Changelog in Linux kernel 6.1.175

Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race

Documentation: fix a hugetlbfs reservation statement

dpaa2: add independent dependencies for FSL_DPAA2_SWITCH

dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n

drbd: Balance RCU calls in drbd_adm_dump_devices()

driver core: Add kernel-doc for DEV_FLAG_COUNT enum value

driver core: device.h: remove extern from function prototypes

driver core: Don't let a device probe until it's ready

driver core: Move dev_err_probe() to where it belogs

drivers/spi-rockchip.c : Remove redundant variable slave

drm/amd/display: Allow DCE link encoder without AUX registers

drm/amd/display: Do not skip unrelated mode changes in DSC validation

drm/amd/display: Fix integer overflow in bios_get_image()

drm/amd/display: Read EDID from VBIOS embedded panel info

drm/amd/display: Validate GPIO pin LUT table size before iterating

drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

drm/amd/pm/ci: Clear EnabledForActivity field for memory levels

drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs

drm/amd/pm/ci: Fill DW8 fields from SMC

drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0

drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled

drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board

drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock

drm/amdgpu/gfx10: look at the right prop for gfx queue priority

drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)

drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ

drm/amdgpu/pm: add missing revision check for CI

drm/amdgpu/pm: align Hawaii mclk workaround with radeon

drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission

drm/amdgpu/uvd3.1: Don't validate the firmware when already validated

drm/amdgpu/vce: Prevent partial address patches

drm/amdgpu/vcn3: Avoid overflow on msg bound check

drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg

drm/amdgpu/vcn4: Avoid overflow on msg bound check

drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg

drm/amdgpu: Add bounds checking to ib_{get,set}_value

drm/amdgpu: Add default case in DVI mode validation

drm/amdgpu: fix spelling typos

drm/amdgpu: fix zero-size GDS range init on RDNA4

drm/amdgpu: Limit BO list entry count to prevent resource exhaustion

drm/amdgpu: remove two invalid BUG_ON()s

drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array

drm/amdgpu: zero-initialize GART table on allocation

drm/amdkfd: validate SVM ioctl nattr against buffer size

drm/arcpgu: fix device node leak

drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe

drm/bridge: it66121: acquire reset GPIO in probe

drm/bridge: megachips: remove bridge when irq request fails

drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup

drm/gma500/oaktrail_lvds: fix hang on init failure

drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init

drm/i915/dp: Fix VSC dynamic range signaling for RGB formats

drm/i915/psr: Do not use pipe_src as borders for SU area

drm/i915/wm: Verify the correct plane DDB entry

drm/i915: Constify watermark state checker

drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update()

drm/i915: Loop over all active pipes in intel_mbus_dbox_update

drm/i915: skip __i915_request_skip() for already signaled requests

drm/komeda: fix integer overflow in AFBC framebuffer size check

drm/msm/a6xx: Fix HLSQ register dumping

drm/msm/a6xx: Use barriers while updating HFI Q headers

drm/msm/dpu: fix mismatch between power and frequency

drm/msm/dsi: don't dump registers past the mapped region

drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0

drm/msm/shrinker: Fix can_block() logic

drm/msm/snapshot: fix dumping of the unaligned regions

drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN

drm/nouveau: fix u32 overflow in pushbuf reloc bounds check

drm/panel: simple: Correct G190EAN01 prepare timing

drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()

drm/radeon: add missing revision check for CI

drm/sun4i: backend: fix error pointer dereference

drm/sun4i: Fix resource leaks

drm/vc4: Fix a memory leak in hang state error path

drm/vc4: Fix memory leak of BO array in hang state

drm/vc4: platform_get_irq_byname() returns an int

drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock

drm/vc4: Release runtime PM reference after binding V3D

drm/virtio: use uninterruptible resv lock for plane updates

dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets

dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs

dt-bindings: net: Fix Tegra234 MGBE PTP clock

e1000: check return value of e1000_read_eeprom

e1000e: Unroll PTP in probe error handling

efi/capsule-loader: fix incorrect sizeof in phys array reallocation

epoll: use refcount to reduce ep_mutex contention

erofs: fix the out-of-bounds nameoff handling for trailing dirents

ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics

eventpoll: defer struct eventpoll free to RCU grace period

exit: prevent preemption of oopsing TASK_DEAD task

exit: Sleep at TASK_IDLE when waiting for application core dump

ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()

ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()

ext4: validate p_idx bounds in ext4_ext_correct_indexes

extcon: ptn5150: handle pending IRQ events during system resume

extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'

f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()

f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi

f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic

f2fs: fix fiemap boundary handling when read extent cache is incomplete

f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()

f2fs: fix null-ptr-deref in f2fs_submit_page_bio()

f2fs: fix to detect potential corrupted nid in free_nid_list

f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()

f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()

f2fs: Use sysfs_emit_at() to simplify code

fanotify: fix false positive on permission events

fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break

fbdev: offb: fix PCI device reference leak on probe failure

fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free

fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

firmware: arm_ffa: Check for NULL FF-A ID table while driver registration

firmware: arm_ffa: Skip free_pages on RX buffer alloc failure

firmware: dmi: Correct an indexing error in dmi.h

firmware: google: framebuffer: Do not mark framebuffer as busy

flow_dissector: do not dissect PPPoE PFC frames

fs/adfs: validate nzones in adfs_validate_bblk()

fs/ntfs3: terminate the cached volume label after UTF-8 conversion

fs/ntfs3: validate rec->used in journal-replay file record check

fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START

fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

fuse: quiet down complaints in fuse_conn_limit_write

fuse: reject oversized dirents in page cache

futex: Prevent lockup in requeue-PI during signal/ timeout wakeup

gfs2: add some missing log locking

gfs2: Call unlock_new_inode before d_instantiate

gfs2: Improve gfs2_consist_inode() usage

gfs2: prevent NULL pointer dereference during unmount

gfs2: Validate i_depth for exhash directories

gpio: cdev: check if uAPI v2 config attributes are correctly zeroed

gpio: tegra: fix irq_release_resources calling enable instead of disable

gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)

HID: alps: fix NULL pointer dereference in alps_raw_event()

HID: asus: do not abort probe when not necessary

HID: asus: make asus_resume adhere to linux kernel coding standards

HID: core: clamp report_size in s32ton() to avoid undefined shift

HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3

HID: quirks: really enable the intended work around for appledisplay

HID: roccat: fix use-after-free in roccat_report_event

HID: uclogic: Fix regression of input name assignment

HID: usbhid: fix deadlock in hid_post_reset()

hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()

hrtimer: Reduce trace noise in hrtimer_start()

hrtimers: Update the return type of enqueue_hrtimer()

hv_sock: fix ARM64 support

hwmon: (corsair-psu) Close HID device on probe errors

hwmon: (ltc2992) Clamp threshold writes to hardware range

hwmon: (ltc2992) Fix u32 overflow in power read path

hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer

hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR

hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple

hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer

hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()

hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()

hwmon: (pmbus/adm1266) reject implausible blackbox record_count

hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors

hwmon: (pmbus/adm1266) seed timestamp from the real-time clock

hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX

i2c: s3c24xx: check the size of the SMBUS message before using it

i3c: mipi-i3c-hci: fix IBI payload length calculation for final status

i40e: Cleanup PTP pins on probe failure

i40e: don't advertise IFF_SUPP_NOFCS

iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler

iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING

iavf: stop removing VLAN filters from PF on interface down

iavf: wait for PF confirmation before removing VLAN filters

IB/core: Fix zero dmac race in neighbor resolution

ibmasm: fix heap over-read in ibmasm_send_i2o_message()

ibmasm: fix OOB reads in command_file_write due to missing size checks

ibmveth: Disable GSO for packets with small MSS

ice: fix locking in ice_dcb_rebuild()

ice: Fix memory leak in ice_set_ringparam()

ice: fix NULL pointer dereference in ice_reset_all_vfs()

ice: fix setting promisc mode while adding VID filter

ice: Pull common tasks into ice_vf_post_vsi_rebuild

iio: adc: ad7768-1: fix one-shot mode data acquisition

iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()

ima: check return value of crypto_shash_final() in boot aggregate

inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails

io-wq: check that the predecessor is hashed in io_wq_remove_pending()

io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE

io_uring/poll: fix multishot recv missing EOF on wakeup race

io_uring/poll: fix signed comparison in io_poll_get_ownership()

io_uring/timeout: check unused sqe fields

io_uring: prevent opcode speculation

iommu/vt-d: Disable DMAR for Intel Q35 IGFX

ip6_gre: Use cached t->net in ip6erspan_changelink().

ipmi: Add limits to event and receive message requests

ipmi: Check event message buffer response for bad data

Linux: ipmi:si: Return state to normal if message allocation fails

ipv4: add new arguments to udp_tunnel_dst_lookup()

ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

ipv4: icmp: validate reply type before using icmp_pointers

ipv4: raw: reject IP_HDRINCL packets with ihl < 5

ipv4: remove "proto" argument from udp_tunnel_dst_lookup()

ipv4: rename and move ip_route_output_tunnel()

ipv6: add NULL checks for idev in SRv6 paths

ipv6: fix possible UAF in icmpv6_rcv()

ipv6: rename and move ip6_dst_lookup_tunnel()

ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()

ipvs: fix MTU check for GSO packets in tunnel mode

irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT

irqchip/ath79-cpu: Remove unused function

irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter

isofs: validate block number from NFS file handle in isofs_export_iget

isofs: validate Rock Ridge CE continuation extent against volume size

ixgbevf: add missing negotiate_features op to Hyper-V ops table

ixgbevf: fix use-after-free in VEPA multicast source pruning

kernel: globalize lookup_or_create_module_kobject()

kernel: param: rename locate_module_kobject

ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()

ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment

ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine

ksmbd: require 3 sub-authorities before reading sub_auth[2]

ksmbd: scope conn->binding slowpath to bound sessions only

ksmbd: use check_add_overflow() to prevent u16 DACL size overflow

ksmbd: validate EaNameLength in smb2_get_ea()

ktest: Avoid undef warning when WARNINGS_FILE is unset

ktest: Fix the month in the name of the failure directory

ktest: Honor empty per-test option overrides

ktest: Run POST_KTEST hooks on failure and cancellation

kunit: config: Enable KUNIT_DEBUGFS by default

kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS

KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value

KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS

KVM: nSVM: Add missing consistency check for nCR3 validity

KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN

KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)

KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT

KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode

KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state

KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2

KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2

KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT

KVM: Reject wrapped offset in kvm_reset_dirty_gfn()

KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION

KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts

KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0

KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

KVM: x86: Fix Xen hypercall tracepoint argument assignment

KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs

KVM: x86: Use scratch field in MMIO fragment to hold small write values

l2tp: Drop large packets with UDP encap

leds: lgm-sso: Remove duplicate assignments for priv->mmap

lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()

lib/ts_kmp: fix integer overflow in pattern length calculation

libceph: Fix potential null-ptr-deref in decode_choose_args()

libceph: Fix potential out-of-bounds access in crush_decode()

libceph: Fix potential out-of-bounds access in osdmap_decode()

libceph: Fix slab-out-of-bounds access in auth message processing

libceph: handle rbtree insertion error in decode_choose_args()

libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()

Linux: Linux 6.1.175

locking: Fix rwlock support in

LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()

LoongArch: Remove unused code to avoid build warning

LoongArch: Show CPU vulnerabilites correctly

LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup

macvlan: annotate data-races around port->bc_queue_len_used

mailbox: add sanity check for channel array

mailbox: mailbox-test: don't free the reused channel

mailbox: mailbox-test: free channels on probe error

mailbox: mailbox-test: initialize struct earlier

mailbox: mailbox-test: make data_ready a per-instance variable

md/raid10: fix deadlock with check operation and nowait requests

md/raid10: fix divide-by-zero in setup_geo() with zero far_copies

md/raid5: fix soft lockup in retry_aligned_read()

md/raid5: validate payload size before accessing journal metadata

media: amphion: Fix race between m2m job_abort and device_run

media: as102: fix to not free memory after the device is registered in as102_usb_probe()

media: dib8000: avoid division by 0 in dib8000_set_dds()

media: em28xx: fix use-after-free in em28xx_v4l2_open()

media: hackrf: fix to not free memory after the device is registered in hackrf_probe()

media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe()

media: i2c: imx412: Assert reset GPIO during probe

media: i2c: ov08d10: fix image vertical start setting

media: i2c: ov8856: free control handler on error in ov8856_init_controls()

media: omap3isp: drop the use count of v4l2 pipeline

media: pci: zoran: fix potential memory leak in zoran_probe()

media: rc: streamzap: Error handling in probe

media: rc: xbox_remote: heed DMA restrictions

media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl()

media: saa7164: add ioremap return checks and cleanups

media: uvcvideo: Enable VB2_DMABUF for metadata stream

media: vidtv: fix nfeeds state corruption on start_streaming failure

media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections

media: vidtv: fix pass-by-value structs causing MSAN warnings

memory: tegra124-emc: Fix dll_change check

memory: tegra30-emc: Fix dll_change check

mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()

misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()

mm/kasan: fix double free for kasan pXds

mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()

mmc: block: use single block write in retry

mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration

module: Fix freeing of charp module parameters when CONFIG_SYSFS=n

mptcp: fix scheduling with atomic in timestamp sockopt

mptcp: sockopt: set timestamp flags on subflow socket, not msk

mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure

mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure

mtd: docg3: Convert to platform remove callback returning void

mtd: docg3: fix use-after-free in docg3_release()

mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions

mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path

mtd: physmap_of_gemini: Fix disabled pinctrl state check

mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob

mtd: spi-nor: Allow post_sfdp hook to return errors

mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations

mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook

mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook

mtd: spi-nor: spansion: Add support for Infineon S25FS256T

mtd: spi-nor: spansion: Enable JFFS2 write buffer for S25FS256T

mtd: spi-nor: spansion: Make RD_ANY_REG_OP macro take number of dummy bytes

mtd: spi-nor: spansion: Rename s28hs512t prefix

mtd: spi-nor: spansion: Replace hardcoded values for addr_nbytes/addr_mode_nbytes

mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()`

mtd: spi-nor: sst: Fix SST write failure

mtd: spi-nor: sst: Fix write enable before AAI sequence

mtd: spi-nor: swp: check SR_TB flag when getting tb_mask

mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation

neigh: let neigh_xmit take skb ownership

neighbour: add RCU protection to neigh_tables[]

net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master

net/rds: handle zerocopy send cleanup before the message is queued

net/rds: Optimize rds_ib_laddr_check

net/rds: reset op_nents when zerocopy page pin fails

net/rds: Restrict use of RDS/IB to the initial network namespace

net/rds: zero per-item info buffer before handing it to visitors

net/sched: act_ct: Only release RCU read lock after ct_ft

net/sched: cls_flower: revert unintended changes

net/sched: netem: fix probability gaps in 4-state loss model

net/sched: netem: fix queue limit check to include reordered packets

net/sched: netem: fix slot delay calculation overflow

net/sched: netem: validate slot configuration

net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)

net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys

net/sched: sch_choke: annotate data-races in choke_dump_stats()

net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()

net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()

net/sched: sch_pie: annotate data-races in pie_dump_stats()

net/sched: sch_pie: annotate more data-races in pie_dump_stats()

net/sched: sch_red: annotate data-races in red_dump_stats()

net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked

net/sched: sch_sfb: annotate data-races in sfb_dump_stats()

net/sched: taprio: continue with other TXQs if one dequeue() failed

net/sched: taprio: fix use-after-free in advance_sched() on schedule switch

net/sched: taprio: refactor one skb dequeue from TXQ to separate function

net/sched: taprio: rename close_time to end_time

net/smc: avoid early lgr access in smc_clc_wait_msg

net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint

net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

net: add proper RCU protection to /proc/net/ptype

net: ag71xx: check error for platform_get_irq

net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled

net: bcmgenet: add bcmgenet_has_* helpers

net: bcmgenet: fix leaking free_bds

net: bcmgenet: fix off-by-one in bcmgenet_put_txcb

net: bcmgenet: fix racing timeout handler

net: bcmgenet: Initialize u64 stats seq counter

net: bcmgenet: keep RBUF EEE/PM disabled

net: bcmgenet: move DESC_INDEX flow to ring 0

net: bcmgenet: Remove custom ndo_poll_controller()

net: bcmgenet: Remove TX ring full logging

net: bcmgenet: support reclaiming unsent Tx packets

net: bcmgenet: switch to use 64bit statistics

net: bonding: add broadcast_neighbor option for 802.3ad

net: bonding: update the slave array for broadcast mode

net: bridge: Flush multicast groups when snooping is disabled

net: caif: clear client service pointer on teardown

net: dsa: clean up FDB, MDB, VLAN entries on unbind

net: dsa: mt7530: fix FDB entries not aging out with short timeout

net: dsa: mt7530: preserve VLAN tags on trapped link-local frames

net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw

net: dsa: mt7530: sync driver-specific behavior of MT7531 variants

net: dsa: realtek: rtl8365mb: fix mode mask calculation

net: enetc: fix the deadlock of enetc_mdio_lock

net: ethernet: cortina: Carry over frag counter

net: ethernet: cortina: Drop half-assembled SKB

net: ethernet: cortina: Make RX SKB per-port

net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference

net: Fix icmp host relookup triggering ip_rt_bug

net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf

net: ifb: report ethtool stats over num_tx_queues

net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

net: ks8851: Avoid excess softirq scheduling

net: ks8851: Reinstate disabling of BHs around IRQ handler

net: lan966x: avoid unregistering netdev on register failure

net: lapbether: handle NETDEV_PRE_TYPE_CHANGE

net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

net: mana: validate rx_req_idx to prevent out-of-bounds array access

net: mctp i2c: check length before marking flow active

net: netconsole: move newline trimming to function

net: phy: dp83869: fix setting CLK_O_SEL field.

net: qrtr: ns: Fix use-after-free in driver remove()

net: rds: fix MR cleanup on copy error

net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo

net: sched: act_csum: validate nested VLAN headers

net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()

net: strparser: fix skb_head leak in strp_abort_strp()

net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring

net: tls: fix strparser anchor skb leak on offload RX setup failure

net: tls: prevent chain-after-chain in plain text SG

net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()

net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()

net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit

net: wwan: iosm: fix potential memory leaks in ipc_imem_init()

net_sched: sch_hhf: annotate data-races in hhf_dump_stats()

netconsole: avoid out-of-bounds access on empty string in trim_newline()

netconsole: propagate device name truncation in dev_name_store()

netdevsim: zero initialize struct iphdr in dummy sk_buff

netfilter: arp_tables: fix IEEE1394 ARP payload parsing

netfilter: conntrack: add missing netlink policy validations

netfilter: conntrack: remove sprintf usage

netfilter: ip6t_eui64: reject invalid MAC header for all packets

netfilter: ip6t_hbh: reject oversized option lists

netfilter: ipset: stop hash:* range iteration at end

netfilter: nf_conntrack_sip: don't use simple_strtoul

netfilter: nf_conntrack_sip: get helper before allocating expectation

netfilter: nf_queue: hold bridge skb->dev while queued

netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator

netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

netfilter: nft_ct: fix missing expect put in obj eval

netfilter: nft_fwd_netdev: check ttl/hl before forwarding

netfilter: nft_osf: restrict it to ipv4

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

netfilter: reject zero shift in nft_bitwise

netfilter: skip recording stale or retransmitted INIT

netfilter: x_tables: unregister the templates first

netfilter: xt_multiport: validate range encoding in checkentry

netfilter: xt_policy: fix strict mode inbound policy matching

netfilter: xt_socket: enable defrag after all other checks

netfilter: xtables: restrict several matches to inet family

nexthop: fix IPv6 route referencing IPv4 nexthop

nf_tables: nft_dynset: fix possible stateful expression memleak in error path

NFC: digital: Bounds check NFC-A cascade depth in SDD response handler

nfc: llcp: add missing return after LLCP_CLOSED checks

nfc: s3fwrn5: allocate rx skb before consuming bytes

NFC: trf7970a: Ignore antenna noise when checking for RF field

nfp: fix swapped arguments in nfp_encode_basic_qdr() calls

nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()

nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map

nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()

ntfs3: add buffer boundary checks to run_unpack()

ntfs3: fix integer overflow in run_unpack() volume boundary check

nvme-apple: drop invalid put of admin queue reference count

nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4

nvme-pci: fix missed admin queue sq doorbell write

nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set

nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free

ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison

ocfs2/dlm: validate qr_numregions in dlm_match_regions()

ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()

ocfs2: fix listxattr handling when the buffer is full

ocfs2: fix out-of-bounds write in ocfs2_write_end_inline

ocfs2: fix possible deadlock between unlink and dio_end_io_write

ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY

ocfs2: handle invalid dinode in ocfs2_group_extend

ocfs2: split transactions in dio completion to avoid credit exhaustion

ocfs2: validate bg_bits during freefrag scan

ocfs2: validate group add input before caching

ocfs2: validate inline data i_size during inode read

openvswitch: cap upcall PID array size and pre-size vport replies

openvswitch: vport: fix self-deadlock on release of tunnel ports

padata: Fix pd UAF once and for all

padata: Put CPU offline callback in ONLINE section to allow failure

padata: Remove comment for reorder_work

padata: Remove cpu online check from cpu add and removal

params: Replace __modinit with __init_or_module

parisc: _llseek syscall is only available for 32-bit userspace

parisc: Fix IRQ leak in LASI driver

PCI/AER: Clear only error bits in PCIe Device Status

PCI/AER: Stop ruling out unbound devices as error source

PCI: Add PCIE_PME_TO_L2_TIMEOUT_US L2 ready timeout value

PCI: Enable AtomicOps only if Root Port supports them

PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown

PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown

PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup

PCI: hv: Set default NUMA node to 0 for devices without affinity info

PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found

PCI: tegra194: Allow system suspend when the Endpoint link is not up

PCI: tegra194: Disable direct speed change for Endpoint mode

PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down

PCI: tegra194: Disable PERST# IRQ only in Endpoint mode

PCI: tegra194: Don't force the device into the D0 state before L2

PCI: tegra194: Fix polling delay for L2 state

PCI: tegra194: Increase LTSSM poll time on surprise link down

PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0()

PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"

PCMCIA: Fix garbled log messages for KERN_CONT

perf branch: Avoid incrementing NULL

perf expr: Return -EINVAL for syntax error in expr__find_ids()

perf util: Kill die() prototype, dead for a long time

perf/x86/intel/uncore: Skip discovery table for offline dies

perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace

phonet/pep: disable BH around forwarded sk_receive_skb()

phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access

pinctrl: abx500: Fix type of 'argument' variable

pinctrl: cy8c95x0: Avoid returning positive values to user space

pinctrl: cy8c95x0: remove duplicate error message

pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()

pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer)

pinctrl: pinctrl-pic32: Fix resource leak

pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150

platform/surface: surfacepro3_button: Drop wakeup source on remove

platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL

platform/x86: dell-wmi-sysman: bound enumeration string aggregation

platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()

platform/x86: hp-wmi: Ignore backlight and FnLock events

platform/x86: hp_accel: Check ACPI_COMPANION() against NULL

platform/x86: intel-hid: Check ACPI_HANDLE() against NULL

platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL

platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup

pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()

pmdomain: ti: omap_prm: Fix a reference leak on device node

power: supply: axp288_charger: Do not cancel work before initializing it

power: supply: max17042: avoid overflow when determining health

powerpc/crash: fix backup region offset update to elfcorehdr

powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o

powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()

powerpc/warp: Fix error handling in pika_dtm_thread

ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

pppoe: drop PFC frames

pstore/ram: fix resource leak when ioremap() fails

pwm: imx-tpm: Count the number of enabled channels in probe

qed: fix double free in qed_cxt_tables_alloc()

quota: Fix race of dquot_scan_active() with quota deactivation

r8152: fix incorrect register write to USB_UPHY_XTAL

randomize_kstack: Maintain kstack_offset per task

rbd: fix null-ptr-deref when device_add_disk() fails

RDMA/core: Prefer NLA_NUL_STRING

RDMA/hns: Fix unlocked call to hns_roce_qp_remove()

RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()

RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()

RDMA/rtrs: Fix use-after-free in path file creation cleanup

RDMA/rxe: Reject unknown opcodes before ICRC processing

RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

RDMA/siw: Reject MPA FPDU length underflow before signed receive math

RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

regset: use kvzalloc() for regset_get_alloc()

regulator: act8945a: fix OF node reference imbalance

regulator: bd9571mwv: fix OF node reference imbalance

regulator: max77650: fix OF node reference imbalance

Revert "ALSA: usb: Increase volume range that triggers a warning"

Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"

Revert "dmaengine: idxd: Fix not releasing workqueue on .release()"

Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"

Revert "net: ethernet: xscale: Check for PTP support properly"

Revert "net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()"

Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()"

Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave"

Revert "x86/vdso: Fix output operand size of RDPID"

ring-buffer: Fix reporting of missed events in iterator

rtc: abx80x: Disable alarm feature if no interrupt attached

rtc: ntxec: fix OF node reference imbalance

rtmutex: Use waiter::task instead of current in remove_waiter()

rxrpc: Fix anonymous key handling

rxrpc: Fix call removal to use RCU safe deletion

rxrpc: Fix key quota calculation for multitoken keys

rxrpc: Fix missing validation of ticket length in non-XDR key preparsing

rxrpc: Fix recvmsg() unconditional requeue

rxrpc: only handle RESPONSE during service challenge

rxrpc: proc: size address buffers for %pISpc output

rxrpc: reject undecryptable rxkad response tickets

s390/debug: Reject zero-length input before trimming a newline

s390/debug: Reject zero-length input in debug_input_flush_fn()

scripts/dtc: Remove unused dts_version in dtc-lexer.l

scripts: generate_rust_analyzer.py: avoid FD leak

scripts: generate_rust_analyzer.py: define scripts

scsi: isci: Fix use-after-free in device removal path

scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails

scsi: sg: Resolve soft lockup issue when opening /dev/sgX

scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

scsi: target: core: Fix integer overflow in UNMAP bounds check

scsi: ufs: core: Fix use-after free in init error and remove paths

sctp: discard stale INIT after handshake completion

sctp: fix missing encap_port propagation for GSO fragments

sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks

sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

security/keys: fix missed RCU read section on lookup

seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode

selftest: memcg: skip memcg_sock test if address family not supported

selftests/mm: skip migration tests if NUMA is unavailable

selftests/mqueue: Fix incorrectly named file

selftests: net: bridge_vlan_mcast: wait for h1 before querier check

slip: bound decode() reads against the compressed packet length

slip: reject VJ receive packets on instances with no rstate array

smb/client: fix out-of-bounds read in symlink_data()

smb/client: fix possible infinite loop and oob read in symlink_data()

smb: client: correctly handle ErrorContextData as a flexible array

smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

smb: client: fix OOB reads parsing symlink error response

smb: client: reject userspace cifs.spnego descriptions

smb: client: require a full NFS mode SID before reading mode bits

smb: server: fix active_num_conn leak on transport allocation failure

smb: server: fix max_connections off-by-one in tcp accept path

soc/tegra: cbb: Set ERD on resume for err interrupt

soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching

soc: qcom: aoss: compare against normalized cooling state

soc: qcom: apr: make remove callback of apr driver void returned

soc: qcom: llcc: fix v1 SB syndrome register offset

soc: qcom: ocmem: register reasons for probe deferrals

soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available

soc: qcom: ocmem: use scoped device node handling to simplify error paths

sound: ua101: fix division by zero at probe

soundwire: bus: demote UNATTACHED state warnings to dev_dbg()

spi: fsl-qspi: Use reinit_completion() for repeated operations

spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo

spi: imx: fix runtime pm leak on probe deferral

spi: meson-spicc: Fix double-put in remove path

spi: mpc52xx: fix use-after-free on unbind

spi: mtk-nor: fix controller deregistration

spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()

spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback

spi: orion: fix clock imbalance on registration failure

spi: rockchip: fix controller deregistration

spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ

spi: rockchip: switch to use modern name

spi: sprd: fix error pointer deref after DMA setup failure

spi: ti-qspi: fix use-after-free after DMA setup failure

spi: topcliff-pch: fix use-after-free on unbind

spi: zynqmp-gqspi: fix controller deregistration

staging: media: atomisp: Disallow all private IOCTLs

staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()

staging: sm750fb: fix division by zero in ps_to_hz()

staging: vme_user: fix root device leak on init failure

string: add mem_is_zero() helper to check if memory area is all zeros

sysfs: don't remove existing directory on update failure

taskstats: set version in TGID exit notifications

tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans

tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)

tcp: annotate data-races around tp->bytes_retrans

tcp: annotate data-races around tp->bytes_sent

tcp: annotate data-races around tp->dsack_dups

tcp: call sk_data_ready() after listener migration

tcp: Fix imbalanced icsk_accept_queue count.

tcp: preserve const qualifier in tcp_sk()

thermal/drivers/spear: Fix error condition for reading st,thermal-flags

thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp

thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata

tipc: fix double-free in tipc_buf_append()

tools/accounting: handle truncated taskstats netlink messages

tpm: avoid -Wunused-but-set-variable

tpm: tpm_tis: add error logging for data transfer

tracing/probe: reject non-closed empty immediate strings

tracing: Avoid NULL return from hist_field_name() on truncation

tracing: branch: Fix inverted check on stat tracer registration

tracing: Do not call map->ops->elt_free() if elt_alloc() fails

tracing: Rebuild full_name on each hist_field_name() call

tty: hvc_iucv: fix off-by-one in number of supported devices

ublk: fix deadlock when reading partition table

udf: reject descriptors with oversized CRC length

um: drivers: call kernel_strrchr() explicitly in cow_user.c

unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure

USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen

usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()

usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()

usb: gadget: renesas_usb3: validate endpoint index in standard request handlers

USB: omap_udc: DMA: Don't enable burst 4 mode

usb: port: add delay after usb_hub_set_port_power()

USB: serial: option: add Telit Cinterion FN990A MBIM composition

USB: serial: option: add Telit Cinterion LE910Cx compositions

usb: storage: Expand range of matched versions for VL817 quirks entry

usb: ulpi: fix memory leak on ulpi_register() error paths

usb: usblp: fix heap leak in IEEE 1284 device ID via short response

usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl

usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()

usbip: validate number_of_packets in usbip_pack_ret_submit()

userfaultfd: allow registration of ranges below mmap_min_addr

vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()

vrf: Fix a potential NPD when removing a port from a VRF

vsock/virtio: fix accept queue count leak on transport mismatch

vsock/virtio: reset connection on receiving queue overflow

vsock/vmci: fix UAF when peer resets connection during handshake

vsock: fix buffer size clamping order

wifi: ath11k: add new hw ops for IPQ5018 to get rx dest ring hashmap

wifi: ath11k: clear shared SRNG pointer state on restart

wifi: ath11k: fix error path leaks in some WMI WOW calls

wifi: ath11k: fix peer resolution on rx path when peer_id=0

wifi: ath11k: fix rssi station dump not updated in QCN9074

wifi: ath11k: initialize hw_ops for IPQ5018

wifi: ath11k: remap ce register space for IPQ5018

wifi: ath11k: Trigger sta disconnect on hardware restart

wifi: ath11k: update ce configurations for IPQ5018

wifi: ath11k: update hal srng regs for IPQ5018

wifi: ath11k: update hw params for IPQ5018

wifi: ath5k: do not access array OOB

wifi: b43: enforce bounds check on firmware key index in b43_rx()

wifi: b43legacy: enforce bounds check on firmware key index in RX path

wifi: brcmfmac: Fix error pointer dereference

wifi: brcmfmac: validate bsscfg indices in IF events

wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

wifi: iwlwifi: read txq->read_ptr under lock

wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure

wifi: mac80211: check tdls flag in ieee80211_tdls_oper

wifi: mt76: mt7921: fix a potential clc buffer length underflow

wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()

wifi: rsi: fix kthread lifetime race between self-exit and external-stop

wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet

wifi: rtw88: check for PCI upstream bridge existence

wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap()

wifi: wl1251: validate packet IDs before indexing tx_frames

xfrm: provide message size for XFRM_MSG_MAPPING

xfrm_user: fix info leak in build_mapping()

xsk: tighten UMEM headroom validation to account for tailroom and min frame