[PATCH 6.18 000/325] 6.18.36-rc1 review

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

This is the start of the stable review cycle for the 6.18.36 release.
There are 325 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.36-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 6.18.36-rc1

Damien Le Moal <dlemoal@kernel.org>
    block: fix handling of dead zone write plugs

Will Deacon <will@kernel.org>
    arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU

Shanker Donthineni <sdonthineni@nvidia.com>
    arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU

Mark Rutland <mark.rutland@arm.com>
    arm64: errata: Mitigate TLBI errata on various Arm CPUs

Mark Rutland <mark.rutland@arm.com>
    arm64: cputype: Add C1-Premium definitions

Mark Rutland <mark.rutland@arm.com>
    arm64: cputype: Add C1-Ultra definitions

Stefano Garzarella <sgarzare@redhat.com>
    vsock/virtio: fix skb overhead accounting to preserve full buf_alloc

Eric Dumazet <edumazet@google.com>
    vsock/virtio: fix potential unbounded skb queue

Julian Anastasov <ja@ssi.bg>
    ipvs: skip ipv6 extension headers for csum checks

Jason Gunthorpe <jgg@ziepe.ca>
    RDMA/umem: Fix truncation for block sizes >= 4G

Leon Romanovsky <leon@kernel.org>
    RDMA: Move DMA block iterator logic into dedicated files

Randy Dunlap <rdunlap@infradead.org>
    RDMA/umem: fix kernel-doc warnings

Davide Ornaghi <d.ornaghi97@gmail.com>
    netfilter: nft_fib: fix stale stack leak via the OIFNAME register

Jason Gunthorpe <jgg@ziepe.ca>
    RDMA: During rereg_mr ensure that REREG_ACCESS is compatible

Jacob Moroni <jmoroni@google.com>
    RDMA/umem: Add helpers for umem dmabuf revoke lock

Jacob Moroni <jmoroni@google.com>
    RDMA/umem: Move umem dmabuf revoke logic into helper function

Jacob Moroni <jmoroni@google.com>
    RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper

Tejun Heo <tj@kernel.org>
    sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()

Johannes Berg <johannes.berg@intel.com>
    wifi: mac80211: tests: mark HT check strict

Rio Liu <rio@r26.me>
    wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode

Johan Hovold <johan@kernel.org>
    driver core: reject devices with unregistered buses

Mingyu Wang <25181214217@stu.xidian.edu.cn>
    fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Use krealloc_array() in dal_vector_reserve()

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

Leorize <leorize+oss@disroot.org>
    drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Bound VBIOS record-chain walk loops

Priya Hosur <Priya.Hosur@amd.com>
    drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range

Yang Wang <kevinyang.wang@amd.com>
    drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2

Yang Wang <kevinyang.wang@amd.com>
    drm/amd/pm: fix smu13 power limit default/cap calculation

Vitaly Prosyak <vitaly.prosyak@amd.com>
    drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)

Christian König <christian.koenig@amd.com>
    drm/amdgpu: restart the CS if some parts of the VM are still invalidated

Christian König <christian.koenig@amd.com>
    drm/amdgpu: fix waiting for all submissions for userptrs

Maíra Canal <mcanal@igalia.com>
    drm/v3d: Skip CSD when it has zeroed workgroups

Maíra Canal <mcanal@igalia.com>
    drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups

Maíra Canal <mcanal@igalia.com>
    drm/v3d: Fix global performance monitor reference counting

Maíra Canal <mcanal@igalia.com>
    drm/v3d: Wait for pending L2T flush before cleaning caches

Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>
    drm/xe: Clear pending_disable before signaling suspend fence

Jani Nikula <jani.nikula@intel.com>
    drm/xe/display: fix oops in suspend/shutdown without display

Andrew Martin <andrew.martin@amd.com>
    drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

Muhammad Bilal <meatuni001@gmail.com>
    drm/amdkfd: fix NULL dereference in get_queue_ids()

Simona Vetter <simona.vetter@ffwll.ch>
    drm/gem: Try to fix change_handle ioctl, attempt 4

Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
    slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock

Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
    slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD

Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
    slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership

Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
    slimbus: qcom-ngd-ctrl: Initialize controller resources in controller

Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
    slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd

Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
    slimbus: qcom-ngd-ctrl: Fix probe error path ordering

Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
    slimbus: qcom-ngd-ctrl: Fix up platform_driver registration

Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
    slimbus: qcom-ngd-ctrl: fix OF node refcount

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: Limit XDomain response copy to actual frame size

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: Validate XDomain request packet size before type cast

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: Clamp XDomain response data copy to allocation size

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: Bound root directory content to block size

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: Reject zero-length property entries in validator

Wyatt Feng <bronzed_45_vested@icloud.com>
    sctp: stream: fully roll back denied add-stream state

Zhao Zhang <zzhan461@ucr.edu>
    sctp: diag: reject stale associations in dump_one path

David Howells <dhowells@redhat.com>
    rxrpc: Fix the ACK parser to extract the SACK table for parsing

Justin Lai <justinlai0215@realtek.com>
    rtase: Reset TX subqueue when clearing TX ring

Justin Lai <justinlai0215@realtek.com>
    rtase: Avoid sleeping in get_stats64()

Kendall Willis <k-willis@ti.com>
    pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source

Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
    pmdomain: imx: fix OF node refcount

Jisheng Zhang <jszhang@kernel.org>
    mmc: sdhci: add signal voltage switch in sdhci_resume_host

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC

Inochi Amaoto <inochiama@gmail.com>
    mmc: litex_mmc: Set mandatory idle clocks before CMD0

Heiko Stuebner <heiko@sntech.de>
    mmc: dw_mmc-rockchip: Add missing private data for very old controllers

Kamal Dasu <kamal.dasu@broadcom.com>
    mmc: core: Fix host controller programming for fixed driver type

Usama Arif <usama.arif@linux.dev>
    mm/mincore: handle non-swap entries before !CONFIG_SWAP guard

Shakeel Butt <shakeel.butt@linux.dev>
    mm/list_lru: drain before clearing xarray entry on reparent

David Carlier <devnexen@gmail.com>
    mm/hugetlb: restore reservation on error in hugetlb folio copy paths

Lorenzo Stoakes <ljs@kernel.org>
    mm/hugetlb: avoid false positive lockdep assertion

SeongJae Park <sj@kernel.org>
    mm/damon/reclaim: handle ctx allocation failure

SeongJae Park <sj@kernel.org>
    mm/damon/lru_sort: handle ctx allocation failure

Muchun Song <muchun.song@linux.dev>
    mm/cma_debug: fix invalid accesses for inactive CMA areas

Muchun Song <muchun.song@linux.dev>
    mm/cma: fix reserved page leak on activation failure

Christian A. Ehrhardt <lk@c--e.de>
    io_uring/wait: fix min_timeout behavior

Jens Axboe <axboe@kernel.dk>
    io_uring/kbuf: don't truncate end buffer for bundles

Judith Mendez <jm@ti.com>
    pinctrl: mcp23s08: Read spi-present-mask as u8 not u32

Dawei Feng <dawei.feng@seu.edu.cn>
    octeontx2-af: fix memory leak in rvu_setup_hw_resources()

Andre Heider <a.heider@gmail.com>
    nvmem: layouts: onie-tlv: fix hang on unknown types

Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
    nvmem: core: fix use-after-free bugs in error paths

Jonas Jelonek <jelonek.jonas@gmail.com>
    net: sfp: initialize i2c_block_size at adapter configure time

Yuqi Xu <xuyq21@lenovo.com>
    net: rds: clear i_sends on setup unwind

Santosh Kalluri <santosh.kalluri129@gmail.com>
    net: phonet: free phonet_device after RCU grace period

Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
    net: mv643xx: fix OF node refcount

ZhaoJinming <zhaojinming@uniontech.com>
    net: bonding: fix NULL pointer dereference in bond_do_ioctl()

ZhaoJinming <zhaojinming@uniontech.com>
    net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()

Nikolay Kuratov <kniv@yandex-team.ru>
    net/mlx5: Reorder completion before putting command entry in cmd_work_handler

Tudor Ambarus <tudor.ambarus@linaro.org>
    firmware: samsung: acpm: Fix mailbox channel leak on probe error

Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
    misc: fastrpc: Fix NULL pointer dereference in rpmsg callback

Junrui Luo <moonafterrain@outlook.com>
    misc: fastrpc: fix DMA address corruption due to find_vma misuse

Zhenghang Xiao <kipreyyy@gmail.com>
    misc: fastrpc: fix use-after-free race in fastrpc_map_create

Anandu Krishnan E <anandu.e@oss.qualcomm.com>
    misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context

Shakeel Butt <shakeel.butt@linux.dev>
    memcg: use round-robin victim selection in refill_stock

Davidlohr Bueso <dave@stgolabs.net>
    locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

Yilin Zhu <zylzyl2333@gmail.com>
    ipc/shm: serialize orphan cleanup with shm_nattch updates

Jason Gunthorpe <jgg@ziepe.ca>
    iommu/dma: Do not try to iommu_map a 0 length region in swiotlb

Cryolitia PukNgae <cryolitia.pukngae@linux.dev>
    Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard

Zeyu WANG <zeyu.thomas.wang@gmail.com>
    Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)

Akhil R <akhilrajeev@nvidia.com>
    i2c: tegra: Fix NOIRQ suspend/resume

Guillermo Rodríguez <guille.rodriguez@gmail.com>
    i2c: stm32f7: fix timing computation ignoring i2c-analog-filter

Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
    i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()

Carlos Song <carlos.song@nxp.com>
    i2c: imx: fix clock and pinctrl state inconsistency in runtime PM

Carlos Song <carlos.song@nxp.com>
    i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()

Ji'an Zhou <eilaimemedsnaimel@gmail.com>
    futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock

Jann Horn <jannh@google.com>
    fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios

Jann Horn <jannh@google.com>
    fuse: reject fuse_notify() pagecache ops on directories

Arpith Kalaginanavoor <arpithk@nvidia.com>
    fs/qnx6: fix pointer arithmetic in directory iteration

Christian Brauner <brauner@kernel.org>
    pidfd: refuse access to tasks that have started exiting harder

Hyunwoo Kim <imv4bel@gmail.com>
    inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush

Michael Bommarito <michael.bommarito@gmail.com>
    IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

Jann Horn <jannh@google.com>
    fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()

Kyle Meyer <kyle.meyer@hpe.com>
    bnxt_en: Fix NULL pointer dereference

Chancel Liu <chancel.liu@nxp.com>
    ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write

Salman Alghamdi <me@cipherat.com>
    staging: rtl8723bs: fix buffer over-read in rtw_update_protection

Amit Matityahu <amitmat@amazon.com>
    timers/migration: Fix livelock in tmigr_handle_remote_up()

Raf Dickson <rafdog35@gmail.com>
    vsock/vmci: fix sk_ack_backlog leak on failed handshake

Yuqi Xu <xuyuqiabc@gmail.com>
    wifi: nl80211: reject oversized EMA RNR lists

Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used

Yingjie Gao <gaoyingjie@uniontech.com>
    xfs: fix rtgroup cleanup in CoW fork repair

Yingjie Gao <gaoyingjie@uniontech.com>
    xfs: fix error returns in CoW fork repair

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    mptcp: add-addr: always drop other suboptions

Tao Cui <cuitao@kylinos.cn>
    selftests: mptcp: add test for extra_subflows underflow on userspace PM

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    mptcp: sockopt: set sockopt on all subflows

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    mptcp: sockopt: check timestamping ret value

Tao Cui <cuitao@kylinos.cn>
    mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation

Paolo Abeni <pabeni@redhat.com>
    mptcp: allow subflow rcv wnd to shrink

Paolo Abeni <pabeni@redhat.com>
    mptcp: close TOCTOU race while computing rcv_wnd

Paolo Abeni <pabeni@redhat.com>
    mptcp: fix retransmission loop when csum is enabled

Alistair Popple <apopple@nvidia.com>
    arm64: mm: call pagetable dtor when freeing hot-removed page tables

Karl Mehltretter <kmehltretter@gmail.com>
    ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow

Karl Mehltretter <kmehltretter@gmail.com>
    ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O

Yuho Choi <dbgh9129@gmail.com>
    ARM: socfpga: Fix OF node refcount leak in SMP setup

Sechang Lim <rhkrqnwk98@gmail.com>
    udp: clear skb->dev before running a sockmap verdict

Cunlong Li <shenxiaogll@gmail.com>
    zram: fix use-after-free in zram_bvec_write_partial()

Michael Bommarito <michael.bommarito@gmail.com>
    RDMA/srp: bound SRP_RSP sense copy by the received length

Yishai Hadas <yishaih@nvidia.com>
    RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc

Jason Gunthorpe <jgg@ziepe.ca>
    RDMA/core: Validate the passed in fops for ib_get_ucaps()

Yin Tirui <yintirui@huawei.com>
    mm/huge_memory: update file PUD counter before folio_put()

SeongJae Park <sj@kernel.org>
    mm/damon/ops-common: call folio_test_lru() after folio_get()

Yin Tirui <yintirui@huawei.com>
    mm/huge_memory: update file PMD counter before folio_put()

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()

Wentao Liang <vulab@iscas.ac.cn>
    drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()

Clément Léger <cleger@meta.com>
    io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Fix UAF at snd_timer_user_params()

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Forcibly close timer instances at closing

HyeongJun An <sammiee5311@gmail.com>
    USB: serial: kl5kusb105: fix bulk-out buffer overflow

Jack Wu <jackbb_wu@compal.com>
    USB: serial: option: add usb-id for Dell Wireless DW5826e-m

Adrian Korwel <adriank20047@gmail.com>
    USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()

Adrian Korwel <adriank20047@gmail.com>
    USB: serial: io_ti: fix heap overflow in get_manuf_info()

Tristan Madani <tristmd@gmail.com>
    xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()

Takao Sato <takaosato1997@gmail.com>
    xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()

Wyatt Feng <bronzed_45_vested@icloud.com>
    xfrm: espintcp: do not reuse an in-progress partial send

Gil Portnoy <dddhkts1@gmail.com>
    ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL

Anton Leontev <leontyevantony@gmail.com>
    hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf

Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
    drm/i915/gem: Fix phys BO pread/pwrite with offset

Joey Gouly <joey.gouly@arm.com>
    KVM: arm64: Restore POR_EL0 access to host EL0

Sean Christopherson <seanjc@google.com>
    KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA

Sean Christopherson <seanjc@google.com>
    KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying

Wei Liu <wei.liu@kernel.org>
    mshv: add a missing padding field

Inochi Amaoto <inochiama@gmail.com>
    mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation

Alice Ryhl <aliceryhl@google.com>
    rust: kasan/kbuild: fix rustc-option when cross-compiling

Alice Ryhl <aliceryhl@google.com>
    rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES

Nathan Chancellor <nathan@kernel.org>
    ARM: Do not select HAVE_RUST when KASAN is enabled

Miguel Ojeda <ojeda@kernel.org>
    rust: x86: support Rust >= 1.98.0 target spec

Masami Hiramatsu (Google) <mhiramat@kernel.org>
    tracing/probes: Point the error offset correctly for eprobe argument error

Eva Kurchatova <eva.kurchatova@virtuozzo.com>
    tracing: Fix CFI violation in probestub being called by tprobes

Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
    accel/ivpu: Fix signed integer truncation in IPC receive

Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
    accel/ivpu: Add buffer overflow check in MS get_info_ioctl

Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
    accel/ivpu: Add bounds checks for firmware log indices

Wupeng Ma <mawupeng1@huawei.com>
    mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison

Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
    soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()

Michael Bommarito <michael.bommarito@gmail.com>
    Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig

Yuqi Xu <xuyq21@lenovo.com>
    Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend

Georgiy Osokin <g.osokin@auroraos.dev>
    tee: shm: fix shm leak in register_shm_helper()

Davide Ornaghi <d.ornaghi97@gmail.com>
    netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register

Tristan Madani <tristan@talencesecurity.com>
    netfilter: nft_tunnel: fix use-after-free on object destroy

Lizhi Hou <lizhi.hou@amd.com>
    accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()

Wentao Liang <vulab@iscas.ac.cn>
    drm/xe: fix refcount leak in xe_range_fence_insert()

Alexander A. Klimov <grandmaster@al2klimov.de>
    drm/vc4: fix krealloc() memory leak

Dmitry Osipenko <dmitry.osipenko@collabora.com>
    drm/virtio: Fix driver removal with disabled KMS

Nikita Zhandarovich <n.zhandarovich@fintech.ru>
    drm/i915/edp: Check supported link rates DPCD read

Pengyu Luo <mitltlatltl@gmail.com>
    clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time

Kuan-Wei Chiu <visitorckw@gmail.com>
    clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs

Hans de Goede <johannes.goede@oss.qualcomm.com>
    clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked

Dongli Zhang <dongli.zhang@oracle.com>
    KVM: VMX: Update SVI during runtime APICv activation

Ido Schimmel <idosch@nvidia.com>
    ipv6: Fix a potential NPD in cleanup_prefix_route()

Jiawen Wu <jiawenwu@trustnetic.com>
    net: txgbe: initialize module info buffer

Jiawen Wu <jiawenwu@trustnetic.com>
    net: txgbe: rename the SFP related

Jiawen Wu <jiawenwu@trustnetic.com>
    net: txgbe: support CR modules for AML devices

Jiawen Wu <jiawenwu@trustnetic.com>
    net: txgbe: optimize the flow to setup PHY for AML devices

Til Kaiser <mail@tk154.de>
    net: mvpp2: build skb from XDP-adjusted data on XDP_PASS

Til Kaiser <mail@tk154.de>
    net: mvpp2: refill RX buffers before XDP or skb use

Til Kaiser <mail@tk154.de>
    net: mvpp2: limit XDP frame size to the RX buffer

Til Kaiser <mail@tk154.de>
    net: mvpp2: sync RX data at the hardware packet offset

Florian Westphal <fw@strlen.de>
    netfilter: nft_exthdr: fix register tracking for F_PRESENT flag

Xiang Mei <xmei5@asu.edu>
    netfilter: nf_log: validate MAC header was set before dumping it

Kyle Zeng <kylebot@openai.com>
    netfilter: x_tables: avoid leaking percpu counter pointers

Weiming Shi <bestswngs@gmail.com>
    netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

Florian Westphal <fw@strlen.de>
    netfilter: revalidate bridge ports

Felix Gu <ustc.gu@gmail.com>
    spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX

Breno Leitao <leitao@debian.org>
    rds: mark snapshot pages dirty in rds_info_getsockopt()

Eric Dumazet <edumazet@google.com>
    ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

Xiang Mei <xmei5@asu.edu>
    tun: zero the whole vnet header in tun_put_user()

Weiming Shi <bestswngs@gmail.com>
    net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

Kyle Zeng <kylebot@openai.com>
    net: guard timestamp cmsgs to real error queue skbs

Xin Long <lucien.xin@gmail.com>
    sctp: validate embedded INIT chunk and address list lengths in cookie

Eric Dumazet <edumazet@google.com>
    ip6_vti: set netns_immutable on the fallback device.

Michael Bommarito <michael.bommarito@gmail.com>
    sctp: fix uninit-value in __sctp_rcv_asconf_lookup()

Vijendar Mukunda <Vijendar.Mukunda@amd.com>
    ASoC: SOF: amd: fix for ipc flags check

Jeremy Kerr <jk@codeconstruct.com.au>
    net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission

Jeremy Kerr <jk@codeconstruct.com.au>
    net: mctp: usb: fix race between urb completion and rx_retry cancellation

Marco Scardovi <scardracs@disroot.org>
    gpio: rockchip: fix generic IRQ chip leak on remove

Ruoyu Wang <ruoyuw560@gmail.com>
    gpio: zynq: fix runtime PM leak on remove

Chih Kai Hsu <hsu.chih.kai@realtek.com>
    r8152: handle the return value of usb_reset_device()

Adrian Moreno <amorenoz@redhat.com>
    net: openvswitch: fix possible kfree_skb of ERR_PTR

Kyle Zeng <kylebot@openai.com>
    ipv6: sit: reload inner IPv6 header after GSO offloads

Fushuai Wang <wangfushuai@baidu.com>
    net/mlx5: Use effective affinity mask for IRQ selection

Dragos Tatulea <dtatulea@nvidia.com>
    net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure

Dragos Tatulea <dtatulea@nvidia.com>
    net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list

Mingyu Wang <25181214217@stu.xidian.edu.cn>
    net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

Maxime Chevallier <maxime.chevallier@bootlin.com>
    net: phy: clean the sfp upstream if phy probing fails

Jakub Kicinski <kuba@kernel.org>
    netdev: fix double-free in netdev_nl_bind_rx_doit()

Rosen Penev <rosenp@gmail.com>
    net: ibm: emac: Fix use-after-free during device removal

Yao Sang <sangyao@kylinos.cn>
    net/mlx4: avoid GCC 10 __bad_copy_from() false positive

HanQuan <eilaimemedsnaimel@gmail.com>
    net: add pskb_may_pull() to skb_gro_receive_list()

Eric Dumazet <edumazet@google.com>
    tcp: restrict SO_ATTACH_FILTER to priv users

Richard Fitzgerald <rf@opensource.cirrus.com>
    ASoC: wm_adsp: Fix NULL dereference when removing firmware controls

Yun Zhou <yun.zhou@windriver.com>
    gpio: mvebu: fix NULL pointer dereference in suspend/resume

Chenguang Zhao <zhaochenguang@kylinos.cn>
    netlabel: validate unlabeled address and mask attribute lengths

Vikas Gupta <vikas.gupta@broadcom.com>
    bnge: fix context mem iteration

Arthur Kiyanovski <akiyano@amazon.com>
    net: ena: PHC: Add missing barrier

Alok Tiwari <alok.a.tiwari@oracle.com>
    idpf: fix mailbox capability for set device clock time

Petr Oros <poros@redhat.com>
    ice: fix missing priority callbacks for U.FL DPLL pins

Sanghyun Park <sanghyun.park.cnu@gmail.com>
    xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

Li RongQing <lirongqing@baidu.com>
    dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device

Li RongQing <lirongqing@baidu.com>
    dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments

Zhenghang Xiao <kipreyyy@gmail.com>
    xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload

Weiming Shi <bestswngs@gmail.com>
    tap: free page on error paths in tap_get_user_xdp()

Gabriele Monaco <gmonaco@redhat.com>
    verification/rvgen: Fix ltl2k writing True as a literal

Gabriele Monaco <gmonaco@redhat.com>
    verification/rvgen: Fix options shared among commands

Gabriele Monaco <gmonaco@redhat.com>
    tools/rv: Fix cleanup after failed trace setup

Gabriele Monaco <gmonaco@redhat.com>
    tools/rv: Fix substring match when listing container monitors

Gabriele Monaco <gmonaco@redhat.com>
    tools/rv: Fix substring match bug in monitor name search

Gabriele Monaco <gmonaco@redhat.com>
    tools/rv: Ensure monitor name and desc are NUL-terminated

Zhan Xusheng <zhanxusheng1024@gmail.com>
    cpufreq/amd-pstate: drop stale @epp_cached kdoc

Johan Hovold <johan@kernel.org>
    spi: cadence-quadspi: fix unclocked access on unbind

Kyle Zeng <kylebot@openai.com>
    ALSA: seq: dummy: fix UMP event stack overread

Ji'an Zhou <eilaimemedsnaimel@gmail.com>
    ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
    time: Fix off-by-one in settimeofday() usec validation

Dexuan Cui <decui@microsoft.com>
    hyperv: Clean up and fix the guest ID comment in hvgdk.h

Aleksandr Nogikh <nogikh@google.com>
    signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()

Geliang Tang <geliang@kernel.org>
    selftests: harness: fix pidfd leak in __wait_for_test

Michael Kelley <mhklinux@outlook.com>
    drm/hyperv: During panic do VMBus unload after frame buffer is flushed

Michael Kelley <mhklinux@outlook.com>
    Drivers: hv: vmbus: Provide option to skip VMBus unload on panic

Roman Kisel <romank@linux.microsoft.com>
    Drivers: hv: VMBus protocol version 6.0

Xin Long <lucien.xin@gmail.com>
    sctp: purge outqueue on stale COOKIE-ECHO handling

Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
    net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr

Eric Dumazet <edumazet@google.com>
    ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

Andy Roulin <aroulin@nvidia.com>
    vxlan: vnifilter: fix spurious notification on VNI update

Andy Roulin <aroulin@nvidia.com>
    vxlan: vnifilter: send notification on VNI add

Nithin Dabilpuram <ndabilpuram@marvell.com>
    octeontx2-af: npc: Fix CPT channel mask in npc_install_flow

Xin Long <lucien.xin@gmail.com>
    sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

Rajat Gupta <rajat.gupta@oss.qualcomm.com>
    net/sched: fix pedit partial COW leading to page cache corruption

Lorenzo Bianconi <lorenzo@kernel.org>
    net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown

Lorenzo Bianconi <lorenzo@kernel.org>
    net: airoha: Fix use-after-free in metadata dst teardown

Kurt Kanzenbach <kurt@linutronix.de>
    ptp: vclock: Switch from RCU to SRCU

Eric Dumazet <edumazet@google.com>
    ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options

Jianyu Li <jianyu.li@mediatek.com>
    af_unix: Fix inq_len update problem in partial read

Suman Ghosh <sumang@marvell.com>
    octeontx2-af: Fix initialization of mcam's entry2target_pffunc field

Geetha sowjanya <gakula@marvell.com>
    octeontx2-pf: Fix NDC sync operation errors

Jason Xing <kernelxing@tencent.com>
    xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()

Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Bluetooth: MGMT: Fix backward compatibility with userspace

SeungJu Cheon <suunj1331@gmail.com>
    Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect

SeungJu Cheon <suunj1331@gmail.com>
    Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls

Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync

Bharath Reddy <kbreddy.rpbc@gmail.com>
    Bluetooth: fix memory leak in error path of hci_alloc_dev()

Zhang Cen <rollkingzzc@gmail.com>
    Bluetooth: bnep: reject short frames before parsing

Dudu Lu <phx0fer@gmail.com>
    Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling

SeungJu Cheon <suunj1331@gmail.com>
    Bluetooth: RFCOMM: validate skb length in MCC handlers

Zhang Cen <rollkingzzc@gmail.com>
    Bluetooth: MGMT: validate advertising TLV before type checks

Zhang Cen <rollkingzzc@gmail.com>
    Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

Fedor Pchelkin <pchelkin@ispras.ru>
    wifi: fix leak if split 6 GHz scanning fails

Jiayuan Chen <jiayuan.chen@linux.dev>
    ipv6: anycast: insert aca into global hash under idev->lock

Tapio Reijonen <tapio.reijonen@vaisala.com>
    net: fec: fix pinctrl default state restore order on resume

David Thompson <davthompson@nvidia.com>
    net: lan743x: permit VLAN-tagged packets up to configured MTU

Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
    net: garp: fix unsigned integer underflow in garp_pdu_parse_attr

Kuniyuki Iwashima <kuniyu@google.com>
    hsr: Remove WARN_ONCE() in hsr_addr_is_self().

Kuniyuki Iwashima <kuniyu@google.com>
    net: Annotate sk->sk_write_space() for UDP SOCKMAP.

Oscar Maes <oscmaes92@gmail.com>
    pcnet32: stop holding device spin lock during napi_complete_done

Deepanshu Kartikey <kartikey406@gmail.com>
    wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap

Yicong Hui <yiconghui@gmail.com>
    drm/imx: Fix three kernel-doc warnings in dcss-scaler.c

Mark Bloch <mbloch@nvidia.com>
    devlink: Release nested relation on devlink free

Lee Jones <lee@kernel.org>
    l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()

Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
    6lowpan: fix off-by-one in multicast context address compression

Jamal Hadi Salim <jhs@mojatatu.com>
    net/sched: act_api: use RCU with deferred freeing for action lifecycle

Guangshuo Li <lgs201920130244@gmail.com>
    dm cache policy smq: check allocation under invalidate lock

Yiming Qian <yimingqian591@gmail.com>
    netfilter: bridge: make ebt_snat ARP rewrite writable

Jiayuan Chen <jiayuan.chen@linux.dev>
    netfilter: nft_ct: bail out on template ct in get eval

Florian Westphal <fw@strlen.de>
    netfilter: conntrack_irc: fix possible out-of-bounds read

Fernando Fernandez Mancera <fmancera@suse.de>
    netfilter: synproxy: add mutex to guard hook reference counting

Julian Anastasov <ja@ssi.bg>
    ipvs: clear the svc scheduler ptr early on edit

Fernando Fernandez Mancera <fmancera@suse.de>
    netfilter: xt_NFQUEUE: prefer raw_smp_processor_id

Gil Portnoy <dddhkts1@gmail.com>
    ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares

Gao Xiang <xiang@kernel.org>
    erofs: fix use-after-free on sbi->sync_decompress

Gao Xiang <xiang@kernel.org>
    erofs: tidy up synchronous decompression

Robertus Diawan Chris <robertusdchris@gmail.com>
    tee: qcomtee: add missing va_end in early return qcomtee_object_user_init()

Arnd Bergmann <arnd@arndb.de>
    tee: fix tee_ioctl_object_invoke_arg padding

Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
    soc: qcom: ice: Return -ENODEV if the ICE platform device is not found

Mihai Sain <mihai.sain@microchip.com>
    ARM: dts: microchip: sam9x7: fix GMAC clock configuration

Val Packett <val@packett.cool>
    arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins

Harshal Dev <harshal.dev@oss.qualcomm.com>
    soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE

Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
    tee: optee: prevent use-after-free when the client exits before the supplicant

Nicolò Coccia <n.coccia96@gmail.com>
    net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS

Ido Schimmel <idosch@nvidia.com>
    ipv6: mcast: Fix use-after-free when processing MLD queries

Mingyu Wang <25181214217@stu.xidian.edu.cn>
    i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl

Hyunwoo Kim <imv4bel@gmail.com>
    KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation

Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
    ARM: fix branch predictor hardening

Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
    ARM: fix hash_name() fault

Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
    ARM: allow __do_kernel_fault() to report execution of memory faults

Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
    ARM: group is_permission_fault() with is_translation_fault()

Kuniyuki Iwashima <kuniyu@google.com>
    bpf: Free reuseport cBPF prog after RCU grace period.


-------------

Diffstat:

 Documentation/ABI/testing/sysfs-fs-erofs           |  14 ++-
 Documentation/arch/arm64/silicon-errata.rst        |  46 +++++++
 Makefile                                           |   7 +-
 arch/arm/Kconfig                                   |   2 +-
 arch/arm/boot/dts/microchip/sam9x7.dtsi            |   6 +-
 arch/arm/include/asm/io.h                          |  15 ++-
 arch/arm/kernel/entry-armv.S                       |   2 +-
 arch/arm/mach-socfpga/platsmp.c                    |   1 +
 arch/arm/mm/alignment.c                            |   6 +-
 arch/arm/mm/fault.c                                | 100 +++++++++++----
 arch/arm64/Kconfig                                 |  38 ++++++
 arch/arm64/Makefile                                |   3 +
 arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi        |   7 +-
 arch/arm64/include/asm/cputype.h                   |   4 +
 arch/arm64/kernel/cpu_errata.c                     |  34 ++++-
 arch/arm64/kvm/at.c                                |   6 +-
 arch/arm64/kvm/hyp/include/hyp/switch.h            |   2 +
 arch/arm64/mm/mmu.c                                |   1 +
 arch/x86/Makefile                                  |   4 +
 arch/x86/Makefile.um                               |   8 ++
 arch/x86/kvm/svm/sev.c                             |  27 ++--
 arch/x86/kvm/vmx/vmx.c                             |   9 --
 arch/x86/kvm/x86.c                                 |   7 ++
 block/blk-zoned.c                                  |  32 ++++-
 drivers/accel/amdxdna/aie2_ctx.c                   |   3 +
 drivers/accel/ivpu/ivpu_fw_log.c                   |   5 +
 drivers/accel/ivpu/ivpu_ipc.c                      |   2 +-
 drivers/accel/ivpu/ivpu_ms.c                       |   7 ++
 drivers/base/bus.c                                 |  11 +-
 drivers/block/zram/zram_drv.c                      |   2 +-
 drivers/clk/qcom/dispcc-sc8280xp.c                 |   4 +-
 drivers/clk/qcom/dispcc-x1e80100.c                 |   2 +-
 drivers/clk/samsung/clk-gs101.c                    |   2 +-
 drivers/cpufreq/amd-pstate.h                       |   1 -
 drivers/firmware/samsung/exynos-acpm.c             |  13 +-
 drivers/gpio/gpio-mvebu.c                          |   4 +-
 drivers/gpio/gpio-rockchip.c                       |   4 +-
 drivers/gpio/gpio-zynq.c                           |   1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c            |   6 +-
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c  |   2 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c   |  49 ++++++--
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  |   5 +
 drivers/gpu/drm/amd/display/dc/basics/vector.c     |   4 +-
 drivers/gpu/drm/amd/display/dc/bios/bios_parser.c  |  15 ++-
 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c |  81 ++++++++----
 .../drm/amd/display/dc/bios/bios_parser_helper.h   |   5 +
 drivers/gpu/drm/amd/display/dc/dc_dp_types.h       |   2 +-
 drivers/gpu/drm/amd/display/dc/dce/dce_transform.c |  10 +-
 .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c   |  10 +-
 .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c    |   3 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c   |  32 ++---
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c   |  32 ++---
 .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c   |   3 +-
 .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c   |   1 -
 drivers/gpu/drm/drm_gem.c                          |  73 +++++------
 drivers/gpu/drm/drm_ioctl.c                        |   3 +-
 drivers/gpu/drm/hyperv/hyperv_drm_drv.c            |   5 +
 drivers/gpu/drm/hyperv/hyperv_drm_modeset.c        |  15 +--
 drivers/gpu/drm/i915/display/intel_dp.c            |  11 +-
 drivers/gpu/drm/i915/gem/i915_gem_phys.c           |  19 ++-
 drivers/gpu/drm/imx/dcss/dcss-scaler.c             |   3 +
 drivers/gpu/drm/v3d/v3d_gem.c                      |   8 ++
 drivers/gpu/drm/v3d/v3d_perfmon.c                  |  24 +++-
 drivers/gpu/drm/v3d/v3d_sched.c                    |  17 ++-
 drivers/gpu/drm/vc4/vc4_validate_shaders.c         |  13 +-
 drivers/gpu/drm/virtio/virtgpu_drv.c               |   5 +-
 drivers/gpu/drm/virtio/virtgpu_submit.c            |   4 +-
 drivers/gpu/drm/xe/display/xe_display.c            |  11 +-
 drivers/gpu/drm/xe/xe_guc_submit.c                 |   2 +-
 drivers/gpu/drm/xe/xe_range_fence.c                |   2 +
 drivers/hv/channel_mgmt.c                          |   1 +
 drivers/hv/hyperv_vmbus.h                          |   3 +-
 drivers/hv/vmbus_drv.c                             |  37 ++++--
 drivers/i2c/busses/i2c-imx-lpi2c.c                 |  53 ++++----
 drivers/i2c/busses/i2c-imx.c                       |  15 ++-
 drivers/i2c/busses/i2c-qcom-cci.c                  |   2 +-
 drivers/i2c/busses/i2c-stm32f7.c                   |   6 +-
 drivers/i2c/busses/i2c-tegra.c                     |  53 ++++----
 drivers/i2c/i2c-dev.c                              |   9 +-
 drivers/infiniband/core/Makefile                   |   2 +-
 drivers/infiniband/core/iter.c                     |  43 +++++++
 drivers/infiniband/core/ucaps.c                    |   8 +-
 drivers/infiniband/core/umem.c                     |  16 +++
 drivers/infiniband/core/umem_dmabuf.c              |  77 +++++++++---
 drivers/infiniband/core/uverbs_std_types_dmah.c    |   5 +
 drivers/infiniband/core/verbs.c                    |  38 ------
 drivers/infiniband/hw/bnxt_re/qplib_res.c          |   2 +-
 drivers/infiniband/hw/cxgb4/mem.c                  |   2 +-
 drivers/infiniband/hw/efa/efa_verbs.c              |   2 +-
 drivers/infiniband/hw/erdma/erdma_verbs.c          |   2 +-
 drivers/infiniband/hw/hns/hns_roce_alloc.c         |   2 +-
 drivers/infiniband/hw/hns/hns_roce_mr.c            |   4 +
 drivers/infiniband/hw/ionic/ionic_ibdev.h          |   2 +-
 drivers/infiniband/hw/irdma/main.h                 |   2 +-
 drivers/infiniband/hw/irdma/verbs.c                |   4 +
 drivers/infiniband/hw/mana/mana_ib.h               |   2 +-
 drivers/infiniband/hw/mlx4/mr.c                    |   5 +
 drivers/infiniband/hw/mlx5/mem.c                   |   1 +
 drivers/infiniband/hw/mlx5/mr.c                    |   4 +
 drivers/infiniband/hw/mlx5/umr.c                   |   1 +
 drivers/infiniband/hw/mthca/mthca_provider.c       |   2 +-
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c        |   2 +-
 drivers/infiniband/hw/qedr/verbs.c                 |   2 +-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma.h          |   2 +-
 drivers/infiniband/sw/rxe/rxe_verbs.c              |   5 +
 drivers/infiniband/ulp/isert/ib_isert.c            |   6 +
 drivers/infiniband/ulp/srp/ib_srp.c                |  30 ++++-
 drivers/input/keyboard/atkbd.c                     |  15 +++
 drivers/iommu/dma-iommu.c                          |  19 ++-
 drivers/md/dm-cache-policy-smq.c                   |  12 +-
 drivers/misc/fastrpc.c                             | 107 ++++++++++------
 drivers/mmc/core/mmc.c                             |   4 +-
 drivers/mmc/host/dw_mmc-rockchip.c                 |  17 +++
 drivers/mmc/host/litex_mmc.c                       |  20 ++-
 drivers/mmc/host/renesas_sdhi_internal_dmac.c      |   1 +
 drivers/mmc/host/sdhci.c                           |   1 +
 drivers/net/bonding/bond_main.c                    |   4 +-
 drivers/net/ethernet/airoha/airoha_eth.c           |   5 +-
 drivers/net/ethernet/amazon/ena/ena_com.c          |   5 +
 drivers/net/ethernet/amd/pcnet32.c                 |   4 +-
 drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c |  14 ++-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   2 +-
 drivers/net/ethernet/freescale/fec_main.c          |   3 +-
 drivers/net/ethernet/ibm/emac/core.c               |   9 +-
 drivers/net/ethernet/intel/ice/ice_dpll.c          |   2 +
 drivers/net/ethernet/intel/idpf/idpf_ptp.c         |   2 +-
 drivers/net/ethernet/marvell/mv643xx_eth.c         |   2 +-
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c    |  67 ++++++----
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c    |   2 +-
 drivers/net/ethernet/marvell/octeontx2/af/rvu.h    |   1 +
 .../net/ethernet/marvell/octeontx2/af/rvu_npc.c    |  36 +++---
 .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c |   2 +-
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |   2 +-
 drivers/net/ethernet/mediatek/mtk_eth_soc.c        |   2 +-
 drivers/net/ethernet/mellanox/mlx4/cq.c            |   9 +-
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      |   6 +-
 drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c   |  10 +-
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c  |  13 +-
 .../net/ethernet/mellanox/mlx5/core/irq_affinity.c |   5 +-
 drivers/net/ethernet/mellanox/mlx5/core/vport.c    |  72 ++++++++---
 drivers/net/ethernet/microchip/lan743x_main.c      |  32 +++++
 drivers/net/ethernet/microchip/lan743x_main.h      |   1 +
 drivers/net/ethernet/realtek/rtase/rtase_main.c    |   7 +-
 drivers/net/ethernet/wangxun/libwx/wx_type.h       |   4 +-
 drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c     | 140 +++++++++++----------
 drivers/net/ethernet/wangxun/txgbe/txgbe_aml.h     |   2 +-
 drivers/net/ethernet/wangxun/txgbe/txgbe_ethtool.c |   5 +-
 drivers/net/ethernet/wangxun/txgbe/txgbe_main.c    |  12 +-
 drivers/net/ethernet/wangxun/txgbe/txgbe_type.h    |  13 +-
 drivers/net/hyperv/netvsc.c                        |  19 ++-
 drivers/net/mctp/mctp-usb.c                        |  28 +++--
 drivers/net/phy/phy_device.c                       |   6 +
 drivers/net/phy/sfp.c                              |   1 +
 drivers/net/tap.c                                  |   2 +
 drivers/net/tun.c                                  |   1 +
 drivers/net/usb/r8152.c                            |   7 +-
 drivers/net/vxlan/vxlan_vnifilter.c                |   5 +-
 drivers/net/wireless/intel/iwlwifi/mvm/ops.c       |   6 +
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c      |  56 +++++----
 drivers/nvmem/core.c                               |  12 +-
 drivers/nvmem/layouts/onie-tlv.c                   |   3 +-
 drivers/pinctrl/pinctrl-mcp23s08_spi.c             |   6 +-
 drivers/pmdomain/imx/gpc.c                         |   2 +-
 drivers/pmdomain/ti/ti_sci_pm_domains.c            |   2 +-
 drivers/ptp/ptp_vclock.c                           |  14 ++-
 drivers/slimbus/qcom-ngd-ctrl.c                    | 122 +++++++++++-------
 drivers/soc/qcom/ice.c                             |  57 +++++++--
 drivers/spi/spi-cadence-quadspi.c                  |   5 +-
 drivers/spi/spi-rzv2h-rspi.c                       |   3 +-
 drivers/staging/rtl8723bs/core/rtw_mlme.c          |  10 +-
 drivers/tee/optee/supp.c                           | 107 +++++++++++-----
 drivers/tee/qcomtee/core.c                         |   6 +-
 drivers/tee/tee_shm.c                              |   2 +-
 drivers/thunderbolt/property.c                     |   6 +
 drivers/thunderbolt/xdomain.c                      |  14 ++-
 drivers/usb/serial/io_ti.c                         |  11 ++
 drivers/usb/serial/kl5kusb105.c                    |   4 +-
 drivers/usb/serial/option.c                        |   3 +
 fs/erofs/internal.h                                |   5 +-
 fs/erofs/super.c                                   |   3 +-
 fs/erofs/sysfs.c                                   |   2 +-
 fs/erofs/zdata.c                                   |  35 ++----
 fs/fcntl.c                                         |   8 +-
 fs/fhandle.c                                       |  16 ++-
 fs/fuse/dev.c                                      |  13 +-
 fs/mount.h                                         |  10 +-
 fs/namespace.c                                     |   6 +-
 fs/qnx6/dir.c                                      |   8 +-
 fs/smb/server/oplock.c                             |  15 ++-
 fs/smb/server/smb2pdu.c                            |  11 ++
 fs/xfs/scrub/cow_repair.c                          |  12 +-
 include/hyperv/hvgdk.h                             |  10 +-
 include/hyperv/hvgdk_mini.h                        |   1 +
 include/hyperv/hvhdk.h                             |   1 +
 include/linux/hugetlb.h                            |   8 --
 include/linux/hyperv.h                             |  72 ++++++++---
 include/linux/mlx5/vport.h                         |   4 +-
 include/linux/mm.h                                 |   8 --
 include/linux/tracepoint.h                         |   8 ++
 include/net/act_api.h                              |   1 +
 include/net/bluetooth/l2cap.h                      |   1 +
 include/net/ip_vs.h                                |   3 +-
 include/net/netfilter/nf_conntrack_helper.h        |   1 +
 include/net/sock.h                                 |   1 +
 include/net/tc_act/tc_pedit.h                      |   1 -
 include/rdma/ib_umem.h                             |  48 +++----
 include/rdma/ib_verbs.h                            |  48 -------
 include/rdma/iter.h                                |  88 +++++++++++++
 include/uapi/linux/tee.h                           |   1 +
 io_uring/io_uring.c                                |   2 +-
 io_uring/kbuf.c                                    |   1 -
 io_uring/net.c                                     |   3 +-
 ipc/shm.c                                          |  10 +-
 kernel/dma/debug.c                                 |   2 +-
 kernel/dma/direct.c                                |   2 +-
 kernel/futex/requeue.c                             |   6 +
 kernel/locking/rtmutex.c                           |   3 +
 kernel/locking/rtmutex_api.c                       |   2 +-
 kernel/pid.c                                       |   8 +-
 kernel/sched/ext.c                                 |  10 +-
 kernel/signal.c                                    |   1 +
 kernel/time/time.c                                 |   2 +-
 kernel/time/timer_migration.c                      |   8 +-
 kernel/trace/trace_probe.c                         |   2 -
 mm/cma.c                                           |   7 +-
 mm/cma_debug.c                                     |   3 +-
 mm/damon/lru_sort.c                                |   4 +
 mm/damon/ops-common.c                              |   4 +-
 mm/damon/reclaim.c                                 |   4 +
 mm/huge_memory.c                                   |   4 +-
 mm/hugetlb.c                                       |  69 +++++-----
 mm/list_lru.c                                      |  21 ++--
 mm/memcontrol.c                                    |   5 +-
 mm/memory-failure.c                                |  19 +--
 mm/mincore.c                                       |  10 +-
 net/6lowpan/iphc.c                                 |   4 +-
 net/802/garp.c                                     |   2 +-
 net/802/mrp.c                                      |   9 ++
 net/bluetooth/bnep/core.c                          |  50 +++++---
 net/bluetooth/hci_sync.c                           |   5 +
 net/bluetooth/hci_sysfs.c                          |   6 +-
 net/bluetooth/iso.c                                |  61 ++++++---
 net/bluetooth/l2cap_core.c                         |  46 +++++++
 net/bluetooth/mgmt.c                               |  17 +--
 net/bluetooth/rfcomm/core.c                        |  69 +++++++---
 net/bluetooth/rfcomm/sock.c                        |  26 +++-
 net/bluetooth/sco.c                                |  20 ++-
 net/bridge/netfilter/ebt_dnat.c                    |   4 +-
 net/bridge/netfilter/ebt_redirect.c                |  16 ++-
 net/bridge/netfilter/ebt_snat.c                    |   3 +
 net/bridge/netfilter/nft_meta_bridge.c             |   2 +
 net/core/filter.c                                  |  15 ++-
 net/core/gro.c                                     |   5 +
 net/core/netdev-genl.c                             |   4 +-
 net/core/skbuff.c                                  |   6 +-
 net/core/sock.c                                    |  13 +-
 net/devlink/core.c                                 |   2 +
 net/hsr/hsr_framereg.c                             |   4 +-
 net/ieee802154/6lowpan/tx.c                        |   5 +
 net/ipv4/inet_fragment.c                           |   3 +
 net/ipv4/ip_fragment.c                             |   3 -
 net/ipv4/ip_options.c                              |   4 +
 net/ipv4/netfilter/arp_tables.c                    |  15 +--
 net/ipv4/netfilter/ip_tables.c                     |  15 +--
 net/ipv4/netfilter/nf_nat_h323.c                   |   2 +
 net/ipv4/netfilter/nft_fib_ipv4.c                  |   2 +-
 net/ipv4/udp.c                                     |   8 ++
 net/ipv6/addrconf.c                                |   6 +-
 net/ipv6/anycast.c                                 |  16 +--
 net/ipv6/ip6_vti.c                                 |   3 +
 net/ipv6/mcast.c                                   |   8 +-
 net/ipv6/netfilter/ip6_tables.c                    |  15 +--
 net/ipv6/netfilter/nft_fib_ipv6.c                  |   2 +-
 net/ipv6/sit.c                                     |   1 +
 net/l2tp/l2tp_ppp.c                                |  92 ++++++++------
 net/mac80211/mlme.c                                |   9 ++
 net/mac80211/tests/chan-mode.c                     |   1 +
 net/mac80211/tx.c                                  |   4 +-
 net/mptcp/options.c                                |  73 +++++------
 net/mptcp/pm.c                                     |  15 +--
 net/mptcp/pm_userspace.c                           |  14 ++-
 net/mptcp/protocol.c                               |   4 +
 net/mptcp/protocol.h                               |   7 +-
 net/mptcp/sockopt.c                                |  15 ++-
 net/netfilter/ipvs/ip_vs_ctl.c                     |  13 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |  18 +--
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  21 ++--
 net/netfilter/ipvs/ip_vs_proto_udp.c               |  20 ++-
 net/netfilter/ipvs/ip_vs_sched.c                   |  14 +--
 net/netfilter/nf_conntrack_helper.c                |  19 +++
 net/netfilter/nf_conntrack_irc.c                   |   4 +-
 net/netfilter/nf_log_syslog.c                      |   4 +-
 net/netfilter/nf_nat_core.c                        |   2 +
 net/netfilter/nf_nat_sip.c                         |   1 +
 net/netfilter/nf_synproxy_core.c                   |  24 +++-
 net/netfilter/nfnetlink_log.c                      |  23 +++-
 net/netfilter/nfnetlink_queue.c                    |  64 ++++++++--
 net/netfilter/nft_ct.c                             |   8 +-
 net/netfilter/nft_ct_fast.c                        |   2 +-
 net/netfilter/nft_exthdr.c                         |   3 +
 net/netfilter/nft_fib.c                            |   6 +
 net/netfilter/nft_tunnel.c                         |   2 +-
 net/netfilter/xt_NFQUEUE.c                         |   2 +-
 net/netlabel/netlabel_unlabeled.c                  |  30 ++---
 net/openvswitch/datapath.c                         |   1 +
 net/phonet/pn_dev.c                                |   2 +-
 net/qrtr/af_qrtr.c                                 |   4 +-
 net/rds/ib_cm.c                                    |   1 +
 net/rds/ib_send.c                                  |   2 +
 net/rds/info.c                                     |   2 +-
 net/rxrpc/input.c                                  |  26 ++--
 net/sched/act_api.c                                |   7 +-
 net/sched/act_pedit.c                              |  77 ++++++------
 net/sctp/bind_addr.c                               |  11 +-
 net/sctp/diag.c                                    |  17 +--
 net/sctp/input.c                                   |   8 ++
 net/sctp/sm_make_chunk.c                           |  12 +-
 net/sctp/sm_statefuns.c                            |   6 +-
 net/sctp/stream.c                                  |   6 +-
 net/smc/af_smc.c                                   |  17 ++-
 net/socket.c                                       |  11 +-
 net/unix/af_unix.c                                 |  11 +-
 net/vmw_vsock/virtio_transport_common.c            |  11 +-
 net/vmw_vsock/vmci_transport.c                     |   4 +-
 net/wireless/nl80211.c                             |   3 +
 net/wireless/scan.c                                |   9 +-
 net/xdp/xsk.c                                      |  11 +-
 net/xfrm/espintcp.c                                |   4 +
 net/xfrm/xfrm_iptfs.c                              |  11 +-
 net/xfrm/xfrm_policy.c                             |  13 +-
 scripts/Makefile.compiler                          |   2 +-
 scripts/generate_rust_target.rs                    |   8 +-
 sound/core/pcm_native.c                            |   7 +-
 sound/core/seq/seq_dummy.c                         |  15 ++-
 sound/core/timer.c                                 |  17 +--
 sound/soc/codecs/wm_adsp.c                         |   3 +
 sound/soc/fsl/fsl_sai.c                            |   2 +-
 sound/soc/sof/amd/acp-ipc.c                        |   4 +-
 sound/soc/sof/amd/acp.h                            |   2 +
 .../test.d/dynevent/eprobes_syntax_errors.tc       |   2 +-
 tools/testing/selftests/kselftest_harness.h        |   1 +
 tools/testing/selftests/net/mptcp/mptcp_join.sh    |   4 +
 tools/verification/rv/src/in_kernel.c              |  67 +++++-----
 tools/verification/rvgen/__main__.py               |  10 +-
 tools/verification/rvgen/rvgen/ltl2ba.py           |   9 +-
 virt/kvm/kvm_main.c                                |   3 +-
 348 files changed, 3127 insertions(+), 1574 deletions(-)