f2573c2a3326 Linux 6.18.51-xanmod1
71f9c06ccf36 Merge tag 'v6.18.51' into 6.18
f6388029ea9e Linux 6.18.51
d83a9de7cecd ksmbd: zero pipe read compound padding
75640976cf47 cifs: add fscache_resize_cookie() to cifs_setsize()
d73f79d1a2c2 mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback
15803e227606 pidfs: protect PIDFD_GET_* ioctls() via ifdef
ed7380f4621f mm/huge_memory: use folio's memcg inside __folio_split()
80656031dfcd migrate: replace RMP_ flags with TTU_ flags
e4307837d92c mm/huge_memory: replace can_split_folio() with direct refcount calculation
f07c94cd3cc2 mm/huge_memory: change folio_split_supported() to folio_check_splittable()
305f9b6eb8a0 mm: thp: use folio_batch to handle THP splitting in deferred_split_scan()
0a4a3d720264 mm: thp: introduce folio_split_queue_lock and its variants
d913a85cc5f7 mm/damon/core: initialize damos->last_applied
05bdb7b867be mm/damon/core-kunit: handle region split failure in filter_out()
7d4ecfb507f3 mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs()
cd6d7f45abc8 mm/damon/core: skip aging from repeated aggressive merging
081ee85b4309 mm/damon/ops-common: use nr_accesses moving sum for quota score
cf94a9043f4a mm/damon/paddr: drop last same folio access check reuse optimization
11e4859ec0d8 mm/damon/vaddr: drop last same folio access check optimization
4c7275444ac6 mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
05dc22d5c4fa iommu/arm-smmu-v3: Add HAFT support for SVA
c660c017dec1 power: supply: ab8500_fg: fix use-after-free on remove
68916940332d power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
62fb3124bf74 Docs/ABI/damon: fix typo in intervals_goal sysfs path
1811bd8792ee mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios()
dba93b8cceb0 hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU
e4d1300b457e mm: rework compound_head() for power-of-2 sizeof(struct page)
5cec3e60e9f2 zram: set default primary compressor in zram_destroy_comps()
fb0e9ecffae5 zram: fix the issue that the write - back limits might overflow
9a78de3befad zram: read slot block idx under slot lock
fcd467124b19 zram: drop wb_limit_lock
d1743ec2dd2c zram: take write lock in wb limit store handlers
e7dbcb7a561a zram: fix out-of-bounds access in read_block_state()
878edb39ecf4 zram: fixup read_block_state()
83dd59ac1c34 NFSD: Prevent client use-after-free during close_lru reaping
cd489b035873 NFSD: Prevent client use-after-free during blocked-lock reaping
7f1abc50ce25 NFSD: Consolidate the revocation-path client unpin
3be89e8039a8 smb: client: reject a tree connect response whose byte count is too small
b7e74bccf588 cifs: Do some preparation prior to organising the function declarations
672cf86aa6aa smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
9eed72e9534b smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
31307a05ed82 cifs: SMB1 split: Separate out SMB1 decls into smb1proto.h
6493277a52b2 cifs: SMB1 split: Create smb1proto.h for SMB1 declarations
e7779c9f7e7f cifs: Remove dead function prototypes
b10015807e4c smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
a3e8b98c823d cifs: Scripted clean up fs/smb/client/smb2proto.h
72796c2ec6e9 cifs: Scripted clean up fs/smb/client/fs_context.h
4fb5a561866c cifs: Scripted clean up fs/smb/client/fscache.h
1537c6c67510 cifs: Scripted clean up fs/smb/client/cifs_unicode.h
549bd9868e9d NFSD: Prevent client use-after-free during admin state revocation
3c0a53ee0b44 NFSD: Prevent client use-after-free during delegation revoke
969b1fefb07d nfsd: convert global state_lock to per-net deleg_lock
6d6b9f6a75c3 nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache
9031493ef736 nfsd: fix UAF in async copy cancel and shutdown
ba0ee9e04b7a nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
f9cec313efb2 nfsd: fix clock domain mismatch in clients_still_reclaiming()
03c512f22d3f nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
ccc069d5c47c nfsd: move struct nfsd_genl_rqstp to nfsctl.c
430ed49a16cf nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
380d138a6b08 net: advertise TCP MSS from the configured MTU, not the learned PMTU
cfb44c6028e6 tcp: clamp route advmss to TCP_MIN_MSS
ea44679bc7d2 ipv4: use dst4_mtu() instead of dst_mtu()
a615a2c8c306 ipv6: use dst6_mtu() instead of dst_mtu()
920dacce8734 inet: add dst4_mtu() and dst6_mtu() helpers
b650560c5ee2 ipv6: add some unlikely()/likely() clauses in ip6_output.c
a294168185fe ipv6: pass proto by value to ipv6_push_nfrag_opts() and ipv6_push_frag_opts()
194d0fb0ea47 fuse: copy request headers via a stack buffer for io-uring
b96b0d2c25d1 fuse-uring: use named constants for io-uring iovec indices
f12ebb0a3ed7 fuse-uring: refactor setting up copy state for payload copying
121fc8edf583 fuse-uring: use enum types for header copying
c46805193fbe fuse-uring: refactor io-uring header copying from ring
6bb5347e9f8a fuse-uring: refactor io-uring header copying to ring
8974575898cd fuse: fix missing barrier when checking io-uring readiness
f1c91222188b PCI: starfive: Fix resource leaks on error paths in host_init()
e5c1d10003b4 PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots
0d72e78c9d38 lockd: fix swapped arguments in nlmsvc_match_ip()
fcfcba8fe17d ocfs2: validate directory-index entry counts when reading metadata
625e00fd25ef ocfs2: validate dx_root extent list fields during block read
a1dabe68fb53 ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
a6f3b8dfbdf4 ASoC: codecs: aw88261: only check PLL and clock state at power-up
0ac722e964cd ASoC: codecs: aw88261: reduce log spam
d013b7de4dcc remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
d6eab9066be0 firmware: qcom_scm: Rename peripheral as pas_id
9d69422ddaa1 sched/core: Make core-sched flips wait for in-flight selections
fef4b8f17e1c sched: Rework prev_balance() to avoid stale prev references
c522333c35d4 sched: Add assert_balance_callbacks_empty helper
c97be9d5ab04 sched_ext: Fix inverted ops.core_sched_before() invocation
c4ade059aaeb scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock
c98197ee3cd2 RDMA/ionic: Embed counter driver data in rdma_counter allocation
27b7b0dacae7 sched_ext: Fix exit_task leak on fork failure during enable
1a3af2262cb3 svcrdma: Reject Read lists that exceed the page budget
59bcf1b38f89 svcrdma: Reject oversized Read segments at decode time
3c97b8e76ca2 rpcrdma: arm rn_done before publishing the notification
9f2f5d099936 svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
ee7f6e5600ae svcrdma: Release transport resources synchronously
3ff45361e946 SUNRPC: fix gssx_dec_option_array error path bugs
5563db13c952 cxl/mce: Make the MCE notifier per-region
513a9613f7a6 cxl/region: Add helper to check Soft Reserved containment by CXL regions
040cface98ff dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding
dfc86b0c2698 cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
ccf481d73bce bpf: Disable preemption in bpf_get_stackid
b466ff95324f bpf: Use stack id functions instead of __bpf_get_stackid
73ebef25aec4 bpf: Factor stackid_new_bucket from __bpf_get_stackid
ba1e22a224c3 bpf: Factor stackid_fastpath function from __bpf_get_stackid
201a381bef3a bpf: Factor stackid_init function from __bpf_get_stackid
7c19b94c625d cpufreq: apple-soc: Fix OPP table cleanup
e989cede4439 ACPI: TAD: Add locking around AML evaluations
dd440f6a2e67 ACPI: TAD: Rearrange RT data validation checking
0a7a19286223 ACPI: x86/rtc-cmos: Use platform device for driver binding
ec2d81115485 ACPI: x86: cmos_rtc: Create a CMOS RTC platform device
f2e08c3f994c ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+
7267557ce98c erofs: skip sufficiently large global buffers when resizing
03c34309eb1b HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
1a503fbb116d HID: mcp2221: fix OOB write in mcp2221_raw_event()
3b4709e48649 HID: sony: clean up device list on probe failure
a15def9a6311 HID: sony: use guard() and scoped_guard()
d2dd2cced65b cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem
85d239160dc1 smb/client: emulate small EOF-extending mode 0 fallocate ranges
41f4c9978739 smb/client: reduce fallocate zero buffer allocation
c2ae13662137 smb: move some definitions from common/smb2pdu.h into common/fscc.h
110747ff535e ceph: properly decrypt filenames in vmalloc() buffers
104a51265042 NFSD: Guard admin state-revocation walks with NFSD_NET_UP
0e763ab306a8 ceph: force a cap message when a deferred revoke can't be acked immediately
c040e139f1a6 ceph: cap delegated inode count in ceph_parse_deleg_inos()
8bd3523df131 cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
6f9b62687a38 cxl/pci: Move CXL driver's RCH error handling into core/ras_rch.c
153b5ecd29ed usb: gadget: f_fs: Fix Use-After-Free in AIO error path
f3d31484b3f2 USB: gadget: ffs: fix mm lifetime handling
06c76d3c389f mm/page_alloc: don't spin_trylock() in NMI on UP
22bbde1960d1 x86/xen: fix init of balloon stats again
6f53c64a880f xen/balloon: improve accuracy of initial balloon target for dom0
b4a6050bde9e mm/slub: fix missing debugfs entries for caches created before sysfs init
d08ea0fd7038 mm/slab: move and refactor __kmem_cache_alias()
e7bd804e3c71 mm/rmap: use huge_ptep_get() in try_to_migrate_one()
54a58d6656dd mm/mglru: fix and remove redundant unevictable folio handling
d4812d21689f mm/mglru: use the common routine for dirty/writeback reactivation
09505232eced mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
daeffb841bb9 mm/hugetlb: refactor code around vmemmap_walk
b662d7bcb5ec mm/hugetlb: defer vmemmap population for bootmem hugepages
edc017be8266 rust: bug: prevent dead_code warning from warn_on!'s flags constant
cf24ce48d602 pidfd: hold exec_update_lock around namespace ioctl
7aa9ab532158 pidfs: simplify PIDFD_GET_<type>_NAMESPACE ioctls
2fa220bc0f84 ovl: fix double end_creating() on the casefold-mismatch path
1c4b90902c05 crypto: atmel-ecc - avoid stale fallback key after set_secret failure
5c1e763b713f crypto: atmel-ecc - clean up and improve ECDH comments
e39767b9a54d crypto: atmel-ecc - replace min_t with min
fc933a4a419b crypto: iaa - unmap dst before software fallback on decompress
4fcbc9f4082c crypto: iaa - fall back to software for multi-entry scatterlists
1517d1996b52 vlan: fix skb_under_panic and races when toggling HW VLAN offload
ed25ed29034d net/packet: defer vmalloc TX_RING free until skbs finish
0f9309044529 fuse: fix race between interrupt and resend
f98640c27cde fuse: remove fm arg of args->end callback
952f7a6d392b fuse: split off fuse_args and related definitions into a separate header
a5bb215dbc34 fuse: publish io-uring queues with release semantics
c051f66b6216 usb: xhci: bail out of setup if the controller is inaccessible
f0ccc2d323d0 usb: xhci: simplify handling of Structural Parameters 1 values
46fb722a3bcf usb: xhci: use cached HCSPARAMS1 value
4e141571d025 usb: xhci: implement USB Port Register Set struct
8dbc9c86c318 usb: xhci: add USB Port Register Set struct
8b7ca0029e94 usb: xhci: add helper to read PORTSC register
a363197790a8 usb: xhci: add tracing for PORTSC register writes
78e8ee25a5e8 afs: Fix leak of ungot volume
c8279ae8df68 ksmbd: fix use-after-free in oplock break notification
e5e7a61fa9e8 drm/nouveau/gsp: fix vblank interrupts on GB20x
dc7c40ffaa1b drm/nouveau/disp: fix head state readback on GB20x
0e346b65a413 drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x
ecb110991bc9 drm/nouveau/disp: fix HDMI vendor infoframes on GB20x
4739d519def7 drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks
94d8195eb418 drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp
a046e789ab66 drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c
1101cbfe7f34 drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
24c25b182d17 drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
b7dc03e09313 drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
4cf436de06ca drm/nouveau: Use write-combined maps for coherent
f3830fdd6930 drm/nouveau: unsubscribe the channel-kill event before the fence context
5ba4bcb3b96c drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware
859d8b6c5b27 drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
ded6ad826fe0 drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
6892f0a2f6b5 drm/sysfb: simpledrm: Improve stride validation
54e32ad5e0c7 drm/sysfb: simpledrm: Improve panel-size validation
8d65b8d1722d drm/sysfb: simpledrm: Improve framebuffer-size validation
fd3462acf659 drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
ebffa44e7a21 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
ae806a95b28f drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
da87bcad1f78 drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
e230c546ed93 drm/amdkfd: Add TLB flush after MES queue eviction/suspension
2e4b909fab96 drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
65e643703f15 drm/amdgpu: update the fw version for gfx12 userqueues
b7cb1b669613 drm/amdgpu: update the fw version for gfx11 userqueues
8de8b4e11ce4 drm/amdgpu: Skip accessing psp rum time db for APUs
492dbf832964 drm/amdgpu: fix autosuspend cleanup during removal
812c406f7529 drm/amdgpu: Disable runtime PM for externally attached dGPUs
964de255497f drm/amdgpu: clamp the isolation index for rings outside a partition
b3a7e0b69903 drm/amdgpu: check thunderbolt before switcheroo registration
66b1b3098863 drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
acd2dd6ecd89 drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
72a95df6bbc7 drm/gud: validate TV mode names before creating enum property
b86438a5c6b0 drm/gud: NUL-terminate TV mode names read from the device
7e28853c78c2 drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
0b2615b8b54f drm/amd/display: validate plane degamma LUT size for private color prop
295d2bf42061 drm/amd/display: fix dc_lock leak on GPU reset error paths
ee28fafb50f5 drm/amd/display: avoid divide-by-zero in __is_lut_linear()
4ac767722175 drm/hibmc: Use drm_atomic_helper_check_plane_state()
ed38f0be5b61 drm/hibmc: Fix list of formats on the primary plane
f5acd8f48cac drm/nouveau/disp/r535: Add scanline position support + head state support
6f9bdbe713fd drm/ssd130x: fix column and row end address in partial updates in ssd133x
6f776d0e43e0 drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
63c70e292e6b drm/ssd130x: fix column and row end address in partial updates for ssd132x
18b3433f10ee drm/i915: Guard against NULL driver_data in i915_pci_probe()
79d09cfe9030 drm: fix race between partial drm_dev_register() failure and ioctl
0259846b15a6 drm/panel-edp: fix i2c adapter leak on probe failure
b51d8fb5e58c drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
80c9528661c7 drm/panthor: fix firmware control interface bounds checks
5516f1acfd07 drm/panthor: harden firmware build-info bounds checks
ef41e8e4ae5b drm/xe/vram: report FLAT_CCS base misalignment
e184e46ca1ba drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
91ec55ddc097 f2fs: fix to zero post-EOF data when extending file size
a984446aa9d5 f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()
dde99df5a9d3 f2fs: fix valid block count leak on data block allocation failure
ab35ae07f2b5 f2fs: fix to clear dirty flag on folio in error path
c16cc4622e4b f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()
f6c49fae98f0 f2fs: fix i_size when pinned fallocate partially fails
161513f53e4a f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
b8ae1228c153 f2fs: fix to migrate all curseg types during free_segment_range
aefcec3bebde f2fs: avoid NULL checkpoint thread access in sysfs
aefb4b0f465b f2fs: fix dentry folio leak in find_in_level
94917ffab3a9 f2fs: fix to avoid potential section-unaligned pinfile
3e61c3944b83 f2fs: return writeback error from collapse range
3b681229e9f8 f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
db504781ea9b f2fs: dirty directory inodes on mtime/ctime update
dc652b2fe916 f2fs: fix to avoid move_range and defragment on device_alias file
445e4a1e6025 f2fs: only redirty pinned folios in redirty_blocks
7f89e2775d5b f2fs: reject overlapping move range after len expansion
95d5975c9d1c f2fs: return symlink writeback errors
ac4b019ac078 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
4fe579067409 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
0bdd0f7a1094 scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
776e4e8cbcf1 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
16c731c4f296 scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
17fb63c1d0fc scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
5dd9bec8004b scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
d7f7746ff031 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
9fa1d71233a8 scsi: qla2xxx: Avoid double completion in async IOCB timeout
10e9f05f7fd0 scsi: qla2xxx: Quiesce response IRQ before freeing request queue
31715d1e1cbf scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
e93aa3c5125d scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
a194684853dc scsi: qla2xxx: Don't query firmware state while chip is down
7203d4aed8f4 scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
e6cfb1ee1833 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
8e7a26931b61 scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
8286a9095fb5 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
8d1161371193 scsi: qla2xxx: Serialize flash version read in reset handler
7a448f5ed0b2 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
11834e5773e2 scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
7b22b4cb8822 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
5ecdb336df2a scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
67f0d5187c29 scsi: qla2xxx: Initialize NVMe abort_work once at submission
47272152a13d scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
206df5ffa72d scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
94bfb61478bc scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
97ca58b0fb02 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
b157256c2808 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
dec5624a3f8c media: chips-media: wave5: Set inst->std during default format initialization
a0506198a77b media: chips-media: wave5: Guard bit depth check with initial_info_obtained
ff98cd2b8b54 media: qcom: iris: use disable_irq() during power-off
ab6f088a44ef media: qcom: iris: fix state-change debug log printing stale value
f1c4f3885df1 media: zoran: Avoid freeing a registered video_device twice
dc005cb7ccb0 media: vimc: fix pixel format lookup in enum_framesizes
52fd9d80c0ce media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
4a187d944384 media: venus: fix payload size calculation in parse_raw_formats()
d031b5ecc4b3 media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
3ced388b7908 media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
331f22dd63bf media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
3345746e0957 media: v4l2-async: avoid deleting unlinked ASC entry on link error
7c62bd653563 media: tda18250: fix possible integer overflow
4d2048466af9 media: saa7164: fix cleanup on resource allocation failure
342632a4d8ba media: s2255: check firmware size before reading trailing marker
68d664f1b4ef media: s2255: bound JPEG frame size before copying into the buffer
93e6ed88f508 media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement
26a2a985bbee media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
7443b16b6dd8 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
12b88016c199 media: rkvdec: Propagate platform_get_irq() errors
5b58d8c206f3 media: rc: sunxi-cir: Unregister rc device on probe failure
8281acf5d704 media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
9392375dd4c0 media: nxp: imx8-isi: Correct color map between V4L2 and ISI
2f9b2768d5ce media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing
5026f927ef41 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
252850653569 media: platform: mtk-mdp3: Fix SCP device refcounting
96dafbae77f5 media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
24aca8839038 media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder
27b7997be552 media: intel/ipu6: fix async notifier cleanup leak on parse error
1d59c5254c33 media: imx355: Avoid calling imx355_power_off twice in error path
af81f35e4f42 media: i2c: ov7740: fix use-after-destroy in remove
90f9b421fc6d media: i2c: ov02a10: fix endpoint parsing use-after-free
4f8fd40b39bf media: i2c: imx415: Return test pattern write errors
1aa66bb3ba44 media: i2c: imx415: Release runtime PM reference on VBLANK error
312c68e9ed8a media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure
0745a59945d9 media: go7007: defer the ALSA v4l2 put until card release
0782807552b6 media: em28xx: fix use-after-free of dev_next->devlist on disconnect
f9322ac9f862 media: em28xx: defer audio-only extension registration
bf3f49273d5b media: cx23885: cancel NetUP CI work before teardown
7087bef6510c media: cx231xx: reject geometry changes while the VBI queue is busy
cb1218da234e media: cobalt: Avoid freeing ALSA private data twice
f78cf36cabf9 media: cedrus: fix memory leak in cedrus_init_ctrls()
5c62095acc2a media: cec: Serialize exclusive follower delivery
38c14532adb3 media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
673611cc2ab9 media: cec: extron-da-hd-4k-plus: add sanity check
a3adb63b1219 media: cec: disable delayed work before freeing an interrupted transmit
695063fc5757 media: cec: core: Fix kmemleak due to missed rc_free_device() call
cb7a4cf63fa2 media: amphion: Remove obsolete frame_count check in venc_start_session
297fee023f46 media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
347e9d2246b8 rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments
76395109a051 LoongArch: Avoid preempt count underflow without probe
266ffc92e685 LoongArch: Do not save/restore percpu base register in rethook trampoline
d692b825dc24 LoongArch: Do not select HAVE_RUST when KASAN is enabled
d3fd094c13c6 LoongArch: Fix acpi_package_ids[] array overflow
882b8912b7e9 LoongArch: BPF: Refactor jump offset calculation in tail call
462e6abc8293 LoongArch: BPF: Optimize redundant TCC loads in epilogue
ab275a23b4d9 LoongArch: Add DIRECT_MAP_PHYSMEM_END definition
4e4dbc341b15 LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
6b78786ee726 LoongArch: KVM: Free init resources if kvm_init() fails
07c3037e45c9 LoongArch: KVM: Fix TOCTOU race on pv_features
b7fab314ade2 LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path
566b1f08d983 KVM: arm64: Correctly cap TLBI Range to the architural limit
3d4c26b16a04 KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
2f1a571af300 KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure
de9b4e8f37ce KVM: arm64: vgic: Fix detection of MI on no pending LR
7631f9529756 KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
72bce82c4171 KVM: arm64: Sign-extend VA for range-based TLBI invalidation
d8580e7aa189 KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
ce447651a52e KVM: arm64: Correctly handle end of VA space TLBI invalidation
be54a70067c7 KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
6408605cbd50 KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page
150c43473dcf KVM: s390: Restore sigset on error path
5ed801685a8a KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP
6ee52d3af2a1 KVM: s390: Fix memory corruption by not reinjecting CK machine checks
3904a3296e40 KVM: s390: Zero initialize irq in reinject_machine_check
cc710ee45395 KVM: s390: Take srcu when importing watchpoint data
b5acacfdb896 KVM: s390: Free guest debug data on vcpu destroy
f55e4d415d95 KVM: s390: Fix old_data leak in guest debug error path
44bf3792c10f KVM: s390: Fix memory leak in guest debug handling
beb9c55af609 KVM: s390: Fix length check __import_wp_info()
39f7abd5927b KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
929fd2d87851 KVM: x86: Serialize writes to disabled_quirks using kvm->lock
3097582b73a8 KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
41debfc98526 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk
7b2721d66525 KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot
0a25ee42e7d1 KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU
e29e9a9d8114 KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
93b7f6eb76a1 KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()
27bdeb5fd190 KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
c43563e7518e KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
674a3244f07f KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
d689dd4eae48 KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
22dfcc22c95e KVM: nVMX: Always flush vpid02 on first use
5778dda871f1 KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode
c9f2c50bad37 iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
b6cedf011bd9 iio: light: opt4001: Reject integration times with a non-zero seconds part
958d69140393 iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
4a9820aa8ef7 iio: light: opt4001: Fix power down clearing bits of the wrong register
6d00b4fec5bf iio: light: opt4060: Fix incorrect register name in threshold read error message
38f58a024966 iio: light: opt4060: Reject integration times with a non-zero seconds part
fcddb4da54ab iio: ti-ads7138: Disable STATS_EN bit while reading conversion results
c0d491c243e7 iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
c2d6437663d7 iio: srf04: fix pm_runtime handling on probe error path
eef652190b00 iio: pressure: mpl115: Fix runtime PM cleanup
7ded5b76ec2d iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
0614928a3eda iio: light: ltrf216a: fix runtime PM reference leak in error path
1ce47f00e9c0 iio: light: gp2ap002: Disable regulators on resume failure
9c1b74fdcffa iio: light: cm32181: return zero after writing calibscale
d2b32b71fa5b iio: gyro: mpu3050: fix sign of raw angular velocity readings
08ac8d2976d5 iio: dac: m62332: Fix regulator reference count imbalance
bcc324f3033c iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show
2d386efb4c37 iio: chemical: sgp30: Handle IAQ thread creation failure
2071624c3d0f iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
43bce901047e iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
510497e31be4 iio: buffer: Tie IIO dma fence lock lifetime to the fence
06a9460b8b79 iio: buffer: Make IIO DMA fence release RCU-safe
f1f8f0e8e0af iio: buffer: Fix potential use-after-free in anonymous buffer release
8de90e0e0f6d iio: adc: pac1921: fix wrong channel used in trigger handler read
beec14368c94 iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig
d2ed166c901e iio: adc: adi-axi-adc: add data size support for AD408X backend
e9627244ac0d ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get
4e580d84a638 ASoC: loongson: Fix error handling in ACPI property parsing
e11b056d69b8 AsoC: intel: sst: fix PCI device reference leak on probe failure
e8ea01a04570 ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
0966b76a0e23 ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division
5ca4bd754352 ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
5a4fe7a87841 ASoC: cs35l34: drain threaded IRQ before runtime suspend
6e369bc46663 ASoC: cs35l33: drain threaded IRQ before runtime suspend
eb5d39dd862f i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
b2b87f2e0bb1 clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
4763197c6f34 clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
bd326b0c5b33 clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
c67fc2fd7139 clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
206a6e21a0cf clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
526b0a71a4d9 clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
cc2941bc3735 clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
51b40cb17c21 clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
4582949b7bad clk: meson: align gxbb_32k_clk_sel number of parents with actual count
88fe6792be2b clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen
05952e503cf6 clk: clocking-wizard: fix integer overflow in rate calculation
82f78c2b3af8 batman-adv: bla: prevent CRC corruptions after claim flush
871acdf97f64 batman-adv: bla: fix freeing of claims on meshif deletion
1cfa7d5f70d5 batman-adv: dat: avoid unaligned fault in IP extraction
c32e5e25c412 batman-adv: mcast: linearize skbuff for packet generation
cedacfecf4b4 batman-adv: mcast: ensure unshared skb for multicast packets
e91d2cc7441d batman-adv: fix stale receive device on merged fragments
c8f86e375b39 mtd: rawnand: validate ONFI extended parameter page sections
4b282dc6a9e9 mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE()
d06f91a52af1 mtd: mtdoops: free page bitmap when the backing MTD is removed
18916f475057 mtd: afs: validate v2 image info bounds
e8bcb9d54429 s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
6d554f2571e6 s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
69632952aca0 s390/vfio-ap: Fix NULL deref in status_show() during queue probe
647916988272 s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
c45753c32d45 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
178ea7a1c2c3 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
f7d66afc34bc s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
3c5f51f257e1 s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
fc069d00a0db s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
3b90d769b351 powerpc/crash: stop watchdogs before booting kdump kernel
36dcb8c2e339 powerpc/pseries: Move H_WATCHDOG definitions to a common header
d2be3dd20e83 powerpc/pseries: Handle and log pseries-wdt registration failures
9c914b7a0bd1 powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
da88a2a2119e powerpc/kexec_file: Prevent kexec range truncation
df45337587db powerpc/kexec_file: Fix null-ptr-def in extra size calculation
6ae9306c7598 parisc: Fix alignment of asm statements in head.S
3e2691eeee83 parisc: eisa: Fix infinite loop when parsing invalid IRQ value
6b1faf1f099f nvdimm/btt: reject an arena whose nfree is below the lane count
bdd929e60bc5 mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()
631d8f39b33e mm/hugetlb: keep max_huge_pages when dissolving surplus folios
ae6a8b0c6990 mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
8e287f463fc4 Revert "irqchip/mbigen: Fix mbigen node address layout"
6e96e2bb1065 pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig
cf1484d9a75d nvmet-tcp: reject unsolicited H2CData PDUs
dbc4acbdb3ca nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
7555ddd60af7 nvmet-auth: Synchronize timeout work during SQ teardown
d663944dbad8 nvme: add missing SRCU grace period in error path
b4af7999a998 nvme-tcp: check the data direction of a C2HData PDU
7df913a7ced5 nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
15d7a35a4892 nvme-fabrics: fix DHCHAP secret leak on parse failure
7ad2ea7c1004 ALSA: pcm: Fix race between non-atomic ops and trigger-start
89992bda7dfb ALSA: harmony: initialize locks before requesting IRQ
1e67ad10373e ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
cd090af03f5d arm64: errata: pass REVIDR when matching target implementation CPUs
68cbd70795dd arm64: mm: Fix the lockless page-table walk in show_pte()
2b3b06cb709c i2c: mux: Fix channel node leak on adapter add failure
112b3d48084c i2c: core: fix debugfs UAF on adapter removal
954f30c8df0a i2c: qcom-geni: update frequency table to fix timing parameters
c643b6e7852e i2c: designware: Enable interrupt mask workaround for HJMC3001
19d65da9f749 perf hisi-ptt: Fix PTT trace TLP header parsing
242138984073 perf trace: Refactor augmented_raw_syscalls using bpf_for
f3a666313849 perf trace: Factor out BPF loop body
3c492c8eba02 perf/x86/intel: Fix kernel address leakages in LBR stack
267f0a4fb9fe rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
3a2b79eae5be rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
a4d6666a65d6 rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
350cb7821b3d rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt
0a90e268cce7 memcg: make the v1 soft limit knob inert
801bcbdbfd59 memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done
7269bd95d707 Input: aiptek - validate raw macro indices before updating state
d07e281f2a77 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
4d6ccd3883df fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
0ceda28f371d mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
5da247e4d1e8 kprobes: Protect kprobe_blacklist with RCU
863f6726a5c0 irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
f8a2f2a46023 ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
685c195fbd7d ata: ahci: work around lost interrupts on Marvell 88SE61xx
ca5bfea2045e ceph: lock mutex in ceph_mds_check_access()
a24a146ae2cb bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
bfb469f20aa9 block: flag zoned disks with GENHD_FL_NO_PART
634e2d23736d cpuidle: psci: Fix support for probe deferral by dropping the faux device
b519dfce1998 cpuidle: dt_idle_genpd: kfree() the original name allocation
fac202d73e7a dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
8fd47ccbba86 dmaengine: dw-edma: Complete descriptors before pausing
3b313f7a00d1 dmaengine: dw-edma: Fix HDMA channel status register access
d382aaf5fed3 dmaengine: fsl-edma: tracing: no ptr dereference during log output
408ff2d5bf55 dma-direct: return struct page from dma_direct_alloc_from_pool()
36177beff2a9 dm: fix resume-vs-remove race
af1f32ccf805 dm: fix race when loading and unloading a table
74ec08f7b81c HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
f4cb9c4556dc HID: rmi: fix OOB access with undersized RMI reports
c7f927aa8b55 HID: bpf: serialize device reference release in struct_ops destroy path
078adc03f6e6 ftrace: Synchronize the initialization of ftrace_ops
7d1559126d86 futex: Prevent rcuwait use-after-free during requeue PI
1cd41131bc4b mm/damon/core-kunit: check region count before testing in split_at()
382e58c24eab mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
368f84ec7910 mm/damon/sysfs: kobject_del() region and target (error) dirs
23c7b91895ff mm/damon/sysfs-schemes: kobject_del() scheme region dirs
20a40e7eb5ec mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs
e608e7bbe82c mm/damon/sysfs-schemes: kobject_del() scheme filter dirs
8a1ebb241fc7 mm/damon/sysfs-schemes: kobject_del() scheme dirs
b9847d539b9c mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs
cb55606449fd samples/damon/wsse: stop and free damon ctx when damon_call() fails
6179c7f47876 samples/damon/wsse: handle damon_start() failure
2446d3820cba samples/damon/prcl: stop and free damon ctx when damon_call() fails
9f370353bba7 samples/damon/prcl: handle damon_start() failure
3c07c57b8941 samples/damon/mtier: handle damon_stop() failure
f0808262a761 samples/damon/mtier: handle damon_start() failure
71de5a082d2c mm/damon/vaddr-kunit: check region count in three_regions test
dd817463c9b4 scsi: pm8001: Use rollback index when freeing MSI-X vectors
4bb34769ef44 scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
1624bff4c511 scsi: target: iscsi: Reserve a terminator byte for the login payload
a38051fa2dde spi: Fix DMA mapping ownership on partial map failure
148a3f03aec8 spi: bcmbca-hsspi: disable clocks on resume failure
0acbfd61aee1 spi: bcm63xx: disable clock on resume failure
b782a7cb0a42 spi: bcm63xx-hsspi: disable clocks on resume failure
907752a7b64a soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size
e373c1acdbcf ublk: clear VM_MAYWRITE on read-only ublk char device mmap
89f06342743c userfaultfd: reset err to be 0 when move_pages_ptes succeeded
65c2029f3bba thermal/drivers/qoriq: Disable clock on resume failure
ec2db87a0bbb thermal/drivers/imx: Disable clock on runtime resume failure
efaab8938fb9 xhci: fix lost bounce buffers on TDs spanning several ring segments
b041e3f35e0d staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
ff61aa328935 staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
d3a7fa61997d usb: gadget: fix null pointer dereference in usb_put_function_instance()
c29a83c1ff3f USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
02ac76f27db2 usb: gadget: f_midi: initialize work in f_midi_alloc()
e89e30f0b5d3 usb: gadget: f_midi2: fix use-after-free in string attribute show path
9c3d5091e356 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
33a81acd2d1d usb: typec: ucsi: displayport: Fix OOB altmode array index
6be5169e7615 usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
42828aeb40b4 usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
d4e00a1eb391 usb: typec: qcom-pmic: cancel reset_work on stop
1e4f33f99bfb usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
c614d7c44ca7 usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
7c4e2f964c65 usb: storage: realtek_cr: fix use-after-free on disconnect
0afe5c31612d usb: dwc3: clear forceRM when issuing EndTransfer
62a8b6796063 usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
1c67f2ba9c5f usb-storage: ene_ub6250: fix race between scan work and probe
7690a86b1932 media: usbtv: keep device alive while ALSA card exists
296a884cd6fe clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
9392a2c34676 ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
838455cc8bfe usb: image: mdc800: change kmalloc() to kzalloc()
4814f28c45f5 drm/amd/display: fix division by zero in get_estimated_bw()
12ee39c2b1d3 bpf: fix the return value of push_stack
c96477e0cabf drm/xe: Don't hand out the flat CCS storage as usable VRAM
a6b088bee95f fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()
0ec897493ff8 drm/amd: Drop calls to restore power limit and clock from smu_resume()
0b6680e30639 mfd: qnap-mcu: keep the reply buffer alive past a command timeout
617b48fc0baf objtool/rust: add one more `noreturn` Rust function
947400af98b9 fsnotify: Fix stale object mask after concurrent mark updates
459f33f82864 entry: Fix seccomp bypass after ptrace with TSYNC
b5a5d389eee6 mm/page_vma_mapped: use huge_ptep_get() for hugetlb
e15407c3a8a0 openvswitch: Fix CT limit teardown use-after-free
a13b1e80e501 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()