1c3a3f933af7 Linux 7.0.13-xanmod1
1256ac68f4df Merge tag 'v7.0.13' into 7.0
9ab336db39b4 Linux 7.0.13
dd03ceed9fc7 drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
cea435ea7e86 netfilter: require Ethernet MAC header before using eth_hdr()
cfd5fc814790 vsock/virtio: fix skb overhead overflow on 32-bit builds
7da48313876e arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
d3f35d35395f arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
1b47b1e1d867 arm64: errata: Mitigate TLBI errata on various Arm CPUs
f4a5047bd5da arm64: cputype: Add C1-Premium definitions
ac43953460bd arm64: cputype: Add C1-Ultra definitions
7bc71bdb1c15 debugobjects: Don't call fill_pool() in early boot hardirq context
33bee10644f8 debugobjects: Do not fill_pool() if pi_blocked_on
bf77b970ca92 vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
100d5b2ffdc6 vsock/virtio: fix potential unbounded skb queue
ac1aad8e1281 RDMA/umem: Fix truncation for block sizes >= 4G
443a201d1612 RDMA: Move DMA block iterator logic into dedicated files
ed76110b7687 RDMA/umem: fix kernel-doc warnings
1ab978a4d2a6 wifi: mac80211: tests: mark HT check strict
002868623c9a wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode
bc75f5951fac sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
3544210609f6 netfilter: nft_fib: fix stale stack leak via the OIFNAME register
50334a05a950 RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
fcb813b12e5b driver core: reject devices with unregistered buses
a7b01a2dfc6d driver core: faux: fix root device registration
bfcc8e8d8a49 fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
de988c7a31f0 drm/amd/display: Use krealloc_array() in dal_vector_reserve()
dc1490927d79 drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
c90954cdea4d drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
98abb179dd51 drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
8aaa7e317fbd drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
98cfb7530ea9 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
2645e3caf7e0 drm/amd/display: Bound VBIOS record-chain walk loops
65c7bff058b3 drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range
8f634181b538 drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
f02262d654f9 drm/amd/pm: fix smu13 power limit default/cap calculation
0fc1c46182fc drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload
7e8fb27dcdb2 drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems
fafd80c0ab64 drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)
1cab68645385 drm/amdgpu: restart the CS if some parts of the VM are still invalidated
6f25f07271a8 drm/amdgpu: fix waiting for all submissions for userptrs
11e643283639 drm/v3d: Skip CSD when it has zeroed workgroups
60ebeb23eaf3 drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
ed2eaf3b7b18 drm/v3d: Fix global performance monitor reference counting
bdc2a495659f drm/v3d: Wait for pending L2T flush before cleaning caches
8bff5f60f0bd drm/xe: Clear pending_disable before signaling suspend fence
91cffc74c61c drm/xe/multi_queue: skip submit when primary queue is suspended
238bcdaae8f2 drm/xe/display: fix oops in suspend/shutdown without display
d02f05d30f35 drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
e1965e8913cf drm/amdkfd: fix NULL dereference in get_queue_ids()
da8f42b770a3 drm/i915: Fix color blob reference handling in intel_plane_state
1d9b93df7fc7 drm/gem: Try to fix change_handle ioctl, attempt 4
9708eb50fd73 slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
2c175bd3e214 slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
c631c792dfc5 slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
1d905fcdecdb slimbus: qcom-ngd-ctrl: Initialize controller resources in controller
08564e15c47a slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
ef46953ed73d slimbus: qcom-ngd-ctrl: Fix probe error path ordering
95ec4af8606f slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
6d717b1c1da9 slimbus: qcom-ngd-ctrl: fix OF node refcount
b2c1e5d9f159 thunderbolt: Limit XDomain response copy to actual frame size
07cd2787cdf8 thunderbolt: Validate XDomain request packet size before type cast
906035d5c378 thunderbolt: Clamp XDomain response data copy to allocation size
cbeb68cbaa0a thunderbolt: Bound root directory content to block size
3b6e68cb97f7 thunderbolt: Reject zero-length property entries in validator
1c6773b8c081 sctp: stream: fully roll back denied add-stream state
f5af203dec6e sctp: diag: reject stale associations in dump_one path
224298450be5 rxrpc: Fix the ACK parser to extract the SACK table for parsing
b8ebad1c381b rtase: Reset TX subqueue when clearing TX ring
22eb056ad0af rtase: Avoid sleeping in get_stats64()
aee95f4c4116 pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source
20e4711543be pmdomain: imx: fix OF node refcount
5dbe75a30b66 mmc: sdhci: add signal voltage switch in sdhci_resume_host
d3ee5a7857b9 mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin EIC7700
9560658351b6 mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
969e6d40f7ee mmc: litex_mmc: Set mandatory idle clocks before CMD0
8d9eca906e76 mmc: dw_mmc-rockchip: Add missing private data for very old controllers
ef27769d1bd8 mmc: core: Fix host controller programming for fixed driver type
3481d4372ae3 mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
2b66496d794e mm/list_lru: drain before clearing xarray entry on reparent
45e33d43243d mm/hugetlb: restore reservation on error in hugetlb folio copy paths
9e7d081e4eef mm/hugetlb: avoid false positive lockdep assertion
d7251c8d3f7c mm/huge_memory: use correct flags for device private PMD entry
635b45ce61de mm/damon/reclaim: handle ctx allocation failure
daab1996431a mm/damon/lru_sort: handle ctx allocation failure
f0b145c8793e mm/cma_debug: fix invalid accesses for inactive CMA areas
628b937f07bd mm/cma: fix reserved page leak on activation failure
6a4771b7e817 pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
3282ddeccb06 octeontx2-af: fix memory leak in rvu_setup_hw_resources()
4f27eb01619c nvmem: layouts: onie-tlv: fix hang on unknown types
40e2a459c0dd nvmem: core: fix use-after-free bugs in error paths
fdc5471f28ab net: sfp: initialize i2c_block_size at adapter configure time
27040bbca289 net: rds: clear i_sends on setup unwind
bff309ea51f1 net: phonet: free phonet_device after RCU grace period
8aec66ab997e net: mv643xx: fix OF node refcount
b0878106ddc4 net: bonding: fix NULL pointer dereference in bond_do_ioctl()
cdb96c42db7b net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()
1d879ad103c3 net/mlx5: Reorder completion before putting command entry in cmd_work_handler
380b1128be0c firmware: samsung: acpm: Fix mailbox channel leak on probe error
d77583ca3329 misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
7ba7b30ddb04 misc: fastrpc: fix DMA address corruption due to find_vma misuse
f20f6512ecb7 misc: fastrpc: fix use-after-free race in fastrpc_map_create
fbe0947420ee misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
aaa81625d605 memory: atmel-ebi: Allow deferred probing
00731bd7e18f memcg: use round-robin victim selection in refill_stock
55363fa0a045 locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
030bbc857bd5 ipc/shm: serialize orphan cleanup with shm_nattch updates
b16f8d40bac9 iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
1ad453817a40 iomap: avoid potential null folio->mapping deref during error reporting
7ba17e6bc3b1 Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
8ce2a32b019f Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
51b5a8f03f45 i2c: tegra: Fix NOIRQ suspend/resume
0046f371c91d i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
8ce7ff721a5e i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
c8f5269c1bf5 i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
649936c74948 i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()
1f2f3f3eacd6 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
1fb8735a3a4d fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
e692f0cb8620 fuse: reject fuse_notify() pagecache ops on directories
d01b1a3952d5 fs/qnx6: fix pointer arithmetic in directory iteration
70090a32f56a accel/ethosu: reject NPU_OP_RESIZE commands from userspace
fb25c76a820c accel/ethosu: reject DMA commands with uninitialized length
6bb73845d185 accel/ethosu: fix arithmetic issues in dma_length()
0c50186a1554 accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85
ee7bed779def accel/ethosu: fix IFM region index out-of-bounds in command stream parser
db6cb3e35ceb accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()
86acde276437 s390: Remove GENERIC_LOCKBREAK Kconfig option
6f6864758a45 pidfd: refuse access to tasks that have started exiting harder
e7051909a01b ovl: keep err zero after successful ovl_cache_get()
010c3313a4d1 inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
1ca40b243277 IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
8e59c22329ae hv: utils: handle and propagate errors in kvp_register
a8ed2c29fcfd fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
321ab33f8393 Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
580844a9683a bnxt_en: Fix NULL pointer dereference
7264a118e5a4 ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
542d65a6dbd9 staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
303f65af819f staging: rtl8723bs: fix buffer over-read in rtw_update_protection
2b192ad757c3 spi: qcom-geni: Fix cs_change handling on the last transfer
d338e61ea940 timers/migration: Fix livelock in tmigr_handle_remote_up()
9698582a4dd9 vsock/vmci: fix sk_ack_backlog leak on failed handshake
ecbf3c45add3 wifi: nl80211: reject oversized EMA RNR lists
46237e3b524b wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used
c12da588f084 xfs: fix rtgroup cleanup in CoW fork repair
49caf3a67bf9 xfs: fix error returns in CoW fork repair
904364a4314b mptcp: add-addr: always drop other suboptions
309ae37f5d33 selftests: mptcp: add test for extra_subflows underflow on userspace PM
9044d167e8af mptcp: sockopt: set sockopt on all subflows
ea9485be76e1 mptcp: sockopt: check timestamping ret value
333f17c1782d mptcp: check desc->count in read_sock
b715f6576fa2 mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
c297a4e65c50 mptcp: allow subflow rcv wnd to shrink
8f4f0a157e84 mptcp: close TOCTOU race while computing rcv_wnd
116173e85146 mptcp: fix retransmission loop when csum is enabled
6804a8204e9e mptcp: fix missing wakeups in edge scenarios
aaa688ac9f18 arm64: mm: call pagetable dtor when freeing hot-removed page tables
2a4dc9a0ac33 ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
36da6043572d ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
5de8003ed03d ARM: socfpga: Fix OF node refcount leak in SMP setup
7d6d92d000eb udp: clear skb->dev before running a sockmap verdict
198b5a14cca2 zram: fix use-after-free in zram_bvec_write_partial()
3523e53ff95f RDMA/srp: bound SRP_RSP sense copy by the received length
0efbb6b54ff5 RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
aa181287ebdc RDMA/core: Validate the passed in fops for ib_get_ucaps()
46ac15788096 mm/huge_memory: update file PUD counter before folio_put()
a8ea042c1f9a mm/damon/ops-common: call folio_test_lru() after folio_get()
ed5b03093129 mm/huge_memory: update file PMD counter before folio_put()
9b0104625451 drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
c0fffc874c26 drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
4973232a67e4 io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
6e069b95e130 io_uring/kbuf: don't truncate end buffer for bundles
6d04b1d5ab32 io_uring/wait: fix min_timeout behavior
306427adf9b9 ALSA: timer: Fix UAF at snd_timer_user_params()
60e73ab87b84 ALSA: timer: Forcibly close timer instances at closing
bde742b076cb USB: serial: kl5kusb105: fix bulk-out buffer overflow
7b57876a8e29 USB: serial: option: add usb-id for Dell Wireless DW5826e-m
5a79b634ee58 USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
d214d2341d4f USB: serial: io_ti: fix heap overflow in get_manuf_info()
822b98d354e6 xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
c885d111ed9f xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
37487d55bf33 xfrm: espintcp: do not reuse an in-progress partial send
2b2eda2821cf ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
3a13bb9540df pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
fe7221b43464 hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
dd51a2eeb93b drm/i915/gem: Fix phys BO pread/pwrite with offset
d65c94cabcd3 KVM: arm64: Restore POR_EL0 access to host EL0
85a1b51c5582 KVM: arm64: Correctly identify executable PTEs at stage-2
b95976c2ea44 KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
097eaeb6e7ec KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA
99d7d43784ae KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
c50aef6de02b mshv: add a missing padding field
5f7aa05c5dec cfi: Include uaccess.h for get_kernel_nofault()
ce315069a4ea mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
c5216c3a3754 rust: kasan/kbuild: fix rustc-option when cross-compiling
7de13410f59e rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
2620c0a988bb ARM: Do not select HAVE_RUST when KASAN is enabled
c2d3f16343f5 rust: x86: support Rust >= 1.98.0 target spec
b69b715f48ac Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend"
290f1bc13224 cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask calculation
54c54537623c tracing/probes: Point the error offset correctly for eprobe argument error
ba096aad386d tracing: Fix CFI violation in probestub being called by tprobes
2821bf2b79e4 accel/ivpu: Fix signed integer truncation in IPC receive
4e5047cc94be accel/ivpu: Add buffer overflow check in MS get_info_ioctl
6bc249d32424 firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe
820fd80cc121 firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported
84f8348dade3 firmware: stratix10-svc: Don't fail probe when async ops unsupported
535da9ad8420 accel/ivpu: Add bounds checks for firmware log indices
f8ab60ae9309 accel/ivpu: Add bounds check for firmware runtime memory
9c2a9c6f930f Revert "drm/xe/nvls: Define GuC firmware for NVL-S"
bf7ba8f96c25 mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
2f016b33ae1e soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
e2b8acf9405b Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
cdd8bbdbee76 Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
dbf779db9274 tee: shm: fix shm leak in register_shm_helper()
f1e81d571e37 netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
f9a0e4b61054 netfilter: nft_tunnel: fix use-after-free on object destroy
50cd49d3406f namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories
21dfec599391 accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
35b4d137d25c drm/xe: fix job timeout recovery for unstarted jobs and kernel queues
667f5fc1cd0b drm/xe: fix refcount leak in xe_range_fence_insert()
297cc20ee2db drm/amd/display: use plane color_mgmt_changed to track colorop changes
dc5b1582adc0 drm/atomic: track individual colorop updates
546c2badf512 drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable
6c513c4d5051 drm/colorop: Remove read-only comments from interpolation fields
4fc692dc6df5 drm/vc4: fix krealloc() memory leak
15e561869a8b drm/virtio: Fix driver removal with disabled KMS
914b780ecf31 drm/i915/edp: Check supported link rates DPCD read
de4473a5b836 clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
8ece0881aae1 clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
cd87ed9bdff9 clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked
9a4895059bb6 ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions
653a28493057 ipv6: Fix a potential NPD in cleanup_prefix_route()
3e72906b4dc1 net: txgbe: initialize PHY interface to 0
9512581cadfd net: txgbe: distinguish module types by checking identifier
04bbab66415d net: txgbe: initialize module info buffer
fe0203c8efd9 net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
02e1b5c4d3b4 net: mvpp2: refill RX buffers before XDP or skb use
9545cc5ef18c net: mvpp2: limit XDP frame size to the RX buffer
e302206ad84a net: mvpp2: sync RX data at the hardware packet offset
f08fb3d42fd3 netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
65ef7397eb9a netfilter: nf_log: validate MAC header was set before dumping it
fb0521aff1e1 netfilter: x_tables: avoid leaking percpu counter pointers
bf8c0b5dd203 netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
d4b1301fd3c9 netfilter: revalidate bridge ports
1b7311da1d69 spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
42aca70f24a3 rds: mark snapshot pages dirty in rds_info_getsockopt()
2fc7bc087cc7 ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
aa03698bb28d ptp: ocp: fix resource freeing order
585cb85e9a29 tun: zero the whole vnet header in tun_put_user()
4fd346695580 net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
eb51a9ad3ceb net: guard timestamp cmsgs to real error queue skbs
512a9bb77c04 sctp: validate embedded INIT chunk and address list lengths in cookie
dcdce3bc9f08 ip6_vti: set netns_immutable on the fallback device.
8e86817b8af4 sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
f157d7c76cbf ASoC: SOF: amd: fix for ipc flags check
e705b8ff4dd3 esp: fix page frag reference leak on skb_to_sgvec failure
2a4886497ff4 net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission
d90feaa3f74b net: mctp: usb: fix race between urb completion and rx_retry cancellation
1f34ea5f6114 gpio: rockchip: fix generic IRQ chip leak on remove
4135af98f7c5 gpio: zynq: fix runtime PM leak on remove
43d77ec8bb9e r8152: handle the return value of usb_reset_device()
895d1dd9057c net: openvswitch: fix possible kfree_skb of ERR_PTR
cb658c2f5f79 ipv6: sit: reload inner IPv6 header after GSO offloads
13f71a217846 net/mlx5: Use effective affinity mask for IRQ selection
0aabca726b43 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
2398e497389e net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
3b20ec8f31e8 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
ef8d739eee6f net: phy: don't try to setup PHY-driven SFP cages when using genphy
019891799dbf net: phy: Clean the phy_ports after unregistering the downstream SFP bus
6370184de82a net: phy: remove phy ports upon probe failure
0b27701ce931 net: phy: clean the sfp upstream if phy probing fails
9b019376cbee netdev: fix double-free in netdev_nl_bind_rx_doit()
c12584cd6078 net: ibm: emac: Fix use-after-free during device removal
8a6108cc4e7c net/mlx4: avoid GCC 10 __bad_copy_from() false positive
848571dcbbbe net: add pskb_may_pull() to skb_gro_receive_list()
c68517a3e18e tcp: restrict SO_ATTACH_FILTER to priv users
6effd6f7b0ba ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
c9677a9274ff gpio: mvebu: fix NULL pointer dereference in suspend/resume
ccfe292a9660 netlabel: validate unlabeled address and mask attribute lengths
bf9b87e3ba65 bnge: fix context mem iteration
7706868b6a3c net: ena: PHC: Add missing barrier
3e5e66923557 idpf: fix mailbox capability for set device clock time
b8dfa5c4ad91 ice: fix missing priority callbacks for U.FL DPLL pins
ec82ea4eb220 xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
4b340c533124 dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
ac3e23900e4f dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments
ff2ee35b6ce5 xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
07e722fa87a5 riscv: cfi: reject unknown flags in PR_SET_CFI
08200bef0983 riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
cdca3bd6f26d verification/rvgen: Fix ltl2k writing True as a literal
f094e7ccee5f verification/rvgen: Fix options shared among commands
9b5436025e5a tools/rv: Fix cleanup after failed trace setup
f6cb782aa2f2 tools/rv: Fix substring match when listing container monitors
23a6fee3270b tools/rv: Fix substring match bug in monitor name search
2ca64127c725 tools/rv: Ensure monitor name and desc are NUL-terminated
0381183e65de rtla: Fix parsing of multi-character short options
74b5580aca02 cpufreq/amd-pstate: drop stale @epp_cached kdoc
f7a7ec6c9a97 x86/resctrl: Only check Intel systems for SNC
6676b6063440 ALSA: seq: dummy: fix UMP event stack overread
7c71a9522555 ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
93bfac936c72 time: Fix off-by-one in settimeofday() usec validation
e12d20a63b61 rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()
c6bd2f7fe6c4 crypto: s390 - add select CRYPTO_AEAD for aes
ee1f40759a50 VFS: fix possible failure to unlock in nfsd4_create_file()
cc16caf0ddb2 hyperv: Clean up and fix the guest ID comment in hvgdk.h
2969ae6e1c78 regulator: mt6363: select CONFIG_IRQ_DOMAIN
dfcd0ba14769 signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
0d628221cd4c selftests: harness: fix pidfd leak in __wait_for_test
8fa0790d7e82 drm/hyperv: During panic do VMBus unload after frame buffer is flushed
6a0ac0efa7ed Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
519d88bc3631 Reapply "bnxt_en: bring back rtnl_lock() in the bnxt_open() path"
0561d73e89c8 fwctl/bnxt_en: Refactor aux bus functions to be more generic
cf70e38a389a fwctl/bnxt_en: Move common definitions to include/linux/bnxt/
83ade59e5da3 sctp: purge outqueue on stale COOKIE-ECHO handling
97aa04c5c9e5 bonding: annotate data-races arcound churn variables
6eea6494e542 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
87172cc8dc49 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
8de65a6ac250 vxlan: vnifilter: fix spurious notification on VNI update
032066759e9f vxlan: vnifilter: send notification on VNI add
613fd24e2d78 octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
edccbf3d63b0 sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
3dee9d0c198f net/sched: fix pedit partial COW leading to page cache corruption
d4f1802fd06d geneve: fix length used in GRO hint UDP checksum adjustment
2d86aeb46d5f net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
4b5a574e033e net: airoha: Fix use-after-free in metadata dst teardown
03275e4bb733 ptp: vclock: Switch from RCU to SRCU
28f5ad1b4055 ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
0155b46b6c7a af_unix: Fix inq_len update problem in partial read
b51968f6e0a9 octeontx2-af: Fix initialization of mcam's entry2target_pffunc field
b099a7c1d808 octeontx2-pf: Fix NDC sync operation errors
bfdfd2706d5f xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
e0ad57f100a3 Bluetooth: MGMT: Fix backward compatibility with userspace
87fa4701854c Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
859bb1f4cb61 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
23e8eb16820b Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
f82799407a50 Bluetooth: fix memory leak in error path of hci_alloc_dev()
be837cd09897 Bluetooth: bnep: reject short frames before parsing
1c2dc44907c5 Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
08b9c1fbe78f Bluetooth: RFCOMM: validate skb length in MCC handlers
2a3f3ed9e198 Bluetooth: MGMT: validate advertising TLV before type checks
6f4462d12133 Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
0f5e9ddd7e8e wifi: cfg80211: enforce HE/EHT cap/oper consistency
927d515cd3e2 wifi: nl80211: split out UHR operation information
26ae801cd32a wifi: cfg80211: add support to handle incumbent signal detected event from mac80211/driver
a24134ddc18b wifi: fix leak if split 6 GHz scanning fails
3a967c498baa ipv6: anycast: insert aca into global hash under idev->lock
a901ee64f85d net: fec: fix pinctrl default state restore order on resume
3b4cfc6bfcfe net: lan743x: permit VLAN-tagged packets up to configured MTU
a11f1a671b13 net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
d71bb171661e hsr: Remove WARN_ONCE() in hsr_addr_is_self().
b183215ff714 tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
6e8a5575cbf3 net: Annotate sk->sk_write_space() for UDP SOCKMAP.
d0510bcef2ec pcnet32: stop holding device spin lock during napi_complete_done
033ce021a220 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
99bdde743385 drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
11324d52b0c6 devlink: Release nested relation on devlink free
62f327e287cf l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
da8808463882 6lowpan: fix off-by-one in multicast context address compression
91d105d2cbe0 net/sched: act_api: use RCU with deferred freeing for action lifecycle
c57570fba240 dm cache policy smq: check allocation under invalidate lock
c9b5ff59feff netfilter: bridge: make ebt_snat ARP rewrite writable
2e154b5f53f1 netfilter: nft_ct: bail out on template ct in get eval
573810f61bcd netfilter: conntrack_irc: fix possible out-of-bounds read
fbf0591275f5 netfilter: synproxy: add mutex to guard hook reference counting
19a9493faa4b ipvs: clear the svc scheduler ptr early on edit
e096a564b206 netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
75e33deda658 ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
4e036c33c6cc wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
95caf60da33d erofs: fix use-after-free on sbi->sync_decompress
1a2906f0ecbf ARM: dts: gemini: Fix partition offsets
01b36bc80924 s390/bug: Always emit format word in __BUG_ENTRY
5479f8eaa844 tee: qcomtee: add missing va_end in early return qcomtee_object_user_init()
7be25955fa7d tee: fix tee_ioctl_object_invoke_arg padding
3be61f3f4c33 soc: qcom: ice: Return -ENODEV if the ICE platform device is not found
cbc17e581acc ARM: dts: microchip: sam9x7: fix GMAC clock configuration
b3228ad2d61c arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins
1a8003b93908 soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
373152c94e57 tee: optee: prevent use-after-free when the client exits before the supplicant
94d286fa5eed net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
087dbacf897c ipv6: mcast: Fix use-after-free when processing MLD queries
d324b8aa20bd Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer
4576621dc657 i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
ec42b4ed1b07 KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
90e47dc5c572 bpf: Free reuseport cBPF prog after RCU grace period.