Changelog
in Linux kernel
6.6.160
9p/xen:
protect xen_9pfs_front_free against concurrent calls
accel/ivpu:
Limit firmware log name prints to field size
accel/ivpu:
Validate firmware log buffer metadata
accel/ivpu:
Validate full buffer range in ivpu_to_cpu_addr
ACPI:
bus: Introduce acpi_bus_get_primary_device()
ACPI:
platform: Use acpi_bus_get_primary_device()
ACPI:
processor_idle: Mark LPI enter functions as __cpuidle
ACPI:
TAD: Add locking around AML evaluations
ACPI:
TAD: Rearrange RT data validation checking
ACPI:
TAD: Split three functions to untangle runtime PM handling
af_unix:
Update last skb marker in manage_oob().
afs:
Fix lock recursion
afs:
Fix reinitialisation of the inode, in particular ->lock_work
alpha:
fix user-space corruption during memory compaction
ALSA:
caiaq: unregister the input device when probe fails
ALSA:
control: Don't add invalid kcontrols to LED layer
ALSA:
core: Define auto-cleanup for snd_card_free()
ALSA:
hda/cs35l41: Fix firmware load work teardown
ALSA:
hda/realtek: Fix headset mic on ASUS Zenbook 14
ALSA:
hda/tegra: Re-enable SDO workaround for Tegra194
ALSA:
ice1712: Fix the error handling via auto-cleanup at probe
ALSA:
line6: reject oversized playback packets
ALSA:
mixer: oss: Add card disconnect checkpoints
ALSA:
mtpav: shut down output timer before card teardown
ALSA:
pcm: oss: Fix data race at accessing runtime.oss.trigger
ALSA:
pcm: oss: Fix setup list UAF on proc write error
ALSA:
seq: avoid stale FIFO cells during resize
ALSA:
seq: Clean up fifo locking with guard
ALSA:
seq: Drop superfluous filter argument of get_event_dest_client()
ALSA:
seq: fifo: Use guard() for locking
ALSA:
seq: Fix kernel heap address leak in bounce_error_event()
ALSA:
seq: oss: Fix UAF at handling events with embedded SysEx data
ALSA:
seq: oss: Serialize readq reset state with q->lock
ALSA:
seq: Serialize compat port-info ioctls
ALSA:
ua101: reject mismatched capture/playback packet sizes
ALSA:
usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
ALSA:
usb-audio: Clamp implicit feedback packet count to URB capacity
ALSA:
usb-audio: Optimize the copy of packet sizes for implicit fb handling
ALSA:
usb-audio: Prevent excessive number of frames
ALSA:
usbusx2y: validate URB actual_length in interrupt callback
ALSA:
usx2y: Use standard print API
amt:
Don't support cross-netns setup.
amt:
send the relay's General Query directly from the receive path
AppArmor:
Allow apparmor to handle unaligned dfa tables
apparmor:
Fix & Optimize table creation from possibly unaligned memory
apparmor:
fix cred UAF caused by begin_current_label_crit_section()
apparmor:
fix deadlock in complain-mode change_hat
apparmor:
fix out-of-bounds write when null terminating a label vec
arch:
turn off -Werror for architectures with known warnings
arm64/fpsimd:
signal: Forbid non-streaming SVE payload on SME-only systems
arm64:
errata: Add Cortex-A725 erratum 3821522 workaround
arm64:
errata: Factor out broken AMU const counter cap
arm64:
irq: exclude the softirq stack switch from KCOV
arm64:
ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
ASoC:
adau1372: allow sleepy powerdown GPIOs
ASoC:
adau1372: fix invalid default state of output ASRC and DAC muxes
ASoC:
amd: acp-mach-common: Add missing error check for clock acquisition
ASoC:
amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
ASoC:
codecs: aw88261: only check PLL and clock state at power-up
ASoC:
codecs: aw88261: reduce log spam
ASoC:
codecs: max98363: fix uninitialized stream_config->type
ASoC:
codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
ASoC:
codecs: rt274: Fix format setting for 44100 rate
ASoC:
codecs: rt286: Revert delay value for jack setup
ASoC:
hdac_hda: Fix hlink refcount leak on component registration failure
ASoC:
Intel: avs: Do not share the name pointer between components
ASoC:
qcom: lpass-cpu: use DAI table index for playback constraints
ASoC:
qcom: q6asm: drop DSP responses for closed data streams
ASoC:
qcom: q6asm: handle the responses after closing
ASoC:
samsung: i2s: enable op_clk in probe to balance runtime PM
ASoC:
SOF: Intel: hda-dai: Ensure DAI widget is valid during params
ASoC:
SOF: ipc4-topology: Harden loops for looking up ALH copiers
ASoC:
SOF: topology: Parse DAI type token for dspless mode
ASoC:
tegra: Fix ASRC Stream6 input threshold control
ASoC:
wm8903: Move the DRC QR threshold to the register that holds it
audit:
fix exe mark UAF in kill_rules()
ax25:
Remove broken autobind
binder:
fix is_failure flag for superseded transaction cleanup
binder:
fix leaked fd fixups on TF_UPDATE_TXN supersede
blk-cgroup:
delay freeing policy data after rcu grace period
blk-cgroup:
fix race between policy activation and blkg destruction
blk-iocost:
clear delay state when freeing policy data
blk-iolatency:
clear delay state when freeing policy data
block2mtd:
prevent direct access of bd_inode
Bluetooth:
6lowpan: avoid untracked enable work
Bluetooth:
btintel: fix buffer over-read in btintel_hw_error()
Bluetooth:
btintel: validate DDC record lengths
Bluetooth:
btqcomsmd: Convert to platform remove callback returning void
Bluetooth:
btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
Bluetooth:
btusb: Add IMC Networks QCA9377 to quirks table
Bluetooth:
do not leak an hci_conn when a second LE connect is rejected
Bluetooth:
eir: Fix possible crashes on eir_create_adv_data
Bluetooth:
eir: Fix stack OOB write when prepending the Flags AD
Bluetooth:
hci_conn: Lock parent access during enhanced SCO setup
Bluetooth:
hci_core: Fix inquiry cache timestamps on 64-bit systems
Bluetooth:
hci_core: Fix queuing tx_work after workqueue is drained
Bluetooth:
hci_core: Fix UAF in hci_unregister_dev()
Bluetooth:
hci_core: free the HCI ID if naming fails
Bluetooth:
hci_core: Serialize ACL scheduling with channel deletion
Bluetooth:
hci_core: Serialize fragmented ISO packet queueing
Bluetooth:
hci_core: Serialize SCO and ISO scheduling with teardown
Bluetooth:
hci_event: fix simultaneous discovery stuck in FINDING
Bluetooth:
hci_event: move wake reason storage into validated event handlers
Bluetooth:
hci_sock: Serialize dead-device detachment
Bluetooth:
hci_sync: don't drain cmd_sync backlog on unregister
Bluetooth:
hci_sync: Fix command skb lifetime during scan setup
Bluetooth:
hci_sync: Fix inquiry cache use-after-free
Bluetooth:
hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
Bluetooth:
hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
Bluetooth:
hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
Bluetooth:
hci_sysfs: Fix NULL pointer dereference in device_del()
Bluetooth:
ISO: fix race of kfree vs kref_get_unless_zero
Bluetooth:
ISO: hold sk properly in iso_conn_ready
Bluetooth:
ISO: Serialize concurrent connect calls
Bluetooth:
ISO: zero the sockaddr before returning it in getname
Bluetooth:
L2CAP: access chan->conn safely in get/setsockopt
Bluetooth:
L2CAP: fix out-of-bounds write in l2cap_ecred_connect
Bluetooth:
L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
Bluetooth:
MGMT: fix crash in set_mesh_sync and set_mesh_complete
Bluetooth:
MGMT: Fix list corruption and UAF in command complete handlers
Bluetooth:
MGMT: Fix status of pending commands flushed on power off
Bluetooth:
RFCOMM: connect the session socket without rfcomm_mutex
Bluetooth:
RFCOMM: Fix initial port reference race
Bluetooth:
RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
Bluetooth:
RFCOMM: free the skb when the DLC has no owner
Bluetooth:
Serialize SMP remote OOB data access
bna:
prevent IOC timer rearm during teardown
bnxt:
fix head underflow on XDP head-grow
bnxt_en:
fix DMA mapping length for padded small packets
bnxt_en:
Fix memory corruption when FW resources change during ifdown
bootconfig:
Fix integer overflow in initrd size check
bpf, arm64:
Enable the inline of bpf_kptr_xchg()
bpf, arm64:
Force 8-byte alignment for JIT buffer to prevent atomic tearing
bpf, cgroup:
Fix storage null-ptr-deref after replacing prog
bpf, sockmap:
Account for receive queue in FIONREAD without a verdict program
bpf, x86:
Fix trampoline stack size for 128-bit arguments
bpf, xdp:
move offload check into dev_xdp_install()
bpf:
abort verification if env->cur_state->loop_entry != NULL
bpf:
add a get_helper_proto() utility function
bpf:
backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
bpf:
backtracking shouldn't clear outer frame R1-R5 for callbacks
bpf:
Cancel the running bpf_timer through kworker for PREEMPT_RT
bpf:
Check sk_state before sk_protocol in bpf_tcp_*_syncookie
bpf:
Check the helper function is valid in get_helper_proto
bpf:
check_cond_jmp_op(): properly infer if register is null
bpf:
Clear buf on error in __bpf_get_task_stack
bpf:
Clear rb node linkage when freeing bpf_rb_root
bpf:
copy_verifier_state() should copy 'loop_entry' field
bpf:
Disable migration when cloning sock storage
bpf:
Disable migration when destroying sock storage
bpf:
Disable preemption in __bpf_get_stack
bpf:
Disable preemption in bpf_get_stackid
bpf:
Do not include stack ptr register in precision backtracking bookkeeping
bpf:
Don't infer non-NULL from a pointer with an unbounded offset
bpf:
Don't predict JMP32 pointer vs zero comparisons
bpf:
Fix a sdiv overflow issue
bpf:
Fix incorrect pruning due to atomic fetch precision tracking
bpf:
Fix kmemleak warning for percpu hashmap
bpf:
Fix mmap_lock leak in irq_work path
bpf:
Fix netns reference imbalance in conntrack kfuncs
bpf:
Fix stackmap overflow check in __bpf_get_stackid()
bpf:
Fix tcx/netkit detach permissions when prog fd isn't given
bpf:
Fix UAF in sock clone early bailouts
bpf:
Fix WARNING in bpf_tracing_link_release
bpf:
generalize is_branch_taken to handle all conditional jumps in one place
bpf:
generalize is_branch_taken() to work with two registers
bpf:
generalize is_scalar_branch_taken() logic
bpf:
Guard conntrack opts error writes
bpf:
improve error message for unsupported helper
bpf:
Improve JEQ/JNE branch taken logic
bpf:
make it easier to add new metadata kfunc
bpf:
mark a NULL call argument precise
bpf:
Mark bpf_refcount field as unique
bpf:
Mark NULL kptr stores precise
bpf:
Mark raw_tp arguments with PTR_MAYBE_NULL
bpf:
Mark syscall helpers as sleepable
bpf:
move is_branch_taken() down
bpf:
net: netfilter: drop dead NULL checks
bpf:
Preserve inner map identity in callback frames
bpf:
Prevent tailcall infinite loop caused by freplace
bpf:
Reject MEM_ALLOC BTF accesses past object bounds
bpf:
Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
bpf:
Reject sleepable BPF_LSM_CGROUP programs at load time
bpf:
Reject writes through untrusted BTF pointers
bpf:
remove unused parameter in bpf_jit_binary_pack_finalize
bpf:
rename is_branch_taken reg arguments to prepare for the second one
bpf:
Take return from set_memory_ro() into account with bpf_prog_lock_ro()
bpf:
Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
bpf:
unify 32-bit and 64-bit is_branch_taken logic
bpf:
Use rcu_read_lock_dont_migrate in bpf_sk_storage.c
bpf:
Zero queue and stack outputs on lock failure
btrfs:
allow to run delayed refs by bytes to be released instead of count
btrfs:
always wait for ordered extents to avoid OE races
btrfs:
check if root is readonly when setting posix acl
btrfs:
convert to new timestamp accessors
btrfs:
defrag: fix deadlock between defrag and delalloc space reservation
btrfs:
do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
btrfs:
do proper folio cleanup when cow_file_range() failed
btrfs:
do proper folio cleanup when run_delalloc_nocow() failed
btrfs:
don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
btrfs:
drop recovered reloc root refs on recovery failure
btrfs:
fix block group refcount race in btrfs_create_pending_block_groups()
btrfs:
fix deadlock between reflink and transaction commit when using flushoncommit
btrfs:
fix deadlock cloning inline extent when using flushoncommit
btrfs:
fix EEXIST abort due to non-consecutive gaps in chunk allocation
btrfs:
fix extent map leak in NOCOW direct I/O write
btrfs:
fix xattr replace when multiple xattrs are packed in the same item
btrfs:
fix zero size inode with non-zero size after log replay
btrfs:
harden block_group::bg_list against list_del() races
btrfs:
lzo: reject compressed segment that overflows the compressed input
btrfs:
lzo: reject inline extents without valid headers
btrfs:
only release the dirty pages io tree after successful writes
btrfs:
qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
btrfs:
reject new transactions if the fs is fully read-only
btrfs:
remove pointless initialization at btrfs_delayed_refs_rsv_release()
btrfs:
remove pointless loop from btrfs_update_block_group()
btrfs:
rename err to ret in btrfs_recover_relocation()
btrfs:
rename ret to err in btrfs_recover_relocation()
btrfs:
rename ret to ret2 in btrfs_recover_relocation()
btrfs:
reserve enough transaction items for qgroup ioctls
btrfs:
reserve space for delayed refs on a per ref basis
btrfs:
scrub: fix local_root reference leak in scrub_print_warning_inode()
btrfs:
skip global block reserve accounting for rescue mounts
btrfs:
stop doing excessive space reservation for csum deletion
btrfs:
stop reserving excessive space for block group item insertions
btrfs:
stop reserving excessive space for block group item updates
btrfs:
take commit root semaphore when iterating in mark_block_group_to_copy()
btrfs:
tree-log: don't use token set/get accessors in fill_inode_item()
btrfs:
zoned: finish active block group cleanup if call_zone_finish() fails
btrfs:
zstd: fix lost wakeup when waiting for a workspace
bus:
fsl-mc: use generic driver_override infrastructure
can:
fix unique skb identifier regression under RPS
ceph:
cap delegated inode count in ceph_parse_deleg_inos()
ceph:
do not repeat ceph_trim_dentries() if no progress possible
ceph:
fix num_ops off-by-one when crypto allocation fails
ceph:
fix race condition validating r_parent before applying state
ceph:
fix UAF in check_new_map() on session freed during unlock
ceph:
properly decrypt filenames in vmalloc() buffers
cgroup/cpuset:
introduce cpuset-v1.c
cgroup/cpuset:
Make nr_deadline_tasks an atomic_t
cgroup/cpuset:
move common code to cpuset-internal.h
cgroup/rstat:
validate cpu before css_rstat_cpu() access
cifs:
call pagecache_isize_extended() in cifs_setsize() when extending
cifs:
fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
cifs:
prevent readdir from changing file size due to stale directory metadata
clk:
mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
clk:
qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs
clk:
sunxi-ng: h616: Reparent CPU clock during frequency changes
clk:
sunxi-ng: h616: Reparent GPU clock during frequency changes
clocksource/drivers/samsung_pwm:
Switch to raw_spinlock_t type
configfs:
pin the symlink target's dirent instead of chasing ->ci_dentry
configfs:
unhash the dentry before dropping the item in rmdir
Linux:
configfs:get_target() - release path as soon as we grab configfs_item reference
coresight:
ete: Always save state on power down
coresight:
etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
coresight:
etm4x: missing cscfg_csdev_disable_active_config() in perf enable
coresight:
ETR: Fix ETR buffer use-after-free issue
coresight:
holding cscfg_csdev_lock while removing cscfg from csdev
coresight:
tmc-etr: Fix race condition between sysfs and perf mode
cpufreq:
apple-soc: Fix OPP table cleanup
cpufreq:
Make cpufreq_driver->exit() return void
cpufreq:
pcc: Remove empty exit() callback
cpufreq:
qcom-cpufreq-hw: Fix possible double free
crypto:
af_alg - limit RX SG extraction by receive buffer budget
crypto:
drbg - Fix ineffective sanity check
crypto:
hisilicon/qm - request reserved interrupt for virtual function
crypto:
qat - protect service table iterations with service_lock
crypto:
x86/aegis - Add missing error checks
crypto:
x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
crypto:
x86/aegis128 - eliminate some indirect calls
crypto:
x86/aegis128 - improve assembly function prototypes
crypto:
x86/aegis128 - optimize length block preparation using SSE4.1
cxgb4/ch_ktls:
disable softirqs around tid_list erases
cxl/mbox:
Clamp mailbox output allocation to the payload size
cxl/mbox:
validate payload size before accessing contents in cxl_payload_from_user_allowed()
cxl/port:
Fix use after free of parent_port in cxl_detach_ep()
cxl/region:
Block region delete during region creation
cxl/region:
Resolve region deletion races
cxl:
Fix CXL_HEADERLOG_SIZE to match RAS Capability size
dcache:
don't put a mountpoint on a dentry that's being removed
device property:
Add fwnode_property_match_property_string()
dlm:
validate length in dlm_search_rsb_tree
dm array:
validate array block headers on read
dm ioctl:
don't let data_start run past the buffer
dm-crypt:
reject the lmk IV mode with AEAD ciphers
dm-snap:
reject the transient exception store for snapshot-merge
dm-stripe:
fix a possible integer overflow
dm-stripe:
limit chunk_sectors to the stripe size
dm-verity-fec:
fix reading parity bytes split across blocks (take 3)
dm-verity:
fix buffer overflow in FEC calculation
dm-verity:
provide dma_alignment limit in io_hints
dm:
fix reading free memory in do_resume
dm:
stop using blk_limits_io_{min,opt}
dma-buf:
dma-heap: don't publish fd before copy_to_user() succeeds
dma-direct:
return struct page from dma_direct_alloc_from_pool()
dma-direct:
simplify the use atomic pool logic in dma_direct_alloc
dmaengine:
Add devm_dma_request_chan()
dmaengine:
idxd: fix double free of wq, engine, and group structs
dmaengine:
ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
dmaengine:
xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
driver core:
Avoid warning when removing a device while its supplier is unbinding
driver core:
bus: add irq_get_affinity callback to bus_type
Drivers:
hv: vmbus: Skip VMBus module cleanup for non-nested root partition
Drivers:
hv: vmbus: use generic driver_override infrastructure
drm/amd/display:
Add missing NULL pointer check within dpcd_extend_address_range
drm/amd/display:
Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer
drm/amd/display:
Avoid NULL dereference in dc_dmub_srv error paths
drm/amd/display:
Avoid overflow from uint32_t to uint8_t
drm/amd/display:
check dc_state_create_copy() for NULL in dm_suspend
drm/amd/display:
Check null pointers before multiple uses
drm/amd/display:
Check null pointers before used
drm/amd/display:
Don't replace a sink mode that shares the native totals
drm/amd/display:
fix a Null pointer dereference vulnerability
drm/amd/display:
Fix dangling pointer in CRTC reset function
drm/amd/display:
Fix dangling pointer in plane reset function
drm/amd/display:
Fix dc_link NULL handling in HPD init
drm/amd/display:
Fix direct scanout alpha on some DRM_FORMATs
drm/amd/display:
Fix fast updates on DCE 8.1
drm/amd/display:
Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
drm/amd/display:
Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
drm/amd/display:
Implement bounds check for stream encoder creation in DCN401
drm/amd/display:
Mark DCE 6.4 as not APU
drm/amd/display:
Preserve eDP mode on initial ASSR failure
drm/amd/display:
prevent hang on link training fail
drm/amd/display:
Resize MST HDCP per-connector arrays to 32
drm/amd/display:
switch DC over to the new DRM logging macros
drm/amd/display:
Use kcalloc() instead of kzalloc()
drm/amd/display:
use proper context for logging
drm/amd/pm/si:
Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
drm/amd/pm/si:
Fix updating clock limits on AC/DC
drm/amd/pm:
Disable MMIO access during SMU Mode 1 reset
drm/amd/pm:
fix null pointer access
drm/amd/powerplay:
fix VoltageObjectInfo zero-stride loop and OOB read
drm/amdgpu/atombios:
drop empty function
drm/amdgpu/gfx6:
fix firmware leak on teardown
drm/amdgpu/ras:
add ras_suspend callback and use it for cp_ecc_error_irq
drm/amdgpu/vcn:
set no_user_fence for VCN v4.0 enc ring
drm/amdgpu:
Add wrapper for freeing vbios memory
drm/amdgpu:
avoid force-completing uninitialized UVD rings
drm/amdgpu:
Bound GPIO I2C table entry count from VBIOS
drm/amdgpu:
change vm->task_info handling
drm/amdgpu:
copy debugfs register data outside the GRBM/SRBM locks
drm/amdgpu:
fix ACP MFD device leak on init failure
drm/amdgpu:
Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
drm/amdgpu:
fix amdgpu_hmm_range_get_pages
drm/amdgpu:
Fix context pstate override handling
drm/amdgpu:
fix double free err_addr pointer warnings
drm/amdgpu:
fix gpu page fault after hibernation on PF passthrough
drm/amdgpu:
fix IP instance memory leak on kobject add failure
drm/amdgpu:
force complete the KIQ ring fences on reset
drm/amdgpu:
harden FRU PIA parsing with bounded helpers
drm/amdgpu:
hide VRAM sysfs attributes on GPUs without VRAM
drm/amdgpu:
make Mac FB workaround generic
drm/amdgpu:
prevent immediate PASID reuse case
drm/amdgpu:
Refactor FRU product information
drm/amdgpu:
reject oversized IBs with per-ring packet limits
drm/amdgpu:
Release VFCT ACPI table reference
drm/amdgpu:
remove two invalid BUG_ON()s
drm/amdgpu:
Remove unused amdgpu_i2c functions
drm/amdgpu:
Remove usage of the deprecated ida_simple_xx() API
drm/amdgpu:
reset VI ASIC on MacBookPro14,3
drm/amdgpu:
reset VI ASIC on MacBookPro15,1
drm/amdgpu:
Restore partition mode after reset
drm/amdgpu:
rework i2c init and fini
drm/amdgpu:
serialize vblank counter reads against GPU reset
drm/amdgpu:
Show vram vendor only if available
drm/amdgpu:
Skip vcn poison irq release on VF
drm/amdgpu:
Use dbg level for VBIOS check messages
drm/amdgpu:
validate and share PSP fw_pri_buf copies via psp_copy_fw
drm/amdkfd:
Add bounds check for CRAT subtype length
drm/amdkfd:
Add TLB flush after MES queue eviction/suspension
drm/amdkfd:
align SDMA doorbell base for shader doorbell writes
drm/amdkfd:
Check bounds on CRIU restore queue type and mqd size
drm/amdkfd:
fix dma_buf reference leak in get_dmabuf_info
drm/amdkfd:
Fix error path at svm_migrate_copy_to_ram
drm/amdkfd:
Fix infinite loop parsing CRAT with zero subtype length
drm/amdkfd:
fix SMI event cross-process information leak
drm/amdkfd:
Fix the case that vm range is hole at svm_migrate_copy_to_vram
drm/aspeed:
Balance the display clock enable on teardown
drm/dp:
don't mark the AUX backlight enabled when enabling failed
drm/fb-helper:
defer setup when fbdev_probe() fails, not just on -EAGAIN
drm/gpuvm:
rename struct drm_gpuva_manager to struct drm_gpuvm
drm/gud:
don't keep a connector without a CRTC as connector_state
drm/gud:
validate GUD_ROTATION_0 is present in supported rotations
drm/i915/bios:
range check LFP Data Block panel_type2
drm/i915/dsi:
Don't do DSC horizontal timing adjustments in command mode
drm/i915/gem:
Prevent overstepping exec array boundary
drm/i915/gt:
Fix NULL deref on sched_engine alloc failure
drm/i915/gt:
Unmask interrupts only when ACTIVE is true
drm/i915/hdcp:
Add encoder check in hdcp2_get_capability
drm/i915/hdcp:
Add encoder check in intel_hdcp_get_capability
drm/i915/mst:
limit DP MST ESI service loop
drm/mediatek:
Add missing IS_ERR check for ovl_adaptor platform device
drm/mediatek:
Fix ovl adaptor platform device leak
drm/mediatek:
Fix pdev reference leak in mtk_drm_bind()
drm/msm/adreno:
Fix a reference leak in a6xx_gpu_init()
drm/msm/dpu:
Add mutex lock in control vblank irq
drm/msm/dpu:
shift IRQ indices by 1
drm/msm:
always recover the gpu
drm/msm:
Only fini scheduler after successful init
drm/msm:
Recover HW before retire hung submit
drm/nouveau/uvmm:
fix NULL deref unwinding an OP_MAP_SPARSE op
drm/nouveau/uvmm:
fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
drm/nouveau:
remove chan->drm
drm/nouveau:
remove nouveau_chan.device
drm/nouveau:
unsubscribe the channel-kill event before the fence context
drm/radeon:
Read the VRAM VBIOS signature with readb()
drm/rockchip:
vop2: fail cleanly if missing a primary plane for a video-port
drm/sched:
Use struct for drm_sched_init() params
drm/sysfb:
ofdrm: Fix integer overflow in fb_size calculation
drm/sysfb:
ofdrm: Fix is_avivo() constant comparison bug
drm/sysfb:
simpledrm: Improve panel-size validation
drm/sysfb:
simpledrm: Improve stride validation
drm/v3d:
Clear queue->active_job when v3d_fence_create() fails
drm/vc4:
drain the hangcheck timer and works on V3D unbind
drm/vc4:
Fix firmware reference leak in vc4_drm_bind()
drm/vc4:
Free the BO cache size list on teardown
drm/vc4:
hvs/v3d: Fix null dereference in unbind
drm/vc4:
Shut down BO cache timer before teardown
drm/virtio:
use the DMA API for resource backing on Xen
drm/vmwgfx:
validate pitch coming from userspace
drm:
renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels
EDAC/amd64:
Mask UMC chip select to the four implemented selects
EDAC/igen6:
Fix call trace due to missing release()
erofs:
add sysfs feature entry for xattr prefixes
erofs:
avoid infinite loops due to corrupted subpage compact indexes
erofs:
disable LZ4 rolling decompression for now
erofs:
fix inline data read failure for ztailpacking pclusters
erofs:
fix interlaced ztailpacking pclusters
erofs:
fix metabuf leak in inode xattr initialization
erofs:
fix use-after-free on sbi->sync_decompress
erofs:
preserve LZMA decoders on resize failure
erofs:
unify lcn as u64 for 32-bit platforms
esp:
do not unref managed frag pages in esp_ssg_unref()
eth:
bnxt: fix truesize for mb-xdp-pass case
eth:
ice: don't dereference pointers from TP_printk()
ethtool:
fail closed if we can't get max channel used in indirection tables
ethtool:
rss: fix indir_table and hkey leak on get_rxfh failure
eventfd:
simplify eventfd_signal()
eventfs:
Use children field for rcu head and add memory barriers
exfat:
convert to new timestamp accessors
exfat:
fix handling of damaged volume in exfat_create_upcase_table()
exfat:
fix out-of-bounds access of directory entries
exfat:
resolve memory leak from exfat_create_upcase_table()
ext2:
Fix lost inode updates for IS_SYNC inodes
ext4:
avoid journaling sb update on error if journal is destroying
ext4:
define ext4_journal_destroy wrapper
ext4:
fix ABBA deadlock in ext4_xattr_inode_cache_find()
ext4:
validate donor file superblock early in EXT4_IOC_MOVE_EXT
f2fs:
accurately adjust free_sections during free_segment_range
f2fs:
avoid NULL checkpoint thread access in sysfs
f2fs:
avoid reading already updated pages during GC
f2fs:
convert f2fs_handle_page_eio() to use folio
f2fs:
embed f2fs_gc_kthread in f2fs_sb_info
f2fs:
fix data loss caused by incorrect use of nat_entry flag
f2fs:
fix dentry folio leak in find_in_level
f2fs:
fix fsck inconsistency caused by FGGC of node block
f2fs:
fix potential deadloop in prepare_compress_overwrite()
f2fs:
fix to avoid potential deadloop in f2fs_fsync_node_pages()
f2fs:
fix to clear dirty flag on folio in error path
f2fs:
fix to migrate all curseg types during free_segment_range
f2fs:
fix to reclaim space in f2fs_allocate_pinning_section()
f2fs:
fix to reset all pinned status during fggc
f2fs:
fix to shrink gc_lock coverage in f2fs_gc_range()
f2fs:
limit recovery filename logging to stored length
f2fs:
read COW data with the original inode during atomic write
f2fs:
use new ioprio Macro to get ckpt thread ioprio level
f2fs:
validate MOVE_RANGE destination size
fbdev:
hyperv_fb: Allow graceful removal of framebuffer
fbdev:
hyperv_fb: Simplify hvfb_putmem
fbdev:
omap2: fix inconsistent lock returns in omapfb_mmap
fbdev:
omap2: fix use-after-free in omapfb_mmap
fbdev:
Wrap user-invoked calls to fb_set_var() in helper
fcntl:
refuse F_SET_RW_HINT on an immutable inode
filelock:
add some new helper functions
filelock:
split common fields into struct file_lock_core
firewire:
core: fix memory leak in error path of build_tree()
firewire:
ohci: fix NULL pointer dereference in ar_context_release
firmware:
arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
firmware:
arm_scmi: Clean up channels on setup failure
firmware:
arm_scmi: Fix SCMI device destroy lifetimes
firmware:
arm_scmi: Publish channel state before callbacks
firmware:
arm_scmi: Unwind TX receiver mailbox setup failure
firmware:
qcom: scm: Fix NULL dereference in IRQ handler before __scm is published
flow_dissector:
avoid u16 truncation of hlen in bpf_flow_dissect()
flow_dissector:
avoid u16 truncation of skb->len when computing thoff
fs,fsverity:
reject size changes on fsverity files in setattr_prepare
fs,fsverity:
remove check for fsverity being enabled in setattr_prepare()
fs/9p:
convert mkdir to use get_new_inode
fs/9p:
fix NULL pointer dereference on mkdir
fs/mbcache:
cancel shrink work before destroying the cache
fs/ntfs3:
Accumulated refactoring changes
fs/ntfs3:
Keep write operations atomic
fs/ntfs3:
Separete common code for file_read/write iter/splice
fs/ntfs3:
Use function file_inode to get inode from file
fs/resctrl:
Prevent use-after-free in rdtgroup_kn_put()
fs:
Free any excess xarray nodes in clear_inode()
fs:
refuse fspick() on internal superblocks
fs:
Remove NTFS classic
fs:
super_set_uuid()
fsnotify:
fix inode reference leak in fsnotify_recalc_mask()
fsverity:
add dependency on 64K or smaller pages
ftrace:
Synchronize the initialization of ftrace_ops
ftrace:
Take trace_array reference before accessing its ftrace_ops
functionfs, gadgetfs:
use simple_recursive_removal()
functionfs:
fix the open/removal races
fuse:
Fix missing FOLL_PIN for direct-io
gcov:
use atomic counter updates to fix concurrent access crashes
genetlink:
pin family module during policy dump
genirq/proc:
Size interrupt directory names for 10-digit interrupt numbers
gfs2:
fix memory leaks in gfs2_fill_super error path
gfs2:
Fix slab-use-after-free in qd_put
gfs2:
Prevent recursive memory reclaim
gpio:
exar: initialize the ID before registering its cleanup
gpio:
mvebu: free generic chips on unbind
gpio:
pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
gpio:
rockchip: fix generic IRQ chip leak on remove
gpio:
rockchip: teardown bugs and resource leaks
gpio:
xilinx: fix runtime PM leak on request error path
greybus:
raw: fix use-after-free if write is called after disconnect
greybus:
raw: fix use-after-free on cdev close
gve:
Account for stopped queues when reading NIC stats
habanalabs:
fix UAF in export_dmabuf()
HID:
alps: unregister DualPoint Stick input device on remove
HID:
bpf: Fix hid_bpf_get_data() range check
HID:
core: Add reserved item tag for main items
HID:
core: introduce hid_safe_input_report()
HID:
core: Mitigate potential OOB by removing bogus memset()
HID:
core: remove #ifdef CONFIG_PM from hid_driver
HID:
hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
HID:
hid-steam: Make client_opened a counter
HID:
intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
HID:
Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend
HID:
logitech-hidpp: Fix FF device cleanup on init failure
HID:
logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
HID:
mcp2221: clear rxbuf after I2C/SMBus transfer completes
HID:
mcp2221: fix OOB write in mcp2221_raw_event()
HID:
multitouch: stop the release timer from being rearmed on remove
HID:
nintendo: avoid bluetooth suspend/resume stalls
HID:
rate-limit hid_warn to prevent log flooding
HID:
sony: clean up device list on probe failure
HID:
sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
HID:
steam: Clean up locking
HID:
steam: Fully unregister controller when hidraw is opened
HID:
steam: Rearrange teardown sequence
HID:
steam: Refactor registration
HID:
steam: Reject short reads
HID:
uhid: convert to hid_safe_input_report()
HID:
universal-pidff: stop the device when force-feedback init fails
hwmon:
(lm90) Add lock protection to lm90_alert
hwmon:
(lm90) Stop work before releasing hwmon device
hwmon:
(pmbus) Fix type confusion in notification logic
hwmon:
(pmbus/core) honor vrm_version in pmbus_data2reg_vid()
hwmon:
(pwm-fan) Stop RPM timer before freeing tach data
hwmon:
(sht3x) Fix unaligned accesses
hwrng:
core - fix rng list on registration error
hwrng:
core - use RCU and work_struct to fix race condition
hwrng:
stm32 - Fix runtime PM cleanup on registration failure
i2c:
at91: release DMA channels when probe defers
i2c:
mxs: fix DMA channel leak on probe error
i2c:
xiic: don't clobber msg->len to signal block-read completion
i2c:
xiic: preserve PEC byte length in SMBus block read setup
i2c:
xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode
i3c:
master: Do not treat master device as a duplicate target
i3c:
master: Fix recursive locking during device registration
i3c:
master: Fix use-after-free of master->this
i3c:
mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
i3c:
mipi-i3c-hci: Fix race in DMA ring dequeue
iavf:
fix out-of-bounds writes in iavf_get_ethtool_stats()
ibmveth:
fix TX LTB and filter unwind on open-fail
ibmveth:
h_free logical LAN on open-fail after register
ice:
change XDP RxQ frag_size from DMA write length to xdp.frame_sz
ice:
Don't process extts if PTP is disabled
ice:
fix double-free of tx_buf skb
ice:
Fix improper extts handling
ice:
fix metadata_dst refcount handling on representor teardown
ice:
fix Rx page leak on multi-buffer frames
ieee802154:
Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
ieee802154:
cc2520: fix FIFOP work use-after-free
igmp:
convert struct ip_sf_list to RCU
iio:
accel: kionix-kx022a: Fix array boundary check
iio:
accel: kxcjk-1013: reject duplicate event disable
iio:
accel: sca3000: fix frequency divider condition check
iio:
adc: ad_sigma_delta: fix use-after-free on unbind
iio:
adc: aspeed: propagate reset deassert errors
iio:
adc: aspeed: Simplify with dev_err_probe
iio:
adc: axp288: Add TS bias override for Haier HV103H
iio:
adc: max1363: sign-extend bipolar differential channel reads
iio:
adc: stm32-adc: fix check on internal channel availability
iio:
adc: stm32-adc: fix possible division by zero in processed channel
iio:
adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
iio:
adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
iio:
adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
iio:
buffer: Ensure bounce buffer used for unaligned case is zeroed.
iio:
buffer: serialize buffer teardown with mode claims
iio:
cdc: ad7150: fix OF matching and publish module aliases
iio:
core: add accessors 'masklength'
iio:
frequency: admv1013: add dev variable
iio:
frequency: admv1013: fix NULL pointer dereference on str
iio:
frequency: admv1013: fix wrong channel field used in admv1013_read_raw()
iio:
frequency: admv1013: Use devm_regulator_get_enable_read_voltage()
iio:
gyro: adis16136: fix unprotected debugfs reads
iio:
health: max30102: fix NULL dereference in interrupt handler
iio:
imu: adis16400: fix unprotected debugfs reads
iio:
imu: adis16480: fix unprotected debugfs reads
iio:
light: Drop ROHM BU27034
iio:
light: gp2ap020a00f: drain irq_work after free_irq
iio:
light: ltrf216a: fix runtime PM reference leak in error path
iio:
light: ltrf216a: Return floating point values
iio:
pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
iio:
proximity: isl29501: Fix return type of isl29501_register_write
iio:
proximity: pulsedlight: fix iio_device left registered on PM setup failure
iio:
proximity: sx9324: Correct proximity channel resolution
iio:
proximity: vcnl3020: fix ISR bitmask check in IRQ handler
iio:
trigger: cancel reenable_work before freeing trigger
Input:
alps - fix use-after-free bugs caused by dev3_register_work
Input:
atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
Input:
i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
Input:
lkkbd - disable pending work before freeing device
Input:
s6sy761 - fix resume ordering and restore sensing
Input:
synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
Input:
synaptics - limit T440p InterTouch quirk to LEN0036
Input:
xpad - add support for Corsair Novablade Pro
io_uring/rw:
end write accounting from ->ki_complete
io_uring:
check for overflows in io_pin_pages
io_uring:
defer eventfd signaling when queued from a wakeup handler
iommu/amd:
Do not reallocate GA log buffers on resume
iommu/amd:
Fix clone_alias() to use the original device's devid
iommu/arm-smmu-v3:
Manage teardown with devm
iommu/msm:
Unwind probe state on registration failure
iommu/s390:
Make attach succeed when the device was surprise removed
iommu/sva:
Set handle->dev before the SVA handle is visible
iommu/vt-d:
Clear Present bit before tearing down context entry
iommu/vt-d:
Clear Present bit before tearing down PASID entry
iommu:
Pass domain to remove_dev_pasid() op
ip6_gre:
remove obsolete ERSPAN PMTU update
ip6mr:
do not clone dst in ip6mr_cache_report()
ip:
orphan prefetched skbs before multicast forwarding
ip_tunnel:
adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
ipmr:
account multicast table and route memory
ipv4:
do not warn on route notification size race
ipv4:
igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
ipv4:
nexthop: allocate skb dynamically in rtm_get_nexthop()
ipv4:
stop PMTU walk when nexthop group shrinks
ipv4:
stop route notification sizing when nexthop group shrinks
ipv6:
annotate data-races around devconf->rpl_seg_enabled
ipv6:
do not warn on route notification size race
ipv6:
fix prefix route expiry in modify_prefix_route()
ipv6:
flowlabel: cap duplicate leases per socket
ipv6:
ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
ipv6:
mcast: use rcu_assign_pointer() for __rcu list updates
ipv6:
rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
ipv6:
sr: use skb_get_hash_net() in seg6_make_flowlabel()
ipv6:
use RCU in ip6_output()
ipvs:
bound LBLCR and LBLC cache growth
ipvs:
do not create invisible templates
ipvs:
do not keep dest_dst if dev is going down
ipvs:
filter some flags received in the backup server
ipvs:
fix missing counter decrement in lblc
ipvs:
revalidate ihl to prevent out-of-bounds access
irqwork:
Move data struct to a types header
ixgbe:
do not configure xps for XDP queues
jbd2:
bound shrinker scans by examined checkpoint buffers
jbd2:
check need_resched() when skipping busy checkpoint buffers
jbd2:
use shrink_type type instead of bool type for __jbd2_journal_clean_checkpoint_list()
jfs:
fix array-index-out-of-bounds read in add_missing_indices
kasan:
avoid sleepable page allocation from atomic context
kcm:
fix zero-frag skb in frag_list on partial sendmsg error
keys:
finalize persistent keyring timeout after link attempt
KEYS:
Fix add_key() race with keyring restriction
KEYS:
trusted: Fix TPM teardown ordering
kgdboc:
Fix tty driver reference leak in configure_kgdboc()
kprobes:
Skip disarmed probes when checking optkprobe overlap
ksmbd:
add chann_lock to protect ksmbd_chann_list xarray
ksmbd:
defer publishing granted locks to prevent UAF/double-free race
ksmbd:
detach blocked lock requests before freeing
ksmbd:
fix heap out-of-bounds write in krb5_authenticate()
ksmbd:
fix maximum allowed access checks
ksmbd:
fix path resolution in ksmbd_vfs_kern_path_create
ksmbd:
fix signededness bug in smb_direct_prepare_negotiation()
ksmbd:
fix slab-out-of-bounds read in ksmbd_alloc_user()
ksmbd:
fix tree connection use-after-free in smb2_tree_connect()
ksmbd:
prevent path traversal bypass by restricting caseless retry
ksmbd:
propagate DACL parsing errors
ksmbd:
remove redundant DACL check in smb_check_perm_dacl
ksmbd:
safely discard unregistered deferred locks
ksmbd:
scope session state changes to bound connections
ksmbd:
serialize oplock close with pending break ownership
ksmbd:
use opener credentials for ADS I/O
ksmbd:
use volume UUID in FS_OBJECT_ID_INFORMATION
ksmbd:
validate NTLMv2 response before updating session key
ksmbd:
validate num_aces and harden ACE walk in smb_inherit_dacl()
ksmbd:
validate SID in parent security descriptor during ACL inheritance
ksmbd:
zero pipe read compound padding
ksmbd_vfs_rename():
vfs_path_parent_lookup() accepts ERR_PTR() as name
KVM:
arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP
KVM:
arm64: vgic-its: Don't dereference a NULL collection on ITT save
KVM:
arm64: vgic: Handle race between interrupt affinity change and LPI disabling
KVM:
nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
KVM:
nSVM: Avoid clearing VMCB_LBR in vmcb12
KVM:
nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
KVM:
nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
KVM:
nVM: Ensure INVVPID is emulated on the correct physical CPU
KVM:
nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
KVM:
s390: Fix memory corruption by not reinjecting CK machine checks
kvm:
s390: Reject memory region operations for ucontrol VMs
KVM:
s390: Zero initialize data structures for inject_pfault_token
KVM:
SEV: Ignore Port I/O requests of length '0'
KVM:
SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
KVM:
SEV: Use long-term pin when registering encrypted memory regions
KVM:
SVM: Add missing save/restore handling of LBR MSRs
KVM:
SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
KVM:
x86/mmu: Bail from shadow walks if the root is invalid or a dummy
KVM:
x86: Use active memslots for the per-vCPU MMIO cache
l2tp:
fix tunnel and session refcount leak on seq_file release
l2tp:
pppol2tp: hold reference to session in pppol2tp_ioctl()
l2tp:
prevent possible tunnel refcount underflow
landlock:
Fix use-after-free of the source's parent directory
libceph:
Fix potential out-of-bounds access in __ceph_x_decrypt()
Linux:
Linux 6.6.160
list_lru:
allow explicit memcg and NUMA node selection
llist:
add interface to check if a node is on a list.
lockd, nfsd:
RCU-protect nlmsvc_ops dispatch
lockd:
adapt to breakup of struct file_lock
lockd:
fix NULL dereference on lockowner allocation failure
lockd:
fix swapped arguments in nlmsvc_match_ip()
loongarch, kexec:
change dependency of object files
LoongArch:
BPF: Refactor jump offset calculation in tail call
LoongArch:
Fix address space mismatch in kexec command line lookup
LoongArch:
Move jump_label_init() before parse_early_param()
mailbox:
zynqmp-ipi: fix an Excess struct member kernel-doc warning
mailbox:
zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop
mailbox:
zynqmp: Move buffered IPI setup to of_match selected routine
mailbox:
zynqmp: Move of_match structure closer to usage
md/raid1,raid10:
fix bio accounting for split md cloned bios
md/raid1,raid10:
fix deadlock in read error recovery path
md/raid1,raid10:
fix error-path detection with md_cloned_bio()
md/raid10:
fix writes_pending and barrier reference leaks on discard failures
md/raid10:
fix writes_pending leak on write request failures
md/raid10:
Handle bio_split() errors
md/raid10:
wait barrier before returning discard request with REQ_NOWAIT
md/raid1:
create serial pool adding rdev to array with serialize_policy=1
md/raid1:
fix writes_pending and barrier reference leaks on write failures
md/raid5:
avoid R5_Overlap races while breaking stripe batches
md:
add new helpers to suspend/resume and lock/unlock array
md:
add new helpers to suspend/resume array
md:
fix rcu protection in md_wakeup_thread
md:
fix stopping sync thread
md:
suspend array while updating raid_disks via sysfs
media:
atomisp: gc2235: fix UAF and memory leak
media:
av7110: fix a spectre vulnerability
media:
hantro: Disable multicore support
media:
nxp: imx8-isi: Fix streaming cleanup on release
media:
platform: mtk-mdp3: fix NULL deref on failed SCP lookup
media:
rkvdec: Propagate platform_get_irq() errors
media:
v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
media:
verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
media:
vivid: fix cleanup bugs in vivid_init()
memcg:
make the v1 soft limit knob inert
memstick:
core: wait for request completion before freeing card
memstick:
rtsx_usb_ms: complete requests after eject instead of dropping them
mfd:
sm501: Convert to platform remove callback returning void
mfd:
sm501: Fix potential memory leaks during remove
MIPS:
ftrace: Fix memory corruption when kernel is located beyond 32 bits
mips:
unhide uasm_in_compat_space_p() declaration
misc:
sgi-gru: remove interrupt-context page-table walks
mlx5:
Fix default values in create CQ
mlxsw:
spectrum_flower: Fix port range register leak in tmplt_create()
mm, slub:
avoid zeroing kmalloc redzone
mm/damon/core:
do non-safe region walk on kdamond_apply_schemes()
mm/damon/core:
don't skip damos_adjust_quota() while esz is not zero
mm/damon/core:
fix unconditionally skip last region
mm/damon/vaddr:
avoid hw-driven pte updates during damon_hugetlb_mkold()
mm/huge_memory:
avoid PMD-size page cache if needed
mm/huge_memory:
transfer the pmd dirty bit to the folio on zap
mm/hugetlb:
fix avoid_reserve to allow taking folio from subpool
mm/hugetlb:
fix hugetlb cgroup rsvd charge/uncharge mismatch
mm/hugetlb:
preserve mremap address delta when skipping page tables
mm/kmemleak:
avoid soft lockup when scanning task stacks
mm/mglru:
fix and remove redundant unevictable folio handling
mm/migrate_device:
clear stale mapping after freeing swapcache
mm/mm_init:
handle alloc_percpu failure in free_area_init_core_hotplug
mm/mremap:
fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
mm/mremap:
fix locked_vm leak from MREMAP_DONTUNMAP self-merge
mm/mremap:
reset unfaulted VMA page offset for MREMAP_DONTUNMAP
mm/page_owner:
use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
mm/page_table_check:
skip special zero mappings
mm/rmap:
fix missing barrier between anon_vma init and vma->anon_vma publish
mm/secretmem:
properly account locked pages
mm/slub:
avoid zeroing outside-object freepointer for single free
mm/smaps:
fix race between smaps_hugetlb_range and migration
mm/thp:
fix "mm: thp: kill __transhuge_page_enabled()"
mm/treewide:
replace pmd_large() with pmd_leaf()
mm/util:
Introduce kmemdup_array()
mm/vmalloc, mm/kasan:
respect gfp mask in kasan_populate_vmalloc()
mm:
change type of state in struct memory_block
mm:
clear uffd-wp PTE/PMD state on mremap()
mm:
list_lru: Update kernel documentation to follow the requirements
mm:
name the anonymous MMOP enum as enum mmop
mm:
simplify thp_vma_allowable_order
mmc:
cavium-octeon: destroy slot platform devices on remove
mmc:
cavium-thunderx: destroy slot platform devices on remove
mmc:
mtk-sd: Cancel request timeout work on remove
mmc:
sdhci-sprd: disable runtime PM on remove
mmc:
via-sdmmc: cancel card-detect work on remove
mmc:
vub300: fix use-after-free on probe failure
module/dups:
Fix use-after-free in kmod_dup_req lifetime handling
most:
core: fix leak on early registration failure
most:
core: fix resource leak in most_register_interface error paths
mpls:
add seqcount to protect the platform_label{,s} pair
mptcp:
do not reschedule the RTX timer for fallback sockets
mptcp:
pm: drop match in userspace_pm_append_new_local_addr
mptcp:
pm: kernel: drop pending ADD_ADDR when removing ID0
mptcp:
pm: reset retrans_time when ADD_ADDR entry is reused
mptcp:
pm: userspace: fix address ID overflow
mptcp:
prevent race between disconnect() and rtx
mptcp:
use sock_kmemdup for address entry
mtd:
block2mtd: Convert to bdev_open_by_dev/path()
mtd:
block2mtd: Fix divide error when erase_size is zero
mtd:
core: call _get_device() with the master MTD
mtd:
maps: vmu-flash: fix fault in unaligned fixup
mtd:
rawnand: cadence: Initialize IRQ state before requesting IRQ
mtd:
rawnand: vf610_nfc: fix false bitflips on reads of erased pages
mtd:
rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
mtd:
spinand: Enable QE on all dies
mtd:
spinand: fix NULL pointer dereference with no ECC engine
mtd:
spinand: fix zero oobavail when no ECC engine is used
namespace:
check a submount for references right before unmounting it
namespace:
check the mounts before reading their parents in pivot_root()
namespace:
check the target before walking it in do_mount_setattr()
namespace:
don't copy an unmounted mount tree
namespace:
don't inherit MNT_UMOUNT in clone_mnt()
namespace:
handle mount locking for automounts correctly
namespace:
refuse an automount below a mount that is in no namespace
namespace:
unhash a dentry before detaching the mounts on it
net/handshake:
Drain pending requests at net namespace exit
net/handshake:
hand off the pinned file reference to accept_doit
net/handshake:
Take a long-lived file reference at submit
net/liquidio:
drop cached VF pci_dev LUT
net/mctp:
publish the mctp_dev only after it is initialised
net/mlx5:
Fix MCIA register buffer overflow on 32 dword reads
net/mlx5e:
Don't store mlx5e_priv in mlx5e_dev devlink priv
net/mlx5e:
Fix "scheduling while atomic" in IPsec MAC address query
net/mlx5e:
Fix netif state handling
net/mlx5e:
Fix publication race for priv->channel_stats[]
net/mlx5e:
Move representor vnic reporter to eswitch devlink port
net/mlx5e:
Order ICOSQ cc update after CQ doorbell
net/mlx5e:
Pass netdev to mlx5e_destroy_netdev instead of priv
net/mlx5e:
Prevent stale XSK buffer release on MPWQE refill retry
net/mlx5e:
Prevent stale XSK buffer release on refill retry
net/mlx5e:
RX, Fix XDP multi-buf frag counting for legacy RQ
net/mlx5e:
RX, Fix XDP multi-buf frag counting for striding RQ
net/mlx5e:
xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
net/ncsi:
Disable the ncsi work before freeing the associated structure
net/packet:
guard the ll header push in packet_rcv_spkt()
net/packet:
prevent TX_RING byte count overflow
net/sched:
account classifier filter allocations to memcg
net/sched:
act_api: release all action references on NEWACTION failure
net/sched:
act_ct: avoid modifying shared unconfirmed ct entry
net/sched:
act_ct: fix helper UAF due to extensions realloc
net/sched:
act_ife: Only operate on Ethernet frames
net/sched:
cls_api: reclaim an empty proto on the error path
net/sched:
cls_route: reject change with no routing attribute
net/sched:
cls_u32: validate offshift to prevent shift-out-of-bounds
net/sched:
em_text: reject unterminated algo before autoload
net/sched:
Fix backlog accounting in qdisc_dequeue_internal
net/sched:
fq: add overflow bounds to quantum and initial quantum
net/sched:
fq_codel: match the no-drop threshold to the packet size
net/sched:
Handle TC_ACT_REDIRECT from qdisc filter chains
net/sched:
sch_codel: match the no-drop threshold to the packet size
net/smc:
Address spelling errors
net/smc:
protect clcsock lifetime in smc_getname
net/smc:
stop killed, freed and out_of_sync sharing a byte
net:
add and use skb_get_hash_net
net:
add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
net:
add xmit recursion limit to tunnel xmit functions
net:
adopt skb_network_offset() and similar helpers
net:
bcmasp: fix double free of WoL irq
net:
bcmgenet: fix NULL dereference in set_coalesce before first open
net:
bridge: arp/nd proxy: fix reading neigh ha
net:
bridge: avoid recursive multicast port cleanup
net:
bridge: use option bits for CFM/MRP frame handlers
net:
dsa: b53: do not enable EEE on bcm63xx
net:
dsa: microchip: fix KSZ8765 fiber detection
net:
ena: Add validation for completion descriptors consistency
net:
ena: fix MMIO read buffer leak on probe failure
net:
ena: Remove autopolling mode
net:
ethernet: mtk_eth_soc: allocate dummy netdev sooner
net:
ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
net:
extend IPv6 exthdr detection of tunneled packets
net:
fix checksum offsets in skb_splice_from_iter()
net:
hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
net:
introduce page_frag_cache_drain()
net:
ioam6: fix OOB and missing lock
net:
ipconfig: bound DHCP option construction
net:
ipconfig: Remove outdated comment and indent code block
net:
ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
net:
l2tp: do not propagate multicast notification errors
net:
lan966x: fix page pool leak in error paths
net:
mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
net:
mana: Guard mana_remove against double invocation
net:
mana: remove double CQ cleanup in mana_create_rxq error path
net:
mana: Skip WQ object destruction for uninitialized RXQ
net:
mctp: unshare packets when reassembling
net:
microchip: vcap: stop scanning after deleting key field
net:
mscc: ocelot: Fix use-after-free caused by cyclic delayed work
net:
nexthop: Have all NH notifiers carry NH ID
net:
nexthop: Increase weight to u16
net:
openvswitch: conntrack: fix helper UAF due to extensions realloc
net:
openvswitch: conntrack: remove 'add_helper' dead code
net:
openvswitch: validate transport header presence in set_ipv6_addr
net:
phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
net:
plumb extack in __dev_change_net_namespace()
net:
pull headers in qdisc_pkt_len_segs_init()
net:
qlcnic: validate unified ROM sections before loading
net:
qrtr: Drop the MHI auto_queue feature for IPCR DL channels
net:
ravb: Fix missing rtnl lock in suspend/resume path
net:
ravb: serialize PTP clock teardown
net:
reject oversized tx_queue_len at netlink parse time
net:
Remove conflicting altnames for dying netns in __dev_change_net_namespace().
net:
sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
net:
sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
net:
sparx5: make ports inherit the switch base mac address type
net:
stmmac: fix oops when split header is enabled
net:
stmmac: fix TX descriptor availability check for TSO traffic
net:
systemport: Fix buffer overflow in bcm_sysport_get_stats()
net:
systemport: Fix RUNT MIB counter register offset calculation
net:
tap: fix wrong transport_header when sending VLAN-tagged frame
net:
tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
net:
team: fix NULL pointer dereference in team_xmit during mode change
net:
team: Remove unused team_mode_op, port_enabled
net:
team: Rename port_disabled team mode op to port_tx_disabled
net:
team: stop reusing skb after queue override
net:
udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
net:
udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
net:
usb: ax88179_178a: fix rx frame length for non-last packets
net:
usb: qmi_wwan: add Quectel EG120K-EA
net:
use dst_dev_rcu() in sk_setup_caps()
net:
use skb_header_pointer() for TCPv4 GSO frag_off check
net:
watchdog: fix refcount tracking races
net_sched:
export pfifo_fast prio2band[]
net_sched:
sch_fifo: implement lockless __fifo_dump()
net_sched:
sch_fq: change how @inactive is tracked
net_sched:
sch_fq: struct sched_data reorg
netconsole:
avoid OOB reads, msg is not nul-terminated
netfilter:
bpf: reject invalid NAT manipulation types
netfilter:
bridge: eb_tables: close module init race
netfilter:
conntrack: fix erronous removal of offload bit
netfilter:
conntrack: remove skb argument from nf_ct_refresh
netfilter:
conntrack: rework offload nf_conn timeout extension logic
netfilter:
cttimeout: detach dataplane timeout policy and repurpose refcount
netfilter:
cttimeout: prevent UAF during module unload
netfilter:
ebtables: move to two-stage removal scheme
netfilter:
flowtable: avoid num_encaps underflow on bridge VLAN untag
netfilter:
flowtable: fix offloaded ct timeout never being extended
netfilter:
flowtable: generalize pending status bit
netfilter:
ipset: do not update comments from kernel-side adds
netfilter:
make nftables drops visible in net dropmonitor
netfilter:
nat: use kfree_rcu to release ops
netfilter:
nf_conntrack_expect: use conntrack GC to reap expectations
netfilter:
nf_flow_table: drop existing skb dst before skb_dst_set_noref()
netfilter:
nf_tables: fix bidirectional offload regression
netfilter:
nf_tables: make nft_object rhltable per table
netfilter:
nf_tables: revert commit_mutex usage in reset path
netfilter:
nf_tables: set->ops->insert returns opaque set element in case of EEXIST
netfilter:
nf_tables: skip double clone set expressions on element insert
netfilter:
nf_tables: skip expired catchall elements on insert and delete
netfilter:
nf_tables: use list_del_rcu for netlink hooks
netfilter:
nfnetlink_queue: do shared-unconfirmed check before segmentation
netfilter:
nft_flow_offload: drop flowtable reference on init error path
netfilter:
nft_lookup: fix catchall element handling with inverted lookups
netfilter:
nft_set_pipapo: restore cloned mapping table memcg accounting
netfilter:
revalidate bridge ports
netfilter:
synproxy: adjust duplicate timestamp options
netfilter:
synproxy: drop packets if timestamp adjustment fails
netfilter:
synproxy: fix unaligned memory access in timestamp adjustment
netfilter:
Use kmemdup_array instead of kmemdup for multiple allocation
netfilter:
x_tables: allocate hook ops while under mutex
netfilter:
x_tables: allow initial table replace without emitting audit log message
NFS:
Return a delegation the client fails to record
NFSD:
Add simple u32, u64, and bool encoders
nfsd:
check nfsd4_acl_to_attr() return value in nfsd4_create()
NFSD:
check truncate permission under inode lock
NFSD:
Clean up nfsd4_encode_layoutreturn()
NFSD:
Clean up nfsd4_encode_stateid()
nfsd:
convert nfsd_net boolean flags to unsigned long flags word
nfsd:
fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
nfsd:
fix clock domain mismatch in clients_still_reclaiming()
nfsd:
fix fcache_disposal UAF by inlining dispose state into nfsd_net
nfsd:
fix nfsd_file leak on inter-server COPY setup failure
nfsd:
fix stale s2s_cp_stateids IDR entry for async COPY
nfsd:
Pass 'cred' instead of 'rqstp' to some functions.
NFSD:
Prevent client use-after-free during blocked-lock reaping
NFSD:
Prevent client use-after-free during close_lru reaping
NFSD:
Prevent client use-after-free during delegation revoke
nfsd:
reject out-of-range nseconds in NFSv3 SETATTR and create ops
nfsd:
size fh_verify server sockaddr slot by xpt_locallen
nfsd:
split sc_status out of sc_type
NFSv4.1:
zero referring call lists before decoding
NFSv4/flexfiles:
fix NULL dereference for NFSv4.0 data servers
NFSv4:
Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
nilfs2:
do not force clear folio if buffer is referenced
nitro_enclaves:
fix use-after-free on SLOT_ALLOC failure
NTB:
core: Add .get_dma_dev() callback to ntb_dev_ops
NTB:
ntb_transport: Use ntb_get_dma_dev() for DMA buffers
ntb:
Store original DMA address for future release
ntfs3:
fix circular locking dependency in run_unpack_ex
null_blk:
free zones array on device power-off
nvdimm:
pmem: keep PREFLUSH before data writes
nvdimm:
virtio_pmem: refcount requests for token lifetime
nvme-fabrics:
fix DHCHAP secret leak on parse failure
nvme-multipath:
fix underflow in ANA log bounds checks
nvme-pci:
add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT
nvme-tcp:
fix potential memory corruption in nvme_tcp_recv_pdu()
nvme-tcp:
sanitize request list handling
nvme:
add missing SRCU grace period in error path
nvme:
fix swapped ZRASF zone state values for full and read only
nvme:
remove stale namespaces by NSID range during scan
nvme_core:
scan namespaces asynchronously
nvmem:
core: fix use-after-free bugs in error paths
nvmem:
core: Rework layouts to become regular devices
nvmem:
Move of_nvmem_layout_get_container() in another header
nvmet-auth:
fix out-of-bounds write in nvmet_auth_challenge()
nvmet-auth:
reject short AUTH_RECEIVE buffers
nvmet-tcp:
allocate socket file
nvmet-tcp:
fix page fragment cache leak in error path
nvmet-tcp:
make nvmet_tcp_alloc_queue() a void function
nvmet:
fix max_qid race between configfs and controller allocation
nvmet:
fix pre-auth out-of-bounds heap read in Discovery Get Log Page
nvmet:
Introduce nvmet_req_transfer_len()
nvmet:
move async event work off nvmet-wq
nvmet:
preserve device path on allocation failure
nvmet:
use the local P2P device on metadata allocation failure
ocfs2/cluster:
keep heartbeat local node stable
ocfs2/heartbeat:
fix slot mapping rollback leaks on error paths
ocfs2:
add extra consistency checks for chain allocator dinodes
ocfs2:
add suballoc slot check in ocfs2_validate_inode_block()
ocfs2:
Avoid touching renamed directory if parent does not change
ocfs2:
correct l_next_free_rec in online check
ocfs2:
fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
ocfs2:
o2hb: quiesce negotiate handlers and timeout work
ocfs2:
validate DIO orphan slot during inode read
ocfs2:
validate directory-index entry counts when reading metadata
ocfs2:
validate dx_root extent list fields during block read
ocfs2:
validate external xattr entries when reading metadata
ocfs2:
validate fast symlink target during inode read
ocfs2:
validate i_refcount_loc when refcount flag is set
ocfs2:
validate inline xattrs during inode block validation
ocfs2:
validate orphan slot during inode read
octeontx2-af:
Block VFs from clobbering special CGX PKIND state
octeontx2-af:
mcs: Fix SC resource cleanup loop
octeontx2-af:
npc: Fix size of entry2cntr_map
octeontx2-vf:
fix workqueue and netdev race in probe/remove
of/irq:
Fix remaining refcount leaks in of_irq_init()
of/overlay:
don't create "//" paths for fragments targeting the root
of/overlay:
don't leak fragment references when changeset init fails
of/overlay:
only treat a positive changeset id as registered
of/overlay:
put property on deadprops only after changeset add succeeds
of:
device: Export of_device_make_bus_id()
of:
unittest: Fix memory leak in unittest_data_add()
openvswitch:
fix soft lockup in the netlink flow dump
openvswitch:
prepare for stolen verdict coming from conntrack and nat engine
OPP:
Fix race between OPP addition and lookup
optee:
register TEE devices only once fully initialized
ovl:
check access to copy_file_range source with src mounter creds
params:
Do not go over the limit when getting the string length
params:
fix charp corruption on allocation failure
params:
Fix multi-line comment style
params:
Sort headers
params:
Use size_add() for kmalloc()
path:
add cleanup helper
PCI/sysfs:
Add CAP_SYS_ADMIN check to __resource_resize_store()
PCI/sysfs:
Demacrofy pci_dev_resource_resize_attr(n) functions
PCI:
Accept AtomicOps already enabled by the hypervisor
PCI:
Allow per function PCI slots to fix slot reset on s390
PCI:
dwc: ep: Flush MSI-X write before unmapping its ATU entry
PCI:
dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
PCI:
endpoint: Add missing NULL check for alloc_workqueue()
PCI:
endpoint: pci-epf-test: Fix double free that causes kernel to oops
PCI:
endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
PCI:
Fix BAR resize for devices on a root bus
PCI:
Fix dyn_id add TOCTOU
PCI:
Fix Resizable BAR restore order
PCI:
Fix UAF when probe runs concurrent to dyn ID removal
PCI:
imx6: Fix suspend/resume support on i.MX6QDL
PCI:
Initialize temporary device in new_id_store()
PCI:
Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
PCI:
Make pci_match_one_device() match on ID instead of device
PCI:
use generic driver_override infrastructure
pds_core:
Clean up init/uninit flows to be more readable
pds_core:
Don't assign interrupt index/bound_intr to notifyq
pds_core:
fix use-after-free on workqueue during remove
pds_core:
quiesce DMA before freeing resources
perf/core:
Allow list_del during perf_event_overflow()
perf/core:
Fix NULL pmu_ctx passed to pmu->sched_task()
perf/core:
Fix WARN in perf_sigtrap()
perf/core:
Run sched_task() for PMUs with only CPU-wide events
perf/x86/amd/core:
Avoid enabling BRS from the SVM reload path
perf/x86/intel/pt:
Fix stop/start with no update
perf/x86/intel:
Fix GRT PEBS load/store direction for latency events, to fix sample classification
perf/x86/intel:
Prevent drain_pebs() reentry
perf/x86/intel:
Remove anythread_deprecated bit from perf_capabilities
perf/x86/intel:
Update event constraints and cache_extra_regsfor ADL
perf:
Fix addr_filter_ranges lifetime
perf:
Fix hang while freeing sigtrap event
perf:
Fix race between perf_event_exit_task() and perf_pending_task()
perf:
Require kernel access for text poke events
perf:
RISC-V: store available counter mask as bitmap
perf:
Supply task information to sched_task()
pinctrl:
mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction
pinctrl:
mediatek: use devm_gpiochip_add_data() for GPIO chip
pinctrl:
sunxi: keep a shadow copy of the data register output latches
pktgen:
use cpus_read_lock() in pg_net_init()
platform/x86/amd/pmc:
Propagate SMU errors and validate S2D address
platform/x86:
asus-wmi: disable USB0 hub on ROG Ally before suspend
platform/x86:
asus-wmi: fix resource leaks on probe failure
platform/x86:
dell-wmi-base: Fix handling of ultra performance key
platform/x86:
int1092: Fix potential memory leak in sar_probe()
platform/x86:
intel_sar: Check ACPI_HANDLE() against NULL
platform/x86:
ISST: Add a NULL check for sst_inst[]
platform/x86:
ISST: Validate max level for set feature
platform/x86:
ISST: Validate parameter for core power state
platform/x86:
lg-laptop: Fix LED resource handling
pmdomain:
imx8m-blk-ctrl: Serialize power on/off across sibling domains
pmdomain:
rockchip: don't ignore clock lookup errors on attach
pmdomain:
rockchip: fix clock leak on domain probe failure
pmdomain:
rockchip: propagate subdomain add errors
pnfs/blocklayout:
Fix device leaks on parse failure
power:
supply: charger-manager: Convert to platform remove callback returning void
power:
supply: charger-manager: register regulators before exposing sysfs
power:
supply: lp8788-charger: Convert to platform remove callback returning void
power:
supply: lp8788-charger: fix use-after-free on remove
power:
supply: lp8788: Use devm_power_supply_register() helper
power:
supply: max17040: propagate register read errors
power:
supply: qcom_battmgr: fix use-after-free
powerpc/64s:
Fix unmap race with PMD migration entries
powerpc/bpf:
rename powerpc64_jit_data to powerpc_jit_data
powerpc/iommu:
Move pSeries specific functions to pseries/iommu.c
powerpc/kexec_file:
Prevent kexec range truncation
powerpc/pgtable-frag:
Fix bad page state in pte_frag_destroy
powerpc/pseries/iommu:
IOMMU incorrectly marks MMIO range in DDW
powerpc/xive:
add error return value to xive_smp_probe()
powerpc/xive:
propagate IPI init errors to prevent use-after-free
ptp:
Add a upper bound on max_vclocks
ptp:
ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
r8169:
remove original workaround for RTL8125 broken rx issue
rcu:
add rcu_read_lock_dont_migrate()
RDMA/bnxt_re:
Avoid repeated requests to allocate WC pages
RDMA/bnxt_re:
Fix the page details for the srq created by kernel consumers
RDMA/bnxt_re:
Initialize dpi variable to zero
RDMA/counter:
Fix num_counters leak on bind_qp failure in alloc_and_bind()
RDMA/cxgb4:
Fix dereg_skb leak and double free in write_tpt_entry()
RDMA/efa:
Fix use of completion ctx after free
RDMA/erdma:
complete object teardown when the destroy command fails
RDMA/erdma:
Hold QP references for AE and CM processing
RDMA/hns:
Fix double destruction of rsv_qp
RDMA/hns:
Fix log flood after cmd_mbox failure
RDMA/irdma:
Prevent user-triggered null deref on QP create
RDMA/irdma:
Replace waitqueue and flag with completion
RDMA/mlx4:
Fix mis-use of RCU in mlx4_srq_event()
RDMA/mlx5:
Fix a WARN during dereg_mr for DM type
RDMA/mlx5:
Fix implicit ODP use after free
RDMA/mlx5:
Fix the recovery flow of the UMR QP
RDMA/mlx5:
Fix UMR hang in LAG error state unload
RDMA/rvt:
Return NULL after port allocation failure
RDMA/rxe:
Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
RDMA/rxe:
Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
RDMA/rxe:
Merge request and complete tasks
RDMA/rxe:
Remove redundant scheduling of rxe_completer
RDMA/siw:
Fix endpoint/socket association handling
RDMA/siw:
Introduce siw_destroy_cep_sock
RDMA/siw:
Remove direct link to net_device
rds:
sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
rds_tcp:
close NULL deref window in rds_tcp_set_callbacks
reboot:
fix cad_pid use-after-free race
regulator:
ltc3676: don't read the write-only HRST and CLIRQ registers
regulator:
tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
remoteproc:
qcom_wcnss: Fix handling the lack of PD regulators in v3
Revert "ksmbd:
fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev()"
Revert "mm/filemap:
avoid buffered read/write race to read inconsistent data"
Revert "net/smc:
Introduce TCP ULP support"
Revert "wifi:
libertas: reject short monitor TX frames"
RISC-V:
KVM: Add kvm_vcpu_config
RISC-V:
KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr()
RISC-V:
KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()
RISC-V:
KVM: Serialize IMSIC attributes with vCPU migration
RISC-V:
KVM: Teardown riscv specific bits after kvm_exit
RISC-V:
KVM: Write hgatp register with valid mode bits
riscv, bpf:
Fix memory leak in bpf_jit_free
riscv:
kvm: fix vector context allocation leak
riscv:
save the SR_SUM status over switches
rtc:
ac100: Assign .num before accessing .hws
rtc:
dev: zero-initialize struct rtc_wkalrm to prevent information leak
rtc:
mpfs: fix unchecked devm_clk_get() error pointer in probe()
rtc:
rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
rtc:
spear: initialize IRQ state before requesting alarm IRQ
rv:
Use strings in da monitors tracepoints
rxrpc:
proc: size address buffers for %pISpc output
s390/ism:
Fix UAF of sba and ieq during ism_dev_exit()
s390/mm:
Add missing secure storage access fixups for donated memory
s390/mm:
Fix in_atomic() handling in do_secure_storage_access()
s390/pkey:
harmonize pkey s390 debug feature calls
s390/pkey:
Wipe copies of protected- and secure-keys
s390/vfio-ap:
Fix missing lock required to access list of ap_matrix_mdev objects
s390/zcrypt:
Close speculative mem read possibility
s390/zcrypt:
Fix buffer over-read in cca_cipher2protkey
sched/core:
Make core-sched flips wait for in-flight selections
sched/deadline:
Fix missing ENQUEUE_REPLENISH during PI de-boosting
sched/deadline:
Fix task_struct reference leak
sched/psi:
fix race between file release and pressure write
sched:
fix warning in sched_setaffinity
scsi:
ch: Do not keep references to data transfer element devices
scsi:
core: pair EH runtime PM get and put
scsi:
core: wake eh reliably when using scsi_schedule_eh
scsi:
hisi_sas: Add slave_destroy interface for v3 hw
scsi:
imm: Fix use-after-free bug caused by unfinished delayed work
scsi:
lpfc: Change lpfc_vport fc_flag member into a bitmask
scsi:
lpfc: Change nlp state statistic counters into atomic_t
scsi:
lpfc: Define lpfc_dmabuf type for ctx_buf ptr
scsi:
lpfc: Fix failure to delete vports when discovery is in progress
scsi:
lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
scsi:
lpfc: Protect vport fc_nodes list with an explicit spin lock
scsi:
lpfc: Remove shost_lock protection for fc_host_port shost APIs
scsi:
mpi3mr: Debug ability improvements
scsi:
mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
scsi:
mpi3mr: Fix possible crash when setting up bsg fails
scsi:
mpi3mr: Split off bus_reset function from host_reset
scsi:
mpi3mr: Synchronous access b/w reset and tm thread for reply queue
scsi:
qedi: Initialize callback state before registration
scsi:
qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
scsi:
qla2xxx: Clear cmds after chip reset
scsi:
qla2xxx: Completely fix fcport double free
scsi:
qla2xxx: Fix 64G link speed reporting in get_data_rate
scsi:
qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
scsi:
qla2xxx: Fix soft lockup polling continuation IOCB signature
scsi:
qla2xxx: Fix use-after-free of qpair work on queue teardown
scsi:
qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
scsi:
qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
scsi:
qla2xxx: Skip vport under deletion in report ID acquisition
scsi:
qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
scsi:
qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
scsi:
qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
scsi:
qla2xxx: Validate BSG request_len before reading vendor_cmd[]
scsi:
qla2xxx: Zero dport diagnostics buffer to avoid info leak
scsi:
sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
scsi:
ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()
scsi:
ufs: core: Add debug log for MCQ command timeout
scsi:
ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()
scsi:
ufs: core: Convert string descriptor format macros to enum
scsi:
ufs: core: Decouple CQ sweep from request iterator in MCQ
scsi:
ufs: core: Move an assignment in ufshcd_mcq_process_cqe()
scsi:
ufs: core: Validate string descriptors
scsi:
ufs: exynos: Disable iocc if dma-coherent property isn't set
scsi:
ufs: mcq: Remove unused parameters
scsi:
ufs: qcom : Refactor phy_power_on/off calls
scsi:
ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
sctp:
add INIT verification after cookie unpacking
sctp:
check RCV_SHUTDOWN after the sendmsg connect wait
sctp:
copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute
sctp:
disable BH before calling udp_tunnel_xmit_skb()
sctp:
fix addr_wq_timer race in sctp_free_addr_wq()
sctp:
validate cookie AUTH state before use
sctp:
validate embedded INIT chunk and address list lengths in cookie
selftests:
tls: add rekey tests
selftests:
tls: add test with a partially invalid iov
selinux:
allow multiple opens of /sys/fs/selinux/policy
selinux:
fix data race on AVC latest_notif
selinux:
preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
selinux:
reject a permission value exceeding the class permission count
serial:
8250: invert serial8250_register_8250_port() CIR condition
serial:
8250_bcm7271: fix use-after-free in brcmuart_remove()
serial:
8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
serial:
core: clear freed pointers on uart_register_driver() failure
serial:
core: do fallible allocations before the console can be registered
serial:
core: fix infinite loop in handle_tx() for PORT_UNKNOWN
serial:
fix TIOCMIWAIT race
serial:
imx: Convert to platform remove callback returning void
serial:
imx: serialize imx_uart_ports[] lifetime
serial:
ip22zilog: Use port lock wrappers
serial:
ma35d1: Convert to platform remove callback returning void
serial:
ma35d1: Fix clock reference leak in ma35d1serial_probe()
serial:
sc16is7xx: fix TX fifo corruption
serial:
tegra: don't clear the Tx FIFO on an Rx-only reset
serial:
vt8500: Fix clock reference leak in vt8500_serial_probe()
sfc:
fix NULL dereferences in ef100_process_design_param()
sfc:
Implement ndo_hwtstamp_(get|set)
sfc:
rip out MDIO support
shmem:
fix recovery on rename failures
slub, kasan:
improve interaction of KASAN and slub_debug poisoning
smb/client:
fix chown/chgrp with SMB3 POSIX Extensions
smb/client:
fix stale page cache in insert/collapse range
smb/client:
invalidate fscache for fallocate range operations
smb/client:
pass cifs_open_info_data to SMB2_open()
smb/client:
send lease break ACKs thru correct session for multiuser mounts
smb/client:
use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()
smb/client:
validate new EOF for insert range
smb/client:
validate new EOF for zero range
smb/client:
zero-initialize stack-allocated cifs_open_info_data
smb/server:
fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
smb/server:
fix session leak in ksmbd_session_register()
smb/server:
fix tree connection leak in smb2_tree_connect()
smb:
client: allocate crypto only for primary server
smb:
client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
smb:
client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
smb:
client: close completed creates on compound wait errors
smb:
client: close handle after create-context parsing failure
smb:
client: discard post-EOF pagecache when extending a file via zero range
smb:
client: fail DACL rewrite when the new DACL exceeds 64K
smb:
client: fix cifsFileInfo reference leak in deferred close
smb:
client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
smb:
client: fix OOB struct field reads in move_smb2_ea_to_cifs()
smb:
client: fix reparse buffer bounds in cifs_query_reparse_point()
smb:
client: fix UAF in decryption with multichannel
smb:
client: fix use-after-free of iface in cifs_try_adding_channels()
smb:
client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
smb:
client: honor forceuid/forcegid when mapping SIDs to uid/gid
smb:
client: let recv_done verify data_offset, data_length and remaining_data_length
smb:
client: only require read lease for size-extending preallocate
smb:
client: reject a tree connect response whose byte count is too small
smb:
client: split cifsFileInfo bitfields to avoid shared-byte RMW races
smb:
client: use finish_no_open() for non-regular inodes
smb:
mark the new channel addition log as informational log with cifs_info
soc/xilinx:
zynqmp_power: Convert to platform remove callback returning void
soc:
aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
soc:
qcom: geni-se: Correct QUP Core ICC vote constants
soc:
xilinx: Shutdown and free rx mailbox channel
sock:
add sock_kmemdup helper
sockmap:
Fix use-after-free in udp_bpf_recvmsg()
soundwire:
fix bug in sdw_add_element_group_count found by syzkaller
spi:
microchip-core-qspi: control built-in cs manually
spi:
mpc52xx: fix controller deregistration
spi:
mpc52xx: fix use-after-free on registration failure
spi:
mpc52xx: switch to use modern name
spi:
oc-tiny: switch to managed controller allocation
spi:
spi-dw-dma: fix print error log when wait finish transaction
spi:
tegra210-quad: Protect curr_xfer check in IRQ handler
spi:
use generic driver_override infrastructure
srcu:
Use irq_work to start GP in tiny SRCU
staging:
rtl8723bs: clean up redundant & parentheses
Staging:
rtl8723bs: Delete dead code from update_current_network()
staging:
rtl8723bs: fix buffer over-read in rtw_update_protection
staging:
rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
staging:
rtl8723bs: fix spacing around operators
staging:
rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
Staging:
rtl8723bs: Remove dead code from _rtw_free_network()
staging:
rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
staging:
sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
strparser:
make sure __strp_recv isn't running before tearing down the parser
SUNRPC:
fix gssx_dec_option_array error path bugs
sunrpc:
fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
SUNRPC:
reject duplicate CREDS_VALUE options
SUNRPC:
Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
sunrpc:
xprtrdma: Use ERR_CAST() to return
super:
make iterate_supers_type() deletion-safe
svcrdma:
Handle ADDR_CHANGE CM event properly
svcrdma:
Refactor the creation of listener CMA ID
svcrdma:
Reject connection when transport allocation fails
svcrdma:
Reject inline replies that overflow the pull-up buffer
svcrdma:
Reject Read lists that exceed the page budget
svcrdma:
Reject Write/Reply chunks with segcount 0
svcrdma:
Use svc_xprt_put to free listener on create failure
svcrdma:
Validate Read chunk positions before reconstruction
swiotlb:
fix default_swiotlb_limit() for non-growable default pool
tap:
fix stack info leak in tap_ioctl() SIOCGIFHWADDR
tap:
Keep hdr_len in tap_get_user()
tcp:
clamp route advmss to TCP_MIN_MSS
tcp:
introduce icsk->icsk_keepalive_timer
tcp:
prevent collapsing skbs across boundary in rtx queue
tcp:
refresh TS.Recent for accepted old ACKs
tcp:
secure_seq: add back ports to TS offset
tcp:
use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
tcp_metrics:
use dst_dev_net_rcu()
team:
avoid NETDEV_CHANGEMTU event when unregistering slave
thermal:
hwmon: Remove hwmon class device along with its parent
thunderbolt:
Disable CL states for the Anker Prime TB5 dock
thunderbolt:
Fix KASAN reported use-after-free when request is canceled
thunderbolt:
Reject oversized XDomain properties responses
time/namespace:
Validate nanosecond field in proc_timens_set_offset()
tipc:
avoid busy looping in tipc_exit_net()
tipc:
destroy topsrv workqueues before closing connections
tipc:
Dont send random pad bytes in RESET/ACTIVATE messages
tipc:
fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
tipc:
hold a reference to nodes found by link name
tipc:
prevent GCM nonce reuse on peer key changes
tipc:
serialize udp bearer replicast list updates
tls:
rx: restore msg_iter before TLS 1.3 optimistic retry
tools:
ynl: extend netdev sample to dump xdp-rx-metadata-features
trace/fgraph:
Fix the warning caused by missing unregister notifier
tracing/probes:
Fix anon_stack check for unnamed bitfields in btf_find_struct_member
tracing/probes:
Remove WARN_ON_ONCE from parse_btf_arg
tracing:
Fix memory corruption from a "STACKTRACE" histogram key
tracing:
Set the trace clock before registering the histogram trigger
tracing:
Take the reference before publishing the named histogram trigger
tracing:
Take trace_array reference when opening a tracer options file
tracing:
Take trace_array reference when opening options file
tracing:
Undo the registration when enabling the histogram trigger fails
tty:
abort break signalling on hangup
tty:
add break_wait kernel-doc
tty:
amiserial: fix broken TIOCMIWAIT
tty:
fix saved termios reset race
tty:
n_gsm: fix missing modem controls after DLCI open in convergence layer type 2
tty:
port: fix tty_port_tty_vhangup() race
tty:
serial: 8250: protect against NULL uart->port.dev in register
tty:
serial: ip22zilog: Use platform device for probing
tty:
serial: max3100: shut down timer before freeing port
tty:
serial: qcom_geni_serial: Keep console RX functional after deep idle
tty:
skip cdev_del() when no cdev is registered
tty:
tty_port: restore TTY_IO_ERROR on activation failure
tty:
vcc: hold port lock when clearing tty pointer in vcc_cleanup
tty:
vcc: zero-initialize control packet in vcc_send_ctl()
tty:
vt: fix memory leak in vc_allocate()
types:
move struct rcuwait into types.h
ublk:
check import_ubuf() return value
ublk:
fix handling recovery & reissue in ublk_abort_queue()
udf:
Fix data loss when converting inline inodes to out of line
udmabuf:
change folios array from kmalloc to kvmalloc
udmabuf:
fix memory leak on last export_udmabuf() error path
udp:
Deal with race between UDP socket address change and rehash
um:
fix time-travel syscall scheduling hack
USB:
cdc-acm: fix racy TIOCMIWAIT implementation
USB:
cdc-acm: skip URB restart in port_shutdown if disconnected
usb:
cdns3: Fix NULL pointer dereference in cdns3_pci_probe
usb:
cdns3: fix use-after-free in cdns3_gadget_exit()
usb:
chipidea: tegra: disable runtime PM on resume failure
usb:
chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
usb:
core: clear both ep_in and ep_out for non-ep0 control endpoints
USB:
dwc2: shut down wakeup timer before freeing HCD state
usb:
dwc3: am62: Fix runtime PM usage count leak on probe error path
usb:
dwc3: clear forceRM when issuing EndTransfer
usb:
dwc3: gadget: fix IRQ storm on invalid event buffer count
usb:
dwc3: gadget: Reinitiate stream for all host NoStream behavior
usb:
f81604: fix struct f81604_int_data size mismatch
usb:
gadget: aspeed-vhub: cancel wake work on device removal
usb:
gadget: at91_udc: Convert to platform remove callback returning void
usb:
gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
USB:
gadget: dummy-hcd: Fix wait for outstanding request completions
usb:
gadget: f_ecm: Fix net_device lifecycle with device_move
usb:
gadget: f_eem: Fix net_device lifecycle with device_move
usb:
gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
usb:
gadget: f_fs: Fix Use-After-Free in AIO error path
usb:
gadget: f_hid: don't call cdev_init while cdev in use
usb:
gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
usb:
gadget: f_midi: Annotate struct f_midi with __counted_by
usb:
gadget: f_midi: initialize work in f_midi_alloc()
usb:
gadget: f_rndis: Fix net_device lifecycle with device_move
usb:
gadget: f_subset: Fix net_device lifecycle with device_move
usb:
gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
USB:
gadget: ffs: fix mm lifetime handling
usb:
gadget: functionfs: Factorize wait-for-endpoint code
usb:
gadget: midi2: Fix the jack descriptor array sizes
usb:
gadget: Support already-mapped DMA SGs
usb:
gadget: uac: validate rate list length before storing
usb:
hub: use shorter 120ms post resume hold for SS root hubs
USB:
iowarrior: fix use-after-free on disconnect race
usb:
octeon-hcd: fix the FIFO-flush timeout computation
usb:
ohci-da8xx: disable controller wakeup on cleanup
usb:
ohci-s3c2410: disable controller wakeup on removal
usb:
ohci-spear: disable controller wakeup on removal
usb:
ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()
usb:
ohci-st: disable controller wakeup on removal
USB:
serial: cp210x: add Corsair AX1500i Power Supply
USB:
serial: fix driver deregistration order
USB:
serial: fix dynamic id driver deregistration race
USB:
serial: fix ioctl hangup race
USB:
serial: fix port tear down use-after-free
USB:
serial: option: add Compal EXC-T1 support
USB:
serial: option: add Compal EXM-G1x support
USB:
serial: option: add Quectel EG060W
USB:
serial: option: add Quectel RG660QB
USB:
serial: option: add support for SIMCom SIM8260C
USB:
serial: quatech2: fix baud rate overflow
USB:
serial: ssu100: fix baud rate overflow
usb:
storage: realtek_cr: fix use-after-free on disconnect
usb:
storage: sierra_ms: reject short SWoC info transfers
usb:
typec: anx7411 - stop the IRQ before destroying the workqueue
usb:
typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
usb:
typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
usb:
typec: tcpm: fix debug accessory mode detection for sink ports
usb:
typec: tcpm: recover after failure to start the frs ams
usb:
typec: tcpm: validate VDO count in Discover Identity ACK handlers
usb:
typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
usb:
typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
usb:
typec: ucsi: displayport: Current CAM OOB index fixup
usb:
typec: ucsi: Get the connector fwnode based on reg value
vc_screen:
reload vc pointer before if (ret) in vcs_write() to avoid UAF
vdpa:
use generic driver_override infrastructure
vduse:
validate virtqueue alignment
veth:
fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
vfio/mlx5:
Fix an unwind issue in mlx5vf_add_migration_pages()
vfs:
make LAST_XXX private to fs/namei.c
vhost-vdpa:
protect config_ctx from being freed under the config callback
vhost:
correct misleading printing information
vhost:
fix vhost_get_avail_idx for a non empty ring
vhost:
invalidate vring access on IOTLB transitions
vhost:
move smp_rmb() into vhost_get_avail_idx()
vhost:
move vdpa group bound check to vhost_vdpa
vhost_iotlb:
bound map allocation in add_range
virt:
acrn: Fix irqfd use-after-free during eventfd shutdown
virtio-mmio:
Remove virtqueue list from mmio device
virtio:
break and reset virtio devices on device_shutdown()
virtio:
hookup irq_get_affinity callback
virtio:
make virtio_bus const
virtio_mmio:
disable IRQ wake before free_irq
virtio_ring:
fix stale descriptor flags after a failed packed add
virtiofs:
use pages instead of pointer for kernel direct IO
vlan:
require the MAC header to be present in __vlan_insert_inner_tag()
vsock:
don't check the listener's sk_err in vsock_accept()
vt:
skip screen update for DEC alignment test on backgroup consoles
vxlan:
Fix NPD in {arp,neigh}_reduce() when using nexthop objects
vxlan:
Fix NPD when refreshing an FDB entry with a nexthop object
vxlan:
fix reading neigh ha
vxlan:
initialize _md in vxlan_xmit_one()
watchdog:
at91sam9_wdt: prevent timer rearm during teardown
wifi:
ath11k: add support to select 6 GHz regulatory type
wifi:
ath11k: cancel SSR work items during PCI shutdown
wifi:
ath11k: fix memory leaks in beacon template setup
wifi:
ath11k: fix misspelling of "dma" in num_rxmda_per_pdev
wifi:
ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
wifi:
ath11k: fix stride mismatch in mac_phy_caps_parse()
wifi:
ath11k: mac: fix struct ieee80211_sband_iftype_data handling
wifi:
ath11k: reset ar->num_stations on hardware start
wifi:
ath11k: update channel list in reg notifier instead reg worker
wifi:
ath12k: avoid explicit HW conversion argument in Rxdma replenish
wifi:
ath12k: avoid explicit mac id argument in Rxdma replenish
wifi:
ath12k: avoid explicit RBM id argument in Rxdma replenish
wifi:
ath12k: Avoid explicit type cast in monitor status parse handler
wifi:
ath12k: Avoid memory leak while enabling statistics
wifi:
ath12k: copy M3 firmware when reusing the buffer
wifi:
ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850
wifi:
ath12k: fix incorrect TID updation in DP monitor status path
wifi:
ath12k: fix invalid access to memory
wifi:
ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
wifi:
ath12k: Fix MSDU buffer types handling in RX error path
wifi:
ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
wifi:
ath12k: fix reusing m3 memory
wifi:
ath12k: fix stride mismatch in mac_phy_caps_parse()
wifi:
ath12k: fix struct hal_rx_phyrx_rssi_legacy_info
wifi:
ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
wifi:
ath12k: refactor DP Rxdma ring structure
wifi:
ath12k: Remove unnecessary (void*) conversions
wifi:
brcmfmac: fix P2P action frame handling without device vif
wifi:
brcmfmac: fix P2P device removal race in brcmf_detach()
wifi:
cfg80211: add link_station_info structure to support MLO statistics
wifi:
cfg80211: avoid double free if updating BSS fails
wifi:
cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
wifi:
cfg80211: preserve hidden-group beacon IE ownership
wifi:
cfg80211: reject duplicate wiphy cipher suite entries
wifi:
cfg80211: release locks on error in cfg80211_wext_siwgenie()
wifi:
cfg80211: stop PMSR before P2P and NAN teardown
wifi:
cfg80211: use wiphy work for socket owner autodisconnect
wifi:
cw1200: fix TX padding OOB read leaking heap data to device
wifi:
fix leak if split 6 GHz scanning fails
wifi:
ieee80211: validate MLE common info length
wifi:
iwlegacy: 3945: free EEPROM data on remove
wifi:
iwlwifi: don't warn when if there is a FW error
wifi:
iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
wifi:
iwlwifi: dvm: pair transport op-mode enter/leave
wifi:
iwlwifi: fix 22000 series SMEM parsing
wifi:
iwlwifi: Fix error code in iwl_op_mode_dvm_start()
wifi:
iwlwifi: mvm: fix P2P-Device binding handling
wifi:
iwlwifi: mvm: remove mvm prefix from iwl_mvm_tx_resp*
wifi:
iwlwifi: mvm: validate TX_CMD response layout
wifi:
iwlwifi: pcie: null RX pointers after free
wifi:
iwlwifi: return ERR_PTR from opmode start()
wifi:
libipw: reject TKIP frames without a full MIC
wifi:
mac80211: account proxy paths against the mesh path limit
wifi:
mac80211: Add 802.3 multicast encapsulation offload support
wifi:
mac80211: Add multicast to unicast support for 802.3 path
wifi:
mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()
wifi:
mac80211: capture fast-RX rate before mesh reuses skb->cb
wifi:
mac80211: count only matching reservations in reserved switch
wifi:
mac80211: defer link RX stats percpu free to RCU
wifi:
mac80211: don't call ieee80211_handle_reconfig_failure when not needed
wifi:
mac80211: don't WARN for connections on invalid channels
wifi:
mac80211: drain PS delivery work during station teardown
wifi:
mac80211: fix mesh fast xmit path deletion UAF
wifi:
mac80211: fix missing RX bitrate update for mesh forwarding path
wifi:
mac80211: handle empty FILS association request payload
wifi:
mac80211: ibss: wait for in-flight TX on disconnect
wifi:
mac80211: keep fallback association elements alive
wifi:
mac80211: keep paired old chanctx alive
wifi:
mac80211: minstrel_ht: validate fixed rate index
wifi:
mac80211: prevent AP VLAN tx from other interfaces
wifi:
mac80211: refactor populating mesh related fields in sinfo
wifi:
mac80211: release mesh path quota on failed additions
wifi:
mac80211: set info->band for 802.3 encap offload frames
wifi:
mac80211: shut down RX BA session timer on teardown
wifi:
mt76: cancel reset and rc work on device unregister
wifi:
mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
wifi:
mt76: fix non-AQL packet accounting for MLO stations
wifi:
mt76: mt7603: initialize global station WCID
wifi:
mt76: mt7915: allocate vif wcid in the same range as stations
wifi:
mt76: mt7915: bound the device EEPROM address before the EFUSE copy
wifi:
mt76: mt7915: Fix an error handling path in mt7915_add_interface()
wifi:
mt76: mt7915: fix list corruption after hardware restart
wifi:
mt76: mt7915: set correct background radar capability
wifi:
mt76: mt7915: unwind state on add_interface failure
wifi:
mt76: mt7921: Place upper limit on station AID
wifi:
mt76: mt792x: pick the SAR table layout from the table itself
wifi:
mt76: mt792x: treat 0xff ACPI SAR entries as no limit
wifi:
mt76: mt7996: bound the device EEPROM address before the EFUSE copy
wifi:
mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
wifi:
mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
wifi:
mt76: mt7996: validate RX band_idx before dereferencing phys[]
wifi:
nl80211: check link is beaconing for color change
wifi:
nl80211: clean up color-change beacon data on errors
wifi:
rtl8xxxu: fix use-after-free from rx_urb_wq on stop
wifi:
rtw88: debugfs: support multiple adapters debugging
wifi:
rtw88: Use devm_kmemdup() in rtw_set_supported_band()
wifi:
rtw89: fix race between cancel_hw_scan and hw_scan completion
wifi:
rtw89: pci: validate sequence number of TX release report
wifi:
wcn36xx: Fix potential use-after-free in TX ack timer teardown
wifi:
wfx: validate MIB read length before copying to caller
wifi:
wlcore: Convert to platform remove callback returning void
wifi:
wlcore: Fix runtime PM leak in wlcore_remove()
wireguard:
noise: reject response consumption after intermediate initiation
wireguard:
queueing: preserve tstamp_type when encapsulating packet
workqueue:
Fix NULL current_pwq deref in chained work check
x86-64:
rename misleadingly named '__copy_user_nocache()' function
x86/CPU/AMD:
Clear virtualized VMLOAD/VMSAVE on Zen4 client
x86/xen:
fix init of balloon stats again
xen/balloon:
improve accuracy of initial balloon target for dom0
xen/netfront:
don't leak the skb when xennet_fill_frags() fails
xen/netfront:
drop RX packets with a short Ethernet header
xen/pvcalls:
bound backend response req_id before indexing rsp[]
xen:
fix UAF in dmabuf_exp_from_pages()
xfrm:
account XFRMA_IF_ID in aevent size calculation
xfrm:
fix stale skb->prev after async crypto steals a GSO segment
xfrm:
hold dev ref until after transport_finish NF_HOOK
xfrm:
hold device only for the asynchronous decryption
xfrm:
prevent policy_hthresh.work from racing with netns teardown
xfs:
catch stale AGF/AGF metadata
xfs:
factor out stale buffer item completion
xfs:
fix cursor and pointer handling when recovering iunlink buckets
xfs:
fix unmount hang with unflushable inodes stuck in the AIL
xfs:
rearrange code in xfs_buf_item.c
xfs:
remove xfs_attr_leaf_hasname
xfs:
xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
xprtrdma:
Fix ep kref imbalance on ADDR_CHANGE
xsk:
fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
zram:
fix out-of-bounds access in read_block_state()
zram:
fix out-of-bounds access in writeback_store()
zram:
fixup read_block_state()
zram:
set default primary compressor in zram_destroy_comps()