2ef81154eee5 Linux 7.3.3-xanmod1
8afa59f2dd1a Merge tag 'v7.3.3' into 7.3
d50d994bffa3 Linux 7.3.3
b0378161c28e xen-blkback: Avoid UAF when reading I/O statistics
fb38fc58acb2 xen-netback: defer xenvif_mcast_addr_list_free()
4867687b6ad2 xen-netback: Fix UAF when reading statistics data
df4510aec006 Linux 7.3.2
e53d1cf05da8 tun: Require CAP_NET_ADMIN to attach to an ownerless device
c314b2be197a ksmbd: keep retry timeout clamp bounds constant
b0ce89f6f6ed media: rc: Fix build failure with CONFIG_LIRC disabled
efb488fd08fd rust_binder: wake epoll on self-work queued to poll thread
edacf65866a9 ksmbd: fix use-after-free after a failed durable reconnect
7b54fe3db87b ksmbd: rebind completed CREATE replays without draining the old channel
fcfad21ec64c ksmbd: fix named stream write and EOF handling
ff7debe48426 ksmbd: use the existing xattr name for a named stream
44950fdcc645 ksmbd: fix invalid pointer dereference when get_inode_acl() fails
a5b190b352b0 ksmbd: fix app-instance non-durable supersede session UAF
06b9fb5c9cee ksmbd: retry break notifications on another connection
c814ae191f8e ksmbd: track delivery of queued TCP writes
234689e9d914 ksmbd: use clear_and_wake_up_bit() directly
52bda0cf91b6 ksmbd: fix out-of-bounds read when padding the final compound response
824a572c0f90 ksmbd: fix SMB2 CREATE response buffer overflow
ece68b35c160 io_uring/net: fix multishot recv length limit accounting
f2de154da4fd io_uring/timeout: count cancelled timeouts in cq_timeouts
5f7e7afd5418 io_uring: defer foreign io-wq enqueues to task_work
8298ce6443ff io_uring/sqpoll: don't wait for the thread to exit
953174dcb862 io_uring: free the task context after a grace period
521861b17a10 io_uring/bpf-ops: clear bpf_ctx while submitting SQEs
1601d274c281 io_uring: free XArray nodes left by a failed store
e98b26bc2a25 io_uring: charge tctx nodes and personalities
9f1afd6d7068 io_uring/rsrc: charge buffer arrays and nodes to memcg
4f943e9fe98d io_uring/io-wq: no new workers once the exit has begun
6ee59400b977 io_uring: keep the drain active when a deferred drain request is started
cbb8c211b514 io_uring/net: don't retry a non-blocking connect() that fails with -EAGAIN
681fc755316c io_uring/register: enforce per-task restrictions in io_uring_register_blind()
cf635f0def46 io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()
beddc87a6349 io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT
49dd02e4f711 io_uring/kbuf: advance head when a pickup empties the buffer ring
eefd13e3cb2c accel/amdxdna: Add support for AIE2 revision 9
72b1e2fc0c87 HID: hid-lenovo-go-s: Use devm_kzalloc for drvdata
fba8d8f8352c HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata struct
d69db0135c6e HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resume
f8a0d1a1ff0a HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfg
313199a99021 HID: hid-lenovo-go-s: Move attribute init to after device query
542a74e19639 HID: hid-lenovo-go-s: Bound stale reply window before reusing send_cmd_complete
cd4a95557f3c HID: hid-lenovo-go-s: Add suspend function and gate access under bool.
5ae8f5f45f43 HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callback
0c66569ee947 HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out()
df2b31428cb2 HID: hid-lenovo-go-s: Prevent deadlock if device removed during setup
9d918eadad41 HID: roccat: savu: reject short special reports
977b08b4f7e2 HID: roccat: ryos: reject short special reports
1e190aef0861 HID: roccat: pyra: reject short button reports
1b19a4415e9b HID: roccat: kovaplus: reject short button reports
ab7282fa4d95 HID: roccat: konepure: reject short button reports
2265963373b8 HID: roccat: koneplus: reject short button reports
9933238906e5 HID: roccat: isku: reject short button reports
eea6b9207e9a HID: quirks: Always poll the Anne Pro 2 with product ID a292
9e1793d9db78 HID: pxrc: reject short input reports
f8a96c52cf87 HID: prodikeys: validate fixed-format MIDI reports
ebe54f9e793b HID: picoLCD: check for fb_deferred_io_init() error
54a9b3a72c66 HID: mcp2221: validate response report length
19711bd64d60 HID: mcp2221: always initialize and cancel init_work
6ee339f14d81 HID: mcp2200: validate READ_ALL response length
28d0c1832821 HID: logitech-dj: validate unnumbered keyboard reports
f768b56558e8 HID: elo: reject short touchscreen reports
773307dd4c3e HID: cp2112: validate response report lengths
b747cf831555 HID: cougar: reject short special-key reports
20518a118bf1 HID: core: Fix out-of-bounds left shift by 32 in s32ton()
6b510a8a03a1 HID: asus: do not send keyboard init reports to touchpads
a59661811be6 HID: amd_sfh: Use report type from request node
368106434cb0 HID: amd_sfh: Remove unsupported motion-state field from accelerometer report
e06f76c09e7c HID: zydacron: validate key report length
5226d19421d2 HID: usbhid: skip interrupt IN polling for devices with no input reports
39006b7b1a7f KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form
9ffe72ff3f1e KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users
fd224f1778e1 KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready
024be82ac4c4 KVM: guest_memfd: take the invalidate lock when unbinding a dying file
99944e95a375 KVM: guest_memfd: Split bind() into prepare()+commit() phases
0f5a9b6e7b22 KVM: TDX: Enable Bus Lock VM exit
e29464ad0eb3 KVM: TDX: Don't assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason()
55bbc1ab4873 KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return
07c720cd164f KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason
02b92b0d7cdc KVM: TDX: Enable Notify VM exit
8afd903bf712 KVM: TDX: Check if there is valid exit infos based on vp_enter_ret
416da9d1824c KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak
e34057e59ed7 KVM: x86: Take SRCU in kvm_zap_gfn_range()
6513f7be321e KVM: x86: Request event processing for exception VM-Exits
88df2f2f928a KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload
873ddb74ff02 KVM: x86: Clear hardware HLT state when userspace makes a vCPU not-halted
54f21a7fd8cc KVM: x86/xen: Take kvm->srcu in __kvm_xen_has_interrupt()
ff7b74473976 KVM: x86/xen: Enforce 4-byte alignment of vcpu_info registration
99aa3b5a308d KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0
73f427e5afd9 KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has
0a751ea342e3 KVM: VMX: Preserve negative return value in vmx_handle_exit() with bus lock detected
b8fbd8c259c0 KVM: VMX: Make handle_bus_lock_vmexit() a shared helper
64bc41553f64 KVM: VMX: Formally define KVM's "0xdead" exit reason used for failed VM-Enter
045e0736e5bd KVM: VMX: Disallow using to_vmx() in common VT code
61478eb01872 KVM: Use goto to handle errors during memslot preparation
359888db0e22 KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state
81c460713ca6 KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0
7d787fb34e82 KVM: SVM: Trigger new ASID allocation in both VMCBs on pCPU switch
a9a7f2d8bd7d KVM: Only bind memslot to guest_memfd instance for CREATE operations
92f77936554b ALSA: x86: hdmi: fix chmap array missing terminator entry
3c7dec767830 x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()
0d2f62032027 x86/cpuid: Mark CPUID function 0x23 as being indexed
18edbcab25d9 rxrpc: Fix return in rxrpc_recvmsg_data() for service calls
3b3127f5a85f rxrpc: Fix double IRQ enablement
6b576c59a8ce afs: Fix afs to abort the rxrpc call on send error
3f37c5ff0b93 rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data()
ec98e8bdbde8 rxrpc: Fix update of call->tx_pending without holding lock
5ed5c9b33f37 SUNRPC: Treat every TLS error alert as fatal
9d161fa805f4 sunrpc: treat empty auth.unix.gid replies as negative entries
86f3078ed2bd SUNRPC: trace an accepted transport before publishing it
0d5885257774 SUNRPC: Resume receiving after a TLS control record
7ad8c8ee23c2 SUNRPC: Reject a TLS alert record that is not two octets
42923e0fc817 SUNRPC: Reject a socket that already has an svc_sock attached
1c582f719010 sunrpc: pin gss module across auth_domain RCU free
9abeb05bce3f SUNRPC: keep the first error in svc_register()
bd4beccf0899 sunrpc: honor the netlink unix_gid NEGATIVE flag
147a30e2e482 SUNRPC: fix oversized GSS proxy token copy
99eb91d68e73 SUNRPC: Do not credit control-record octets to the RPC stream
70614e41d379 SUNRPC: Copy the deferred RPC Call from the head buffer
35fc1e20d2b0 nfsd: zero NFSv4 COMPOUND tag padding
49f6570e1a89 NFSD: validate transport name in listener_set before serv creation
d67360912543 NFSD: Set nn->cld_net before registering the cld pipe
cca29c873bb8 NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE on a non-regular file
df6a0f9256e2 NFSD: Resolve the recall-any mask names in the trace format
cf44075507de NFSD: Reject an oversized principal hash from nfsdcld
479651d608f3 nfsd: propagate SETXATTR value decode errors
ed98b0c57e5e nfsd: preflight SEQUENCE replies before accepting a slot
c0dacde381e1 NFSD: Map flex file layout IDs through the request's user namespace
a52df9d2bde0 NFSD: map fh_verify() status codes for NFS_ACLv3 replies
42c6f630b87c nfsd: honour client-provided attributes for NFS4_CREATE_EXCLUSIVE4_1
a596d1979fcb nfsd: hold cl_lock in client_has_openowners()
35c0d6b9d14c NFSD: Fix out-of-bounds read in the rpc_status dump
24a2a428cb2a nfsd: Fix id-to-name cache entry leak in idtoname_parse()
a307eaf5f55d nfsd: fetch direct I/O alignment for files handed to the filecache
542bce50f177 NFSD: Fail a pool_threads read whose reply does not fit
a8bb6c0085ab nfsd: don't offer flexfiles layouts when NFSv3 isn't being served
4e3c12151f13 nfsd: don't modify a session slot when replaying its cached reply
226c11eb2004 NFSD: Don't complete a cld upcall the daemon has not read
cd58899f22a9 NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients
d568594503a0 NFSD: Destroy a recalled delegation the client does not hold
fea77ec4a376 NFSD: copy SETXATTR data from all XDR buffer segments
99ab5346b698 nfsd: clear XDR padding in GETXATTR replies
340fd5acb07f NFSD: cap the number of listeners accepted in listener_set
f29fa7b0e4d7 NFS/localio: report the stability a DIO WRITE actually has
e0bd99a6afb9 NFS/localio: fix nfs_local_dio_misaligned tracepoint
ca85441a75b5 NFS/localio: detect a short read or write before the iterator has moved
430e46dabbd9 NFS: Fix stale negative cache on failed nfs_mkdir()
2a31674c3e72 NFSv4/flexfiles: Bound page coalescing on the absolute stripe offset
2e58e4f9a8dc NFSv4/flexfiles: Use the full 64-bit stripe_unit
71f6e7a9ab81 NFSv4/flexfiles: Use the full 64-bit offset for read DS selection
fe52fa531945 NFSv4/flexfiles: fail I/O to the data server once a lock is lost
e3668ce48f89 NFSv4/filelayout: Anchor page coalescing on pattern_offset
db9ff4e24e34 NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from LAYOUTGET
f9ef68e05696 NFSv4: Fix a regression in the handling of CB_RECALL_ANY
fde95d71af2c NFSv4/pnfs: Free the netid when draining a data-server address list
92371c6d8b0e NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating
1c46038a0117 pnfs/blocklayout: Complete a device upcall when the pipe is closed
5131cc775413 pnfs/blocklayout: Complete a device upcall only on its own reply
7873ce517fc1 pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume ndc_immediate
3e7b577a8904 kernfs: don't lose IN_DELETE_SELF when decoding a file handle
c7e3ac100b0b xfs: map pNFS layouts to the end of the extent again
1ba1937de005 smb: client: validate the data area in SMB2_read()
8eec99e61b79 smb: client: validate SMB1 EA list bounds before parsing
d55c0c19b0d1 smb: client: validate NT transaction response layout and offsets
e505c266c315 smb: client: require stable pages for SMB compression
df63e0193388 smb: client: reject short SESSION_SETUP responses
1374082f0897 smb: client: reject short or out-of-range FIND response parameters
4dfc78e53f41 smb: client: reject FIND data areas that run past the received response
b3f511aa7f45 smb: client: reclaim credits for decrypted reads with no matching mid
be1bcc9147fa smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()
9615d78d537d smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan
7141cde58f9d smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2
31f6dbb29fe1 smb: client: fix fiemap wild read on empty truncated response
d26f7fbca425 smb: client: fix buffer overflow in SMB2_tcon()
ed62849db326 smb: client: don't resurrect an exiting tcon from cached dir workers
d5993c6146ad smb: client: bound POSIX lock data area by response length
956968544ae6 smb: smbdirect: fix buffer length underflow in RDMA transfers
c8a4c381fd68 smb: server: size directory name conversion buffer correctly
2d20d6246e96 x86/bugs: Adapt SRSO mitigation to Zen6
a056fd70150d xfs: reattach dquots after changing inode ids
2d3b089c3a61 xfs: range-check bc_levels array access in scrub tracepoints
8732d928601f xfs: propagate errors while checking null siblings
381cf36c19ef xfs: opportunistically skip btree block checks
73b25554d38f xfs: only written file data blocks can be shared
7aa055259d47 xfs: never reset the default quota timer
1576a107cea5 xfs: init inode number for tracepoint
ccf4fa942caa xfs: fix data fork block count check in xrep_inode_blockcounts
696ef990e101 xfs: fix correction of unwritten extents in quota file data fork
4fe6d43988e9 xfs: don't try to scrub self-referential dirent in metapath checker
2a2854c0b5b0 xfs: don't try to repair rtsummary if the summary file isn't computed
10fead7a6e6e xfs: don't subtract excess usage twice when computing agf_btreeblks
0f58d3e918d2 xfs: don't set a metadata directory's parent to sb_rootino
c7313e113412 xfs: don't scan across metadata/regular directory trees for dirents
2242470913eb xfs: don't rescan ifree and icount when frozen
666e40ff71d8 xfs: don't queue rmap update twice when reaping a fork
471e4ae43cc5 xfs: don't overrun incore inode when cleaning attr forks
cfbb7114e80e xfs: don't clear COWEXTSIZE on directories on reflink filesystems
7de12ac75210 xfs: don't allow sm_agno for non-group metadir path checking
1faee6fac8cb xfs: complain loudly when dirtree checker finds broken links
79e681c2d6fb xfs: clear set[ug]id mode bits when zapping attr fork
fac22ce28f83 xfs: clarify various parts of the bitmap API
01ceebca4a21 xfs: check for termination during rmap btree walk
bb29f3c85f00 xfs: check for fragments when full-extent sharing matches
e2768e65a5f2 xfs: bound inode fork length against the fork size during log recovery
229c4478a356 xfs: bound da-node entry count against the correct geometry
aa1cd2a9e5ce xfs: always zero the whole shortform header when zeroing attr fork
07108a934ff0 xfs: always report scrub errors in tracepoints
194dfc48a109 xfs: always report inode repair setup failures
2430132937e9 xfs: always forget cached ACLs if the attr fork swap succeeds
b5e9a2ca7637 xfs: abort directory tree repair whenever dl->aborted is set
afc2caf20937 xfs: update quota flags on secondary supers when metadir enabled
0a5959bdd18b xfs: rescan the AGs if incore delalloc counter is negative
c554aa3ff634 xfs: release ip after unlinked list store failure
1481b4644cd6 xfs: reject remote xattr entries with an out-of-range value length
c5c34a0a5a80 xfs: reject out-of-range attribute value lengths in xfs_attr_copy_value
c88682ce55ec xfs: reject absurdly large xattr value lengths in xchk_xattr_actor
05064c66ecfd xfs: reduce new btree slack factor if free space is negative
ee636421740b rtnetlink: wait for RCU readers in rtnl_link_unregister()
e81a69d22ae0 netfilter: nft_payload: restrict checksum offsets to known values
f38839a20269 xfs: fix xchk_stats_estimate_bufsize to allow for the trailing null
e5ae64394e87 xfs: actually check XFS_DIFLAG2_METADATA for metadata btree data forks
78c2c67d04d6 xfs: adjust checks for cross-AG reaping issues
074552c68a76 xfs: jump out of xchk_bmap_check_rmap if fatal signals
aa1862633297 xfs: mark overfull dabtree node blocks as corrupt
db77cc2d232a xfs: check fork type against dabtree block magic number
86598d7f4b0e xfs: abort dirtree repair if the live update hook dies
a66dacc78547 xfs: fix revalidation of xchk_dquot_iter cached mappings
01f15dc261e1 xfs: bail out of directory tree repairs on error
be6f30fb7187 xfs: assign an owner to scrub_stats_fops
a9ff42a62473 xfs: allow softlimit with no hardlimit in quota scrub
7322bbd8660a xfs: fix lost errno returned from xfarray_foliosort
7dd8e5cced0b xfs: don't repair fs summary counters with garbage
a463a9fe659d xfs: fix skipped inode mask handling in iscan
1e2d0332e619 xfs: don't proceed with xattr repair if the live update fails
d69bf84e316c xfs: validate rc_domain in xchk_rtrefcount_mergeable
95c96e9695b8 xfs: don't fix the directory tree if live update fails
1ff7b0bdabce xfs: flag excessive delalloc rt extents as corruption
1a00d111c253 xfs: zero out di_metatype when removing the metadir file iflag
a32c9a7f0dda xfs: don't pass iget failures up when marking ondisk inodes
a6de88e800a3 xfs: always reset incore attr fork buffer when resetting fork
18c2ab78f10c xfs: fix inode btree repair when a cluster is larger than a chunk
62136be2c4fb xfs: actually report corrupt xattrs as XFAIL during cross-referencing
65a65a295935 xfs: fix buffer overflow in corrupt inline attr structure
5ff42c585d34 xfs: fix unnecessary dapos truncation in xchk_dir_walk
45e05c784eee xfs: actually lock the metafile reservation when adjusting after repair
d46e7803780d xfs: avoid cross-rtgroup reaping after a repair
1e94102db79c xfs: online quotacheck must dirty dquot if enforcement adjustments needed
4fe8b75e3917 xfs: fix buffer overruns in xfs_ioc_attr_list
ef23fa3a55ed xfs: fix missing xfs_qm_adjust_dqlimits call in quotacheck repair
88a78147d88e xfs: fix xfs_rename_space_res for non-pptr filesystems
9f9521c7a9e5 xfs: fix ondisk symlink target validation in xrep_dinode_check_dfork
ad832ef85e5e xfs: compute the correct fdblocks/frextents for repair when they're negative
fdb2fbf39aa5 xfs: mark cow extents bad if there's no rmap mapping for them
9cd32a16634d xfs: clear the symlink zapped flag if inline symlink is ok
f46a6fdbe8cc ovl: skip copy up of empty security.capability
3d92153206ce ovl: set the revalidate flags after d_instantiate()
125789d6336c ovl: reserve space for the casefolded name terminator
ffe508adf85a ovl: read the nlink xattr of every indexed non-dir
859d56d13560 ovl: fortify ovl_copy_xattr() against underlying layer modifications
7b2150d4dd5f ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN
0aa08f8f0787 ovl: fix a torn path in ovl_get_redirect()
e35c3b1dc69b ovl: do not copy up an xattr value that was never read
0defa3e443bb ovl: do not copy up a dentry that was removed
d3cd02c8c691 ovl: check the casefold flag of directories only
3bf6fda63259 ovl: check that the parents of volatile/dirty are dirs
5ccb1e71dfea ovl: always encode the origin fh when index is enabled
77c9b481faac ovl: use the pinned upper dir in ovl_fix_origin()
b2d4777172be ovl: take a snapshot of the name for copy up
ea5327a9228b ovl: set OVL_WHITEOUTS before publishing the upper dir
73aae2a6b5b3 ovl: hold a reference on the parent in readdir
558cb79cb242 smb: client: stop processing a read response after a receive error
20a2fb9842ca smb: client: hold server info until cifsd exits
d6074ea8379b smb: client: fix OOB last_entry pointer from unbounded LastNameOffset
d2052367cbda ocfs2: snapshot dentry names in file and setattr traces
2d9e864c2344 ocfs2: pin refcount trees before dropping the lookup lock
5778be09eab7 ocfs2: fix chunk number of the first chunk in a local quota file
cd3119eb1ebf ocfs2: cancel quota sync work before freeing quota info
574aa7782c78 ocfs2/dlm: hold the lookup reference across convert AST enqueue
0eb7cd164169 ocfs2/dlm: hold a lock reference across grant AST enqueue
7294ec25a13c ocfs2/heartbeat: unlink live slots when their node is missing
d2d69a681cf8 media: rc: Fix ABBA deadlock by making locks more fine grained
341e2ba83d23 media: rc: Fix use after free in bpf progs
46607d55c3f2 media: rc: After rc_unregister_device() timers can be re-armed
ba90c13e3347 media: rc: Use after free in ir_raw_event_handle()
7df669eab2ab media: rc: mce_kbd: Fix inconsistent locking of keylock
9a9c8607260a media: rc: Fix race condition during rc_register_device()
8e0ca5ea8320 media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister
0b7c968ec9b9 media: rc: fintek-cir: process a full RX buffer instead of overflowing it
7a6e8c9726df media: rc: Ensure registered is cleared in error path
1a565b81f8dd media: rc: Ensure that rc_unregister_device() does not free input device
35f55810ee24 nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF
91895cfc28ae nvmem: core: Fix OOB read for bit offsets of more than one byte
ea2aaf6bda6b pps: generators: don't use the driver's info after unregister
190a92be7853 power: supply: sbs-battery: disable polling before supply teardown
2a3ac39a7a26 power: supply: pf1550: drain IRQ work before unregistering supplies
8a9f16b5237e phy: core: Fix race-condition between _of_phy_get() and try_module_get()
6cfde28fca86 resource: report a devm_request_resource() conflict under the lock
d858330e288a spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout
ac2859c61ecf ufs: use u64 for directory size in ufs_last_byte
adb693d0369c usb: gadget: fix refcount underflow in gadgetfs_bind() error path
a2942b3abb5b vfio/nvgrace-gpu: Use a core-only open_device in fallback mode
3f4c7168ee28 virtio_net: atomically disable rx mode work
40e3d300cc7e wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement
6609261ccf32 wifi: ath9k: delete channel-context timers on deinit
5f4b2debc87b xen-blkfront: unbind irq before tearing down ring and shadow requests
b0e79d0ed03e staging: rtl8723bs: fix protected RX frame validation in decrypt path
928335263daf serial: core: shut down initialized port on removal
bd04acf9b9d5 scsi: dc395x: sync the waiting_timer before freeing the host
34500fda2384 net: sched: prevent scheduling deactivated qdiscs
d6bb100e3feb mtd: virt-concat: unlink discarded items before freeing
6c3c09d54a43 mtd: virt-concat: unlink concat node before freeing it
ce2b83e47af4 mshv_vtl: detach poll waiter on POLLFREE
aff16e324463 mptcp: hold MP_JOIN msk ref when cloning reqsk
9efc8d0c9c81 mm: khugepaged: fix swap entry value to folio_pfn()
6bfd20c1f7ef mm: khugepaged: fix folio is used after pte_unmap_unlock()
0ff1c54374e9 mm: khugepaged: fix folio is used after folio_put/unlock()
863ecacdae9e mm/truncate: look up the end-edge straddler by index
93c839762ea9 mm/slab: sample slab_state once in kmem_cache_destroy()
b8c683bd5482 mm/rmap: don't discard lazyfree THPs at PMD level
b81d7da262d9 media: s5p-mfc: use timer_shutdown_sync() for the self-rearming watchdog
e0e12b25b102 media: redrat3: fix UAF in probe error path leaving rc device registered
f402682026d5 media: microchip-isc: take a reference on the parsed endpoints
e7dd17ce3190 media: microchip-csi2dc: fix async notifier leak on probe error path
71de8e33596c media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA buffers
9e393784a902 media: imx-jpeg: cancel timeout worker when streaming stops
f6b21af3e32f media: gspca: use vb2_video_unregister_device() on disconnect
47b32af13359 media: cx23885: unregister DVB bus when SP2 CI setup fails
c3d0261c4fae KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls
fabc002f6396 KVM: pfncache: use a dedicated invalidation sequence for cache refresh
2fa83c615f8d KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot
73a1e1bfe3db iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown
212557010f57 iomap: don't resubmit an ioend after ->writeback_submit() failed
11239f2b509c io_uring/io-wq: save worker type before dropping its reference
f214e9fe86a0 HID: hiddev: keep state alive through disconnect unlock
62fa0acd3bd8 genirq: Move interrupt thread exit_work object to irqaction
08aaea3e62b2 genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes
10c13801ea38 fsverity: Set S_VERITY only after rollback is no longer possible
14a853bf3e6f fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
a6e222f1d75b filelock: keep superblock active through delegation wait
4bc608af98a3 fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use
f099d5adad31 fbdev: atmel_lcdfb: Prevent FIFO work after removal
4fa318e637dc drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase
19502449eeea Bluetooth: hci_vhci: Pin module for debugfs file operations
01ab732291bb ASoC: amd: ps: fix snd_acp63_remove() teardown ordering
76319a56f069 ALSA: pcmtest: handle multiple wraps in random capture fill
fb5ae914176d ALSA: emux: Fix UAF of soundfont zones at note-on
aa7e5d71f90c ALSA: control: Fix UAF in snd_ctl_elem_add() on card disconnect
35003a3a2221 accel/amdxdna: clear the mailbox channel pointer when starting it fails
64112b14e30c rust: rcpufreq_dt: add module alias
3eba9d12ef59 rust: module_param: Fix potentially incorrect access of `SetOnce<T>`
13d0556da30f rust: fwctl: declare cfi_encoding for fwctl_rpc_scope
b6ef73666dc4 rust: cpufreq: reject NULL from cpufreq_cpu_get()
b91e8d8c2ed9 rust: configfs: fix data offset calculation for subsystem callbacks
84bbe321c4c3 rust: bug: update the SAFETY comment for warn_slowpath_fmt() on UML
e05c740e7536 rust: bug: pass TAINT_WARN to warn_slowpath_fmt() on UML
9c64b4a95500 rust: block: require `Sync` for `Operations::QueueData`
acb67dcaf7c5 rust: block: fix `Send` bound for `GenDisk`
0d1415d4f614 rust: bitmap: restrict bitmap length to at most i32::MAX
5628b545fda2 rust: bindings: fix VM_MAYSHARE value
c49e6b77a65b rust: bindings: fix `VM_MAYSHARE` blocklist entry
eb826c12c094 objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0
7d3df0125735 klist: avoid accesses after waking klist_remove()
dfba346a73fb HID: wacom: Write shared touch initial status only once
b17e2a13af7c HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration
f1fb9f9087c7 HID: wacom: Redesign shared sibling data lifecycle
8e56f274d61a HID: wacom: Fix Use-After-Free in wacom_bamboo_pad
4e1bf2f5fe28 HID: wacom: Fix Use-After-Free in wacom_intuos_pad
9970418ce814 HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration
6d10563bdbba HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities
47597992e6c2 s390/zcrypt: Guard domain index uses against speculative bypass
21268907891d s390/zcrypt: Fix out-of-bounds ptr advance in cca_query_crypto_facility()
0f0aa2b560a6 s390/zcrypt: Fix and improve zcrypt reply message verification checks
1653ab681d83 s390/vmcp: Initialize full session info to zero
7ababff20914 s390/signal: Fix incorrect return address in signal frame
e3d89fe35617 s390/probes: Fix wrong opcode for cgrb fixup
641040939ef8 s390/kprobes: Prevent kprobes on instructions with exception table entry
47cbef607039 s390/extable: Fix mvcos instruction decoding
0bd89971c20e s390/cpum_cf: Check session mask before cpu offline
3ec7ced89d2c s390/pci: Add error cleanup in zpci_directed_irq_init()
da15d34d6cb9 s390/pci: Fix use-after-free race in zpci floating interrupt cleanup
5c1096d6d24a s390/pci: Fix resource leak in zpci MSI setup
b4d2ce74ee12 s390/pci: Fix MSI directed-mode teardown IRQ bit count
5259b258f234 s390/pci: Fix double-free and NULL deref in zpci MSI domain cleanup
a1fe31028ad6 drm/msm: Fix vm_bo use-after-free in with_vm_locks()
9d9d62dfef36 ata: sata_fsl: Fix use-after-free of host_priv on probe() failure
85db2c35fd93 ASoC: audio-graph-card2: Fix use-after-free in audio_graph2_link_c2c()
8db1a8614b4f apparmor: fix a use-after-free in aa_lookupn_ns()
51b21515bdac mm/hugetlb: fix use-after-free of a new anon folio
83798e46a01c mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte()
adf422b7587b media: ipu-bridge: Fix use-after-free in IVSC error path
a7962198ab36 media: imon: fix use-after-free in display_close via dev_dbg
ba097d24c56b media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path
544b575ba44d media: cx23885: Fix use-after-free in cx23885_finidev due to race condition
5e30e92df3a0 media: au0828: fix use-after-free in bulk_timeout timer on disconnect
25d0baa6adb4 lockd: Fix use-after-free in nlmsvc_retry_blocked
f79a0195db1f landlock: Fix superblock use-after-free in release_inode()
3e0bb6b07a95 iommufd: Fix event queue release use-after-free
5ee2e99021c5 nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection()
fd7843365a9e nvmet: fix use-after-free of the old registrant in nvmet_pr_preempt()
02b63c0227a3 platform/x86/amd: hfi: Fix a use-after-free when unloading the driver
465f3074762a platform/x86: asus-wmi: fix use-after-free unregistering kbd_led led
a3b57ce3e95d PM: EM: Fix use-after-free of perf domain in netlink doit handlers
3c9447811438 pps: generators: fix use-after-free when closing a removed device
a0aaf59e7a86 rapidio: mport_cdev: fix use-after-free in mport_mm_close()
47eb0ec18f7b RDMA/irdma: avoid use-after-free in icrdma_remove
0b6d8b41af15 RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup
0b5282963734 sched_ext: Fix use-after-free of a local reenq node left on an inactive cpu
72367dacb5c9 smb: client: fix use-after-free in cifs_ses_add_channel()
a3481ed0aea2 smb: client: fix use-after-free infoleak via the readdir resume name
5653608781a6 spmi: Fix potential use-after-free by grabbing of_node reference
75120454474b SUNRPC: fix netns use-after-free in write_gssp()
f6a3ccfc8d6f wifi: b43: fix use-after-free in b43_bcma_remove()
13610241843c cgroup: serialize migrations of newly forked processes
d78de077d45e vlan: restore HW VLAN tag insertion with reorder_hdr off
8c5f62dd9a0b ksmbd: verify transform SessionId matches the decrypted header
e14b640498c4 ksmbd: validate security descriptor offsets before pointer arithmetic
896ecf714703 ksmbd: validate AppInstanceId takeover target
98701475f3b3 ksmbd: use u8 for SMB2 oplock level values
74d241547a77 ksmbd: return end of file for reads past a named stream's data
caee6342acfa ksmbd: restore Kerberos logins with released ksmbd-tools
0e64f8956316 ksmbd: reserve space for the UTF-16 terminator in stream info
1767a5e45dbf ksmbd: reclaim ended sessions on logoff and expiration
97d489f68b85 ksmbd: prevent stale data from being written by SMB2 WRITE requests
1f8945d2eb20 ksmbd: prevent share root removal through empty paths
4f148586c9cb ksmbd: prevent session binding in compound requests
4cdee894f9bc ksmbd: preserve unreadable named streams on open
94f8462fc9d5 ksmbd: limit sessions on each connection
ddbcb0fe1b4a ksmbd: ignore network devices of other namespaces
4b333aed69cf ksmbd: hold a connection reference for each session channel
db30f8f330fc ksmbd: fix session reference leak on compounded SESSION_SETUP
b62ef8cfec93 ksmbd: fix parent dentry lifetime in directory enumeration
d1e92aa651ca ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()
828c02c65e2b ksmbd: fix OOB read and cross-share confusion in ksmbd_validate_name_reconnect()
e0e394d73795 ksmbd: fix extended session security negotiation for raw NTLMSSP
6789f0983f8e ksmbd: drain session procfs readers before dropping table references
be6794149311 ksmbd: deny access for an empty DACL instead of granting the request
4e4e8b38994a ksmbd: defer connection scavenging while session locks are busy
d82d8a248f61 ksmbd: avoid restoring only in-memory EOF after allocation change
ab5c9662b880 ksmbd: accept share config responses from ksmbd-tools before 3.5.3
bb0d41885365 backlight: qcom-wled: Fix WLED3 brightness register stride
617037871238 backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe
a1f4944f6f79 backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()
17f98aed6617 backlight: lm3630a: Cancel delayed work before destroying workqueue
1611ce4dc6cb Drivers: hv: vmbus: Bounds check the shared ring buffer indices
16da5d271322 driver core: take parent lock in async device attach
6ad5071fbef6 driver core: fix parent lock use-after-free on USB disconnect
c2c7c95e789e driver core: Limit the messages on a refused uevent
444dd434b508 driver core: take parent lock on deferred probe
b7bca38440a3 net/sched: act_ife: do not consume the inner header on egress
6b850585b41a net/sched: fix packet reordering on requeue
2702ae318630 net/sched: sch_teql: fix use-after-free on lower qdisc drop
04bc5e44895e net/sched: sch_teql: fix slaves_lock IRQ deadlock
0cc691a899a4 net/sched: cls_flower: avoid stale mask references after delete
c20b24907eb1 net/sched: cls_bpf: accept dev-bound programs on shared blocks
97fb3f1597cc serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports
b48a7e8bbb0a irqchip/gic-v5: Fix standalone IRSes OF probe
54a83cb2ac80 dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints
70a197fa961f xfs: fix integer overflow problem when setting large free areas
8ca05d997cda wwan: wwan_hwsim: Pin module for debugfs file operations
f022984a4a1c udf: fix return value for non-recorded-allocated extents in udf_map_block()
e45356d83adc thunderbolt: Do not RPM complete unrelated subtrees on unplug
31209411c4f9 smb: client: fix early procfs exposure race
4bf4fb7f3234 smb: client: do not pass a NULL buf to is_oplock_break()
cb5303cfe9bc ocfs2: publish the filecheck owner before adding sysfs attributes
625bbfa9c160 ocfs2: pin owning modules for open debugfs files
ef1a59804c07 ocfs2: drain quorum work before removing the cluster
57a474ce387b ocfs2/dlm: drain join handlers before releasing module text
7f6a52f076d4 nfsd: fix race between client_info_show() and free_client()
6af7578840bd net: usb: pegasus: do not advance rx_skb->data on dropped frames
b8111914eb7c net: ipv4: add zero check for snd_cwnd_clamp
5f4bd9eebdd2 media: usbtv: fix null-pointer dereference on disconnect
5d17cf3d380d media: go7007: only set audio_enabled if go7007_snd_init() succeeded
e282da1201f1 media: em28xx: reject audio endpoint with zero packet size
e10b88635c81 media: cx88: Disable PCI device on MPEG initialization failure
be9fa57665ef libceph: bound mon_command ack decode to front len
2a4b6ae380a9 ksmbd: serialize directory emptiness checks with readdir
57f36ae23e6b kcsan: Avoid division by zero in kcsan_prandom_u32_max()
63700a2a8df0 kcov: ignore an out-of-range comparison count in write_comp_data()
10a58bf0107a fuse: don't BUG when the copy buffer is exhausted
d129cfc783b5 ceph: fail readdir when the MDS reply carries no dirfrag
11e9f0c8b30a blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
8602ec8effb0 ARM: 9524/1: mm: align hugetlb mappings to the huge page size
3c287de98388 wifi: mt76: mt7925: fix reset panic caused by the WM2 rx irq mask
934dd36b19d7 Bluetooth: forget a peer's RPA once it advertises its identity address
22c82f33ff0b ALSA: line6: Clear prev_fbuf on capture buffer release
2d9f3c97c407 clk: renesas: r9a08g046: Propagate clk rate for ETH TX mux clocks
026aa32c00b0 fork: don't create io threads once PF_POSTCOREDUMP is set
0e8cff375cd6 fork: move the coredump and exec checks into create_io_thread()
ababac26fb49 exec: cancel io_uring requests before de_thread()
f293f53f59c1 io_uring/timeout: don't lose a cancel as io-wq arms a timeout
c5e3cfa344dd io_uring/timeout: don't flush with the sequence behind the last flush
484a60bf6ae4 io_uring/timeout: don't put a sequence target behind the last flush
4db3e79955e8 io_uring: look up the file before queueing to io-wq
a49dbba64121 io_uring/timeout: don't end a linked timeout with 1
efbe2c7f6648 io_uring/timeout: no ABS update of multishot timeouts
8d8c471fd389 io_uring/net: don't retry recv on uncommitted buffers
e98168889a21 io_uring: don't pass restart error codes to userspace
56f0c2b9f8f7 io_uring/openclose: keep the lock in io_pipe_fixed()
2e3a64edeb79 io_uring/sqpoll: let the thread sleep on disabled rings
1989bc6b6657 io_uring/kbuf: handle index wrap in last buffer check
3affc16f4241 io_uring/zcrx: fix buffer offsets in areas above 4GB
be062d346246 io_uring/napi: don't busy poll past an expired timeout
ee771a45df5c io_uring/napi: make stale entries time out after 60s
67f3cb72d0b6 io_uring/wait: no early -ETIME if min_wait finds work
efe5d500ad36 io_uring/timeout: use the right clock for ABS updates
8f7fb6e535f3 io_uring/timeout: keep repeat count on multishot update
8740aae303e6 io_uring/timeout: don't skip over reached sequences
7b29df54ab00 io_uring/fdinfo: fix CQE dump of CQE32 rings
39ce48e9b495 io_uring/register: keep 128b SQEs intact on resize
6e979098da0e io_uring/register: handle index wrap when resizing
933a6d48e216 io_uring/register: don't wrap 32b CQEs when resizing
a84216f82581 io_uring: don't split 128b SQEs at the SQPOLL cap
a74e890ddfb2 io_uring: drop the CQE cache if a refill fails
3b7aadb9a5a1 io_uring/futex: allocate private hash before waiting
2c92f10b4a7c io_uring/poll: drop stale double poll entry on rearm
975da1f9f121 io_uring/wait: look at all CQ waiters on wake up
e4ee47968755 io_uring: wake ring pollers for local task_work
4a8ca109f0af io_uring/cancel: let CANCEL_ALL find parked requests
fc5dd19ec1aa io_uring/cancel: recognize "no timeout" on 32-bit
4c8649449365 io_uring/cancel: don't forget that the work was running
87468ed5d85d io_uring: don't lose a cancel as io-wq parks a request
782d5aac194a io_uring/poll: don't lose a cancel as io-wq arms poll
6fa54b56ea92 io_uring/io-wq: let cancel find picked up hashed work
f26d52326122 io_uring/io-wq: don't exit with a creation pending
5958704e872a io_uring/io-wq: don't strand work when a worker exits
6e39f9728ae6 io_uring/io-wq: don't go to sleep on pending work
96835abbb4c1 io_uring/mpscq: disable preemption while pushing
58ddf0ec7070 io_uring/cancel: rearm local work wake up before sleep
581ab347a5d5 io_uring: don't lose the DEFER_TASKRUN wake up
f334e79a11e0 io_uring: don't flood a cancelling task with task_work
59e45f44c3ce io_uring/io-wq: don't hide a link from cancellations
7df9a3b5eda5 io_uring/io-wq: don't lose the signal that ends work
340944e27b4b io_uring/wait: don't spin on a stuck overflow list
c4fe1024b2f3 io_uring/cmd: don't leave list poison in ->hash_node
6e11ce129b34 io_uring/waitid: own the request before clearing ->head
5e2e67801f18 platform: cznic: turris-omnia-mcu: Add missing MODULE_DEVICE_TABLE()
77afbe74dc5b wifi: ath12k: Increase RXDMA buffer ring size for default memory profile
7a4092ea607e wifi: ath12k: Make RXDMA buffer ring size configurable per memory profile
3310ab2f3d52 wifi: ath12k: convert DP_RX_RELEASE_RING_SIZE to inline helper
753a375bd54d wifi: ath12k: convert ATH12K_RX_DESC_COUNT to inline helper
471bf7dce307 wifi: ath12k: convert ATH12K_NUM_POOL_TX_DESC to inline helper
1615fa91c5e9 wifi: ath12k: convert DP_RXDMA_MONITOR_DST_RING_SIZE to inline helper
4e567ec40be8 wifi: ath12k: convert DP_RXDMA_MONITOR_BUF_RING_SIZE to inline helper
72603d155cbd wifi: ath12k: convert DP_TX_COMP_RING_SIZE to inline helper
5483e3312b18 wifi: ath12k: move dp_profile_params to dp.h
89092aa492f1 ksmbd: reject FSCTL_SET_ZERO_DATA on a directory handle
97cc014a2595 smb: smbdirect: don't hand out already failed sockets in smbdirect_socket_accept()
df7e97ff4f11 smb: smbdirect: release failed pending sockets of a listener
1ce50f83ed13 smb: smbdirect: don't wait for RDMA_CM_EVENT_DISCONNECTED in smbdirect_socket_destroy_sync()
d4a52e78378a ksmbd: wait for negotiation before receiving another PDU
1a9c180cd843 net: skbuff: propagate shared-frag marker in skb_zerocopy()