[PATCH 6.6 000/452] 6.6.143-rc1 review

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

This is the start of the stable review cycle for the 6.6.143 release.
There are 452 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.143-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 6.6.143-rc1

Borislav Petkov (AMD) <bp@alien8.de>
    x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common()

Borislav Petkov (AMD) <bp@alien8.de>
    x86/CPU/AMD: Call the spectral chicken in the Zen2 init function

Borislav Petkov (AMD) <bp@alien8.de>
    x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function

Petr Machata <petrm@nvidia.com>
    Revert "selftest/ptp: update ptp selftest to exercise the gettimex options"

Paolo Abeni <pabeni@redhat.com>
    mptcp: fix missing wakeups in edge scenarios

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    mptcp: add-addr: always drop other suboptions

Will Deacon <will@kernel.org>
    arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU

Shanker Donthineni <sdonthineni@nvidia.com>
    arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU

Mark Rutland <mark.rutland@arm.com>
    arm64: errata: Mitigate TLBI errata on various Arm CPUs

Mark Rutland <mark.rutland@arm.com>
    arm64: cputype: Add C1-Premium definitions

Mark Rutland <mark.rutland@arm.com>
    arm64: cputype: Add C1-Ultra definitions

Shanker Donthineni <sdonthineni@nvidia.com>
    arm64: cputype: Add NVIDIA Olympus definitions

Aaron Erhardt <aer@tuxedocomputers.com>
    ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6

Julian Anastasov <ja@ssi.bg>
    ipvs: skip ipv6 extension headers for csum checks

Xiang Mei <xmei5@asu.edu>
    net: bonding: fix use-after-free in bond_xmit_broadcast()

Jason Gunthorpe <jgg@ziepe.ca>
    RDMA/umem: Fix truncation for block sizes >= 4G

Leon Romanovsky <leon@kernel.org>
    RDMA: Move DMA block iterator logic into dedicated files

Randy Dunlap <rdunlap@infradead.org>
    RDMA/umem: fix kernel-doc warnings

Jason Gunthorpe <jgg@ziepe.ca>
    RDMA: During rereg_mr ensure that REREG_ACCESS is compatible

Anton Leontev <leontyevantony@gmail.com>
    hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf

Wupeng Ma <mawupeng1@huawei.com>
    mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison

Jane Chu <jane.chu@oracle.com>
    mm/memory-failure: fix missing ->mf_stats count in hugetlb poison

David Hildenbrand <david@redhat.com>
    mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb()

David Hildenbrand <david@redhat.com>
    mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio

David Hildenbrand <david@redhat.com>
    mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb()

Davide Ornaghi <d.ornaghi97@gmail.com>
    netfilter: nft_fib: fix stale stack leak via the OIFNAME register

Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
    usb: typec: ucsi: Don't update power_supply on power role change if not connected

Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
    serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ

Michael Bommarito <michael.bommarito@gmail.com>
    scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()

Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
    usb: typec: ucsi: Check if power role change actually happened before handling

Kai Aizen <kai.aizen.dev@gmail.com>
    usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind

Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
    usb: dwc3: xilinx: fix error handling in zynqmp init error paths

Wentao Liang <vulab@iscas.ac.cn>
    usb: musb: omap2430: Fix use-after-free in omap2430_probe()

Tudor Ambarus <tudor.ambarus@linaro.org>
    tty: serial: samsung: Remove redundant port lock acquisition in rx helpers

Tudor Ambarus <tudor.ambarus@linaro.org>
    tty: serial: samsung: use u32 for register interactions

Thomas Gleixner <tglx@linutronix.de>
    serial: samsung_tty: Use port lock wrappers

Cássio Gabriel <cassiogabrielcontato@gmail.com>
    ALSA: firewire-motu: Protect register DSP event queue positions

Pratyush Yadav (Google) <pratyush@kernel.org>
    memfd: deny writeable mappings when implying SEAL_WRITE

Rodrigo Alencar <rodrigo.alencar@analog.com>
    iio: dac: ad5686: fix ref bit initialization for single-channel parts

Peter Chen <peter.chen@cixtech.com>
    usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure

Antoniu Miclaus <antoniu.miclaus@analog.com>
    iio: chemical: scd30: fix division by zero in write_raw

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio: chemical: scd30: Use guard(mutex) to allow early returns

Antoniu Miclaus <antoniu.miclaus@analog.com>
    iio: gyro: adis16260: fix division by zero in write_raw

Paolo Abeni <pabeni@redhat.com>
    mptcp: handle first subflow closing consistently

Shuai Zhang <shuai.zhang@oss.qualcomm.com>
    Bluetooth: hci_qca: Convert timeout from jiffies to ms

Uwe Kleine-König <u.kleine-koenig@baylibre.com>
    Bluetooth: hci_qca: Migrate to serdev specific shutdown function

Uwe Kleine-König <u.kleine-koenig@baylibre.com>
    serdev: Provide a bustype shutdown function

Ricardo B. Marliere <ricardo@marliere.net>
    serdev: make serdev_bus_type const

SeongJae Park <sj@kernel.org>
    mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()

Alistair Popple <apopple@nvidia.com>
    mm/memory: fix spurious warning when unmapping device-private/exclusive pages

Shardul Bankar <shardul.b@mpiricsoftware.com>
    mptcp: do not drop partial packets

Paolo Abeni <pabeni@redhat.com>
    mptcp: introduce the mptcp_init_skb helper

David Carlier <devnexen@gmail.com>
    iio: adc: npcm: fix unbalanced clk_disable_unprepare()

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    iio: adc: npcm: Convert to platform remove callback returning void

Zeng Heng <zengheng4@huawei.com>
    arm64: tlb: Flush walk cache when unsharing PMD tables

Dawei Feng <dawei.feng@seu.edu.cn>
    octeontx2-pf: avoid double free of pool->stack on AQ init failure

Jann Horn <jannh@google.com>
    af_unix: Fix UAF read of tail->len in unix_stream_data_wait()

Kuniyuki Iwashima <kuniyu@google.com>
    af_unix: Cache state->msg in unix_stream_read_generic().

David Howells <dhowells@redhat.com>
    rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer

David Howells <dhowells@redhat.com>
    rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg

Michael Bommarito <michael.bommarito@gmail.com>
    net: hsr: defer node table free until after RCU readers

Justin Iurman <justin.iurman@gmail.com>
    ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()

Eric Dumazet <edumazet@google.com>
    ipv6/addrconf: annotate data-races around devconf fields (II)

Li Xiasong <lixiasong1@huawei.com>
    mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient

Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
    ice: fix VF queue configuration with low MTU values

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    selftests: mptcp: drop nanoseconds width specifier

Paolo Abeni <pabeni@redhat.com>
    mptcp: reset rcv wnd on disconnect

Paolo Abeni <pabeni@redhat.com>
    mptcp: cleanup fallback dummy mapping generation

Paolo Abeni <pabeni@redhat.com>
    mptcp: use plain bool instead of custom binary enum

Sam Daly <sam@samdaly.ie>
    octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

Justin Stitt <justinstitt@google.com>
    octeontx2-af: replace deprecated strncpy with strscpy

Lukas Wunner <lukas@wunner.de>
    platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery

Michael Bommarito <michael.bommarito@gmail.com>
    smb: client: require net admin for CIFS SWN netlink

Ido Schimmel <idosch@nvidia.com>
    genetlink: Use internal flags for multicast groups

Guopeng Zhang <zhangguopeng@kylinos.cn>
    cgroup/cpuset: Reset DL migration state on can_attach() failure

Asim Viladi Oglu Manizada <manizada@pm.me>
    ksmbd: fix OOB write in QUERY_INFO for compound requests

Thomas Zimmermann <tzimmermann@suse.de>
    fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros

Corey Minyard <corey@minyard.net>
    ipmi:ssif: NULL thread on error

Corey Minyard <corey@minyard.net>
    ipmi:ssif: Remove unnecessary indention

Yin Tirui <yintirui@huawei.com>
    mm/huge_memory: update file PMD counter before folio_put()

Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
    soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()

Lorenzo Stoakes <ljs@kernel.org>
    mm/hugetlb: avoid false positive lockdep assertion

Johan Hovold <johan@kernel.org>
    driver core: reject devices with unregistered buses

Mingyu Wang <25181214217@stu.xidian.edu.cn>
    fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Use krealloc_array() in dal_vector_reserve()

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size

Christian König <christian.koenig@amd.com>
    drm/amdgpu: restart the CS if some parts of the VM are still invalidated

Andrew Martin <andrew.martin@amd.com>
    drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

Muhammad Bilal <meatuni001@gmail.com>
    drm/amdkfd: fix NULL dereference in get_queue_ids()

Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
    slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock

Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
    slimbus: qcom-ngd-ctrl: fix OF node refcount

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: Limit XDomain response copy to actual frame size

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: Validate XDomain request packet size before type cast

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: Clamp XDomain response data copy to allocation size

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: Bound root directory content to block size

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: Reject zero-length property entries in validator

Wyatt Feng <bronzed_45_vested@icloud.com>
    sctp: stream: fully roll back denied add-stream state

Zhao Zhang <zzhan461@ucr.edu>
    sctp: diag: reject stale associations in dump_one path

Jisheng Zhang <jszhang@kernel.org>
    mmc: sdhci: add signal voltage switch in sdhci_resume_host

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC

Inochi Amaoto <inochiama@gmail.com>
    mmc: litex_mmc: Set mandatory idle clocks before CMD0

Kamal Dasu <kamal.dasu@broadcom.com>
    mmc: core: Fix host controller programming for fixed driver type

David Carlier <devnexen@gmail.com>
    mm/hugetlb: restore reservation on error in hugetlb folio copy paths

Eduard Zingerman <eddyz87@gmail.com>
    selftests/bpf: Update comments find_equal_scalars->sync_linked_regs

Eduard Zingerman <eddyz87@gmail.com>
    selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking

Eduard Zingerman <eddyz87@gmail.com>
    bpf: Remove mark_precise_scalar_ids()

Eduard Zingerman <eddyz87@gmail.com>
    bpf: Track equal scalars history on per-instruction level

Dawei Feng <dawei.feng@seu.edu.cn>
    octeontx2-af: fix memory leak in rvu_setup_hw_resources()

Andre Heider <a.heider@gmail.com>
    nvmem: layouts: onie-tlv: fix hang on unknown types

Yuqi Xu <xuyq21@lenovo.com>
    net: rds: clear i_sends on setup unwind

Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
    net: mv643xx: fix OF node refcount

ZhaoJinming <zhaojinming@uniontech.com>
    net: bonding: fix NULL pointer dereference in bond_do_ioctl()

Nikolay Kuratov <kniv@yandex-team.ru>
    net/mlx5: Reorder completion before putting command entry in cmd_work_handler

Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
    misc: fastrpc: Fix NULL pointer dereference in rpmsg callback

Junrui Luo <moonafterrain@outlook.com>
    misc: fastrpc: fix DMA address corruption due to find_vma misuse

Zhenghang Xiao <kipreyyy@gmail.com>
    misc: fastrpc: fix use-after-free race in fastrpc_map_create

Anandu Krishnan E <anandu.e@oss.qualcomm.com>
    misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context

Yilin Zhu <zylzyl2333@gmail.com>
    ipc/shm: serialize orphan cleanup with shm_nattch updates

Cryolitia PukNgae <cryolitia.pukngae@linux.dev>
    Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard

Zeyu WANG <zeyu.thomas.wang@gmail.com>
    Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)

Akhil R <akhilrajeev@nvidia.com>
    i2c: tegra: Fix NOIRQ suspend/resume

Guillermo Rodríguez <guille.rodriguez@gmail.com>
    i2c: stm32f7: fix timing computation ignoring i2c-analog-filter

Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
    i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()

Jann Horn <jannh@google.com>
    fuse: reject fuse_notify() pagecache ops on directories

Christian Brauner <brauner@kernel.org>
    pidfd: refuse access to tasks that have started exiting harder

Hyunwoo Kim <imv4bel@gmail.com>
    inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush

Michael Bommarito <michael.bommarito@gmail.com>
    IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

Kyle Meyer <kyle.meyer@hpe.com>
    bnxt_en: Fix NULL pointer dereference

Chancel Liu <chancel.liu@nxp.com>
    ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write

Raf Dickson <rafdog35@gmail.com>
    vsock/vmci: fix sk_ack_backlog leak on failed handshake

Yuqi Xu <xuyuqiabc@gmail.com>
    wifi: nl80211: reject oversized EMA RNR lists

Tao Cui <cuitao@kylinos.cn>
    selftests: mptcp: add test for extra_subflows underflow on userspace PM

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    mptcp: sockopt: check timestamping ret value

Paolo Abeni <pabeni@redhat.com>
    mptcp: allow subflow rcv wnd to shrink

Paolo Abeni <pabeni@redhat.com>
    mptcp: close TOCTOU race while computing rcv_wnd

Paolo Abeni <pabeni@redhat.com>
    mptcp: fix retransmission loop when csum is enabled

Karl Mehltretter <kmehltretter@gmail.com>
    ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow

Karl Mehltretter <kmehltretter@gmail.com>
    ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O

Yuho Choi <dbgh9129@gmail.com>
    ARM: socfpga: Fix OF node refcount leak in SMP setup

Sechang Lim <rhkrqnwk98@gmail.com>
    udp: clear skb->dev before running a sockmap verdict

Cunlong Li <shenxiaogll@gmail.com>
    zram: fix use-after-free in zram_bvec_write_partial()

Michael Bommarito <michael.bommarito@gmail.com>
    RDMA/srp: bound SRP_RSP sense copy by the received length

SeongJae Park <sj@kernel.org>
    mm/damon/ops-common: call folio_test_lru() after folio_get()

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()

Wentao Liang <vulab@iscas.ac.cn>
    drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Fix UAF at snd_timer_user_params()

HyeongJun An <sammiee5311@gmail.com>
    USB: serial: kl5kusb105: fix bulk-out buffer overflow

Jack Wu <jackbb_wu@compal.com>
    USB: serial: option: add usb-id for Dell Wireless DW5826e-m

Adrian Korwel <adriank20047@gmail.com>
    USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()

Adrian Korwel <adriank20047@gmail.com>
    USB: serial: io_ti: fix heap overflow in get_manuf_info()

Wyatt Feng <bronzed_45_vested@icloud.com>
    xfrm: espintcp: do not reuse an in-progress partial send

Gil Portnoy <dddhkts1@gmail.com>
    ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL

Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
    drm/i915/gem: Fix phys BO pread/pwrite with offset

Sean Christopherson <seanjc@google.com>
    KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying

Inochi Amaoto <inochiama@gmail.com>
    mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation

Masami Hiramatsu (Google) <mhiramat@kernel.org>
    tracing/probes: Point the error offset correctly for eprobe argument error

Michael Bommarito <michael.bommarito@gmail.com>
    Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig

Yuqi Xu <xuyq21@lenovo.com>
    Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend

Tristan Madani <tristan@talencesecurity.com>
    netfilter: nft_tunnel: fix use-after-free on object destroy

Alexander A. Klimov <grandmaster@al2klimov.de>
    drm/vc4: fix krealloc() memory leak

Dmitry Osipenko <dmitry.osipenko@collabora.com>
    drm/virtio: Fix driver removal with disabled KMS

Pengyu Luo <mitltlatltl@gmail.com>
    clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: ctnetlink: ensure safe access to master conntrack

Ido Schimmel <idosch@nvidia.com>
    ipv6: Fix a potential NPD in cleanup_prefix_route()

Til Kaiser <mail@tk154.de>
    net: mvpp2: build skb from XDP-adjusted data on XDP_PASS

Til Kaiser <mail@tk154.de>
    net: mvpp2: refill RX buffers before XDP or skb use

Lorenzo Bianconi <lorenzo@kernel.org>
    net: mvpp2: Add metadata support for xdp mode

Til Kaiser <mail@tk154.de>
    net: mvpp2: limit XDP frame size to the RX buffer

Til Kaiser <mail@tk154.de>
    net: mvpp2: sync RX data at the hardware packet offset

Florian Westphal <fw@strlen.de>
    netfilter: nft_exthdr: fix register tracking for F_PRESENT flag

Xiang Mei <xmei5@asu.edu>
    netfilter: nf_log: validate MAC header was set before dumping it

Kyle Zeng <kylebot@openai.com>
    netfilter: x_tables: avoid leaking percpu counter pointers

Weiming Shi <bestswngs@gmail.com>
    netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

Breno Leitao <leitao@debian.org>
    rds: mark snapshot pages dirty in rds_info_getsockopt()

Eric Dumazet <edumazet@google.com>
    ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

Weiming Shi <bestswngs@gmail.com>
    net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

Kyle Zeng <kylebot@openai.com>
    net: guard timestamp cmsgs to real error queue skbs

Michael Bommarito <michael.bommarito@gmail.com>
    sctp: fix uninit-value in __sctp_rcv_asconf_lookup()

Chih Kai Hsu <hsu.chih.kai@realtek.com>
    r8152: handle the return value of usb_reset_device()

Adrian Moreno <amorenoz@redhat.com>
    net: openvswitch: fix possible kfree_skb of ERR_PTR

Kyle Zeng <kylebot@openai.com>
    ipv6: sit: reload inner IPv6 header after GSO offloads

Dragos Tatulea <dtatulea@nvidia.com>
    net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list

Mingyu Wang <25181214217@stu.xidian.edu.cn>
    net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

Maxime Chevallier <maxime.chevallier@bootlin.com>
    net: phy: clean the sfp upstream if phy probing fails

Yao Sang <sangyao@kylinos.cn>
    net/mlx4: avoid GCC 10 __bad_copy_from() false positive

Eric Dumazet <edumazet@google.com>
    tcp: restrict SO_ATTACH_FILTER to priv users

Richard Fitzgerald <rf@opensource.cirrus.com>
    ASoC: wm_adsp: Fix NULL dereference when removing firmware controls

Yun Zhou <yun.zhou@windriver.com>
    gpio: mvebu: fix NULL pointer dereference in suspend/resume

Chenguang Zhao <zhaochenguang@kylinos.cn>
    netlabel: validate unlabeled address and mask attribute lengths

Sanghyun Park <sanghyun.park.cnu@gmail.com>
    xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

Brian Foster <bfoster@redhat.com>
    iomap: don't revert iov_iter on partially completed buffered writes

Mark Rutland <mark.rutland@arm.com>
    arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI

Mark Rutland <mark.rutland@arm.com>
    arm64: tlb: Allow XZR argument to TLBI ops

Marc Zyngier <maz@kernel.org>
    KVM: arm64: Remove VPIPT I-cache handling

Weiming Shi <bestswngs@gmail.com>
    tap: free page on error paths in tap_get_user_xdp()

Minh Nguyen <minhnguyen.080505@gmail.com>
    net: skbuff: fix missing zerocopy reference in pskb_carve helpers

Gabriele Monaco <gmonaco@redhat.com>
    tools/rv: Fix cleanup after failed trace setup

Kuen-Han Tsai <khtsai@google.com>
    usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo

Kuen-Han Tsai <khtsai@google.com>
    usb: gadget: f_ncm: Fix net_device lifecycle with device_move

Ji'an Zhou <eilaimemedsnaimel@gmail.com>
    ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
    time: Fix off-by-one in settimeofday() usec validation

Aleksandr Nogikh <nogikh@google.com>
    signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()

Rui Qi <qirui.001@bytedance.com>
    ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp

Xin Long <lucien.xin@gmail.com>
    sctp: purge outqueue on stale COOKIE-ECHO handling

Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
    net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr

Eric Dumazet <edumazet@google.com>
    ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

Andy Roulin <aroulin@nvidia.com>
    vxlan: vnifilter: fix spurious notification on VNI update

Andy Roulin <aroulin@nvidia.com>
    vxlan: vnifilter: send notification on VNI add

Nithin Dabilpuram <ndabilpuram@marvell.com>
    octeontx2-af: npc: Fix CPT channel mask in npc_install_flow

Lorenzo Bianconi <lorenzo@kernel.org>
    net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown

Kurt Kanzenbach <kurt@linutronix.de>
    ptp: vclock: Switch from RCU to SRCU

Eric Dumazet <edumazet@google.com>
    ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options

Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Bluetooth: MGMT: Fix backward compatibility with userspace

Bharath Reddy <kbreddy.rpbc@gmail.com>
    Bluetooth: fix memory leak in error path of hci_alloc_dev()

Zhang Cen <rollkingzzc@gmail.com>
    Bluetooth: bnep: reject short frames before parsing

Dudu Lu <phx0fer@gmail.com>
    Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling

SeungJu Cheon <suunj1331@gmail.com>
    Bluetooth: RFCOMM: validate skb length in MCC handlers

Zhang Cen <rollkingzzc@gmail.com>
    Bluetooth: MGMT: validate advertising TLV before type checks

Zhang Cen <rollkingzzc@gmail.com>
    Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

Tapio Reijonen <tapio.reijonen@vaisala.com>
    net: fec: fix pinctrl default state restore order on resume

David Thompson <davthompson@nvidia.com>
    net: lan743x: permit VLAN-tagged packets up to configured MTU

Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
    net: garp: fix unsigned integer underflow in garp_pdu_parse_attr

Kuniyuki Iwashima <kuniyu@google.com>
    hsr: Remove WARN_ONCE() in hsr_addr_is_self().

Kuniyuki Iwashima <kuniyu@google.com>
    net: Annotate sk->sk_write_space() for UDP SOCKMAP.

Oscar Maes <oscmaes92@gmail.com>
    pcnet32: stop holding device spin lock during napi_complete_done

Yicong Hui <yiconghui@gmail.com>
    drm/imx: Fix three kernel-doc warnings in dcss-scaler.c

Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
    6lowpan: fix off-by-one in multicast context address compression

Jamal Hadi Salim <jhs@mojatatu.com>
    net/sched: act_api: use RCU with deferred freeing for action lifecycle

Guangshuo Li <lgs201920130244@gmail.com>
    dm cache policy smq: check allocation under invalidate lock

Yiming Qian <yimingqian591@gmail.com>
    netfilter: bridge: make ebt_snat ARP rewrite writable

Jiayuan Chen <jiayuan.chen@linux.dev>
    netfilter: nft_ct: bail out on template ct in get eval

Florian Westphal <fw@strlen.de>
    netfilter: conntrack_irc: fix possible out-of-bounds read

Fernando Fernandez Mancera <fmancera@suse.de>
    netfilter: synproxy: add mutex to guard hook reference counting

Julian Anastasov <ja@ssi.bg>
    ipvs: clear the svc scheduler ptr early on edit

Fernando Fernandez Mancera <fmancera@suse.de>
    netfilter: xt_NFQUEUE: prefer raw_smp_processor_id

Gil Portnoy <dddhkts1@gmail.com>
    ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
    tee: optee: prevent use-after-free when the client exits before the supplicant

Nicolò Coccia <n.coccia96@gmail.com>
    net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS

Ido Schimmel <idosch@nvidia.com>
    ipv6: mcast: Fix use-after-free when processing MLD queries

Mingyu Wang <25181214217@stu.xidian.edu.cn>
    i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl

Nathan Chancellor <nathan@kernel.org>
    Disable -Wattribute-alias for clang-23 and newer

Guenter Roeck <linux@roeck-us.net>
    hwmon: (pmbus/core) Protect regulator operations with mutex

Zhu Yanjun <yanjun.zhu@linux.dev>
    RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug

Pauli Virtanen <pav@iki.fi>
    Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

Johan Hovold <johan@kernel.org>
    USB: serial: mct_u232: fix memory corruption with small endpoint

Kuniyuki Iwashima <kuniyu@google.com>
    bpf: Free reuseport cBPF prog after RCU grace period.

Michal Pecio <michal.pecio@gmail.com>
    usb: core: Fix SuperSpeed root hub wMaxPacketSize

Nathan Chancellor <nathan@kernel.org>
    HID: core: Fix size_t specifier in hid_report_raw_event()

Benjamin Tissoires <bentiss@kernel.org>
    HID: pass the buffer size to hid_report_raw_event

Vicki Pfau <vi@endrift.com>
    HID: core: Add printk_ratelimited variants to hid_warn() etc

Maciej W. Rozycki <macro@orcam.me.uk>
    serial: zs: Convert to use a platform device

Maciej W. Rozycki <macro@orcam.me.uk>
    serial: dz: Convert to use a platform device

Maciej W. Rozycki <macro@orcam.me.uk>
    serial: dz: Fix bootconsole handover lockup

Wei-Cheng Chen <weichengc@nvidia.com>
    xhci: tegra: Fix ghost USB device on dual-role port unplug

Johan Hovold <johan@kernel.org>
    USB: serial: digi_acceleport: fix memory corruption with small endpoints

Mickaël Salaün <mic@digikod.net>
    landlock: Fix handling of disconnected directories

Aleksandr Nogikh <nogikh@google.com>
    x86/kexec: Disable KCOV instrumentation after load_segments()

Doruk Tan Ozturk <doruk@0sec.ai>
    Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

Johan Hovold <johan@kernel.org>
    USB: serial: cypress_m8: fix memory corruption with small endpoint

Maciej W. Rozycki <macro@orcam.me.uk>
    serial: zs: Switch to using channel reset

Maciej W. Rozycki <macro@orcam.me.uk>
    serial: zs: Fix bootconsole handover lockup

Maciej W. Rozycki <macro@orcam.me.uk>
    serial: dz: Fix bootconsole message clobbering at chip reset

David Francis <David.Francis@amd.com>
    drm/amdkfd: Check for pdd drm file first in CRIU restore path

Eric Huang <jinhuieric.huang@amd.com>
    drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

Eric Huang <jinhuieric.huang@amd.com>
    drm/amdkfd: fix NULL pointer bug in svm_range_set_attr

Shitalkumar Gandhi <shital.gandhi45@gmail.com>
    serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma

Maciej W. Rozycki <macro@orcam.me.uk>
    serial: zs: Fix swapped RI/DSR modem line transition counting

Hongling Zeng <zenghongling@kylinos.cn>
    serial: sh-sci: fix memory region release in error path

Prasanna S <prasanna.s@oss.qualcomm.com>
    serial: qcom-geni: fix UART_RX_PAR_EN bit position

Myeonghun Pak <mhun512@gmail.com>
    serial: altera_jtaguart: handle uart_add_one_port() failures

Timur Kristóf <timur.kristof@gmail.com>
    drm/amd/pm/si: Disregard vblank time when no displays are connected

Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
    drm/i915: Fix potential UAF in TTM object purge

Berkant Koc <me@berkoc.com>
    drm/hyperv: validate VMBus packet size in receive callback

Berkant Koc <me@berkoc.com>
    drm/hyperv: validate resolution_count and fix WIN8 fallback

Alexandru Hossu <hossu.alexandru@gmail.com>
    scsi: target: iscsi: Validate CHAP_R length before base64 decode

Michael Bommarito <michael.bommarito@gmail.com>
    scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

Michael Bommarito <michael.bommarito@gmail.com>
    scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

Michael Bommarito <michael.bommarito@gmail.com>
    scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow

Michael Bommarito <michael.bommarito@gmail.com>
    thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()

Michael Bommarito <michael.bommarito@gmail.com>
    usb: gadget: f_fs: copy only received bytes on short ep0 read

Seungjin Bae <eeodqql09@gmail.com>
    usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports

Jeremy Erazo <mendozayt13@gmail.com>
    usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling

Guangshuo Li <lgs201920130244@gmail.com>
    usb: gadget: f_hid: fix device reference leak in hidg_alloc()

Guangshuo Li <lgs201920130244@gmail.com>
    usb: gadget: net2280: Fix double free in probe error path

Johan Hovold <johan@kernel.org>
    USB: serial: mct_u232: fix missing interrupt-in transfer sanity check

Johan Hovold <johan@kernel.org>
    USB: serial: mxuport: fix memory corruption with small endpoint

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan: fix missing indat transfer sanity check

Zhang Cen <rollkingzzc@gmail.com>
    USB: serial: cypress_m8: validate interrupt packet headers

Zhang Cen <rollkingzzc@gmail.com>
    USB: serial: belkin_sa: validate interrupt status length

Wanquan Zhong <wanquan.zhong@fibocom.com>
    USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL

Jan Volckaert <janvolck@gmail.com>
    USB: serial: option: add MeiG SRM813Q

Heitor Alves de Siqueira <halves@igalia.com>
    usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize

Heitor Alves de Siqueira <halves@igalia.com>
    usb: usbtmc: check URB actual_length for interrupt-IN notifications

Michael Bommarito <michael.bommarito@gmail.com>
    usbip: vudc: Fix use after free bug in vudc_remove due to race condition

Sam Burkels <sam@1a38.nl>
    usb: storage: Add quirks for PNY Elite Portable SSD

Stephen J. Fuhry <fuhrysteve@gmail.com>
    USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers

Michal Pecio <michal.pecio@gmail.com>
    usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval

Xu Yang <xu.yang_2@nxp.com>
    usb: chipidea: core: convert ci_role_switch to local variable

Zhaoyang Yu <2426767509@qq.com>
    tty: serial: pch_uart: add check for dma_alloc_coherent()

Guangshuo Li <lgs201920130244@gmail.com>
    counter: Fix refcount leak in counter_alloc() error path

Ian Abbott <abbotti@mev.co.uk>
    comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()

Ian Abbott <abbotti@mev.co.uk>
    comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()

Nicolás Bazaes <contacto@bazaes.cl>
    Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

Ali Ganiyev <ali.qaniyev@gmail.com>
    ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

Dmitriy Zharov <contact@zharov.dev>
    Input: xpad - add support for ASUS ROG RAIKIRI II

Qbeliw Tanaka <q.tanaka@gmx.com>
    Input: xpad - add "Nova 2 Lite" from GameSir

Jingguo Tan <tanjingguo@huawei.com>
    xfrm: esp: restore combined single-frag length gate

Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
    ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks

Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
    ASoC: qcom: q6asm-dai: close stream only when running

Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
    netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

Michael Bommarito <michael.bommarito@gmail.com>
    xfrm: ah: use skb_to_full_sk in async output callbacks

Maoyi Xie <maoyixie.tju@gmail.com>
    xfrm: route MIGRATE notifications to caller's netns

Ashutosh Desai <ashutoshdesai993@gmail.com>
    nfc: hci: fix out-of-bounds read in HCP header parsing

Arnd Bergmann <arnd@arndb.de>
    iommu, debugobjects: avoid gcc-16.1 section mismatch warnings

Lee Jones <lee@kernel.org>
    HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

Kuniyuki Iwashima <kuniyu@google.com>
    ip6: vti: Use ip6_tnl.net in vti6_changelink().

Zhengchuan Liang <zcliangcn@gmail.com>
    xfrm: input: hold netns during deferred transport reinjection

Qi Tang <tpluszz77@gmail.com>
    ipv6: validate extension header length before copying to cmsg

Maoyi Xie <maoyixie.tju@gmail.com>
    ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

Zhengchuan Liang <zcliangcn@gmail.com>
    ipv6: exthdrs: refresh nh after handling HAO option

Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
    ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params

Justin Iurman <justin.iurman@gmail.com>
    ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

Junrui Luo <moonafterrain@outlook.com>
    macsec: fix replay protection at XPN lower-PN wrap

Yuqi Xu <xuyq21@lenovo.com>
    bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: elan_i2c - validate firmware size before use

Dan Carpenter <error27@gmail.com>
    usb: dwc2: Fix use after free in debug code

Peter Chen <peter.chen@cixtech.com>
    usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles

Yongchao Wu <yongchao.wu@autochips.com>
    usb: cdns3: gadget: fix request skipping after clearing halt

Johan Hovold <johan@kernel.org>
    USB: serial: omninet: fix memory corruption with small endpoint

Felix Gu <ustc.gu@gmail.com>
    iio: buffer: hw-consumer: fix use-after-free in error path

Aldo Conte <aldocontelk@gmail.com>
    iio: light: cm3323: fix reg_conf not being initialized correctly

Advait Dhamorikar <advaitd@mechasystems.com>
    iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL

Salah Triki <salah.triki@gmail.com>
    iio: temperature: tsys01: fix broken PROM checksum validation

Sanjay Chitroda <sanjayembeddedse@gmail.com>
    iio: ssp_sensors: cancel delayed work_refresh on remove

David Carlier <devnexen@gmail.com>
    iio: gyro: itg3200: fix i2c read into the wrong stack location

Salah Triki <salah.triki@gmail.com>
    iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw

Rodrigo Alencar <rodrigo.alencar@analog.com>
    iio: dac: ad5686: acquire lock when doing powerdown control

Rodrigo Alencar <rodrigo.alencar@analog.com>
    iio: dac: ad5686: fix input raw value check

Salah Triki <salah.triki@gmail.com>
    iio: dac: max5821: fix return value check in powerdown sync

Christofer Jonason <christofer.jonason@guidelinegeo.com>
    iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux

Jason A. Donenfeld <Jason@zx2c4.com>
    wireguard: send: append trailer after expanding head

Sean Christopherson <seanjc@google.com>
    KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC

Qiang Ma <maqianga@uniontech.com>
    KVM: arm64: PMU: Preserve AArch32 counter low bits

Wentao Guan <guanwentao@uniontech.com>
    USB: cdc-acm: Fix bit overlap and move quirk definitions to header

Ben Hutchings <benh@debian.org>
    parport: Fix race between port and client registration

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: xpad - fix out-of-bounds access for Share button

Muhammad Bilal <meatuni001@gmail.com>
    Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

Muhammad Bilal <meatuni001@gmail.com>
    Bluetooth: ISO: fix UAF in iso_recv_frame

Muhammad Bilal <meatuni001@gmail.com>
    Bluetooth: HIDP: fix missing length checks in hidp_input_report()

Siwei Zhang <oss@fourdim.xyz>
    Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

Siwei Zhang <oss@fourdim.xyz>
    Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()

Stepan Ionichev <sozdayvek@gmail.com>
    auxdisplay: line-display: fix OOB read on zero-length message_store()

Linpu Yu <linpu5433@gmail.com>
    ipc: limit next_id allocation to the valid ID range

Mikulas Patocka <mpatocka@redhat.com>
    hpfs: fix a crash if hpfs_map_dnode_bitmap fails

Shuai Zhang <shuai.zhang@oss.qualcomm.com>
    Bluetooth: btusb: Allow firmware re-download when version matches

hlleng <a909204013@gmail.com>
    HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse

Thomas Fourier <fourier.thomas@gmail.com>
    Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()

Henri A <contact@henrialfonso.com>
    media: rc: igorplugusb: fix control request setup packet

Johan Hovold <johan@kernel.org>
    USB: serial: safe_serial: fix memory corruption with small endpoint

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    usb: typec: ucsi: validate connector number in ucsi_connector_change()

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    usb: typec: altmodes/displayport: validate count before reading Status Update VDO

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    usb: typec: ucsi: ccg: reject firmware images without a ':' record header

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer

Prathamesh Shete <pshete@nvidia.com>
    soc/tegra: pmc: Fix unsafe generic_handle_irq() call

Abdurrahman Hussain <abdurrahman@nexthop.ai>
    hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock

Abdurrahman Hussain <abdurrahman@nexthop.ai>
    hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock

Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
    x86/kexec: add a sanity check on previous kernel's ima kexec buffer

Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
    of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()

Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
    ima: verify the previous kernel's IMA buffer lies in addressable RAM

Horatiu Vultur <horatiu.vultur@microchip.com>
    phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X

Will Deacon <will@kernel.org>
    arm64: io: Extract user memory type in ioremap_prot()

Will Deacon <will@kernel.org>
    arm64: io: Rename ioremap_prot() to __ioremap_prot()

Jouni Högander <jouni.hogander@intel.com>
    drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used

Suraj Kandpal <suraj.kandpal@intel.com>
    drm/dp: Add eDP 1.5 bit definition

Jouni Högander <jouni.hogander@intel.com>
    drm/i915/psr: Read Intel DPCD workaround register

Jouni Högander <jouni.hogander@intel.com>
    drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register

Jakub Kicinski <kuba@kernel.org>
    inet: frags: flush pending skbs in fqdir_pre_exit()

Jakub Kicinski <kuba@kernel.org>
    inet: frags: add inet_frag_queue_flush()

Thomas Zimmermann <tzimmermann@suse.de>
    drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup

Thomas Zimmermann <tzimmermann@suse.de>
    drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info

Oliver Neukum <oneukum@suse.com>
    media: rc: ttusbir: fix inverted error logic

Sean Young <sean@mess.org>
    media: rc: fix race between unregister and urb/irq callbacks

Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
    mm/page_alloc: clear page->private in free_pages_prepare()

Sven Eckelmann <sven@narfation.org>
    batman-adv: bla: avoid double decrement of bla.num_requests

Sven Eckelmann <sven@narfation.org>
    batman-adv: tt: avoid empty VLAN responses

Sven Eckelmann <sven@narfation.org>
    batman-adv: tt: fix TOCTOU race for reported vlans

Sven Eckelmann <sven@narfation.org>
    batman-adv: tp_meter: directly shut down timer on cleanup

Zhengchuan Liang <zcliangcn@gmail.com>
    net: af_key: zero aligned sockaddr tail in PF_KEY exports

Sven Eckelmann <sven@narfation.org>
    batman-adv: tp_meter: avoid role confusion in tp_list

Sven Eckelmann <sven@narfation.org>
    batman-adv: iv: recover OGM scheduling after forward packet error

Sven Eckelmann <sven@narfation.org>
    batman-adv: tvlv: reject oversized TVLV packets

Sven Eckelmann <sven@narfation.org>
    batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface

Sven Eckelmann <sven@narfation.org>
    batman-adv: tt: reject oversized local TVLV buffers

Sven Eckelmann <sven@narfation.org>
    batman-adv: tvlv: abort OGM send on tvlv append failure

Sven Eckelmann <sven@narfation.org>
    batman-adv: v: stop OGMv2 on disabled interface

Yeoreum Yun <yeoreum.yun@arm.com>
    perf: Fix dangling cgroup pointer in cpuctx

Pavel Begunkov <asml.silence@gmail.com>
    net: skbuff: fix pskb_carve leaking zcopy pages

Jiayuan Chen <jiayuan.chen@linux.dev>
    ipv6: fix possible infinite loop in fib6_select_path()

Jiayuan Chen <jiayuan.chen@linux.dev>
    ipv6: fix possible infinite loop in rt6_fill_node()

Zhenghang Xiao <kipreyyy@gmail.com>
    sctp: fix race between sctp_wait_for_connect and peeloff

Dipayaan Roy <dipayanroy@linux.microsoft.com>
    net: mana: Add NULL guards in teardown path to prevent panic on attach failure

Marco Scardovi <scardracs@disroot.org>
    gpio: rockchip: convert bank->clk to devm_clk_get_enabled()

Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

Zhenghang Xiao <kipreyyy@gmail.com>
    Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

Jamal Hadi Salim <jhs@mojatatu.com>
    net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"

Rahul Chandelkar <rc@rexion.ai>
    ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

Jakub Kicinski <kuba@kernel.org>
    ethtool: eeprom: add more safeties to EEPROM Netlink fallback

Jakub Kicinski <kuba@kernel.org>
    ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback

Oliver Hartkopp <socketcan@hartkopp.net>
    bonding: refuse to enslave CAN devices

Zhao Dongdong <zhaodongdong@kylinos.cn>
    Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

Cássio Gabriel <cassiogabrielcontato@gmail.com>
    ASoC: codecs: simple-mux: Fix enum control bounds check

Sean Shen <grayhat@foxmail.com>
    ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

Eric Dumazet <edumazet@google.com>
    tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

Eric Dumazet <edumazet@google.com>
    vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

Eric Dumazet <edumazet@google.com>
    tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

Alexander Stein <alexander.stein@ew.tq-group.com>
    gpio: mxc: fix irq_high handling

Luka Gejak <luka.gejak@linux.dev>
    net: hsr: fix potential OOB access in supervision frame handling

Cássio Gabriel <cassiogabrielcontato@gmail.com>
    ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors

Eric Dumazet <edumazet@google.com>
    ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

David Jeffery <djeffery@redhat.com>
    scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues

Breno Leitao <leitao@debian.org>
    net/iucv: fix locking in .getsockopt

Alexandra Winter <wintera@linux.ibm.com>
    net/smc: Do not re-initialize smc hashtables

Ilya Maximets <i.maximets@ovn.org>
    net: netlink: don't set nsid on local notifications

Ilya Maximets <i.maximets@ovn.org>
    net: netlink: fix sending unassigned nsid after assigned one

Ziyu Zhang <ziyuzhang201@gmail.com>
    vsock: keep poll shutdown state consistent

Weiming Shi <bestswngs@gmail.com>
    tun: free page on build_skb failure in tun_xdp_one()

Weiming Shi <bestswngs@gmail.com>
    tun: free page on short-frame rejection in tun_xdp_one()

Fernando Fernandez Mancera <fmancera@suse.de>
    netfilter: nf_tables: fix dst corruption in same register operation

Jeremy Sowden <jeremy@azazel.net>
    netfilter: bitwise: add support for doing AND, OR and XOR directly

Jeremy Sowden <jeremy@azazel.net>
    netfilter: bitwise: rename some boolean operation functions

Florian Westphal <fw@strlen.de>
    netfilter: ebtables: fix OOB read in compat_mtw_from_user

Florian Westphal <fw@strlen.de>
    netfilter: xt_cpu: prefer raw_smp_processor_id

Chris Mason <clm@meta.com>
    netfilter: synproxy: refresh tcphdr after skb_ensure_writable

Carl Lee <carl.lee@amd.com>
    nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems

David Ahern <dahern@nvidia.com>
    xfrm: Check for underflow in xfrm_state_mtu

Lee Jones <lee@kernel.org>
    nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()

Lee Jones <lee@kernel.org>
    nfc: llcp: Fix use-after-free in llcp_sock_release()

Kevin Hao <haokexin@gmail.com>
    net: cpsw_new: Fix potential unregister of netdev that has not been registered yet

Mingzhe Zou <mingzhe.zou@easystack.cn>
    bcache: fix uninitialized closure object

Carlos Eduardo Gallo Filho <gcarlos@disroot.org>
    drm: Remove plane hsub/vsub alignment requirement for core helpers

Victor Nogueria <victor@mojatatu.com>
    net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked

Jeremy Kerr <jk@codeconstruct.com.au>
    net: mctp: ensure our nlmsg responses are initialised

Davide Caratti <dcaratti@redhat.com>
    net/sched: cls_fw: fix NULL dereference of "old" filters before change()

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size


-------------

Diffstat:

 Documentation/arch/arm64/silicon-errata.rst        |  48 +++
 Makefile                                           |   4 +-
 arch/arm/include/asm/io.h                          |  15 +-
 arch/arm/kernel/entry-armv.S                       |   2 +-
 arch/arm/mach-socfpga/platsmp.c                    |   1 +
 arch/arm64/Kconfig                                 |  50 +++
 arch/arm64/include/asm/cputype.h                   |   6 +
 arch/arm64/include/asm/io.h                        |  25 +-
 arch/arm64/include/asm/kvm_mmu.h                   |   5 +-
 arch/arm64/include/asm/tlb.h                       |   2 +-
 arch/arm64/include/asm/tlbflush.h                  |  64 ++--
 arch/arm64/kernel/acpi.c                           |   2 +-
 arch/arm64/kernel/cpu_errata.c                     |  34 +-
 arch/arm64/kernel/sys_compat.c                     |   2 +-
 arch/arm64/kvm/hyp/nvhe/mm.c                       |   2 +-
 arch/arm64/kvm/hyp/nvhe/pkvm.c                     |   2 +-
 arch/arm64/kvm/hyp/nvhe/tlb.c                      |  69 +---
 arch/arm64/kvm/hyp/pgtable.c                       |   2 +-
 arch/arm64/kvm/hyp/vhe/tlb.c                       |  21 +-
 arch/arm64/kvm/pmu-emul.c                          |   4 +-
 arch/arm64/mm/ioremap.c                            |   8 +-
 arch/mips/dec/platform.c                           | 109 +++++-
 arch/x86/kernel/Makefile                           |  14 +
 arch/x86/kernel/cpu/amd.c                          |  33 +-
 arch/x86/kernel/setup.c                            |   6 +
 arch/x86/kvm/svm/avic.c                            |  35 +-
 arch/x86/mm/Makefile                               |   2 +
 drivers/auxdisplay/line-display.c                  |   2 +-
 drivers/base/bus.c                                 |  11 +-
 drivers/block/zram/zram_drv.c                      |   2 +-
 drivers/bluetooth/btusb.c                          |   8 +-
 drivers/bluetooth/hci_qca.c                        |  38 +--
 drivers/char/ipmi/ipmi_msghandler.c                |   2 +-
 drivers/char/ipmi/ipmi_ssif.c                      |  29 +-
 drivers/clk/qcom/dispcc-sc8280xp.c                 |   4 +-
 drivers/comedi/drivers/comedi_test.c               |   5 +-
 drivers/counter/counter-core.c                     |   3 +-
 drivers/gpio/gpio-mvebu.c                          |   4 +-
 drivers/gpio/gpio-mxc.c                            |   2 +-
 drivers/gpio/gpio-rockchip.c                       |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |   4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |  10 +-
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c  |  10 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c   |  49 ++-
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c               |   3 +
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  |   5 +
 drivers/gpu/drm/amd/display/dc/basics/vector.c     |   4 +-
 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c |  54 ++-
 .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c    |   3 +-
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c         |   4 +
 drivers/gpu/drm/bridge/sil-sii8620.c               |   1 +
 drivers/gpu/drm/drm_fb_helper.c                    |  12 +-
 drivers/gpu/drm/hyperv/hyperv_drm_proto.c          | 113 ++++++-
 drivers/gpu/drm/i915/display/intel_display_types.h |   1 +
 drivers/gpu/drm/i915/display/intel_dpcd.h          |  15 +
 drivers/gpu/drm/i915/display/intel_psr.c           |  34 +-
 drivers/gpu/drm/i915/gem/i915_gem_phys.c           |  19 +-
 drivers/gpu/drm/i915/gem/i915_gem_ttm.c            |  28 +-
 drivers/gpu/drm/imx/dcss/dcss-scaler.c             |   3 +
 drivers/gpu/drm/vc4/vc4_validate_shaders.c         |  13 +-
 drivers/gpu/drm/virtio/virtgpu_drv.c               |   5 +-
 drivers/gpu/drm/virtio/virtgpu_submit.c            |   4 +-
 drivers/hid/bpf/hid_bpf_dispatch.c                 |   3 +-
 drivers/hid/hid-core.c                             |  35 +-
 drivers/hid/hid-gfrm.c                             |   4 +-
 drivers/hid/hid-ids.h                              |   1 +
 drivers/hid/hid-logitech-hidpp.c                   |   2 +-
 drivers/hid/hid-multitouch.c                       |   2 +-
 drivers/hid/hid-picolcd_cir.c                      |   1 +
 drivers/hid/hid-primax.c                           |   2 +-
 drivers/hid/hid-quirks.c                           |   1 +
 drivers/hid/hid-vivaldi-common.c                   |   2 +-
 drivers/hid/wacom_sys.c                            |  19 +-
 drivers/hid/wacom_wac.h                            |   1 +
 drivers/hwmon/pmbus/adm1266.c                      |  49 ++-
 drivers/hwmon/pmbus/pmbus_core.c                   | 117 +++++--
 drivers/i2c/busses/i2c-qcom-cci.c                  |   2 +-
 drivers/i2c/busses/i2c-stm32f7.c                   |   6 +-
 drivers/i2c/busses/i2c-tegra.c                     |  53 +--
 drivers/i2c/i2c-dev.c                              |   9 +-
 drivers/iio/adc/npcm_adc.c                         |  31 +-
 drivers/iio/adc/viperboard_adc.c                   |   4 +-
 drivers/iio/adc/xilinx-xadc-core.c                 |  11 +-
 drivers/iio/buffer/industrialio-hw-consumer.c      |   4 +-
 drivers/iio/chemical/scd30_core.c                  |  65 ++--
 drivers/iio/common/ssp_sensors/ssp_dev.c           |   1 +
 drivers/iio/dac/ad5686.c                           |  16 +-
 drivers/iio/dac/ad5686.h                           |   1 +
 drivers/iio/dac/max5821.c                          |   9 +-
 drivers/iio/gyro/adis16260.c                       |   3 +
 drivers/iio/gyro/itg3200_buffer.c                  |   2 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c     |   2 +-
 drivers/iio/light/cm3323.c                         |   5 +-
 drivers/iio/magnetometer/st_magn_core.c            |  13 +-
 drivers/iio/temperature/tsys01.c                   |   2 +-
 drivers/infiniband/core/Makefile                   |   2 +-
 drivers/infiniband/core/iter.c                     |  43 +++
 drivers/infiniband/core/umem.c                     |  16 +
 drivers/infiniband/core/verbs.c                    |  38 ---
 drivers/infiniband/hw/bnxt_re/qplib_res.c          |   2 +-
 drivers/infiniband/hw/cxgb4/mem.c                  |   2 +-
 drivers/infiniband/hw/efa/efa_verbs.c              |   2 +-
 drivers/infiniband/hw/erdma/erdma_verbs.c          |   2 +-
 drivers/infiniband/hw/hns/hns_roce_alloc.c         |   2 +-
 drivers/infiniband/hw/hns/hns_roce_mr.c            |   4 +
 drivers/infiniband/hw/irdma/main.h                 |   2 +-
 drivers/infiniband/hw/irdma/verbs.c                |   4 +
 drivers/infiniband/hw/mana/mana_ib.h               |   2 +-
 drivers/infiniband/hw/mlx4/mr.c                    |   5 +
 drivers/infiniband/hw/mlx5/mem.c                   |   1 +
 drivers/infiniband/hw/mlx5/mr.c                    |   4 +
 drivers/infiniband/hw/mlx5/umr.c                   |   1 +
 drivers/infiniband/hw/mthca/mthca_provider.c       |   2 +-
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c        |   2 +-
 drivers/infiniband/hw/qedr/verbs.c                 |   2 +-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma.h          |   2 +-
 drivers/infiniband/sw/rxe/rxe_qp.c                 |   7 +-
 drivers/infiniband/sw/rxe/rxe_verbs.c              |   5 +
 drivers/infiniband/ulp/isert/ib_isert.c            |   6 +
 drivers/infiniband/ulp/srp/ib_srp.c                |  30 +-
 drivers/input/joystick/xpad.c                      |  14 +-
 drivers/input/keyboard/atkbd.c                     |  15 +
 drivers/input/misc/ims-pcu.c                       |   2 +-
 drivers/input/mouse/elan_i2c_core.c                |   5 +
 drivers/input/mouse/synaptics.c                    |   1 +
 drivers/input/touchscreen/atmel_mxt_ts.c           |   2 +-
 drivers/input/touchscreen/usbtouchscreen.c         |   5 +
 drivers/iommu/io-pgtable-arm-v7s.c                 |  18 +-
 drivers/md/bcache/super.c                          |   3 +-
 drivers/md/dm-cache-policy-smq.c                   |  12 +-
 drivers/media/cec/core/cec-core.c                  |   2 +-
 drivers/media/common/siano/smsir.c                 |   1 +
 drivers/media/i2c/ir-kbd-i2c.c                     |   2 +
 drivers/media/pci/bt8xx/bttv-input.c               |   3 +-
 drivers/media/pci/cx23885/cx23885-input.c          |   1 +
 drivers/media/pci/cx88/cx88-input.c                |   3 +-
 drivers/media/pci/dm1105/dm1105.c                  |   1 +
 drivers/media/pci/mantis/mantis_input.c            |   1 +
 drivers/media/pci/saa7134/saa7134-input.c          |   1 +
 drivers/media/pci/smipcie/smipcie-ir.c             |   1 +
 drivers/media/pci/ttpci/budget-ci.c                |   1 +
 drivers/media/rc/ati_remote.c                      |   6 +-
 drivers/media/rc/ene_ir.c                          |   2 +-
 drivers/media/rc/fintek-cir.c                      |   3 +-
 drivers/media/rc/igorplugusb.c                     |   3 +-
 drivers/media/rc/iguanair.c                        |   1 +
 drivers/media/rc/img-ir/img-ir-hw.c                |   3 +-
 drivers/media/rc/img-ir/img-ir-raw.c               |   3 +-
 drivers/media/rc/imon.c                            |   3 +-
 drivers/media/rc/ir-hix5hd2.c                      |   2 +-
 drivers/media/rc/ir_toy.c                          |   1 +
 drivers/media/rc/ite-cir.c                         |   2 +-
 drivers/media/rc/mceusb.c                          |   1 +
 drivers/media/rc/rc-ir-raw.c                       |   5 -
 drivers/media/rc/rc-loopback.c                     |   1 +
 drivers/media/rc/rc-main.c                         |   6 +-
 drivers/media/rc/redrat3.c                         |   4 +-
 drivers/media/rc/st_rc.c                           |   2 +-
 drivers/media/rc/streamzap.c                       |   7 +-
 drivers/media/rc/sunxi-cir.c                       |   1 +
 drivers/media/rc/ttusbir.c                         |   4 +-
 drivers/media/rc/winbond-cir.c                     |   2 +-
 drivers/media/rc/xbox_remote.c                     |   5 +-
 drivers/media/usb/au0828/au0828-input.c            |   1 +
 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c        |   1 +
 drivers/media/usb/dvb-usb/dvb-usb-remote.c         |   6 +-
 drivers/media/usb/em28xx/em28xx-input.c            |   1 +
 drivers/misc/fastrpc.c                             | 107 +++---
 drivers/mmc/core/mmc.c                             |   4 +-
 drivers/mmc/host/litex_mmc.c                       |  20 +-
 drivers/mmc/host/renesas_sdhi_internal_dmac.c      |   1 +
 drivers/mmc/host/sdhci.c                           |   1 +
 drivers/net/bonding/bond_main.c                    |  12 +-
 drivers/net/ethernet/amd/pcnet32.c                 |   4 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   2 +-
 drivers/net/ethernet/freescale/fec_main.c          |   3 +-
 drivers/net/ethernet/intel/ice/ice_virtchnl.c      |   2 +-
 drivers/net/ethernet/marvell/mv643xx_eth.c         |   2 +-
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c    |  75 +++--
 drivers/net/ethernet/marvell/octeontx2/af/cgx.c    |  13 +-
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c    |   2 +-
 drivers/net/ethernet/marvell/octeontx2/af/rvu.h    |   1 +
 .../net/ethernet/marvell/octeontx2/af/rvu_npc.c    |  32 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c |   2 +-
 .../ethernet/marvell/octeontx2/nic/otx2_common.c   |   2 +
 drivers/net/ethernet/mediatek/mtk_eth_soc.c        |   2 +-
 drivers/net/ethernet/mellanox/mlx4/cq.c            |   9 +-
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      |   6 +-
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c  |  13 +-
 drivers/net/ethernet/mellanox/mlx5/core/vport.c    |  72 +++-
 drivers/net/ethernet/microchip/lan743x_main.c      |  32 ++
 drivers/net/ethernet/microchip/lan743x_main.h      |   1 +
 drivers/net/ethernet/microsoft/mana/mana_en.c      |  72 ++--
 drivers/net/ethernet/ti/cpsw_new.c                 |   4 +-
 drivers/net/hyperv/netvsc.c                        |  19 +-
 drivers/net/macsec.c                               |   3 +-
 drivers/net/phy/mscc/mscc.h                        |   8 +-
 drivers/net/phy/mscc/mscc_main.c                   |  23 +-
 drivers/net/phy/phy_device.c                       |   6 +
 drivers/net/tap.c                                  |   2 +
 drivers/net/tun.c                                  |   5 +-
 drivers/net/usb/r8152.c                            |   7 +-
 drivers/net/vxlan/vxlan_core.c                     |   4 +-
 drivers/net/vxlan/vxlan_vnifilter.c                |   5 +-
 drivers/net/wireguard/send.c                       |  20 +-
 drivers/nfc/nxp-nci/i2c.c                          |  21 +-
 drivers/nvmem/layouts/onie-tlv.c                   |   3 +-
 drivers/of/kexec.c                                 |  15 +-
 drivers/parport/share.c                            |  11 +-
 drivers/platform/x86/intel/vsec.c                  |  34 +-
 drivers/ptp/ptp_vclock.c                           |  14 +-
 drivers/scsi/fcoe/fcoe_ctlr.c                      |   2 +-
 drivers/scsi/scsi_lib.c                            |  27 +-
 drivers/scsi/scsi_transport_fc.c                   |  77 +++--
 drivers/slimbus/qcom-ngd-ctrl.c                    |   5 +-
 drivers/soc/qcom/ice.c                             |  36 +-
 drivers/soc/tegra/pmc.c                            | 104 ++++--
 drivers/staging/greybus/hid.c                      |   2 +-
 drivers/staging/media/av7110/av7110_ir.c           |   1 +
 drivers/target/iscsi/iscsi_target.c                |   6 +-
 drivers/target/iscsi/iscsi_target_auth.c           |  19 +-
 drivers/target/iscsi/iscsi_target_nego.c           |   7 +-
 drivers/target/iscsi/iscsi_target_parameters.c     |  62 +++-
 drivers/target/iscsi/iscsi_target_parameters.h     |   2 +-
 drivers/tee/optee/supp.c                           | 107 ++++--
 drivers/thunderbolt/property.c                     |  38 ++-
 drivers/thunderbolt/xdomain.c                      |  14 +-
 drivers/tty/serdev/core.c                          |  23 +-
 drivers/tty/serial/altera_jtaguart.c               |   7 +-
 drivers/tty/serial/dz.c                            | 171 +++++-----
 drivers/tty/serial/fsl_lpuart.c                    |  15 +-
 drivers/tty/serial/pch_uart.c                      |  19 +-
 drivers/tty/serial/qcom_geni_serial.c              |  17 +-
 drivers/tty/serial/samsung_tty.c                   | 129 ++++---
 drivers/tty/serial/sh-sci.c                        |   2 +-
 drivers/tty/serial/zs.c                            | 218 +++++-------
 drivers/tty/serial/zs.h                            |   1 -
 drivers/usb/cdns3/cdns3-gadget.c                   |  12 +-
 drivers/usb/cdns3/cdns3-plat.c                     |  11 +-
 drivers/usb/chipidea/core.c                        |  16 +-
 drivers/usb/class/cdc-acm.c                        |   2 -
 drivers/usb/class/cdc-acm.h                        |   2 +
 drivers/usb/class/usbtmc.c                         |  14 +
 drivers/usb/core/config.c                          |   9 +-
 drivers/usb/core/hcd.c                             |   4 +-
 drivers/usb/core/quirks.c                          |   4 +
 drivers/usb/dwc2/hcd.c                             |   4 +-
 drivers/usb/dwc3/dwc3-xilinx.c                     |  26 +-
 drivers/usb/gadget/composite.c                     |   5 +-
 drivers/usb/gadget/function/f_fs.c                 |   2 +-
 drivers/usb/gadget/function/f_hid.c                |   3 +-
 drivers/usb/gadget/function/f_ncm.c                |  33 +-
 drivers/usb/gadget/function/f_uvc.c                |  26 +-
 drivers/usb/gadget/function/u_ether.c              |  28 +-
 drivers/usb/gadget/function/u_ether.h              |  26 ++
 drivers/usb/gadget/function/u_ncm.h                |   2 +-
 drivers/usb/gadget/udc/dummy_hcd.c                 |   4 +
 drivers/usb/gadget/udc/net2280.c                   |   4 +-
 drivers/usb/host/xhci-tegra.c                      |  77 +++--
 drivers/usb/musb/omap2430.c                        |   3 +-
 drivers/usb/serial/belkin_sa.c                     |   3 +
 drivers/usb/serial/cypress_m8.c                    |  20 +-
 drivers/usb/serial/digi_acceleport.c               |  23 +-
 drivers/usb/serial/io_ti.c                         |  11 +
 drivers/usb/serial/keyspan.c                       |   4 +
 drivers/usb/serial/kl5kusb105.c                    |   4 +-
 drivers/usb/serial/mct_u232.c                      |  26 +-
 drivers/usb/serial/mxuport.c                       |   8 +
 drivers/usb/serial/omninet.c                       |   9 +-
 drivers/usb/serial/option.c                        |  12 +-
 drivers/usb/serial/safe_serial.c                   |  11 +
 drivers/usb/storage/unusual_uas.h                  |   7 +
 drivers/usb/typec/altmodes/displayport.c           |   2 +
 drivers/usb/typec/tcpm/tcpci_maxim_core.c          |   9 +
 drivers/usb/typec/tcpm/wcove.c                     |  13 +-
 drivers/usb/typec/ucsi/displayport.c               |   4 +
 drivers/usb/typec/ucsi/ucsi.c                      |  24 +-
 drivers/usb/typec/ucsi/ucsi_ccg.c                  |   5 +
 drivers/usb/usbip/vudc_dev.c                       |   1 +
 drivers/usb/usbip/vudc_transfer.c                  |   3 +-
 drivers/video/fbdev/Kconfig                        |   1 +
 drivers/video/fbdev/core/fbcon.c                   |   9 +
 drivers/video/fbdev/vt8500lcdfb.c                  |   4 +-
 fs/fcntl.c                                         |   8 +-
 fs/fuse/dev.c                                      |   9 +-
 fs/hpfs/alloc.c                                    |   2 +-
 fs/iomap/buffered-io.c                             |   4 -
 fs/smb/client/netlink.c                            |   6 +-
 fs/smb/server/oplock.c                             |  15 +-
 fs/smb/server/smb2pdu.c                            | 143 ++++++--
 fs/smb/server/smbacl.c                             |  51 ++-
 fs/smb/server/smbacl.h                             |   2 +
 include/drm/display/drm_dp.h                       |   1 +
 include/drm/drm_fourcc.h                           |   5 +-
 include/linux/bpf_verifier.h                       |   4 +
 include/linux/compat.h                             |   4 +
 include/linux/compiler-clang.h                     |   6 +
 include/linux/compiler_attributes.h                |  11 +
 include/linux/compiler_types.h                     |   4 +
 include/linux/hid.h                                |  15 +-
 include/linux/hid_bpf.h                            |   4 +-
 include/linux/hugetlb.h                            |  16 +-
 include/linux/ima.h                                |   1 +
 include/linux/mlx5/vport.h                         |   4 +-
 include/linux/mm.h                                 |   8 -
 include/linux/parport.h                            |   1 +
 include/linux/serdev.h                             |   1 +
 include/linux/syscalls.h                           |   4 +
 include/media/rc-core.h                            |   2 -
 include/net/act_api.h                              |   1 +
 include/net/bluetooth/l2cap.h                      |   1 +
 include/net/genetlink.h                            |   9 +-
 include/net/inet_frag.h                            |  18 +-
 include/net/ip_vs.h                                |   3 +-
 include/net/ipv6_frag.h                            |   9 +-
 include/net/netfilter/nf_conntrack_core.h          |   5 +
 include/net/netfilter/nf_conntrack_helper.h        |   1 +
 include/net/netfilter/nf_tables.h                  |   7 +
 include/net/sock.h                                 |   1 +
 include/net/xfrm.h                                 |   3 +-
 include/rdma/ib_umem.h                             |  44 +--
 include/rdma/ib_verbs.h                            |  48 ---
 include/rdma/iter.h                                |  88 +++++
 include/uapi/linux/netfilter/nf_tables.h           |  18 +-
 ipc/shm.c                                          |  10 +-
 ipc/util.c                                         |   2 +-
 kernel/bpf/verifier.c                              | 369 +++++++++++++--------
 kernel/cgroup/cpuset.c                             |   8 +-
 kernel/events/core.c                               |  16 +-
 kernel/pid.c                                       |   8 +-
 kernel/signal.c                                    |   1 +
 kernel/time/time.c                                 |   2 +-
 kernel/trace/trace_probe.c                         |   2 -
 lib/debugobjects.c                                 |   2 +-
 mm/damon/ops-common.c                              |   4 +-
 mm/damon/sysfs-schemes.c                           |   8 +-
 mm/gup.c                                           |   2 +-
 mm/huge_memory.c                                   |   2 +
 mm/hugetlb.c                                       | 118 ++++---
 mm/memfd.c                                         |  12 +-
 mm/memory-failure.c                                |  94 +++---
 mm/memory.c                                        |   2 +-
 mm/memory_hotplug.c                                |   2 +-
 mm/mempolicy.c                                     |   2 +-
 mm/migrate.c                                       |  18 +-
 mm/page_alloc.c                                    |   1 +
 net/6lowpan/iphc.c                                 |   4 +-
 net/802/garp.c                                     |   2 +-
 net/802/mrp.c                                      |   9 +
 net/batman-adv/bat_iv_ogm.c                        |  82 ++++-
 net/batman-adv/bat_v_ogm.c                         |  59 ++--
 net/batman-adv/bridge_loop_avoidance.c             |  57 +++-
 net/batman-adv/soft-interface.c                    |   1 +
 net/batman-adv/tp_meter.c                          |  67 ++--
 net/batman-adv/translation-table.c                 |  43 ++-
 net/batman-adv/tvlv.c                              |  28 +-
 net/batman-adv/tvlv.h                              |   2 +-
 net/batman-adv/types.h                             |  42 ++-
 net/bluetooth/6lowpan.c                            |   2 +
 net/bluetooth/bnep/core.c                          |  50 ++-
 net/bluetooth/hci_conn.c                           |   8 +-
 net/bluetooth/hci_sync.c                           |   9 +-
 net/bluetooth/hci_sysfs.c                          |   6 +-
 net/bluetooth/hidp/core.c                          |  23 +-
 net/bluetooth/iso.c                                |  12 +-
 net/bluetooth/l2cap_core.c                         |  87 ++++-
 net/bluetooth/l2cap_sock.c                         |  16 +-
 net/bluetooth/mgmt.c                               |  17 +-
 net/bluetooth/rfcomm/core.c                        |  69 ++--
 net/bluetooth/rfcomm/sock.c                        |  26 +-
 net/bridge/netfilter/ebt_snat.c                    |   3 +
 net/bridge/netfilter/ebtables.c                    |  30 ++
 net/core/drop_monitor.c                            |   2 +-
 net/core/filter.c                                  |  17 +-
 net/core/skbuff.c                                  |  20 +-
 net/core/sock.c                                    |  13 +-
 net/ethtool/eeprom.c                               |  10 +-
 net/hsr/hsr_forward.c                              |   4 +-
 net/hsr/hsr_framereg.c                             |  10 +-
 net/ieee802154/6lowpan/tx.c                        |   5 +
 net/ipv4/ah4.c                                     |   2 +-
 net/ipv4/esp4.c                                    |   4 +-
 net/ipv4/inet_fragment.c                           |  54 ++-
 net/ipv4/ip_fragment.c                             |  21 +-
 net/ipv4/ip_options.c                              |   4 +
 net/ipv4/ip_tunnel_core.c                          |  22 +-
 net/ipv4/netfilter/arp_tables.c                    |  15 +-
 net/ipv4/netfilter/ip_tables.c                     |  15 +-
 net/ipv4/netfilter/nf_nat_h323.c                   |   2 +
 net/ipv4/netfilter/nft_fib_ipv4.c                  |   2 +-
 net/ipv4/sysctl_net_ipv4.c                         |   2 +-
 net/ipv4/udp.c                                     |   8 +
 net/ipv6/addrconf.c                                |  53 +--
 net/ipv6/ah6.c                                     |   2 +-
 net/ipv6/datagram.c                                |  54 ++-
 net/ipv6/esp6.c                                    |   4 +-
 net/ipv6/exthdrs.c                                 |  35 +-
 net/ipv6/ioam6.c                                   |   8 +-
 net/ipv6/ip6_input.c                               |   2 +-
 net/ipv6/ip6_vti.c                                 |  25 +-
 net/ipv6/mcast.c                                   |  22 +-
 net/ipv6/ndisc.c                                   |  18 +-
 net/ipv6/netfilter/ip6_tables.c                    |  15 +-
 net/ipv6/netfilter/nft_fib_ipv6.c                  |   2 +-
 net/ipv6/route.c                                   |   5 +
 net/ipv6/seg6_hmac.c                               |   8 +-
 net/ipv6/sit.c                                     |   1 +
 net/iucv/af_iucv.c                                 |  20 +-
 net/key/af_key.c                                   |  58 ++--
 net/mctp/device.c                                  |   1 +
 net/mctp/neigh.c                                   |   1 +
 net/mctp/route.c                                   |   1 +
 net/mptcp/options.c                                |  73 ++--
 net/mptcp/pm.c                                     |  49 ++-
 net/mptcp/pm_netlink.c                             |  18 +-
 net/mptcp/protocol.c                               | 102 ++++--
 net/mptcp/protocol.h                               |  17 +-
 net/mptcp/sockopt.c                                |   8 +-
 net/mptcp/subflow.c                                |  20 +-
 net/netfilter/ipvs/ip_vs_ctl.c                     |  13 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |  18 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  21 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c               |  20 +-
 net/netfilter/ipvs/ip_vs_sched.c                   |  14 +-
 net/netfilter/nf_conntrack_ecache.c                |   2 +
 net/netfilter/nf_conntrack_expect.c                |  10 +-
 net/netfilter/nf_conntrack_helper.c                |  19 ++
 net/netfilter/nf_conntrack_irc.c                   |   4 +-
 net/netfilter/nf_conntrack_netlink.c               |  28 +-
 net/netfilter/nf_conntrack_proto_tcp.c             |   3 +-
 net/netfilter/nf_log_syslog.c                      |   4 +-
 net/netfilter/nf_nat_core.c                        |   2 +
 net/netfilter/nf_nat_sip.c                         |   1 +
 net/netfilter/nf_synproxy_core.c                   |  26 +-
 net/netfilter/nft_bitwise.c                        | 184 ++++++++--
 net/netfilter/nft_byteorder.c                      |  13 +-
 net/netfilter/nft_ct.c                             |   8 +-
 net/netfilter/nft_ct_fast.c                        |   2 +-
 net/netfilter/nft_exthdr.c                         |   3 +
 net/netfilter/nft_fib.c                            |   6 +
 net/netfilter/nft_tunnel.c                         |   2 +-
 net/netfilter/xt_NFQUEUE.c                         |   2 +-
 net/netfilter/xt_cpu.c                             |   2 +-
 net/netlabel/netlabel_unlabeled.c                  |  30 +-
 net/netlink/af_netlink.c                           |  11 +-
 net/netlink/genetlink.c                            |   4 +-
 net/nfc/hci/core.c                                 |  10 +
 net/nfc/llcp_core.c                                |  11 +
 net/nfc/llcp_sock.c                                |   2 +
 net/nfc/nci/hci.c                                  |  10 +
 net/openvswitch/datapath.c                         |   1 +
 net/psample/psample.c                              |   2 +-
 net/qrtr/af_qrtr.c                                 |   4 +-
 net/rds/ib_cm.c                                    |   1 +
 net/rds/ib_send.c                                  |   2 +
 net/rds/info.c                                     |   2 +-
 net/rxrpc/ar-internal.h                            |  12 +-
 net/rxrpc/call_event.c                             |  27 +-
 net/rxrpc/call_object.c                            |   2 +
 net/rxrpc/conn_event.c                             |  30 +-
 net/rxrpc/insecure.c                               |   8 +-
 net/rxrpc/recvmsg.c                                |  68 +++-
 net/rxrpc/rxkad.c                                  | 115 +++----
 net/sched/act_api.c                                |   7 +-
 net/sched/cls_fw.c                                 |   6 +-
 net/sched/sch_netem.c                              |  40 ---
 net/sched/sch_sfb.c                                |   2 +-
 net/sctp/diag.c                                    |  17 +-
 net/sctp/input.c                                   |   8 +
 net/sctp/sm_statefuns.c                            |   6 +-
 net/sctp/socket.c                                  |   2 +
 net/sctp/stream.c                                  |   6 +-
 net/smc/af_smc.c                                   |  21 +-
 net/socket.c                                       |  11 +-
 net/unix/af_unix.c                                 |  38 +--
 net/vmw_vsock/af_vsock.c                           |  49 ++-
 net/vmw_vsock/hyperv_transport.c                   |   9 +-
 net/vmw_vsock/virtio_transport_common.c            |  14 +-
 net/vmw_vsock/vmci_transport.c                     |  12 +-
 net/wireless/nl80211.c                             |   3 +
 net/xfrm/espintcp.c                                |   4 +
 net/xfrm/xfrm_input.c                              |  16 +-
 net/xfrm/xfrm_policy.c                             |  15 +-
 net/xfrm/xfrm_state.c                              |  23 +-
 net/xfrm/xfrm_user.c                               |   5 +-
 security/integrity/ima/ima_kexec.c                 |  35 ++
 security/landlock/errata/abi-1.h                   |  16 +
 security/landlock/fs.c                             |  40 ++-
 sound/core/pcm_native.c                            |   7 +-
 sound/core/timer.c                                 |   1 +
 .../motu/motu-register-dsp-message-parser.c        |  14 +-
 sound/pci/hda/patch_hdmi.c                         |   1 +
 sound/soc/codecs/simple-mux.c                      |   2 +-
 sound/soc/codecs/wm_adsp.c                         |   3 +
 sound/soc/fsl/fsl_sai.c                            |   2 +-
 sound/soc/intel/boards/bytcht_es8316.c             |  29 +-
 sound/soc/qcom/qdsp6/q6asm-dai.c                   |  43 +--
 .../selftests/bpf/progs/verifier_scalar_ids.c      | 333 ++++++++++++-------
 .../selftests/bpf/progs/verifier_spill_fill.c      |   4 +-
 .../bpf/progs/verifier_subprog_precision.c         |   2 +-
 tools/testing/selftests/bpf/verifier/precise.c     |   2 +-
 .../test.d/dynevent/eprobes_syntax_errors.tc       |   2 +-
 tools/testing/selftests/mm/hmm-tests.c             |  50 +++
 tools/testing/selftests/net/mptcp/mptcp_connect.sh |   6 +-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    |   4 +
 tools/testing/selftests/ptp/testptp.c              |  62 +---
 tools/verification/rv/src/in_kernel.c              |   2 +-
 virt/kvm/kvm_main.c                                |   3 +-
 508 files changed, 5864 insertions(+), 3002 deletions(-)