967cc061f0dc Linux 7.1.4-xanmod1
d3dc120f721d Merge tag 'v7.1.4' into 7.1
7a5cef0db479 Linux 7.1.4
63940a3adc7d xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
5394c215efde xfs: write the rg superblock when fixing it
4d281a74eed8 xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
19fa8bc0df48 xfs: don't zap bmbt forks if they are MAXLEVELS tall
704a6ba079f0 xfs: fully check the parent handle when it points to the rootdir
cb1f92cb29cc xfs: clamp timestamp nanoseconds correctly
b7e9edbed705 xfs: handle non-inode owners for rtrmap record checking
261c7a32f637 xfs: set xfarray killable sort correctly
5da68d6c927a xfs: use the rt version of the cow staging checker
b19e5b47424b xfs: grab rtrmap btree when checking rgsuper
2b14fe1e0924 xfs: don't wrap around quota ids in dqiterate
44f891bc0889 xfs: resample the data fork mapping after cycling ILOCK
cccbabeb9a18 xfs: fail recovery on a committed log item with no regions
0bc4d4a97302 xfs: fix null pointer dereference in tracepoint
57cba95f0e97 smb: client: reject overlapping data areas in SMB2 responses
25e2ac320c3d Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
07e454687b13 timekeeping: Register default clocksource before taking tk_core.lock
ae8f855a28e0 ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY
0a7f33010c0e fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
a635f427d57e fuse-uring: make a fuse_req on SQE commit only findable after memcpy
4021a3a79eee fuse-uring: Avoid queue->stopped races and set/read that value under lock
95d7f50aff2a fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
4f45f276d5b4 fuse-uring: end fuse_req on io-uring cancel task work
e8afc85acdf3 fuse-uring: fix moving cancelled entry to ent_in_userspace list
d01a09b442cb fuse-uring: fix data races on ring->ready
fe604c08d874 fuse-uring: fix EFAULT clobber in fuse_uring_commit
893479015cb6 fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
1ec674d3d0ed fuse: don't block in fuse_get_dev() for non-sync_init case
1f3f4060e656 fuse: fix io-uring background queue dispatch on request completion
65a1c2551f7e fuse: re-lock request before returning from fuse_ref_folio()
779b7f1fcdee fuse: do not use start_removing_noperm()
81b1045c401c fuse: fix device node leak in cuse_process_init_reply()
a37a64ebc9d7 Revert "fuse: fix conversion of fuse_reverse_inval_entry() to start_removing()"
c78c4b242299 fuse: avoid 32-bit prune notification count wrap
7ddcbd4dd85f fuse: back uncached readdir buffers with pages
75c93cd3c421 RDMA/siw: bound Read Response placement to the RREAD length
020700a2fdc4 RDMA/core: Fix broadcast address falsely detected as local
da3e44add94b RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
2ffcdbfd1431 Input: maplecontrol - set driver data before registering input device
79e6fd106356 Input: maplemouse - set driver data before registering input device
2351e841951c Input: maple_keyb - set driver data before registering input device
d5ab7e52e86e Input: mms114 - fix multi-touch slot corruption
2914e243ec9e Input: maplemouse - fix NULL pointer dereference in open()
b75371bc87ae Input: gscps2 - advance receive buffer write index
f3d5e77b27fd Input: mms114 - reject an oversized device packet size
a8d87184576c Input: touchwin - reset the packet index on every complete packet
2691b68f9b03 Input: ads7846 - don't use scratch for tx_buf when clearing register
a747c4eb0265 Input: mms114 - fix touch indexing for MMS134S and MMS136
a40250f97c31 Input: iforce - bound the device-reported force-feedback effect index
2a6766869012 Input: goodix - clamp the device-reported contact count
6bac57d8fe2a Input: elan_i2c - prevent division by zero and arithmetic underflow
bfe622efecd4 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
64fb0e1161cc Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
43d61346c040 Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
00904687b9c5 i2c: i801: fix hardware state machine corruption in error path
5800647d19d3 i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
1f0ab044e106 i2c: stm32f7: truncate clock period instead of rounding it
cb037e697da0 i2c: davinci: Unregister cpufreq notifier on probe failure
d8c97bde8224 i2c: mpc: Fix timeout calculations
35dbd1f1f603 i2c: core: fix adapter deregistration race
036d554f532b i2c: core: fix adapter debugfs creation
76402d37a5de i2c: core: fix adapter probe deferral loop
034e30742811 i2c: core: fix NULL-deref on adapter registration failure
3d760ca230b0 i2c: core: fix irq domain leak on adapter registration failure
fb2c0eab51ae fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
284d5ba931a5 Revert "svcrdma: Use contiguous pages for RDMA Read sink buffers"
40eedc4253db svcrdma: wake sq waiters when the transport closes
0449a6583c0e dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
18bd476ef4a1 udmabuf: fix DMA direction mismatch in release_udmabuf()
cd1067ccc0db KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
f3a98d5881b9 KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
f2ca2b532621 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
bf27cd2d58a4 KVM: TDX: Account all non-transient page allocations for per-TD structures
f0a47e6cb035 KVM: VMX: Handle bad values on proxied writes to LBR MSRs
aa41338ee2db KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB
77eab9571f6d KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
dda5ce3fdf89 KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated
a3487d5926dd KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports
256034648b9e KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
dcdb476f5fc5 KVM: SEV: Pin source page for write when adding CPUID data for SNP guest
d4f4d61715d1 KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
7fca3fcef81c KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
60e51a62170a LoongArch: KVM: Add missing slots_lock for device register/unregister
5fd30133af86 KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
5c22e38cfb73 selftests/landlock: Increase default audit socket timeout
395135628ad5 selftests/landlock: Filter dealloc records in audit_count_records()
7621e00a4059 landlock: Account all audit data allocations to user space
c02f2a0ae1c1 selftests/landlock: Explicitly disable audit in teardowns
0254cef9bf18 landlock: Set audit_net.sk for socket access checks
fe85607ceffc audit: fix removal of dangling executable rules
2c6381d90898 iommufd: Set upper bounds on cache invalidation entry_num and entry_len
0714e5a4c83e iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
f66c16b17550 iommufd: Break the loop on failure in iommufd_fault_fops_read()
76c05bd8f634 iommufd: Reject invalid read count in iommufd_fault_fops_read()
db4e1a1e9f13 iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
f682c833f7d5 iommufd: Reject invalid read count in iommufd_veventq_fops_read()
7a860d6f260e iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
e7b5e5565274 iommufd: Set veventq_depth upper bound
6c5fc40200cd iommufd: Move vevent memory allocation outside spinlock
f9f08e46b9e3 iommufd: Fix data_len byte-count vs element-count mismatch
0cdbb97a4dbd iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
ff189754fc34 iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
477f8dec3b5a iommu/vt-d: Avoid WARNING in sva unbind path
c76b8abce575 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
49af4044ed98 nouveau/vmm: fix another SPT/LPT race
f250db8ea6e9 selftests/mm: fix ksft_process_madv.sh test category
913324904ce9 selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
04ba248d02d9 mm: do file ownership checks with the proper mount idmap
377b1cd6bbcf mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
fceca62a095e selftests: mm: fix and speedup "droppable" test
246f0713360a mm: fix mmap errno value when MAP_DROPPABLE is not supported
9adedf9c885c lib/test_hmm: use kvfree() to free kvcalloc() allocations
ede985ff4b56 riscv: mm: Unconditionally sfence.vma for spurious fault
bc773b8b4c81 riscv: mm: Define DIRECT_MAP_PHYSMEM_END
84ab222021c2 NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
c8e041c68c0b exfat: bound uniname advance in exfat_find_dir_entry()
5bfa2814528d exfat: preserve benign secondary entries during rename and move
c4c82cdfdf8a vt: fix spurious modifier in CSI/cursor key sequences
e7da02659c22 module: decompress: check return value of module_extend_max_pages()
8e0a22bc728e rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule
e36501b7d4ab NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
80a7608376e5 audit: fix potential integer overflow in audit_log_n_hex()
e5d5f3bd053a tracing: Prevent out-of-bounds read in glob matching
792118d05f01 selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION calls with invalid length
c04873ea85d9 liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name length
0cff05bd2186 perf/aux: Fix page UAF in map_range()
5fd2dbeded54 i2c: core: fix hang on adapter registration failure
a935b64548fc regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
3e6e9f17f583 watchdog: apple: Add "apple,t8103-wdt" compatible
7057fcf3a6d3 EDAC/i10nm: Don't fail probing if ADXL is missing
03f6ecbc446c x86/mm: Fix freeing of PMD-sized vmemmap pages
9d000bdd250d spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
507c13781101 spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
02d9dac2b843 arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
4519290ed20d crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
1691f2c4a4f2 crypto: talitos/hash - remove useless wrapper
a4ffe8e7bdfe crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
ab3b0f3e4e72 crypto: talitos/hash - drop workqueue mechanism for SEC1
96a8955d7020 crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
a0cf230cb4df crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
0f21d65f4381 crypto: talitos - move code in current_desc_hdr() into a standalone function
873e34c46cb7 crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
ec6669f1c162 crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
b624dcd2fda9 crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
9d4ea20a402d crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
abf9a568013c crypto: qat - factor out AER reset helpers
ce42224487c5 crypto: qat - validate RSA CRT component lengths
8e8391469a92 crypto: qat - skip restart for down devices
0dbcecea740d crypto: qat - protect service table iterations with service_lock
425f1260ecb9 crypto: qat - notify fatal error before AER reset preparation
6f52fe576ac6 crypto: qat - keep VFs enabled during reset
4515bf525c96 crypto: qat - handle sysfs-triggered reset callbacks
59c0901db2b7 crypto: qat - fix restarting state leak on allocation failure
c98aed00e65a crypto: qat - centralize bus master enable
d5c0a6f8dc7e crypto: drbg - Fix the fips_enabled priority boost
044aaaba99e1 crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
59a27cf2d01a crypto: drbg - Fix ineffective sanity check
d9f4acde5ae9 crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG
a9e886f73dd7 crypto: drbg - Fix returning success on failure in CTR_DRBG
20f548cdac94 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
8836801847b9 crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
67ed191b4c8b crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
d51207735e7c crypto: ccp - Do not initialize SNP for SEV ioctls
43de8b9f01b7 crypto: loongson - Remove broken and unused loongson-rng
0927083d5e3e crypto: loongson - Select CRYPTO_RNG
855240d4d243 crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
83fa1397d585 crypto: pcrypt - restore callback for non-parallel fallback
98a771d340bd crypto: hisi-trng - Remove crypto_rng interface
ebaae7c4251c crypto: ecc - Fix carry overflow in vli multiplication
a856bc7d0fbb crypto: crypto4xx - Remove insecure and unused rng_alg
e74df53b36cd crypto: chacha20poly1305 - validate poly1305 template argument
59057f5d4e9a crypto: caam - use print_hex_dump_devel to guard key hex dumps again
8cf5fb050312 crypto: caam - use print_hex_dump_devel to guard key hex dumps
d9dbf9a484cb crypto: af_alg - Remove zero-copy support from skcipher and aead
9830725078c8 isofs: bound Rock Ridge symlink components to the SL record
b8df7f486a46 btrfs: fix incorrect buffered IO fallback for append direct writes
44f37ee92fdc partitions: aix: bound the pp_count scan to the ppe array
b4af31b898a9 btrfs: do not trim a device which is not writeable
5d444a2a06d0 btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
caa71b3a43ea nvmet-auth: validate reply message payload bounds against transfer length
05645271751e btrfs: fix false IO failure after falling back to buffered write
a29b316b9bbf nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
16898de2ca35 nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
f815869f926c dm-ioctl: report an error if a device has no table
0d3d19f78595 block: partitions: fix of_node refcount leak in of_partition()
5828517d17ed nvme: target: rdma: fix ndev refcount leak on queue connect
1c0462532916 crypto: atmel-sha204a - fail on hwrng registration error in probe path
5c925be839d8 crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
68896ba8ccb8 hwrng: jh7110 - fix refcount leak in starfive_trng_read()
7f7774b9da0e udf: validate sparing table length as an entry count, not a byte count
74580fdf0229 udf: validate VAT header length against the VAT inode size
be87de7789a8 udf: validate free block extents against the partition length
77e7b127472a wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
aa4c4a931576 block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
dfecbb9ee08d usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
f99f32ea9aa9 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
0cae3d610942 usb: gadget: f_fs: Fix DMA fence leak
ba1867999dbc usb: gadget: f_fs: initialize reset_work at allocation time
3aeed2451603 usb: typec: ucsi: cancel pending work on system suspend
dbb500bad021 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
f1736bb63f74 usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
42ac1cc7de06 usb: typec: ucsi: Invert DisplayPort role assignment
313ca06e7e22 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
20f38be1d262 usb: typec: tcpm: Fix VDM type for Enter Mode commands
9a95bf88c6e4 usb: typec: ps883x: Fix DP+USB3 configuration
14457cb92258 usb: typec: class: drop PD lookup reference
575cb72b5ed0 usb: typec: anx7411: use devm_pm_runtime_enable()
0443e4416aa1 usbip: vudc: fix NULL deref in vep_dequeue()
ddc4619707af usbip: tools: support SuperSpeedPlus devices
e9b316d99a5c USB: usb-storage: ene_ub6250: restore media-ready check
e5493c9a98ff USB: ulpi: fix memory leak on registration failure
a3a13fdc5310 USB: serial: digi_acceleport: fix write buffer corruption
79bc131df0e5 USB: serial: digi_acceleport: fix hard lockup on disconnect
92fa3e1a4984 USB: serial: digi_acceleport: fix broken rx after throttle
6c8ccd8db36e USB: serial: option: add Telit Cinterion FE990D50 compositions
d4b12b6b395e USB: serial: keyspan_pda: fix information leak
835b0596d4c9 usb: mtu3: unmap request DMA on queue failure
48dd0b2ec9f2 USB: misc: uss720: unregister parport on probe failure
fc1b546973c1 usb: misc: usbio: bound bulk IN response length to the received transfer
88bf7b68ac90 USB: storage: include US_FL_NO_SAME in quirks mask
e4271a74bf99 usb: sl811-hcd: disable controller wakeup on remove
9ba62966461a USB: legousbtower: fix use-after-free on disconnect race
452c5d97ba38 USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
71590982700f USB: iowarrior: fix use-after-free on disconnect race
e4596816984e USB: iowarrior: fix use-after-free on disconnect
a3e794136ab5 USB: ldusb: fix use-after-free on disconnect race
e88cff5fbaa6 USB: idmouse: fix use-after-free on disconnect race
7f1f24c36793 usb: gadget: f_printer: take kref only for successful open
54fa390aae39 usb: gadget: udc: Fix use-after-free in gadget_match_driver
fcb21bf74764 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
4bb88aee6b86 usb: free iso schedules on failed submit
f4f5219c06d4 usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
4349e487a114 usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
effc5f7942b4 USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
963075c4da0c usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
35179684907c usb: cdc_acm: Add quirk for Uniden BC125AT scanner
0aa71f258810 Revert "usb: typec: mux: avoid duplicated mux switches"
51e65f1d7845 net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
bd6ad9a6b304 bpf: Allow LPM map access from sleepable BPF programs
d57db0d97505 bpf: Keep dynamic inner array lookups nullable
ff77d013b737 bpf: Validate BTF repeated field counts before expansion
ee7099359f96 bpf: Restore sysctl new-value from 1 to 0
51d07c12ca41 bpf: Reject fragmented frames in devmap
06a2e6dbaa26 xfs: fix memory leak in xfs_dqinode_metadir_create()
4707344b0d36 xfs: fix exchmaps reservation limit check
60db12509ec0 xfs: fix pointer arithmetic error on 32-bit systems
cbcb09dacb71 xfs: fix unreachable BIGTIME check in dquot flush validation
ed16544d0d8b xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
ce03e51a24c1 xfs: only log freed extents for the current RTG in zoned growfs
4693131bee05 xfs: pass back updated nb from xfs_growfs_compute_deltas
d108043cc04e xfs: release dquot buffer after dqflush failure
33c2c9d717f6 xfs: use null daddr for unset first bad log block
9690e8a34263 serial: 8250_mid: Disable DMA for selected platforms
4c4b4af4a9f2 media: mtk-jpeg: cancel workqueue on release for supported platforms only
d26aef771b4f nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
d5b45bad75cd hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
c25d3c931a63 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
d36e69c8c0c8 HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
8131f4226688 HID: lg-g15: cancel pending work on remove to fix a use-after-free
6b0838e86da8 HID: appleir: fix UAF on pending key_up_timer in remove()
6493ebf9489e HID: multitouch: fix out-of-bounds bit access on mt_io_flags
df3d8aa1a939 HID: letsketch: fix UAF on inrange_timer at driver unbind
27c4dad1b791 HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
57bdd10ad50d HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
3e7761f7bf9f HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
48218df04220 HID: pidff: Use correct effect type in effect update
e2cc711a9df3 HID: wacom: stop hardware after post-start probe failures
cfc0d283d931 HID: uhid: convert to hid_safe_input_report()
835fcc865556 HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
493f261c0772 tools/mm/slabinfo: fix total_objects attribute name
27c83f667575 tools/mm/slabinfo: Fix trace disable logic inversion
0d18ccef142f mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
d33dc0d5824c X.509: Fix validation of ASN.1 certificate header
942dfe844229 perf/arm-cmn: Fix DVM node events
c94806905e02 s390: Revert support for DCACHE_WORD_ACCESS
c67b06370ade clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
75b478096c6b time/jiffies: Register jiffies clocksource before usage
8f06363446c5 posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
c1cfd63326f5 proc: protect ptrace_may_access() with exec_update_lock (part 1)
0e3c739a2f6f cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
a0106b41f9a7 cpufreq: Fix hotplug-suspend race during reboot
a18f80bf5359 sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
e0d0adc3d204 cpufreq: intel_pstate: Sync policy->cur during CPU offline
a5f5f5053f98 perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
dfd1894cb64c proc: protect ptrace_may_access() with exec_update_lock (FD links)
8e931557b317 libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
15432f19562f firmware_loader: fix device reference leak in firmware_upload_register()
9de568ef6cdf cpufreq: qcom-cpufreq-hw: Fix possible double free
625b014f922c OPP: of: Fix potential memory leak in opp_parse_supplies()
53eeaf4d6306 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
eedf142d994e smb/server: do not require delete access for non-replacing links
f80add1bfb34 smb: client: mask server-provided mode to 07777 in modefromsid
fc25bbc893f6 smb: client: fix atime clamp check in read completion
46a84715a015 smb: client: harden POSIX SID length parsing
52f9c9dafefc smb: client: use unaligned reads in parse_posix_ctxt()
927d4805aea0 smb: client: Fix next buffer leak in receive_encrypted_standard()
b18ed621dbfc smb: client: fix double-free in SMB2_close() replay
ff2d30927bc3 smb: client: fix double-free in SMB2_open() replay
013a9a3da46c smb: client: fix double-free in SMB2_flush() replay
901891513951 smb: client: fix change notify replay double-free
fc65ffb4ef1b smb: client: fix double-free in SMB2_ioctl() replay
89234773e834 smb: client: fix query_info() replay double-free
3317a5d015fc smb: client: fix query directory replay double-free
550cfb8a8118 smb/client: fix chown/chgrp with SMB3 POSIX Extensions
89ca7756d556 ksmbd: validate NTLMv2 response before updating session key
5fecc15a30cb ksmbd: track the connection owning a byte-range lock
52a56cf53ec8 ksmbd: use opener credentials for ADS I/O
4b7059974549 ksmbd: use opener credentials for delete-on-close
3bed9974fdf8 ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
5bc2aa358b57 ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
8cc9ec711f52 ksmbd: run set info with opener credentials
aae600cdaffc ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
a10942af2783 ksmbd: require source read access for duplicate extents
5c75275c0fc9 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
fd22b039a5a0 ksmbd: serialize QUERY_DIRECTORY requests per file
deffa929086d ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
c917e4522d25 ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
8c9a4f1327eb ksmbd: prevent path traversal bypass by restricting caseless retry
a1cc432cb0b0 smb/client: Fix error code in smb2_aead_req_alloc()
0700f946659d smb: client: resolve SWN tcon from live registrations
daf6246ab988 coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
6b47bdaacfd0 Bluetooth: L2CAP: validate option length before reading conf opt value
e96fbac8d3a7 Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
01afd198c2c2 Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
714d861d35d9 Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
b42cb640a049 Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
50c662bdcd51 Bluetooth: fix UAF in bt_accept_dequeue()
49bcb39e3a04 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
563a85730471 Bluetooth: bnep: pin L2CAP connection during netdev registration
0f0a83e26a9c Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
9efe838c1313 netfilter: flowtable: IPIP tunnel hardware offload is not yet support
419835f1bd5f netfilter: flowtable: fix offloaded ct timeout never being extended
b6183b1b88a7 netfilter: ebtables: terminate table name before find_table_lock()
7b217960e88b netfilter: ebtables: module names must be null-terminated
5ee856e4208a netfilter: ebtables: zero chainstack array
57056be3ec12 netfilter: handle unreadable frags
02f8a0a1da2e netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
2a55fdf9f746 mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup
6a4196d19f47 mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
b9beed2322f3 mm: shrinker: fix NULL pointer dereference in debugfs
284c267f013e mm: shrinker: fix shrinker_info teardown race with expansion
86237e56091e mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
fc030c5b116f mfd: cros_ec: Delay dev_set_drvdata() until probe success
c12a5b226135 media: nxp: imx8-isi: Fix use-after-free on remove
a094ac95d3b6 net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
f91883031e5a ipv4: igmp: remove multicast group from hash table on device destruction
5ed09a108d93 netpoll: fix a use-after-free on shutdown path
f254713ac539 io_uring/rw: preserve partial result for iopoll
ab85765cbe32 io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
7267717f3578 io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
7a89ad762fad HID: logitech-dj: Fix maxfield check in DJ short report validation
41cad91a09d6 gpio: sch: use raw_spinlock_t in the irq startup path
5c3c9ec1172a gpio: eic-sprd: use raw_spinlock_t in the irq startup path
6350df503897 NTB: epf: Avoid calling pci_irq_vector() from hardirq context
e2018628301a ntfs: avoid calling post_write_mst_fixup() for invalid index_block
f433acc85b86 fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
1f4f02b336c3 debugobjects: Plug race against a concurrent OOM disable
2edd162cbd4a coresight: etb10: restore atomic_t for shared reading state
9531014c60c8 Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
50c38d9f42a5 Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
c5186201fa70 audit: Fix data races of skb_queue_len() readers on audit_queue
cea34abc94b0 net: af_key: initialize alg_key_len for IPComp states
12c36c99655f ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
6e92b28cd74f crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
2b7bd6dccff1 crypto: krb5 - filter out async aead implementations at alloc
6dda8406d8a3 crypto: amlogic - avoid double cleanup in meson_crypto_probe()
225b6d3fc7e9 staging: rtl8723bs: fix OOB write in HT_caps_handler()
729c4e72563b staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
4380b3860d88 staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
402f13ec9594 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
b5cc2f999927 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
7e7741c8315e staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
d90b9f39f375 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
138cd190efd5 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
35f4dbec7380 staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()
837c1f965542 staging: media: ipu7: fix double-free and use-after-free in error paths
7c973c5113e3 staging: media: atomisp: reduce load_primary_binaries() stack usage
753e684fa55f media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
c6cda17e9854 staging: vme_user: fix location monitor leak in tsi148 bridge
157bcfc7955c staging: vme_user: fix location monitor leak in fake bridge
6e9d10f62773 smb: client: restrict implied bcc[0] exemption to responses without data area
1b495fa0d492 staging: vme_user: bound slave read/write to the kern_buf size
f333b6851bdf tipc: fix out-of-bounds read in broadcast Gap ACK blocks
69f17ac132a3 tracing: Fix NULL pointer dereference in func_set_flag()
b713aa0cc344 6lowpan: fix NHC entry use-after-free on error path
1947b6411460 usb: misc: usbio: fix disconnect UAF in client teardown
642e04f5c292 usb: dwc3: run gadget disconnect from sleepable suspend context
8f50613bff22 USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
92d5736a6204 hwrng: virtio: clamp device-reported used.len at copy_data()
378493da2980 virtio-mmio: fix device release warning on module unload
64a4c0befa77 virtio_pci: fix vq info pointer lookup via wrong index
e8ee198bbc04 netfilter: ipset: fix race between dump and ip_set_list resize
76e415ea88d2 mm/damon/ops-common: handle extreme intervals in damon_hot_score()
4caf12c778fe tcp: restore RCU grace period in tcp_ao_destroy_sock
55fd485e66d0 PCI/IOV: Skip VF Resizable BAR restore on read error
7908ddb6f8b3 PCI: Skip Resizable BAR restore on read error
67a8b1d876d5 PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
df77314b3bed PCI: mediatek: Fix IRQ domain leak when port fails to enable
6a2363bf9eae PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95
edefa5f4b701 PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
76143cbb18dc PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95
7707ac040967 PCI: host-common: Request bus reassignment when not probe-only
669c4f387600 PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
6864c789b570 PCI: altera: Fix resource leaks on probe failure
ff396bab155f PCI: altera: Do not dispose parent IRQ mapping
bc29e49364ea PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
1d3f464bb158 riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers
569f18a83eed usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
a3eaf82ff842 xhci: sideband: fix ring sg table pages leak
93cd037da94f usb: xhci: Fix sleep in atomic context in xhci_free_streams()
0644da3621dd rust_binder: clear freeze listener on node removal
59fbe6b20456 rust_binder: synchronize Rust Binder stats with freeze commands
ad6af5c32dac rust_binder: reject context manager self-transaction
3ffc336432da rust_binder: fix BINDER_GET_EXTENDED_ERROR
74920b1b4e47 rust_binder: use a u64 stride when cleaning up the offsets array
0f15f0f6ca5d binder: fix UAF in binder_free_transaction()
ef5439ba5b9a binder: fix UAF in binder_thread_release()
087a305e025c Bluetooth: btusb: fix wakeup source leak on probe failure
838c917a2f16 Bluetooth: btusb: fix use-after-free on marvell probe failure
da7d7758fe88 Bluetooth: btusb: fix use-after-free on registration failure
c028dfa0a3c7 Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
39d163627b51 vfio/mlx5: Fix racy bitfields and tighten struct layout
a5df401dc84f vfio: Remove device debugfs before releasing devres
a3a8afa2f6e7 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
ad0f12d2dfc2 vfio/pci: Fix racy bitfields and tighten struct layout
278a5659c391 vfio/pci: Release the VGA arbiter client on register_device() failure
062b820290bc vfio/pci: Latch disable_idle_d3 per device
2bdb4c96287d vfio/pci: Use a private flag to prevent power state change with VFs
58c5ec23b1a2 x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
c4fe3d9551ea ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
3314c5af8a13 ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
4e01d542e910 ALSA: usb-audio: Roll back quirk control caches on write errors
14dfb2abae01 ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
edf3ce5a72ca ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
4246dd043b7a ALSA: usb-audio: avoid kobject path lookup in DualSense match
344b64d4d411 ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8
ab1db6491242 ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
6ded42615fa1 ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
38a7cc46370a ALSA: ice1712: check snd_ctl_new1() return value
17f31b904e8c ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
8bbba4ab5e6d ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
0056958bf308 ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
d6a40a4d083e ALSA: hda/cs35l41: Fix firmware load work teardown
465075c68351 ALSA: gus: check snd_ctl_new1() return value
31a01b70bb90 ALSA: firewire: isight: bound the sample count to the packet payload
aeeeae9c1a51 ALSA: FCP: Add Focusrite ISA C8X support
1949163dee39 ALSA: es1938: check snd_ctl_new1() return value
426a9947a38d ALSA: compress: Fix task creation error unwind
67e9ea92cd59 ALSA: cmipci: check snd_ctl_new1() return value
0680413f2f10 ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
e47f2a341adb ALSA: aoa: check snd_ctl_new1() return value
18ec7d7785be ALSA: ymfpci: check snd_ctl_new1() return value
21584672fd69 ALSA: virtio: Validate control metadata from the device
6f3c7e552fd8 ALSA: virtio: Add missing 384 kHz PCM rate mapping
27161c68d5e7 ALSA: usx2y: us144mkii: fix work UAF on disconnect
d90f868f56a1 iio: temperature: tmp006: use devm_iio_trigger_register
d8274d1a79af iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
e52f7939a41c iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
f87b86a7fd9e iio: temperature: Build mlx90635 with CONFIG_MLX90635
1c8150ee8f2f iio: resolver: ad2s1210: notify trigger and clear state on fault read error
769e819e6925 iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
46e69d3dd429 iio: pressure: mpl115: fix runtime PM leak on read error
9990e06016af iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
0adca7d78b7b iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
8a383705c455 iio: light: veml6030: fix channel type when pushing events
9f45d437ce24 iio: light: tsl2591: return actual error from probe IRQ failure
56447eeab51e iio: light: opt3001: fix missing state reset on timeout
2ebaea7f3089 iio: light: gp2ap002: fix runtime PM leak on read error
a82b89a35692 iio: light: al3320a: read both ALS ADC registers again
2b42c313b941 iio: light: al3320a: add missing REGMAP_I2C to Kconfig
e297afa1845f iio: light: al3010: read both ALS ADC registers again
78451f43e3f4 iio: light: al3010: fix incorrect scale for the highest gain range
acd4946b583a iio: light: al3010: add missing REGMAP_I2C to Kconfig
c2d8c2696b8c iio: light: al3000a: add missing REGMAP_I2C to Kconfig
4f49fef6179d iio: imu: st_lsm6dsx: deselect shub page before reading whoami
2e2595765dcb iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
9fdc477b652a iio: imu: inv_icm42600: fix timestamp clock period by using lower value
65f1f81e7521 iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
9f5690f2dc54 iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
a11bc637375e iio: gyro: bmg160: wait full startup time after mode change at probe
6c8675468862 iio: gyro: bmg160: bail out when bandwidth/filter is not in table
f187dc5a4c48 iio: event: Fix event FIFO reset race
b03fb2f8c6fc iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source()
89fbd3e32dff iio: core: fix uninitialized data in debugfs
20a5fee40c3d iio: common: st_sensors: honour channel endianness in read_axis_data
d49ff54b2784 iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
fb8e18f8ca72 iio: buffer: hw-consumer: free scan_mask on buffer release
33b29764f6c4 iio: backend: fix uninitialized data in debugfs
84552fdcef8f iio: adc: ti-ads124s08: Return reset GPIO lookup errors
6537f0810018 iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
eb5b07c9d0ec iio: adc: spear: Initialize completion before requesting IRQ
af885d419b4d iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for()
2f18c5551aa9 iio: adc: lpc32xx: Initialize completion before requesting IRQ
f1de829ee87a iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
3bceb26dfaf7 iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
73a92d5e3d78 iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
f75a12808cd3 iio: adc: ad7768-1: Select GPIOLIB
e3f3fcf011e7 iio: adc: ad7380: select REGMAP
5d32dd6338c8 iio: adc: ad4062: add GPIOLIB dependency
13a91e8631cf iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
35a3cd8fd65e iio: accel: bmc150: clamp the device-reported FIFO frame count
9facd79028a7 usb: gadget: function: rndis: add length check for header
b09716040f3f usb: gadget: function: rndis: add length check to response query
994994cfadaf wifi: rtw89: correct drop logic for malformed AMPDU frames
29d3f527bc1a bpf: Prefer dirty packs for eBPF allocations
3448efcb18ae bpf: Prefer packs that won't trigger an IBPB flush on allocation
80a96785fe42 bpf: Skip redundant IBPB in pack allocator
7ff3b159b8b7 bpf: Restrict JIT predictor flush to cBPF
52440e15d962 x86/bugs: Enable IBPB flush on BPF JIT allocation
7a6c171c6a1a bpf: Support for hardening against JIT spraying
06ccef0434e9 perf/core: Detach event groups during remove_on_exec
007f071b2c39 futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
89592176b718 rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
c781009975c5 rust: doctest: fix incorrect pattern in replacement
6822a2685b4d rust: block: fix GenDisk cleanup paths
afa40a464072 rust: pci: use 'static lifetime for PCI BAR resource names
1b1cac9887ec rust: kasan: KASAN+RUST requires clang
3f096fb8647b rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0
fbe9f0ff0b5b LoongArch: Add PIO for early access before ACPI PCI root register
eace3b3e729d platform/x86: intel-hid: Protect ACPI notify handler against recursion
7d69235bdc58 ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
873576e585da ACPI: NFIT: core: Fix possible NULL pointer dereference
dc066bd13c86 ACPI: CPPC: Suppress UBSAN warning caused by field misuse
8c8e8ac22ee1 KVM: x86: Unconditionally recompute CR8 intercept on PPR update
db8407b9fd06 KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
3db1ef139956 KVM: x86: Move update_cr8_intercept() to lapic.c
3b3ca5d3a28e perf trace beauty fcntl: Fix build with older kernel headers
7d45ca69164e slab: recognize @GFP parameter as optional in kernel-doc
2dfe9f5c91d0 mm/khugepaged: write all dirty file folios when collapsing
806586e33891 net/sched: dualpi2: fix GSO backlog accounting
710183888174 userfaultfd: gate must_wait writability check on pte_present()
6537884e9cf2 rust: str: clean unused import for Rust >= 1.98
77ddefb1aeda rust: str: use the "kernel vertical" imports style