Merge tag 'v6.18.52' into qcom-6.18.y - #1158
Open
nsiddams (nsiddams) wants to merge 3232 commits into
Open
nsiddams (nsiddams) wants to merge 3232 commits into
nsiddams (nsiddams) wants to merge 3232 commits into
Conversation
[ Upstream commit 984f831 ] The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so validate_nla() accepts a payload shorter than the address. The GROUP consumer reads it with nla_get_in_addr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing kernel memory. Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width. Fixes: f9c4bb0 ("vxlan: vni filtering support on collect metadata device") Reported-by: Weiming Shi <bestswngs@gmail.com> Signed-off-by: Xiang Mei <xmei5@asu.edu> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260812215341.763123-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 7b196e2 ] mv88e6352_pcs_link_check() ignores errors returned by port_get_cmode(). If the port status register read fails, mv88e6352_port_get_cmode() returns without setting cmode. The link check then compares an uninitialized value and may incorrectly treat the PCS as active. Save the return value and fail the link check after releasing the register lock. marvell_c22_pcs_get_state() initializes the reported link state to down before calling the check, so a read failure is handled safely until a later poll succeeds. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 8576455 ("net: dsa: mv88e6xxx: convert 88e6352 to phylink_pcs") Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Reviewed-by: Vladimir Oltean <olteanv@gmail.com> Link: https://patch.msgid.link/20260813153131.3952970-1-ruoyuw560@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 9466ef3 ] The TCP receive queue can hold adjacent skbs whose sequence ranges overlap. The tls fast-path reads the record header with skb_copy_bits() by byte offset, which assumes skbs do not overlap, so a header split across the overlap is misread and the connection aborts (-EMSGSIZE/-EINVAL). tls_strp_check_queue_ok() detects such overlaps but only ran after the header was parsed, never covering the header itself. Observed with parallel kTLS connections on: - ConnectX-7 + IPsec crypto offload + GRO - VirtIO (8 queues) + GRO Fixes: 84c61fe ("tls: rx: do not use the standard strparser") Signed-off-by: Maximilian Immanuel Brandtner <maxbr@linux.ibm.com> Link: https://patch.msgid.link/20260813121337.3300688-1-maxbr@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 21040c7 ] A notification should be emitted only when the vlan delete was successful and not otherwise. The proper check is if br/nbp_vlan_delete returned 0. Fixes: f545923 ("net: bridge: vlan: notify on vlan add/delete/change flags") Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260814141640.64958-1-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 4deb3ed ] Since commit 053fc4f ("fuse: fix UAF in rcu pathwalks"), fuse_conn_put() frees the fuse_conn through call_rcu() rather than synchronously. For cuse, fc->release is cuse_fc_release(), which lives in the cuse module. If the module is removed before the RCU grace period ends, the callback jumps into freed module memory: userspace / module unload | RCU softirq ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ close(/dev/cuse) | cuse_channel_release() | fuse_dev_release() | fuse_conn_put(fch->conn) | call_rcu(delayed_release) ------+---> callback queued | rmmod cuse | cuse_exit() | cuse_channel_destroy() | ... | return | | <module text freed> | | rcu_do_batch() | delayed_release() | fc->release() | -> cuse_fc_release() | ^^^ freed text! The freed module text is unmapped by vfree(), so the jump into the stale callback triggers a page-fault Oops. If the virtual address is subsequently reused, the callback could execute unrelated code (undefined behaviour). Fix this by calling rcu_barrier() in cuse_exit() so that any pending fuse_conn release callback completes before the module is removed. Fixes: 053fc4f ("fuse: fix UAF in rcu pathwalks") Signed-off-by: Baokun Li <libaokun@linux.alibaba.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit de603b9 ] read_log_rec_buf() copies a log record into a caller buffer starting at u32 off = lsn_to_page_off(log, lsn) + log->record_header_len; log->record_header_len (and log->data_off, used for the following pages) comes verbatim from the on-disk restart area and is only checked for 8-byte alignment in is_rst_area_valid(), so off can exceed log->page_size. "tail = log->page_size - off" then underflows and memcpy() reads past the page_size-sized buffer returned by read_log_page(), spilling adjacent slab memory into the replay buffer. This is reachable by mounting a crafted NTFS image: BUG: KASAN: slab-out-of-bounds in read_log_rec_buf+0x216/0x580 Read of size 64 at addr ffff88800a877ff8 by task exploit/127 read_log_rec_buf fs/ntfs3/fslog.c:2299 log_replay fs/ntfs3/fslog.c:4216 ntfs_loadlog_and_replay fs/ntfs3/fsntfs.c:324 ntfs_fill_super fs/ntfs3/super.c:1392 get_tree_bdev_flags fs/super.c:1694 __x64_sys_mount fs/namespace.c:4360 The buggy address is located 4088 bytes to the right of the 4096-byte region [ffff88800a876000, ffff88800a877000) Reject an in-page offset outside the current page before the copy. Fixes: b46acd6 ("fs/ntfs3: Add NTFS journal") Assisted-by: Claude:claude-opus-4-8 Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> [almaz.alexandrovich@paragon-software.com: replaced the >= sign with >] Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c22f91d ] When an EA record has a non-zero ef->size, ntfs_read_ea() only checks that the record fits in the remaining buffer (ea_size > bytes), not that ef->size is large enough to hold the record's own name_len + 1 + elength. A crafted image can pass validation with, e.g., ef->size = 24 but elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of the undersized record, reading past the kmalloc(info->size) allocation and leaking heap memory to userspace via getxattr(): BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302) Read of size 65535 at addr ffff888100794550 by task exploit __asan_memcpy (mm/kasan/shadow.c:105) ntfs_get_ea (fs/ntfs3/xattr.c:302) ntfs_getxattr (fs/ntfs3/xattr.c:848) __vfs_getxattr (fs/xattr.c:441) vfs_getxattr (fs/xattr.c:474) do_getxattr (fs/xattr.c:800) path_getxattrat (fs/xattr.c:868) do_syscall_64 (arch/x86/entry/syscall_64.c:94) The buggy address is located 80 bytes inside of allocated 84-byte region in cache kmalloc-96 Compute the size the record needs and require ef->size to cover it. Fixes: 0e8235d ("fs/ntfs3: Check fields while reading") Reported-by: Xiang Mei <xmei5@asu.edu> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi <bestswngs@gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c6441be ] When CONFIG_QCOM_UBWC_CONFIG=n, compiler needs to know the definition of ERR_PTR otherwise there will be a compilation error: In file included from drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp_v13.c:7: ./include/linux/soc/qcom/ubwc.h: In function ‘qcom_ubwc_config_get_data’: ./include/linux/soc/qcom/ubwc.h:45:16: error: implicit declaration of function ‘ERR_PTR’ [-Wimplicit-function-declaration] Fix this by including <linux/err.h> Fixes: 1924272 ("soc: qcom: Add UBWC config provider") Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com> Tested-by: Nathan Chancellor <nathan@kernel.org> # build Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 928f659 ] fuse_iget() can return NULL when its inode allocation fails, but fuse_fill_super_submount() passed the result straight to get_fuse_inode() and decremented fi->nlookup without checking it: root = fuse_iget(sb, parent_fi->nodeid, ...); fi = get_fuse_inode(root); fi->nlookup--; Inside fuse_iget() the inode allocation can fail and return NULL. The submount root takes the iget5_locked() path, whose alloc_inode() can fail under memory pressure (the auto-submount branch can fail the same way in new_inode() or fuse_alloc_submount_lookup()): inode = iget5_locked(sb, nodeid, fuse_inode_eq, fuse_inode_set, &nodeid); if (!inode) return NULL; A NULL root makes get_fuse_inode() a container_of() on NULL and the nlookup decrement a write to a bogus address, oopsing the mount. With CONFIG_KASAN the following null pointer dereference is reported when the root inode allocation of an auto-submount fails (e.g. under memory pressure): ================================================================== BUG: KASAN: null-ptr-deref in fuse_get_tree_submount+0x656/0x8b0 Read of size 8 at addr 00000000000002b0 by task ls/942 CPU: 0 PID: 942 Comm: ls Tainted: G W 6.6 qualcomm-linux#15 Call Trace: <TASK> fuse_get_tree_submount+0x656/0x8b0 vfs_get_tree+0x48/0x140 fc_mount+0x13/0x50 fuse_dentry_automount+0x7a/0xb0 __traverse_mounts+0xca/0x330 step_into+0x339/0xac0 path_lookupat+0xc5/0x2f0 filename_lookup+0x163/0x2a0 vfs_statx+0xd5/0x200 do_statx+0x83/0xd0 __x64_sys_statx+0xa0/0xc0 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x78/0xe2 </TASK> ================================================================== Return -ENOMEM instead; the caller tears down the partially built superblock on error, matching the other error returns in this function. Fixes: 1866d77 ("fuse: Allow fuse_fill_super_common() for submounts") Signed-off-by: Baokun Li <libaokun@linux.alibaba.com> Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c139e7e ] print_conn_list() compares the raw hardware connection list with the connection list cached by the HDA driver. When they differ, it prints an additional "In-driver Connection" line so that /proc/asound/card*/codec#* shows the topology actually used by the driver. The comparison currently passes conn_len directly to memcmp(). However, conn_len is a number of connection-list entries, while memcmp() expects a size in bytes. Both list and conn are arrays of hda_nid_t, which is u16, so only half of the connection data is compared. For example, for two-entry lists such as: hardware: 0x0c 0x0d cached: 0x0c 0x0e conn_len is 2, and the current comparison checks only the first hda_nid_t. The lists are therefore incorrectly treated as identical even though the second connection differs. This can happen legitimately when codec fixups replace a cached connection list with snd_hda_override_conn_list(). The codec routing used by the driver is not affected, but the proc output can hide the overridden driver-visible routing and provide misleading topology information during codec debugging. Convert the entry count to a byte size so that memcmp() covers the complete connection list. Fixes: 8b2c7a5 ("ALSA: hda - Add In-driver connection info") Signed-off-by: Xu Rao <raoxu@uniontech.com> Link: https://patch.msgid.link/7B802A4E225CC808+20260818083808.2735120-1-raoxu@uniontech.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit bc2dc66 ] vxlan_mdb_flush() iterates over the MDB entries using hlist_for_each_entry_safe(), which only tolerates the removal of the current entry. Contrary to the comment above the loop, the removal of an entry can trigger the removal of another entry. Flushing the remotes of a (*, G) entry also removes the (S, G) entries that were created for its source list, once they are left without remotes: vxlan_mdb_remotes_flush() -> vxlan_mdb_remote_del() -> vxlan_mdb_remote_srcs_del() -> vxlan_mdb_remote_src_del() -> vxlan_mdb_remote_src_fwd_del() -> __vxlan_mdb_del() -> vxlan_mdb_entry_put() Such an entry can be located after the (*, G) entry in the list, as vxlan_mdb_entry_get() returns an existing entry without moving it to the head of the list. This order is obtained by adding the (S, G) entry before the (*, G) entry, the latter with NLM_F_REPLACE, as the addition of the source otherwise fails with -EEXIST. The (S, G) entry is then the entry saved by hlist_for_each_entry_safe() and it is freed while the (*, G) entry is processed. The next iteration calls hlist_del() on it again, writing LIST_POISON1 to LIST_POISON2 [1]. Besides device deletion, the flush is also reachable from RTM_DELMDB with NLM_F_BULK. Fix by re-reading the next entry after the remotes were flushed. The current entry cannot be removed by this flush, as source lists can only be configured on (*, G) entries and the removed entries are (S, G) entries. It is therefore still linked and its next pointer reflects the removals. [1] BUG: KASAN: wild-memory-access in vxlan_mdb_entry_put.part.0+0x328/0x588 Write of size 8 at addr dead000000000122 by task ip/327 CPU: 3 UID: 1000 PID: 327 Comm: ip Not tainted 7.2.0-rc7 qualcomm-linux#2 PREEMPT Call trace: vxlan_mdb_entry_put.part.0+0x328/0x588 vxlan_mdb_flush+0x1d8/0x25c vxlan_mdb_fini+0x8c/0x100 vxlan_uninit+0x1c/0x7c unregister_netdevice_many_notify+0x954/0xd4c rtnl_dellink+0x210/0x530 rtnetlink_rcv_msg+0x434/0x4d0 netlink_rcv_skb+0xc4/0x204 rtnetlink_rcv+0x18/0x24 netlink_unicast+0x4b8/0x548 netlink_sendmsg+0x29c/0x560 ____sys_sendmsg+0x390/0x3ec ___sys_sendmsg+0x114/0x188 __sys_sendmsg+0xf0/0x178 __arm64_sys_sendmsg+0x48/0x60 invoke_syscall.constprop.0+0x58/0x180 el0_svc_common.constprop.0+0x74/0x140 do_el0_svc+0x30/0x40 el0_svc+0x38/0x98 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Fixes: a3a48de ("vxlan: mdb: Add MDB control path support") Signed-off-by: Baul Lee <baul.lee@xbow.com> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260814153547.29567-1-baul.lee@xbow.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit cb7643b ] On QEMU rtl8139 model, frames that arrive while the interface is suspended still end up in the stack after resume. With pm_test=devices, which keeps devices suspended for 5s, 200 frames sent to interface during that time and 50 frames after resume, eth0 reports 113 received frames. cp_suspend() is supposed to stop receiver and the transmitter, but the mask is wrong: (~RxOn | ~TxOn) is ~0, nothing is cleared and Cmd still reads 0x0d when cp_suspend() returns. Use ~(RxOn | TxOn) so both bits are actually cleared. Fixes: 1da177e ("Linux-2.6.12-rc2") Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260817043057.20099-1-kmehltretter@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8acf691 ] smc_sk_init() calls sk->sk_prot->hash(sk) before several fields are fully initialised: clcsock_release_lock, the saved clcsk_* callbacks, use_fallback/fallback_rsn, and conn.close_work. Once hash() returns the socket is visible to concurrent hash walkers, which can then observe uninitialised state. Move hash(sk) to the end of smc_sk_init() so the socket is published only after it is fully constructed. Fixes: d0e3565 ("net/smc: refactoring initialization of smc sock") Reviewed-by: Hidayath Khan <hidayath@linux.ibm.com> Reviewed-by: Sidraya Jayagond <sidraya@linux.ibm.com> Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com> Link: https://patch.msgid.link/20260813074315.554926-1-mjambigi@linux.ibm.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 5ab078e ] The get_instance_id() macro walks the per-type attribute array with 'i <= instances_count'. Each array is allocated with exactly instances_count entries, so the valid range is [0, instances_count) and the last iteration reads one element past the end. On a name miss that out-of-bounds attribute_name is handed to strcmp(), which reads on until it finds a NUL byte. Every kobject in these ksets is built from an entry that was populated, so a miss does not look reachable from sysfs today. The bound is wrong either way and the read is out of bounds. The matching macro in hp-bioscfg carried the same off-by-one and was corrected by commit 2515071 ("platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro"). That macro takes a kobject pointer out of the out-of-bounds element and dereferences it, so it could fault. This one reads a char array. Use '<' to match the allocation. Fixes: e8a60aa ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems") Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260814132535.4169956-1-sammiee5311@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 98f28d8 ] A common pattern in epoll network servers is to eagerly accept all pending connections from the non-blocking listening socket after epoll_wait indicates the socket is ready by calling accept in a loop until EAGAIN is returned indicating that the backlog is empty. Scheduling a timeout for a non-blocking accept with an empty backlog meant AF_VSOCK sockets used by epoll network servers incurred hundreds of microseconds of additional latency per accept loop compared to AF_INET or AF_UNIX sockets. Signed-off-by: Laurence Rowe <laurencerowe@gmail.com> Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Link: https://patch.msgid.link/20260402204918.130395-1-laurencerowe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Stable-dep-of: b8c899c ("vsock: don't check the listener's sk_err in vsock_accept()") Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b8c899c ] Syzbot reported an issue which can be reproduced with these steps: r0 = socket(AF_VSOCK, SOCK_STREAM, 0) bind(r0, {VMADDR_CID_ANY, PORT}) connect(r0, {VMADDR_CID_LOCAL, PORT}) -> -1, EPROTO (self-connect) listen(r0, backlog) -> 0 r1 = socket(AF_VSOCK, SOCK_STREAM, 0) connect(r1, {VMADDR_CID_LOCAL, PORT}) -> 0 accept(r0) -> -1, EPROTO (stale sk_err) Basically, it creates a socket (r0) and triggers a self-connect after binding it. This self-connect fails with EPROTO because it loops back to r0 while the socket is still in the TCP_SYN_SENT state, causing it to be incorrectly dispatched to the connecting-client path. The unexpected packet type encountered there sets sk_err to EPROTO. After that, it invokes a listen() call on the same socket. This listen() call succeeds because the kernel's listening path never inspects or clears sk_err. Then, a new socket (r1) is created as a normal client and connects to r0. However, vsock_accept() rejects this incoming connection because the listener's sk_err still holds the EPROTO error from the earlier failed self-connect. This rejection causes the child socket created for r1's connection to never be freed on virtio or hyperv transports; only the VMCI transport implements pending_work to revisit and clean up a rejected socket. For a non-blocking connect(), vsock_connect() may return -EINPROGRESS immediately, and vsock_connect_timeout() can later set sk->sk_err asynchronously. Since no vsock transport ever sets sk_err on a socket while it is in TCP_LISTEN state, checking it in vsock_accept() serves no purpose and only carries forward errors left behind by earlier, unrelated connection attempts on the same socket. Remove the checks so accept() no longer rejects valid incoming connections because of a stale error, which also avoids the resource leak described above. Fixes: d021c34 ("VSOCK: Introduce VM Sockets") Reported-by: syzbot+1b2c9c4a0f8708082678@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1b2c9c4a0f8708082678 Suggested-by: Michal Luczaj <mhal@rbox.co> Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Link: https://patch.msgid.link/20260813173024.2362935-2-phind.uet@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 96cbf89 ] vsock_connect() returns sk_err to userspace but does not clear it: if (sk->sk_err) { err = -sk->sk_err; For a blocking connect() the error has already been delivered as connect()'s return value, so leaving it set causes subsequent operations like poll()/epoll() to keep reporting POLLERR even though the connect failure was already delivered. The error should be consumed once it has been returned to userspace. Switch to sock_error(), which reads and clears sk_err atomically, matching the behavior of other protocol implementations such as __inet_stream_connect(). Fixes: d021c34 ("VSOCK: Introduce VM Sockets") Tested-by: Wupeng Ma <mawupeng1@huawei.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com> Link: https://patch.msgid.link/20260813173024.2362935-4-phind.uet@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit e213939 ] The password PSWD_ENCODINGS parser reads password_obj[elem + pos_values] while copying the supported password encodings from the ACPI package. The outer loop only guarantees that elem is within password_obj_count. The encoding count is bounded by MAX_ENCODINGS_SIZE, but that does not guarantee that the ACPI package contains enough entries for all elem + pos_values accesses. A malformed package can therefore declare a non-zero encoding count without providing enough string objects, causing the parser to read past the ACPI package array and pass an out-of-bounds string pointer and length to hp_convert_hexstr_to_str(). Add the same computed-index bounds check used by the other offset-based package parsing loops before reading password_obj[elem + pos_values]. Fixes: 8646a3b ("platform/x86: hp-bioscfg: passwdobj-attributes") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Link: https://patch.msgid.link/20260708090937.740435-1-lgs201920130244@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 3921bb8 ] hsmp_hwmon_write() takes the user-supplied hwmon value as a signed long and assigns "val / MICROWATT_PER_MILLIWATT" to msg.args[0], which is a __u32. MICROWATT_PER_MILLIWATT is an unsigned long, so a negative write to power1_cap (e.g. "echo -1 > power1_cap") is first converted to a huge unsigned value by the division and then stored into the u32 argument. As a result a nonsensical, multi-gigawatt socket power limit is sent to the SMU via HSMP_SET_SOCKET_POWER_LIMIT instead of the write being rejected. Reject negative values with -EINVAL before the conversion. Tested with HSMP enabled: CAP=$(dirname $(grep -l amd_hsmp_hwmon \ /sys/class/hwmon/hwmon*/name | head -1))/power1_cap # negative write echo -1000000 > $CAP ; echo "ret=$?" # valid positive write must still work echo 400000000 > $CAP ; echo "ret=$?" Before: # echo -1000000 > $CAP ; echo "ret=$?" ret=0 <- accepted; bogus limit sent to SMU # echo 400000000 > $CAP ; echo "ret=$?" ret=0 After: # echo -1000000 > $CAP ; echo "ret=$?" bash: echo: write error: Invalid argument ret=1 <- rejected with -EINVAL # echo 400000000 > $CAP ; echo "ret=$?" ret=0 <- valid write still works Fixes: 92c025d ("platform/x86/amd/hsmp: Report power via hwmon sensors") Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260812090012.140193-1-hemanth.selam@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 46b14c6 ] rsh_log_store() calls the FIELD_PREP() macro without including the required header file, resulting a build error: CC drivers/platform/mellanox/mlxbf-bootctl.o drivers/platform/mellanox/mlxbf-bootctl.c: In function ‘rsh_log_store’: drivers/platform/mellanox/mlxbf-bootctl.c:429:16: error: implicit declaration of function ‘FIELD_PREP’ [-Wimplicit-function-declaration] 429 | data = FIELD_PREP(MLXBF_RSH_LOG_TYPE_MASK, MLXBF_RSH_LOG_TYPE_MSG); | ^~~~~~~~~~ Fix this by including the <linux/bitfield.h> file. Fixes: e9d1b2d ("mlxbf-bootctl: Add sysfs file for BlueField boot log") Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260810-mellanox_fix_implicit_declaration-v1-1-352e647b8f28@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8ccc9bf ] Empty NLA_NESTED attributes are valid, and bonding uses them to clear the ARP and NS target lists. When either target attribute is empty, nla_for_each_nested() does not execute, so err retains an uninitialized value before it is tested. The request can consequently return an unpredictable error after clearing the targets. Initialize err to zero so an empty target list completes successfully. Non-empty lists still propagate errors from __bond_opt_set() unchanged. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 4fb0ef5 ("bonding: convert arp_ip_target to use the new option API") Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Acked-by: Jay Vosburgh <jv@jvosburgh.net> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn> Link: https://patch.msgid.link/20260813153126.3952893-1-ruoyuw560@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 0b1c2af ] sashiko is reporting that trying to read /sys/kernel/debug/ref_tracker/* causes use-afer-free crash when either alloc_percpu() or dev_addr_init() in alloc_netdev_mqs() failed, for commit 4d92b95 ("net: add net device refcount tracker infrastructure") added ref_tracker_dir_exit() to only free_netdev() path. Closes: https://sashiko.dev/#/patchset/56c707e7-1fb0-43ec-b8fb-cf6f451e513e%40I-love.SAKURA.ne.jp Fixes: 4d92b95 ("net: add net device refcount tracker infrastructure") Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/b06ce35d-e7bc-47a5-8e0a-e82be7e4dd08@I-love.SAKURA.ne.jp Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 281eb47 ] The page reporting callback submits an sg list to the reporting virtqueue. With VIRTIO_RING_F_INDIRECT_DESC negotiated and total_sg > 1 (which it typically is), virtqueue_add reports it to the host by allocating an indirect descriptor via kmalloc(GFP_KERNEL). This is not pretty: the reporting worker isolates potentially hundreds of MB of free pages from the buddy allocator (reported pages are at least pageblock_order, and the sg can contain up to PAGE_REPORTING_CAPACITY entries of varying orders). As the result, very theoretically, the kmalloc might trigger OOM when we have in fact a ton of free memory. Clear VIRTIO_RING_F_INDIRECT_DESC, to avoid using indirect descriptors. Fixes: b0c504f ("virtio-balloon: add support for providing free page reports to host") Assisted-by: Claude:claude-opus-4-6 Acked-by: David Hildenbrand (Arm) <david@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <73fac8a629fd9aca7bb3265ac243a769c28af25d.1783232420.git.mst@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit bd670e5 ] vdpasim_create() leaves vdpasim->worker as an ERR_PTR when kthread_run_worker() fails. The error path then drops the device reference, which releases the partially initialized simulator. vdpasim_free() unconditionally passes the worker pointer to kthread_destroy_worker(), so the ERR_PTR is dereferenced and can trigger a general protection fault. Store the worker error, clear the pointer, and only clean up the worker when it was successfully initialized. Also make the release path tolerate partially initialized objects by guarding virtqueue and IOTLB cleanup, since the same release path can be reached from other initialization failures. I found this bug myself, though the patch was written with AI assistance. Fixes: 76acfa7 ("vdpa_sim: use kthread worker") Assisted-by: OpenAI-Codex:GPT-5 Reviewed-by: Eugenio Pérez <eperezma@redhat.com> Signed-off-by: Linfeng Sun <linfeng.sun.dev@gamil.com> Message-ID: <20260620100959.2070316-1-slf@hdu.edu.cn> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 0d8aebe ] The generic virtio bus .shutdown handler, virtio_dev_shutdown(), breaks and resets a device once it has established that the driver has no .shutdown of its own. A driver that does implement .shutdown, to quiesce its own activity first, still needs the same break and reset afterwards and would otherwise have to open code it. Factor the break + synchronize_cbs + reset sequence out of virtio_dev_shutdown() into an exported virtio_device_shutdown() helper so such drivers can reuse it instead of duplicating the core logic. No functional change. Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260624140846.2616797-2-den@openvz.org> Stable-dep-of: 7e17eef ("virtio_balloon: quiesce balloon work before device shutdown") Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 29536a9 ] virtballoon_remove() stops all of the balloon's asynchronous work (the free page reporting worker, the inflate/deflate and stats workers, the OOM notifier and the free page shrinker) before tearing the device down. A following change needs the same teardown from a .shutdown handler, so move it into a virtballoon_quiesce() helper. No functional change. Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260624140846.2616797-3-den@openvz.org> Stable-dep-of: 7e17eef ("virtio_balloon: quiesce balloon work before device shutdown") Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 7e17eef ] Commit 8bd2fa0 ("virtio: break and reset virtio devices on device_shutdown()") added a generic virtio bus .shutdown handler that breaks and resets every virtio device during device_shutdown(), i.e. on reboot and kexec. virtio_balloon provides no .shutdown of its own, so that generic path runs while the balloon's asynchronous work is still armed. Once the device has been broken, virtqueue_add_inbuf() in virtballoon_free_page_report() returns -EIO and trips its WARN_ON_ONCE(). On a kernel booted with panic_on_warn that turns an ordinary reboot, for example a kexec based upgrade, into a fatal panic in the middle of device_shutdown(), so the machine never reaches the new kernel. Relaxing that single WARN_ON_ONCE() would only hide the symptom: the inflate/deflate and OOM paths do not warn, they call wait_event(vb->acked, ...) and would instead block forever on a broken queue that can no longer complete. The device has to be quiesced, not just kept quiet. Add a .shutdown handler that quiesces the balloon via the shared virtballoon_quiesce() helper while the device is still alive, and only then breaks and resets it via virtio_device_shutdown(). Unlike virtballoon_remove() the balloon workqueue is not destroyed, as shutdown does not free the device and cancel_work_sync() together with stop_update already prevent any further work from being queued. Fixes: 8bd2fa0 ("virtio: break and reset virtio devices on device_shutdown()") Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260624140846.2616797-4-den@openvz.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 92a7b13 ] The clear_user() call in VHOST_GET_FEATURES_ARRAY incorrectly starts at argp, which is the beginning of the features array, overwriting the data just written by copy_to_user(). It should start after the copied elements at argp + copied * sizeof(u64) to only zero the trailing unused space. Use size_mul() for both the offset and length calculations so the arithmetic stays consistent with the surrounding code and remains overflow-safe. Fixes: 333c515 ("vhost-net: allow configuring extended features") Signed-off-by: Yufeng Wang <wangyufeng@kylinos.cn> Acked-by: Eugenio Pérez <eperezma@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260626070438.59149-1-r4o5m6e8o@163.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit dc3f1ee ] In vp_find_vqs_intx(), the admin vq was set up using the local queue_idx counter instead of avq->vq_index (the actual queue index obtained from the device). This differs from vp_find_vqs_msix() which correctly uses avq->vq_index. Using the wrong index causes the admin virtqueue to be mapped to an incorrect hardware queue. Fix it by using avq->vq_index consistent with the msix path. Fixes: af22bbe ("virtio: create admin queues alongside other virtqueues") Signed-off-by: Li RongQing <lirongqing@baidu.com> Message-ID: <20260629033538.2476-1-lirongqing@baidu.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 23ae56d ] In add_direct_chain(), newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr->head only on success. On the error path, the cleanup loop was incorrectly iterating over mr->head instead of tmp. Fix by iterating over 'tmp' in the err_alloc cleanup path. Fixes: 94abbcc ("vdpa/mlx5: Add shared memory registration code") Signed-off-by: Li RongQing <lirongqing@baidu.com> Acked-by: Eugenio Pérez <eperezma@redhat.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260701113608.1972-1-lirongqing@baidu.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
|
Reviewed arch/arm64/boot/dts/qcom/lemans.dtsi. There are only refgen related changes in display for which +1 PCIe changes are not owned by display team. |
| if (err) | ||
| dev_dbg(fl->sctx->dev, "Error: Invoke Failed %d\n", err); | ||
|
|
Contributor
There was a problem hiding this comment.
not needed
| @@ -1550,7 +1559,6 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, | |||
| inbuf.client_id = fl->client_id; | |||
| inbuf.namelen = init.namelen; | |||
| inbuf.pageslen = 0; | |||
|
|
|||
Contributor
There was a problem hiding this comment.
not needed
| if (err == -ERESTARTSYS) { | ||
| spin_lock(&fl->lock); | ||
| list_for_each_entry_safe(buf, b, &fl->mmaps, node) { | ||
| list_del(&buf->node); |
Contributor
There was a problem hiding this comment.
this block needs to be removed
nsiddams (nsiddams)
force-pushed
the
6.18.52-lts
branch
from
September 23, 2026 09:54
0df308c to
3f9ac1d
Compare
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
nsiddams (nsiddams)
force-pushed
the
6.18.52-lts
branch
from
September 23, 2026 10:02
3f9ac1d to
e096e9e
Compare
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
|
reviewed lemans.dtsi from pcie side. Looks good |
| @@ -324,6 +324,22 @@ u32 msm_dp_panel_get_mode_bpp(struct msm_dp_panel *msm_dp_panel, | |||
| return bpp; | |||
| } | |||
|
|
|||
| int msm_dp_panel_get_modes(struct msm_dp_panel *msm_dp_panel, | |||
There was a problem hiding this comment.
This function is not needed. Remove this.
Ekansh Gupta (ekanshibu)
approved these changes
Sep 24, 2026
Ekansh Gupta (ekanshibu)
left a comment
Ekansh Gupta (ekanshibu)
left a comment
Contributor
There was a problem hiding this comment.
Approved for fastrpc.c
nsiddams (nsiddams)
force-pushed
the
6.18.52-lts
branch
from
September 24, 2026 07:00
e096e9e to
0dfa8b9
Compare
commented
Sep 24, 2026
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
commented
Sep 24, 2026
|
LGTM for qcom-geni-se.c |
commented
Sep 24, 2026
|
LGTM for dp_panel.c |
imrashai
reviewed
Sep 24, 2026
| @@ -159,6 +159,19 @@ static struct clk_rcg2 gpu_cc_gx_gfx3d_clk_src = { | |||
| }, | |||
| }; | |||
|
|
|||
| static struct clk_branch gpu_cc_ahb_clk = { | |||
There was a problem hiding this comment.
This is not required to be modelled. Latest changes present on 6.18.y branch, drops this clock modelling, and keeps it ON from critical clocks list.
| "dsi1_phy_pll_out_byteclk", | ||
| "dsi1_phy_pll_out_dsiclk", | ||
| "sleep_clk"; | ||
| "dsi1_phy_pll_out_dsiclk"; |
There was a problem hiding this comment.
This change alone cannot be picked, as it will break the bindings and driver compatibility. It is better to drop this change for now.
nsiddams (nsiddams)
force-pushed
the
6.18.52-lts
branch
from
September 24, 2026 12:04
0dfa8b9 to
903d4f8
Compare
commented
Sep 24, 2026
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
commented
Sep 24, 2026
Contributor
|
nsiddams (@nsiddams), I reviewed the two commits touching phy-qcom-sgmii-eth.c and have the following comments:
v1 of this is already in the tree and the conflict resolution will break things. I will revert v1 and merge v2 (that was merged) in a separate PR.
|
nsiddams (nsiddams)
force-pushed
the
6.18.52-lts
branch
from
September 24, 2026 15:53
903d4f8 to
a411f1d
Compare
commented
Sep 24, 2026
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
nsiddams (nsiddams)
force-pushed
the
6.18.52-lts
branch
from
September 25, 2026 09:26
a411f1d to
74b5eff
Compare
commented
Sep 25, 2026
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
commented
Sep 25, 2026
Contributor
Looks good now. Approved for phy-qcom-sgmii-eth.c. |
commented
Sep 25, 2026
PR #1158 — validate-patchPR: #1158
Final Summary
|
commented
Sep 25, 2026
PR #1158 — checker-log-analyzerPR: #1158
Detailed report: Full report
|
nsiddams (nsiddams)
force-pushed
the
6.18.52-lts
branch
from
September 25, 2026 11:42
74b5eff to
d64d989
Compare
commented
Sep 25, 2026
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
* refs/heads/8f3741e
Linux 6.18.52
wifi: mt76: fix airoha_npu dependency tracking
staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
pinctrl: airoha: an7583: add missed gpio22 pin group
ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
ACPI: processor: idle: Remove redundant static variable and rename cstate check function
ACPI: processor: idle: Move max_cstate update out of the loop
ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init
cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified
cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled
cpufreq/amd-pstate: Add support for raw EPP writes
cpufreq/amd-pstate: Add static asserts for EPP indices
cpufreq/amd-pstate: Fix some whitespace issues
io_uring/waitid: fix KCSAN warning on io_waitid->head
io_uring/waitid: use io_waitid_remove_wq() consistently
net/sched: fq: clamp quantum and initial_quantum in change path
Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array
tcp: reject non zerocopy devmem tx
ipmr: Add __rcu to netns_ipv4.mrt.
ipmr: Call ipmr_fib_lookup() under RCU.
erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()
erofs: relax sanity check for tail pclusters due to ztailpacking
block: fix merging data-less bios
blk-mq-dma: always initialize dma state
block: save page offset gaps in cloned bio
integrity: Eliminate weak definition of arch_get_secureboot()
apparmor: fix kernel-doc comments for inview
pinctrl: airoha: an7581: fix incorrect led mapping in phy4_led1 pin function
pinctrl: airoha: Fix AIROHA_PINCTRL_CONFS_DRIVE_E2 in an7583_pinctrl_match_data
pinctrl: airoha: an7583: add missed gpio32 pin group
pinctrl: airoha: an7583: fix misprint in gpio19 pinconf
pinctrl: airoha: an7583: fix incorrect led mapping in phy4_led1 pin function
pinctrl: airoha: an7583: fix gpio21 pin group
pinctrl: airoha: an7583: fix phy1_led1 pin function
pinctrl: airoha: an7583: remove undefined groups from pcm_spi pin function
phy: renesas: rcar-gen3-usb2: add regulator dependency
perf annotate: Fix build with NO_SLANG=1
wifi: nl80211: fix UHR capability validation
wifi: mt76: npu: Add missing rx_token_size initialization
wifi: mt76: restrict NPU/PPE active checks to MMIO devices
s390/kexec: Disable stack protector in s390_reset_system()
selftests: vDSO: getrandom: Fix path to s390 chacha implementation
cpufreq/amd-pstate: Fix setting EPP in performance mode
cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP
cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp
cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name
cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset
cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks
usb: ucsi: huawei_gaokun: move typec_altmode off stack
serial: 8250: Ignore flow control on suspend/resume with no_console_suspend
platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
perf tests kvm: Avoid leaving perf.data.guest file around
tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection
mtd: rawnand: pl353: Fix debug prints
dm-integrity: fix buffer overflow with keyed discard
net/sched: sch_htb: limit htb_classify inner-class filter hops
tcp: fix corruption of urgent data on multi-segment retransmit
usb: atm: usbatm: fix invalid ci_range initialization
net: fec: only stop PTP if it was initialized
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
net: stmmac: selftests: Account for the UC filter list for filtering tests
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
net: stmmac: selftests: Check multiple MMC counters
net: airoha: npu: fix missing streaming DMA mask
selftests/arm64: Fix MTE prctl TAP plan
selftests/arm64: Treat KSM merge_across_nodes as optional
selftests/arm64: Print missing MTE TAP headers
ALSA: control: Don't add invalid kcontrols to LED layer
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
netfilter: xt_HL: add pr_fmt and checkentry validation
netfilter: nf_tables: move hardware offload step after building the chain blob
virtio-net: Ensure that TCP packets don't overflow gso_segs
drm/xe/xe_gt_idle: Add CCS to the powergating info print
net: stmmac: selftests: Pass the IP proto mask in the TC selftest
net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs
net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure
net: ethernet: sun4i-emac: Fix IRQ error handling
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
libceph: validate banner payload length
ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
ceph: Fix ERR_PTR(0) in ceph_mkdir()
ASoC: dapm: Fix off-by-one check on the second enum channel
apparmor: policy_int make sure list heads are initialized before fail path
apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
crypto: acomp - allocate async request context when cloning
tpm: st33zp24: Validate locality read result
tpm: st33zp24: Return zero on status read failure
net/sched: sch_teql: restore skb->dev on the slave failure path
net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
net/sched: fq_pie: clamp default quantum to avoid signed overflow
net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
net/sched: fq_codel: clamp default quantum and mtu
net/sched: fq: add overflow bounds to quantum and initial quantum
net: fix a resource leak in copy_net_ns() error handling path
net: core: check skb_frags_readable before uncloning in skb_copy_ubufs
net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC
maple_tree: fix argument name in header
maple_tree: catch race in mas_alloc_cyclic()
selftests/mm: skip COW tmpfile cases when fallocate() is unsupported
cifs: fix clearing stats for fastest execution of each smb2 command
octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup
net/rds: use wq_has_sleeper() in rds_cong_map_updated()
net/sched: act_ife: Only operate on Ethernet frames
net/sched: add qstats_cpu_drop_inc() helper
net: enetc: restore RX ring congestion mode after ring reconfiguration
octeontx2-af: Fix TL3/TL2 link config ENA clearing
net: qualcomm: rmnet: restore skb->dev on deaggregated frames
octeontx2-vf: fix workqueue and netdev race in probe/remove
octeontx2-af: fix NULL deref in NIX TM tree debugfs read path
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
xsk: honor XDP_TX_METADATA in zero-copy path
xsk: align TX metadata layout across ABIs
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
Bluetooth: btnxpuart: Validate the FW dump header length
Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
Bluetooth: btmtk: Do not discard the subsystem reset timeout
Bluetooth: btmtk: Do not report success when subsys reset fails
Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
arm64: process: Fix context switching MTE store-only tag check
arm64: ptdump: Make note_page_flush() range aware
erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
scsi: qla2xxx: Fix an loop timeout test
Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
syscore: Pass context data to callbacks
net_sched: sch_fq: fix pacing delay underflow with pacing offload
net: page_pool: Remove zone/policy GFP flags when allocating XArray entries
net: libwx: fix concurrent bitmap overwrite in PTP setup
net: txgbe: fix MISC interrupt unmasking in non-MSI-X mode and device shutdown
net: wangxun: introduce WX_STATE_DOWN to serialize device shutdown state
net: wangxun: schedule hardware stats update in watchdog
net: wangxun: replace busy-wait reset flag with kernel mutex
net: txgbe: support RSC offload
net: txgbe: support RX desc merge mode
ptp: netc: fix period truncation and potential divide-by-zero in PEROUT
bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check
bnxt_en: Fix call to hardware monitoring event handler
rtc: pcf85363: Add error checking to regmap calls in probe()
NFSv4/pnfs: key the data server cache on the NFS version
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
net/smc: free pending qentry in smc_llc_flow_stop() before memset
net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
net: tcp: block mixing readable and unreadable frags
inetpeer: randomize RB-tree node comparison using SipHash
ip6mr: plug drop_reason to ip6mr_cache_report()
ipmr: Free mr_table after RCU grace period.
net: change sock_queue_rcv_skb_reason() to return a drop_reason
ipmr: Remove RTNL in ipmr_rules_init() and ipmr_net_init().
ipmr: Convert ipmr_net_exit_batch() to ->exit_rtnl().
ipmr: Move unregister_netdevice_many() out of ipmr_free_table().
ipmr: Move unregister_netdevice_many() out of mroute_clean_tables().
net: qlcnic: validate unified ROM sections before loading
net: add missing ref_tracker_dir_exit() to net_passive_dec()
ipv6: avoid divide by zero in rt6_multipath_rebalance
netdevsim: update queue NAPI association on queue reset
net: ipa: balance runtime PM reference on remove error
forcedeth: stop the tx_timeout register dump past the requested window
net/mlx5: E-Switch, preserve max tx speed on vport state modification
net/mlx5: Move vport DOWN state check out of mlx5_query_vport_max_tx_speed()
net/mlx5: Skip disabled vports when setting max TX speed
RDMA/mlx5: Implement query_port_speed callback
IB/core: Add query_port_speed verb
IB/core: Add helper to convert port attributes to data rate
net/mlx5: Add support for querying bond speed
net/mlx5: Handle port and vport speed change events in MPESW
net/mlx5: E-Switch, use state lock for vport state changes
net/mlx5: Propagate LAG effective max_tx_speed to vports
net/mlx5: Add max_tx_speed and its CAP bit to IFC
net/mlx5: E-Switch, support eswitch inactive mode
net/mlx5: MPFS, add support for dynamic enable/disable
devlink: Introduce switchdev_inactive eswitch mode
net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
net/sched: add get_fill_size callbacks for actions missing them
net: bridge: Reject descending VLAN tunnel ranges
xsk: fix NULL pointer dereference in __xsk_rcv()
xsk: avoid double checking against rx queue being full
irqchip/irq-realtek-rtl: Use readl_be()/writel_be() instead of readl()/writel()
irqchip/irq-realtek-rtl: Add mask for interrupt handling
irqchip/irq-realtek-rtl: Add interrupt data structure
irqchip/irq-realtek-rtl: Split out parent setup code
irqchip/irq-realtek-rtl: Add multicore support
irqchip/irq-realtek-rtl: Add/simplify register helpers
smb: server: remove unused DES crypto header
smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file
ALSA: mtpav: shut down output timer before card teardown
spi: amlogic-spisg: Make sure clk_init_data is fully initialized
RDMA/ucma: Allow path records to exactly fit the output buffer
ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
ALSA: core: Add scoped cleanup helper for card references
irqchip/gic-v5: Use logical cpu 0 irs_data for dynamic IST allocation
irqchip/gic-v5: Fix gicv5_init_common() error paths
irqchip/gic-v5: Check for NULL LPI domain on domain teardown
irqchip/gic-v5: Synchronize CPU interface disable
clk: visconti: Make sure clk_init_data is fully initialized
clk: ti: Make sure clk_init_data is fully initialized
prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
lib/interval_tree: fix allocation warning messages
rtc: gamecube: check return value of devm_rtc_register_device()
i2c: ocores: Disable clock on failed resume
irqchip/renesas-rzg2l: Fix loss of interrupt
rtc: zynqmp: Return optional clock lookup errors
cifs: remove dead size-update blocks in cifs_setattr_unix/nounix
smb: client: fix request buffer leak in smb2_new_read_req()
rtc: spacemit: handle regmap_test_bits() error return
rtc: pcf8563: fix clock provider leak on unbind
virtio: rtc: time out alarm requests
vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
virtio_pci: fix wrong queue index for admin vq in intx path
vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY
virtio_balloon: quiesce balloon work before device shutdown
virtio_balloon: factor out virtballoon_quiesce()
virtio: add virtio_device_shutdown() helper
vdpa_sim: fix cleanup after worker creation failure
virtio_balloon: disable indirect descriptors
net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
bonding: initialize err for empty target lists
mlxbf-bootctl: fix the build error with FIELD_PREP()
platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
platform/x86: hp-bioscfg: fix password encoding bounds check
vsock: use sock_error() to consume sk_err after a failed connect
vsock: don't check the listener's sk_err in vsock_accept()
vsock: avoid timeout for non-blocking accept() with empty backlog
platform/x86: dell-wmi-sysman: Fix instance ID bounds
net/smc: hash socket only after full initialisation in smc_sk_init()
8139cp: fix Rx and Tx not being disabled in cp_suspend
vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
ALSA: hda: Fix connection list comparison in proc output
fuse: check for NULL root inode in fuse_fill_super_submount
soc: qcom: ubwc: Fix missing include
fs/ntfs3: validate ef->size covers the record's name and value
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
cuse: wait for pending RCU callbacks on module exit
net: bridge: vlan: fix inverted default vlan notification
tls: fix RX desync on overlapping skbs
net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error
vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
ipvs: fix integer overflow in ftp helper port/address parsing
f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled
net: hsr: free learned nodes on device setup failure
pppox: drain queued packets on channel handoff
net: dsa: b53: fix error propagation from b53_fdb_dump()
net: kcm: Hold RCU read lock while running BPF parser
ionic: fix completion descriptor access with 2x desc size
ptp: netc: skip PEROUT disable if channel is not enabled
drm/xe: tests: fix error message in xe_migrate_sanity_test()
hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed
octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()
bpf, xdp: move offload check into dev_xdp_install()
clk: ti: mux: resolve parent clocks by DT index, not by name
clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()
nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3
NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
pnfs/blocklayout: Fix device leaks on parse failure
NFSv4: remove callback IDR entry on client allocation failure
nfs: refactor pNFS functions using clear_and_wake_up_bit
nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
smb/server: fix session leak in ksmbd_session_register()
ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
ksmbd: disconnect on SMB3 decryption failure
bpf: Reject negative optlen in cgroup getsockopt hook
m68k: nfcon: Do not call console_is_registered() in nfcon_device()
bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
erofs: fix unused pcluster_pools for higher page sizes
lwt_bpf: Restore reserved headroom after xmit program
erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX
erofs: fix interlaced ztailpacking pclusters
erofs: error out obviously illegal extents in advance
erofs: clean up encoded map flags
smb/server: preserve error status in smb2_handle_negotiate()
smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()
smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
ksmbd: free preauth sessions on connection teardown
ksmbd: do not advertise unimplemented CA support
ksmbd: validate ipc response length before dereferencing its fields
smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
ksmbd: Do not skip lock checks for single-byte ranges
hwmon: (emc1403) Drop hysteresis for low limit temperature
hwmon: (emc1403) Rely on subsystem locking
hwmon: (coretemp) Fix core_data leak on CPUs without PTS
apparmor: fix deadlock in complain-mode change_hat
block: mtip32xx: synchronize ioctls with device removal
ublk: reject non-power-of-2 zone sizes in SET_PARAMS
null_blk: serialize configfs attribute updates with device setup
null_blk: serialize configfs attribute stores with the lock
null_blk: reject per-device queue resize for shared tag set
null_blk: free zones array on device power-off
null_blk: free global tag_set on init error path
null_blk: register configfs subsystem after creating default devices
null_blk: use DEFINE_MUTEX for the file-scope mutex
mailbox: riscv-sbi-mpxy: validate RPMI notification lengths
mailbox: pcc: Fix command timeout due to missed interrupt
mailbox: rockchip: disable pclk on probe failure and unbind
mailbox: qcom-cpucp: handle NULL data in send_data callback
mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
perf dso: Replace assert with runtime check in dso__read_symbol()
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
perf dso: Use stored fd error instead of stale errno in file_read() and file_size()
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
perf dso: Guard against errno==0 when dso__get_filename() returns NULL
sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
crypto: lskcipher - propagate errors from unaligned crypt
crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
selftests/sched_ext: Fix flaky ddsp failure tests on busy systems
bpf: Fix pending_pos walk on 32-bit ring position wrap
ACPI: scan: fix bus ID cleanup on device_add() failures
ring-buffer: Remove trace_buffer::cpus
riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
selftests/bpf: Use ping_command() for IPv6 pings in lwt_ip_encap
selftests/bpf: Add tests to verify the fix of encapsulating VxLAN in lwt
HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
ASoC: SOF: validate topology volume range before allocation
tracing: Have trace_event_update_all() only handle module that is loading
HID: haptic: don't write an uninitialized value to unhandled usages
ALSA: core: Fix use-after-free in snd_card_do_free()
fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
fs/ntfs3: fix integer overflow in MFT cluster validation
bpf, arm64: Fix stack-passed arguments for indirect trampolines
net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race
scsi: ufs: core: Set task state before io_schedule_timeout()
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
selftests/bpf: Fix for veristat file/prog filters processing
Squashfs: check block offset is not negative
ocfs2: fix circular locking dependency in ocfs2_init_acl()
ocfs2: validate DIO orphan slot during inode read
ocfs2: validate orphan slot during inode read
bpftool: Fix double close in map dump
x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
selftests/cgroup: Preserve CPU hotplug write errors
ALSA: seq: midi: Serialize input teardown with event_input
ALSA: seq: midi: Optimize event_input locking with RCU
clocksource/drivers/armada: Unwind timer clock on init failure
clocksource/drivers/clps711x: Do not unmap clocksource MMIO
s390/debug: Fix deadlock during unregister
xenbus: Unregister reboot notifier on init failure
power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
power: supply: bq27xxx: bq27520g4: fix REG_TTES address
power: supply: bd99954: Drop bad register fields
PCI/ASPM: Disable/restore ASPM on every function for multi-function devices
spi: img-spfi: don't disable runtime PM on DMA deferred probe
selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
selftests: harness: Mark test fixture objects __maybe_unused
selftests: harness: Restore order of test functions
kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
perf build: Remove leftover feature tests for removed cxx and clang support
super: fix dying superblock warning messages
PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore
firewire: core: fix memory leak in error path of build_tree()
firewire: core: validate parent port count before allocating nodes in build_tree()
firewire: core: consolidate port counting in build_tree()
firewire: core: add KUnit tests for failure of tree building
firewire: core: add KUnit tests for successful tree building
firewire: core: add KUnit test skeleton for node tree
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
mtd: ubi: Release device reference on busy detach
ubi: Fix rollback for explicit UBI device numbers
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
UBI: Preserve torture flag when rescheduling failed erasures
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
ASoC: pxa: Use devm_clk_get_optional() for extclk clock
idpf: add missing cpu_to_le32 in idpf_tx_splitq_build_flow_desc
ice: acquire NVM lock around each flash read
ice: refactor to use helpers
ice: clear the default forwarding VSI rule when releasing a VSI
ice: fall back to SBQ when LL PHY timer interface times out
RDMA/cma: Fix WARNING in res_to_rt
RDMA/cxgb4: Free debugfs on registration failure
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
ALSA: seq: Don't leak the extension cell pointer in the bounce payload
nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
nfc: digital: Do not dump a NULL response in command completion
nfc: pn533: hold a reference to the request skb during send_frame
nfc: llcp: bound SNL TLV parsing to the skb and add length checks
nfc: nci: fix double completion race in nci_data_exchange_complete
nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
nfc: llcp: avoid userspace overflow on invalid optlen
nvme: reject passthrough of driver-managed Set Features
nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
nvme-apple: Drop the PRP null check chicken bit
nvme-apple: Require page aligned buffers on the admin queue
nvme: Add a quirk for page aligned admin queue buffers
nvme: expose active quirks in sysfs
nvme: remove virtual boundary for sgl capable devices
block: accumulate memory segment gaps per bio
nvme-apple: Never set the opcode in the NVMMU TCB
nvme-apple: Don't set a DMA direction for commands without a data transfer
nvme-apple: Destroy the admin queue on removal
nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
nvme: Add the DHCHAP maximum HD IDs
s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN
s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
integrity: Make arch_ima_get_secureboot integrity-wide
arm64: bti: Disable in-kernel BTI with recent versions of Clang
ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
spi: sprd-adi: Fix probe succeeding without registering the controller
phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy
phy: qualcomm: qmp-combo: Add DP offsets and settings for Glymur platforms
phy: qualcomm: qmp-combo: Update QMP PHY with Glymur settings
phy: qualcomm: Update the QMP clamp register for V6
phy: qcom-qmp-combo: Use regulator_bulk_data with init_load_uA for regulator setup
phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs
phy: renesas: rcar-gen3-usb2: Ignore missing VBUS regulator
rust: uapi: replace direct asm-generic/ioctl.h include with linux/ioctl.h
iommu/amd: Fix incorrect device ID in invalid PASID error message
apparmor: fix unconfined user namespace restriction forced stack
apparmor: change fn_label_build() call to not return NULL
apparmor: split xxx_in_ns into its two separate semantic use cases
powerpc/configs: enable CONFIG_RAS to fix EDAC support
amt: Don't support cross-netns setup.
selftests/sched_ext: Check skeleton open failure in exit test
cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates
cgroup/cpuset: Fail if isolated and nohz_full don't leave any housekeeping
cgroup/cpuset: Rename update_unbound_workqueue_cpumask() to update_isolation_cpumasks()
nvme-pci: release descriptor pools on probe failure
nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable()
nvmet: fix Reservation Register Replace for unregistered host with IEKEY
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
hwmon: (cros_ec) Synchronize EC access from the thermal device callbacks
hwmon: (cros_ec) Store the hwmon device in cros_ec_hwmon_priv
hwmon: (cros_ec) Register the thermal devices after the hwmon ones
hwmon: Support guard() and scoped_guard for subsystem locks
hwmon: (cros_ec) Add support for temperature thresholds
hwmon: (cros_ec) Move temperature channel params to a macro
hwmon: (cros_ec) Split up supported features in the documentation
arm64: Disable KCSAN instrumentation in delay.o
xdrgen: Fix opaque and string encoders for unbounded members
xdrgen: Do not declare union XDR functions in the definitions header
xdrgen: Address some checkpatch whitespace complaints
m68k: Fix backtraces for non-running tasks
hwrng: imx-rngc - Disable clock on registration failure
crypto: qat - remove dead ADF_HEX code
crypto: qat - use 2-arg strscpy where destination size is known
iommu/vt-d: Flush context cache with correct SID when tearing down aliases
iommu/vt-d: Tear down scalable-mode context on probe failure
iommu/vt-d: Clear Present bit before tearing down copied context entry
iommu/vt-d: Fix UCTP context table slot when copying root entries
iommu/dma: Restore locking around msi_page_list
fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call
fbdev: kyro: Validate overlay viewport coordinates
fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()
perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
perf python: Fix memory leak in pyrf__metrics_cb
perf python: Validate CPU and thread maps in pyrf_evsel__open
perf python: Handle Py_None for thread and cpu maps
perf python: Check counts_values size in set_values
perf test: Fix skiplist leak in cmd_test
perf test: Support dynamic test suites with setup callback and private data
perf synthetic-events: Fix uninitialized pthread_join
perf stat: Fix evsel_list leak in cmd_stat
ARM: dts: helios4: add SATA regulator supplies
ARM: dts: helios4: add vcc-supply to GPIO expander
ARM: dts: helios4: add vcc-supply to EEPROM
arm64: dts: turris-mox: fix usb3 phys
i3c: renesas: Don't register devices when ENTDAA times out
i3c: renesas: Follow a unified pattern for transfer and command initialization
i3c: renesas: Return immediately if there is no transfer
bpf: Fix mmap_lock leak in irq_work path
bpf: Avoid faultable build ID reads under mm locks
bpf: Factor out stack_map build ID helpers
riscv: cpufeature: Clarify ISA spec version for canonical order
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
iio: light: gp2ap002: re-enable irq if runtime suspend fails
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
iio: light: opt4060: Fix pointer type passed to div_u64_rem()
bpf, cgroup: Fix storage null-ptr-deref after replacing prog
Bluetooth: MSFT: validate evt_prefix_len against the response length
Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative
Bluetooth: btmtk: add MT7902 SDIO support
Bluetooth: btmtk: add MT7902 MCU support
mmc: sdio: add MediaTek MT7902 SDIO device ID
Bluetooth: MGMT: free the HCI command when it is cancelled
Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
Bluetooth: hci_conn: fix the SCO setup context lifetime
Bluetooth: btintel: Fix diagnostics event detection
Bluetooth: virtio_bt: avoid OOB read of build info string
pinctrl: airoha: fix edge-triggered interrupts handling
pinctrl: airoha: fix IRQ mask/unmask code
pinctrl: airoha: add missed IRQ resource helpers
pinctrl: airoha: fix getting gpiochip/pinctrl pointers in the IRQ handling code
pinctrl: airoha: add missed get_direction() function for gpio_chip
pinctrl: airoha: an7583: fix spi group pins
pinctrl: airoha: an7583: fix muxing of non-gpio default pins
pinctrl: airoha: an7581: fix mux/conf of pcie_reset pins
pinctrl: airoha: fix pwm pin function for an7581 and an7583
pinctrl: airoha: convert PWM GPIO to macro
pinctrl: airoha: an7583: fix I2C0_SDA_PD register bit order
pinctrl: airoha: an7581: fix pinconf of i2c_scl/i2c_sda pins
pinctrl: airoha: fix mdio bitfield names
pinctrl: airoha: add support for Airoha AN7583 PINs
pinctrl: airoha: convert PHY LED GPIO to macro
btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
btrfs: avoid GFP_ATOMIC allocations in qgroup free paths
btrfs: use aligned range for locking in extent_fiemap()
btrfs: zoned: don't clobber the extent buffer when zeroing it out
btrfs: retry verity reads for not-uptodate Merkle folios
btrfs: always wait for ordered extents to avoid OE races
btrfs: merge setting ret and return ret
btrfs: make btrfs_repair_io_failure() handle bs > ps cases without large folios
btrfs: defrag: fix deadlock between defrag and delalloc space reservation
scsi: sd: Fix sd_done() sense handling condition
perf trace-event: Fix integer truncation in do_read() and skip()
Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices
Bluetooth: btusb: Record matched usb_device_id into btusb_data
Bluetooth: btusb: refactor endpoint lookup
Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event
sched/fair: Check CPU capacity before comparing group types during load balance
sched/fair: Also gate overloaded status update for SD_ASYM_CPUCAPACITY
perf/x86/intel/pt: Fix stop/start with no update
perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED
perf/x86/intel/pt: Factor out pt_config_enable()
ACPI: video: Release PCI device reference after lookup
regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
bpf, arm64: Fix exception table metadata for arena load-acquire
bpf, x86: Fix exception table metadata for arena load-acquire
bpf, riscv: Add and use bpf_atomic_is_load_acq() helper
bpf: Reject load-acquire from pointers requiring fault protection
perf: arm_pmuv3: Zero initialize hw_id branch stack field
coresight: Refactor etm4_config_timestamp_event()
coresight: etm4x: fix leaked trace id
coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
coresight: Change syncfreq to be a u8
coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
md/raid1: don't set array_frozen in raid1_takeover()
md/md-llbitmap: stop daemon timer rearm on destroy
md/md-llbitmap: prevent create failure bitmap UAF
md: avoid stale clone I/O accounting timestamps
md: wait for behind writes before destroying bitmap
md/raid5: round bitmap stripes with sector division
phy: qcom: qmp-pcie: Add pcs_lane1 offset to V5 offsets
phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads
phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()
soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
hugetlbfs: release subpool on fill_super failure
pinctrl: rockchip: Reset the pin count when recalculating SoC data
firmware_loader: do not queue completed sysfs fallback requests
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
drm/amdgpu/gfx6: Use PFP on the compute queues too
drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
perf trace-event: Fix buffer overflow in read_string()
phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
phy: sunplus: fix error handling in sp_uphy_init()
phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator
phy: renesas: rcar-gen3-usb2: Add regulator for OTG VBUS control
phy: renesas: rcar-gen3-usb2: Factor out VBUS control logic
arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
ext4: fix spurious message about orphan cleanup on RO fs
drm/amdgpu/gfx6: Fixup emit_cntxcntl()
leds: gpio: Clear error pointers for skipped LEDs
mfd: macsmc: Fix key count endianness annotation
mfd: iqs62x: Reject zero-length firmware records
mfd: rave-sp: validate received frame payload lengths
arm64: hibernate: Restore DAIF state on error
arm64: hibernate: mask DAIF before restoring hibernated kernel
wifi: mac80211: skip default WMM setup for AP_VLAN links
RDMA/erdma: restrict the driver to little-endian systems
module/dups: Fix use-after-free in kmod_dup_req lifetime handling
module/dups: Inform duplicate requests about the result directly
module: use strscpy() to copy module names in stats and dup tracking
module: replace use of system_wq with system_dfl_wq
RDMA/siw: Fix use-after-free in siw_accept()
IB/isert: post the full-feature receive buffers after session registration
IB/isert: delay the final Login Response until the session is registered
cpufreq: imx6q: fix out-of-bounds write when probed more than once
cpufreq: imx6q: fix devres accumulation across driver rebind
rust: cpufreq: Fix temporary write in Registration::bios_limit_callback
rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table
drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
drm/sun4i: dw-hdmi: Drop TCON TOP port reference
drm/sun4i: tcon: Drop remote endpoint reference
drm/sun4i: crtc: Propagate layer initialization error
drm/sun4i: hdmi: Don't leak sync polarity bits into packet control
drm/sun4i: tcon: Drop TCON TOP device reference
drm/sun4i: tcon: Set output mux for DSI and LVDS
drm/sun4i: vi scaler: Fix coefficient selection
clk: rockchip: rk3576: fix source muxes for SPI0..SPI4
ocfs2: synchronize heartbeat callbacks with o2net teardown
perf libbfd: Fix memory leaks and NULL fclose in BPF disassembly
perf bpf: Add PROG_TAGS to required arrays in __bpf_event__print_bpf_prog_info()
perf libbfd: Validate BPF prog info arrays before pointer cast
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
ARM: 9481/2: breakpoint: CFI breakpoints only on demand
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
RDMA/erdma: Hold QP references for AE and CM processing
RDMA/erdma: Hold CQ references when processing EQ events
kbuild: fix modules.builtin(.modinfo) targets in the top-level Makefile
modpost: prevent leak when early return no suffix .o in read_symbols()
scripts/tags.sh: Prevent binary files appearing in cscope.files
intel_idle: Avoid using deep idle states during initialization
intel_idle: Add cmdline option to adjust C-states table
intel_idle: Initialize sysfs after cpuidle driver initialization
bpf: Check load-acquire src ptr type before the load
arm64: dts: qcom: sar2130p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: sc8280xp-blackrock: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
selftests/mm: fix ternary operator precedence in ksm_tests
selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes
selftests/mm: ksm_tests: use kselftest framework
bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
remoteproc: Move resource table data structure to its own header
arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC
drm/omap: dsi: Do not copy isr table
riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller
fat: release buffer head after rebuilding parent
rapidio: clear mport->net when rio_add_net() fails
pps-gpio: remove dead capture_clear code
pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
pps: don't try to wait for negative timeouts in PPS_FETCH
lib/string: fix memchr_inv() for large ranges
ocfs2/cluster: keep heartbeat local node stable
ublk: check for ublk_unmap_io() returning 0
ublk: check import_ubuf() return value
block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
block/blk-iocost: collect per-cpu latency stats over possible CPUs
block/blk-stat: drain per-cpu callback stats over possible CPUs
blk-cgroup: skip dying blkg in blkcg_activate_policy()
blk-cgroup: fix race between policy activation and blkg destruction
phonet: pep: do not write beyond optlen in getsockopt
net: stmmac: Skip PHY attach if custom PCS is in use
iio: light: tsl2583: return zero in write_raw() on success
iio: light: isl29028: return zero in write_raw() on success
iio: light: tsl2772: fix ALS calibscale readback
perf arm-spe: Reject zero nr_cpu in metadata to prevent division by zero
perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
perf auxtrace: Fix queue grow overflow and old array leak
perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
HID: lg4ff: validate report length before fixed offsets
HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure
HID: steam: Reject short reads
HID: steam: Improve logging and other cleanup
HID: steam: Add support for sensor events on the Steam Controller (2015)
HID: steam: Rename some constants that got renamed upstream
HID: steam: Refactor and clean up report parsing
HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
HID: synchronize input before cleaning up a failed probe
HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver
misc: pci_endpoint_test: Check SUCCESS bit for doorbell status
dm-integrity: replace forgeable discard filler with a keyed sector marker
tty: clear cdev pointer after cdev_add() failure
serial: amba-pl011: keep console clock enabled for atomic writes
serial: amba-pl011: unprepare console clock on unregister
MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
soc: fsl: qe: implement get_direction()
soc: fsl: qe: properly scan GPIO nodes at startup
powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
pinctrl: spacemit: validate pins in pinconf callbacks
pinctrl: eswin: Fix Handling of PIN_CONFIG_PERSIST_STATE
firmware: coreboot: Validate table bounds
firmware: google: Add bounds checks in coreboot_table_populate()
wifi: cfg80211: stop PMSR before P2P and NAN teardown
wifi: cfg80211: Add an API to configure local NAN schedule
wifi: nl80211: split out UHR operation information
wifi: nl80211: refactor nl80211_parse_chandef
wifi: cfg80211: add support to handle incumbent signal detected event from mac80211/driver
wifi: cfg80211: add initial UHR support
wifi: ieee80211: add some initial UHR definitions
wifi: nl80211: Add support for EPP peer indication
wifi: cfg80211: include S1G_NO_PRIMARY flag when sending channel
wifi: mac80211: disconnect on CSA to channel 0
wifi: mac80211: skip unused probe response countdown offsets
wifi: zd1211rw: reject secondary interfaces to prevent conflicts
wifi: mac80211: send TWT teardown to peer after setup TX failure
perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register
iommu/arm-smmu-v3: Convert to use atomic poll timeout
kselftest/arm64: Don't write to P0 in irritator on SME only systems
kselftest/arm64: fp-ptrace: Fix checks for inactive SVE and SSVE regsets
arm64/fpsimd: ptrace: Fix inactive SVE and SSVE regsets
arm64: smp: Fix IPI teardown for GICv5 flow
wifi: mt76: mt7996: remove beacon_int_min_gcd from ADHOC interface combinations
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
wifi: mt76: reject out-of-range link ids in mt76_vif_link()
wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum
wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band
wifi: mt76: fix queue assignment for disassoc packets
wifi: mt76: mt7915: report RX chain signal for all RX paths
wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1
wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
wifi: mt76: mt7996: fix reg addr remap when addr is 0
wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
wifi: mt76: mt7915: fix double hif2 init on the non-WED path
wifi: mt76: mt7996: fix MIB TX aggregation counter registers for mt7990
wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset
wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER
wifi: mt76: mt7996: skip key upload when adding an offchannel link
wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
bpf, x86: Fix trampoline stack size for 128-bit arguments
perf machine: Check snprintf truncation for guest kallsyms path
perf machine: Free scandir entries in guest kernel map creation
perf machine: Reset errno before strtol in guest kernel map creation
perf machine: Don't abort guest map creation on first inaccessible dir
perf machine: Check snprintf truncation in machines__findnew()
perf machine: Guard against NULL strlist in machines__findnew()
perf machine: Fix NULL parent dereference in fork event processing
perf machine: Fix fd leak on bounds check in maps__set_modules_path_dir()
regulator: core: use system_freezable_wq for init complete work
ASoC: tas2783-sdw: drop stale regcache on uninitialized re-attach
ASoC: codecs: tas2783-sdw: Propagate regcache_sync() errors
ASoC: tas2783: Use new SoundWire enumeration helper
soundwire: Add a helper function to wait for device initialisation
wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
drm/msm/dp: Drop dev_pm_opp_set_rate(0)
drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)
perf: arm_spe: Make wakeup range check overflow safe
drm/msm/dp: do not reject wide-bus modes while a YUV420 mode is active
drm/msm/dp: reject YUV420-only modes without VSC SDP support
drm/msm: don't tear down KMS twice when KMS init fails
ACPI: processor: Unregister cpufreq notifier on init failure
ACPI: processor: idle: Optimize ACPI idle driver registration
wifi: mt76: only consume the WO drop bit on WED v2 devices
wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar
wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure
wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
wifi: mt76: mt7915: unwind state on add_interface failure
wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
wifi: mt76: check txfree done event on the WED hw path
wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
wifi: mt76: fix RXDMAD_C buffer recycling race
wifi: mt76: fix uninitialised RXDMAD_C descriptor info
wifi: mt76: fix stranded frames in mt76_txq_schedule_pending
wifi: mt76: mt7915: write RX header translation bit to the correct register
wifi: mt76: mt7996: don't report a zero TX bitrate
wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset
wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
wifi: mt76: assign link_id when sending probe request during scan
wifi: mt76: fix non-AQL packet accounting for MLO stations
wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP
wifi: mt76: mt7996: fix out-of-bounds array access during hardware restart
wifi: mt76: mt7996: set specific BSSINFO and STAREC commands after channel switch
wifi: mt76: mt7996: support fixed rate for link station
wifi: mt76: fix RX data queuing of RRO 3.0
wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU
wifi: mt76: mt7996: fix EAPOL source BSS for non-MLD stations
wifi: mt76: mt792x: Fix memory leak in SDIO TX path
wifi: mt76: mt7925: fix msg len mismatch between driver and firmware
wifi: mt76: mt7925: update clc before setting sar power table
wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
wifi: mt76: always enable RRO queues for non-MT7992 chipset
wifi: mt76: Introduce the NPU generic layer
wifi: mt76: Move Q_READ/Q_WRITE definitions in dma.h
wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
wifi: mt76: connac: add MT7991A (0x7991) to is_mt7996()
fanotify: report full event length for FIONREAD
misc: sgi-gru: remove interrupt-context page-table walks
misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()
powerpc/44x: Set GPIO chip parent
powerpc: implement get_direction() in cpm2
locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
md/raid1: create serial pool adding rdev to array with serialize_policy=1
fs: annotate inode timestamp accessors
i3c: master: adi: add OF module alias for autoloading
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
swiotlb: Preserve allocation virtual address for dynamic pools
iommu/dma: Check atomic pool allocation result directly
md: scope memalloc_noio to allocation critical sections
md: skip redundant raid_disks update when value is unchanged
md: remove unused mddev argument from export_rdev
md/bitmap: resume array on backlog_store() error path
clk: qcom: Return expected ENOMEM error on dynamic allocation failure
clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable
lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
bpf: Fix potential UAF when reading bpf link info
bpf: Fix potential UAF in bpf_netns_link_update_prog
power: supply: sc2731_charger: cancel work on remove
power: supply: isp1704_charger: cancel work on remove
arm64: dts: qcom: qcs6490-rb3gen2: Fix the PCIe iommu-map entries
arm64: dts: qcom: lemans: Fix the PCIe iommu-map entries
arm64: dts: qcom: lemans: Move PCIe devices into soc node
arm64: dts: qcom: sa8775p: Add reg and clocks for QoS configuration
arm64: dts: qcom: lemans: add QCrypto node
arm64: dts: qcom: lemans: add refgen regulator and use it for DSI
arm64: dts: qcom: lemans: move USB PHYs to a proper place
arm64: dts: qcom: talos: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8750: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries
arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries
arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries
arm64: dts: qcom: sar2130p: Fix the PCIe iommu-map entries
arm64: dts: qcom: kodiak: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID
block: fix dio leak on metadata mapping error
block: add a bio_endio_status helper
block: don't set BIO_QUIET for BLK_STS_AGAIN
blk-crypto: use on-stack skcipher requests for fallback en/decryption
blk-crypto: optimize bio splitting in blk_crypto_fallback_encrypt_bio
blk-crypto: submit the encrypted bio in blk_crypto_fallback_bio_prep
firmware: qcom: scm: Fix tzmem state on probe retry
firmware: qcom: scm: Fix reserved memory cleanup on probe failure
firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published
firmware: qcom: scm: instrument SMC call path with tracepoints
firmware: qcom: scm: add trace events for the SMC call interface
firmware: qcom_scm: Support multiple waitq contexts
firmware: qcom_scm: Add API to get waitqueue IRQ info
arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en
clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration
arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes
arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property
arm64: dts: qcom: msm8976-longcheer-l9360: Fix accidental node override
arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep
rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
md/raid10: consistently fail atomic writes that require splitting
wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
Revert "serial: 8250: Clear CON_PRINTBUFFER on port re-registration"
selftests/zram: fix kernel_gte() for POSIX sh
md: recheck spare changes before starting sync
tools/nolibc/powerpc: mark ctr and xer as clobbered by system call
fanotify: stop permission watchdog when timeout is zero
md/raid5: protect lockless recovery_offset accesses during reshape
md/raid5-ppl: fix use-after-free in ppl_do_flush()
md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency
bus: mhi: host: Fix controller cleanup on EDL sysfs failure
bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
platform/chrome: cros_ec_debugfs: Unregister panic notifier
platform/chrome: cros_ec_debugfs: Clean up console log on probe failure
media: qcom: iris: handle runtime PM resume failure in core deinit
media: qcom: iris: Fix bitmask test in iris_allow_cmd()
drm/msm: remove objects from evit list after pinning them
PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe
PCI: starfive: Fix Runtime PM handling and teardown ordering
wifi: ath12k: validate TLV length in process_tpc_stats()
wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
spi: davinci: switch to managed controller allocation
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
IB/isert: reject login PDUs declaring more data than was received
IB/isert: reject PDUs declaring more data than was received
media: staging/ipu7: fix async notifier leak on init error
RDMA/cxgb4: free STAG index when TPT entry write fails
RDMA/mlx5: Send cong param changes to the resolved port mdev
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
nilfs2: prevent out-of-bounds read in super root block parsing
nilfs2: fix infinite loop in nilfs_clean_segments()
clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs
clk: mediatek: mt8135: Fix inverted gate control for devapc_ck
clk/x86: pmc_atom: add kasprintf return value check
clk: palmas: Manage external-control prepare with devm
clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
clk: mediatek: Refactor pllfh registration to pass device
clk: mediatek: Pass device to clk_hw_register for PLLs
clk: mediatek: Refactor pll registration to pass device
clk: tegra: tegra124-emc: put EMC node on register failure
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
wifi: mac80211: fix per-STA profile length in cross-link CSA parsing
RDMA/efa: Fix PBL chunk length computation
RDMA/rxe: Fix UAF in ODP init error-handling path
iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs
iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init
iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
fs/ntfs3: reject restart table growth beyond U16_MAX entries
staging: rtl8723bs: use kfree_sensitive() for key material
firmware: qcom_scm: Introduce PAS context allocator helper function
remoteproc: Prevent crash handling to race with rproc_del()
remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
remoteproc: Allow shutdown of crashed processors
remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()
cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf
cpufreq/amd-pstate: Add comment explaining nominal_perf usage for performance policy
w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
spi: oc-tiny: switch to managed controller allocation
clk: mediatek: mt6735: Unregister PLLs on probe failure
isofs: release zisofs block pointer buffer head
powercap: intel_rapl_tpmi: Handle PMU registration failure during probe
thermal/drivers/qcom-spmi-adc-tm5: Drop IIO_VAL_INT check in adc_tm5_get_temp
thermal/drivers/airoha: Fix copy paste error for sen internal
thermal/drivers/airoha: Fix copy paste error on clamp_t low temp
RDMA/mlx5: Fix integer overflow of user QP buffer size
crypto: keembay - publish OF module alias for OCS AES/SM4
crypto: keembay - Initialize completion before requesting IRQ
scsi: ufs: debugfs: Reserve space for a string terminator
power: supply: sbs-battery: Use a per-device serial number buffer
arm64: RSI: fix field-spanning write warning in attestation token init
tools/build: Allow versioning of all LLVM tools defined in Makefile.include
pinctrl: mediatek: free EINT resources on unbind
cxl/region: Fix use-after-free in find_pos_and_ways() error path
selftests/bpf: Fix memory leak on subtest_states reallocation
selftests/bpf: Fix incorrect error checking for pthread_create
ARM: lpc32xx: only run SoC init on LPC32xx hardware
bpf: Fix CFI mismatch in task work callback
arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen property
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
arm64: dts: rockchip: Add missing hclk for RK3588 eDP1
arm64: dts: rockchip: Add missing hclk for RK3588 eDP0
drm/panthor: return PTR_ERR() from devm_drm_dev_alloc()
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
drm/tve200: add OF module alias for autoloading
perf cap: Remove used_root parameter and simplify capability checks
leds: pca9532: Fix phantom device registration on missing hardware
PM: hibernate: Fix memory leak in snapshot_write_next() error path
RDMA/erdma: complete object teardown when the destroy command fails
xfrm: Fix skb double-free in xfrm_dev_direct_output()
perf cs-etm: Avoid truncating AUX buffer sizes to int
perf cs-etm: Flush thread stacks after decoder reset
riscv: dts: spacemit: k1: Split gmac_clk_ref into independent pinctrl groups
riscv: dts: spacemit: Add OrangePi R2S board device tree
riscv: dts: spacemit: add MusePi Pro board device tree
firmware: arm_scmi: Unrequest devices if driver registration fails
firmware: arm_scmi: Roll back partial protocol table registration
cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems
cpufreq/amd-pstate: Fix EPP return type and handle errors during initialization
cpufreq/amd-pstate: Add support for platform profile class
cpufreq/amd-pstate: Add dynamic energy performance preference
amd-pstate: Make certain freq_attrs conditionally visible
cpufreq/amd-pstate: Use sysfs_match_string() for epp
cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active
ARM: dts: allwinner: a10: Fix PMU interrupt
ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
ext4: fix buffer_head leak in ext4_init_orphan_info
RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
wifi: ath12k: Correctly copy the hint BSSID in WMI scan request
wifi: ath12k: allocate HOST_DDR and BDF regions after Q6 RO region
wifi: ath12k: refactor QMI memory assignment
wifi: ath12k: switch to name-based reserved memory lookup
wifi: ath6kl: avoid buffer overreads in WMI event handlers
ext4: validate readdir offset before accessing dirent
ext4: use fsdata to track inline data write state and fix race
ext4: drain in-flight DIO before buffered write fallback
ext4: clear stale xarray tags on folios skipped during writeback
thermal: intel: int3400: clean up ODVP on probe failures
iommu/arm-smmu-v3: Declare eats_s1chk and eats_trans as host-endian u64
iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
iommu/qcom: Remove sysfs device on probe failure path
iommu/amd: Fix undefined behavior in devid_write debugfs function
firmware: arm_scmi: Fix requested device removal race
RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
RDMA/core: Fix potential use after free in uverbs_free_dmah()
RDMA/core: Fix potential use after free in ib_free_cq()
RDMA/core: Fix potential use after free in counter_release()
RDMA/core: Fix potential use after free in ib_destroy_srq_user()
RDMA/core: Fix potential use after free in ib_destroy_cq_user()
RDMA/core: Fix use after free in ib_query_qp()
RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
RDMA/nldev: Fix locking when accessing mr->pd
RDMA/restrack: Fix typos in the comments
RDMA/mana_ib: drain QP references after partial table insertion
RDMA/erdma: Fix CEQ tasklet use-after-free on removal
PCI: j721e: Fix incorrect max_lanes for J7200
RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
bpf: Mark bpf_refcount field as unique
bpf: Preserve unique-field state across nested structs
bpf: Fix offset warn check for bpf_res_spin_lock
virt: arm-cca-guest: use migrate_disable() for attestation token requests
ACPI: battery: Adjust charging status validation check
bpf, riscv: Fix extable handling for arena load_acquire
riscv, bpf: Fix kernel stack corruption in tailcall with CFI
riscv, bpf: Fix memory leak in bpf_jit_free
libbpf: Search /lib64 and /lib in resolve_full_path()
bpf: Zero queue and stack outputs on lock failure
platform/x86: acer-wmi: reject missing gaming WMI results
ext4: skip extra isize expansion during mount to prevent deadlock
ext4: fix out-of-bounds read in ext4_read_inline_dir()
ext4: fix circular lock dependency in ext4_ext_migrate
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
ACPI: processor: validate MADT IOAPIC entry bounds
ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
RDMA/nldev: validate dynamic counter attribute length
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
selftests/bpf: Silence array bounds warning in global_map_resize
selftests/bpf: Check malloc result with ASSERT_NEQ in test_sha256
x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist
arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0
kcsan: avoid unintended access checking in NMIs
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]
RDMA/hfi1: Propagate sdma_txinit_ahg() errors
arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins
phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe
phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe
ASoC: meson: Keep link pointers valid on realloc failure
dmaengine: dw-edma: Clear stale requests on termination
dmaengine: dw-edma: Serialize channel state checks
dmaengine: dw-edma: Serialize abort state updates
dmaengine: dw-edma: Terminate all descriptors without callbacks
bpf: Reject arena frees below the arena base
drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg
driver core: soc: Unregister bus on early device registration failure
software node: Fix software_node_get_reference_args() with index -1
perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
mtd: mtdswap: Avoid freeing registered blktrans device twice
mtd: intel-dg: Fix runtime PM error path in probe
mtd: intel-dg: wake card on operations
vfio/pci: clear vdev->msi_perm after freeing it on init failure
char: xilinx_hwicap: unregister class on init errors
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
ppdev: prevent overflow when setting port timeout
cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)
misc: lan966x_pci: depopulate children on populate failure
misc: ad525x_dpot: use driver core groups for sysfs files
misc: rtsx: add missing write register handling
misc: bcm-vk: Use acquire/release for msgq_inited
speakup: keyhelp: guard letter_offsets possible out-of-range indexing
accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
uio: Fix stale info pointer in failed registration path
gpib: Move stuck SRQ update under lock
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
staging: rtl8723bs: remove multiple blank lines in core/
staging: rtl8723bs: replace rtw_zmalloc() with kzalloc()
staging: rtl8723bs: expand multiple assignment into separate statements
staging: rtl8723bs: fix operator and type cast spacing
staging: rtl8723bs: use standard offsetof in cfg80211 operations
staging: rtl8723bs: Fix operator spacing in rtw_security.c
UDF symlink pathComponent header OOB read
tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
usb: gadget: f_uac1_legacy: remove broken string configfs attrib…
nsiddams (nsiddams)
force-pushed
the
6.18.52-lts
branch
from
September 25, 2026 12:33
d64d989 to
0212757
Compare
commented
Sep 25, 2026
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.