95d03facd0b1 Linux 6.18.56-xanmod1 a893a19142a7 Merge tag 'v6.18.56' into 6.18 17ad2612c11a Linux 6.18.56 a47406c769f7 ipv4: free inet_opt and ireq_opt after an RCU grace period b473ee29aa0d iio: adc: adi-axi-adc: Initialize state mutex bb29dd90885b iio: adc: adi-axi-adc: Make use of dev_err_probe() e05c55de819b iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs 845c959178cc net: mana: Sync page pool RX frags for CPU 55aa2774323e net: mana: remove double CQ cleanup in mana_create_rxq error path 72d2f5436789 xen/netfront: drop RX packets with a short Ethernet header 626deff23b54 net: usb: qmi_wwan: add Quectel EG120K-EA 525694a6021e KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails 81d787551590 KVM: x86: Add static calls for nested virtualization ops 69f1d46341c2 KVM: x86: Reject nested CAP enablement if nested virtualization is disabled 9a4605ac9045 KVM: move TSS constants from kvm_host.h to tss.h 318ef696fa3c KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted 267c586a090a KVM: arm64: Use stage-1 leaf size for VM_PFNMAP 1113374a17d7 KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT e4f086a7d707 KVM: arm64: Always populate FGT masks at boot time a014b1a377e4 KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h cf0654248c87 arm64: errata: Add Cortex-A725 erratum 3821522 workaround 424e851050f4 arm64: errata: Factor out broken AMU const counter cap 277c4d8eac0b arm64: mm: Fix the break-before-make flush range for erratum 2645198 e506333d1b9f perf: Require kernel access for text poke events 2581b43e162c perf/core: Check kernel access when kernel callchains are requested a16986dac7be perf: Replace perf_event_header__init_id with full header init 624370942abd unwind: Shorten lines 08bf919f041a tty: fix saved termios reset race 9e8595cbd31d usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 100f92cc9014 tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2 ba927133b301 usb: dwc3: gadget: fix IRQ storm on invalid event buffer count 9b995b757a87 drm/amd/display: Fix fast updates on DCE 8.1 6f3608823464 drm/amdgpu: reset VI ASIC on MacBookPro14,3 d12b62677fb4 drm/amdgpu: reset VI ASIC on MacBookPro15,1 0e0fd96b2626 drm/amd/display: Preserve eDP mode on initial ASSR failure 8786c5bc7737 drm/amd/display: Mark DCE 6.4 as not APU 6b0cc4e32599 iio: adc: ad4030: fix invalid oversampling_ratio validation 23222e50948a iio: adc: ad4030: Use BIT macro to improve code readability 9c8158ef4ccc units: Add HZ_PER_GHZ a0a1929d66d6 smb: client: only require read lease for size-extending preallocate aec958676fb7 iio: adc: aspeed: propagate reset deassert errors 49c97ba1a3a3 iio: adc: aspeed: Simplify with dev_err_probe 74d723eee729 smb: client: distinguish real EOF from a stale remote_i_size on read cecf4114069f smb: client: flush dirty data before zeroing a range 405a969c0b33 thunderbolt: Don't access a DP tunnel after its DPRX read was canceled 9cedbfde1450 wifi: mac80211: set info->band for 802.3 encap offload frames cbdcf80683f5 wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() 03525b632908 wifi: mac80211: count only matching reservations in reserved switch 80e8b0ea73ba mtd: spinand: fix NULL pointer dereference with no ECC engine 2d86abd28071 nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known d3d6d7efdacc nvmet: copy the hostid into the ctrl before creating PR pc_refs dd053fc01eef nvmet-tcp: Don't error if TLS is enabed on a reset 889c61e3d0f1 Bluetooth: Serialize SMP remote OOB data access e887e43bd5aa fsverity: add dependency on 64K or smaller pages b4c0c41b952c fs,fsverity: remove check for fsverity being enabled in setattr_prepare() 2efdeec99ca0 fs,fsverity: reject size changes on fsverity files in setattr_prepare 8f317daa50fe rust: irq: pass RegistrationInner as cookie to request_irq 333fa4bb5dbb rust: devres: ensure revocation is complete before device finishes unbinding e7930d857cc7 rust: devres: fix race between concurrent revokers 5017fdcb5ad7 rust: devres: add 'static bound to Devres 8ae7e5dec4f3 rust: devres: fix race condition due to nesting 946ae2e1669b mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc 60f3b22d501d mm/vma: rename __mmap_prepare() function to avoid confusion 98f6a4589e0f netfs: clear post-EOF pagecache when extending a file via write 4b8ce1686dea pfcp: fix socket lifetime on netdevice registration failure 8bed333470a1 mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages 0a6c9b380190 drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read e68380710fc9 svcrdma: Use svc_xprt_put to free listener on create failure d1d9694ae47d mptcp: fix msk->timer_ival reset e64703280ce7 iio: trigger: cancel reenable_work before freeing trigger e113bac1d5e7 iio: proximity: vl53l0x-i2c: claim direct mode for raw reads 28e76a775c30 iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler a70d84d2f6c3 iio: proximity: sx9324: Correct proximity channel resolution 20ebd7f4e35c iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure 58237debc18d iio: proximity: isl29501: Fix return type of isl29501_register_write 6501b032be21 iio: proximity: aw96103: validate firmware data length 493e743ea1b5 iio: pressure: rohm-bm1390: Return error when read fails 4fd5a61e61d6 iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup 10a958e76c73 iio: light: rohm-bu27034: Fix infinite delay on error cc71400bc965 iio: light: gp2ap020a00f: drain irq_work after free_irq ce308ce18ded iio: imu: adis16480: fix unprotected debugfs reads 50e8d70ba074 iio: imu: adis16400: fix unprotected debugfs reads 60699102827f iio: health: max30102: fix NULL dereference in interrupt handler b53dc6e15aea iio: gyro: adis16136: fix unprotected debugfs reads 786f0162fe6d iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() d6a83a501507 iio: cdc: ad7150: fix OF matching and publish module aliases b134ef820610 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. b466db9e68b4 iio: buffer: serialize buffer teardown with mode claims 8aef1e8bdd86 iio: admv1013: initialize callback mutex before registering notifier a5fe2d1b55fa iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind f44e2ac2fb11 iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls d74c2489acc5 iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure 6dd3bf785d03 iio: adc: stm32-adc: fix possible division by zero in processed channel 2754d336af34 iio: adc: stm32-adc: fix check on internal channel availability 56e8e9d9992b iio: adc: rohm-bd79124: Fix rising alarm 2a3fd11fd0e1 iio: adc: rohm-bd79124: Fix GPIO mask check 02a9e6a95a3b iio: adc: rohm-bd79124: Fix channel initialization 1d8beaae5a74 iio: adc: rohm-bd79124: Catch regmap errors at measurement start/stop 2eb7f097e15d iio: adc: pac1934: check ACPI label duplication fe0ceff995d9 iio: adc: max1363: sign-extend bipolar differential channel reads f87d392bb4eb iio: adc: axp288: Add TS bias override for Haier HV103H ed1a6230155f iio: adc: ade9000: request interrupts after powering the device f73b94acc7ec iio: adc: ade9000: handle Phase C dip events in IRQ1 handler fddb6cc28134 iio: adc: ade9000: fix overlapping scan_index for current and voltage channels d2400175228f iio: adc: ade9000: fix NULL pointer dereference in clkout registration f20b94a7dc1f iio: adc: ad_sigma_delta: fix use-after-free on unbind 0633f83c4caa iio: adc: ad7173: Fix digital filter configuration d2261795797b iio: accel: sca3000: fix frequency divider condition check 3365209e758c iio: accel: kxcjk-1013: reject duplicate event disable 5c7ca8fe7206 iio: accel: kionix-kx022a: Prevent memory leak and fix state 4165641d06ef smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races f82242fe3109 smb: client: flush and commit data before querying allocated ranges dce9bca8afcb smb: client: discard post-EOF pagecache when extending a file via copy range b75dadb50a25 smb: client: discard post-EOF pagecache when extending a file via zero range 2f97f929dad9 thunderbolt: Reject oversized XDomain properties responses 58cb2aa1d29f thunderbolt: Disable CL states for the Anker Prime TB5 dock 2f5893172fc6 thunderbolt: Fix domain reference leak when DPRX read is canceled 34a6e27c954e thunderbolt: Tear down inactive DP tunnels when the domain is stopped e09cbad4db58 thunderbolt: Mark discovered tunnels as active c444d2c17dc2 thunderbolt: Hold a router reference for each allocated HopID f18faa3d3b81 thunderbolt: Fix KASAN reported use-after-free when request is canceled 29664699216c USB: serial: option: add Compal EXC-T1 support af4224809ea1 USB: serial: option: add Quectel RG660QB 3ef1b5c9a719 USB: serial: option: add Compal EXM-G1x support 8b495843267b USB: serial: option: add Quectel EG060W 02e1112182d8 USB: serial: option: add support for SIMCom SIM8260C 4597ddd6168a USB: serial: fix ioctl hangup race a1aa474768f6 USB: serial: fix driver deregistration order 4d6da6867b4a USB: serial: fix dynamic id driver deregistration race 02fc7a87f029 USB: serial: ssu100: fix baud rate overflow 4e18c175cea2 USB: serial: quatech2: fix baud rate overflow 25a5f7239a43 USB: serial: cp210x: add Corsair AX1500i Power Supply 452f1c9b76f7 wifi: mac80211: handle empty FILS association request payload 128e800a4127 wifi: mac80211: fix mesh fast xmit path deletion UAF a613c891906b wifi: mac80211: release mesh path quota on failed additions 1892e71aa2e5 wifi: mac80211: reject invalid 320 MHz CSA bandwidth 42aa9feb27b6 wifi: mac80211: minstrel_ht: validate fixed rate index d0183cd1f6a2 wifi: mac80211: keep fallback association elements alive 3b75831ceee7 wifi: mac80211: account proxy paths against the mesh path limit 772bd89304ec wifi: mac80211: drain PS delivery work during station teardown 481f9230284c wifi: mac80211: shut down RX BA session timer on teardown 1c82d0c5d509 wifi: mac80211: keep paired old chanctx alive cd8f8f45d81a wifi: iwlegacy: 3945: free EEPROM data on remove b0e97bd40e0c wifi: cw1200: fix TX padding OOB read leaking heap data to device 4c9a32a80810 wifi: cfg80211: fix RTS threshold setting for single-radio PHY 98abf374e509 KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor b37ae6e65a1d KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs 97c1dcce17ef KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy 8b7d4f68fef9 KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state b1de3ebf5950 KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it f6189e26d023 KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified 1a62eb293f60 mtd: spinand: Do not update the QE bit on devices without one b28120197cc1 mtd: spinand: fix zero oobavail when no ECC engine is used 23cef33571b1 mtd: spinand: Enable QE on all dies 2bbaa3f8df83 mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive() 875c57f2df09 mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB 1ed0ccd56491 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ cadf42f22438 mtd: mtd_intel_dg: reset poll counter for each erase a991c28066e7 mtd: block2mtd: Fix divide error when erase_size is zero 2423a05dd0f2 nvmet: pci-epf: reject too-short SGL segments 7fd3c363eba4 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() 21ffcae171d1 nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT 49e8a3224c91 nvme-multipath: fix underflow in ANA log bounds checks e30a2406408d tpm: fix off-by-four bounds check in tpm2_get_random() aa480f05aed7 net: extend IPv6 exthdr detection of tunneled packets 6316d17324bd ipvs: bound LBLCR and LBLC cache growth 891bd8335a0d io_uring: fix task_work add use-after-free with SQPOLL a85d0f00671b fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() bdbc8e78aa96 tracing: fprobe: fix suspicious rcu usage in fprobe_entry b0f76d4cb9be mm/damon/core: do non-safe region walk on kdamond_apply_schemes() d3c2d2692bdf x86/mm: Drop unnecessary PMD page copy when freeing fe23680e6f1d x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h 84df222de86e Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() c3b5e6da4ba6 Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() c42ce5373405 Bluetooth: btintel: fix buffer over-read in btintel_hw_error() 708cdd203d0b Bluetooth: hci_core: Serialize fragmented ISO packet queueing 1681f97afdf9 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown 86e9708f9d19 Bluetooth: hci_core: Serialize ACL scheduling with channel deletion dd4db9f808ac Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems cabd58d9bb66 Bluetooth: hci_conn: Lock parent access during enhanced SCO setup 333257e6e4a7 Bluetooth: hci_sync: Fix inquiry cache use-after-free 0a554901bd22 Bluetooth: RFCOMM: Fix initial port reference race 4230d65032fc i2c: xiic: don't clobber msg->len to signal block-read completion 51e1125ff7d6 i2c: xiic: preserve PEC byte length in SMBus block read setup ba0632683728 EDAC/altera: Fix device node reference leaks in the SDMMC ECC setup 865f3bdebbc9 EDAC/altera: Fix use-after-free in error paths 74eeb95c0478 EDAC/altera: Fix memory leak on dci allocation failure 9846b85c2eb8 EDAC/altera: Drop __init from ECC setup paths for re-probe safety 0c03cb91b569 EDAC/altera: Do not allow driver unbinding 9d2d3b3dfe89 EDAC/versalnet: Drop remote processor handle refcount on driver removal e561c2740b62 ALSA: hda/realtek: Fix silent speaker on Higole F9B d8986de05cc6 ALSA: hda/realtek: Fix square wave output on ASUS Strix G615LR eb0c7fda59cf ALSA: ua101: reject mismatched capture/playback packet sizes fc5c52848e40 ALSA: seq: Serialize compat port-info ioctls 9590d1679162 ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 69d2b7a4c115 ASoC: qcom: lpass-cpu: use DAI table index for playback constraints d195c8c763fd ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type 7df8c39a50f3 ASoC: codecs: max98363: fix uninitialized stream_config->type 2bce6f006cfe arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems 1c17db14f2c2 serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL 8f9103651d6a serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around 48e09369839f serial: vt8500: Fix clock reference leak in vt8500_serial_probe() f895ed664cb7 serial: tegra: don't clear the Tx FIFO on an Rx-only reset d8233d6b391b serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() 7019a84c23c1 serial: fix TIOCMIWAIT race 3f151c2e86f5 serial: revert guards in uart_wait_modem_status() c3ba14c29d55 serial: 8250_omap: fix wake irq cleared during suspend e32440fa536a serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() 2c8614981d3e tty: serial: max3100: shut down timer before freeing port 94af6cd832e9 tty: abort break signalling on hangup c110c6eed54f tty: serial: qcom_geni_serial: Keep console RX functional after deep idle 6b7be3b9b857 tty: port: fix tty_port_tty_vhangup() race 7021acc84c2e tty: tty_port: restore TTY_IO_ERROR on activation failure 821050631750 tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup 4335278d0e75 tty: vcc: zero-initialize control packet in vcc_send_ctl() 3551bdf843a1 tty: amiserial: fix broken TIOCMIWAIT e8615dfe80cf tty: vt: fix memory leak in vc_allocate() d16046f1ace2 usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe 95160fe606e6 usb: cdns3: fix use-after-free in cdns3_gadget_exit() 072535f26dc5 usb: typec: ucsi: displayport: Current CAM OOB index fixup f5ed186d0cf3 usb: typec: ucsi: Get the connector fwnode based on reg value 41934f92e7a5 usb: typec: ucsi: glink: fix use-after-free of ucsi on remove 75dc6cb377ef usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() 282be6ae8be7 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() 30dbaf3c6696 usb: typec: tipd: don't send GAID when probe fails in APP mode b2ed8643face usb: typec: tcpm: recover after failure to start the frs ams 4333174ea52c USB: dwc2: shut down wakeup timer before freeing HCD state 1da16c46b8d7 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints bd89c4f42f56 usb: chipidea: tegra: disable runtime PM on resume failure 7811d8e26c77 usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC 5298c96bf006 USB: gadget: dummy-hcd: Fix wait for outstanding request completions 474e9e1852fb usb: gadget: aspeed-vhub: cancel wake work on device removal 9f0321e8e9af usb: dwc3: am62: Fix runtime PM usage count leak on probe error path 7b5ed2d30ccc usb: typec: port-mapper: Only match USB4 port if host interface is available 50a92c02551c usb: typec: anx7411 - stop the IRQ before destroying the workqueue 8c611876c002 usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd 87f2185423e0 usb: gadget: midi2: Fix the jack descriptor array sizes 772149e7badb usb: ohci-st: disable controller wakeup on removal ec69932b4558 usb: ohci-spear: disable controller wakeup on removal dc1b196ad595 usb: ohci-s3c2410: disable controller wakeup on removal 83e8bd42bd17 usb: ohci-da8xx: disable controller wakeup on cleanup a12e803d2255 usb: octeon-hcd: fix the FIFO-flush timeout computation e9545dd8bc62 usb: hub: use shorter 120ms post resume hold for SS root hubs e2d62928f266 usb: storage: sierra_ms: reject short SWoC info transfers 5e8980a81af1 USB: serial: fix port tear down use-after-free a0ed07b5bbb2 USB: cdc-acm: skip URB restart in port_shutdown if disconnected 108af6f585dd USB: cdc-acm: fix racy TIOCMIWAIT implementation 9b5b83ca2a66 soc: qcom: geni-se: Correct QUP Core ICC vote constants d54df2de22f9 rust_binder: cancel deferred work items in thread exit f7fb6c2835ed nitro_enclaves: fix use-after-free on SLOT_ALLOC failure c5504e179135 Input: synaptics - limit T440p InterTouch quirk to LEN0036 fc92d4499f3f Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 95e8d0a7b22f Input: s6sy761 - fix resume ordering and restore sensing d79caaf07875 Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 bcfd26841471 Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 0278c68c59b9 kgdboc: Fix tty driver reference leak in configure_kgdboc() 1299cb3fb061 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede 86cdcc87d4ba binder: fix is_failure flag for superseded transaction cleanup 5b113e8ee326 drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU 587469076e4f drm/amdgpu: fix ACP MFD device leak on init failure 7ca44cb14d02 drm/amdgpu: fix IP instance memory leak on kobject add failure b84f1386d84b drm/mediatek: Fix pdev reference leak in mtk_drm_bind() 629458b7e495 drm/mediatek: Fix ovl adaptor platform device leak 88f8a92dcb0c drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device 4d12b763c2c5 drm/radeon: Read the VRAM VBIOS signature with readb() 652f631e2e3a drm/amdgpu/gfx6: fix firmware leak on teardown 36fa4159d005 drm/amd/pm/si: Fix updating clock limits on AC/DC e67aef159f43 drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC 197946faa1b7 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend f3db2853e2a2 PCI: Accept AtomicOps already enabled by the hypervisor f3eaf3191008 spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260 d5a81039adc6 ALSA: ice1712: Fix the error handling via auto-cleanup at probe fc34dd95d3ba ALSA: core: Define auto-cleanup for snd_card_free() 524063fea29f perf: Fix race between perf_event_exit_task() and perf_pending_task() 7648757145aa i2c: at91: release DMA channels when probe defers efd0d161b0cb net: mvneta: clear XDP pfmemalloc flag between frames 53b21bc2df6e ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() f81d40e2eb69 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference 9a76ae59fd63 net: sparx5: make ports inherit the switch base mac address type e3630ff89b77 of: Put coreboot node after compatibility check 47c5ac61e6fb net: microchip: vcap: stop scanning after deleting key field 4033e1a9262c netfilter: flowtable: generalize pending status bit f6143ae109df netfilter: bpf: reject invalid NAT manipulation types 55d033324f67 ipvs: filter some flags received in the backup server 7151f14d5915 ipvs: do not create invisible templates 60e9a6e2ba71 ipvs: fix missing counter decrement in lblc e5633d81b2da tcp: refresh TS.Recent for accepted old ACKs 35c706d6eb19 net: sparx5: skip ptp deinit if init was skipped 297769d75dc6 net: sparx5: move PTP IRQ handling out of sparx5_start() 728138dcfc92 net: sparx5: move stats initialization and add deinit function 387478e9e986 net: sparx5: move MAC table initialization and add deinit function a0a8687eb787 net: sparx5: move VCAP initialization to probe ebb164ae76ad net: sparx5: move netdev and notifier block registration to probe a01c71ab74ea net: phy: qcom: at803x: Fix IPQ5018 short-cable DAC values 82be3d08de9e net: ethernet: mtk_eth_soc: allocate dummy netdev sooner 2f581814e4e3 net: cap skb->queue_mapping when the tx queue is picked 2294b62eaec6 net: bcmgenet: fix NULL dereference in set_coalesce before first open 507c895019a8 net: pcs: rzn1-miic: Clear MIIC protection state before unprotect sequence a4b63808f99a virtio_blk: set the zone write granularity ac4827cf9653 net/sched: sch_codel: match the no-drop threshold to the packet size ab6842a1c7bd net/sched: fq_codel: match the no-drop threshold to the packet size e94970076d29 gve: DQO: accept TSO packets with non-protocol gso_type bits 5069ce898148 net: restrict SO_RESERVE_MEM to TCP sockets and cap max value 358d5ac5a5d5 net: stmmac: fix rx Scatter-Gather support 5847b60561a3 net: stmmac: convert priv->sph* to boolean and rename f78d45d5f1ac net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() f74f100e4958 tipc: prevent GCM nonce reuse on peer key changes adad3ff80e50 octeontx2-af: mcs: Fix SC resource cleanup loop 3a6e67ff267a net/mlx5: Fix slab-out-of-bounds when handling team device events 8438b4f65a17 net: systemport: Fix RUNT MIB counter register offset calculation 96d8b26be5bc net: systemport: Fix buffer overflow in bcm_sysport_get_stats() 7f16443a30f4 Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister 70d2afb55401 netfilter: ipset: do not update comments from kernel-side adds e50eaba0b34b ipv6: fix prefix route expiry in modify_prefix_route() 6598215a1d8e net: bcmgenet: allocate RX buffers as page fragments ebc9611ab154 net/sched: cls_api: reclaim an empty proto on the error path 63120572edde net/mctp: publish the mctp_dev only after it is initialised 380acb097059 ARC: arch_cmpxchg_relaxed to use size of pointed type not pointer a85823b074f9 arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz b0fce76873a5 Bluetooth: btintel: validate DDC record lengths 8ba754621f10 Bluetooth: hci_core: free the HCI ID if naming fails 790730e4d95d blk-mq: set RQF_USE_SCHED when the operation is known 2e8f3fdb0825 blk-mq: factor out a helper blk_mq_limit_depth() c97ef13ad96b block: reject polled dio with user integrity metadata ed389554fe22 ASoC: codecs: rt274: Fix format setting for 44100 rate eb04ba7d9780 ASoC: codecs: rt286: Revert delay value for jack setup 88e96d902efe wifi: mac80211: prevent AP VLAN tx from other interfaces 227ebe48704b wifi: mac80211: Add 802.3 multicast encapsulation offload support 9f4e5abe6bf7 wifi: mac80211: Add multicast to unicast support for 802.3 path dd7973a4130b wifi: cfg80211: preserve hidden-group beacon IE ownership cfd70c9b1984 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() 9cff19ddd7f9 rtc: ac100: Fix clock provider use-after-free on probe failure 00dc50cede96 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak 345ce265cf60 wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE e0c21130c1c7 wifi: ath9k: reject short WMI command responses 9a9467f7cc63 wifi: ath11k: reset ar->num_stations on hardware start 9338b2dea74c wifi: mac80211: drop oversized fragments to avoid extra_len overflow f9d075fa9fba wifi: mac80211: remove RX_DROP f41735133943 ASoC: tegra: Fix ASRC Stream6 input threshold control 71d140099165 wifi: wfx: validate MIB read length before copying to caller 9091199beced ASoC: wm8903: Move the DRC QR threshold to the register that holds it b8cbeda043e4 of/overlay: don't create "//" paths for fragments targeting the root 7a46f1917b32 of/overlay: don't leak fragment references when changeset init fails 2222a8b7dfeb random: fix vgetrandom_opaque_params kernel-doc 541d61d59f19 nvmet: preserve device path on allocation failure f971f1c63cf7 mtd: core: call _get_device() with the master MTD 4c73c1859fa6 iio: accel: kionix-kx022a: Fix array boundary check 489e51034910 iio: light: rohm-bu27034: Fix error return 09a9a2a9548f iio: dac: rohm-bd79703: Do not allow writing SCALE 7899d0530b41 mm/damon/core: don't skip damos_adjust_quota() while esz is not zero 122b8541f511 random: vDSO: avoid call to memset() when zeroing reserved parameter 3f75da1e4ee6 ALSA: line6: reject oversized playback packets 84727facd850 ALSA: caiaq: unregister the input device when probe fails 9cec23424c59 wifi: wlcore: Fix runtime PM leak in wlcore_remove() ad06f7312d3f vt: skip screen update for DEC alignment test on backgroup consoles 037d7e3ca5c5 vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() 233a2e190b12 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF 90c29158159e net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone 7d2ff870f0cf rds_tcp: close NULL deref window in rds_tcp_set_callbacks dc87b56b43c9 mm/huge_memory: initialise workingset state before folio split 9ebb974773bf mm: shmem: ignore sysfs configs for shmem forced collapse 7a1e8daeaa46 virt: vmgenid: set driver_data before registering notification handlers 0af47cb2575d virt: vmgenid: remap memory as decrypted 258310d59a82 module: fix lost error code from codetag_load_module() 512eaf01ffab netfs: zero gaps in read-gaps folio to avoid writing back stale data 96c46c75b0d4 tpm: Disable TPM on null key name mismatch e701345d886e sctp: check RCV_SHUTDOWN after the sendmsg connect wait e0cabda9b6f4 rtc: spear: initialize IRQ state before requesting alarm IRQ 160619b38707 rtc: ac100: Assign .num before accessing .hws 37286a49cc74 r8169: disable EEE on RTL8168h/8111h 69ca64bbb528 net/packet: prevent TX_RING byte count overflow c5f91098edee netfilter: nft_flow_offload: drop flowtable reference on init error path ba56d6f9f1a8 net: phy: aquantia: fix system interface type not updated in forced mode ed997f875d03 net: fix checksum offsets in skb_splice_from_iter() 0d1525fdcd33 of/overlay: only treat a positive changeset id as registered 7dc6a769153c of/overlay: put property on deadprops only after changeset add succeeds 42f6d682e0ab of/irq: Fix remaining refcount leaks in of_irq_init() f7ea1916e8a8 octeontx2-pf: Fix RSS indirection table size 6745fa65f411 kprobes: Skip disarmed probes when checking optkprobe overlap c2733ea2c15a kasan: unpoison task stack below watermark only in generic mode 2ebeba4f9e81 io_uring/zcrx: requeue multishot receives stopped by a local resource 4e9e016c4f49 io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full 0c19a6c1d25f HID: multitouch: stop the release timer from being rearmed on remove 97be6396817b HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request 308db93de666 crypto: x86/aes-gcm - fix always true check for last AAD segment 88633025f20b audit: fix exe mark UAF in kill_rules() 745e83328dd6 ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices 224b56b7c02b smb: client: close completed creates on compound wait errors 78e718c5aa14 cifs: Remove the RFC1002 header from smb_hdr f09875ff901e smb: client: close handle after create-context parsing failure 080573f41950 smb/client: pass cifs_open_info_data to SMB2_open() 7bdc4b7d99a8 smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() 605ef5bd74d0 cifs: on replayable errors back-off before replay, not after 178820984f2c Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table 60ba99f910b7 ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture f44d5d3b7e34 neighbour: Annotate access to neigh_parms fields. 3b91cdacb16b neighbour: Use RCU list helpers for neigh_parms.list writers. df057d89e0cc RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr() b15c79fca280 xfs: don't let memory failures leak blocks and kill repairs 70a7918fda54 smb: client: use finish_no_open() for non-regular inodes 677aeec9783c mm/execmem: make the populate and alloc atomic 7ad8b185dd7e selftests/mm: hugetlb-mremap: add setup of HugeTLB pages 22e82acec93a KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction 81e3f065a648 KVM: arm64: nv: Fix life cycle of the nested_mmus array e18b8236c57f btrfs: initialize inode mapping flags for cached inodes