion argument in Rxdma replenish e976114d81746 wifi: ath12k: avoid explicit RBM id argument in Rxdma replenish 27d472b86c19b wifi: ath12k: avoid explicit mac id argument in Rxdma replenish e762406e13446 wifi: ath12k: Remove unnecessary (void*) conversions ce906c4ae5725 RISC-V: KVM: Teardown riscv specific bits after kvm_exit ddfb25dfb16d8 RISC-V: KVM: Add kvm_vcpu_config ec97bd5378c59 wifi: ath11k: update channel list in reg notifier instead reg worker e2f45bfeef5ff wifi: ath11k: fix misspelling of "dma" in num_rxmda_per_pdev 8b7c9c5fec37c wifi: ath11k: add support to select 6 GHz regulatory type 4513843d58d8f f2fs: fix potential deadloop in prepare_compress_overwrite() 9b5e2f1ade251 f2fs: convert f2fs_handle_page_eio() to use folio 77fd40b7ed0c3 btrfs: fix block group refcount race in btrfs_create_pending_block_groups() b6d27f4869c9c ext4: avoid journaling sb update on error if journal is destroying 735c0e603cf25 ext4: define ext4_journal_destroy wrapper f364eb60987a5 ax25: Remove broken autobind b17edabd91714 fs/9p: fix NULL pointer dereference on mkdir 616b4f2d1556c fs/9p: convert mkdir to use get_new_inode 3d0281d071395 net: mctp: unshare packets when reassembling 924ef5959b7cf eth: bnxt: fix truesize for mb-xdp-pass case 9d22cf5cc94cd nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() 6088e11c9aed1 RDMA/mlx5: Fix the recovery flow of the UMR QP 6e59f56161ccc RDMA/mlx5: Fix a WARN during dereg_mr for DM type d63d73d045e48 RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers 50e44aa5f9905 bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT 4ace6fb49c8be btrfs: do proper folio cleanup when cow_file_range() failed 545d6893d3a34 btrfs: do proper folio cleanup when run_delalloc_nocow() failed 6105f0d9cc7be net: ravb: Fix missing rtnl lock in suspend/resume path e2ef3fa31353b net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels 7368f88b2e62d wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion bf66ec718e687 scsi: mpi3mr: Fix possible crash when setting up bsg fails 8458c686d50a8 nilfs2: do not force clear folio if buffer is referenced a306dfff6b76a RDMA/mlx5: Fix implicit ODP use after free 8e2f6ba256dd1 mm: clear uffd-wp PTE/PMD state on mremap() a852466354667 net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue 33b3e09a489a3 rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy 01aaa7935af30 PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() 57d90fe7aab16 powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW 1e9dfe15404dd powerpc/iommu: Move pSeries specific functions to pseries/iommu.c 2855445a1870b udp: Deal with race between UDP socket address change and rehash 6a97bfc0293db RDMA/siw: Remove direct link to net_device 30fc8f6d33bb2 PCI: imx6: Fix suspend/resume support on i.MX6QDL d7dade716905b scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs 465e06ffbb681 vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() e469922fbdf6a udmabuf: fix memory leak on last export_udmabuf() error path 2384a29db79bd udmabuf: change folios array from kmalloc to kvmalloc 0015d54a47995 virtiofs: use pages instead of pointer for kernel direct IO f9f621c5a26e0 fuse: Fix missing FOLL_PIN for direct-io 0335fb698ab04 drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe 1a0aecabff72a io_uring: check for overflows in io_pin_pages 82dc96f0f4eec exfat: fix out-of-bounds access of directory entries 41d73ca1fe161 exfat: convert to new timestamp accessors 9ada9ff6339d4 afs: Fix lock recursion 00872dcc2a3e4 drm/amd/display: Implement bounds check for stream encoder creation in DCN401 64704f231d5de net/ncsi: Disable the ncsi work before freeing the associated structure 98691b2e28a6c l2tp: prevent possible tunnel refcount underflow 692e9a20018da drm/amd/display: Check null pointers before used 4f51f6d23c585 drm/amd/display: Check null pointers before multiple uses 180280f3c4621 drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer 45f2bbe7bc08d bpf: Fix a sdiv overflow issue 7299868253c0e mm, slub: avoid zeroing kmalloc redzone 694eea36e3e16 mm/slub: avoid zeroing outside-object freepointer for single free 6158dbcba6986 slub, kasan: improve interaction of KASAN and slub_debug poisoning f8ba0d22afa61 bpf: Prevent tailcall infinite loop caused by freplace 6fc6ef4cd858a drm/amd/display: Avoid overflow from uint32_t to uint8_t 29ec422b32c69 scsi: lpfc: Change lpfc_vport fc_flag member into a bitmask 6a80b818c63e0 scsi: lpfc: Protect vport fc_nodes list with an explicit spin lock 3543cdaf0185b scsi: lpfc: Change nlp state statistic counters into atomic_t 148b39768ff2b scsi: lpfc: Remove shost_lock protection for fc_host_port shost APIs 2d0dfb1f2fad2 scsi: lpfc: Fix failure to delete vports when discovery is in progress 117df33ecfd8a drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range 0c1e8a6f7ce9b drm/amd/display: Use kcalloc() instead of kzalloc() 7eed5b3115ce9 pktgen: use cpus_read_lock() in pg_net_init() 2a0ba376cdf72 serial: sc16is7xx: fix TX fifo corruption 97cee643a8258 PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init() 2011c0ebaf710 mm/huge_memory: avoid PMD-size page cache if needed 6d1f6dd02a2d7 mm: simplify thp_vma_allowable_order 88f520120f999 mm/thp: fix "mm: thp: kill __transhuge_page_enabled()" acf609843a848 gve: Account for stopped queues when reading NIC stats 7d5711e03cefd s390/pkey: Wipe copies of protected- and secure-keys 3732398dcf65d s390/pkey: harmonize pkey s390 debug feature calls 1f7f63f7165d1 ice: Fix improper extts handling 1eb6c4a0d83d1 drm/amdgpu: fix double free err_addr pointer warnings 9aa83a5eb013f ice: Don't process extts if PTP is disabled 2bbfffa802adc bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() c20d0fa873039 bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() d35130036d327 sched: fix warning in sched_setaffinity f8005214946fd sched/deadline: Fix task_struct reference leak 251840f22eff3 drm/amdgpu: change vm->task_info handling 2860d59e4ce2b net: nexthop: Increase weight to u16 942ae3d64c3ce net: nexthop: Have all NH notifiers carry NH ID f6dd625053726 drm/msm/dpu: Add mutex lock in control vblank irq fee05f14bf747 drm/msm/dpu: shift IRQ indices by 1 ec2e11c1d36db tty: add break_wait kernel-doc 5e8f3ac8fa3d4 namespace: handle mount locking for automounts correctly 55d7433e26c79 fcntl: refuse F_SET_RW_HINT on an immutable inode b98dd4af91ade namespace: check the target before walking it in do_mount_setattr() 86a2d56b19607 namespace: don't copy an unmounted mount tree db90eecbde319 namespace: unhash a dentry before detaching the mounts on it 013c060b2f122 drm/vc4: Fix firmware reference leak in vc4_drm_bind() 45f2d1a6edf1c scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() 49dd29ce73653 scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock() cce865a62cec3 scsi: ufs: core: Add debug log for MCQ command timeout 4813a6624ce48 scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe() 40589a91c7b9b scsi: ufs: mcq: Remove unused parameters ec6ecab1b7577 scsi: ch: Do not keep references to data transfer element devices 37a0d6e81a42e scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ 262062c01f5a8 optee: register TEE devices only once fully initialized cf59abb49e91f wifi: ath12k: copy M3 firmware when reusing the buffer 4af250fc84828 wifi: ath12k: fix reusing m3 memory 2be324c89993c ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params 60b5824ae259a ASoC: hdac_hda: Fix hlink refcount leak on component registration failure 3b8a540b36aa0 ALSA: control: Don't add invalid kcontrols to LED layer c17fe25dcb55a ACPI: processor_idle: Mark LPI enter functions as __cpuidle 444b0e44aa430 net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv 7b3b902320214 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv 04474009a2ea7 most: core: fix leak on early registration failure 82f42a13e3d7a most: core: fix resource leak in most_register_interface error paths a56d4f8f8f4c5 namespace: check the mounts before reading their parents in pivot_root() 99698cfa34e49 namespace: don't inherit MNT_UMOUNT in clone_mnt() 9b6ed57eb8c89 Bluetooth: ISO: Serialize concurrent connect calls db6fbc2b77849 drm/vmwgfx: validate pitch coming from userspace 4dc3d5a004b8f Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex f01cbddfb4273 Bluetooth: hci_sync: Fix command skb lifetime during scan setup b21f20320fa2f net: team: stop reusing skb after queue override 9486377e5e971 net: team: fix NULL pointer dereference in team_xmit during mode change 84600e7b30fc1 net: team: Rename port_disabled team mode op to port_tx_disabled 85cf6665154de net: team: Remove unused team_mode_op, port_enabled 4f46ac83d87a4 netfilter: nf_tables: fix bidirectional offload regression 089f10b47843a apparmor: fix cred UAF caused by begin_current_label_crit_section() 20c52a7041409 ALSA: mixer: oss: Add card disconnect checkpoints c937a494901df ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger d9df965284abd ALSA: pcm: oss: Fix setup list UAF on proc write error 8f27d152b2a59 nvme-tcp: sanitize request list handling 604cf76a6a7e8 llist: add interface to check if a node is on a list. 24120e90d4638 mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge 522fd1a6efd0a mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP 1f26323565177 ice: fix metadata_dst refcount handling on representor teardown b14a682ad7d45 ip6_gre: remove obsolete ERSPAN PMTU update 578d39ab420b1 tracing: Set the trace clock before registering the histogram trigger cbf9961602ffb HID: steam: Clean up locking 3c2f97343d4df HID: steam: Refactor registration d2587923d50c8 HID: steam: Rearrange teardown sequence 5f135cfc1d68c HID: steam: Fully unregister controller when hidraw is opened 0aa096eec8d87 HID: hid-steam: Make client_opened a counter dd7a39f644373 drm/amd/display: Don't replace a sink mode that shares the native totals 8ed6cf7f77915 can: fix unique skb identifier regression under RPS 2deafd015ea9a dlm: validate length in dlm_search_rsb_tree 99b8bd6323e6f wifi: mt76: mt7603: initialize global station WCID 63ec518b737c4 netfilter: flowtable: fix offloaded ct timeout never being extended 5d3ee9fc5fb08 netfilter: conntrack: fix erronous removal of offload bit b7b80d204abdc net: openvswitch: validate transport header presence in set_ipv6_addr 41ad5bcf0219a mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() 3e531d85b7823 net/mlx5e: Order ICOSQ cc update after CQ doorbell 194685b13dc9e veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down c44c02c930c65 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() 774856241e7dc net/sched: cls_route: reject change with no routing attribute d9e08836d06c8 flow_dissector: avoid u16 truncation of skb->len when computing thoff 2c64c30d493d8 ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM 2cb098262ce2f ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes 58905982b0d91 ASoC: adau1372: allow sleepy powerdown GPIOs 50deef6dc4dd4 wifi: mt76: mt792x: pick the SAR table layout from the table itself 26f0504432add wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit 7a53bb4668b31 btrfs: fix xattr replace when multiple xattrs are packed in the same item 3c231142c4f4b nvmet: use the local P2P device on metadata allocation failure 8739f06e3f82c cxgb4/ch_ktls: disable softirqs around tid_list erases 95114e4211962 amt: send the relay's General Query directly from the receive path 00bcc303000ba net/sched: em_text: reject unterminated algo before autoload bf2848e50bd73 drm/vc4: Free the BO cache size list on teardown ad8a96a9e0fee drm/aspeed: Balance the display clock enable on teardown bf3d841ef12fc gpio: exar: initialize the ID before registering its cleanup f424fc191ec2b drm/dp: don't mark the AUX backlight enabled when enabling failed 95fb7c259b86f namespace: refuse an automount below a mount that is in no namespace 5e6bfd9f249f2 dcache: don't put a mountpoint on a dentry that's being removed f639428183449 namespace: check a submount for references right before unmounting it cae49d34f0cd1 fs: refuse fspick() on internal superblocks d63df57e738a3 drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs b5f813f500c44 drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks 067c88010df80 drm/amdgpu: make Mac FB workaround generic 037796d9ca1da drm/amdgpu: serialize vblank counter reads against GPU reset 8a2b420ee227a drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info 4a86f0a696f48 drm/amdkfd: align SDMA doorbell base for shader doorbell writes 17c5fa371de2d drm/vc4: drain the hangcheck timer and works on V3D unbind 77abc1837c965 drm/i915/gt: Unmask interrupts only when ACTIVE is true 24c04e80c35ff drm/i915/gem: Prevent overstepping exec array boundary a5ce29550386f drm/gud: don't keep a connector without a CRTC as connector_state 4a2006c675758 drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN d5c372ad03330 Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown a54ce160e3ef7 Bluetooth: RFCOMM: free the skb when the DLC has no owner 44ce36c5789ac Bluetooth: MGMT: Fix status of pending commands flushed on power off 37cef0c8fb537 Bluetooth: hci_sock: Serialize dead-device detachment 8181a1a45c706 scsi: qedi: Initialize callback state before registration a613e4fafb47c iio: light: Drop ROHM BU27034 7e90b11a4f699 pmdomain: rockchip: propagate subdomain add errors 1b476b9a90ac9 pmdomain: rockchip: fix clock leak on domain probe failure b94c6104c4949 pmdomain: rockchip: don't ignore clock lookup errors on attach 3601dd1cdc97c pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains 1ea151615a82f regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 fd376d8374111 regulator: ltc3676: don't read the write-only HRST and CLIRQ registers c995c52eba192 openvswitch: fix soft lockup in the netlink flow dump ab0d2a6fe87e8 nvme: fix swapped ZRASF zone state values for full and read only c128173919a65 net: usb: ax88179_178a: fix rx frame length for non-last packets 1e4d51d903ecf net: dsa: microchip: fix KSZ8765 fiber detection 695a5a4c69c92 net: bridge: avoid recursive multicast port cleanup e607017a553d2 net/smc: protect clcsock lifetime in smc_getname d8a24b9e1774a net/packet: guard the ll header push in packet_rcv_spkt() 605a59639abb9 mmc: sdhci-sprd: disable runtime PM on remove 9e799f25c420e mmc: mtk-sd: Cancel request timeout work on remove 5d4cdd4a15075 mmc: cavium-thunderx: destroy slot platform devices on remove a1019e0722049 mmc: cavium-octeon: destroy slot platform devices on remove 281f68d6cf8ac dm: fix reading free memory in do_resume bcfb26658e0fa dm-snap: reject the transient exception store for snapshot-merge 9a0dab8a9d997 dm-crypt: reject the lmk IV mode with AEAD ciphers f2c181e1d58e9 memstick: rtsx_usb_ms: complete requests after eject instead of dropping them c3ab92542475d memstick: core: wait for request completion before freeing card 305f1828b871d KEYS: Fix add_key() race with keyring restriction f7bff12d5de4b keys: finalize persistent keyring timeout after link attempt c2e0cbb587a8a ibmveth: fix TX LTB and filter unwind on open-fail decb4d4ead2c7 ibmveth: h_free logical LAN on open-fail after register b07b3925f6766 gpio: xilinx: fix runtime PM leak on request error path ce45166daf6bd EDAC/amd64: Mask UMC chip select to the four implemented selects be0167091542e sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute a545def625860 selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts a07d325ebb37a selinux: fix data race on AVC latest_notif af4b3d33f2ff5 Revert "wifi: libertas: reject short monitor TX frames" b60259d4047fb tipc: hold a reference to nodes found by link name 7f796bb3b440d tipc: destroy topsrv workqueues before closing connections dbee987ecf312 swiotlb: fix default_swiotlb_limit() for non-growable default pool a18dd388045dc strparser: make sure __strp_recv isn't running before tearing down the parser 5051df0311447 xen/netfront: don't leak the skb when xennet_fill_frags() fails 3dc61af2998cf workqueue: Fix NULL current_pwq deref in chained work check fb5ce4c7790c3 wireguard: noise: reject response consumption after intermediate initiation b261dbed0c538 wireguard: queueing: preserve tstamp_type when encapsulating packet 7b79131e357c4 wifi: brcmfmac: fix P2P device removal race in brcmf_detach() 3ad7606400f38 usb: f81604: fix struct f81604_int_data size mismatch 98195e822343a dm ioctl: don't let data_start run past the buffer 41cabfbf3532e btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() 496a45b7c6705 ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) e35becbd03191 arm64: irq: exclude the softirq stack switch from KCOV 1eeeb4d315401 Input: xpad - add support for Corsair Novablade Pro 8a3b935b6b603 ipv6: do not warn on route notification size race 088ba80eef85f ipv4: do not warn on route notification size race 72d9d17092bb3 ipv4: stop route notification sizing when nexthop group shrinks 7fd60d3c9a1e1 ipv4: stop PMTU walk when nexthop group shrinks 408c78e50feab crypto: drbg - Fix ineffective sanity check 8f1215a370e89 netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting 80861f424fe5c Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING 45adb04a8ad0c mm/damon/core: fix unconditionally skip last region e3c206de1fcba mm/damon/core: do non-safe region walk on kdamond_apply_schemes() 82ecc6b5af65d f2fs: fix to reset all pinned status during fggc 9f5510b0452ba f2fs: fix to shrink gc_lock coverage in f2fs_gc_range() f4ee42c35022a f2fs: fix to reclaim space in f2fs_allocate_pinning_section() 7d7ad2bea4eed HID: uhid: convert to hid_safe_input_report() b9d2deecddae7 HID: core: introduce hid_safe_input_report() f1dc59675d542 wifi: cfg80211: release locks on error in cfg80211_wext_siwgenie() 909b31661be70 iio: cdc: ad7150: fix OF matching and publish module aliases a2df3f13f00b3 smb: client: only require read lease for size-extending preallocate 55f1cebee909c iio: adc: stm32-adc: fix possible division by zero in processed channel b950ad53ca6ea iio: adc: axp288: Add TS bias override for Haier HV103H f66a164ea6bd4 iio: adc: max1363: sign-extend bipolar differential channel reads 9f503cda04f2c iio: adc: aspeed: propagate reset deassert errors 3d8019516f028 iio: adc: aspeed: Simplify with dev_err_probe 975b09bc680ac iio: adc: ad_sigma_delta: fix use-after-free on unbind 3df27277f8f95 smb: client: discard post-EOF pagecache when extending a file via zero range 6535f7084d958 wifi: mac80211: set info->band for 802.3 encap offload frames 40d7e969b6f15 wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() 84da7a0e92207 KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted b1ac8181a59ab mm/hugetlb: fix avoid_reserve to allow taking folio from subpool 6a2baff6fecae net: mana: remove double CQ cleanup in mana_create_rxq error path cd9c62753becf net: mana: Skip WQ object destruction for uninitialized RXQ 263d45141069a net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() f3a52e2ec2788 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry 32bbb870078d4 net/mlx5e: Prevent stale XSK buffer release on refill retry f1c966eb6ed5e fs: Free any excess xarray nodes in clear_inode() 2a74f30a7bb30 iio: health: max30102: fix NULL dereference in interrupt handler b76f068b2d3d0 iio: core: add accessors 'masklength' 4ae6ed5b6074d wifi: mac80211: count only matching reservations in reserved switch 47864a9092fd6 wifi: mac80211: keep paired old chanctx alive 6b5366ba63a58 jbd2: bound shrinker scans by examined checkpoint buffers dc7ece0b827fe jbd2: check need_resched() when skipping busy checkpoint buffers 6198123cac2ff gpio: rockchip: fix generic IRQ chip leak on remove 77b6ff33c8f56 gpio: rockchip: teardown bugs and resource leaks d4cf99c7ea95a firmware: arm_scmi: Unwind TX receiver mailbox setup failure 50e38091a657a firmware: arm_scmi: Publish channel state before callbacks b1a86a5ab0d44 fbdev: hyperv_fb: Allow graceful removal of framebuffer 3a489c3bbf5ed fbdev: hyperv_fb: Simplify hvfb_putmem 18f9f3ddbf2ed erofs: unify lcn as u64 for 32-bit platforms b18a82503a67a erofs: avoid infinite loops due to corrupted subpage compact indexes 6b6b47c1aa717 ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers 796207e63c51f ASoC: SOF: topology: Parse DAI type token for dspless mode ce220b4cdf62f tty: port: fix tty_port_tty_vhangup() race cf8530a25ae92 bnxt_en: fix DMA mapping length for padded small packets b4f2a7ae80ed4 mtd: spinand: Enable QE on all dies bff83b723e93a mtd: block2mtd: Fix divide error when erase_size is zero 057320c36c5a2 block2mtd: prevent direct access of bd_inode 8736c49d6ff27 mtd: block2mtd: Convert to bdev_open_by_dev/path() de77b0f681421 wifi: mac80211: keep fallback association elements alive d0da6ab1fc53a wifi: mac80211: shut down RX BA session timer on teardown 77c449c9c946f mtd: spinand: fix NULL pointer dereference with no ECC engine 1fbc4b24c7443 apparmor: Fix & Optimize table creation from possibly unaligned memory bd00629b52788 AppArmor: Allow apparmor to handle unaligned dfa tables 122b1fdcd26b5 drm/amd/display: Mark DCE 6.4 as not APU 04c259eaceba4 i2c: xiic: preserve PEC byte length in SMBus block read setup 7b42e4a70f8c4 i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode 4ae00993e6d92 ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 3cdad0c541f89 serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() 0af044c47a957 serial: ma35d1: Convert to platform remove callback returning void 2f973fe58d70e serial: fix TIOCMIWAIT race 158a07da2da72 tty: serial: max3100: shut down timer before freeing port b71f75408c466 tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2 16032c980d8f7 tty: tty_port: restore TTY_IO_ERROR on activation failure 402b1aceabfb4 usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 5a206e64ae8ab drm/amd/display: Preserve eDP mode on initial ASSR failure 82cc242da6d62 USB: dwc2: shut down wakeup timer before freeing HCD state 4f35e6be2f86b usb: ohci-spear: disable controller wakeup on removal 7037a6a567223 usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() c1e3aed32da03 drm/amdgpu: reset VI ASIC on MacBookPro14,3 79c4721c17fbc drm/amdgpu: reset VI ASIC on MacBookPro15,1 29302964ef583 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend 12dace1387d3c fsverity: add dependency on 64K or smaller pages 0a5c76eb3950a KVM: arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP e786386c882d5 arm64: errata: Add Cortex-A725 erratum 3821522 workaround fb8b57d0321f6 arm64: errata: Factor out broken AMU const counter cap 94afa17d6bfd5 Bluetooth: Serialize SMP remote OOB data access f997e03e2ef58 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown 052acee988011 arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems 8c38cb055f6a9 perf: Require kernel access for text poke events 6b4e15cccfbe0 tty: fix saved termios reset race 6cd82563bb270 usb: dwc3: gadget: fix IRQ storm on invalid event buffer count bc992b73f7af6 drm/amd/display: Fix fast updates on DCE 8.1 3f3b0898557a9 fs,fsverity: remove check for fsverity being enabled in setattr_prepare() a4ca8102e70e1 fs,fsverity: reject size changes on fsverity files in setattr_prepare 0542d213253ee xen/netfront: drop RX packets with a short Ethernet header 5ea733af79616 usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling 424e4d0bc47f0 usb: typec: tcpm: fix debug accessory mode detection for sink ports 0a2f71ccf9c20 usb: gadget: f_fs: Fix Use-After-Free in AIO error path aee2fde0f39e2 USB: gadget: ffs: fix mm lifetime handling 723d73b245843 usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed 09ddd44db0a84 usb: gadget: at91_udc: Convert to platform remove callback returning void abc17fd508a51 serial: imx: serialize imx_uart_ports[] lifetime 4663bded2e49a serial: imx: Convert to platform remove callback returning void dd34630226211 net: usb: qmi_wwan: add Quectel EG120K-EA ffac3399bf627 wifi: wlcore: Fix runtime PM leak in wlcore_remove() 8435103a82aa7 wifi: wlcore: Convert to platform remove callback returning void 75b3b30ae4ee6 mptcp: prevent race between disconnect() and rtx 0f7668bcf6685 tcp: introduce icsk->icsk_keepalive_timer 9116b5ef5a5b3 mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages c073d01f6f536 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF 4b5ebb4f91a61 SUNRPC: reject duplicate CREDS_VALUE options 8c56a46db3b75 SUNRPC: fix gssx_dec_option_array error path bugs 574af7c61f2be drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read dd0c3e6c03e3b KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save c873363497808 jfs: fix array-index-out-of-bounds read in add_missing_indices ac5d26a46c90f iio: trigger: cancel reenable_work before freeing trigger 42eb8c2cf1744 iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler 2272efb10096e iio: proximity: sx9324: Correct proximity channel resolution 2c8211eef9892 iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure 59ab2f302548d iio: proximity: isl29501: Fix return type of isl29501_register_write 05ef1af381a0f iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup 85c20d1cf3f01 iio: light: gp2ap020a00f: drain irq_work after free_irq 8a78224497271 iio: imu: adis16480: fix unprotected debugfs reads d3078aaef8af4 iio: imu: adis16400: fix unprotected debugfs reads b62c3944c006c iio: gyro: adis16136: fix unprotected debugfs reads 2bde96b2857aa iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() b4f53cec8cc94 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. 6a728408ff522 iio: buffer: serialize buffer teardown with mode claims 012451d72c122 iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind d94d2ec25ff26 iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls 53473b0556296 iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure 01d20048ab0e2 iio: adc: stm32-adc: fix check on internal channel availability 57628402e9cbf iio: accel: sca3000: fix frequency divider condition check 137c35cff4d4d iio: accel: kxcjk-1013: reject duplicate event disable 3b8e7928cf192 smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races b270c1074860d thunderbolt: Reject oversized XDomain properties responses 7bca83bf8ba00 thunderbolt: Disable CL states for the Anker Prime TB5 dock b70b9c41f240c thunderbolt: Fix KASAN reported use-after-free when request is canceled 4375b5d91db4d USB: serial: option: add Compal EXC-T1 support 992a471458f96 USB: serial: option: add Quectel RG660QB 85750b58e8d4f USB: serial: option: add Compal EXM-G1x support 9c910016df78c USB: serial: option: add Quectel EG060W bb5487f3aadbe USB: serial: option: add support for SIMCom SIM8260C 24d6edb6bd7f7 USB: serial: fix ioctl hangup race e7ad832b1144d USB: serial: fix driver deregistration order 2917216123615 USB: serial: fix dynamic id driver deregistration race f8e290609546a USB: serial: ssu100: fix baud rate overflow 7ee47aea0baca USB: serial: quatech2: fix baud rate overflow e7fa5128bcc4f USB: serial: cp210x: add Corsair AX1500i Power Supply 0b1e4a7eeb6a3 wifi: mac80211: handle empty FILS association request payload ebb7cba623d38 wifi: mac80211: fix mesh fast xmit path deletion UAF 57bfaa8b28534 wifi: mac80211: release mesh path quota on failed additions eebc70f132041 wifi: mac80211: minstrel_ht: validate fixed rate index c66ab4b94bb04 wifi: mac80211: account proxy paths against the mesh path limit cbff71fe689f3 wifi: mac80211: drain PS delivery work during station teardown 3ebc529726c0c wifi: iwlegacy: 3945: free EEPROM data on remove b66539a4dab12 wifi: cw1200: fix TX padding OOB read leaking heap data to device 951fce1510645 KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy 40d855d6ad463 mtd: spinand: fix zero oobavail when no ECC engine is used e238c19826cc9 mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB c69d8aceda362 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ ef4dfad231a78 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() e7188a268c356 nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT 3045128294d34 nvme-multipath: fix underflow in ANA log bounds checks 5a2b9cc53719b net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules fdbd83c2d929e net: extend IPv6 exthdr detection of tunneled packets 3776f34fbce99 HID: multitouch: stop the release timer from being rearmed on remove bc9ff8e64771c ipvs: bound LBLCR and LBLC cache growth be58b239d2be5 Bluetooth: btintel: fix buffer over-read in btintel_hw_error() 545fa70f730eb Bluetooth: hci_core: Serialize fragmented ISO packet queueing 780affacd9297 Bluetooth: hci_core: Serialize ACL scheduling with channel deletion b208818492cde Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems 70b55855eecb4 Bluetooth: hci_conn: Lock parent access during enhanced SCO setup ddc9edb244cc8 Bluetooth: hci_sync: Fix inquiry cache use-after-free 55d162aa00d1e Bluetooth: RFCOMM: Fix initial port reference race 48f0e0bcf683f i2c: xiic: don't clobber msg->len to signal block-read completion ada5ded765f05 ALSA: ua101: reject mismatched capture/playback packet sizes 2db234e163f0d ALSA: seq: Serialize compat port-info ioctls 775df6a27e843 ASoC: qcom: lpass-cpu: use DAI table index for playback constraints 30a60e74ee71d ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type a756c93fae312 ASoC: codecs: max98363: fix uninitialized stream_config->type 3d9faec1da7e8 serial: vt8500: Fix clock reference leak in vt8500_serial_probe() 2c4ddc8ed0d87 serial: tegra: don't clear the Tx FIFO on an Rx-only reset dd81650bec58a serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() 6c9c9367351a4 tty: abort break signalling on hangup a42d96e8101ca tty: serial: qcom_geni_serial: Keep console RX functional after deep idle 57753441ef84b tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup 4b59afc8af314 tty: vcc: zero-initialize control packet in vcc_send_ctl() 674b1c890322f tty: amiserial: fix broken TIOCMIWAIT bdda8d889accc tty: vt: fix memory leak in vc_allocate() dbdd0ca9a7eac usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe efdf0ddaed011 usb: cdns3: fix use-after-free in cdns3_gadget_exit() 9a86cdb675949 usb: typec: ucsi: displayport: Current CAM OOB index fixup abe93f73639da usb: typec: ucsi: Get the connector fwnode based on reg value a39d53f70e637 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() ae8aae45a39fc usb: typec: tcpm: recover after failure to start the frs ams 198d74dcfa129 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints 40fef138eb6c1 usb: chipidea: tegra: disable runtime PM on resume failure 06ac8609d6d18 usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC 6849e51b89de5 USB: gadget: dummy-hcd: Fix wait for outstanding request completions 0d39ac4f65f93 usb: gadget: aspeed-vhub: cancel wake work on device removal be347590e188d usb: dwc3: am62: Fix runtime PM usage count leak on probe error path a789838675afa usb: typec: anx7411 - stop the IRQ before destroying the workqueue da841c1511a61 usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd 18138d9f19cf6 usb: gadget: midi2: Fix the jack descriptor array sizes 61db743284896 usb: ohci-st: disable controller wakeup on removal 203094415f85c usb: ohci-s3c2410: disable controller wakeup on removal 2cf192041c00b usb: ohci-da8xx: disable controller wakeup on cleanup ba0f023cee31c usb: octeon-hcd: fix the FIFO-flush timeout computation e4df763ba3c4f usb: hub: use shorter 120ms post resume hold for SS root hubs 4faaad69f1833 usb: storage: sierra_ms: reject short SWoC info transfers e4a6883ad9b46 USB: serial: fix port tear down use-after-free d86775e79838d USB: cdc-acm: skip URB restart in port_shutdown if disconnected 451ded3b33bef USB: cdc-acm: fix racy TIOCMIWAIT implementation 4cea8e5b6c593 soc: qcom: geni-se: Correct QUP Core ICC vote constants 8bde6f643ab6f nitro_enclaves: fix use-after-free on SLOT_ALLOC failure d74220bb59af0 Input: synaptics - limit T440p InterTouch quirk to LEN0036 a2300ca8797eb Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 9ef8a8de8717d Input: s6sy761 - fix resume ordering and restore sensing dee75ece52b6a Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 a71adc66e8401 Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 69b1ed4acc56c kgdboc: Fix tty driver reference leak in configure_kgdboc() a7329ea53d04f binder: fix leaked fd fixups on TF_UPDATE_TXN supersede e9b364e46d594 binder: fix is_failure flag for superseded transaction cleanup d700c26ed64bd drm/amdgpu: fix ACP MFD device leak on init failure f6364e7284a13 drm/amdgpu: fix IP instance memory leak on kobject add failure 4a0ae61067671 drm/mediatek: Fix pdev reference leak in mtk_drm_bind() 03fb1c657028c drm/mediatek: Fix ovl adaptor platform device leak f0ffb09cf1bf2 drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device bc7255b8623de drm/radeon: Read the VRAM VBIOS signature with readb() 2aee72150b0ea drm/amdgpu/gfx6: fix firmware leak on teardown e28008f8d5020 drm/amd/pm/si: Fix updating clock limits on AC/DC 48ab11f054267 drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC e0c2f42f7c608 PCI: Accept AtomicOps already enabled by the hypervisor a2047aff72ce5 ALSA: ice1712: Fix the error handling via auto-cleanup at probe 80c7c10debd3a ALSA: core: Define auto-cleanup for snd_card_free() 655acfa713bce perf: Fix race between perf_event_exit_task() and perf_pending_task() 22efeebe688fe i2c: at91: release DMA channels when probe defers 4ab37e4f4a33c ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() 963e11f65c1be net: add and use skb_get_hash_net 68f35f8ffa803 net: sparx5: make ports inherit the switch base mac address type ef82f57fc999e net: microchip: vcap: stop scanning after deleting key field f7e292f3c8c85 netfilter: flowtable: generalize pending status bit 28c2a0ed2657b netfilter: conntrack: rework offload nf_conn timeout extension logic b6aefccb76489 netfilter: conntrack: remove skb argument from nf_ct_refresh 752492947be31 netfilter: bpf: reject invalid NAT manipulation types d7d33c9efa9d1 ipvs: filter some flags received in the backup server 1c68bfde05276 ipvs: do not create invisible templates 0632541dbfa43 ipvs: fix missing counter decrement in lblc 0c52040a3f69f tcp: refresh TS.Recent for accepted old ACKs efc91ab1d97bd net: ethernet: mtk_eth_soc: allocate dummy netdev sooner 213ff02ab26a4 net: bcmgenet: fix NULL dereference in set_coalesce before first open 41583c7d80ea6 net/sched: sch_codel: match the no-drop threshold to the packet size 5172124684e12 net/sched: fq_codel: match the no-drop threshold to the packet size a85a3dce4b6c7 tipc: prevent GCM nonce reuse on peer key changes f9531e8331790 octeontx2-af: mcs: Fix SC resource cleanup loop 5b353908e3be9 net: systemport: Fix RUNT MIB counter register offset calculation 96a2b04205155 net: systemport: Fix buffer overflow in bcm_sysport_get_stats() b11acfcb5925e Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister 71d660ec3c5d4 netfilter: ipset: do not update comments from kernel-side adds 44b6c6a3d10ac ipv6: fix prefix route expiry in modify_prefix_route() 0fc74e7d97d23 net/sched: cls_api: reclaim an empty proto on the error path 288ef37e0c463 net/mctp: publish the mctp_dev only after it is initialised 7df748aa9f9ec Bluetooth: btintel: validate DDC record lengths bb5d897e1c5e8 Bluetooth: hci_core: free the HCI ID if naming fails 0edda2d686666 ASoC: codecs: rt274: Fix format setting for 44100 rate d7b0b90517d23 ASoC: codecs: rt286: Revert delay value for jack setup 2fe08c8ff2684 wifi: mac80211: prevent AP VLAN tx from other interfaces 8c01127f8940e wifi: mac80211: Add 802.3 multicast encapsulation offload support 2d822b7b09828 wifi: mac80211: Add multicast to unicast support for 802.3 path 5617d53288390 wifi: cfg80211: preserve hidden-group beacon IE ownership ab741d1b714b4 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() a2215eb3cbbd3 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak 60142eb2afda3 wifi: ath11k: reset ar->num_stations on hardware start a7223b725905d ASoC: tegra: Fix ASRC Stream6 input threshold control 819d4c1323e2a wifi: wfx: validate MIB read length before copying to caller c881b1e4e9249 ASoC: wm8903: Move the DRC QR threshold to the register that holds it cd68146459b10 of/overlay: don't create "//" paths for fragments targeting the root 702b5db6e7b38 of/overlay: don't leak fragment references when changeset init fails 287a399310045 nvmet: preserve device path on allocation failure d94731cafa57e mtd: core: call _get_device() with the master MTD 714d8f0b1c616 iio: accel: kionix-kx022a: Fix array boundary check 84f8401d9bc5b mm/damon/core: don't skip damos_adjust_quota() while esz is not zero 4cea59e43e3cc perf/core: Fix WARN in perf_sigtrap() 51fba083e454f mm/secretmem: properly account locked pages 933d8ac23388e ALSA: line6: reject oversized playback packets df2787819bd13 ALSA: caiaq: unregister the input device when probe fails 2fc4e71aefab5 vt: skip screen update for DEC alignment test on backgroup consoles 786b74335c219 rds_tcp: close NULL deref window in rds_tcp_set_callbacks 1130350c8975a wifi: cfg80211: avoid double free if updating BSS fails c6d8cce685d60 scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info 8ec545537c110 scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr 7ceb6f7cb8f8f smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions 1bef1944ef15a sctp: check RCV_SHUTDOWN after the sendmsg connect wait aeda50d645bbb rtc: spear: initialize IRQ state before requesting alarm IRQ e77c5fc1f39fd rtc: ac100: Assign .num before accessing .hws ae169d318d5d2 net/packet: prevent TX_RING byte count overflow 1d27214fd9a4d netfilter: nft_flow_offload: drop flowtable reference on init error path ec96aa3ade2eb net: fix checksum offsets in skb_splice_from_iter() cc688475c56d3 of/overlay: only treat a positive changeset id as registered 936f1ffcb87a1 of/overlay: put property on deadprops only after changeset add succeeds b5f488c2a9ed3 of/irq: Fix remaining refcount leaks in of_irq_init() 3f968dcdf0188 kprobes: Skip disarmed probes when checking optkprobe overlap 9aee3caeff4dd audit: fix exe mark UAF in kill_rules() 8b417c887ac82 ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices 7ed1062d154ec mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() 47a948ba653a4 xfs: fix cursor and pointer handling when recovering iunlink buckets 8afc80156b1d9 smb: client: close completed creates on compound wait errors eaa97a196a107 smb: client: close handle after create-context parsing failure 2f8118f4c4313 smb/client: pass cifs_open_info_data to SMB2_open() b63f09fdcb523 smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() bd9571812d022 HID: alps: unregister DualPoint Stick input device on remove 37dc19c454191 HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM 74cbf0acf9de5 HID: core: remove #ifdef CONFIG_PM from hid_driver a35160b2c75bf Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table bd06033625ec2 bpf, xdp: move offload check into dev_xdp_install() 43d61b442a0a1 RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr() d8ec34618e710 drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op 045532f920d86 smb: client: use finish_no_open() for non-regular inodes fbe8c7c940a7c perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification 2e4c5400f489e perf/x86/intel: Update event constraints and cache_extra_regsfor ADL 5e20b39aa7844 netfilter: nf_tables: skip expired catchall elements on insert and delete ab8dfb330c907 netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST a0f5fd7a285f4 net: ena: fix MMIO read buffer leak on probe failure 33b32efafb729 net: ena: Remove autopolling mode d4bd24339b505 perf/core: Run sched_task() for PMUs with only CPU-wide events fa360a018369f perf/core: Allow list_del during perf_event_overflow() 98181f9721f75 perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() 403d8e4d52f5f perf: Supply task information to sched_task() 38a6a118260eb net: ipconfig: bound DHCP option construction f770bd77c6e15 net: ipconfig: Remove outdated comment and indent code block a9d9819a7d239 PCI: Fix BAR resize for devices on a root bus bf58ea4958118 PCI: Fix Resizable BAR restore order 4ab3655384e1d super: make iterate_supers_type() deletion-safe 6c2bcf6b173d4 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration 3486ce08c383e RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr() 18866dc1f525f net: openvswitch: conntrack: fix helper UAF due to extensions realloc 7ecaa9628b05a net: openvswitch: conntrack: remove 'add_helper' dead code 7ce66bca55e37 openvswitch: prepare for stolen verdict coming from conntrack and nat engine c812bb4aea13d net/sched: act_ct: avoid modifying shared unconfirmed ct entry 31f5fe29a5720 net/sched: act_ct: fix helper UAF due to extensions realloc cf73ef2a761df mm/hugetlb: preserve mremap address delta when skipping page tables 465e222815c88 mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish 34d9dffaf0ff4 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM 8a8d16d19207d drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc() 070a004d9d752 perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities 9e2a2f98e8c01 tcp: prevent collapsing skbs across boundary in rtx queue f04cbdfac9b82 bna: prevent IOC timer rearm during teardown aa00eead258e4 smb: client: fix reparse buffer bounds in cifs_query_reparse_point() ffc88169f4fac smb/client: send lease break ACKs thru correct session for multiuser mounts 15e59e377facc wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown d073d306e587c hwmon: (pwm-fan) Stop RPM timer before freeing tach data 93a025166495c btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() 525c225e23d61 smb: client: fix cifsFileInfo reference leak in deferred close 11cff5518f798 mptcp: do not reschedule the RTX timer for fallback sockets 3fe0b4b1aed10 mptcp: pm: reset retrans_time when ADD_ADDR entry is reused 518fb6a834258 mptcp: pm: userspace: fix address ID overflow c003c9ab21406 mptcp: use sock_kmemdup for address entry f116f8462c8c2 sock: add sock_kmemdup helper 48bf542f03cf0 mptcp: pm: drop match in userspace_pm_append_new_local_addr a92e0910f5fb8 erofs: add sysfs feature entry for xattr prefixes db0c3465b54a1 erofs: preserve LZMA decoders on resize failure 1b5730a1c7def net/sched: act_api: release all action references on NEWACTION failure b2eb38377671a virtio_mmio: disable IRQ wake before free_irq cbfd5d11311bb virtio-mmio: Remove virtqueue list from mmio device 21e0749e8ef27 ipmr: account multicast table and route memory 8ca55a476af2d drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug 0cec951667a62 drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation 110dd054fd4af drm/sysfb: simpledrm: Improve stride validation 52f36434159e4 drm/sysfb: simpledrm: Improve panel-size validation b6c0e77d950bf f2fs: fix dentry folio leak in find_in_level e754120f8ede5 f2fs: limit recovery filename logging to stored length 428e244dd4066 scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature 2df8c86309047 scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot 8b6565f19423a scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs 9d69eed95b841 scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate 5e0d6ffabbbd8 scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path bbe692466399a media: rkvdec: Propagate platform_get_irq() errors 7cdb1e2d3b0e5 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup d20ef2b13a2e0 mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP 461dbac2056bb clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs 3ce0e9b43f355 nvme-fabrics: fix DHCHAP secret leak on parse failure 68cb1f5d4aa50 rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm 16dbe1300ebad ftrace: Synchronize the initialization of ftrace_ops abdc98e67d7db tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member aa4e177ae7108 staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() f4f0fe3ab47ed usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() 4892be1ef0bbe wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy 027679d613ea7 i3c: master: Fix use-after-free of master->this 7b25b755d5907 i3c: master: Do not treat master device as a duplicate target 73f3697a7b1c1 hwrng: stm32 - Fix runtime PM cleanup on registration failure 35964ed01e10b power: supply: qcom_battmgr: fix use-after-free 98d0b8a1bfd9a platform/x86: ISST: Validate max level for set feature 8bae4ab7a4c84 platform/x86: ISST: Validate parameter for core power state 55d71c70f11d9 mmc: via-sdmmc: cancel card-detect work on remove 4fe2db296c9cd lockd: fix swapped arguments in nlmsvc_match_ip() 730bb75ed5f66 i2c: mxs: fix DMA channel leak on probe error 6c6ec0f6be517 dmaengine: Add devm_dma_request_chan() 2064fdbec82ec ASoC: codecs: aw88261: only check PLL and clock state at power-up c45851fc674be ASoC: codecs: aw88261: reduce log spam 31b41ea8383d5 params: fix charp corruption on allocation failure 29144aa486899 params: Fix multi-line comment style 75f9f1e0b4082 params: Sort headers 641d864ba4d0d params: Use size_add() for kmalloc() 710c30766efd8 params: Do not go over the limit when getting the string length 88b11059bb23f ACPI: TAD: Add locking around AML evaluations d4a76ed0d9b4c ACPI: TAD: Split three functions to untangle runtime PM handling 156fbd020ae36 ACPI: TAD: Rearrange RT data validation checking 12b54e5aab7c0 cpufreq: apple-soc: Fix OPP table cleanup 6b1c1130fcbfa coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior 04c3e4456fe76 nfsd: fix clock domain mismatch in clients_still_reclaiming() 2d8a8ed4f9d86 nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() 1c6a4d6c20fd4 nfsd: size fh_verify server sockaddr slot by xpt_locallen f5e9f3a75efc7 zram: fix out-of-bounds access in read_block_state() a5dda540c113c zram: fixup read_block_state() 81dfc6c665547 KEYS: trusted: Fix TPM teardown ordering 7e6ff8c58985f ethtool: fail closed if we can't get max channel used in indirection tables 0e58d7070eef1 media: av7110: fix a spectre vulnerability 705a8b8cc5a44 kvm: s390: Reject memory region operations for ucontrol VMs d233c8da8b70f drm/i915/hdcp: Add encoder check in hdcp2_get_capability df17aa6038f96 drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability 017bea876eca3 pinctrl: sunxi: keep a shadow copy of the data register output latches 3d531429524df vlan: require the MAC header to be present in __vlan_insert_inner_tag() 61812323c037a smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() ee0d8f83d68f6 smb: client: fix use-after-free of iface in cifs_try_adding_channels() d8bc505cabfba smb: mark the new channel addition log as informational log with cifs_info f448b267968d0 wifi: libipw: reject TKIP frames without a full MIC 8b637ab10e40e ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity 72399eb8bfaa2 ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling 48fc1c74052c9 landlock: Fix use-after-free of the source's parent directory 4a1ba62a486a4 ieee802154: cc2520: fix FIFOP work use-after-free 260f99b355a44 net: bridge: use option bits for CFM/MRP frame handlers ed1cead97afb9 io_uring/rw: end write accounting from ->ki_complete 1a345d95e59a9 genetlink: pin family module during policy dump aaa7f676418e1 Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev b88e69064588e Bluetooth: btqcomsmd: Convert to platform remove callback returning void c94985e4fd77e tracing: Fix memory corruption from a "STACKTRACE" histogram key cc004a1107e2c f2fs: embed f2fs_gc_kthread in f2fs_sb_info 54c587f3f95ce f2fs: validate MOVE_RANGE destination size 5f33efe046589 scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] 9bd063c082ef0 scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown 2e6f60adf609c scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking 2ecc30066c228 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak ab1a8a3c99712 KVM: s390: Zero initialize data structures for inject_pfault_token 3868476cd3916 nvme: add missing SRCU grace period in error path 29266da8ee1d9 ftrace: Take trace_array reference before accessing its ftrace_ops 716850842d2f1 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() 5a55352d30ad3 staging: rtl8723bs: fix spacing around operators c1e7e35100eff usb: storage: realtek_cr: fix use-after-free on disconnect 5aade99d72ede udf: Fix data loss when converting inline inodes to out of line 17d5ae5897312 wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop aad3129b8e915 ocfs2: validate directory-index entry counts when reading metadata 1ecc0a9f100a7 ocfs2: validate dx_root extent list fields during block read 66358f5789c9a HID: universal-pidff: stop the device when force-feedback init fails 56ef23198bdd5 HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind 6eb70b78e48b0 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() 23c5cc9652c6e ceph: properly decrypt filenames in vmalloc() buffers ab949252fdf10 nfsd: fix nfsd_file leak on inter-server COPY setup failure b9f5bde07c0f9 x86/xen: fix init of balloon stats again 4a138cd221545 xen/balloon: improve accuracy of initial balloon target for dom0 b17c8f5dcb36a apparmor: fix out-of-bounds write when null terminating a label vec cf79df1770660 x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client edb9a302cc938 net: ena: Add validation for completion descriptors consistency 70eca80d98a44 net/mlx5e: Fix netif state handling 1743d5a678048 ocfs2: Avoid touching renamed directory if parent does not change 08f3e29665c31 xfrm: prevent policy_hthresh.work from racing with netns teardown 7801e616fbe36 dma-direct: return struct page from dma_direct_alloc_from_pool() 9f1262802008b dma-direct: simplify the use atomic pool logic in dma_direct_alloc Signed-off-by: Bruce Ashfield --- .../recipes-kernel/linux/linux-yocto_6.6.bbappend | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.6.bbappend b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.6.bbappend index 7196df5efc..dc079a8cd8 100644 --- a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.6.bbappend +++ b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.6.bbappend @@ -12,10 +12,10 @@ KMACHINE:genericx86 ?= "common-pc" KMACHINE:genericx86-64 ?= "common-pc-64" KMACHINE:beaglebone-yocto ?= "beaglebone" -SRCREV_machine:genericx86 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:genericx86-64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:beaglebone-yocto ?= "297689603c5961261abe13480351a125365ab025" +SRCREV_machine:genericx86 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:genericx86-64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:beaglebone-yocto ?= "0f0eb060f0536344a77c54833ee722a91cce1193" -LINUX_VERSION:genericx86 = "6.6.159" -LINUX_VERSION:genericx86-64 = "6.6.159" -LINUX_VERSION:beaglebone-yocto = "6.6.159" +LINUX_VERSION:genericx86 = "6.6.160" +LINUX_VERSION:genericx86-64 = "6.6.160" +LINUX_VERSION:beaglebone-yocto = "6.6.160"