bca689d38274 Linux 7.2.9-xanmod1
9627345b4d19 Merge tag 'v7.2.9' into 7.2
5fce161649b4 Linux 7.2.9
82339215fc00 i2c: qcom-geni: release DMA channels on probe error
f0c1fb7e96b3 accel/ivpu: Drop IRQF_ONESHOT to allow IPC IRQ threading on PREEMPT_RT
bf5266d912c0 KVM: x86: Add static calls for nested virtualization ops
7f0a727723a0 KVM: x86: Reject nested CAP enablement if nested virtualization is disabled
ac1dc205acca KVM: move TSS constants from kvm_host.h to tss.h
42dd578c3c8f KVM: x86/mmu: Move kvm_mmu_do_page_fault() from mmu_internal.h => mmu.c
d54c173828ea KVM: x86/mmu: Move kvm_arch_async_page_ready() below kvm_tdp_page_fault()
a0d29482f3ff KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h
5bf1c9175e65 KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
512c93f4461b KVM: arm64: nv: Fix life cycle of the nested_mmus array
b097d9d7a5b0 net/sched: act_ct: avoid modifying shared unconfirmed ct entry
8988f4d11f3f net/sched: act_ct: fix helper UAF due to extensions realloc
9355bf2b26a6 drm/amd/display: Relax DML frame limit with UBSAN
93664ce254c7 super: make iterate_supers_type() deletion-safe
e4c644e2ef8e super: take lock after last reference count
499f144ae5d1 super: convert s_count to refcount_t s_passive
139efdb3ee6e i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
6c3420d6ba34 i2c: qcom-geni: Store of_device_id data in driver private struct
4edab037132b i2c: qcom-geni: Move resource initialization to separate function
fb54df3645d8 i2c: qcom-geni: Isolate serial engine setup
3aede00c681a accel/ivpu: Use separate flag for job timeout
a19900a0ed08 accel/ivpu: Use threaded IRQ for IPC callback processing
63fc6312d39d landlock: Work around gcc-16 -Wuninitialized warning
d6efcfd5cd8f drm/xe: Add wa_14025941587 to xe2, xe3 and xe3p platforms
961c717e6bf0 xfs: fix cursor and pointer handling when recovering iunlink buckets
b39ce66ab47c xfs: fix blockgc group quota scanning when usrquota isn't enforced
41bc624377f0 xfs: drop dquot flush lock when we can't find a buffer to flush
f1f7bc739a89 xfs: don't merge different file IO error types
0e0d3372a840 xfs: don't let memory failures leak blocks and kill repairs
f0d8352a39f4 xfs: don't let hidden_space go negative in xfs_metafile_resv_init
b4b9928ee54f xfs: call xfs_dquot_set_prealloc_limits if we installed default rtb limits
2703b954d306 xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
26ba0c5482d9 xfs: fix rtgroup repair estimations
0f3f707b5478 xfs: check di_forkoff correctly in scrub
1fd8a33bbd0b xfs: use the correct reservations for rtrmap/refcount recovery
34e600858fc3 xfs: only flag zero padding for dir3 data blocks, not dir3 block blocks
445cb918169a xfs: don't call xfs_exchange_range_finish for a dry run
dfb84f25e775 xfs: check padding field in xfs_ioc_commit_range
fbf850345ff7 xfs: use correct jiffies comparison function in xchk_maybe_relax
f813aefd9e09 xfs: release orphanage dir inode if chown fails
4cb89cd1ac1d xfs: fix attr fork block count checks in xrep_inode_blockcounts
da172e10613d xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption
70783946f3b5 smb: client: delete compound mids on send failure before unlock
253612499ce9 smb: client: close completed creates on compound wait errors
b01f4f85817c smb: client: validate POSIX create context length
3c07deb26273 smb: client: use finish_no_open() for non-regular inodes
f09b5f972eca smb: client: preserve create-context parsing errors
7c1509598a4f smb: client: clean up failed cached directory opens
cdb36b09fb1f smb: client: close handle after create-context parsing failure
cecc5399987e smb: client: fix create context out-of-bounds reads
005b23d9e324 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
2e8bba0360d1 Bluetooth: mgmt: fix race in read_unconf_index_list()
f557274af7b9 Bluetooth: L2CAP: validate frame length before control and FCS access
e5fcca51177f Bluetooth: ISO: release unused CIS holds after channel attach
bbcd723ee7a8 Bluetooth: ISO: balance the parent hold in hci_bind_bis()
47d67ec424e6 Bluetooth: hci_sock: reject out-of-range OCF values
1a92763c2ba7 Bluetooth: hci_sock: validate event length before filtering
947eb2f41f70 Bluetooth: hci_conn: fix CIS hold ownership on reuse
df59474a0a85 sched/cache: Refresh LLC capacity across CPU hotplug, to fix capacity underestimation bug
852ecb6bc0bc sched/cache: Decouple sched_cache_group from mm to fix UAF
3fdf2ceb31e8 sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
c942d0d46049 RISC-V: KVM: Fix HSM hart status error propagation
e9c89ca5f145 RISC-V: KVM: Propagate interrupted G-stage faults
f475f4d78def RISC-V: KVM: Release unused page after MMU invalidation
3cc6184bd592 RISC-V: KVM: Synchronize hrtimer callback during teardown
71acbea44e78 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
22df195bff84 KVM: arm64: Transfer the hyp stack pages out of the host stage-2
3cefc1ab511f KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race
330346dda3bf KVM: arm64: Fix spurious warning for benign stage 2 teardown race
af6813d16ace KVM: arm64: Fix AArch32 DBGBXVR<n> handling
cc53eb5c6515 KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode
d4cc2dff1211 KVM: SEV: Do cache maintenance on the source VM during intra-host migration
9784e5ca91b3 KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV
4e4d2ae5ad39 KVM: Don't treat reserved xarray entries as having memory attributes
9a5eec7bdd3f KVM: Ensure memory attributes xarray nodes are accounted to the caller's memcg
3c3433657c82 s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config
fa0cccea9250 s390/pci: Don't report recovery success on skipped recovery
d47272ceaab8 s390/pci: Report SCLP status on error events when no pdev is associated
1b957d5c2f73 s390/pci: Fix missing device lock in zpci_report_status()
1cd0b7a08dc8 s390/pci: Fix leak of struct pci_dev reference in zpci_report_status()
7f78226eb743 s390/cmf: Fix virtual vs physical address confusion
44b16b026080 s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
7274abc88dda pinctrl: sunxi: keep a shadow copy of the data register output latches
db451df3dc17 pinctrl: single: free the IRQ on domain creation failure
742be6976ebd pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions
ff77310ea0bf pinctrl: mpfs-mssio: use correct regmap function to set bank voltage
897e39973c26 pinctrl: mpfs-mssio: fix width of unused bank voltage setting
c45b783d57c2 perf/x86/intel: Constrain Panther Cove UOPS_DISPATCHED events to PMCs 0-3
991113857d31 perf/x86/intel: Remove incorrect Panther Cove PEBS data-source constraints
6ec90c2a7bd9 perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints
40f6fd75cc22 perf/x86/intel: Fix Panther Cove PEBS data-source snoop states
eefb89f25187 perf/x86/intel: Fix DKT PEBS load/store direction for latency events, to fix sample classification
684a72b20c00 perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification
d07b3fd6df84 perf/x86/intel: Fix CMT PEBS load/store direction for latency events, to fix sample classification
f0be081114da perf/core: Run sched_task() for PMUs with only CPU-wide events
ec15f6a50183 perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
8a20dbb31020 parisc: parse early parameters in setup_arch()
db45f02b7a5f parisc: Increase kernel stack size to 32kb
b92d5f31d466 scsi: ufs: pltfrm: Add quirk for R-Car S4 lacking lanes-per-direction
9f6f4840def9 scsi: ufs: core: Keep internal commands dispatchable during error handling
24ffc919467d scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
6ef70d790425 nfc: trf7970a: power down on startup RX gain failure
035056e07ea6 nfc: port100: reject frames whose declared length exceeds the received data
744e61bd0618 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
9ede11e12f96 nfc: fix use-after-free in nfc_get_local_general_bytes
4fb8b1ccc475 netfilter: nf_tables: skip expired catchall elements on insert and delete
d9cf4ac6f326 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
3a7384bc2e66 netfilter: ip6t_rpfilter: reject routes without inet6_dev
e27b51822681 net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
f2379110d05d net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
b03b8ed983df net: txgbe: fix FDIR filter restore for VF rules
f0105a92289d net: phy: micrel: Advance register data pointer in write loop
a0cb48c6418d net: phy: intel-xway: workaround 100BASE-TX Link-Up issue
47785f9f638b net: ena: fix MMIO read buffer leak on probe failure
e32f6c0e0d62 net: ena: fix PHC cleanup on probe failure
fe2a42789c12 net: bridge: mdb: restart port group walk after deletion
3a7d9271b37c net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
d4ab263e40fc net: atl1c: fix soft lockup on out-of-range tpd_cons read
e02a83bb0b7a net: openvswitch: conntrack: fix helper UAF due to extensions realloc
ec8f12f46f07 net: openvswitch: conntrack: remove 'add_helper' dead code
457e0df1b571 net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
259e6cbb6a09 net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
cbaad2922bd5 net: ipconfig: bound DHCP option construction
deed332a8dd6 net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
6285919d4c06 net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
35e716a70733 net: arp: terminate device name before lookup
da9d42531f3a net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
a9551f26287d net/sched: reject IDR error pointers when deleting actions
e73f832f0a7b net/mlx5e: fix swapped IPv6 IPsec policy masks
2b2a207ef975 net/mlx5e: advertise MACsec offload only when supported
1f13989a0704 net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
4b09b7c84b86 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
723983a774f1 HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
eed737d89fa3 HID: hid-oxp: use cancel_delayed_work_sync() in remove
443f6b93442b HID: alps: fix use-after-free on input2 registration failure
978e801750c7 HID: alps: unregister DualPoint Stick input device on remove
2a0c9afefc0e packet: use ubuf_info completion for TX_RING packets
aee774588abd PCI: of_property: Omit bus properties without a subordinate bus
75be9cc46213 PCI: Fix BAR resize for devices on a root bus
655690f370e2 mm/damon/core: reset invalid quota->charge_target_from
27adca087f25 mm/damon/core: allow esz to be set to zero
2ecc56fb6a58 mm/damon/core: fix unconditionally skip last region
d5208de0799c mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()
6e74ffc9ecf6 mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
480a39b0a12c mm/hugetlb: preserve mremap address delta when skipping page tables
443628f755b3 mm/hugetlb: do not dissolve gigantic pages without runtime support
d348a715380b mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
fcedc256a1eb gpio: tps65219: Fix TPS65214 GPIO direction programming
d5313d51c6e6 gpio: tps65219: Use the variant-specific direction callback
eafce3255b27 gpio: tps65219: Fix GPIO input value reads
ecced0076b70 drm/virtio: fix NULL pointer dereference on fence allocation failure
ae583668f16d drm/virtio: fix memory leak of fence event on execbuffer failure
9f71d6b6bdb7 drm/xe: Keep walking on SVM eviction failure
599c17ac1c6a drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV
531d4cd03118 drm/xe: harden adjust_idledly() against divide-by-zero and overflow
bddaa5e4094c drm/xe/vm: nuke PTs only after unlinking contested VMAs
189ffc7b6cad drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
cd6e11b6ebe0 drm/nouveau: RCU-free the scheduler-containing nouveau_sched
780ad8e4df9f drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
9e13c398a234 drm/nouveau: Fix gem reference leak in validate_init()
872a5473c02a drm/nouveau: fix double-free in nvif_vmm_dtor
3e0861ebb9ec drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
eed63b613725 drm/nouveau: fix autosuspend cleanup during teardown
5b2fffbba290 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
06c69c64686a drm/nouveau/dmem: pin VRAM for the whole registered range
18f1cb48a799 drm/amdgpu: move userq fence wait out of signalling section
8372eea98082 drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
2556dd3a36be drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
d9bc9e5a356c drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
25901f180bde drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
7963b4d2445a drm/amdgpu/vcn5.0.1: fix video_timeout unit mismatch in jpeg reset wait
ca51e225a554 drm/amdgpu/vcn4.0.3: fix video_timeout unit mismatch in jpeg reset wait
545a1c879289 drm/amdgpu/userq: fix double jiffies conversion in hang detect timeout
707474d1d861 drm/amd/display: Bump frame warning limit for clang builds of dml
d111fde7b12f drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
02b74891624e drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
168e41173a9e drm/i915/dp_mst: Fix configuring TUs for a disconnected stream
67da63b54ced drm/i915/dp_mst: Fix configuring FEC for a disconnected stream
a9047237769c drm/i915/quirks: Limit eDP rate to HBR2 on HP Pavilion Plus 14-ew1
2dd0190e397e drm/i915: fix incorrect RCU teardown order
eb4af1467287 drm/imagination: Fix page count for page table for map() interface
d30ea2747164 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
a69c4b678db8 drm/client: fix restore of partially initialized client
b36d32f30c3f rds: ib: Clear the sg list when mapping an MR fails
f178300e2f56 mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
3361c93e4173 llc: reserve device headroom for allocated frames
6e20dabffbcd gpio: zynq: fix runtime PM leak on request error path
60a466f23190 gpio: cdev: fix kernel stack leak to user-space in error path
39748357db26 gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
f05a01fc7d4f kprobes: Fix permanent hang when flushing the kprobe optimizer
94214cf0a08d ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
4254d5878c32 ipv6: do not let ipv6_find_hdr() return an offset past the packet end
d7c5bd315923 ipe: protect the dm-verity root hash with RCU
e9015d32752f ipe: fix use-after-free when auditing a newly loaded policy
cb52f9f188c3 fsl/fman: Fix clk reference leak in read_dts_node()
260f586a80e7 writeback: report a Tasks-RCU quiescent state per cgwb drain pass
f97e6d0572d1 workqueue: Fix NULL current_pwq deref in flush dependency check
9dac137bf77e writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
37a2042748bc netfs: Fix missing alloc tagging of direct mempool allocations
1ae2a242c15b fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
b7459fddcb27 fprobe: Terminate the fgraph_data list when the reservation is not filled
520cf06b8ea0 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
dfacf401f83d cgroup/pids: Restore pids.events notifications in local mode
0751ab665cb3 cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict
9daa00445928 crypto: s390/hmac - Generate intermediate CV for API partial block handling
640d37fbd34d bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
e09d1c6729ee bna: prevent IOC timer rearm during teardown
80fbb0bc4d11 ata: libata-scsi: bound the ATA passthru sense descriptor writes
590395db5359 arm64: errata: match the target implementation CPU's own MIDR
ce71865bf43f arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
218a944b9e03 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
6df536c5acbc sctp: discard the rest of the packet on a stale-cookie error
08e835f5ec6e tcp: prevent collapsing skbs across boundary in rtx queue
b0e517961f09 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
31e3ef800705 virtio_net: copy zerocopy frags in start_xmit without NAPI
0f035ce43acd vsock: ignore empty child namespace mode writes
64da377e83d7 x86/sev: Make vTPM SVSM calls preemption-safe
61d4c3b00250 x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
51c17a944e3f x86/mce: Fix hardware debug register corruption on task migration
59af43ccece4 vlan: require the MAC header to be present in __vlan_insert_inner_tag()
415f5a755cec drm/pagemap: dma-unmap pages before handling migration errors
283550b74db3 mptcp: return sk_wait_data() errors from recvmsg()
ee4d5818a9ec sched/core: Account PSI IRQ time to the execution context, not the scheduling context
c7de8521947a perf/core: Fill branch entries with a single assignment
5286d4eb5cd7 perf/core: Fix a refcount leak in attach_perf_ctx_data()
841410754a71 perf/x86/intel: Delete dead NVL PEBS data-source initcall
074eee0bf0d6 perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs()
050c4b962184 perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused
67f0ef3b5ff6 perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED
23e769520fb8 perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
fc4fd0281ac8 autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
719bd33ab359 ovl: fix UAF in ovl_do_mkdir() debug print
90d51095371d vlan: ensure sufficient headroom in vlan_dev_hard_header()
43e3c3773b43 net/sched: sch_teql: fix shadowed err in __teql_resolve()
39de64a284fe bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
cb3528ad8bb4 llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
c517e8755960 gve: DQO: reject TSO packets with an out of range MSS
4de58b27f3ad gve: fix TX drop when GSO MSS is too small for hw
dc9e8964a21f gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO
c68f41574634 net: flush skb_defer_nodes in dev_cpu_dead()
1993c8745f85 net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
24ca932b612b tipc: Fix a data race on mon->peer_cnt in mon_timeout()
a9b968e42690 net/smc: fix UAF on lgr list traversal in smcr_port_err()
670f303169d2 net/rds: size a connection's path set by the transport it ends up with
fe6c8ea8bfd5 nfp: hold IPsec RX state under the XArray lock
e78b95cfd5df net: libwx: fix races in Tx timestamp handling
e461e9e49564 net: wangxun: implement soft quiesce for PCIe error recovery
671a68654a9d net: phylink: record the PHY only once bringup cannot fail
0f87720c7e4b tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
f306e465b5a2 net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq
aae2a1f1e3a0 net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
9173f503c959 bpf: Zero-fill other CPUs when BPF_F_CPU creates a per-cpu hash element
c664cca8f622 net: emac: move setting of netops to fix crash
062b56c0986f net/sched: act_ife: validate metadata length before decoding
b07bea42bf59 macsec: initialize SecY before registering the netdevice
fa1bdd972dd7 bonding: crypto offload enabled, non-offload slave failover, rekey failed
eabd0ae36117 drm/imagination: clamp freelist reconstruction requests
930318290d85 net: xps: reject an out of range traffic class
ff022fd9d0f0 vxlan: use one headroom snapshot for neighbour replies
63c5e48d6f7f ip_gre: Reject enabling collect metadata through changelink
027d9debeaed net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
81c38c742651 net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
780f373ae5d0 net: bcmgenet: do not skip WoL power up on GENET V1
006c7cce35e3 net: bcmgenet: initialize u64 stats seq counter for all queues
eeed00e40e24 net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
36c07127924f net: ipv6: keep room for the mac header in dst_dev_overhead()
298673397ea3 net: stmmac: clear stale buf->page after recycling on skb build failure
8b7aae8f0e96 tg3: use random MAC address when tg3_get_device_address fails
b3373c33c7b7 bpf: Fix BSWAP 32 and 16 on MIPS64
1bd91670966a bpf: Fix immediate JMP JEQ/JNE on MIPS32
ee17e21bc496 net: mdio: realtek-rtl9300: fix RTL931x C22 extended page selection
c8dad411b82d net: dsa: mv88e6xxx: 88E6191X and 88E6193X have no PTP
06f8310798ec vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
d7f474226809 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
43f6b647f209 veth: manage XDP program pointers during channel resize
f329d4242308 net: bcmgenet: stop Tx NAPI before disabling the queues
7cdbc5768b93 net/sched: act_gate: budget the per-entry list in get_fill_size
2450a3883672 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
4262b12277a3 nfc: llcp: fix slab-out-of-bounds reads when logging service names
0a0412745c86 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
9e51b24f684f nfc: llcp: fix -ENOMEM on connect with zero-length service name
a86987d03a4d nfc: st21nfca: validate ISO15693 inventory length
0b01a946b0f2 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
779e13c0fa7f nfc: virtual_ncidev: Add missing ioctl compat handler
6c488ec3e010 selftests/nci: Fix out-of-bounds store on thread join
1aefc05d7bcf selftests: nci: Fix uninitialized family ID on missing attribute
d5e1c92d09ca nfc: llcp: Fix race condition in accept_queue lifecycle
ead3daa724a8 selftests: nci: Correct pthread_create return value check
320a2ff49bdc nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
7b996cc06dda nfc: st21nfca: validate received frame size
6a17a5806e9f nfc: nfcmrvl: validate helper command length before pull
bb375f3c5990 bpf: Reject dev-bound-only programs on other devices
0b160417826d net/sched: fix potential stack infoleak in em_text_dump()
491aa3167ae0 eth: fbnic: Avoid rounding zero ring sizes
212d21e66921 net: stmmac: selftests: Account for alignment shift on dwmac1000 for Jumbo test
ec351284780a net: stmmac: size the RX buffers from the frame length, not the MTU
fa47a0487b48 net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
849cb2ba0341 net: stmmac: selftests: Capture all packets for vlan checks
adff25039a1f net: stmmac: selftests: Check the dev->features for S-TAG offload testing
ca0f523acf36 net: stmmac: selftests: Validate EEE based on the actual LPI timer value
2efadd72b95f net: stmmac: selftests: Support running selftests on DSA conduits
35bf3b23c9a8 sctp: hold asoc or transport before mod_timer() in timer handlers
25e31481f739 net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
b5b3fcb335e0 net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
ee1df60a0d0e firewire: cdev: fix back-transition for iso_resource_auto client resource
ba7d627dbc67 bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
0b6b2bb9b90a bpf: Reject pkt arguments in mutating subprogs
84ebb991ae98 bpf: Fix bpf_sock context code generation
39ffceaddb10 bpf: Fix bounds check for skb-backed dynptrs
37dbcadd7683 thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds
1aca79e5cda2 PM: hibernate: Freeze kernel threads after image preallocation
61ee40a3f2c0 net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure
45b4701ab262 genetlink: report the real command id for dump-only ops in policy dumps
986ec9602ee8 net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
3001a103a367 net: spacemit: clear TX descriptor on fragment mapping failure
c593f38e1cdb s390/debug: Fix NULL pointer dereference in debug_info_copy()
b42ca15649e7 s390/debug: Do not register views for failed static debug areas
9cb99c37d03a drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable
b6c0c757c658 tg3: clean up PHYLIB resources on probe failure
d1b5fd969cc5 udp: remove a disconnected socket from the 4-tuple hash table
f7b3d38dd7c4 udp: relocate a connected socket in the 4-tuple hash table on re-connect
f9722746df13 ipv6: Fix dst leak for uncached routes.
05b442709bd5 net: usb: sr9700: include receive overhead in the length check
0ad83979a0fd dpll: use exact lookup for reference sync pin id
3950b9ec5e12 net: don't require the hwtstamp NDOs when a PHY provides timestamping
e03e77071e75 ipv6: Prevent rt6_insert_exception() for dying fib6_info.
696baf868e23 octeontx2-af: Fix memory scaling limitation in SR-IOV mode
89a7241fc7ec bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
9240fc1f2cde Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
b29b70bfa121 Bluetooth: btintel_pcie: validate device-supplied DMA indices
ad0d2d4ada51 Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
c777431395a4 drm/xe/gt_throttle: Report power brake as a throttle reason on CRI
7f9ba0b02387 ovpn: reject invalid peer VPN addresses
57fd86c10acb ovpn: reject multipeer peers without VPN addresses
47dd2b681911 ovpn: reject duplicate peer VPN addresses
2b09b0b13a8b ovpn: always unhash old VPN addresses before rehashing
72bd1bea37ea ovpn: replace bind when clearing stale local source
e283009151d3 ovpn: replace bind when learning local endpoint
400f3cd8ff05 ovpn: validate peer state before caching UDP dst
2149f81ffd4c ovpn: track UDP socket route key for peer dst cache
5cdb2076fbe2 ovpn: skip UDP source validation for unspecified addresses
ae754c2b702a ovpn: preserve IPv6 scope id for netlink peer endpoints
9b796251c3cc drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
8910994f4d12 pinctrl: tegra238: Fix register bank for AON pin groups
49762b1b881b drm/virtio: sync shmem backing on guest-bound transfers
bed76f2c0f9e Revert "drm/virtio: Allow importing prime buffers when 3D is enabled"
7c8deb77d05b drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
02df4e24dc4c drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
749d8bb964b3 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
f75066c79d1e drm/virtio: fix object leak when drm_gem_handle_create() fails
1301a1292c67 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
86a0e945fb64 bpf: Check params size before reading reserved fields
9d4be026bdff net: usb: catc: bound the RX packet length in catc_rx_done()
4105870a4b8a bpf: Bound ownership depth through local kptrs and graph roots
b34ae23eb781 net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset
ddc34cc0834c sctp: avoid livelock while updating retransmit path
ce93f8561f87 eth: fbnic: Handle FW mailbox completions flagged with an error
a969db6548a1 eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
4f4b767ffea7 eth: fbnic: reset num_napi when the napi vectors are freed
1fb569cf3bf9 eth: fbnic: use the Rx queue napi pointer to find the napi vector
16ff1023213c eth: fbnic: Handle maximum standalone channels
4ca1503491f1 net: ethtool: keep rtnl_lock for the ioctl self test
b0afb7c7ca27 ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
0fdb944d4df0 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
c20f755338ca net: gue: reject invalid REMCSUM offsets
650787233c2f net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
cdf9203b168a drm/nouveau/disp: don't reject HDMI config on cards without SCDC
b862c332bfa8 drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
391517da7fd5 drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
253a27ae7afe pinctrl: qcom: ipq5210: Publish the OF module alias
9f80910a87a9 ocfs2: make ocfs2_calc_xattr_init() return void
9b583795feb5 arm64: io: Reject non-user protection in ioremap_prot()
0321f3c891f3 netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
5ad109938f0d ipvs: revalidate ihl before icmp_send
70a725baef91 netfilter: nft_synproxy: use the family-aware checksum helper
8137a39e08e8 netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
f26652e99f51 netfilter: flowtable: publish HW_DEAD after worker is done
e2ccbbb270f8 gpiolib: use of_node_name if line-name is missing
06b78f3c925f ipv4: fib: fix data-race and stale genid check around nh->nh_saddr
0d449edab5b1 libbpf: Reject truncated ldimm64 CO-RE relocations
8e4cbcca1e0a bpf: Restrict CO-RE poisoning to relocatable instructions
091b40845bd3 bpf: Preserve packet pointer class displacement in regsafe()
56dc616d7a1f bpf: Make post-verification instruction rewrites killable
688fd49e2dfe net/mlx5: LAG, reload IB reps of LAG master before the rest
efa4cfabced0 net/mlx5: SD, unload reps on shared FDB create error path
bd4dcb995574 net/mlx5: devcom, Base component size on linked devices
5d2f913258ba octeontx2-af: use seq_file for rsrc_alloc debugfs
ab14b5bbb871 net: pcs: rzn1-miic: Fix config array initialization
2f898f9ec7c7 net/sched: cls_u32: fix manual hash table handle IDR aliasing
4bab07f7b74e eth: fbnic: Fix payload page pool error cleanup
87ce4b53b743 bpf: Skip unsettled links in link iterator
3c1e0a4bc156 xsk: Use a 32-bit compare in xsk_map_gen_lookup
3cdc6e12ff79 fs: avoid repeated scans in evict_inodes()
9a86ff5e1bf3 netfs, afs: Fix symlink reading
71ab3046a73b netfs: Fix netfs_read_gaps() to use separate sink folios
5af61cd2b595 s390/cio: Guard PMCW field accesses with dnv check
7b0ae882b861 s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points
1b8e7661d07b s390/cio: Fix cio_update_schib() to not cache invalid schib
704f1ce7fe7f s390/pci/docs: Fix sriov_numvfs attribute name
09d610f7a972 scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
2ef65974d040 selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode
03ced4687fb7 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
edcb84ee607a Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
800c28b0c25d Bluetooth: SMP: reject Security Request over BR/EDR
7ed50d2b2fc0 pinctrl: sunxi: A523: fix voltage withstand encoding
3ddf8383b544 scsi: sd_zbc: Reject disks with too many zones
ca688bb20795 scsi: block: Fix zones_cond out-of-bounds write on zone report
e1ca4e3a380e squashfs: Add dictionary size range check to prevent shift-out-of-bounds
bb79f2334ab8 KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP
33135c7653f6 KVM: selftests: fix steal_time for arm64 with host page size > 4K
7a6b9d829f13 KVM: arm64: Match hyp text by physical address in fix_host_ownership()
166d27b5908d KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0
7b5e99d28674 KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
f0cd8ffae092 KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
bae3e4493046 KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
0895f04f763d KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save
318354021fea KVM: arm64: vgic-its: Free the caches when GITS_BASER changes
f3514b599eea RISC-V: KVM: Fix perf-backed counter accounting across stop and read
ca5f939b49b5 RISC-V: KVM: Report snapshot write failure to the guest
c4ff5b02120c RISC-V: KVM: Preserve firmware counter value across stop/start
6da466502621 KVM: riscv: Fix NACL hfence entry update order
650b2606b134 RISC-V: KVM: Fix the conversion between vsip and hvip
0b69a3c24a06 HID: bpf: fix __hid_bpf_hw_check_params report length
ee25833f037f HID: amd_sfh: Validate PCI BAR size before mapping
f3a0ceb68003 pinctrl: generic: serialise pinctrl_generic_dt_node_to_map()
0602f3e9eebd pinctrl: meson: Fix typo in s4 group name
d7cd5ebe1398 bpf, arm64: set up the frame pointer for the exception callback
cb3f6c0c211e bpf: Fix u32 overflow issue in map batch operations
889420541911 bpf, sockmap: Fix self-redirect copied_seq double-counting
f101602415fb bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
cba54d142c43 bpf: Fix out-of-bounds read of rtt_min in sock_ops
4e48fe9b1c77 bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
413f72ce8c82 bpf: Allow terminal gotox instructions
032d037c42c0 KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr()
45f3f248297c HID: elecom: fix bus type for M-XGL20DLBK
2b25f11ec52e HID: winwing: fix use-after-free in force feedback teardown
86ed8ca0bb3d HID: multitouch: Add report ID mismatch quirk for ASUS ROG Z13 Folio
ee7246bccb9d tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
2534a5e5d360 bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
b8fa56722e9c bpf: Fix divide-by-zero in btf_struct_walk()
ff94a50f1eb1 selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc
fca71ead7a20 bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
707567d2edf6 bpf: Fix bpf_skb_change_tail wrt csum partial skbs
116bba758533 s390/uv: Prevent potential out-of-bounds read
91867f46cfb6 s390/uv: Fix loop condition in uv_find_secrets
90bd832b2bc3 KVM: s390: Fix race in _destroy_pages_crste()
c958f0498891 KVM: s390: Fix potential races in dat skey functions
75867536746a KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()
7a33007b95c8 KVM: s390: Add missing srcu in kvm_s390_set_irq_state()
d0e3bf633f05 KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
94c43c7df464 KVM: s390: Fix _gaccess_shadow_fault()
66db037037f6 KVM: s390: Fix dirty marking in adapter_indicators_set*()
63d2ecad81aa remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage
0b1eebd35968 drm/amd/display: Remove sink usage from DPMS
df064aea8f23 ALSA: hda/realtek: Add StarFighter HDA SSID
84332282a7ea ALSA: hda/realtek: Limit Star Labs internal mic boost
d55c308af33f drm/amd/display: Atomize IRQ register read/modify/write ops