From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6AE933067F; Tue, 16 Jun 2026 15:04:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781622299; cv=none; b=OvqWIt+XD2DB+dJU5ni9a25IertRFcW5pHEXl1zixcnRdEFJf4ruGm/jAKPc6e74Nkv/9U9W1rOQnWvC0to8e9IURtCyX8f6SztYpo+r5GcK4QTjI0lh4PybYdY/1GJ131VuVa3OF5Q4TQh7vfwF8zkJGL3jbKp/Oge2aTgkrcE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781622299; c=relaxed/simple; bh=3tN+NNHblDfP881auAqXeeWnCbbkbiBgG7sLiojIcps=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=nYzeyhpnqQaGguy5IMCNrXNSJFRhdq9dZtF143Q+Vzx81U49OhIX+RIfOogAmj6OPUfdn+D3lnYWuolGb8MTe+H2FkAwYrhh1AePbF2uI3kYD4ILuo2VGRMLKusOL0u7sEh2UR+rulECZzsdEGNeJpQkI/GYulqDXMbRLiWDqUk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mC5eNevs; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="mC5eNevs" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C23861F000E9; Tue, 16 Jun 2026 15:04:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781622295; bh=PJUi/iwPaXWvRkBsi3J1mtmCd3js9d5ghMBpk/zqUIE=; h=From:To:Cc:Subject:Date; b=mC5eNevsEyhc6Re6zhmyyRSN5vmQ/NDPdkdMAhp4IlYnVd1yTnGU9IOKyunheJO/i 9PFDttxi1O+j92gTwtPwLVXPJhGdH6SQG3zdfP+AfHrieIvaqIN8Wnbz5bstOrlMJ+ RF0WH/uZYZdTBrYem1dM6KllqhAl6JYTFPS7N/DQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, linux@roeck-us.net, shuah@kernel.org, patches@kernelci.org, lkft-triage@lists.linaro.org, pavel@nabladev.com, jonathanh@nvidia.com, f.fainelli@gmail.com, sudipm.mukherjee@gmail.com, rwarsow@gmx.de, conor@kernel.org, hargar@microsoft.com, broonie@kernel.org, achill@achill.org, sr@sladewatkins.com Subject: [PATCH 6.18 000/325] 6.18.36-rc1 review Date: Tue, 16 Jun 2026 20:26:36 +0530 Message-ID: <20260616145057.827196531@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.36-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-6.18.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 6.18.36-rc1 X-KernelTest-Deadline: 2026-06-18T14:51+00:00 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is the start of the stable review cycle for the 6.18.36 release. There are 325 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.36-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman Linux 6.18.36-rc1 Damien Le Moal block: fix handling of dead zone write plugs Will Deacon arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland arm64: cputype: Add C1-Premium definitions Mark Rutland arm64: cputype: Add C1-Ultra definitions Stefano Garzarella vsock/virtio: fix skb overhead accounting to preserve full buf_alloc Eric Dumazet vsock/virtio: fix potential unbounded skb queue Julian Anastasov ipvs: skip ipv6 extension headers for csum checks Jason Gunthorpe RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap RDMA/umem: fix kernel-doc warnings Davide Ornaghi netfilter: nft_fib: fix stale stack leak via the OIFNAME register Jason Gunthorpe RDMA: During rereg_mr ensure that REREG_ACCESS is compatible Jacob Moroni RDMA/umem: Add helpers for umem dmabuf revoke lock Jacob Moroni RDMA/umem: Move umem dmabuf revoke logic into helper function Jacob Moroni RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper Tejun Heo sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() Johannes Berg wifi: mac80211: tests: mark HT check strict Rio Liu wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode Johan Hovold driver core: reject devices with unregistered buses Mingyu Wang <25181214217@stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() Harry Wentland drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Leorize drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs Harry Wentland drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Harry Wentland drm/amd/display: Bound VBIOS record-chain walk loops Priya Hosur drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range Yang Wang drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 Yang Wang drm/amd/pm: fix smu13 power limit default/cap calculation Vitaly Prosyak drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14) Christian König drm/amdgpu: restart the CS if some parts of the VM are still invalidated Christian König drm/amdgpu: fix waiting for all submissions for userptrs Maíra Canal drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups Maíra Canal drm/v3d: Fix global performance monitor reference counting Maíra Canal drm/v3d: Wait for pending L2T flush before cleaning caches Tangudu Tilak Tirumalesh drm/xe: Clear pending_disable before signaling suspend fence Jani Nikula drm/xe/display: fix oops in suspend/shutdown without display Andrew Martin drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 Muhammad Bilal drm/amdkfd: fix NULL dereference in get_queue_ids() Simona Vetter drm/gem: Try to fix change_handle ioctl, attempt 4 Bjorn Andersson slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Bjorn Andersson slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD Bjorn Andersson slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership Bjorn Andersson slimbus: qcom-ngd-ctrl: Initialize controller resources in controller Bjorn Andersson slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd Bjorn Andersson slimbus: qcom-ngd-ctrl: Fix probe error path ordering Bjorn Andersson slimbus: qcom-ngd-ctrl: Fix up platform_driver registration Bartosz Golaszewski slimbus: qcom-ngd-ctrl: fix OF node refcount Michael Bommarito thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito thunderbolt: Validate XDomain request packet size before type cast Michael Bommarito thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito thunderbolt: Bound root directory content to block size Michael Bommarito thunderbolt: Reject zero-length property entries in validator Wyatt Feng sctp: stream: fully roll back denied add-stream state Zhao Zhang sctp: diag: reject stale associations in dump_one path David Howells rxrpc: Fix the ACK parser to extract the SACK table for parsing Justin Lai rtase: Reset TX subqueue when clearing TX ring Justin Lai rtase: Avoid sleeping in get_stats64() Kendall Willis pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source Bartosz Golaszewski pmdomain: imx: fix OF node refcount Jisheng Zhang mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Inochi Amaoto mmc: litex_mmc: Set mandatory idle clocks before CMD0 Heiko Stuebner mmc: dw_mmc-rockchip: Add missing private data for very old controllers Kamal Dasu mmc: core: Fix host controller programming for fixed driver type Usama Arif mm/mincore: handle non-swap entries before !CONFIG_SWAP guard Shakeel Butt mm/list_lru: drain before clearing xarray entry on reparent David Carlier mm/hugetlb: restore reservation on error in hugetlb folio copy paths Lorenzo Stoakes mm/hugetlb: avoid false positive lockdep assertion SeongJae Park mm/damon/reclaim: handle ctx allocation failure SeongJae Park mm/damon/lru_sort: handle ctx allocation failure Muchun Song mm/cma_debug: fix invalid accesses for inactive CMA areas Muchun Song mm/cma: fix reserved page leak on activation failure Christian A. Ehrhardt io_uring/wait: fix min_timeout behavior Jens Axboe io_uring/kbuf: don't truncate end buffer for bundles Judith Mendez pinctrl: mcp23s08: Read spi-present-mask as u8 not u32 Dawei Feng octeontx2-af: fix memory leak in rvu_setup_hw_resources() Andre Heider nvmem: layouts: onie-tlv: fix hang on unknown types Bartosz Golaszewski nvmem: core: fix use-after-free bugs in error paths Jonas Jelonek net: sfp: initialize i2c_block_size at adapter configure time Yuqi Xu net: rds: clear i_sends on setup unwind Santosh Kalluri net: phonet: free phonet_device after RCU grace period Bartosz Golaszewski net: mv643xx: fix OF node refcount ZhaoJinming net: bonding: fix NULL pointer dereference in bond_do_ioctl() ZhaoJinming net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues() Nikolay Kuratov net/mlx5: Reorder completion before putting command entry in cmd_work_handler Tudor Ambarus firmware: samsung: acpm: Fix mailbox channel leak on probe error Mukesh Ojha misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Junrui Luo misc: fastrpc: fix DMA address corruption due to find_vma misuse Zhenghang Xiao misc: fastrpc: fix use-after-free race in fastrpc_map_create Anandu Krishnan E misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Shakeel Butt memcg: use round-robin victim selection in refill_stock Davidlohr Bueso locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Yilin Zhu ipc/shm: serialize orphan cleanup with shm_nattch updates Jason Gunthorpe iommu/dma: Do not try to iommu_map a 0 length region in swiotlb Cryolitia PukNgae Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Carlos Song i2c: imx: fix clock and pinctrl state inconsistency in runtime PM Carlos Song i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan() Ji'an Zhou futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock Jann Horn fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios Jann Horn fuse: reject fuse_notify() pagecache ops on directories Arpith Kalaginanavoor fs/qnx6: fix pointer arithmetic in directory iteration Christian Brauner pidfd: refuse access to tasks that have started exiting harder Hyunwoo Kim inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush Michael Bommarito IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Jann Horn fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() Kyle Meyer bnxt_en: Fix NULL pointer dereference Chancel Liu ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write Salman Alghamdi staging: rtl8723bs: fix buffer over-read in rtw_update_protection Amit Matityahu timers/migration: Fix livelock in tmigr_handle_remote_up() Raf Dickson vsock/vmci: fix sk_ack_backlog leak on failed handshake Yuqi Xu wifi: nl80211: reject oversized EMA RNR lists Emmanuel Grumbach wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used Yingjie Gao xfs: fix rtgroup cleanup in CoW fork repair Yingjie Gao xfs: fix error returns in CoW fork repair Matthieu Baerts (NGI0) mptcp: add-addr: always drop other suboptions Tao Cui selftests: mptcp: add test for extra_subflows underflow on userspace PM Matthieu Baerts (NGI0) mptcp: sockopt: set sockopt on all subflows Matthieu Baerts (NGI0) mptcp: sockopt: check timestamping ret value Tao Cui mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation Paolo Abeni mptcp: allow subflow rcv wnd to shrink Paolo Abeni mptcp: close TOCTOU race while computing rcv_wnd Paolo Abeni mptcp: fix retransmission loop when csum is enabled Alistair Popple arm64: mm: call pagetable dtor when freeing hot-removed page tables Karl Mehltretter ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Karl Mehltretter ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi ARM: socfpga: Fix OF node refcount leak in SMP setup Sechang Lim udp: clear skb->dev before running a sockmap verdict Cunlong Li zram: fix use-after-free in zram_bvec_write_partial() Michael Bommarito RDMA/srp: bound SRP_RSP sense copy by the received length Yishai Hadas RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc Jason Gunthorpe RDMA/core: Validate the passed in fops for ib_get_ucaps() Yin Tirui mm/huge_memory: update file PUD counter before folio_put() SeongJae Park mm/damon/ops-common: call folio_test_lru() after folio_get() Yin Tirui mm/huge_memory: update file PMD counter before folio_put() Harry Wentland drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Wentao Liang drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() Clément Léger io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries Takashi Iwai ALSA: timer: Fix UAF at snd_timer_user_params() Takashi Iwai ALSA: timer: Forcibly close timer instances at closing HyeongJun An USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel USB: serial: io_ti: fix heap overflow in get_manuf_info() Tristan Madani xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() Takao Sato xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() Wyatt Feng xfrm: espintcp: do not reuse an in-progress partial send Gil Portnoy ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL Anton Leontev hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Joonas Lahtinen drm/i915/gem: Fix phys BO pread/pwrite with offset Joey Gouly KVM: arm64: Restore POR_EL0 access to host EL0 Sean Christopherson KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA Sean Christopherson KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying Wei Liu mshv: add a missing padding field Inochi Amaoto mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation Alice Ryhl rust: kasan/kbuild: fix rustc-option when cross-compiling Alice Ryhl rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES Nathan Chancellor ARM: Do not select HAVE_RUST when KASAN is enabled Miguel Ojeda rust: x86: support Rust >= 1.98.0 target spec Masami Hiramatsu (Google) tracing/probes: Point the error offset correctly for eprobe argument error Eva Kurchatova tracing: Fix CFI violation in probestub being called by tprobes Andrzej Kacprowski accel/ivpu: Fix signed integer truncation in IPC receive Andrzej Kacprowski accel/ivpu: Add buffer overflow check in MS get_info_ioctl Andrzej Kacprowski accel/ivpu: Add bounds checks for firmware log indices Wupeng Ma mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Manivannan Sadhasivam soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() Michael Bommarito Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Yuqi Xu Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Georgiy Osokin tee: shm: fix shm leak in register_shm_helper() Davide Ornaghi netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register Tristan Madani netfilter: nft_tunnel: fix use-after-free on object destroy Lizhi Hou accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() Wentao Liang drm/xe: fix refcount leak in xe_range_fence_insert() Alexander A. Klimov drm/vc4: fix krealloc() memory leak Dmitry Osipenko drm/virtio: Fix driver removal with disabled KMS Nikita Zhandarovich drm/i915/edp: Check supported link rates DPCD read Pengyu Luo clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time Kuan-Wei Chiu clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs Hans de Goede clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked Dongli Zhang KVM: VMX: Update SVI during runtime APICv activation Ido Schimmel ipv6: Fix a potential NPD in cleanup_prefix_route() Jiawen Wu net: txgbe: initialize module info buffer Jiawen Wu net: txgbe: rename the SFP related Jiawen Wu net: txgbe: support CR modules for AML devices Jiawen Wu net: txgbe: optimize the flow to setup PHY for AML devices Til Kaiser net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser net: mvpp2: refill RX buffers before XDP or skb use Til Kaiser net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser net: mvpp2: sync RX data at the hardware packet offset Florian Westphal netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng netfilter: x_tables: avoid leaking percpu counter pointers Weiming Shi netfilter: nf_conntrack: destroy stale expectfn expectations on unregister Florian Westphal netfilter: revalidate bridge ports Felix Gu spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX Breno Leitao rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Xiang Mei tun: zero the whole vnet header in tun_put_user() Weiming Shi net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng net: guard timestamp cmsgs to real error queue skbs Xin Long sctp: validate embedded INIT chunk and address list lengths in cookie Eric Dumazet ip6_vti: set netns_immutable on the fallback device. Michael Bommarito sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Vijendar Mukunda ASoC: SOF: amd: fix for ipc flags check Jeremy Kerr net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission Jeremy Kerr net: mctp: usb: fix race between urb completion and rx_retry cancellation Marco Scardovi gpio: rockchip: fix generic IRQ chip leak on remove Ruoyu Wang gpio: zynq: fix runtime PM leak on remove Chih Kai Hsu r8152: handle the return value of usb_reset_device() Adrian Moreno net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng ipv6: sit: reload inner IPv6 header after GSO offloads Fushuai Wang net/mlx5: Use effective affinity mask for IRQ selection Dragos Tatulea net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure Dragos Tatulea net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list Mingyu Wang <25181214217@stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Maxime Chevallier net: phy: clean the sfp upstream if phy probing fails Jakub Kicinski netdev: fix double-free in netdev_nl_bind_rx_doit() Rosen Penev net: ibm: emac: Fix use-after-free during device removal Yao Sang net/mlx4: avoid GCC 10 __bad_copy_from() false positive HanQuan net: add pskb_may_pull() to skb_gro_receive_list() Eric Dumazet tcp: restrict SO_ATTACH_FILTER to priv users Richard Fitzgerald ASoC: wm_adsp: Fix NULL dereference when removing firmware controls Yun Zhou gpio: mvebu: fix NULL pointer dereference in suspend/resume Chenguang Zhao netlabel: validate unlabeled address and mask attribute lengths Vikas Gupta bnge: fix context mem iteration Arthur Kiyanovski net: ena: PHC: Add missing barrier Alok Tiwari idpf: fix mailbox capability for set device clock time Petr Oros ice: fix missing priority callbacks for U.FL DPLL pins Sanghyun Park xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Li RongQing dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device Li RongQing dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments Zhenghang Xiao xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload Weiming Shi tap: free page on error paths in tap_get_user_xdp() Gabriele Monaco verification/rvgen: Fix ltl2k writing True as a literal Gabriele Monaco verification/rvgen: Fix options shared among commands Gabriele Monaco tools/rv: Fix cleanup after failed trace setup Gabriele Monaco tools/rv: Fix substring match when listing container monitors Gabriele Monaco tools/rv: Fix substring match bug in monitor name search Gabriele Monaco tools/rv: Ensure monitor name and desc are NUL-terminated Zhan Xusheng cpufreq/amd-pstate: drop stale @epp_cached kdoc Johan Hovold spi: cadence-quadspi: fix unclocked access on unbind Kyle Zeng ALSA: seq: dummy: fix UMP event stack overread Ji'an Zhou ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams Naveen Kumar Chaudhary time: Fix off-by-one in settimeofday() usec validation Dexuan Cui hyperv: Clean up and fix the guest ID comment in hvgdk.h Aleksandr Nogikh signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Geliang Tang selftests: harness: fix pidfd leak in __wait_for_test Michael Kelley drm/hyperv: During panic do VMBus unload after frame buffer is flushed Michael Kelley Drivers: hv: vmbus: Provide option to skip VMBus unload on panic Roman Kisel Drivers: hv: VMBus protocol version 6.0 Xin Long sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Andy Roulin vxlan: vnifilter: fix spurious notification on VNI update Andy Roulin vxlan: vnifilter: send notification on VNI add Nithin Dabilpuram octeontx2-af: npc: Fix CPT channel mask in npc_install_flow Xin Long sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing Rajat Gupta net/sched: fix pedit partial COW leading to page cache corruption Lorenzo Bianconi net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown Lorenzo Bianconi net: airoha: Fix use-after-free in metadata dst teardown Kurt Kanzenbach ptp: vclock: Switch from RCU to SRCU Eric Dumazet ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Jianyu Li af_unix: Fix inq_len update problem in partial read Suman Ghosh octeontx2-af: Fix initialization of mcam's entry2target_pffunc field Geetha sowjanya octeontx2-pf: Fix NDC sync operation errors Jason Xing xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() Luiz Augusto von Dentz Bluetooth: MGMT: Fix backward compatibility with userspace SeungJu Cheon Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect SeungJu Cheon Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls Luiz Augusto von Dentz Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync Bharath Reddy Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen Bluetooth: bnep: reject short frames before parsing Dudu Lu Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() Fedor Pchelkin wifi: fix leak if split 6 GHz scanning fails Jiayuan Chen ipv6: anycast: insert aca into global hash under idev->lock Tapio Reijonen net: fec: fix pinctrl default state restore order on resume David Thompson net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Kuniyuki Iwashima hsr: Remove WARN_ONCE() in hsr_addr_is_self(). Kuniyuki Iwashima net: Annotate sk->sk_write_space() for UDP SOCKMAP. Oscar Maes pcnet32: stop holding device spin lock during napi_complete_done Deepanshu Kartikey wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap Yicong Hui drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Mark Bloch devlink: Release nested relation on devlink free Lee Jones l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() Yizhou Zhao 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li dm cache policy smq: check allocation under invalidate lock Yiming Qian netfilter: bridge: make ebt_snat ARP rewrite writable Jiayuan Chen netfilter: nft_ct: bail out on template ct in get eval Florian Westphal netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Gil Portnoy ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers Emmanuel Grumbach wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares Gao Xiang erofs: fix use-after-free on sbi->sync_decompress Gao Xiang erofs: tidy up synchronous decompression Robertus Diawan Chris tee: qcomtee: add missing va_end in early return qcomtee_object_user_init() Arnd Bergmann tee: fix tee_ioctl_object_invoke_arg padding Manivannan Sadhasivam soc: qcom: ice: Return -ENODEV if the ICE platform device is not found Mihai Sain ARM: dts: microchip: sam9x7: fix GMAC clock configuration Val Packett arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins Harshal Dev soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE Amirreza Zarrabi tee: optee: prevent use-after-free when the client exits before the supplicant Nicolò Coccia net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS Ido Schimmel ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217@stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Hyunwoo Kim KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation Russell King (Oracle) ARM: fix branch predictor hardening Russell King (Oracle) ARM: fix hash_name() fault Russell King (Oracle) ARM: allow __do_kernel_fault() to report execution of memory faults Russell King (Oracle) ARM: group is_permission_fault() with is_translation_fault() Kuniyuki Iwashima bpf: Free reuseport cBPF prog after RCU grace period. ------------- Diffstat: Documentation/ABI/testing/sysfs-fs-erofs | 14 ++- Documentation/arch/arm64/silicon-errata.rst | 46 +++++++ Makefile | 7 +- arch/arm/Kconfig | 2 +- arch/arm/boot/dts/microchip/sam9x7.dtsi | 6 +- arch/arm/include/asm/io.h | 15 ++- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm/mm/alignment.c | 6 +- arch/arm/mm/fault.c | 100 +++++++++++---- arch/arm64/Kconfig | 38 ++++++ arch/arm64/Makefile | 3 + arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 7 +- arch/arm64/include/asm/cputype.h | 4 + arch/arm64/kernel/cpu_errata.c | 34 ++++- arch/arm64/kvm/at.c | 6 +- arch/arm64/kvm/hyp/include/hyp/switch.h | 2 + arch/arm64/mm/mmu.c | 1 + arch/x86/Makefile | 4 + arch/x86/Makefile.um | 8 ++ arch/x86/kvm/svm/sev.c | 27 ++-- arch/x86/kvm/vmx/vmx.c | 9 -- arch/x86/kvm/x86.c | 7 ++ block/blk-zoned.c | 32 ++++- drivers/accel/amdxdna/aie2_ctx.c | 3 + drivers/accel/ivpu/ivpu_fw_log.c | 5 + drivers/accel/ivpu/ivpu_ipc.c | 2 +- drivers/accel/ivpu/ivpu_ms.c | 7 ++ drivers/base/bus.c | 11 +- drivers/block/zram/zram_drv.c | 2 +- drivers/clk/qcom/dispcc-sc8280xp.c | 4 +- drivers/clk/qcom/dispcc-x1e80100.c | 2 +- drivers/clk/samsung/clk-gs101.c | 2 +- drivers/cpufreq/amd-pstate.h | 1 - drivers/firmware/samsung/exynos-acpm.c | 13 +- drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-rockchip.c | 4 +- drivers/gpio/gpio-zynq.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 6 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 49 ++++++-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 ++- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 81 ++++++++---- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 2 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 10 +- .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c | 10 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 32 ++--- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 32 ++--- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 1 - drivers/gpu/drm/drm_gem.c | 73 +++++------ drivers/gpu/drm/drm_ioctl.c | 3 +- drivers/gpu/drm/hyperv/hyperv_drm_drv.c | 5 + drivers/gpu/drm/hyperv/hyperv_drm_modeset.c | 15 +-- drivers/gpu/drm/i915/display/intel_dp.c | 11 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 ++- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/v3d/v3d_gem.c | 8 ++ drivers/gpu/drm/v3d/v3d_perfmon.c | 24 +++- drivers/gpu/drm/v3d/v3d_sched.c | 17 ++- drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/gpu/drm/virtio/virtgpu_drv.c | 5 +- drivers/gpu/drm/virtio/virtgpu_submit.c | 4 +- drivers/gpu/drm/xe/display/xe_display.c | 11 +- drivers/gpu/drm/xe/xe_guc_submit.c | 2 +- drivers/gpu/drm/xe/xe_range_fence.c | 2 + drivers/hv/channel_mgmt.c | 1 + drivers/hv/hyperv_vmbus.h | 3 +- drivers/hv/vmbus_drv.c | 37 ++++-- drivers/i2c/busses/i2c-imx-lpi2c.c | 53 ++++---- drivers/i2c/busses/i2c-imx.c | 15 ++- drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 ++++---- drivers/i2c/i2c-dev.c | 9 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++++++ drivers/infiniband/core/ucaps.c | 8 +- drivers/infiniband/core/umem.c | 16 +++ drivers/infiniband/core/umem_dmabuf.c | 77 +++++++++--- drivers/infiniband/core/uverbs_std_types_dmah.c | 5 + drivers/infiniband/core/verbs.c | 38 ------ drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 + drivers/infiniband/hw/ionic/ionic_ibdev.h | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 + drivers/infiniband/hw/mana/mana_ib.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 5 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 4 + drivers/infiniband/hw/mlx5/umr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 5 + drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/srp/ib_srp.c | 30 ++++- drivers/input/keyboard/atkbd.c | 15 +++ drivers/iommu/dma-iommu.c | 19 ++- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/misc/fastrpc.c | 107 ++++++++++------ drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/dw_mmc-rockchip.c | 17 +++ drivers/mmc/host/litex_mmc.c | 20 ++- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci.c | 1 + drivers/net/bonding/bond_main.c | 4 +- drivers/net/ethernet/airoha/airoha_eth.c | 5 +- drivers/net/ethernet/amazon/ena/ena_com.c | 5 + drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c | 14 ++- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 3 +- drivers/net/ethernet/ibm/emac/core.c | 9 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 2 + drivers/net/ethernet/intel/idpf/idpf_ptp.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 67 ++++++---- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 36 +++--- .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx4/cq.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 13 +- .../net/ethernet/mellanox/mlx5/core/irq_affinity.c | 5 +- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 72 ++++++++--- drivers/net/ethernet/microchip/lan743x_main.c | 32 +++++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/realtek/rtase/rtase_main.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_type.h | 4 +- drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c | 140 +++++++++++---------- drivers/net/ethernet/wangxun/txgbe/txgbe_aml.h | 2 +- drivers/net/ethernet/wangxun/txgbe/txgbe_ethtool.c | 5 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 12 +- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 13 +- drivers/net/hyperv/netvsc.c | 19 ++- drivers/net/mctp/mctp-usb.c | 28 +++-- drivers/net/phy/phy_device.c | 6 + drivers/net/phy/sfp.c | 1 + drivers/net/tap.c | 2 + drivers/net/tun.c | 1 + drivers/net/usb/r8152.c | 7 +- drivers/net/vxlan/vxlan_vnifilter.c | 5 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 56 +++++---- drivers/nvmem/core.c | 12 +- drivers/nvmem/layouts/onie-tlv.c | 3 +- drivers/pinctrl/pinctrl-mcp23s08_spi.c | 6 +- drivers/pmdomain/imx/gpc.c | 2 +- drivers/pmdomain/ti/ti_sci_pm_domains.c | 2 +- drivers/ptp/ptp_vclock.c | 14 ++- drivers/slimbus/qcom-ngd-ctrl.c | 122 +++++++++++------- drivers/soc/qcom/ice.c | 57 +++++++-- drivers/spi/spi-cadence-quadspi.c | 5 +- drivers/spi/spi-rzv2h-rspi.c | 3 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 10 +- drivers/tee/optee/supp.c | 107 +++++++++++----- drivers/tee/qcomtee/core.c | 6 +- drivers/tee/tee_shm.c | 2 +- drivers/thunderbolt/property.c | 6 + drivers/thunderbolt/xdomain.c | 14 ++- drivers/usb/serial/io_ti.c | 11 ++ drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/option.c | 3 + fs/erofs/internal.h | 5 +- fs/erofs/super.c | 3 +- fs/erofs/sysfs.c | 2 +- fs/erofs/zdata.c | 35 ++---- fs/fcntl.c | 8 +- fs/fhandle.c | 16 ++- fs/fuse/dev.c | 13 +- fs/mount.h | 10 +- fs/namespace.c | 6 +- fs/qnx6/dir.c | 8 +- fs/smb/server/oplock.c | 15 ++- fs/smb/server/smb2pdu.c | 11 ++ fs/xfs/scrub/cow_repair.c | 12 +- include/hyperv/hvgdk.h | 10 +- include/hyperv/hvgdk_mini.h | 1 + include/hyperv/hvhdk.h | 1 + include/linux/hugetlb.h | 8 -- include/linux/hyperv.h | 72 ++++++++--- include/linux/mlx5/vport.h | 4 +- include/linux/mm.h | 8 -- include/linux/tracepoint.h | 8 ++ include/net/act_api.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/ip_vs.h | 3 +- include/net/netfilter/nf_conntrack_helper.h | 1 + include/net/sock.h | 1 + include/net/tc_act/tc_pedit.h | 1 - include/rdma/ib_umem.h | 48 +++---- include/rdma/ib_verbs.h | 48 ------- include/rdma/iter.h | 88 +++++++++++++ include/uapi/linux/tee.h | 1 + io_uring/io_uring.c | 2 +- io_uring/kbuf.c | 1 - io_uring/net.c | 3 +- ipc/shm.c | 10 +- kernel/dma/debug.c | 2 +- kernel/dma/direct.c | 2 +- kernel/futex/requeue.c | 6 + kernel/locking/rtmutex.c | 3 + kernel/locking/rtmutex_api.c | 2 +- kernel/pid.c | 8 +- kernel/sched/ext.c | 10 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/time/timer_migration.c | 8 +- kernel/trace/trace_probe.c | 2 - mm/cma.c | 7 +- mm/cma_debug.c | 3 +- mm/damon/lru_sort.c | 4 + mm/damon/ops-common.c | 4 +- mm/damon/reclaim.c | 4 + mm/huge_memory.c | 4 +- mm/hugetlb.c | 69 +++++----- mm/list_lru.c | 21 ++-- mm/memcontrol.c | 5 +- mm/memory-failure.c | 19 +-- mm/mincore.c | 10 +- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 ++ net/bluetooth/bnep/core.c | 50 +++++--- net/bluetooth/hci_sync.c | 5 + net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/iso.c | 61 ++++++--- net/bluetooth/l2cap_core.c | 46 +++++++ net/bluetooth/mgmt.c | 17 +-- net/bluetooth/rfcomm/core.c | 69 +++++++--- net/bluetooth/rfcomm/sock.c | 26 +++- net/bluetooth/sco.c | 20 ++- net/bridge/netfilter/ebt_dnat.c | 4 +- net/bridge/netfilter/ebt_redirect.c | 16 ++- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/nft_meta_bridge.c | 2 + net/core/filter.c | 15 ++- net/core/gro.c | 5 + net/core/netdev-genl.c | 4 +- net/core/skbuff.c | 6 +- net/core/sock.c | 13 +- net/devlink/core.c | 2 + net/hsr/hsr_framereg.c | 4 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/inet_fragment.c | 3 + net/ipv4/ip_fragment.c | 3 - net/ipv4/ip_options.c | 4 + net/ipv4/netfilter/arp_tables.c | 15 +-- net/ipv4/netfilter/ip_tables.c | 15 +-- net/ipv4/netfilter/nf_nat_h323.c | 2 + net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/udp.c | 8 ++ net/ipv6/addrconf.c | 6 +- net/ipv6/anycast.c | 16 +-- net/ipv6/ip6_vti.c | 3 + net/ipv6/mcast.c | 8 +- net/ipv6/netfilter/ip6_tables.c | 15 +-- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/sit.c | 1 + net/l2tp/l2tp_ppp.c | 92 ++++++++------ net/mac80211/mlme.c | 9 ++ net/mac80211/tests/chan-mode.c | 1 + net/mac80211/tx.c | 4 +- net/mptcp/options.c | 73 +++++------ net/mptcp/pm.c | 15 +-- net/mptcp/pm_userspace.c | 14 ++- net/mptcp/protocol.c | 4 + net/mptcp/protocol.h | 7 +- net/mptcp/sockopt.c | 15 ++- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 ++-- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 ++- net/netfilter/ipvs/ip_vs_sched.c | 14 +-- net/netfilter/nf_conntrack_helper.c | 19 +++ net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_nat_core.c | 2 + net/netfilter/nf_nat_sip.c | 1 + net/netfilter/nf_synproxy_core.c | 24 +++- net/netfilter/nfnetlink_log.c | 23 +++- net/netfilter/nfnetlink_queue.c | 64 ++++++++-- net/netfilter/nft_ct.c | 8 +- net/netfilter/nft_ct_fast.c | 2 +- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 ++--- net/openvswitch/datapath.c | 1 + net/phonet/pn_dev.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/rxrpc/input.c | 26 ++-- net/sched/act_api.c | 7 +- net/sched/act_pedit.c | 77 ++++++------ net/sctp/bind_addr.c | 11 +- net/sctp/diag.c | 17 +-- net/sctp/input.c | 8 ++ net/sctp/sm_make_chunk.c | 12 +- net/sctp/sm_statefuns.c | 6 +- net/sctp/stream.c | 6 +- net/smc/af_smc.c | 17 ++- net/socket.c | 11 +- net/unix/af_unix.c | 11 +- net/vmw_vsock/virtio_transport_common.c | 11 +- net/vmw_vsock/vmci_transport.c | 4 +- net/wireless/nl80211.c | 3 + net/wireless/scan.c | 9 +- net/xdp/xsk.c | 11 +- net/xfrm/espintcp.c | 4 + net/xfrm/xfrm_iptfs.c | 11 +- net/xfrm/xfrm_policy.c | 13 +- scripts/Makefile.compiler | 2 +- scripts/generate_rust_target.rs | 8 +- sound/core/pcm_native.c | 7 +- sound/core/seq/seq_dummy.c | 15 ++- sound/core/timer.c | 17 +-- sound/soc/codecs/wm_adsp.c | 3 + sound/soc/fsl/fsl_sai.c | 2 +- sound/soc/sof/amd/acp-ipc.c | 4 +- sound/soc/sof/amd/acp.h | 2 + .../test.d/dynevent/eprobes_syntax_errors.tc | 2 +- tools/testing/selftests/kselftest_harness.h | 1 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 + tools/verification/rv/src/in_kernel.c | 67 +++++----- tools/verification/rvgen/__main__.py | 10 +- tools/verification/rvgen/rvgen/ltl2ba.py | 9 +- virt/kvm/kvm_main.c | 3 +- 348 files changed, 3127 insertions(+), 1574 deletions(-)