Linux 7.1-rc6

[Linus Torvalds]

Well, I wouldn't call this "small", but it is certainly smaller than
rc5 was. And I don't think there's anything particularly scary here,
so maybe we're still on track for a normal release cycle. Let's see.

Things look pretty normal except for the larger-than-I'd-wish-for size
(which I guess technically is "normal" these days too). The bulk of
the changes are drivers all over the place - GPU, networking, usb,
serial, sound, scsi ...  A little bit of everything.

There's also core networking and selftest updates. The rest is pretty
much spread out: architecture fixes (x86, mips, arm64 - mainly kvm),
filesystem fixes (smb, nfs), and some other random fixes (mm,
liveupdate).

Please keep testing,

                   Linus

---

Advait Dhamorikar (1):
      iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL

Aldo Conte (1):
      iio: light: cm3323: fix reg_conf not being initialized correctly

Aleksandr Golovnya (1):
      ksmbd: release ksmbd_inode ref via ksmbd_inode_put on lookup paths

Alexander Perlis (1):
      scsi: devinfo: Add BLIST_NO_RSOC for Promise VTrak E310f

Alexander Stein (1):
      gpio: mxc: fix irq_high handling

Alexandra Winter (1):
      net/smc: Do not re-initialize smc hashtables

Alexandre Ghiti (1):
      mm: memcontrol: propagate NMI slab stats to memcg vmstats

Alexandru Hossu (1):
      scsi: target: iscsi: Validate CHAP_R length before base64 decode

Alexis Bouzigues (1):
      i2c: virtio: mark device ready before registering the adapter

Alexis Lothoré (eBPF Foundation) (1):
      x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines

Ali Ganiyev (1):
      ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

Alice Ryhl (1):
      rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN

Andrei Vagin (1):
      Revert "x86/fpu: Refine and simplify the magic number check
during signal return"

Andy Shevchenko (1):
      iio: adc: nxp-sar-adc: Avoid division by zero

Antoniu Miclaus (3):
      iio: gyro: adis16260: fix division by zero in write_raw
      iio: chemical: scd30: fix division by zero in write_raw
      iio: adc: nxp-sar-adc: fix division by zero in write_raw

Arnd Bergmann (1):
      iommu, debugobjects: avoid gcc-16.1 section mismatch warnings

Ashutosh Desai (1):
      nfc: hci: fix out-of-bounds read in HCP header parsing

Balasubramani Vivekanandan (1):
      drm/xe: Restore IDLEDLY regiter on engine reset

Bartosz Golaszewski (4):
      gpio: shared: undo the vote of the proxy on GPIO free
      gpio: adnp: fix flow control regression caused by scoped_guard()
      gpio: shared: fix deadlock on shared proxy's parent removal
      gpio: shared: fix lockdep false positive by removing unneeded lock

Ben Hutchings (1):
      parport: Fix race between port and client registration

Benoît Monin (1):
      iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()

Berkant Koc (2):
      drm/hyperv: validate resolution_count and fix WIN8 fallback
      drm/hyperv: validate VMBus packet size in receive callback

Björn Töpel (1):
      net: Avoid checksumming unreadable skb tail on trim

Borislav Petkov (1):
      x86/microcode: Do not access MSR_IA32_PLATFORM_ID when running as a guest

Borislav Petkov (AMD) (1):
      Documentation/arch/x86: Hide clearcpuid=

Breno Leitao (1):
      net/iucv: fix locking in .getsockopt

Bruce Johnston (1):
      dm vdo: use GFP_NOIO for blkdev_issue_zeroout on format path

Byungchul Park (1):
      Revert "mm: introduce a new page type for page pool in page type"

Carl Lee (1):
      nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems

Chaitanya Sabnis (1):
      i2c: davinci: fix division by zero on missing clock-frequency

Chris Mason (1):
      netfilter: synproxy: refresh tcphdr after skb_ensure_writable

Christian König (2):
      drm/amdgpu: fix amdgpu_hmm_range_get_pages
      drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx

Christofer Jonason (1):
      iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux

Chuck Lever (10):
      sunrpc: prevent out-of-bounds read in __cache_seq_start()
      NFSD: Report whether fh_key was actually updated
      net/handshake: Use spin_lock_bh for hn_lock
      nvme-tcp: store negative errno in queue->tls_err
      net/handshake: Pass negative errno through handshake_complete()
      net/handshake: Take a long-lived file reference at submit
      net/handshake: hand off the pinned file reference to accept_doit
      net/handshake: Close the submit-side sock_hold race
      net/handshake: Verify file-reference balance in submit paths
      net/handshake: Drain pending requests at net namespace exit

Cássio Gabriel (5):
      ALSA: firewire-motu: Protect register DSP event queue positions
      ALSA: hda: cs35l56: Fix system name string leaks
      ALSA: pcm: oss: Fix setup list UAF on proc write error
      ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
      ASoC: codecs: simple-mux: Fix enum control bounds check

Dan Carpenter (5):
      iio: adc: qcom-spmi-adc5-gen3: Fix off by one in
adc5_gen3_get_fw_channel_data()
      usb: typec: tipd: Fix error code in tps6598x_probe()
      usb: dwc2: Fix use after free in debug code
      accel/ivpu: prevent uninitialized data bug in debugfs
      gpio: virtuser: Fix uninitialized data bug in
gpio_virtuser_direction_do_write()

David Ahern (1):
      xfrm: Check for underflow in xfrm_state_mtu

David Carlier (3):
      iio: adc: npcm: fix unbalanced clk_disable_unprepare()
      iio: gyro: itg3200: fix i2c read into the wrong stack location
      dma-buf: fix UAF in dma_buf_fd() tracepoint

David Francis (1):
      drm/amdkfd: Check for pdd drm file first in CRIU restore path

David Jeffery (1):
      scsi: core: Run queues for all non-SDEV_DEL devices from
scsi_run_host_queues

Deepanshu Kartikey (1):
      kernel/fork: validate exit_signal in kernel_clone()

Dev Jain (1):
      mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one

Dhabaleshwar Das (1):
      accel/rocket: fix UAF via dangling GEM handle in create_bo

Dipayaan Roy (2):
      net: mana: Add NULL guards in teardown path to prevent panic on
attach failure
      net: mana: Skip redundant detach on already-detached port

Dmitriy Zharov (1):
      Input: xpad - add support for ASUS ROG RAIKIRI II

Dmitry Torokhov (4):
      Input: xpad - fix out-of-bounds access for Share button
      Input: elan_i2c - validate firmware size before use
      Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
      Input: atmel_mxt_ts - check mem_size before calculating config memory size

Doruk Tan Ozturk (1):
      Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

Edson Juliano Drosdeck (1):
      ALSA: hda/realtek: Limit mic boost on Positivo DN140

Emily Ehlert (1):
      KVM: x86: Fix ERAPS RAP clear on INVPCID single-context invalidation

Eric Dumazet (4):
      ipv4: free net->ipv4.sysctl_local_reserved_ports after
unregister_net_sysctl_table()
      tunnels: load network headers after skb_cow() in
iptunnel_pmtud_build_icmp[v6]()
      vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
      tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

Eric Huang (2):
      drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
      drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

Eugen Hristev (1):
      MAINTAINERS, mailmap: change email for Eugen Hristev

Ewan D. Milne (1):
      scsi: scsi_debug: Add missing newline in scsi_debug_device_reset()

Fabian Lippold (1):
      ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1

Felix Gu (4):
      iio: light: veml6070: Fix resource leak in probe error path
      iio: adc: meson-saradc: fix calibration buffer leak on error
      iio: buffer: hw-consumer: fix use-after-free in error path
      usb: typec: fusb302: Fix resource leak when
devm_drm_dp_hpd_bridge_add() fails

Fernando Fernandez Mancera (2):
      netfilter: nf_tables: fix dst corruption in same register operation
      Revert "ipv6: preserve insertion order for same-scope addresses"

Florian Schmaus (1):
      kunit: fix use-after-free in debugfs when using kunit.filter

Florian Westphal (4):
      netfilter: nf_conntrack_gre: fix gre keymap list corruption
      netfilter: xt_cpu: prefer raw_smp_processor_id
      netfilter: disable payload mangling in userns
      netfilter: ebtables: fix OOB read in compat_mtw_from_user

Frank Wunderlich (1):
      net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration

Geoffrey D. Bennett (1):
      ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417

George Guo (1):
      kho: fix KHO_TREE_MAX_DEPTH for non-4KB page sizes

Greg Kroah-Hartman (13):
      Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
      iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
      iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
      iio: imu: adis16550: fix stack leak in trigger handler
      usb: typec: ucsi: ccg: reject firmware images without a ':' record header
      usb: typec: wcove: don't write past struct pd_message in
wcove_read_rx_buffer()
      usb: typec: altmodes/displayport: validate count before reading
Status Update VDO
      usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
      usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
      usb: typec: tcpm: bound altmode_desc[] per iteration in
svdm_consume_modes()
      usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
      usb: typec: ucsi: validate connector number in ucsi_connector_change()
      Revert "gpib: cb7210: Fix region leak when request_irq fails"

Guangshuo Li (4):
      counter: Fix refcount leak in counter_alloc() error path
      usb: gadget: f_hid: fix device reference leak in hidg_alloc()
      usb: gadget: net2280: Fix double free in probe error path
      uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory

Hamza Mahfooz (1):
      netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST
without direction check

Hang Cao (1):
      dt-bindings: usb: Fix EIC7700 USB reset's issue

Heitor Alves de Siqueira (5):
      usb: usbtmc: check URB actual_length for interrupt-IN notifications
      usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
      Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions
      Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
      Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()

Henri A (1):
      media: rc: igorplugusb: fix control request setup packet

Herbert Xu (1):
      xfrm: ipcomp: Free destination pages on acomp errors

Hisam Mehboob (1):
      KVM: selftests: Guard execinfo.h inclusion for non-glibc builds

Hongling Zeng (2):
      serial: sh-sci: fix memory region release in error path
      gpib: cb7210: Fix region leak when request_irq fails

Hongtao Lee (1):
      tools/bootconfig: Fix buf leaks in apply_xbc

Ian Abbott (2):
      comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
      comedi: comedi_test: fix check for valid scan_begin_src in
waveform_ai_cmdtest()

Ian Ray (1):
      MAINTAINERS: .mailmap: update after GEHC spin-off

Ido Schimmel (3):
      bridge: Fix sleep in atomic context in netlink path
      bridge: Fix sleep in atomic context in sysfs path
      selftests: rtnetlink: Add bridge promiscuity tests

Ilya Maximets (3):
      net: netlink: fix sending unassigned nsid after assigned one
      net: netlink: don't set nsid on local notifications
      selftests: net: add a test case for nsid in all nsid notifications

Ivan Lipski (1):
      drm/amd/display: Write REFCLK to 48MHz on DCN21

Ivan Vecera (3):
      dpll: export __dpll_device_change_ntf() for use under dpll_lock
      dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work
      dpll: zl3073x: make frequency monitor a per-device attribute

Jacques Nilo (3):
      serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
      serial: 8250: dispatch SysRq character in serial8250_handle_irq()
      serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()

Jakub Kicinski (25):
      ethtool: rss: avoid modifying the RSS context response
      ethtool: rss: add missing errno on RSS context delete
      ethtool: rss: fix falsely ignoring indir table updates
      ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
      ethtool: rss: fix hkey leak when indir_size is 0
      ethtool: rss: avoid device context leak on reply-build failure
      ethtool: module: call ethnl_ops_complete() on module flash errors
      ethtool: module: avoid leaking a netdev ref on module flash errors
      ethtool: module: avoid racy updates to dev->ethtool bitfield
      ethtool: module: check fw_flash_in_progress under rtnl_lock
      ethtool: module: fix cleanup if socket used for flashing multiple devices
      ethtool: cmis: require exact CDB reply length
      ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
      ethtool: cmis: validate start_cmd_payload_size from module
      ethtool: cmis: validate fw->size against start_cmd_payload_size
      ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
      ethtool: tsconfig: fix reply error handling
      ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY
lookup error
      ethtool: pse-pd: fix missing ethnl_ops_complete()
      ethtool: tsconfig: fix missing ethnl_ops_complete()
      ethtool: tsinfo: fix uninitialized stats on the by-PHC path
      ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
      ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
      ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
during fallback
      ethtool: eeprom: add more safeties to EEPROM Netlink fallback

Jakub Pisarczyk (1):
      ALSA: hda/cs420x: Add CS4208 fixup for iMac16,1

Jamal Hadi Salim (5):
      net: Introduce skb tc depth field to track packet loops
      net/sched: Revert "net/sched: Restrict conditions for adding
duplicating netems to qdisc tree"
      Revert "selftests/tc-testing: Add tests for restrictions on
netem duplication"
      net/sched: fix packet loop on netem when duplicate is on
      net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop

Jan Volckaert (1):
      USB: serial: option: add MeiG SRM813Q

Janusz Krzysztofik (1):
      drm/i915: Fix potential UAF in TTM object purge

Jason A. Donenfeld (1):
      wireguard: send: append trailer after expanding head

Jason Gunthorpe (1):
      iommu/vt-d: Simplify calculate_psi_aligned_address()

Jeremy Erazo (2):
      usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
      smb: client: detect short folioq copy in cifs_copy_folioq_to_iter()

Jiayuan Chen (5):
      netfilter: nft_fib_ipv6: walk fib6_siblings under RCU
      netfilter: nft_fib_ipv6: handle routes via external nexthop
      selftests: netfilter: add nft_fib_nexthop test
      ipv6: fix possible infinite loop in rt6_fill_node()
      ipv6: fix possible infinite loop in fib6_select_path()

Jijie Shao (2):
      net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
      net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path

Jingguo Tan (2):
      xfrm: esp: restore combined single-frag length gate
      vsock/virtio: bind uarg before filling zerocopy skb

Jingle Wu 吳金國 (2):
      Input: elan_i2c - add ic type 0x19
      Input: elan_i2c - increase device reset wait timeout after update FW

Joerg Roedel (2):
      MAINTAINERS: Add Vasant Hegde to reviewers of AMD IOMMU
      MAINTAINERS: Add my employer to my entries

Johan Hovold (9):
      tty: add missing tty_driver include to tty_port.h
      USB: serial: digi_acceleport: fix memory corruption with small endpoints
      USB: serial: keyspan: fix missing indat transfer sanity check
      USB: serial: mct_u232: fix memory corruption with small endpoint
      USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
      USB: serial: cypress_m8: fix memory corruption with small endpoint
      USB: serial: mxuport: fix memory corruption with small endpoint
      USB: serial: omninet: fix memory corruption with small endpoint
      USB: serial: safe_serial: fix memory corruption with small endpoint

Jouni Högander (2):
      drm/i915/psr: Block DC states on vblank enable when Panel Replay supported
      drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable

Junrui Luo (1):
      macsec: fix replay protection at XPN lower-PN wrap

Justin Iurman (1):
      ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

K Prateek Nayak (1):
      cpufreq/amd-pstate-ut: Disable dynamic_epp after the mode switch

Kai Aizen (1):
      usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind

Kean (1):
      HID: lenovo: Fix buffer over-read and unaligned access in X12
Tab raw_event handler

Keith Busch (1):
      blk-mq: reinsert cached request to the list

Kim Seer Paller (1):
      iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings

Kito Xu (veritas501) (1):
      net/sched: act_mirred: Fix blockcast recursion bypass leading to
stack overflow

Kris Kater (1):
      ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Lenovo Yoga Slim 7 14AGP11

Kuniyuki Iwashima (1):
      ip6: vti: Use ip6_tnl.net in vti6_changelink().

Laurent Pinchart (2):
      Revert "media: renesas: vsp1: Initialize format on all pads"
      Revert "media: renesas: vsp1: brx: Fix format propagation"

Lee Jones (3):
      nfc: llcp: Fix use-after-free in llcp_sock_release()
      nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
      HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

Lei Chen (1):
      KVM: x86: Rate-limit global clock updates on vCPU load

Li Ming (1):
      cxl/test: Update mock dev array before calling platform_device_add()

Lianqin Hu (1):
      ALSA: usb-audio: Add iface reset and delay quirk for TAE1160 USB Audio

Lim HyeonJun (1):
      io_uring/tctx: set ->io_uring before publishing the tctx node

Linpu Yu (1):
      ipc: limit next_id allocation to the valid ID range

Linus Torvalds (2):
      security/keys: fix missed RCU read section on lookup
      Linux 7.1-rc6

Liu Kai (1):
      HID: remove duplicate hid_warn_ratelimited definition

Lizhi Hou (1):
      accel/amdxdna: Block running when IOMMU is off

Lorenzo Stoakes (1):
      Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"

Louis Clinckx (2):
      HID: lenovo-go: reject non-USB transports in probe
      HID: lenovo-go: drop dead NULL check on to_usb_interface()

Lucien.Jheng (1):
      net: phy: air_en8811h: add AN8811HB MCU assert/deassert support

Luiz Augusto von Dentz (1):
      Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

Luka Gejak (1):
      net: hsr: fix potential OOB access in supervision frame handling

Maciej W. Rozycki (8):
      serial: zs: Fix swapped RI/DSR modem line transition counting
      serial: dz: Fix bootconsole message clobbering at chip reset
      serial: dz: Fix bootconsole handover lockup
      serial: zs: Fix bootconsole handover lockup
      serial: zs: Switch to using channel reset
      serial: dz: Convert to use a platform device
      serial: zs: Convert to use a platform device
      serial: dz: Enable modular build

Maoyi Xie (2):
      xfrm: route MIGRATE notifications to caller's netns
      ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

Marco Scardovi (2):
      gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
      gpio: rockchip: teardown bugs and resource leaks

Mark Brown (1):
      KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor

Matthew Maurer (1):
      rust_binder: Avoid holding lock when dropping delivered_death

Michael Bommarito (14):
      thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
      thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
      thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
      xfrm: ah: use skb_to_full_sk in async output callbacks
      usbip: vudc: Fix use after free bug in vudc_remove due to race condition
      usb: gadget: f_fs: copy only received bytes on short ep0 read
      usb: gadget: f_fs: serialize DMABUF cancel against request completion
      scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
      scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
      scsi: target: iscsi: Fix CRC overread and double-free in
iscsit_handle_text_cmd()
      scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
      octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
      l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
      drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO

Michael Roth (1):
      KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use

Michal Pecio (3):
      usb: core: Fix SuperSpeed root hub wMaxPacketSize
      usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
      usb: core: Clean up SuperSpeed/eUSB2 descriptor validation logging

Michał Grzelak (1):
      drm/i915/aux: use polling when irqs are unavailable

Mike Rapoport (Microsoft) (1):
      memblock: don't touch memblock arrays when memblock_free() is called late

Mikhail Gavrilov (1):
      x86/virt: Silence RCU lockdep splat in emergency virt callback path

Mikulas Patocka (1):
      hpfs: fix a crash if hpfs_map_dnode_bitmap fails

Milan P. Gandhi (1):
      scsi: megaraid_sas: Fix NULL pointer dereference on firmware
duplicate completion

Minh Nguyen (1):
      net: skbuff: fix missing zerocopy reference in pskb_carve helpers

Muhammad Bilal (3):
      Bluetooth: HIDP: fix missing length checks in hidp_input_report()
      Bluetooth: ISO: fix UAF in iso_recv_frame
      Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

Myeonghun Pak (2):
      HID: u2fzero: free allocated URB on probe errors
      serial: altera_jtaguart: handle uart_add_one_port() failures

Myrrh Periwinkle (2):
      usb: typec: ucsi: Check if power role change actually happened
before handling
      usb: typec: ucsi: Don't update power_supply on power role change
if not connected

Nathan Chancellor (1):
      Disable -Wattribute-alias for clang-23 and newer

NeilBrown (1):
      lockd: fix TEST handling when not all permissions are available.

Nicolás Bazaes (1):
      Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490

Oliver Hartkopp (1):
      bonding: refuse to enslave CAN devices

Pavel Begunkov (1):
      net: skbuff: fix pskb_carve leaking zcopy pages

Pavitra Jha (1):
      Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()

Pengpeng Hou (1):
      iio: chemical: mhz19b: reject oversized serial replies

Peter Chen (2):
      usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
acquisition failure
      usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
permanently leaks the runtime PM usage counter across bind/unbind
cycles

Peter Zijlstra (1):
      x86/kvm/vmx: Fix x86_64 CFI build

Pranay Samala (1):
      drm/i915/color: Fix HDR pre-CSC LUT programming loop

Prasanna S (1):
      serial: qcom-geni: fix UART_RX_PAR_EN bit position

Prathamesh Deshpande (1):
      net/mlx5: HWS: Reject unsupported remove-header action

Pratyush Yadav (Google) (2):
      memfd: deny writeable mappings when implying SEAL_WRITE
      kho: fix order calculation for kho_unpreserve_pages()

Qbeliw Tanaka (1):
      Input: xpad - add "Nova 2 Lite" from GameSir

Qi Tang (1):
      ipv6: validate extension header length before copying to cmsg

Qiang Ma (1):
      KVM: arm64: PMU: Preserve AArch32 counter low bits

Radhey Shyam Pandey (1):
      usb: dwc3: xilinx: fix error handling in zynqmp init error paths

Radu Sabau (1):
      iio: adc: ad4695: Fix call ordering in offload buffer postenable

Rafael J. Wysocki (4):
      Input: atlas - check ACPI_COMPANION() against NULL
      ACPI: button: Fix ACPI GPE handler leak during removal
      ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
      ACPI: button: Add missing device class clearing on probe failures

Rahul Chandelkar (1):
      ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

Rajat Gupta (1):
      drm: prevent integer overflows in dumb buffer creation helpers

Richard Chang (1):
      zram: fix use-after-free in zram_writeback_endio

Rob Herring (Arm) (1):
      dt-bindings: usb: ti,omap4-musb: Drop duplicate 'usb-phy'
property constraints

Rodrigo Alencar (4):
      iio: dac: ad5686: fix ref bit initialization for single-channel parts
      iio: dac: ad5686: fix input raw value check
      iio: dac: ad5686: acquire lock when doing powerdown control
      iio: dac: ad5686: fix powerdown control on dual-channel devices

Salah Triki (4):
      iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
      iio: dac: max5821: fix return value check in powerdown sync
      iio: temperature: tsys01: fix broken PROM checksum validation
      iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw

Sam Burkels (1):
      usb: storage: Add quirks for PNY Elite Portable SSD

Sanjay Chitroda (1):
      iio: ssp_sensors: cancel delayed work_refresh on remove

Santhosh Kumar K (1):
      spi: spi-mem: avoid mutating op template in spi_mem_supports_op()

Sean Christopherson (11):
      KVM: selftests: Include sys/mman.h *and* linux/mman.h, via kvm_syscalls.h
      KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
      KVM: SEV: Ignore MMIO requests of length '0'
      KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+
      KVM: SEV: Ignore Port I/O requests of length '0'
      KVM: SEV: Use the size of the PSC header as the minimum size for
PSC requests
      KVM: SEV: Compute the correct max length of the in-GHCB scratch area
      KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
      KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
      KVM: SEV: Check PSC request indices against the actual size of the buffer
      KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer

Sean Shen (1):
      ksmbd: fix FSCTL permission bypass by adding a permission check
for FSCTL_SET_SPARSE

Sebastian Reichel (1):
      usb: typec: tcpm: improve handling of DISCOVER_MODES failures

SeongJae Park (1):
      mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()

Seungjin Bae (1):
      usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports

Shaomin Chen (1):
      xfrm: iptfs: reset runtime state when cloning SAs

Shitalkumar Gandhi (1):
      serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma

Shuai Zhang (2):
      Bluetooth: btusb: Allow firmware re-download when version matches
      Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading

Shuvam Pandey (1):
      iio: adc: nxp-sar-adc: zero-initialize dma_slave_config

Siwei Zhang (2):
      Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
      Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()

Srinivas Kandagatla (5):
      ASoC: qcom: q6asm-dai: do not set stream state in event and
trigger callbacks
      ASoC: qcom: q6asm-dai: close stream only when running
      ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
      ASoC: qcom: q6asm-dai: remove unnecessary braces
      ASoC: qcom: q6asm-dai: use pointer type with kzalloc_obj()

Stanley.Yang (1):
      drm/amdgpu: fix potential overflow in fs_info.debugfs_name

Stefano Garzarella (1):
      vsock/virtio: fix skb overhead overflow on 32-bit builds

Steffen Klassert (1):
      Revert "esp: fix page frag reference leak on skb_to_sgvec failure"

Stephen J. Fuhry (1):
      USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub
controllers

Steve French (1):
      smb: client: fix uninitialized variable in smb2_writev_callback

Sunil Khatri (9):
      drm/amdgpu/userq: Fix doorbell object cleanup of queue
      drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lock
      drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_index
      drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart fails
      drm/amdgpu/userq: reserve root bo without interruption
      drm/amdgpu/userq: make sure queue is valid in the hang_detect_work
      drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapper
      drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj valid
      drm/amdgpu/userq: use array instead of list for userq_vas

Sunny Patel (1):
      mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page

Svyatoslav Ryhel (1):
      iio: Fix iio_multiply_value use in iio_read_channel_processed_scale

Thomas Fourier (1):
      Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()

Timur Kristóf (1):
      drm/amd/pm/si: Disregard vblank time when no displays are connected

Tudor Ambarus (1):
      tty: serial: samsung: Remove redundant port lock acquisition in rx helpers

Uladzislau Rezki (Sony) (1):
      mm/vmalloc: do not trigger BUG() on BH disabled context

Usama Arif (1):
      xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

Uwe Kleine-König (The Capable Hub) (1):
      Input: fm801-gp - simplify initialisation of pci_device_id array

Varadarajan Narayanan (1):
      spi: dt-bindings: spi-qpic-snand: Add ipq5210 compatible

Victor Nogueira (3):
      net/sched: act_mirred: Fix return code in early mirred redirect
error paths
      selftests/tc-testing: Add mirred test cases exercising loops
      selftests/tc-testing: Add netem test case exercising loops

Viken Dadhaniya (1):
      serial: qcom_geni: fix kfifo underflow when flush precedes DMA
completion IRQ

Vincent Donnefort (4):
      KVM: arm64: Fix CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC
      KVM: arm64: Fix meta-page unsharing in pKVM hyp tracing
      KVM: arm64: Fix rollback in hyp_trace_buffer_share_hyp()
      KVM: arm64: Fix memory leak in hyp_trace_unload()

Wanquan Zhong (1):
      USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL

Wei-Cheng Chen (1):
      xhci: tegra: Fix ghost USB device on dual-role port unplug

Weiming Shi (4):
      tun: free page on short-frame rejection in tun_xdp_one()
      tap: free page on error paths in tap_get_user_xdp()
      tun: free page on build_skb failure in tun_xdp_one()
      net: team: fix NULL pointer dereference in team_xmit during mode change

Wentao Guan (1):
      USB: cdc-acm: Fix bit overlap and move quirk definitions to header

Wentao Liang (1):
      usb: musb: omap2430: Fix use-after-free in omap2430_probe()

Xiaolei Wang (1):
      misc: rp1: Send IACK on IRQ activate to fix kdump/kexec

Xu Yang (1):
      usb: chipidea: core: convert ci_role_switch to local variable

Yongchao Wu (1):
      usb: cdns3: gadget: fix request skipping after clearing halt

Yuqi Xu (1):
      bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

Zhang Cen (2):
      USB: serial: belkin_sa: validate interrupt status length
      USB: serial: cypress_m8: validate interrupt packet headers

Zhang Heng (2):
      ALSA: hda/realtek: Fix incorrect comment for ALC299_FIXUP_PREDATOR_SPK
      ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP

Zhao Dongdong (1):
      Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

Zhaoyang Yu (1):
      tty: serial: pch_uart: add check for dma_alloc_coherent()

Zhengchuan Liang (2):
      ipv6: exthdrs: refresh nh after handling HAO option
      xfrm: input: hold netns during deferred transport reinjection

Zhenghang Xiao (3):
      Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
      sctp: fix race between sctp_wait_for_connect and peeloff
      drm/gem: fix race between change_handle and handle_delete

Ziyi Guo (1):
      drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO

Ziyu Zhang (1):
      vsock: keep poll shutdown state consistent

bui duc phuc (1):
      regmap: reject volatile update_bits() in cache-only mode

e521588 (1):
      esp: fix page frag reference leak on skb_to_sgvec failure

hlleng (1):
      HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse