945bad56c1ff Linux 7.0.12-xanmod1
232039678e8a Merge tag 'v7.0.12' into 7.0
f53879e2e1e2 Linux 7.0.12
4424dbcb06d6 KVM: arm64: Reassign nested_mmus array behind mmu_lock
9121f4605ab9 KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
3c4e4e85e8f1 tools: ynl: add scope qualifier for definitions
023b3294aaf0 usb: core: Fix SuperSpeed root hub wMaxPacketSize
c14c09650e6f mailbox: Fix NULL message support in mbox_send_message()
793c9fd29b14 xhci: tegra: Fix ghost USB device on dual-role port unplug
76502a5905e0 net: phy: micrel: fix LAN8814 QSGMII soft reset
c5b9916fe2e4 hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
75dcee5b34fa hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
f81535cbeabc hwmon: (pmbus) Add support for guarded PMBus lock
32789ab1879c i2c: tegra: make tegra_i2c_mutex_unlock() return void
48125cd9c55c arm64: tlb: Flush walk cache when unsharing PMD tables
19dac2e4f3c8 ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X
f948952aa33a ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx
8acf59fc2a35 rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
aef39da7abf4 platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
8feef9cfcc67 platform/x86/intel/vsec: Make driver_data info const
2f319055d000 platform/x86/intel/vsec: Refactor base_addr handling
3af5fc3f0ac9 Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
7ec3a52d903b serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
dd3dba6c2270 serial: 8250: dispatch SysRq character in serial8250_handle_irq()
b9e9afd7619b serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
4dc9f1517503 serial: zs: Convert to use a platform device
570264885d36 serial: zs: Switch to using channel reset
ae20e5e645de serial: zs: Fix bootconsole handover lockup
5c9fb95c8d64 serial: dz: Convert to use a platform device
c57f1ec7c390 serial: dz: Fix bootconsole handover lockup
60d725ad9ef3 serial: dz: Fix bootconsole message clobbering at chip reset
967a00b8e06a drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
2fd24407457a drm/amdgpu: fix amdgpu_hmm_range_get_pages
f0d97cd47610 drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
8f643d534ffc drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
bbb5dfdb729f drm/amdkfd: Check for pdd drm file first in CRIU restore path
4f9eeedc3d31 drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
c24eee21f9a9 drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
e9007b39697f serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
b27bf2721065 serial: zs: Fix swapped RI/DSR modem line transition counting
92c3a2aa6141 serial: sh-sci: fix memory region release in error path
0d2c41a8b009 serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ
d90cfd656cb6 serial: qcom-geni: fix UART_RX_PAR_EN bit position
f71e3567c30e serial: altera_jtaguart: handle uart_add_one_port() failures
bde1b7af764b drm/amd/pm/si: Disregard vblank time when no displays are connected
a29654d451bb drm/i915: Fix potential UAF in TTM object purge
9e7e6a073f1d drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable
eec121219705 drm/i915/psr: Block DC states on vblank enable when Panel Replay supported
b09f70cec428 drm/i915/color: Fix HDR pre-CSC LUT programming loop
cde2c9257cbe drm/gem: fix race between change_handle and handle_delete
c8974d96b6a5 drm/hyperv: validate VMBus packet size in receive callback
8a114b25b552 drm/hyperv: validate resolution_count and fix WIN8 fallback
c04e85799356 scsi: target: iscsi: Validate CHAP_R length before base64 decode
26e4a304b7e6 scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
5118ea225fe6 scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
bdff76dff6ec scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
d537d29d51c8 scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
ed9455ef4bd9 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
3bec49ca55e0 thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
a47784aee77f thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
552dae28dbeb usb: gadget: f_fs: serialize DMABUF cancel against request completion
23c1f7deb9dd usb: gadget: f_fs: copy only received bytes on short ep0 read
4108ae71c462 usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
a20f0ccf4570 usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
9a98013e552c usb: gadget: f_hid: fix device reference leak in hidg_alloc()
db2b72e83a02 usb: gadget: net2280: Fix double free in probe error path
5f1b9cff8898 usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
ed260b56bc9f USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
57f332af1745 USB: serial: mct_u232: fix memory corruption with small endpoint
b40166b4ef96 USB: serial: mxuport: fix memory corruption with small endpoint
f7f566ad7519 USB: serial: keyspan: fix missing indat transfer sanity check
9469419b12a1 USB: serial: digi_acceleport: fix memory corruption with small endpoints
4a4cb0021ebe USB: serial: cypress_m8: validate interrupt packet headers
db1e7eb6203d USB: serial: belkin_sa: validate interrupt status length
523fb491eb2e USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
b690447cceb0 USB: serial: option: add MeiG SRM813Q
11a11f4465ea usb: typec: ucsi: Don't update power_supply on power role change if not connected
59fe90deafae usb: typec: ucsi: Check if power role change actually happened before handling
1ce69d85f408 usb: typec: tcpm: improve handling of DISCOVER_MODES failures
a1d938a01579 usb: typec: tipd: Fix error code in tps6598x_probe()
b28f49c764de usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
f141b01eaa58 usb: usbtmc: check URB actual_length for interrupt-IN notifications
207bf80362df usbip: vudc: Fix use after free bug in vudc_remove due to race condition
254a7139d9d7 usb: storage: Add quirks for PNY Elite Portable SSD
8e7a61e2672f USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
d53e4c41331f usb: musb: omap2430: Fix use-after-free in omap2430_probe()
bd58581f4796 usb: dwc3: xilinx: fix error handling in zynqmp init error paths
1173b5d51481 usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
b6efc5c7ad7f usb: chipidea: core: convert ci_role_switch to local variable
e344865bfca4 uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory
9c92b4220797 tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
d8d53a343ebe tty: serial: pch_uart: add check for dma_alloc_coherent()
a5e0360c5f97 counter: Fix refcount leak in counter_alloc() error path
ac1dc0845791 comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
7085a1076a48 comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
6c3d07ca8ebd dt-bindings: usb: Fix EIC7700 USB reset's issue
38f4e149d864 Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
6c6b989b4ebf Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
9f608ae5ea78 misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
4f7c131d2bdd ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
022324b61b03 Input: xpad - add support for ASUS ROG RAIKIRI II
133d03cc0637 Input: xpad - add "Nova 2 Lite" from GameSir
b569f86e2f8d dma-buf: fix UAF in dma_buf_fd() tracepoint
dfb9f6cbfa98 xfrm: iptfs: reset runtime state when cloning SAs
cf9d4327d85e ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
65f3b3fc2347 xfrm: esp: restore combined single-frag length gate
423ce1608292 ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
ba6b723d6da9 ASoC: qcom: q6asm-dai: close stream only when running
d67c6adee8d1 netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
fa70b0429ee0 ALSA: firewire-motu: Protect register DSP event queue positions
165431d2b320 ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
17135b223b22 xfrm: ah: use skb_to_full_sk in async output callbacks
b30aa173c380 xfrm: ipcomp: Free destination pages on acomp errors
26ce8dbf2e23 xfrm: route MIGRATE notifications to caller's netns
83b1362edc9d nfc: hci: fix out-of-bounds read in HCP header parsing
f92942a28ea8 iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
5db3fca0cec7 HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
85b710b68297 spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
474d6c771d79 net: skbuff: fix missing zerocopy reference in pskb_carve helpers
ee1778ba0f5c ip6: vti: Use ip6_tnl.net in vti6_changelink().
782d60a6596a l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
9f67a36e91bb xfrm: input: hold netns during deferred transport reinjection
eb18a1b1644e ipv6: validate extension header length before copying to cmsg
596f6354c96a ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
9b6dcc0a39fd ipv6: exthdrs: refresh nh after handling HAO option
68be0260e2a0 octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
b43217090d9a ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
2b56bbd928c0 ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
d55acbe577db macsec: fix replay protection at XPN lower-PN wrap
63f64a510c79 bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
ccd153ee4fe9 wireguard: send: append trailer after expanding head
9edff632ca21 x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
9b694bc0e183 i2c: davinci: fix division by zero on missing clock-frequency
d97baee9590e Input: elan_i2c - validate firmware size before use
6d0b79d1d111 usb: dwc2: Fix use after free in debug code
3087c0227e8b usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles
fcadb0ec13c7 usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
6e16e3f3232e usb: cdns3: gadget: fix request skipping after clearing halt
f34cf2928387 USB: serial: omninet: fix memory corruption with small endpoint
96cdeaba6a00 iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
9319c94f63ed iio: buffer: hw-consumer: fix use-after-free in error path
ebe14cfea488 iio: light: cm3323: fix reg_conf not being initialized correctly
2c50c017df97 iio: chemical: scd30: fix division by zero in write_raw
ea69e7a6efa8 iio: chemical: mhz19b: reject oversized serial replies
4fda8295f47d iio: Fix iio_multiply_value use in iio_read_channel_processed_scale
a4762f4b4234 iio: light: veml6070: Fix resource leak in probe error path
5c154b5cc4a9 iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
37d58ba38711 iio: temperature: tsys01: fix broken PROM checksum validation
6f9540b85f05 iio: ssp_sensors: cancel delayed work_refresh on remove
5a42e39606b9 iio: gyro: adis16260: fix division by zero in write_raw
cfc3283859cf iio: gyro: itg3200: fix i2c read into the wrong stack location
f96cbc8834f3 iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
ad64b14c120d iio: adc: nxp-sar-adc: Avoid division by zero
cb6ea15e7d3c iio: adc: nxp-sar-adc: fix division by zero in write_raw
b5510573ebcb iio: adc: ad4695: Fix call ordering in offload buffer postenable
72434c1eece2 iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
a72f8e51d6ee iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
dfa3246da40e iio: dac: ad5686: fix powerdown control on dual-channel devices
4add35e88629 iio: dac: ad5686: acquire lock when doing powerdown control
a4cb12d9bd77 iio: dac: ad5686: fix input raw value check
b090925bd8f7 iio: dac: ad5686: fix ref bit initialization for single-channel parts
b4af7b67989f iio: dac: max5821: fix return value check in powerdown sync
e4ada55bf8d7 iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
3e419ace2ee2 iio: adc: npcm: fix unbalanced clk_disable_unprepare()
5518375b5fa7 iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
de94e8be5ebe Disable -Wattribute-alias for clang-23 and newer
566eef0eba04 gpio: shared: fix lockdep false positive by removing unneeded lock
a554dfcd30dd gpio: shared: fix deadlock on shared proxy's parent removal
08931fed78f7 gpio: shared: undo the vote of the proxy on GPIO free
0e96728fd00f KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
edbbe88f83b5 KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
505a3b945355 KVM: SEV: Check PSC request indices against the actual size of the buffer
6644565527c4 KVM: SEV: Compute the correct max length of the in-GHCB scratch area
e0cb2a6f9c35 KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
2d62ae9fbbf3 KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests
c30cde934c78 KVM: SEV: Ignore Port I/O requests of length '0'
b328ede59ac3 KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
4fb3571242a5 KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
14d24d35801a KVM: arm64: PMU: Preserve AArch32 counter low bits
742a9b5ccd8c KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
9494d9428dfa USB: cdc-acm: Fix bit overlap and move quirk definitions to header
26b749e07fc9 rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN
1e0973066397 rust_binder: Avoid holding lock when dropping delivered_death
a1e81b58da01 parport: Fix race between port and client registration
6346b0895b57 Input: xpad - fix out-of-bounds access for Share button
380e67b1794a Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
242c3f2a4995 Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
a59d4f4217e6 Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
51cb9dcfdf9a Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
1a6b803b00cc Bluetooth: ISO: fix UAF in iso_recv_frame
b83dcacd2ec7 Bluetooth: HIDP: fix missing length checks in hidp_input_report()
08d81fe96f80 Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
7555fd885a06 Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
f9f041b8f4e9 smb: client: fix uninitialized variable in smb2_writev_callback
6ad4f75ef9f3 auxdisplay: line-display: fix OOB read on zero-length message_store()
f611db9b771b mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one
ebe2cbefc862 zram: fix use-after-free in zram_writeback_endio
555702282d45 memfd: deny writeable mappings when implying SEAL_WRITE
24861d04f197 mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page
45280786c8d9 mm: memcontrol: propagate NMI slab stats to memcg vmstats
bd4be70669af ipc: limit next_id allocation to the valid ID range
2c33177023c9 mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
4f37bb30b57d hpfs: fix a crash if hpfs_map_dnode_bitmap fails
ad7eff07b625 mm/vmalloc: do not trigger BUG() on BH disabled context
78ba05b28637 Bluetooth: btusb: Allow firmware re-download when version matches
277a1e4b7bf7 HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
6c13f3bb652b USB: serial: cypress_m8: fix memory corruption with small endpoint
169ae421a107 Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
5cc3f6db72f7 media: rc: igorplugusb: fix control request setup packet
857b3cc73f91 USB: serial: safe_serial: fix memory corruption with small endpoint
5af2719b460a usb: typec: ucsi: validate connector number in ucsi_connector_change()
c4ab8e2d4432 usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
3f9d50c8b02b usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
77a759ec30bc usb: typec: altmodes/displayport: validate count before reading Status Update VDO
52d518f7130b usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
cbad85b446c0 usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
ed8649f3822e usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
c8460de584fe usb: typec: ucsi: ccg: reject firmware images without a ':' record header
58dfb6fe9dc8 iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
c2c255444392 iio: imu: adis16550: fix stack leak in trigger handler
890d0312d5f9 iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
c03affe0700a drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
bb7ede8b396e drm/i915/psr: Read Intel DPCD workaround register
a21a0a1c269c drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
e9bac19cab74 Revert "x86/fpu: Refine and simplify the magic number check during signal return"
99a55c7cde83 Revert "ipv6: preserve insertion order for same-scope addresses"
cc3b31258602 net: skbuff: fix pskb_carve leaking zcopy pages
9b9d5bd6e3d4 ipv6: fix possible infinite loop in fib6_select_path()
5e40de719ee7 ipv6: fix possible infinite loop in rt6_fill_node()
5d317573f1d4 vsock/virtio: bind uarg before filling zerocopy skb
a7df36f01463 net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
6140cfa72145 sctp: fix race between sctp_wait_for_connect and peeloff
7ae590797f9b net: mana: Skip redundant detach on already-detached port
0a9c520fdcb1 net: mana: Add NULL guards in teardown path to prevent panic on attach failure
6be81e77e174 gpio: rockchip: teardown bugs and resource leaks
4b1ecc12de18 gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
2ebd4ad675c9 gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write()
b603136707ad gpio: adnp: fix flow control regression caused by scoped_guard()
3bc067d1b92f Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
60bceb9a4c69 Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
d153b8898c00 Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
8e7977afaef3 Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
e7a33807fb3f dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work
5e5a40e625b8 dpll: export __dpll_device_change_ntf() for use under dpll_lock
faf6eaa4bbe9 dpll: zl3073x: add die temperature reporting for supported chips
f22e18e64301 dpll: zl3073x: detect DPLL channel count from chip ID at runtime
8c35539db0ab net/handshake: Drain pending requests at net namespace exit
16eaba5aa89c net/handshake: Take a long-lived file reference at submit
c06876d4fac3 net/handshake: hand off the pinned file reference to accept_doit
a5704c81af65 net/handshake: Pass negative errno through handshake_complete()
b1127c08dd71 nvme-tcp: store negative errno in queue->tls_err
91898de9501a net/handshake: Use spin_lock_bh for hn_lock
fba9d0f5c3eb net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path
e85672cbf30c net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
e9a28b511a47 net/sched: act_mirred: Fix return code in early mirred redirect error paths
34457de389fb net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow
45ac526a0d57 net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
471710246993 net: Introduce skb tc depth field to track packet loops
cfb261604276 net/sched: fix packet loop on netem when duplicate is on
4e208db021de net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"
c0487a9c1e11 ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
4fe1bc4b3603 ethtool: eeprom: add more safeties to EEPROM Netlink fallback
0cf91f8ef78c ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback
2b6a4816c4e1 ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
d0d2c5ccd1de ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
e7fd0d3b2b1b ethtool: tsinfo: fix uninitialized stats on the by-PHC path
d53fe379d1f9 ethtool: tsconfig: fix missing ethnl_ops_complete()
fa589c1b354d ethtool: pse-pd: fix missing ethnl_ops_complete()
abfeaefba218 ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error
33f38055cc12 ethtool: tsconfig: fix reply error handling
6205f7166d2d ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
2f9cb30d97e4 bridge: Fix sleep in atomic context in sysfs path
803d39accfbd bridge: Fix sleep in atomic context in netlink path
563090e5d450 bonding: refuse to enslave CAN devices
2061d080a013 Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
f1a32b2056c6 drm/xe: Restore IDLEDLY regiter on engine reset
05ef77f02607 ASoC: codecs: simple-mux: Fix enum control bounds check
aef151bcfa49 ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
cb549df9ce4e tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
a493efd4336c vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
f3f204541f28 tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
d8fe497f5afb blk-mq: reinsert cached request to the list
bd4ca2e3b875 cxl/test: Update mock dev array before calling platform_device_add()
739efd8c2add ethtool: cmis: validate fw->size against start_cmd_payload_size
a46340da0038 ethtool: cmis: validate start_cmd_payload_size from module
ad75c54341c6 ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
eb5dcd740cd7 ethtool: cmis: require exact CDB reply length
6efed7de0011 ethtool: module: fix cleanup if socket used for flashing multiple devices
7dc869f7a246 ethtool: module: check fw_flash_in_progress under rtnl_lock
01b489b6033f ethtool: module: avoid racy updates to dev->ethtool bitfield
956b134d917f ethtool: module: avoid leaking a netdev ref on module flash errors
e96ef1a40dda ethtool: module: call ethnl_ops_complete() on module flash errors
057d5a50a37d ethtool: rss: avoid device context leak on reply-build failure
566e7dbdd899 ethtool: rss: fix hkey leak when indir_size is 0
80d95d92f828 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
a4dd2f6075b6 ethtool: rss: fix falsely ignoring indir table updates
e5f7d5444f8e ethtool: rss: add missing errno on RSS context delete
7c8bdc52a05d ethtool: rss: avoid modifying the RSS context response
611a027ab0a2 net: Avoid checksumming unreadable skb tail on trim
ef1add674623 drm/i915/aux: use polling when irqs are unavailable
891213feacdf gpio: mxc: fix irq_high handling
4193221708b4 accel/ivpu: prevent uninitialized data bug in debugfs
78607a6854a2 net: hsr: fix potential OOB access in supervision frame handling
474433175b68 net/mlx5: HWS: Reject unsupported remove-header action
43ffe5230d86 ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
be387230dc22 ALSA: pcm: oss: Fix setup list UAF on proc write error
d3d04dc55f55 ALSA: hda: cs35l56: Fix system name string leaks
155f90be5ee8 ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
b0c6eef21d07 scsi: scsi_debug: Add missing newline in scsi_debug_device_reset()
c740e13e7fe3 scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues
69554adc7a6f net/iucv: fix locking in .getsockopt
5ec939367e70 net/smc: Do not re-initialize smc hashtables
0572988b1efb net: netlink: don't set nsid on local notifications
52f2c4bf0053 net: netlink: fix sending unassigned nsid after assigned one
51372a2d179e vsock: keep poll shutdown state consistent
4fefc6156a16 tun: free page on build_skb failure in tun_xdp_one()
18a84c35842e tap: free page on error paths in tap_get_user_xdp()
98c67be9eb9d tun: free page on short-frame rejection in tun_xdp_one()
a391afe74398 netfilter: nf_tables: fix dst corruption in same register operation
fcc4c043d137 netfilter: ebtables: fix OOB read in compat_mtw_from_user
9788f953df27 netfilter: xt_cpu: prefer raw_smp_processor_id
a91887a5b6ee netfilter: synproxy: refresh tcphdr after skb_ensure_writable
451f1ccbbdb7 accel/rocket: fix UAF via dangling GEM handle in create_bo
0636c2c1a5d1 kunit: fix use-after-free in debugfs when using kunit.filter
2f03bab3a794 HID: remove duplicate hid_warn_ratelimited definition
5e77af119ec8 tools/bootconfig: Fix buf leaks in apply_xbc
ff00567123fe nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
3db50ceeacb5 xfrm: Check for underflow in xfrm_state_mtu
b2a60f7f846f nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
bc421d0826de nfc: llcp: Fix use-after-free in llcp_sock_release()
cb0771fd48f9 bcache: fix uninitialized closure object
9ad3288632c8 net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
d14ae8ef88c2 xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
43b7c5728131 ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
614cb8c26c5a ACPI: button: Fix ACPI GPE handler leak during removal
7585b6aa55d8 Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size