Changelog in Linux kernel 6.12.111

 
9p: invalidate readdir buffer on seek
9p: use kvzalloc for readdir buffer
 
accel/ivpu: Limit firmware log name prints to field size
accel/ivpu: Validate firmware log buffer metadata
accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr
 
accel/qaic: Address potential out-of-bounds read in resp_worker()
 
acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
 
ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach
ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge
ACPI: TAD: Add locking around AML evaluations
ACPI: TAD: Rearrange RT data validation checking
ACPI: TAD: Split three functions to untangle runtime PM handling
 
ACPICA: add boundary checks in acpi_ps_get_next_field()
ACPICA: add boundary checks in two places
ACPICA: Add package limit checks in parser functions
ACPICA: Add validation for node in acpi_ns_build_normalized_path()
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()
ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()
ACPICA: Fix condition check in acpi_ps_parse_loop()
ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()
ACPICA: Prevent adding invalid references
ACPICA: validate byte_count in acpi_ps_get_next_package_length()
ACPICA: validate handler object type in two places
 
af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
 
af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.
af_unix: Unlink scc_entry in unix_del_edge().
af_unix: Update last skb marker in manage_oob().
 
affs: handle set_blocksize failures
 
afs: Clear stale peer app data after address list changes
afs: Fix incorrect free in candidate cleanup in afs_lookup_server()
 
ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
ALSA: caiaq: Fix potential double-free at error path
ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough
ALSA: es18xx: check control allocation before private data setup
ALSA: hda/common: Use cleanup macros for PM controls
ALSA: hda/common: Use guard() for mutex locks
ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10
ALSA: hda/core: Use guard() for mutex locks
ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50)
ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE
ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx
ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED)
ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP
ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC
ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs
ALSA: hda/realtek: Add quirk for HP Pavilion x360
ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED
ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT
ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8
ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series
ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk
ALSA: hda: cs35l56: Fail if wmfw file is missing
ALSA: hda: Introduce auto cleanup macros for PM
ALSA: hda: Report a change when only the channel status bytes move
ALSA: hda: restore MFG widget enumeration after core split
ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
ALSA: rawmidi: Expose the tied device number in info ioctl
ALSA: rawmidi: Show substream activity in info ioctl
ALSA: seq: oss: Reject reads that cannot fit the next event
ALSA: seq: Remove arbitrary prioq insertion limit
ALSA: ump: Copy FB name string more safely
ALSA: ump: Copy safe string name to rawmidi
ALSA: ump: do not touch legacy_rmidi before it exists
ALSA: ump: Update rawmidi name per EP name update
ALSA: us122l: Prevent write upgrades for read mappings
ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4
ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless
ALSA: usb-audio: Add quirk flags for SC13A
ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
ALSA: usb-audio: Add quirk for Novation Mininova
ALSA: usb-audio: Add quirk for YAMAHA CDS3000
ALSA: usb-audio: caiaq: validate EP1 reply lengths
ALSA: usb-audio: Propagate write errors in generic mixer put callbacks
ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf
ALSA: usbusx2y: validate URB actual_length in interrupt callback
ALSA: usx2y: Drain pending US-428 pipe-4 output commands
 
apparmor: propagate -ENOMEM correctly in unpack_table
 
arm64/daifflags: Make local_daif_*() helpers __always_inline
 
arm64: fixmap: Allow 256K early_ioremap() at any offset
arm64: kprobes: Allow reentering kprobes while single-stepping
arm64: trans_pgd: clone only the linear map that exists at runtime
 
ARM: 9484/1: enable interrupts when unhandled user faults are triggered
ARM: ensure interrupts are enabled in __do_user_fault()
 
arm: Handle KCOV __init vs inline mismatches
 
ARM: tegra: p880: Lower CPU thermal limit
 
ASoC: ab8500: Correct digital interface format setup
ASoC: ab8500: Repair the DAPM capture graph
ASoC: ab8500: Reset the audio block before configuring it
ASoC: ab8500: Validate and program TDM slots correctly
ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits
ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx
ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx
ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()
ASoC: bcm: bcm63xx: Publish the OF module aliases
ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
ASoC: codecs: rk3328: Use managed GPIO and clock helpers
ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit
ASoC: Intel: avs: Clean up the bus when fetching ML caps fails
ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology
ASoC: Intel: avs: Fix unbalanced module reference count
ASoC: Intel: catpt: Complete coredump handling
ASoC: Intel: sof_sdw: Add quirks for new Dell laptops
ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally
ASoC: Intel: SST: Publish the PCI module aliases
ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend()
ASoC: meson: aiu: Validate written enum values
ASoC: mt6351: Publish the OF module alias
ASoC: qcom: q6apm: return error code to consumers on failures
ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt
ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence
ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure
ASoC: rt5645: Perform the initial jack detect at probe
ASoC: rt712-sdca: reset codec at io_init to fix silent headphone
ASoC: sprd: validate compress buffer sizes against fixed allocations
ASoC: sti: initialize IRQ lock before requesting IRQ
ASoC: tas2781: Update default register address to TAS2563
ASoC: ti: omap3pandora: update board check to use DT compatible
ASoC: topology: Check PCM and DAI name strings before use
ASoC: ux500: Allow repeated MSP prepare calls
ASoC: ux500: Correct MSP frame and bit clock setup
ASoC: ux500: Deassert the MSP reset during probe
ASoC: ux500: Fix MSP stream lifecycle handling
ASoC: ux500: Program the MSP FIFO watermarks
ASoC: ux500: Propagate MSP setup errors
ASoC: ux500: Remove obsolete PRCMU QoS calls
ASoC: ux500: Request the MSP MMIO resource
ASoC: ux500: Validate MSP DAI configuration
 
ata: ahci: fail probe if BAR too small for claimed ports
ata: libata-core: Disable LPM on some WD drives
ata: libata-core: Disable LPM on WD Green 2.5 480GB
ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0
ata: libata-pmp: add JMicron JMS562 quirk
 
befs: handle set_blocksize failures
 
bfs: handle set_blocksize failures
 
bitfield: wire __bf_shf to __builtin_ctzll
 
blk-cgroup: fix leaks and online flag on radix_tree_insert failure
blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat()
 
Bluetooth: btintel: bound firmware ID by TLV length
Bluetooth: btintel: validate version TLV value lengths
Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW
Bluetooth: btintel_pcie: Clear automask on spurious interrupts
Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one
Bluetooth: btintel_pcie: validate packet_len before skb_put_data
Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware
Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925
Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
Bluetooth: btrtl: Add the support for RTL8761CUV
Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV
Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922
Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923
Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040)
Bluetooth: btusb: Add support for TP-Link TL-UB250
Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset
Bluetooth: btusb: Fix UAF of btusb_data by rx_work
Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset
Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c
Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38
Bluetooth: hci_core: Fix race condition during device registration
Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
Bluetooth: ISO: fix malformed ISO_END/CONT handling
Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect
Bluetooth: L2CAP: validate connectionless PSM length
Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame
 
bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
bnxt_en: Only restore LRO if the device supports TPA
bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
 
bonding: alb: fix uninitialized transport header access in alb_determine_nd()
bonding: do not clear curr_active_slave prematurely when releasing all slaves
bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
 
bpf: Disable preemption in bpf_get_stackid
bpf: Don't predict JMP32 pointer vs zero comparisons
bpf: Factor stackid_fastpath function from __bpf_get_stackid
bpf: Factor stackid_init function from __bpf_get_stackid
bpf: Factor stackid_new_bucket from __bpf_get_stackid
bpf: Fix NULL-ptr-deref in btf_var_show()
bpf: Fix NULL-ptr-deref when showing a void BTF type
bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
bpf: fix the return value of push_stack
bpf: Guard __get_user acesss with access_ok for uprobe_multi data
bpf: Mark bpf_btf_find_by_name_kind() as sleepable
bpf: Mark faultable stack helpers as sleepable
bpf: Mark sched_process_wait argument as nullable
bpf: Mask pseudo pointer values in verifier logs
bpf: NUL-terminate replaced sysctl value
bpf: reject BPF_PSEUDO_FUNC reference to the main program
bpf: Reject non-scalar bpf_loop iteration counts
bpf: Reject redirect helpers without a bpf_net_context
bpf: Reject untrusted allocated-object pointers
bpf: Require MEM_PERCPU for percpu kptr stores
bpf: Use stack id functions instead of __bpf_get_stackid
 
bpftool: Pass host flags to bootstrap libbpf
bpftool: Strip all -Wformat* flags from bootstrap libbpf build
 
bridge: Add missing READ_ONCE() annotations around FDB destination port
bridge: Do not suppress ARP probes and DAD NS unconditionally
 
btrfs: add btrfs prefix to main lock, try lock and unlock extent functions
btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
btrfs: detach failed sprout device from transaction update list
btrfs: do not force reloc root creation during qgroup_account_snapshot()
btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag
btrfs: expose per-inode stable writes flag
btrfs: fix extent map leak in NOCOW direct I/O write
btrfs: fix reloc root cleanup in merge_reloc_roots()
btrfs: fix the possible bioc_list memory leak during error
btrfs: fix transaction use-after-free in raid stripe insertion
btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()
btrfs: move btrfs_alloc_write_mask() into fs.h
btrfs: move BTRFS_BYTES_TO_BLKS() into fs.h
btrfs: move btrfs_is_empty_uuid() from ioctl.c into fs.c
btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr()
btrfs: parameter constification in ioctl.c
btrfs: pass struct btrfs_inode to btrfs_sync_inode_flags_to_i_flags()
btrfs: prepare btrfs_punch_hole_lock_range() for large data folios
btrfs: protect sb_write_pointer() with invalidate lock
btrfs: rename extent map functions to get block start, end and check if in tree
btrfs: restore active device pointers after failed sprout
btrfs: return proper negative error code for update_raid_extent_item()
btrfs: send: fix lost error return value in will_overwrite_ref()
btrfs: tree-checker: validate INODE_REF's namelen
btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF
btrfs: update include and forward declarations in headers
btrfs: use BTRFS_PATH_AUTO_FREE in can_nocow_extent()
btrfs: use lockless read in nr_cached_objects shrinker callback
btrfs: use on-disk uuid for s_uuid in temp_fsid mounts
btrfs: zoned: finish active block group cleanup if call_zone_finish() fails
 
bus: fsl-mc: wait for the MC firmware to complete its boot
 
cachefiles: Fix double fput
 
ceph: force a cap message when a deferred revoke can't be acked immediately
ceph: harden send_mds_reconnect and handle active-MDS peer reset
ceph: properly decrypt filenames in vmalloc() buffers
ceph: Remove fs/ceph deadcode
 
char/nvram: Remove redundant nvram_mutex
 
cifs: Fix support for creating SFU fifo
cifs: Fix support for creating SFU socket
cifs: validate idmap key payload length
 
clk: keystone: don't cache clock rate
clk: renesas: cpg-mssr: Add number of clock cells check
clk: samsung: exynos850: mark APM I3C clocks as critical
clk: socfpga: agilex: implement l3_main_free_clk
 
configfs_depend_prep(): pass configfs_dirent instead of dentry
 
coresight: platform: defer connection counter increment until alloc succeeds
 
cpufreq: apple-soc: Fix OPP table cleanup
cpufreq: initialize policy rwsem before sysfs publication
cpufreq: zero-initialize policy cpumask before sysfs publication
 
crypto: atmel-ecc - add support for atecc608b
crypto: atmel-ecc - avoid stale fallback key after set_secret failure
crypto: atmel-sha204a - remove sysfs group before hwrng
crypto: ccp - Fix possible deadlock in SEV init failure path
crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y
crypto: iaa - unmap dst before software fallback on decompress
crypto: ixp4xx - fix buffer chain unwind on allocation failure
crypto: omap - add omap_des_unregister_algs helper
crypto: virtio - bound the akcipher result length
crypto: virtio - Drop sign/verify operations
crypto: virtio - Drop superfluous [as]kcipher_ctx pointer
crypto: virtio - Drop superfluous [as]kcipher_req pointer
crypto: x86/aria - add missing vzeroupper in AVX-512 code
crypto: x86/aria - add missing vzeroupper in AVX2 code
 
cxgb4: clip_tbl: Fix spelling mistake "wont" -> "won't"
 
cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c
cxl/pci: Remove unnecessary CXL Endpoint handling helper functions
cxl/pci: Remove unnecessary CXL RCH handling helper functions
 
cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
 
dlm: add usercopy whitelist to dlm_cb cache
 
dm/amdgpu: fix malformed link_settings debugfs output
 
dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes
dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc
 
dpaa2-switch: fix handling of NAPI on the remove path
dpaa2-switch: fix the error path in dpaa2_switch_rx()
dpaa2-switch: rework FDB management on the bridge leave path
 
driver core: Export get_dev_from_fwnode()
 
drivers/of: validate status properties in reconfig state changes
 
Drivers: hv: vmbus: add VTL2 redirect connection ID
 
drm/amd/display: Check for sharpening case when calculating max vtaps for scaler
drm/amd/display: clean-up dead code in dml2_mall_phantom
drm/amd/display: Find link encoder for flexible DIG mapping cases
drm/amd/display: Fix CRC open failure during active rendering
drm/amd/display: Fix DPMS using partially updated pipe context
drm/amd/display: Initialize dsc_caps to 0
 
drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
drm/amd/pm/si: Fix updating clock limits from power states
 
drm/amd/pm: bound pp_dpm_set_pp_table() memcpy
drm/amd/pm: Check SMUv13.0.6/12 metrics integrity
 
drm/amdgpu: fix buffer overflow during vBIOS update
drm/amdgpu: flush pending RCU callbacks on module unload
drm/amdgpu: harden FRU PIA parsing with bounded helpers
drm/amdgpu: Prefer ROM BAR for default VGA device
drm/amdgpu: Use system unbound workqueue for soft IH ring
drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw
 
drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
drm/amdkfd: Check bounds on allocate_doorbell
drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap
drm/amdkfd: Fix OOB memory exposure in get_wave_state()
drm/amdkfd: fix UAF race in destroy_queue_cpsch
drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl
drm/amdkfd: Properly acquire queue buffers in CRIU restore
drm/amdkfd: Unwind debug trap enable on copy_to_user failure
 
drm/arm/komeda: fix error handling for clk_prepare_enable() and callers
 
drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend
 
drm/bridge: tc358768: Set pre_enable_prev_first for reverse order
 
drm/cirrus-qemu: Validate BAR0 size during probe
 
drm/cirrus: Use video aperture helpers
 
drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device
 
drm/drm_exec: fix up contended obj when num_objects is 0
 
drm/gem: Consider GEM object reclaimable if shrinking fails
 
drm/gma500: return errors from Oaktrail HDMI I2C reads
 
drm/gud: Add RCade Display Adapter VID/PID pair
 
drm/i915: Fix memory leak in query_perf_config_list()
 
drm/imagination: Populate FW common context ID before passing to the FW
 
drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
 
drm/mediatek: dsi: Add compatible for mt8167-dsi
 
drm/nouveau/bios: skip the IFR header if present
 
drm/panel: Enable GPIOLIB for panels which uses functions from it
drm/panel: jadard-jd9365da-h3: set prepare_prev_first
drm/panel: simple: Add AM-1280800W8TZQW-T00H
 
drm/vc4: hvs/v3d: Fix null dereference in unbind
 
drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
 
drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl()
 
drm: rz-du: Ensure correct suspend/resume ordering with VSP
 
drop_monitor: fix size calculations for 64-bit attributes
drop_monitor: perform u64_stats updates under IRQ-disabled section
 
e1000e: limit endianness conversion to boundary words
 
EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
 
EDAC/igen6: Fix channel address decode for non-hash mode
EDAC/igen6: Fix channel selection hash
EDAC/igen6: Fix interleave boundary condition
 
efi/cper, cxl: Make definitions and structures global
efi/cper, cxl: Prefix protocol error struct and function names with cxl_
 
erofs: preserve LZMA decoders on resize failure
erofs: skip sufficiently large global buffers when resizing
 
eth: ice: don't dereference pointers from TP_printk()
eth: mlx5: fix macsec dependency
eth: nfp: bound the ntuple rule dump by the caller's buffer size
eth: nfp: drop the replaced rule from the list when reprogramming fails
eth: nfp: migrate to new RXFH callbacks
 
ethtool: Block setting of symmetric RSS when non-symmetric rx-flow-hash is requested
ethtool: Symmetric OR-XOR RSS hash
 
exec: do_close_on_exec() before taking exec_update_lock
 
exfat: fix handling of damaged volume in exfat_create_upcase_table()
 
f2fs: validate inline dentry name lengths before conversion
 
fbcon: don't suspend/resume when vc is graphics mode
 
fbdev: pm2fb: unwind WC setup on probe failure
fbdev: vfb: defer cleanup until the last reference
 
firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
firmware: arm_scmi: Validate SENSOR_UPDATE payload size
firmware: stratix10-svc: change get provision data to async SMC call
firmware: stratix10-svc: fix FCS SMC call kernel-doc
 
fou: Fix use-after-free in fou_create()
 
freevxfs: don't BUG() on unknown typed-extent type
 
fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib
fs/ntfs3: validate index entry key bounds
 
fs: autofs: fix memory leak in autofs_fill_super()
fs: don't return -EINVAL for successful nested thaw
 
fuse: fix race between interrupt and resend
fuse: set ff->flock only on success
 
gfs2: fix quota init duplicate scan
gfs2: move quota_init qc iterator increment
gfs2: page poisoning fix
 
gpio: dwapb: Mask interrupts at hardware initialization
gpio: pisosr: Read "ngpios" as u32
 
hfs: rework hfsplus_readdir() logic
 
hfsplus: fix issue of direct writes beyond end-of-file
hfsplus: rework hfsplus_readdir() logic
 
HID: apple: preserve keyboard backlight across T2 resume
HID: bpf: Add Huion Inspiroy Frego M button quirk
HID: hidpp: fix potential UAF in hidpp_connect_event()
HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
HID: mcp2221: fix OOB write in mcp2221_raw_event()
HID: multitouch: Fix Yoga Book 9 14IAH10 touchscreen misclassification
HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts
HID: sony: clean up device list on probe failure
HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
HID: sony: use guard() and scoped_guard()
HID: universal-pidff: stop the device when force-feedback init fails
 
host1x: bus: Fix missing ops null check in error teardown
 
hpfs: handle set_blocksize failures
 
hsr: broadcast netlink notifications in the device's net namespace
 
hwmon: (adt7462) Add of_match_table to support devicetree
hwmon: (applesmc) fix key backlight workqueue leak on register failure
hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
hwmon: (chipcap2) fix channels in humidity alarm notifications
hwmon: (corsair-cpro) Create debugfs entries after hwmon registration
hwmon: (corsair-cpro) Remove debugfs entries when probe fails
hwmon: (corsair-psu) Fix linear11 calculation
hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist
hwmon: (gpio-fan) Fix use-after-free in alarm work
hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read()
hwmon: (ltc4282) Make sure clk_init_data is fully initialized
hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
hwmon: (raspberrypi) Fix delayed-work teardown race
hwmon: Introduce 64-bit energy attribute support
 
i2c: smbus: reject oversized block transfers in the common path
 
i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA
 
ice: add missing xa_destroy for sched_node_ids
ice: pass the return value of skb_checksum_help()
 
idpf: account for VLAN header when parsing RSC packet header
 
ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
ieee802154: cc2520: fix FIFOP work use-after-free
ieee802154: hwsim: serialize pib updates to fix double-free
 
igmp: convert struct ip_sf_list to RCU
 
iio: accel: mma8452: switch to non-devm request_threaded_irq()
iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
iio: adc: rtq6056: add i2c_device_id support
iio: light: stk3310: Deal with the ps interrupt issue in PM
 
ima: return error early if file xattr cannot be changed
 
inet: add dst4_mtu() and dst6_mtu() helpers
inet: frags: invalidate queues before flushing them
 
integrity: Check for NULL returned by asymmetric_key_public_key
 
io_uring/net: let io_recv_buf_select return the length of the buffer region
 
iomap: don't make REQ_POLLED imply REQ_NOWAIT
 
iommu/rockchip: disable fetch dte time limit
 
iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
 
iommu: arm-smmu-qcom: Ensure smmu is powered up in set_ttbr0_cfg
 
ionic: use netif_txq_maybe_stop() in ionic_tx()
 
ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
 
ip: orphan prefetched skbs before multicast forwarding
 
ipmi: si: Use platform_get_irq_optional() to retrieve interrupt
 
ipv4: fib: bound automatic table ID allocation
ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
ipv4: use dst4_mtu() instead of dst_mtu()
 
ipv6: add some unlikely()/likely() clauses in ip6_output.c
ipv6: addrconf: fix temp address generation after prefix deprecation
ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers
ipv6: annotate data-races around devconf->rpl_seg_enabled
ipv6: fix fib6 walker UAF on seq stop
ipv6: ip6_mc_input() and ip6_mr_input() cleanups
ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
ipv6: pass proto by value to ipv6_push_nfrag_opts() and ipv6_push_frag_opts()
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
ipv6: sr: restore network header before routing and forwarding
ipv6: use dst6_mtu() instead of dst_mtu()
ipv6: use READ_ONCE() for bindv6only default in inet6_create()
 
ipvs: fix reversed sequence option serialization
ipvs: reject invalid states in connection template sync records
 
irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
 
isofs: handle set_blocksize failures
 
jfs: handle set_blocksize failures
 
kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access()
 
KEYS: trusted: Fix TPM teardown ordering
 
ksmbd: align SMB2 oplock break ack handling
ksmbd: apply create security descriptor first
ksmbd: break RH leases before delete-on-close
ksmbd: deny renaming directory with open children
ksmbd: find bound sessions during reauthentication
ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
ksmbd: fix lease break and ack state handling
ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
ksmbd: fix use-after-free in oplock break notification
ksmbd: mark invalid session responses as signed
ksmbd: preserve VFS inherited POSIX ACL mask
ksmbd: prevent out-of-bounds reads in share config responses
ksmbd: propagate DACL parsing errors
ksmbd: rate limit unmapped SID errors
ksmbd: remove stale channels from all sessions on teardown
ksmbd: start file id allocation at 1
ksmbd: treat read-control opens as stat opens only for leases
ksmbd: treat unnamed DATA stream as base file
ksmbd: use connection ClientGUID for lease lookup
ksmbd: use memcmp() to compare ClientGUIDs
ksmbd: validate SID namespace before mapping IDs
ksmbd: validate SMB2 lease create contexts
 
KVM: PPC: Book3S HV: Set irqfd->producer only on success
KVM: SEV: Add an anonymous "psc" struct to track current PSC metadata
KVM: SEV: Disable SEV-SNP support on initialization failure
KVM: SEV: Make it more obvious when KVM is writing back the current PSC index
KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
KVM: SVM: Invalidate "next" SNP VMSA GPA even on failure
KVM: SVM: Mark VMCB dirty before processing incoming snp_vmsa_gpa
KVM: SVM: Move SEV-ES VMSA allocation to a dedicated sev_vcpu_create() helper
KVM: SVM: Use guard(mutex) to simplify SNP vCPU state updates
 
l2tp: fix tunnel and session refcount leak on seq_file release
 
leds: pca9532: Don't stop blinking for non-zero brightness
leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE
leds: uleds: Return -EFAULT on copy_to_user() failure
 
libbpf: Add __NR_bpf definition for LoongArch
libbpf: Also reset {insn,data}_cur on realloc failure
 
libnvdimm: Replace namespace_match() with device_find_child_by_name()
 
Linux: Linux 6.12.111
 
locking/lockdep: Invalidate stale class_cache entries for zapped classes
 
mac802154: fix use-after-free of sdata via queued RX frames
 
mailbox: imx: Add a channel shutdown field
mailbox: imx: use devm_of_platform_populate()
mailbox: imx: Use devm_pm_runtime_enable()
mailbox: Make mbox_send_message() return error code when tx fails
 
md/raid10: fix writes_pending and barrier reference leaks on discard failures
 
md/raid5: account discard IO
md/raid5: let stripe batch bm_seq comparison wrap-safe
 
media: as102: do not rely on id table address comparison
media: chips-media: wave5: Add range checks for dec_output_info
media: chips-media: wave5: Fix Reports from Kernel Lock Validator
media: dm1105: fix missing error check for dma_alloc_coherent
media: em28xx-video: fix missing res_free() on init_usb_xfer failure
media: hevc: add bounded tile-count helpers
media: imon: Add iMON VFD HID OEM v1.2 key mappings
media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
media: qcom: camss: avoid format string warning
media: rc: mceusb: Add support for 04eb:e033
media: v4l2-ctrls: validate AV1 tile counts
media: v4l2-ctrls: validate HEVC tile counts
media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
media: video-i2c: use vb2_video_unregister_device on driver removal
 
mfd: db8500-prcmu: Fold dbx500 header into db8500
mfd: db8500-prcmu: Remove needless return in three void APIs
mfd: rsmu: Add 8a34002 support
mfd: tps65219: Make poweroff handler conditional on system-power-controller
 
minix: handle set_blocksize failures
 
mips: cps: Assemble jr.hb with an R2 ISA level
 
mm, hugetlb: increment the number of pages to be reset on HVO
 
mm, swap: ratelimit bad swap entry reports
 
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
 
mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()
 
mm/migrate_device: clear stale mapping after freeing swapcache
 
mm/slab: move and refactor __kmem_cache_alias()
 
mm/slub: fix missing debugfs entries for caches created before sysfs init
 
mm: fix possible NULL pointer dereference in __swap_duplicate
mm: move _pincount in folio to page[2] on 32bit
mm: move hugetlb specific things in folio to page[3]
 
mmc: core: Add validation for host-provided max_segs
mmc: davinci: avoid NULL deref of host->data in IRQ handler
mmc: davinci: fix mmc_add_host order in probe
mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC
mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC
 
mptcp: avoid unneeded actions on subflow reset
mptcp: close race between scheduler and state change
mptcp: fix bad accounting in __mptcp_subflow_push_pending()
mptcp: options: handle MPC data + csum reqd + no csum
mptcp: remove unneeded READ_ONCE() annotation
mptcp: subflow: no need to copy thmac during ulp_clone
mptcp: syncookies: remember the request backup flag
 
net/micrel: Fix typos in micrel driver code comments
 
net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition
net/mlx5: E-Switch, prevent mc_list repopulation during vport disable
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
net/mlx5: HWS, Handle destroying table that has a miss table
 
net/mlx5e: Fix ETS zero BW reporting when one TC holds 100%
net/mlx5e: Fix setting RS FEC after remapping
net/mlx5e: Fix use-after-free race in sample_restore_put()
net/mlx5e: Verify unique vhca_id count instead of range
 
net/packet: defer vmalloc TX_RING free until skbs finish
 
net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
net/rds: acquire the fastpath locks in rds_conn_shutdown()
net/rds: clear cp_flags bits individually in rds_conn_path_reset()
net/rds: don't let rds_conn_shutdown() consume a concurrent drop
net/rds: Don't sleep inside rds_ib_conn_path_shutdown
net/rds: fix tcp stream corruption with large pages
net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
net/rds: use clear_bit_unlock() in release_refill()
net/rds: use wq_has_sleeper() in release_in_xmit()
 
net/sched: act_api: budget all shared attributes in notify skbs
net/sched: act_api: fix skb sizing and action leak on reoffload delete
net/sched: act_api: release all action references on NEWACTION failure
net/sched: act_api: size the RTM_GETACTION reply from the actions
net/sched: act_csum: don't mangle UDP tunnel GSO packets
net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
net/sched: cls_route: Fix in-place replace
net/sched: cls_route: free emptied bucket on filter move
net/sched: cls_route: Reject handle aliasing
net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted
net/sched: defer qdisc freeing after failed creation
net/sched: drr: clamp quantum in change class
net/sched: ets: clamp quantum in parse and fallback paths
net/sched: fq_pie: clamp quantum in change path
net/sched: hhf: clamp quantum in change and init paths
net/sched: pie: clamp psched_mtu in pie_drop_early
net/sched: sch_drr: make cl->quantum lockless
net/sched: sfq: clamp quantum in change path
 
net: advertise TCP MSS from the configured MTU, not the learned PMTU
net: amd-xgbe: discard rx packets with bad FCS
net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
net: au1000: move free_irq out of the close-time spinlocked section
net: bcmasp: clear txcb->last before writing each descriptor
net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times
net: bridge: mcast: properly convert mglist to rcu
net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations
net: cpsw_new: unregister devlink on port registration failure
net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
net: dsa: lantiq_gswip: deduplicate dsa_switch_ops
net: dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN value
net: dsa: lantiq_gswip: move definitions to header
net: dsa: lantiq_gswip: prepare for more CPU port options
net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
net: dsa: mv88e6xxx: define .pot_clear() for 6321
net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family
net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family
net: dsa: qca8k: Add support for force mode for fixed link topology
net: dsa: realtek: rtl8365mb: add support for RTL8367SB
net: dsa: sja1105: flower: reject cross-chip redirect
net: ethernet: cortina: Count dropped frames as NAPI work
net: ethernet: cortina: Count RX descriptors for freeq refill
net: ethernet: cortina: Count RX drops once per frame
net: ethernet: cortina: Finish RX updates before NAPI completion
net: ethernet: cortina: Fix budget accounting
net: ethernet: cortina: No mapping is a dropped rx
net: ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registers
net: ethernet: oa_tc6: Disable tx queues on fatal error
net: ethernet: oa_tc6: Export standard defined registers
net: ethernet: oa_tc6: Fix for the wrong data type
net: ethernet: oa_tc6: Handle the OA TC6 SPI protected mode
net: ethernet: oa_tc6: Improve the error recovery
net: ethernet: oa_tc6: Interrupt is active low, level triggered.
net: ethernet: oa_tc6: Protect skb pointer used by two different kernel instances
net: ethtool: add dedicated callbacks for getting and setting rxfh fields
net: ethtool: copy the rxfh flow handling
net: ethtool: remove the duplicated handling from rxfh and rxnfc
net: ethtool: require drivers to opt into the per-RSS ctx RXFH
net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()
net: hinic: fix mailbox segment buffer overflow
net: hns3: improve the unused_tuple parameter setting
net: hso: fix TIOCMIWAIT race
net: hsr: enable promiscuous mode on interlink port with fwd offload
net: hsr: require valid EOT supervision TLV
net: ibm: emac: mal: fix potential system hang in mal_remove()
net: ibm: emac: Reserve VLAN header in MJS limit
net: icmp: avoid invalid transport header access in icmp_send tracepoint
net: iptunnel: fix stale transport header during tunnel decapsulation
net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward
net: ipv6: Fix UDP length overflow with PMTU discover and big MTU
net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down
net: lan966x: restore RX state on reload failure
net: macb: destroy the phylink instance on the probe error path
net: macb: fix NULL pointer dereference on unbind with fixed-link
net: macb: rename bp->sgmii_phy field to bp->phy
net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG
net: mana: Reserve extra CQ slot for the fence completion CQE
net: mctp: i3c: serialize probe with bus removal
net: microchip: sparx5: clean up PSFP resources on flower setup failure
net: mpls: clear inner_protocol when the last label is popped
net: openvswitch: fix use-after-free of the flow table mask array
net: phy: add phy_disable_eee
net: phy: mediatek-ge: disable EEE on the MT7530 PHY
net: phy: mediatek: Re-organize MediaTek ethernet phy drivers
net: phy: motorcomm: use device properties for firmware tuning
net: qrtr: fix node refcount leak on ctrl packet alloc failure
net: reject oversized tx_queue_len at netlink parse time
net: sfp: add quirk for OEM 2.5G optical modules
net: stmmac: add stmmac_tso_header_size()
net: stmmac: add TSO check for header length
net: stmmac: fix TSO support when some channels have TBS available
net: stmmac: fix TX descriptor availability check for TSO traffic
net: stmmac: initialize ptp_lock at probe time
net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
net: stmmac: TSO: Simplify the code flow of DMA descriptor allocations
net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
net: sun4i-emac: fix missing of_node_put() for phy_node
net: thunderx: fix PTP device ref leak in nicvf_probe()
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
net: usb: pegasus: don't rely on id table pointer arithmetic
net: usb: qmi_wwan: add MeiG SRM813Q
net: wwan: t7xx: Add delay between MD and SAP suspend
 
netconsole: take target_cleanup_list_lock in drop_netconsole_target()
 
netfilter: ip6_tables: set F_PROTO when proto value is nonzero
netfilter: ipset: mark the rcu locked areas properly
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
netfilter: nf_conntrack_expect: zero at allocation time
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
netfilter: nf_log: unregister loggers before per-net teardown
netfilter: nfnetlink_log: cope with concurrent instance destruction
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
netfilter: nft_set_pipapo_avx2: add missing vzeroupper
netfilter: report NLM_F_DUMP_FILTERED when all is filtered out
 
netfs: Fix decision whether to disallow write-streaming due to fscache use
 
netlabel: fix IPv6 unlabeled address add error handling
 
netlink: introduce type-checking attribute iteration for nlmsg
 
nexthop: Initialize extack in remove_nh_grp_entry()
 
NFS: fix eof updates after NFSv4.2 fallocate/zero-range
 
nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache
 
NFSD: Consolidate the revocation-path client unpin
 
nfsd: dedup nfs4_client_to_reclaim inserts
nfsd: disallow file locking and delegations for NFSv4 reexport
nfsd: fix clock domain mismatch in clients_still_reclaiming()
nfsd: fix netlink dumpit error handling for rpc_status_get
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
 
NFSD: Guard admin state-revocation walks with NFSD_NET_UP
NFSD: Make nfsd_genl_rqstp::rq_ops array best-effort
NFSD: Prevent client use-after-free during admin state revocation
NFSD: Prevent client use-after-free during blocked-lock reaping
NFSD: Prevent client use-after-free during close_lru reaping
NFSD: Prevent client use-after-free during delegation revoke
 
nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
 
NFSD: Rename a function parameter
 
nfsd: update mtime/ctime on COPY in presence of delegated attributes
nfsd: validate sockaddr length per family in listener_set
nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
 
ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()
ntfs3: handle set_blocksize failures
 
nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl
 
nvme-fc: Do not cancel requests in io target before it is initialized
 
nvme-rdma: fix -EIO cleanup order in queue_rq
 
nvme-tcp: defer TLS inline send to io_work
nvme-tcp: open-code nvme_tcp_queue_request() for R2T
 
nvme: refresh multipath head zoned limits from path limits
nvme: remove stale namespaces by NSID range during scan
 
nvmet-rdma: fix queue leak when connect backlog is exceeded
 
ocfs2: validate directory-index entry counts when reading metadata
ocfs2: validate dx_root extent list fields during block read
 
octeontx2-af: Fix limiting SRIOV VF count logic
octeontx2-af: fix PF/CGX debugfs PCI bus lookup
octeontx2-af: mcs: Clear stale X2P calibration state before calibration
 
octeontx2-pf: reset HTB scheduler topology before freeing queues
 
of: dynamic: Fix overlayed devices not probing because of fw_devlink
 
omfs: handle set_blocksize failures
 
openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()
 
OPP: of: Fix potential multiplication overflow when calculating freq
 
PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device()
 
PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()
PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
 
PCI: altera: Protect root bus removal with rescan lock
PCI: Avoid FLR for MediaTek MT7925 WiFi
PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
PCI: intel-gw: Enable clock before PHY init
PCI: iproc: Protect root bus removal with rescan lock
PCI: mediatek: Protect root bus removal with rescan lock
PCI: plda: Protect root bus removal with rescan lock
PCI: rockchip: Protect root bus removal with rescan lock
PCI: Stop setting cached power state to 'unknown' on unbind
PCI: switchtec: Add Gen6 Device IDs
PCI: Wait for device readiness after D3hot -> D0uninitialized transition
 
pds_core: don't release PCI regions for VFs on reset
pds_core: fix cmd_regs access racing BAR unmap on reset
pds_core: quiesce DMA before freeing resources
 
perf evsel: Add per-thread warning for EOPNOTSUPP open failues
 
perf symbol: Do not use debug file as the binary type
 
perf/core: Allow list_del during perf_event_overflow()
perf/core: Check sample_type in perf_sample_save_callchain
perf/core: Skip empty AUX records with only format flags
 
perf/ftrace: Fix WARNING in __unregister_ftrace_function
 
perf/x86/intel/ds: Clarify adaptive PEBS processing
perf/x86/intel/ds: Factor out PEBS group processing code to functions
perf/x86/intel/ds: Remove redundant assignments to sample.period
 
perf/x86/intel: Correct pt_regs->flags update for PEBS path
 
perf: Fix addr_filter_ranges lifetime
perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ
perf: RISC-V: store available counter mask as bitmap
perf: RISC-V: use BIT_ULL for u64 overflow masks
perf: Supply task information to sched_task()
 
phonet: check register_netdevice_notifier() error in phonet_device_init()
 
pinctrl: renesas: rzg2l: Handle RZ/V2H(P) IOLH configuration in PM cache
pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP
 
platform/chrome: Resolve kb_wake_angle visibility race
 
platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table
platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table
platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen
platform/x86: sel3350-platform: Retain LED state on load and unload
 
powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()
 
powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver
 
powerpc/fadump: Add timeout to RTAS busy-wait loops
 
powerpc/kexec_file: Use inclusive range checks in add_usable_mem()
 
powerpc/ps3: Fix repository.c build failure
 
powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash
 
ppp: ppp_async: simplify tty disc_data access
ppp: ppp_synctty: simplify tty disc_data access
 
ppp_async: drop the errored frame instead of resetting its headroom
 
ppp_synctty: ensure a writeable skb header
 
printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY
 
ptp: ocp: add shutdown callback
 
qnx4: handle set_blocksize failures
 
RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed
 
raw: annotate disconnect-side IPv4 match writers
 
rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks()
 
RDMA/bnxt_re: Proper rollback if the ioremap fails
 
RDMA/irdma: Fix typo in SQ completions generation
 
RDMA/mlx5: Create ODP EQ for non-pinned dmabuf MRs
RDMA/mlx5: Fix state and counter desync on loopback enable failure
RDMA/mlx5: Use QP port when decoding responder CQEs
 
RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
 
RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()
 
rds: annotate data-race around rs_seen_congestion
rds: filter RDS_INFO_* getsockopt by caller's netns
 
regulator: core: clamp voltage constraints before applying apply_uV
regulator: da9121: Use subvariant ids in the I2C table
 
Revert "arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries"
Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries"
Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries"
Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries"
Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries"
Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries"
Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries"
Revert "arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries"
 
Revert "ARM: 9481/2: breakpoint: CFI breakpoints only on demand"
 
Revert "bpf, s390: Clear fetch destination on faulting arena atomic"
 
Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"
 
Revert "nvme-apple: Drop the PRP null check chicken bit"
Revert "nvme-apple: Prevent shared tags across queues on Apple A11"
Revert "nvme-apple: Reset q->sq_tail during queue init"
 
Revert "nvme: apple: Add Apple A11 support"
 
Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems"
 
Revert "selftests/mm: report unique test names for each cow test"
Revert "selftests/mm: skip COW tmpfile cases when fallocate() is unsupported"
 
Revert "selftests: harness: Mark test fixture objects __maybe_unused"
 
Revert "slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL"
 
ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
ring-buffer: Check resize_disabled before publishing the new subbuf order
 
riscv: panic if IRQ handler stacks cannot be allocated
 
rpc_mkpipe_dentry(): saner calling conventions
 
rpc_pipe: don't overdo directory locking
 
rpc_populate(): lift cleanup into callers
 
rpcrdma: arm rn_done before publishing the notification
 
rtase: Fix flow control configuration
 
rtc: aspeed: add AST2700 compatible
rtc: bq32000: add delay between RTC reads
rtc: mv: add suspend/resume support for wakeup
 
rust: allow `unknown_lints` in generated bindings for Rust < 1.88
 
s390/boot: Fix physical memory search range
 
s390/cio: Purge based on the cdev's online status
 
s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm
s390/crypto: Fix skcipher_walk return code handling in aes_s390
s390/crypto: Fix use of mutex in atomic context
 
s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
s390/ipl: Fix NULL deref in kdump without re-IPL parm block
 
s390/ism: folio_put() after error
 
s390/qeth: allow bridgeport queries despite OS_MISMATCH
 
s390/time: Use jiffies instead of jiffies_64
 
s390/vtime: Use __this_cpu_read() / get rid of READ_ONCE()
 
s390/zcore: Removed unused variables
 
sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity
 
sched_ext: Fix inverted ops.core_sched_before() invocation
sched_ext: Fix nonexistent field in sched-ext.rst example
sched_ext: Fix timer pinning and return value in scx_central
 
scripts/mksysmap: fix escape of '$' in the __pi_ pattern
 
scripts/sorttable: Mark long_size as __maybe_unused
 
scripts: modpost: detect and report truncated buf_printf() output
 
scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
scsi: core: Do not block on tag allocation in scsi_eh_lock_door()
scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
scsi: pm8001: Reject firmware update in fatal error state
scsi: pm8001: Reject non-fatal dump when controller is crashed
scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
 
sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
sctp: fix err_chunk memory leaks in INIT handling
sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
sctp: Unwind address notifier registration on failure
 
selftests/alsa: Fix the step check for INTEGER controls
 
selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0
 
selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter
 
selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value
 
selftests: mptcp: fix an UAF in mptcp_connect.c
 
serial: 8250: fix possible ISR soft lockup
 
smb/client: fix data corruption in emulated insert range
smb/client: fix integer truncation in collapse range
smb/client: flush dirty data before punching a hole
smb/client: mark file sparse before emulating insert range
smb/client: reduce fallocate zero buffer allocation
smb/client: validate new EOF for insert range
smb/client: validate new EOF for zero range
smb/client: zero-initialize stack-allocated cifs_open_info_data
 
smb: client: avoid leaking refcount in cifs_queue_oplock_break()
smb: client: avoid leaking refcount when cifs_sb_tlink() fails
smb: client: batch SRV_COPYCHUNK entries to cut round trips
smb: client: bound dirent name against end of SMB response in cifs_filldir
smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
smb: client: fix file type corruption in wsl_to_fattr()
smb: client: fix heap overflow in DACL owner/group rewrite
smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
smb: client: fix races in cifsd thread creation
smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range
smb: client: pin DFS superblock in iterator callback
smb: client: reject userspace cifs.idmap descriptions
smb: client: transport: Fix debug printing in __release_mid()
smb: move copychunk definitions to common/smb2pdu.h
 
soc/tegra: fuse: Register nvmem lookups at probe
 
soundwire: dmi-quirks: Disable ghost Realtek devices
soundwire: intel: Move suspend tracking from trigger to pm suspend
soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list
soundwire: only handle alert events when the peripheral is attached
soundwire: validate DT compatible before parsing it
 
sparc64: uprobes: add missing break
 
sparc: Disable compat support with LLD
 
spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()
spi: core: Abort active target transfer on controller suspend
spi: dw-dma: Wait for controller idle before completing Tx
spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs
spi: dw: fix wrong RX_SAMPLE_DLY setting after resume
spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM
spi: xilinx: let transfers timeout in case of no IRQ
 
staging: fbtft: make dirty_lock IRQ-safe
 
sunrpc: Add a helper to derive maxpages from sv_max_mesg
sunrpc: defer rq_argp and rq_resp free until after RCU grace period
 
SUNRPC: fix gssx_dec_option_array error path bugs
 
sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
 
SUNRPC: Introduce xdr_set_scratch_folio()
SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode
SUNRPC: Update svcxdr_init_decode() to call xdr_set_scratch_folio()
 
sunvdc: unmap LDC cookies when the descriptor send fails
 
svcrdma: Adjust the number of entries in svc_rdma_recv_ctxt::rc_pages
svcrdma: Reject Write/Reply chunks with segcount 0
svcrdma: Release transport resources synchronously
svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
 
tcp: clamp route advmss to TCP_MIN_MSS
tcp: use GFP_ATOMIC in tcp_send_active_reset()
 
tee: optee: Allow MT_NORMAL_TAGGED shared memory
 
thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries
 
thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
 
thermal: sysfs: switch to use scnprintf() to suppress truncation warning
 
thunderbolt: Avoid reserved fields in path config space for USB4 routers
thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host()
thunderbolt: Don't create multiple DMA tunnels on firmware connection manager
thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible
thunderbolt: Improve multi-display DisplayPort tunnel allocation
thunderbolt: Increase timeout for Configuration Ready bit
thunderbolt: Keep the domain reference while processing hotplug
thunderbolt: Keep XDomain reference during the lifetime of a service
thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
thunderbolt: Set tb->root_switch to NULL when domain is stopped
thunderbolt: Verify Router Ready bit is set after router enumeration
 
tick/broadcast: Plug clockevents replacement race
 
tipc: Dont send random pad bytes in RESET/ACTIVATE messages
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
tipc: fix NULL deref in tipc_named_node_up() on empty publication list
 
tls: Flush backlog before waiting for a new record
tls: reject the combination of TLS and sockmap
 
tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang
 
tracing/probes: Fix use-after-free on field name/type of events with multiple probes
 
tracing/user_events: Don't destroy fields when event removal fails
 
tracing: Disable KCOV instrumentation for trace_irqsoff.o
tracing: Fix memory corruption from the histogram stacktrace modifier
tracing: Free histogram the field rejected for a bad modifier
tracing: Free histogram the var ref when its initialization fails
tracing: Free histogram var refs regardless of how often they are referenced
tracing: Keep the entry count when the histogram stats allocation fails
tracing: Let histogram values keep the percent and graph modifiers
 
tunnels: Drop stale dst when building an ICMP error for PMTUD
 
ufs: create the root dentry after loading cylinder metadata
ufs: do not treat unreadable directory blocks as empty
ufs: validate cylinder group metadata before caching it
 
USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set
 
usb: core: hcd: fix possible deadlock in rh control transfers
usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
 
USB: gadget: ffs: fix mm lifetime handling
 
usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
usb: gadget: udc: skip pullup() if already connected
usb: host: add ARCH_AIROHA in XHCI MTK dependency
usb: serial: spcp8x5: don't store usb_device_id
usb: usbtmc: don't store usb_device_id
usb: xhci: add USB Port Register Set struct
usb: xhci: bail out of setup if the controller is inaccessible
usb: xhci: Improve Soft Retries after short transfers
usb: xhci: simplify handling of Structural Parameters 1 values
usb: xhci: use cached HCSPARAMS1 value
usb: xusbatm: don't rely on id table pointer arithmetic
 
usbip: vhci_hcd: fix NULL deref in status_show_vhci
 
vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add()
 
vdpa/octeon_ep: Use 4 bytes for mailbox signature
 
vdpa: ifcvf: Put device on unsupported feature error
vdpa: solidrun: Free IRQs after request failure
 
vdpa_sim_blk: reject out-of-range sector starts
 
vdpa_sim_net: check TX pull result before RX copy
 
vhost-scsi: flush backend after device ioctls
 
vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
vhost-vdpa: protect config_ctx from being freed under the config callback
 
vhost/vdpa: reject VRING_NUM larger than device max
 
virtio-fs: avoid double-free on failed queue setup
 
virtio-pci: return IRQ_HANDLED after non-zero ISR
 
virtio: fix use-after-free in unregister_virtio_device()
 
virtio_console: do not free control-out buffers on remove
 
virtio_input: reset device if input_register_device() fails
virtio_input: stop callbacks before unregistering input device
 
vlan: fix skb_under_panic and races when toggling HW VLAN offload
 
vsock: use sk_acceptq_is_full() helper in all transports
 
vxlan: initialize _md in vxlan_xmit_one()
vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
vxlan: reject dynamic fdb entries that reference a nexthop id
 
watchdog: fix hrtimer start when pretimeout is zero
watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94
watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform
watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk
watchdog: msc313e: Avoid division by zero
watchdog: msc313e: Enable clock before accessing hardware registers
watchdog: msc313e: Fix clock leak and spurious timer in settimeout()
watchdog: msc313e: Fix NULL pointer dereference in PM callbacks
watchdog: msc313e: Fix spurious reset on suspend
watchdog: msc313e: Fix undefined behavior
watchdog: msc313e: Sync timeout value if WDT was running at boot
watchdog: sunxi_wdt: preserve boot-enabled watchdog
 
wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
wifi: ath9k_htc: don't store usb_device_id
wifi: cfg80211: reject duplicate wiphy cipher suite entries
wifi: cfg80211: validate assoc response length before status and IE access
wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()
wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
wifi: iwlwifi: acpi: validate WGDS table revision index
wifi: iwlwifi: bound aligned TLV advance in FW parser
wifi: iwlwifi: mvm: add a check on the tid coming from the firmware
wifi: iwlwifi: mvm: fix a possible underflow
wifi: iwlwifi: mvm: fix an off-by-1 boundary check
wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
wifi: iwlwifi: mvm: fix sched scan IE sizing
wifi: iwlwifi: mvm: parse beacon notif per layout
wifi: iwlwifi: mvm: validate mac_link_id in session protect notif
wifi: iwlwifi: mvm: validate sta_id in BA window status notif
wifi: iwlwifi: mvm: validate TX_CMD response layout
wifi: iwlwifi: pcie: null RX pointers after free
wifi: libertas: reject short monitor TX frames
wifi: libipw: fix key index receive bound checks
wifi: mac80211: always allow transmitting null-data on TXQs
wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed
wifi: mac80211: explicitly disable FTM responder on AP stop
wifi: mac80211: ibss: wait for in-flight TX on disconnect
wifi: mac80211: validate deauth frame length before reason access
wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
wifi: mt76: mt7921: skip unknown CLC firmware records
wifi: mt76: mt7921: validate CLC firmware records
wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv
wifi: mt76: mt7925: add Netgear A8500 USB device ID
wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS
wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec
wifi: mt76: transform aspm_conf for pci_disable_link_state
wifi: mwifiex: replace one-element arrays with flexible array members
wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
wifi: nl80211: reject beacons with bad HE operation
wifi: ralink: RT2X00: init EEPROM properly
wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
wifi: rsi: validate beacon length before fixed buffer copy
wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()
wifi: rtw89: disable CSI STBC for VHT 160MHz
wifi: rtw89: pci: enable LTR based on pcie control register
wifi: rtw89: phy: check length before parsing PHY status IE
 
workqueue: reject watchdog thresholds that overflow jiffies
workqueue: replace use of system_wq with system_percpu_wq
workqueue: Update documentation as per system_percpu_wq naming
 
x86/locking: Remove semicolon from "lock" prefix
x86/locking: Use sfence for wmb() if SSE is available
 
x86/mm: Fix user-space data loss with MADV_FREE and THP
 
x86/xen: fix init of balloon stats again
 
xdrgen: Fix union declarations
 
xen/balloon: improve accuracy of initial balloon target for dom0
 
xen/front-pgdir-shbuf: free grant reference head on errors
 
xen/gntalloc: validate grant count before allocation
 
xfs: actually recover intended file sizes in xfs_xmi_item_recover_intent
xfs: advance the findparent inode scan cursor while holding ILOCK
xfs: bail out on bitmap errors in xrep_agfl_fill
xfs: compute dquot checksum after resetting dd_lsn in repair
xfs: count escaped corruption errors in scrub stats
xfs: destroy seen inode bitmap when we fail to add a dirpath
xfs: don't leak dqacct if rhashtable insertion fails
xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails
xfs: don't modify file attributes or poke fsnotify for dry runs
xfs: don't spin forever on zero-length dirents when salvaging them
xfs: fix backwards skipping logic in xrep_quota_block
xfs: fix bnobt repair space reservation disposal failure
xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
xfs: fix name string recording in slowpath pptr tracepoints
xfs: fix replaying dirent removals into the temporary directory
xfs: initialise args->total for parent pointer updates
xfs: initialise error in xfs_defer_finish_one()
xfs: log the tempip after we convert it to extents format
xfs: preserve owner on in-memory btree creation
xfs: report nonexistent parents as a filesystem corruption
xfs: reset parent pointer args before each dir tree unlink repair
xfs: signal inode btree xref error if get_rec returns an error
xfs: snapshot old AGFL before rewriting it
xfs: snapshot scrub stats when rendering them
xfs: truncate quota file correctly when repairing quota file
 
xhci: Prevent queuing new commands if xhci is inaccessible
 
xprtrdma: Add request-pool slack for delayed recycling
 
zram: fix out-of-bounds access in read_block_state()
zram: fix out-of-bounds access in writeback_store()
zram: fixup read_block_state()
zram: remove entry element member
zram: set default primary compressor in zram_destroy_comps()
zram: switch to guard() for init_lock
zram: use zram_read_from_zspool() in writeback