Linux 7.2-rc2

[Linus Torvalds]

It's Sunday afternoon, and rc2 is out. Things look very normal - it's
not a small rc2, but it's in line with recent releases, and slightly
smaller than rc2 was in 7.1. Let's see how that all continues, but so
far so good.

The diffstat looks normal too, with about half the patch being drivers
- the usual suspects accounting for the bulk of it. The rest being
spread all over (but mostly filesystems and networking).

The only slightly unusual thing is the header file split where
mod_devicetable.h was split into multiple smaller per-subsystem
device-id headers, which is how it should always have been done, but
wasn't. It's a cleanup, but it also means that we have one fewer of
those monster headers that causes almost everything to be recompiled
if you touch it - even when the changes are relevant only to a few
small files.

Anyway, that shows up in the diffstat, but is hopefully not really
visible any other way as all the users hopefully got updates properly.
Knock wood.

Shortlog appended for your pleasure - easy enough to scrool through to
get a quick feel for the kinds of things that have been going on.
Nothing really stands out..

                   Linus

---

Abdurrahman Hussain (1):
      hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()

Alan Urmancheev (1):
      exec: fix off-by-one in binfmt max rewrite depth comment

Alex Deucher (13):
      drm/amdgpu/gfx8: drop unecessary BUG_ON()
      drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
      drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
      drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
      drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
      drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
      drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()
      drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
      drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
      drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
      drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
      drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
      drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()

Alex Williamson (7):
      vfio/pci: Latch disable_idle_d3 per device
      vfio/pci: Release the VGA arbiter client on register_device() failure
      vfio/pci: Fix racy bitfields and tighten struct layout
      vfio/mlx5: Fix racy bitfields and tighten struct layout
      vfio/pci: Latch all module parameters per device
      vfio: Remove device debugfs before releasing devres
      vfio/pci: Expose latched module parameter policy in debugfs

Amir Goldstein (1):
      ovl: fix comment about locking order

Andrea Righi (1):
      net: lan743x: Initialize eth_syslock spinlock before use

André Draszik (1):
      dma-fence: use correct callback in dma_fence_timeline_name()

Arnd Bergmann (1):
      drm/amd/display: avoid large stack allocation in
commit_planes_do_stream_update_sequence

Asad Kamal (1):
      drm/amdgpu: fix aperture mapping leak

Ashutosh Dixit (10):
      drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
      drm/xe/rtp: Maintain OA whitelists separately
      drm/xe/rtp: Keep track of non-OA nonpriv slots
      drm/xe/rtp: Generalize whitelist_apply_to_hwe
      drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
      drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
      drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
      drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
      drm/xe/rtp: Ensure locking/ref counting for OA whitelists
      drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG

Baineng Shou (1):
      dma-fence: Make dma_fence_dedup_array() robust against 0-count input

Bastian Blank (2):
      riscv: Add build salt to the vDSO
      mips: Add build salt to the vDSO

Ben Dooks (2):
      raid6: fix riscv symbol undeclared warnigns
      raid6: fix raid6_recov_rvv symbol undeclared warning

Boris Brezillon (10):
      drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock
      drm/panthor: Keep the reset work disabled until everything is initialized
      drm/panthor: Fix potential invalid pointer deref in
group_process_tiler_oom()
      drm/panthor: Fix theoretical IOMEM access in suspended state
      drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick()
      drm/panthor: Fix panthor_pwr_unplug()
      drm/panthor: Drop a needless check in panthor_fw_unplug()
      drm/panthor: Fix a leak when a group is evicted before the tiler
OOM is serviced
      drm/panthor: Interrupt group start/resumption if group_bind_locked() fails
      drm/panthor: Keep interrupts masked until they are needed

Boyuan Zhang (5):
      drm/amdgpu: fix division by zero with invalid uvd dimensions
      drm/amdgpu/vcn4: avoid rereading IB param length
      drm/amdgpu/vce: fix integer overflow in image size
      drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
      drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection

Brajesh Gupta (2):
      drm/imagination: Fix double call to drm_sched_entity_fini()
      drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY

Breno Leitao (2):
      netpoll: fix a use-after-free on shutdown path
      bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()

Bryam Vargas (6):
      net/sched: sch_taprio: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
      net/sched: sch_multiq: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
      drm/virtio: bound EDID block reads to the response buffer
      orangefs: keep the readdir entry size 64-bit in fill_from_part()
      ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
      ata: libata-core: Reject an invalid concurrent positioning ranges count

Ce Sun (2):
      drm/amdgpu: fix resource leak on ACP reset timeout
      drm/amdgpu: invoke pm_genpd_remove() before freeing genpd

ChenXiaoSong (1):
      smb/server: do not require delete access for non-replacing links

Christian Brauner (4):
      fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
      selftests/filesystems: test O_TMPFILE creation on idmapped mounts
      bpf: have bpf_real_data_inode() take a struct file
      xfs: fix the error unwind in xfs_open_devices()

Christian König (1):
      drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx

Christoph Hellwig (12):
      xfs: split up xfs_buf_alloc_backing_mem
      xfs: lift setting __GFP_NOFAIL from xfs_buf_alloc_kmem to the caller
      xfs: fix incorrect use of gfp flags in xfs_buf_alloc_backing_mem
      xfs: simplify the failure path in xfs_buf_alloc_vmalloc
      xfs: open code xfs_buf_ioend_fail in xfs_buf_submit
      xfs: also mark the buffer stale on verifier failure in xfs_buf_submit
      xfs: improve the xfs_buf_ioend_fail calling convention
      xfs: remove xfs_buf_ioend
      xfs: fix handling of synchronous errors in xfs_buf_submit
      xfs: simplify __xfs_buf_ioend
      iomap: consolidate bio submission
      iomap: submit read bio after each extent

Corey Leavitt (1):
      net: pse-pd: scope pse_control regulator handle to kref lifetime

Dan Carpenter (1):
      afs: Fix error code in afs_extract_vl_addrs()

David Francis (1):
      drm/amdkfd: Use kvcalloc to allocate arrays

David Howells (32):
      afs: Fix double netfs initialisation in afs_root_iget()
      afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints
      afs: Fix directory inode initialisation order
      afs: Fix bulk lookup malfunction due to change in dir_emit() API
      afs: Fix misplaced inc of net->cells_outstanding
      afs: Fix reinitialisation of the inode, in particular ->lock_work
      afs: Fix callback service message parsers to pass through -EAGAIN
      afs: Use scoped_seqlock_read() rather than manually doing seqlock stuff
      afs: Fix missing NULL pointer check in afs_break_some_callbacks()
      afs: Fix leak of ungot volume
      afs: Fix vllist leak
      afs: Fix lack of locking around modifications of net->cells_dyn_ino
      afs: Fix premature cell exposure through /afs
      afs: Fix the volume AFS_VOLUME_RM_TREE is set on
      afs: Fix unchecked-length string display in debug statement
      netfs: Fix decision whether to disallow write-streaming due to fscache use
      netfs: Fix netfs_create_write_req() to handle async cache object creation
      cachefiles: Fix double fput
      cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE
      iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages()
      iov_iter: Fix missing alloc fail check in iov_iter_extract_bvec_pages()
      iov_iter: Fix a memory leak in iov_iter_extract_user_pages()
      iov_iter: Remove unused variable in kunit_iov_iter.c
      scatterlist: Fix offset in folio calc in extract_xarray_to_sg()
      netfs: Fix kdoc warning
      netfs: Replace wb_lock with a bit lock for asynchronicity
      netfs: Fix writethrough to use collection offload
      netfs: Fix writeback error handling
      netfs: Fix folio state after ENOMEM whilst under writeback iteration
      netfs: Fix DIO write retry for filesystems without a ->prepare_write()
      cifs: Fix missing credit release on failure in cifs_issue_read()
      netfs: Fix barriering when walking subrequest list

David Lee (1):
      fhandle: reject detached mounts in capable_wrt_mount()

David Windsor (2):
      x86/uprobes: Keep shadow stack in sync for emulated CALLs
      selftests/x86: Add shadow stack uprobe CALL test

Dawei Feng (2):
      xfs: fix memory leak in xfs_dqinode_metadir_create()
      net/mlx5: HWS, fix matcher leak on resize target setup failure

Dmitry Safonov (1):
      tcp: Decrement tcp_md5_needed static branch

Donet Tom (1):
      drm/amdgpu: Fix AMDGPU_GTT_MAX_TRANSFER_SIZE for non-4K systems

Doruk Tan Ozturk (1):
      net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

Farhad Alemi (1):
      freevxfs: don't BUG() on unknown typed-extent type

Felix Gu (1):
      spi: rzv2h-rspi: Fix DMA transfer error handling for signal interruption

Fengnan Chang (1):
      iomap: release pages on atomic dio size mismatch

Florian Westphal (5):
      netfilter: nf_conntrack_expect: zero at allocation time
      netfilter: nft_set_pipapo: don't leak bad clone into future transaction
      netfilter: nfnetlink_queue: restrict writes to network header
      netfilter: nftables: restrict linklayer and network header writes
      netfilter: nftables: restrict checkum update offset

Francois Dugast (1):
      drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()

Gerald Schaefer (1):
      s390/monwriter: Reject buffer reuse with different data length

Gil Portnoy (2):
      ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
      ksmbd: close superseded durable handles through refcount handoff

Gleb Markov (1):
      cxgb4: Fix decode strings dump for T6 adapters

Granthali Vinodkumar Dhandar (2):
      drm/amdgpu: add support for GC IP version 11.7.0
      drm/amdgpu: add support for GC IP version 11.7.1

Guenter Roeck (2):
      hwmon: (pmbus) Fix passing events to regulator core
      hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against
divide-by-zero

Gustavo Kenji Mendonça Kaneko (2):
      drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend
      drm/arm/komeda: fix error handling for clk_prepare_enable() and callers

Gustavo Sousa (1):
      drm/xe/rtp: Add struct types for RTP tables

Haofeng Li (2):
      ksmbd: reject undersized DACLs before parsing ACEs
      ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl

Haoxiang Li (4):
      net: ipa: fix SMEM state handle leaks in SMP2P init
      net: liquidio: fix BAR resource leak on PF number failure
      fsl/fman: Free init resources on KeyGen failure in fman_init()
      irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure

Harish Kasiviswanathan (1):
      drm/amdgpu: Fix kernel panic during driver load failure

Harry Wentland (1):
      drm/amd/display: guard against overflow in HDCP message dump

Holger Dengler (1):
      pkey: Move keytype check from pkey api to handler

Honglei Huang (1):
      drm/amd/display: use kvzalloc to allocate struct dc

Hongling Zeng (1):
      cachefiles: Fix double unlock in nomem_d_alloc error path

HyeongJun An (2):
      hwmon: (asus_atk0110) Check package count before accessing element
      ALSA: usx2y: us144mkii: fix work UAF on disconnect

Ido Schimmel (1):
      bridge: stp: Fix a potential use-after-free when deleting a bridge

Jakob Linke (1):
      drm/amdgpu/soc24: reset dGPU if suspend got aborted

Jakub Kicinski (3):
      eth: fbnic: don't cache shinfo across skb realloc
      selftests: net: bump default cmd() timeout to 20 seconds
      selftests: drv-net: tso: don't touch dangerous feature bits

Jamal Hadi Salim (1):
      net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF

Jan Beulich (1):
      x86/Xen: correct commentary and parameter naming of xen_exchange_memory()

Jani Nikula (7):
      drm/i915/hdcp: check streams[] bounds before overflow
      drm/i915/hdcp: require monotonically increasing seq_num_v
      drm/dp: fix kernel-doc for struct drm_dp_as_sdp
      drm/fixed: fix kernel-doc for drm_sm2fixp()
      drm/ras: include linux/types.h in drm_ras.h
      drm/i915/vrr: require valid min/max vfreq for VRR
      drm/i915/bios: range check LFP Data Block panel_type2

Jann Horn (1):
      bpf,fork: wipe ->bpf_storage before bailouts that access it

Jason Wang (1):
      MAINTAINERS: Update Jason Wang's email address

Jesse Zhang (2):
      drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq
      drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq

Jetha Chan (1):
      ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table

Jiawen Wu (1):
      net: libwx: fix VMDQ mask for 1-queue mode

Jiri Olsa (1):
      uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline

Jisheng Zhang (2):
      spi: dw: fix first spi transfer with dma always fallback to PIO
      spi: dw: use the correct error msg if request_irq() fails

Joanne Koong (1):
      fuse: call fuse_send_readpages explicitly from fuse_readahead

John Madieu (2):
      ASoC: rsnd: adg: make rsnd_adg_clk_control() idempotent
      ASoC: rsnd: src: Add missing scu_supply clock to suspend/resume

Joonas Lahtinen (1):
      drm/i915: Return NULL on error in active_instance

Jori Koolstra (1):
      MAINTAINERS: take over vboxsf from Hans de Goede

Joshua Crofts (3):
      hwmon: (max1619) add missing 'select REGMAP' to Kconfig
      hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
      hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig

KaFai Wan (1):
      bpf: Fix insn_aux_data leak on verifier err_free_env path

Karuna Ramkumar (1):
      ata: libata-scsi: limit simulated SCSI command copy to response length

Krzysztof Wilczyński (1):
      proc: only bump parent nlink when registering directories

Kyle Hendry (1):
      MIPS: mm: Add check for highmem before removing memory block

Lee Jones (1):
      MAINTAINERS: Add a mailing list entry to MFD

Leorize (1):
      drm/amd/display: set MSA MISC1 bit 6 when using VSC SDP for DCE 11.x

Li RongQing (1):
      afs: Remove erroneous seq |= 1 in volume lookup loop

Linus Torvalds (1):
      Linux 7.2-rc2

Linus Walleij (1):
      net: dsa: Fix skb ownership in taggers

Lizhi Hou (4):
      accel/amdxdna: Fix amdxdna_client lifetime race during device removal
      accel/amdxdna: Fix notifier_wq lifetime race during device removal
      accel/amdxdna: Fix iommu domain lifetime race during device removal
      accel/amdxdna: Fix use-after-free in debug BO command handling

Longjun Tang (1):
      virtio_net: disable cb when NAPI is busy-polled

Lorenzo Bianconi (2):
      net: airoha: dma map xmit frags with skb_frag_dma_map()
      net: airoha: fix max receive size configuration

Lu Yao (1):
      drm/xe: Remove redundant exec_queue_suspended() check in
submit_exec_queue()

Luca Coelho (1):
      drm/dp_mst: Handle torn-down topology gracefully in
drm_dp_mst_topology_queue_probe()

Luca Weiss (1):
      ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280

Maciej W. Rozycki (1):
      MIPS: DEC: Ensure RTC platform device deregistration upon failure

Maoyi Xie (1):
      net: wwan: iosm: bound device offsets in the MUX downlink decoder

Martin Kaiser (3):
      tracing: probes: fix typo in a log message
      tracing: eprobe: read the complete FILTER_PTR_STRING pointer
      riscv: probes: save original sp in rethook trampoline

Masami Hiramatsu (Google) (4):
      tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
      tracing/events: Fix to check the simple_tsk_fn creation
      tracing/probes: Fix double addition of offset for @+FOFFSET
      tracing/probes: Make the $ prefix mandatory for comm access

Matt Bobrowski (1):
      bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is
uninitialized

Matteo Croce (1):
      fat: stop reading directory entries past the end-of-directory marker

Matthew Auld (3):
      drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs
      drm/xe: fix NPD in bo_meminfo()
      drm/xe/pt: prevent invalid cursor access for purged BOs

Matthew Brost (1):
      drm/xe: Return error on non-migratable faults requiring devmem

Matthew Stewart (2):
      drm/amd/display: Fix DCN42 null registers & register masks
      drm/amd/display: Remove DCCG registers not needed in DCN42

Matti Vaittinen (2):
      hwmon: adm1275: Prevent reading uninitialized stack
      hwmon: adm1275: Detect coefficient overflow

Matvey Kovalev (2):
      qede: fix out-of-bounds check for cqe->len_list[]
      afs: fix NULL pointer dereference in afs_get_tree()

Michael Bommarito (4):
      tcp: restore RCU grace period in tcp_ao_destroy_sock
      tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
      xen/pvcalls: bound backend response req_id before indexing rsp[]
      minix: avoid overflow in bitmap block count calculation

Michal Wajdeczko (1):
      drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays

Morduan Zang (1):
      iomap: guard io_size EOF trim against concurrent truncate underflow

Myeonghun Pak (1):
      ata: sata_gemini: unwind clocks on IDE pinctrl errors

Namjae Jeon (7):
      ksmbd: avoid zeroing the read buffer in smb2_read()
      ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
      ksmbd: fix outstanding credit leak on abort and error paths
      ksmbd: doc: update feature support status for durable handles
and compression
      ksmbd: don't hold ci->m_lock while waiting for a lease break ack
      ksmbd: snapshot previous oplock state before durable checks
      ksmbd: fix app-instance durable supersede session UAF

Nan Li (1):
      afs: handle CB.InitCallBackState3 requests without a server record

Natalie Vock (2):
      drm/amdgpu: Only set bo->moved when the BO was actually moved
      drm/amdgpu: Rename moved state to needs_update

Nuoqi Gui (3):
      bpf: Mask pseudo pointer values in verifier logs
      selftests/bpf: Cover pseudo-BTF ksym log masking
      seg6: validate SRH length before reading fixed fields

Pablo Neira Ayuso (2):
      netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
      netfilter: nfnetlink_cthelper: cap to maximum number of
expectation per master

Paul Louvel (1):
      gpio-f7188x: Add support for NCT6126D version B

Pawan Gupta (6):
      bpf: Support for hardening against JIT spraying
      x86/bugs: Enable IBPB flush on BPF JIT allocation
      bpf: Restrict JIT predictor flush to cBPF
      bpf: Skip redundant IBPB in pack allocator
      bpf: Prefer packs that won't trigger an IBPB flush on allocation
      bpf: Prefer dirty packs for eBPF allocations

Pengfei Zhang (1):
      ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump

Pengpeng Hou (6):
      spi: sh-msiof: abort transfers when reset times out
      gpio: mvebu: fail probe if gpiochip registration fails
      gpio: htc-egpio: use managed gpiochip registration
      MIPS: configs: Enable the current Ingenic USB PHY symbol
      hwmon: (w83793) remove vrm sysfs file on probe failure
      hwmon: (w83627hf) remove VID sysfs files on error and remove

Perry Yuan (1):
      drm/amdgpu: flush pending RCU callbacks on module unload

Petr Wozniak (2):
      net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
      Revert "net: phy: sfp: probe for RollBall I2C-to-MDIO bridge in mdio-i2c"

Philipp Stanner (1):
      dma-buf: dma-fence: Fix potential NULL pointer dereference

Praveen Talari (1):
      spi: core: Abort active target transfer on controller suspend

Prike Liang (3):
      drm/amdgpu/mes11: set doorbell offset for suspending userq
      drm/amdgpu/mes12: set doorbell offset for suspending userq
      drm/amdgpu: add the doorbell index input for suspending userq

Qiang Liu (3):
      ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
      ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
      ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr

Qingshuang Fu (1):
      irqchip/ts4800: Fix missing chained handler cleanup on remove

Rafael J. Wysocki (1):
      ACPICA: Define acpi_ut_safe_strncpy() as strscpy_pad() alias

Randy Dunlap (1):
      docs: hwmon: ltc4283: fix malformed table docs build error

Ratheesh Kannoth (1):
      MAINTAINERS: Update Marvell octeontx2 driver maintainers

Reinette Chatre (1):
      x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU
when SNC enabled

Rodrigo Vivi (1):
      drm/xe: wedge from the timeout handler only after releasing the queue

Rosen Penev (1):
      net: gianfar: dispose irq mappings on probe failure and device removal

Runyu Xiao (2):
      hwmon: (occ) unregister sysfs devices outside occ lock
      ksmbd: annotate oplock list traversals under m_lock

Samuel Holland (1):
      riscv: Fix 32-bit call_on_irq_stack() frame pointer ABI

Samuel Moelius (2):
      net/sched: dualpi2: clear stale classification on filter miss
      net/sched: hhf: clear heavy-hitter state on reset

Samuel Page (1):
      tipc: fix out-of-bounds read in broadcast Gap ACK blocks

Sean Christopherson (1):
      vfio: selftests: Add luuid to libvfio.mk's list of libraries,
not to the Makefile

Sebastian Andrzej Siewior (1):
      futex/requeue: Revert "Prevent NULL pointer dereference in
remove_waiter() on self-deadlock""

Sechang Lim (5):
      selftests/bpf: don't modify the skb in the strparser parser prog
      bpf, sockmap: reject a packet-modifying SK_SKB stream parser
      selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser
      tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()
      net/sched: act_bpf: use rcu_dereference_bh() to read the filter

Sen Wang (3):
      ASoC: codecs: tas675x: use READ_ONCE for params to be used concurrently
      ASoC: codecs: tas675x: Fix CHx temperature range register bit fields
      Documentation: sound: tas675x: Fix temperature range and
impedance documentation

Sergio Paracuellos (3):
      gpio: mt7621: avoid corruption of shared interrupt trigger state
      gpio: mt7621: more robust management of IRQ domain teardown
      gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips

Shubham Nayak (1):
      ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to
enable mute LED

Shuicheng Lin (3):
      drm/xe/userptr: Hold notifier_lock for write on inject test path
      drm/xe/userptr: Drop bogus static from finish in force_invalidate
      drm/xe/hw_engine: Fix double-free of managed BO in error path

Shuvam Pandey (1):
      drm/imagination: Fix user array stride in pvr_set_uobj_array()

Souvik Banerjee (1):
      ovl: use linked upper dentry in copy-up tmpfile

Steve French (1):
      cifs: update internal module version number

Sven Eckelmann (6):
      batman-adv: retrieve ethhdr after potential skb realloc on RX
      batman-adv: access unicast_ttvn skb->data only after skb realloc
      batman-adv: gw: acquire ethernet header only after skb realloc
      batman-adv: dat: acquire ARP hw source only after skb realloc
      batman-adv: bla: reacquire gw address after skb realloc
      batman-adv: dat: ensure accessible eth_hdr proto field

Taeyang Lee (1):
      perf/core: Detach event groups during remove_on_exec

Theodor Arsenij Larionov-Trichkine (1):
      netfilter: nft_fib: reject fib expression on the netdev egress hook

Thomas Hellström (1):
      drm/xe/rtp: Fix build error with clang < 21 and non-const initializers

Thomas Huth (1):
      xen: Replace __ASSEMBLY__ with __ASSEMBLER__ in header files

Thomas Zimmermann (1):
      drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips

Thorsten Blum (1):
      riscv: smp: use secs_to_jiffies in __cpu_up

Uwe Kleine-König (The Capable Hub) (17):
      mod_devicetable.h: Split into per subsystem headers
      media: ti: vpe: #include <linux/platform_device.h> explicitly
      driver: core: Include headers for acpi_device_id and
of_device_id for struct device_driver
      driver core: platform: Include header for struct platform_device_id
      usb: serial: Include <linux/usb.h> in <linux/usb/serial.h>
      platform/x86: msi-ec: Ensure dmi_system_id is defined
      of: Explicitly include <linux/types.h> and <linux/err.h>
      i2c: Let i2c-core.h include <linux/i2c.h>
      platform/x86: x86-android-tablets: Add include defining struct
dmi_system_id
      platform/x86: int3472: Add include defining struct dmi_system_id
      usb: dwc2: Add include defining struct pci_device_id
      ALSA: hda/core: Add include defining struct hda_device_id
      LoongArch: KVM: Add include defining struct cpu_feature
      media: em28xx: Add include for struct usb_device_id
      parisc: #include <linux/compiler.h> for unlikely() in <asm/ptrace.h>
      Replace <linux/mod_devicetable.h> by more specific
<linux/device-id/*.h> (headers)
      Replace <linux/mod_devicetable.h> by more specific
<linux/device-id/*.h> (c files)

Viacheslav Bocharov (2):
      gpio: shared-proxy: always serialize with a sleeping mutex
      pinctrl: meson: restore non-sleeping GPIO access

Vijendar Mukunda (1):
      MAINTAINERS: ASoC: SOF: add AMD reviewer for Sound Open Firmware

Vivian Wang (1):
      riscv: Raise default NR_CPUS for 64BIT to 256

Vladimir Zapolskiy (1):
      gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe

Wang Han (1):
      scripts/sorttable: Handle RISC-V patchable ftrace entries

Wei Fang (1):
      net: enetc: check the number of BDs needed for xdp_frame

WenTao Liang (2):
      ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb
corrupts anchor list on each resubmission
      drm/amd/display: detect_link_and_local_sink: DP alt mode timeout
path leaks prev_sink reference

Wentao Liang (2):
      xen/gntdev: fix error handling in ioctl
      ata: pata_pxa: Fix DMA channel leak on probe error

Wolfram Sang (2):
      spi: dt-bindings: snps,dw-apb-ssi: drop superfluous RZ/N1 entry
      spi: dt-bindings: snps,dw-apb-ssi: add 'power-domains' property

Xi Ruoyao (1):
      MIPS: loongson64: add IRQ work based on self-IPI

Xiang Mei (2):
      usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
      netfilter: ipset: fix race between dump and ip_set_list resize

Xiaogang Chen (1):
      drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size

Xin Long (2):
      sctp: add INIT verification after cookie unpacking
      sctp: fix addr_wq_timer race in sctp_free_addr_wq()

Xu Rao (1):
      ACPI: TAD: Check AC wake capability before enabling wakeup

Yang Wang (3):
      drm/amd/pm: make pp_features read-only when scpm is enabled
      drm/amd/pm: fix amdgpu_pm_info power display units
      drm/amd/pm: fix smu13 power limit range calculation

Yicong Yang (1):
      ACPI: RIMT: Only defer the IOMMU configuration in init stage

Yingjie Gao (1):
      xfs: release dquot buffer after dqflush failure

Yiyang Chen (2):
      bpf: Reject offset refcount acquire arguments
      selftests/bpf: Cover refcount acquire node offsets

Yongqiang Sun (1):
      drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size

Yousef Alhouseen (8):
      sctp: fix SCTP_RESET_STREAMS stream list length limit
      netdevsim: remove ethtool debugfs files before freeing netdev
      xen/front-pgdir-shbuf: free grant reference head on errors
      xen/gntalloc: make grant counters unsigned
      xen/gntalloc: validate grant count before allocation
      xenbus: reject unterminated directory replies
      xfs: use null daddr for unset first bad log block
      ASoC: SOF: validate probe info element counts

Yuho Choi (1):
      irqchip/gic-v3-its: Fix OF node reference leak

Yuto Ohnuki (1):
      afs: check for duplicate servers in VL server list

Zhu Lingshan (1):
      drm/amdgpu: reject mapping a reserved doorbell to a new queue

Zihan Xi (2):
      smb: client: harden POSIX SID length parsing
      smb: client: use unaligned reads in parse_posix_ctxt()

Zilin Guan (1):
      afs: use kvfree() to free memory allocated by kvcalloc()

jiazhenyuan (1):
      xfs: fix AGFL extent count calculation in xrep_agfl_fill