[PATCH 5.15 000/571] 5.15.224-rc1 review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 5.15.224 release.
There are 571 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Fri, 30 Oct 2026 16:59:22 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.224-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Linux 5.15.224-rc1

Christian Brauner <brauner@xxxxxxxxxx>
    signal: don't retarget shared signals in a dying thread group

Christian Brauner <brauner@xxxxxxxxxx>
    io-wq: order the exit bit against worker creation task work

Srish Srinivasan <ssrish@xxxxxxxxxxxxx>
    keys/trusted_keys: return immediately after TPM unseal failure

Stefano Garzarella <sgarzare@xxxxxxxxxx>
    KEYS: trusted: Fix blob allocation size in tpm2_key_decode()

Adrian Martinez <adrimg3196@xxxxxxxxx>
    KEYS: Fix key_reject_and_link() race with keyring restriction

Cen Zhang <zzzccc427@xxxxxxxxx>
    keys: Protect the read method check against type removal

Kyle Zeng <kylebot@xxxxxxxxxx>
    keys: make keyring indexes independent of kernel addresses

Cen Zhang <zzzccc427@xxxxxxxxx>
    keys: Protect the type name while describing a key

Cen Zhang <zzzccc427@xxxxxxxxx>
    keys: Check the authorization payload in process keyring searches

Cen Zhang <zzzccc427@xxxxxxxxx>
    keys: Avoid the owner account dereference in named keyring lookup

Donggeun Yoo <donggeunyoo.kernel@xxxxxxxxx>
    tracing: Fix 64-bit and signed histogram fields on 32-bit kernels

Donggeun Yoo <donggeunyoo.kernel@xxxxxxxxx>
    tracing: Unregister field variable histograms when the command fails

Donggeun Yoo <donggeunyoo.kernel@xxxxxxxxx>
    tracing: Save the event file instead of the compatible histogram

Kyle Zeng <kylebot@xxxxxxxxxx>
    tracing: Reject incomplete event filter expressions

Pauli Virtanen <pav@xxxxxx>
    Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

Pauli Virtanen <pav@xxxxxx>
    Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

Jonas Köppeler <j.koeppeler@xxxxxxxxxxxx>
    net_sched: codel: fix stale state for empty flows in fq_codel

Yu Kuai <yukuai3@xxxxxxxxxx>
    md: move initialization and destruction of 'io_acct_set' to md.c

Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    netfilter: nf_tables: unconditionally bump set->nelems before insertion

Florian Westphal <fw@xxxxxxxxx>
    netfilter: nf_tables: always increment set element count

Xiang Mei <xmei5@xxxxxxx>
    net: bonding: fix use-after-free in bond_xmit_broadcast()

Aleksandr Khromov <haa@xxxxxxxxx>
    ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION

Aleksandr Khromov <haa@xxxxxxxxx>
    ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in

Aleksandr Khromov <haa@xxxxxxxxx>
    ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION

Yun Zhou <yun.zhou@xxxxxxxxxxxxx>
    xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

Frank Sorenson <sorenson@xxxxxxxxxx>
    cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()

Ben Cressey <ben@xxxxxxxxxxx>
    dm-integrity: fix infinite loop on discard with large tag size

Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@xxxxxxxxx>
    drm/i915/dmc: Harden DMC firmware payload parsing

Jann Horn <jannh@xxxxxxxxxx>
    futex: Fix mm reuse handling for FUT_OFF_MMSHARED

Wentao Liang <vulab@xxxxxxxxxxx>
    i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()

Ido Schimmel <idosch@xxxxxxxxxx>
    ipv4: udp: Create exceptions before socket matching

Daehyeon Ko <4ncienth@xxxxxxxxx>
    vsock/virtio: validate packet source for connected sockets

Chen Cheng <chencheng@xxxxxxxxx>
    dm-integrity: require stable writes for internal hash modes

Florian Westphal <fw@xxxxxxxxx>
    netfilter: nf_tables: always walk all pending catchall elements

Ido Schimmel <idosch@xxxxxxxxxx>
    bridge: mcast: Fix use-after-free during router port configuration

Usama Arif <usama.arif@xxxxxxxxx>
    mm/huge_memory: transfer the pmd dirty bit to the folio on zap

Linmao Li <lilinmao@xxxxxxxxxx>
    Input: byd - synchronize timer deletion before freeing private data

Christian Brauner <brauner@xxxxxxxxxx>
    unicode: free the map after a grace period

Cen Zhang (Microsoft) <cenzhang@xxxxxxxxxxxxxxxxxxx>
    watch_queue: Fix note pool publication race in watch_queue_set_size()

Daniil Stas <daniil.stas@xxxxxxxxxx>
    hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur

Fuad Tabba <fuad.tabba@xxxxxxxxx>
    KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save

Laurence Oberman <loberman@xxxxxxxxxx>
    scsi: st: Fix use-after-free race between st_remove() and st_open()

Lee Jones <lee@xxxxxxxxxx>
    tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields

Aohan Mei <henrymei@xxxxxxxxxxx>
    net/sched: cls_flower: validate mask pointer after nla_next()

Jun Yang <littleddfu@xxxxxxxxx>
    net: bridge: mcast: don't truncate the port group walk on teardown

Hyunwoo Kim <imv4bel@xxxxxxxxx>
    KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots

Di Shen <di.shen@xxxxxxxxxx>
    OPP: Fix race between OPP addition and lookup

Zhang Changzhong <zhangchangzhong@xxxxxxxxxx>
    net/sched: cls_u32: skip hash tables in u32_bind_class()

Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
    security/keys: fix missed RCU read section on lookup

David Rosca <david.rosca@xxxxxxx>
    drm/amdgpu: Fix VCE 3 ring align_mask

Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
    mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

Zihan Xi <zihanx@xxxxxxxxxx>
    ipv4: avoid divide by zero in fib_rebalance

Niklas Schnelle <schnelle@xxxxxxxxxxxxx>
    s390/pci: Fix leak of uninitialized kernel data in SCLP report

Aswin Karuvally <aswin@xxxxxxxxxxxxx>
    s390/ctcm: Prevent XID null dereference

Florian Schauer <florian@xxxxxxxxxx>
    page_pool: keep frag_offset aligned for odd-sized requests

Charles Vosburgh <theminershive@xxxxxxxxx>
    sctp: validate chunk length in the inqueue parser

Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
    tipc: protect node reset trace dump with node lock

Bryam Vargas <hexlabsecurity@xxxxxxxxx>
    net/iucv: fix the recvmsg window update

Genjian Zhang <zhanggenjian@xxxxxxxxxx>
    dm-ebs: fix incorrect device offset check in ebs_ctr()

Ben Cressey <ben@xxxxxxxxxxx>
    dm-crypt: fix a tiny race condition in crypt_dec_pending

Benjamin Marzinski <bmarzins@xxxxxxxxxx>
    dm cache: fix issue with background work locking

Ming-Hung Tsai <mtsai@xxxxxxxxxx>
    dm cache: fix demotion stats in passthrough mode

Etienne Perot <eperot@xxxxxxxxxx>
    cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children

Cen Zhang (Microsoft Security FORGE Labs) <blbllhy@xxxxxxxxx>
    tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)

Heyang Tan <thy15333007817@xxxxxxx>
    wifi: p54: validate firmware record lengths

Tengda Wu <wutengda@xxxxxxxxxxxxxxx>
    tracing: Fix hist trigger timestamps for buffered events

Donggeun Yoo <donggeunyoo.kernel@xxxxxxxxx>
    tracing: Fix the shift out of bounds in the log2 histogram modifier

Jesse Zhang <Jesse.Zhang@xxxxxxx>
    drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

Timur Kristóf <timur.kristof@xxxxxxxxx>
    drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang

Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
    scsi: libiscsi: Validate the task named by a management response

Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
    scsi: libiscsi: Validate the ITT reflected in a Reject PDU

Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
    scsi: libiscsi: Reject a negative task index from parse_pdu_itt

Loic Poulain <loic.poulain@xxxxxxxxxxxxxxxx>
    i2c: qcom-cci: Fix HALT_ACK reset request being dropped

Sasha Levin <sashal@xxxxxxxxxx>
    tools: gpio: fix building from the top level with O=

Daehyeon Ko <4ncienth@xxxxxxxxx>
    sctp: revalidate output stream after association connect wait

Aohan Mei <henrymei@xxxxxxxxxxx>
    net: rds: fix uninitialized trans dereference in CM event handler

Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
    net/sched: fix use-after-free in __tcf_action_put()

Kyle Zeng <kylebot@xxxxxxxxxx>
    fsnotify: prevent mark additions during connector teardown

Amirmohammad Eftekhar <amirmohammadeftekhar@xxxxxxxxx>
    KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry

Sung Byeongchan <tjdqudcks0424@xxxxxxxxx>
    autofs: ignore notification errors from a replaced pipe

Kyle Zeng <kylebot@xxxxxxxxxx>
    netlink: avoid hashing the network namespace pointer

Kyle Zeng <kylebot@xxxxxxxxxx>
    pipe: preserve existing fasync readers on writer setup failure

Nickolai Zeldovich <nickolai@xxxxxxxxxxxxx>
    exit: fix lost-update race on the child_subreaper bitfields

Christian Brauner <brauner@xxxxxxxxxx>
    clone: add CLONE_AUTOREAP

Sasha Levin <sashal@xxxxxxxxxx>
    samples: pidfd: fix userprogs typo

Cen Zhang <zzzccc427@xxxxxxxxx>
    ocfs2/dlm: Protect the recovery list during debugfs reads

Linfeng Sun <linfeng.sun.dev@xxxxxxxxx>
    scsi: target: iscsi: Fix race in discovery auth updates

Laurence Oberman <loberman@xxxxxxxxxx>
    scsi: st: Save the visited block for the partition the drive is in

Keith Busch <kbusch@xxxxxxxxxx>
    nios2: fix __wsum type degradation in csum_fold()

Kyle Zeng <kylebot@xxxxxxxxxx>
    netlink: reset skb headers before unicast and multicast filtering

Anjali Kulkarni <anjali.k.kulkarni@xxxxxxxxxx>
    netlink: Reverse the patch which removed filtering

Florian Westphal <fw@xxxxxxxxx>
    netlink: remove netlink_broadcast_filtered

HyeongJun An <sammiee5311@xxxxxxxxx>
    ASoC: nau8822: Fix the 128x oversampling switch bits

HyeongJun An <sammiee5311@xxxxxxxxx>
    ASoC: wm8978: Fix the 128x oversampling switch bits

HyeongJun An <sammiee5311@xxxxxxxxx>
    ASoC: max98371: Fix the Speaker DHT Min Volume bits

HyeongJun An <sammiee5311@xxxxxxxxx>
    ASoC: pcm3168a: Fix the DAC zero flag polarity bit

HyeongJun An <sammiee5311@xxxxxxxxx>
    ASoC: cs42l52: Fix the NG Type Switch bit

HyeongJun An <sammiee5311@xxxxxxxxx>
    ASoC: cs42l56: Put the Limiter Cushion control on the limiter register

Avi Weiss <thnkslprpt@xxxxxxxxx>
    ASoC: stm32: spdifrx: fix synchronization state check

Allison Henderson <achender@xxxxxxxxxx>
    net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure

Michal Luczaj <mhal@xxxxxxx>
    vsock: treat TCP_CLOSING as once-established

Michael Kelley <mhkelley58@xxxxxxxxx>
    Drivers: hv: Don't reset VMBus connection state on error/exit paths

Xueqin Luo <luoxueqin@xxxxxxxxxx>
    power: supply: ds2780: Fix ds2780_get_capacity() returning raw value

Andrii Nakryiko <andrii@xxxxxxxxxx>
    bpf: fix potential 32-bit overflow when accessing ARRAY map element

Jinu Kim <kimjw04271234@xxxxxxxxx>
    KVM: x86: Use active memslots for the per-vCPU MMIO cache

Ilan Dudnik <ilan.dudnik@xxxxxxxxxxxxxx>
    ksmbd: fix heap out-of-bounds write in krb5_authenticate()

Dave Chinner <dchinner@xxxxxxxxxx>
    xfs: fix unmount hang with unflushable inodes stuck in the AIL

Dave Chinner <dchinner@xxxxxxxxxx>
    xfs: factor out stale buffer item completion

Dave Chinner <dchinner@xxxxxxxxxx>
    xfs: rearrange code in xfs_buf_item.c

Dave Chinner <dchinner@xxxxxxxxxx>
    xfs: catch stale AGF/AGF metadata

Dave Chinner <dchinner@xxxxxxxxxx>
    xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock

Dave Chinner <dchinner@xxxxxxxxxx>
    xfs: buffer pins need to hold a buffer reference

Guo Xuenan <guoxuenan@xxxxxxxxxx>
    xfs: fix super block buf log item UAF during force shutdown

Dave Chinner <dchinner@xxxxxxxxxx>
    xfs: aborting inodes on shutdown may need buffer lock

Dave Chinner <dchinner@xxxxxxxxxx>
    xfs: log items should have a xlog pointer, not a mount

Tahera Fahimi <taherafahimi@xxxxxxxxxxxxxxxxxxx>
    xfrm: prevent policy_hthresh.work from racing with netns teardown

Johan Hovold <johan@xxxxxxxxxx>
    tty: add break_wait kernel-doc

Jiri Slaby <jirislaby@xxxxxxxxxx>
    tty: finish kernel-doc of tty_struct members

Florian Westphal <fw@xxxxxxxxx>
    netfilter: nf_tables: fix crash when nf_trace is enabled

Christian Brauner <brauner@xxxxxxxxxx>
    namespace: handle mount locking for automounts correctly

Christian Brauner <brauner@xxxxxxxxxx>
    fcntl: refuse F_SET_RW_HINT on an immutable inode

Christian Brauner <brauner@xxxxxxxxxx>
    namespace: check the target before walking it in do_mount_setattr()

Christian Brauner <brauner@xxxxxxxxxx>
    namespace: don't copy an unmounted mount tree

Christian Brauner <brauner@xxxxxxxxxx>
    namespace: unhash a dentry before detaching the mounts on it

Krzysztof Karas <krzysztof.karas@xxxxxxxxx>
    drm/i915/gt: Unmask interrupts only when ACTIVE is true

Nguyen Ngoc Thang <ngocthang2710.1999@xxxxxxxxx>
    drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN

Mikhail Gavrilov <mikhail.v.gavrilov@xxxxxxxxx>
    drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks

Ahmed Abdelhaleem Ahmed <ahmedhal@xxxxxxxxx>
    scsi: ch: Do not keep references to data transfer element devices

Shao-Fu Chen <shf.chen@xxxxxxxxxxxx>
    optee: register TEE devices only once fully initialized

Shawn Lin <shawn.lin@xxxxxxxxxxxxxx>
    pmdomain: rockchip: propagate subdomain add errors

Shawn Lin <shawn.lin@xxxxxxxxxxxxxx>
    pmdomain: rockchip: don't ignore clock lookup errors on attach

Shawn Lin <shawn.lin@xxxxxxxxxxxxxx>
    pmdomain: rockchip: fix clock leak on domain probe failure

Mikulas Patocka <mpatocka@xxxxxxxxxx>
    dm: fix reading free memory in do_resume

Christian Brauner <brauner@xxxxxxxxxx>
    namespace: check the mounts before reading their parents in pivot_root()

Christian Brauner <brauner@xxxxxxxxxx>
    namespace: don't inherit MNT_UMOUNT in clone_mnt()

Zack Rusin <zack.rusin@xxxxxxxxxxxx>
    drm/vmwgfx: validate pitch coming from userspace

Mikhail Gavrilov <mikhail.v.gavrilov@xxxxxxxxx>
    Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex

Weiming Shi <bestswngs@xxxxxxxxx>
    net: team: stop reusing skb after queue override

Weiming Shi <bestswngs@xxxxxxxxx>
    net: team: fix NULL pointer dereference in team_xmit during mode change

Marc Harvey <marcharvey@xxxxxxxxxx>
    net: team: Rename port_disabled team mode op to port_tx_disabled

Marc Harvey <marcharvey@xxxxxxxxxx>
    net: team: Remove unused team_mode_op, port_enabled

Felix Fietkau <nbd@xxxxxxxx>
    netfilter: nf_tables: fix bidirectional offload regression

Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
    mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge

Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
    mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP

Vishal Badole <Vishal.Badole@xxxxxxx>
    EDAC/amd64: Mask UMC chip select to the four implemented selects

Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
    selinux: fix data race on AVC latest_notif

Daehyeon Ko <4ncienth@xxxxxxxxx>
    ip6_gre: remove obsolete ERSPAN PMTU update

Donggeun Yoo <donggeunyoo.kernel@xxxxxxxxx>
    tracing: Set the trace clock before registering the histogram trigger

Vicki Pfau <vi@xxxxxxxxxxx>
    HID: steam: Clean up locking

Vicki Pfau <vi@xxxxxxxxxxx>
    HID: steam: Refactor registration

Vicki Pfau <vi@xxxxxxxxxxx>
    HID: steam: Rearrange teardown sequence

Vicki Pfau <vi@xxxxxxxxxxx>
    HID: steam: Fully unregister controller when hidraw is opened

Vicki Pfau <vi@xxxxxxxxxxx>
    HID: hid-steam: Make client_opened a counter

Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    HID: hid-steam: Fix cleanup in probe()

Adrian Betschart <adrian.betschart@xxxxxxxxxxxx>
    drm/amd/display: Don't replace a sink mode that shares the native totals

Oliver Hartkopp <socketcan@xxxxxxxxxxxx>
    can: fix unique skb identifier regression under RPS

Eric Dumazet <edumazet@xxxxxxxxxx>
    ipv6: use RCU in ip6_xmit()

Frank Sorenson <sorenson@xxxxxxxxxx>
    smb: client: reject short Next offsets in parse_server_interfaces()

Steve French <stfrench@xxxxxxxxxxxxx>
    smb3: fix for slab out of bounds on mount to ksmbd

Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    cifs: fix underflow in parse_server_interfaces()

Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    netfilter: nf_tables: release flowtable after rcu grace period on error

Ilya Maximets <i.maximets@xxxxxxx>
    openvswitch: vport: fix self-deadlock on release of tunnel ports

Yang Yang <n05ec@xxxxxxxxxx>
    openvswitch: defer tunnel netdev_put to RCU release

Ezrak1e <ezrakiez@xxxxxxxxx>
    dlm: validate length in dlm_search_rsb_tree

Xue Lei <Xue.Lei@xxxxxxxxxxxxx>
    mtd: fix double free and WARN_ON in add_mtd_device() error paths

Miquel Raynal <miquel.raynal@xxxxxxxxxxx>
    mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters

Miquel Raynal <miquel.raynal@xxxxxxxxxxx>
    mtd: Clean refcounting with MTD_PARTITIONED_MASTER

Alexander Usyskin <alexander.usyskin@xxxxxxxxx>
    mtd: fix use-after-free in mtd release

Fernando Fernandez Mancera <fmancera@xxxxxxx>
    net: openvswitch: validate transport header presence in set_ipv6_addr

Li RongQing <lirongqing@xxxxxxxxx>
    net/mlx5e: Order ICOSQ cc update after CQ doorbell

Eric Dumazet <edumazet@xxxxxxxxxx>
    flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

Eric Dumazet <edumazet@xxxxxxxxxx>
    flow_dissector: avoid u16 truncation of skb->len when computing thoff

Marek Szyprowski <m.szyprowski@xxxxxxxxxxx>
    ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM

Alvin Šipraga <alvin.sipraga@xxxxxxxxxx>
    ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes

Alvin Šipraga <alvin.sipraga@xxxxxxxxxx>
    ASoC: adau1372: allow sleepy powerdown GPIOs

Sang-Hoon Choi <csh0052@xxxxxxxxx>
    nvmet: use the local P2P device on metadata allocation failure

Sang-Hoon Choi <csh0052@xxxxxxxxx>
    cxgb4/ch_ktls: disable softirqs around tid_list erases

Jamal Hadi Salim <jhs@xxxxxxxxxxxx>
    net/sched: em_text: reject unterminated algo before autoload

Maíra Canal <mcanal@xxxxxxxxxx>
    drm/vc4: Free the BO cache size list on teardown

Myeonghun Pak <mhun512@xxxxxxxxx>
    drm/aspeed: Balance the display clock enable on teardown

Sang-Hoon Choi <csh0052@xxxxxxxxx>
    gpio: exar: initialize the ID before registering its cleanup

Oleg Keri <okerixx@xxxxxxxxx>
    drm/dp: don't mark the AUX backlight enabled when enabling failed

Christian Brauner <brauner@xxxxxxxxxx>
    namespace: refuse an automount below a mount that is in no namespace

Christian Brauner <brauner@xxxxxxxxxx>
    dcache: don't put a mountpoint on a dentry that's being removed

Christian Brauner <brauner@xxxxxxxxxx>
    namespace: check a submount for references right before unmounting it

Christian Brauner <brauner@xxxxxxxxxx>
    fs: refuse fspick() on internal superblocks

Alex Deucher <alexander.deucher@xxxxxxx>
    drm/amdgpu: make Mac FB workaround generic

Fan Wu <fanwu01@xxxxxxxxxx>
    drm/vc4: drain the hangcheck timer and works on V3D unbind

Krzysztof Karas <krzysztof.karas@xxxxxxxxx>
    drm/i915/gem: Prevent overstepping exec array boundary

Sajal Gupta <sajal2005gupta@xxxxxxxxx>
    drm/gud: don't keep a connector without a CRTC as connector_state

Palla Raghunath <raghunathpalla.0209@xxxxxxxxx>
    Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

Maxim Skokov <skokovmaksimevg@xxxxxxxxx>
    Bluetooth: RFCOMM: free the skb when the DLC has no owner

Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
    Bluetooth: hci_sock: Serialize dead-device detachment

Runyu Xiao <runyu.xiao@xxxxxxxxxx>
    scsi: qedi: Initialize callback state before registration

Abhishek Ojha <Abhishek.ojha@xxxxxxxxxxxxxxxxxxxx>
    regulator: ltc3676: don't read the write-only HRST and CLIRQ registers

Denis V. Lunev <den@xxxxxxxxxx>
    openvswitch: fix soft lockup in the netlink flow dump

Karl Bonde Torp <k.torp@xxxxxxxxxxx>
    nvme: fix swapped ZRASF zone state values for full and read only

Fredrik Nyberg <fredrik.nyberg@xxxxxxxxxxxxx>
    net: usb: ax88179_178a: fix rx frame length for non-last packets

Zixuan Chai <petalzu987@xxxxxxxxx>
    net: bridge: avoid recursive multicast port cleanup

Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
    net/smc: protect clcsock lifetime in smc_getname

Quchaosheng <quchaosheng000406@xxxxxxx>
    net/packet: guard the ll header push in packet_rcv_spkt()

Guangshuo Li <lgs201920130244@xxxxxxxxx>
    mmc: sdhci-sprd: disable runtime PM on remove

Yibo Tan <lhfff@xxxxxxxxxx>
    mmc: mtk-sd: Cancel request timeout work on remove

Guangshuo Li <lgs201920130244@xxxxxxxxx>
    mmc: cavium-thunderx: destroy slot platform devices on remove

Guangshuo Li <lgs201920130244@xxxxxxxxx>
    mmc: cavium-octeon: destroy slot platform devices on remove

Ma Xinmeng <1564938642@xxxxxx>
    dm-snap: reject the transient exception store for snapshot-merge

Ben Cressey <ben@xxxxxxxxxxx>
    dm-crypt: reject the lmk IV mode with AEAD ciphers

Nguyen Ngoc Thang <ngocthang2710.1999@xxxxxxxxx>
    memstick: rtsx_usb_ms: complete requests after eject instead of dropping them

Raj Ojha <rajojha047@xxxxxxxxx>
    memstick: core: wait for request completion before freeing card

성병찬 <tjdqudcks0424@xxxxxxxxx>
    KEYS: Fix add_key() race with keyring restriction

Karl Mehltretter <kmehltretter@xxxxxxxxx>
    keys: finalize persistent keyring timeout after link attempt

Mingming Cao <mmc@xxxxxxxxxxxxx>
    ibmveth: h_free logical LAN on open-fail after register

Ridham Khurana <khurana.ridham222@xxxxxxxxx>
    gpio: xilinx: fix runtime PM leak on request error path

Hui Peng <benquike@xxxxxxxxx>
    sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

Stephen Smalley <stephen.smalley.work@xxxxxxxxx>
    selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

Johannes Berg <johannes.berg@xxxxxxxxx>
    Revert "wifi: libertas: reject short monitor TX frames"

Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
    tipc: hold a reference to nodes found by link name

Yuqi Xu <xuyuqiabc@xxxxxxxxx>
    tipc: destroy topsrv workqueues before closing connections

Sabrina Dubroca <sd@xxxxxxxxxxxxxxx>
    strparser: make sure __strp_recv isn't running before tearing down the parser

Josef Bacik <josef@xxxxxxxxxxxxxx>
    xen/netfront: don't leak the skb when xennet_fill_frags() fails

Pavankumar Kondeti <pavan.kondeti@xxxxxxxxxxxxxxxx>
    workqueue: Fix NULL current_pwq deref in chained work check

Jason A. Donenfeld <Jason@xxxxxxxxx>
    wireguard: noise: reject response consumption after intermediate initiation

Michele Dionisio <michele.dionisio@xxxxxxxxx>
    wifi: brcmfmac: fix P2P device removal race in brcmf_detach()

Palla Raghunath <raghunathpalla.0209@xxxxxxxxx>
    dm ioctl: don't let data_start run past the buffer

Wentao Liang <vulab@xxxxxxxxxxx>
    btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()

Daehyeon Ko <4ncienth@xxxxxxxxx>
    ipv6: do not warn on route notification size race

Daehyeon Ko <4ncienth@xxxxxxxxx>
    ipv4: do not warn on route notification size race

Daehyeon Ko <4ncienth@xxxxxxxxx>
    ipv4: stop route notification sizing when nexthop group shrinks

Daehyeon Ko <4ncienth@xxxxxxxxx>
    ipv4: stop PMTU walk when nexthop group shrinks

Eric Biggers <ebiggers@xxxxxxxxxx>
    crypto: drbg - Fix ineffective sanity check

Carlos Llamas <cmllamas@xxxxxxxxxx>
    HID: uhid: convert to hid_safe_input_report()

Benjamin Tissoires <bentiss@xxxxxxxxxx>
    HID: core: introduce hid_safe_input_report()

Cong Nguyen <congnt264@xxxxxxxxx>
    iio: adc: max1363: sign-extend bipolar differential channel reads

Pengpeng Hou <pengpeng@xxxxxxxxxxx>
    iio: adc: aspeed: propagate reset deassert errors

Paulo Alcantara <pc@xxxxxxxxxxxxx>
    smb: client: discard post-EOF pagecache when extending a file via zero range

Felix Fietkau <nbd@xxxxxxxx>
    wifi: mac80211: set info->band for 802.3 encap offload frames

Sean Christopherson <seanjc@xxxxxxxxxx>
    KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted

Peter Xu <peterx@xxxxxxxxxx>
    mm/hugetlb: fix avoid_reserve to allow taking folio from subpool

Matthew Wilcox (Oracle) <willy@xxxxxxxxxxxxx>
    fs: Free any excess xarray nodes in clear_inode()

Zhiling Zou <zhilinz@xxxxxxxxxx>
    wifi: mac80211: count only matching reservations in reserved switch

Zhiling Zou <zhilinz@xxxxxxxxxx>
    wifi: mac80211: keep paired old chanctx alive

Johan Hovold <johan@xxxxxxxxxx>
    tty: port: fix tty_port_tty_vhangup() race

Jiri Slaby (SUSE) <jirislaby@xxxxxxxxxx>
    tty: introduce and use tty_port_tty_vhangup() helper

Eric Dumazet <edumazet@xxxxxxxxxx>
    bnxt_en: fix DMA mapping length for padded small packets

Johan Hovold <johan@xxxxxxxxxx>
    USB: serial: fix driver deregistration order

Johan Hovold <johan@xxxxxxxxxx>
    USB: serial: clean up core error labels

Zhao Li <enderaoelyther@xxxxxxxxx>
    wifi: mac80211: account proxy paths against the mesh path limit

Han Xu <han.xu@xxxxxxx>
    mtd: spinand: Enable QE on all dies

Pei Xiao <xiaopei01@xxxxxxxxxx>
    mtd: block2mtd: Fix divide error when erase_size is zero

Johan Hovold <johan@xxxxxxxxxx>
    USB: serial: fix ioctl hangup race

Mika Westerberg <mika.westerberg@xxxxxxxxxxxxxxx>
    thunderbolt: Fix KASAN reported use-after-free when request is canceled

Zhao Li <enderaoelyther@xxxxxxxxx>
    wifi: mac80211: keep fallback association elements alive

Zhao Li <enderaoelyther@xxxxxxxxx>
    wifi: mac80211: shut down RX BA session timer on teardown

Timur Kristóf <timur.kristof@xxxxxxxxx>
    drm/amd/display: Mark DCE 6.4 as not APU

Johan Hovold <johan@xxxxxxxxxx>
    serial: fix TIOCMIWAIT race

Mingyu Wang <25181214217@xxxxxxxxxxxxxxxxx>
    tty: vt: fix memory leak in vc_allocate()

David Heidelberg <david@xxxxxxx>
    Input: s6sy761 - fix resume ordering and restore sensing

Fan Wu <fanwu01@xxxxxxxxxx>
    tty: serial: max3100: shut down timer before freeing port

Johan Hovold <johan@xxxxxxxxxx>
    tty: abort break signalling on hangup

Jiri Slaby <jirislaby@xxxxxxxxxx>
    tty: reformat kernel-doc in tty_io.c

Johan Hovold <johan@xxxxxxxxxx>
    tty: tty_port: restore TTY_IO_ERROR on activation failure

Pannarat Wiriyaarritham <pannarat.wiriyaarritham@xxxxxxxxxxxxxx>
    usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41

Runyu Xiao <runyu.xiao@xxxxxxxxxx>
    USB: dwc2: shut down wakeup timer before freeing HCD state

Myeonghun Pak <mhun512@xxxxxxxxx>
    usb: ohci-spear: disable controller wakeup on removal

Chen Ni <nichen@xxxxxxxxxxx>
    usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()

Orgad Shaneh <orgads@xxxxxxxxx>
    usb: octeon-hcd: fix the FIFO-flush timeout computation

Willian Oliveira <williandossantosdeoliveira287@xxxxxxxxx>
    drm/amdgpu/gfx6: fix firmware leak on teardown

Guangshuo Li <lgs201920130244@xxxxxxxxx>
    drm/amdgpu: fix ACP MFD device leak on init failure

Vijendar Mukunda <Vijendar.Mukunda@xxxxxxx>
    drm/amdgpu: fix for coding style issues

Francisco Beltrán Millalén <fbeltranmillalen@xxxxxxxxx>
    drm/amdgpu: reset VI ASIC on MacBookPro14,3

Andre Eikmeyer <dev@deq.rocks>
    drm/amdgpu: reset VI ASIC on MacBookPro15,1

Timur Kristóf <timur.kristof@xxxxxxxxx>
    drm/amd/pm/si: Fix updating clock limits on AC/DC

Jiangshan Yi <yijiangshan@xxxxxxxxxx>
    drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend

Eric Biggers <ebiggers@xxxxxxxxxx>
    fsverity: add dependency on 64K or smaller pages

Mostafa Saleh <smostafa@xxxxxxxxxx>
    KVM: arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP

Jinseob Kim <kimjinseob88@xxxxxxxxx>
    iio: buffer: serialize buffer teardown with mode claims

Beata Michalska <beata.michalska@xxxxxxx>
    arm64: errata: Add Cortex-A725 erratum 3821522 workaround

Beata Michalska <beata.michalska@xxxxxxx>
    arm64: errata: Factor out broken AMU const counter cap

Kyle Zeng <kylebot@xxxxxxxxxx>
    ALSA: seq: Serialize compat port-info ioctls

Zhengchuan Liang <zcliangcn@xxxxxxxxx>
    perf: Require kernel access for text poke events

Johan Hovold <johan@xxxxxxxxxx>
    tty: fix saved termios reset race

Jiazi Liu <jiazi.liu1984@xxxxxxxxx>
    usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

Viken Dadhaniya <viken.dadhaniya@xxxxxxxxxxxxxxxx>
    soc: qcom: geni-se: Correct QUP Core ICC vote constants

Timur Kristóf <timur.kristof@xxxxxxxxx>
    drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC

Jiangshan Yi <yijiangshan@xxxxxxxxxx>
    smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

Josef Bacik <josef@xxxxxxxxxxxxxx>
    xen/netfront: drop RX packets with a short Ethernet header

Amit Sunil Dhamne <amitsd@xxxxxxxxxx>
    usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling

Xu Yang <xu.yang_2@xxxxxxx>
    usb: typec: tcpm: fix debug accessory mode detection for sink ports

Fan Wu <fanwu01@xxxxxxxxxx>
    usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

Uwe Kleine-König <u.kleine-koenig@xxxxxxxxxxxxxx>
    usb: gadget: at91_udc: Convert to platform remove callback returning void

Karl Mehltretter <kmehltretter@xxxxxxxxx>
    serial: imx: serialize imx_uart_ports[] lifetime

Uwe Kleine-König <u.kleine-koenig@xxxxxxxxxxxxxx>
    serial: imx: Convert to platform remove callback returning void

Gilberto Conde <gilbertorconde@xxxxxxxxx>
    net: usb: qmi_wwan: add Quectel EG120K-EA

Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
    wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

Chengchang Tang <tangchengchang@xxxxxxxxxx>
    RDMA/hns: Fix WQ_MEM_RECLAIM warning

Wentao Liang <vulab@xxxxxxxxxxx>
    wifi: wlcore: Fix runtime PM leak in wlcore_remove()

Uwe Kleine-König <u.kleine-koenig@xxxxxxxxxxxxxx>
    wifi: wlcore: Convert to platform remove callback returning void

Uwe Kleine-König <u.kleine-koenig@xxxxxxxxxxxxxx>
    wifi: wl12xx: Drop if with an always false condition

Frank Sorenson <sorenson@xxxxxxxxxx>
    smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races

Mehmet Fide <mehmet.fide@xxxxxxxxxxxxxxxxxx>
    mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages

Yi Yang <yiyang13@xxxxxxxxxx>
    vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF

Chris Mason <clm@xxxxxxxx>
    SUNRPC: reject duplicate CREDS_VALUE options

Chris Mason <clm@xxxxxxxx>
    SUNRPC: fix gssx_dec_option_array error path bugs

Asad Kamal <asad.kamal@xxxxxxx>
    drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read

Amit Pundir <amit.pundir@xxxxxxxxxx>
    arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved

Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
    Input: exc3000 - properly stop timer on shutdown

Simon Liebold <simonlie@xxxxxxxxx>
    Revert "scsi: sd: sd_zbc: Use logical blocks as unit when querying zones"

Victor Nogueira <victor@xxxxxxxxxxxx>
    net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode

Fan Wu <fanwu01@xxxxxxxxxx>
    iio: trigger: cancel reenable_work before freeing trigger

Salah Triki <salah.triki@xxxxxxxxx>
    iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler

Cong Nguyen <congnt264@xxxxxxxxx>
    iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure

Salah Triki <salah.triki@xxxxxxxxx>
    iio: proximity: isl29501: Fix return type of isl29501_register_write

Fan Wu <fanwu01@xxxxxxxxxx>
    iio: light: gp2ap020a00f: drain irq_work after free_irq

Arka Mondal <arkamondalofficial@xxxxxxxxx>
    iio: imu: adis16480: fix unprotected debugfs reads

Arka Mondal <arkamondalofficial@xxxxxxxxx>
    iio: imu: adis16400: fix unprotected debugfs reads

Arka Mondal <arkamondalofficial@xxxxxxxxx>
    iio: gyro: adis16136: fix unprotected debugfs reads

Felix Gu <ustc.gu@xxxxxxxxx>
    iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls

Felix Gu <ustc.gu@xxxxxxxxx>
    iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure

Salah Triki <salah.triki@xxxxxxxxx>
    iio: accel: sca3000: fix frequency divider condition check

Jiale Yao <yaojiale02@xxxxxxx>
    iio: accel: kxcjk-1013: reject duplicate event disable

Daehyeon Ko <4ncienth@xxxxxxxxx>
    thunderbolt: Reject oversized XDomain properties responses

Ian Lin <ian.lin@xxxxxxxxxxxxx>
    USB: serial: option: add Compal EXC-T1 support

Sebastian Sjoholm <sebastian.sjoholm@xxxxxxxxx>
    USB: serial: option: add Quectel RG660QB

Ian Lin <jisayme@xxxxxxxxx>
    USB: serial: option: add Compal EXM-G1x support

Carlo Szelinsky <github@xxxxxxxxxxxx>
    USB: serial: option: add Quectel EG060W

Zhao Dongdong <zhaodongdong@xxxxxxxxxx>
    USB: serial: option: add support for SIMCom SIM8260C

Johan Hovold <johan@xxxxxxxxxx>
    USB: serial: fix dynamic id driver deregistration race

Johan Hovold <johan@xxxxxxxxxx>
    USB: serial: ssu100: fix baud rate overflow

Johan Hovold <johan@xxxxxxxxxx>
    USB: serial: quatech2: fix baud rate overflow

Jérémy Carrat <jeremy.carrat@xxxxxxxxxx>
    USB: serial: cp210x: add Corsair AX1500i Power Supply

Yuqi Xu <xuyuqiabc@xxxxxxxxx>
    wifi: mac80211: handle empty FILS association request payload

Zhao Li <enderaoelyther@xxxxxxxxx>
    wifi: mac80211: release mesh path quota on failed additions

Yuqi Xu <xuyuqiabc@xxxxxxxxx>
    wifi: mac80211: minstrel_ht: validate fixed rate index

Zhao Li <enderaoelyther@xxxxxxxxx>
    wifi: mac80211: drain PS delivery work during station teardown

Guangshuo Li <lgs201920130244@xxxxxxxxx>
    wifi: iwlegacy: 3945: free EEPROM data on remove

Tianchu Chen <flynnnchen@xxxxxxxxxxx>
    wifi: cw1200: fix TX padding OOB read leaking heap data to device

Nuno Sá <nuno.sa@xxxxxxxxxx>
    mtd: spinand: fix zero oobavail when no ECC engine is used

Mehmet Fide <mehmet.fide@xxxxxxxxxxxxxxxxxx>
    mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB

Runyu Xiao <runyu.xiao@xxxxxxxxxx>
    mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ

Daehyeon Ko <4ncienth@xxxxxxxxx>
    nvme-multipath: fix underflow in ANA log bounds checks

Leon Hwang <leon.hwang@xxxxxxxxx>
    kprobes: Skip disarmed probes when checking optkprobe overlap

Zhiling Zou <zhilinz@xxxxxxxxxx>
    ipvs: bound LBLCR and LBLC cache growth

Chandrashekar Devegowda <chandrashekar.devegowda@xxxxxxxxx>
    Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
    Bluetooth: hci_core: Serialize ACL scheduling with channel deletion

Linmao Li <lilinmao@xxxxxxxxxx>
    Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems

Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
    Bluetooth: RFCOMM: Fix initial port reference race

Xiang Mei <xmei5@xxxxxxx>
    ALSA: ua101: reject mismatched capture/playback packet sizes

Zimeng Li <me@xxxxxxxx>
    ASoC: qcom: lpass-cpu: use DAI table index for playback constraints

Wentao Liang <vulab@xxxxxxxxxxx>
    serial: vt8500: Fix clock reference leak in vt8500_serial_probe()

Simon Gassner <simon.gassner@xxxxxxxxxxxxxx>
    serial: tegra: don't clear the Tx FIFO on an Rx-only reset

Fan Wu <fanwu01@xxxxxxxxxx>
    serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

Viken Dadhaniya <viken.dadhaniya@xxxxxxxxxxxxxxxx>
    tty: serial: qcom_geni_serial: Keep console RX functional after deep idle

Joshua Rogers <linux@xxxxxxxxx>
    tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

Joshua Rogers <linux@xxxxxxxxx>
    tty: vcc: zero-initialize control packet in vcc_send_ctl()

Johan Hovold <johan@xxxxxxxxxx>
    tty: amiserial: fix broken TIOCMIWAIT

Jie Deng <dengjie03@xxxxxxxxxx>
    usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe

Fan Wu <fanwu01@xxxxxxxxxx>
    usb: cdns3: fix use-after-free in cdns3_gadget_exit()

Jameson Thies <jthies@xxxxxxxxxx>
    usb: typec: ucsi: displayport: Current CAM OOB index fixup

Prashanth K <prashanth.k@xxxxxxxxxxxxxxxx>
    usb: typec: ucsi: Get the connector fwnode based on reg value

Radhey Shyam Pandey <radhey.shyam.pandey@xxxxxxx>
    usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()

Amit Sunil Dhamne <amitsd@xxxxxxxxxx>
    usb: typec: tcpm: recover after failure to start the frs ams

Hui Peng <benquike@xxxxxxxxx>
    usb: core: clear both ep_in and ep_out for non-ep0 control endpoints

Yuchao Zhang <ndaugoing@xxxxxxxxx>
    usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC

Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
    USB: gadget: dummy-hcd: Fix wait for outstanding request completions

Fan Wu <fanwu01@xxxxxxxxxx>
    usb: gadget: aspeed-vhub: cancel wake work on device removal

Liu Chao <liuc63@xxxxxxxxxxxx>
    usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd

Myeonghun Pak <mhun512@xxxxxxxxx>
    usb: ohci-st: disable controller wakeup on removal

Myeonghun Pak <mhun512@xxxxxxxxx>
    usb: ohci-s3c2410: disable controller wakeup on removal

Myeonghun Pak <mhun512@xxxxxxxxx>
    usb: ohci-da8xx: disable controller wakeup on cleanup

Lovekesh Solanki <lovekeshsolanki00@xxxxxxxxx>
    usb: hub: use shorter 120ms post resume hold for SS root hubs

Syed Labeeq Sajid Bukhari <syedlabeeq@xxxxxxxxx>
    usb: storage: sierra_ms: reject short SWoC info transfers

Johan Hovold <johan@xxxxxxxxxx>
    USB: serial: fix port tear down use-after-free

Johan Hovold <johan@xxxxxxxxxx>
    USB: cdc-acm: fix racy TIOCMIWAIT implementation

Yuxiao Wang <yuxiao.wang@xxxxxxxxxx>
    nitro_enclaves: fix use-after-free on SLOT_ALLOC failure

Raphaël Larocque <rlarocque@xxxxxxxxxxx>
    Input: synaptics - limit T440p InterTouch quirk to LEN0036

Lovekesh Solanki <lovekeshsolanki00@xxxxxxxxx>
    Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490

Lovekesh Solanki <lovekeshsolanki00@xxxxxxxxx>
    Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410

Martino Papero <martino.papero@xxxxxxxxx>
    Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11

Wentao Liang <vulab@xxxxxxxxxxx>
    kgdboc: Fix tty driver reference leak in configure_kgdboc()

Imre Kaloz <kaloz@xxxxxxxxxx>
    drm/radeon: Read the VRAM VBIOS signature with readb()

Nikola Prica <nikola.prica@xxxxxxx>
    PCI: Accept AtomicOps already enabled by the hypervisor

Luo Gengkun <luogengkun2@xxxxxxxxxx>
    perf: Fix race between perf_event_exit_task() and perf_pending_task()

Hongjian Dai <daihongjian@xxxxxxxxxxxxxxx>
    i2c: at91: release DMA channels when probe defers

Eric Dumazet <edumazet@xxxxxxxxxx>
    ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

Florian Westphal <fw@xxxxxxxxx>
    net: add and use skb_get_hash_net

Florian Westphal <fw@xxxxxxxxx>
    netfilter: nf_tables: avoid skb access on nf_stolen

Julian Anastasov <ja@xxxxxx>
    ipvs: filter some flags received in the backup server

Julian Anastasov <ja@xxxxxx>
    ipvs: do not create invisible templates

Julian Anastasov <ja@xxxxxx>
    ipvs: fix missing counter decrement in lblc

Jeff Jo <jeffjo@xxxxxxxxxx>
    tcp: refresh TS.Recent for accepted old ACKs

Jamal Hadi Salim <jhs@xxxxxxxxxxxx>
    net/sched: sch_codel: match the no-drop threshold to the packet size

Jamal Hadi Salim <jhs@xxxxxxxxxxxx>
    net/sched: fq_codel: match the no-drop threshold to the packet size

Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
    tipc: prevent GCM nonce reuse on peer key changes

Florian Fainelli <florian.fainelli@xxxxxxxxxxxx>
    net: systemport: Fix RUNT MIB counter register offset calculation

Florian Westphal <fw@xxxxxxxxx>
    netfilter: ipset: do not update comments from kernel-side adds

Jamal Hadi Salim <jhs@xxxxxxxxxxxx>
    net/sched: cls_api: reclaim an empty proto on the error path

Binbin Deng <18983559317@xxxxxxx>
    net/mctp: publish the mctp_dev only after it is initialised

Jeremy Kerr <jk@xxxxxxxxxxxxxxxxxxxx>
    mctp: Add refcounts to mctp_dev

Sai Teja Aluvala <aluvala.sai.teja@xxxxxxxxx>
    Bluetooth: btintel: validate DDC record lengths

Sang-Hoon Choi <csh0052@xxxxxxxxx>
    Bluetooth: hci_core: free the HCI ID if naming fails

Cezary Rojewski <cezary.rojewski@xxxxxxxxx>
    ASoC: codecs: rt274: Fix format setting for 44100 rate

Zhao Li <enderaoelyther@xxxxxxxxx>
    wifi: cfg80211: preserve hidden-group beacon IE ownership

Nicolas Escande <nico.escande@xxxxxxxxx>
    wifi: ath11k: reset ar->num_stations on hardware start

HyeongJun An <sammiee5311@xxxxxxxxx>
    ASoC: wm8903: Move the DRC QR threshold to the register that holds it

Abdurrahman Hussain <abdurrahman@xxxxxxxxxx>
    of/overlay: don't create "//" paths for fragments targeting the root

Abdurrahman Hussain <abdurrahman@xxxxxxxxxx>
    of/overlay: don't leak fragment references when changeset init fails

Julian Sun <sunjunchao@xxxxxxxxxxxxx>
    nvmet: preserve device path on allocation failure

Karl Mehltretter <kmehltretter@xxxxxxxxx>
    mtd: core: call _get_device() with the master MTD

Alexander Usyskin <alexander.usyskin@xxxxxxxxx>
    mtd: call external _get and _put in right order

Tomas Winkler <tomas.winkler@xxxxxxxxx>
    mtd: use refcount to prevent corruption

Shang XiaoJing <shangxiaojing@xxxxxxxxxx>
    mtd: core: Fix refcount error in del_mtd_device()

Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
    mtd: core: Drop duplicate NULL checks around nvmem_unregister()

Zev Weiss <zev@xxxxxxxxxxxxxxxxx>
    mtd: core: clear out unregistered devices a bit more

Nilesh Javali <njavali@xxxxxxxxxxx>
    scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort

Nilesh Javali <njavali@xxxxxxxxxxx>
    scsi: qla2xxx: Initialize NVMe abort_work once at submission

Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    hsr: Remove WARN_ONCE() in hsr_addr_is_self().

Duoming Zhou <duoming@xxxxxxxxxx>
    watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger

Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
    perf/core: Fix WARN in perf_sigtrap()

Xiang Mei <xmei5@xxxxxxx>
    ALSA: line6: reject oversized playback packets

Nguyen Ngoc Thang <ngocthang2710.1999@xxxxxxxxx>
    ALSA: caiaq: unregister the input device when probe fails

Zizhi Wo <wozizhi@xxxxxxxxxx>
    vt: skip screen update for DEC alignment test on backgroup consoles

Clément Léger <clement.leger@xxxxxxxxxxx>
    of/irq: add missing of_node_put() for interrupt parent node

Sanghyun Park <sanghyun.park.cnu@xxxxxxxxx>
    vxlan: use one headroom snapshot for neighbour replies

Maoyi Xie <maoyixie.tju@xxxxxxxxx>
    rds_tcp: close NULL deref window in rds_tcp_set_callbacks

Xin Long <lucien.xin@xxxxxxxxx>
    openvswitch: add nf_ct_is_confirmed check before assigning the helper

Konrad Dybcio <konrad.dybcio@xxxxxxxxxx>
    drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails

Konrad Dybcio <konrad.dybcio@xxxxxxxxxx>
    drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs

Benjamin Berg <benjamin.berg@xxxxxxxxx>
    wifi: cfg80211: avoid double free if updating BSS fails

Jun Yang <junvyyang@xxxxxxxxxxx>
    sctp: check RCV_SHUTDOWN after the sendmsg connect wait

Runyu Xiao <runyu.xiao@xxxxxxxxxx>
    rtc: spear: initialize IRQ state before requesting alarm IRQ

Ilkka Lappeteläinen <ilkka.lappetelainen@xxxxxxxxx>
    net/packet: prevent TX_RING byte count overflow

Aohan Mei <henrymei@xxxxxxxxxxx>
    netfilter: nft_flow_offload: drop flowtable reference on init error path

Abdurrahman Hussain <abdurrahman@xxxxxxxxxx>
    of/overlay: only treat a positive changeset id as registered

Abdurrahman Hussain <abdurrahman@xxxxxxxxxx>
    of/overlay: put property on deadprops only after changeset add succeeds

Wentao Liang <vulab@xxxxxxxxxxx>
    of/irq: Fix remaining refcount leaks in of_irq_init()

Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
    audit: fix exe mark UAF in kill_rules()

Takashi Iwai <tiwai@xxxxxxx>
    ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices

Zihan Xi <zihanx@xxxxxxxxxx>
    smb: client: close completed creates on compound wait errors

Zihan Xi <zihanx@xxxxxxxxxx>
    smb: client: close handle after create-context parsing failure

ChenXiaoSong <chenxiaosong@xxxxxxxxxx>
    smb/client: pass cifs_open_info_data to SMB2_open()

ChenXiaoSong <chenxiaosong@xxxxxxxxxx>
    smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()

Chen Changcheng <chenchangcheng@xxxxxxxxxx>
    HID: alps: unregister DualPoint Stick input device on remove

Bastien Nocera <hadess@xxxxxxxxxx>
    HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM

Marcus Folkesson <marcus.folkesson@xxxxxxxxx>
    HID: hid-alps: use default remove for hid device

Thomas Weißschuh <linux@xxxxxxxxxxxxxx>
    HID: core: remove #ifdef CONFIG_PM from hid_driver

Tibor Harcsa <silurust@xxxxxxxxx>
    Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table

Aldo Ariel Panzardo <qwe.aldo@xxxxxxxxx>
    Bluetooth: mgmt: fix race in read_unconf_index_list()

Zihan Xi <zihanx@xxxxxxxxxx>
    smb: client: validate POSIX create context length

Namjae Jeon <linkinjeon@xxxxxxxxxx>
    smb: client: use finish_no_open() for non-regular inodes

Aohan Mei <henrymei@xxxxxxxxxxx>
    netfilter: nf_tables: skip expired catchall elements on insert and delete

Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST

Guangshuo Li <lgs201920130244@xxxxxxxxx>
    net: ena: fix MMIO read buffer leak on probe failure

Dr. David Alan Gilbert <linux@xxxxxxxxxxx>
    net: ena: Remove autopolling mode

Ilya Titov <ilya.titov@xxxxxxxxxxxxxx>
    pinctrl: sunxi: keep a shadow copy of the data register output latches

Wang Jianzheng <wangjianzheng@xxxxxxxx>
    pinctrl: sunxi: Use devm_clk_get_enabled() helpers

Samuel Holland <samuel@xxxxxxxxxxxx>
    pinctrl: sunxi: Refactor register/offset calculation

Yuqi Xu <xuyuqiabc@xxxxxxxxx>
    net: ipconfig: bound DHCP option construction

Thorsten Blum <thorsten.blum@xxxxxxxxx>
    net: ipconfig: Remove outdated comment and indent code block

Zihan Xi <zihanx@xxxxxxxxxx>
    smb: client: fix create context out-of-bounds reads

Steve French <stfrench@xxxxxxxxxxxxx>
    smb3: make query_on_disk_id open context consistent and move to common code

Ilya Maximets <i.maximets@xxxxxxx>
    net: openvswitch: conntrack: fix helper UAF due to extensions realloc

Jinjiang Tu <tujinjiang@xxxxxxxxxx>
    mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish

Dapeng Mi <dapeng1.mi@xxxxxxxxxxxxxxx>
    perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities

Wentao Liang <vulab@xxxxxxxxxxx>
    drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()

Willem de Bruijn <willemb@xxxxxxxxxx>
    tcp: prevent collapsing skbs across boundary in rtx queue

Myeonghun Pak <mhun512@xxxxxxxxx>
    bna: prevent IOC timer rearm during teardown

Paulo Alcantara <pc@xxxxxxxxxxxxx>
    smb: client: fix smbd_connection leak on cifs_get_tcp_session() error

Fan Wu <fanwu01@xxxxxxxxxx>
    wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

Yibo Tan <lhfff@xxxxxxxxxx>
    hwmon: (pwm-fan) Stop RPM timer before freeing tach data

Tzung-Bi Shih <tzungbi@xxxxxxxxxx>
    watchdog: rtd119x: Avoid division by zero

Christophe JAILLET <christophe.jaillet@xxxxxxxxxx>
    watchdog: rtd119x: Use devm_clk_get_enabled() helper

Hongling Zeng <zenghongling@xxxxxxxxxx>
    btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()

Yuho Choi <oss.patchbox@xxxxxxxxx>
    ALSA: virtio: reset device before deleting virtqueues

Bjoern Doebel <doebel@xxxxxxxxx>
    smb: client: avoid leaking refcount when cifs_sb_tlink() fails

Fan Wu <fanwu01@xxxxxxxxxx>
    smb: client: fix cifsFileInfo reference leak in deferred close

Paulo Alcantara <pc@xxxxxxxxxxxxx>
    smb: client: fix file type corruption in cifs_reparse_point_to_fattr()

Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
    ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()

Xuanqiang Luo <luoxuanqiang@xxxxxxxxxx>
    net/sched: act_api: release all action references on NEWACTION failure

Zihan Xi <zihanx@xxxxxxxxxx>
    ipmr: account multicast table and route memory

Guanghui Yang <3497809730@xxxxxx>
    f2fs: fix dentry folio leak in find_in_level

Wenjie Qi <qwjhust@xxxxxxxxx>
    f2fs: limit recovery filename logging to stored length

Nilesh Javali <njavali@xxxxxxxxxxx>
    scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature

Nilesh Javali <njavali@xxxxxxxxxxx>
    scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot

Nilesh Javali <njavali@xxxxxxxxxxx>
    scsi: qla2xxx: Quiesce response IRQ before freeing request queue

Nilesh Javali <njavali@xxxxxxxxxxx>
    scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate

Nilesh Javali <njavali@xxxxxxxxxxx>
    scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path

Ruoyu Wang <ruoyuw560@xxxxxxxxx>
    media: zoran: Avoid freeing a registered video_device twice

Guangshuo Li <lgs201920130244@xxxxxxxxx>
    media: saa7164: fix cleanup on resource allocation failure

Narasimharao Vadlamudi <ahmisaranrao@xxxxxxxxx>
    media: rkvdec: Propagate platform_get_irq() errors

Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
    mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP

Karl Mehltretter <kmehltretter@xxxxxxxxx>
    arm64: mm: Fix the lockless page-table walk in show_pte()

Hugh Dickins <hughd@xxxxxxxxxx>
    arm64: allow pte_offset_map() to fail

Steven Rostedt <rostedt@xxxxxxxxxxx>
    ftrace: Synchronize the initialization of ftrace_ops

Muhammad Bilal <meatuni001@xxxxxxxxx>
    staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()

Can Peng <pengcan@xxxxxxxxxx>
    spi: bcm63xx: disable clock on resume failure

Jeffin Philip <jeffinphilip14@xxxxxxxxx>
    usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()

Adrian Hunter <adrian.hunter@xxxxxxxxx>
    i3c: master: Fix use-after-free of master->this

Adrian Hunter <adrian.hunter@xxxxxxxxx>
    i3c: master: Do not treat master device as a duplicate target

Can Peng <pengcan@xxxxxxxxxx>
    hwrng: stm32 - Fix runtime PM cleanup on registration failure

Fan Wu <fanwu01@xxxxxxxxxx>
    mmc: via-sdmmc: cancel card-detect work on remove

Jianing Li <m13940358460@xxxxxxx>
    power: supply: max17040: drop incorrect I2C functionality check

Uwe Kleine-König <u.kleine-koenig@xxxxxxxxxxxxxx>
    power: supply: max17040: Convert to i2c's .probe_new()

Angel Iglesias <ang.iglesiasg@xxxxxxxxx>
    i2c: core: Introduce i2c_client_get_device_id helper function

Fan Wu <fanwu01@xxxxxxxxxx>
    power: supply: rt9455: quiesce delayed work before teardown

Uwe Kleine-König <u.kleine-koenig@xxxxxxxxxxxxxx>
    power: supply: rt9455: Convert to i2c's .probe_new()

Oscar Ou <oscarou@xxxxxxxxxxxx>
    lockd: fix swapped arguments in nlmsvc_match_ip()

Ruoyu Wang <ruoyuw560@xxxxxxxxx>
    i2c: mxs: fix DMA channel leak on probe error

Bence Csókás <csokas.bence@xxxxxxxxx>
    dmaengine: Add devm_dma_request_chan()

Jiacheng Yu <yujiacheng3@xxxxxxxxxx>
    params: fix charp corruption on allocation failure

Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
    params: Fix multi-line comment style

Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
    params: Sort headers

Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
    params: Use size_add() for kmalloc()

Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
    params: Do not go over the limit when getting the string length

Christophe JAILLET <christophe.jaillet@xxxxxxxxxx>
    kernel/params.c: Use kstrtobool() instead of strtobool()

Kuan-Wei Chiu <visitorckw@xxxxxxxxx>
    coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior

Frank Sorenson <sorenson@xxxxxxxxxx>
    cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0

Chuck Lever <chuck.lever@xxxxxxxxxx>
    nfsd: gate nfs2 setacl by argp->mask

Jeff Layton <jlayton@xxxxxxxxxx>
    nfsd: fix clock domain mismatch in clients_still_reclaiming()

Jeff Layton <jlayton@xxxxxxxxxx>
    nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()

Chris Mason <clm@xxxxxxxx>
    nfsd: size fh_verify server sockaddr slot by xpt_locallen

Chris Mason <clm@xxxxxxxx>
    nfsd: release path refs on follow_down() error

Longlong Xia <xialonglong@xxxxxxxxxx>
    zram: fix out-of-bounds access in read_block_state()

Sergey Senozhatsky <senozhatsky@xxxxxxxxxxxx>
    zram: fixup read_block_state()

Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
    KEYS: trusted: Fix TPM teardown ordering

Qing Ming <a0yami@xxxxxxxxxxx>
    gtp: serialize PDP context updates

Breno Leitao <leitao@xxxxxxxxxx>
    usb: xhci: bail out of setup if the controller is inaccessible

Arnaldo Carvalho de Melo <acme@xxxxxxxxxx>
    perf test bpf: Address error about non-null argument for epoll_pwait 2nd arg

Namhyung Kim <namhyung@xxxxxxxxxx>
    perf tools: Fix a asan issue in parse_events_multi_pmu_add()

Xiang Mei <xmei5@xxxxxxx>
    vlan: require the MAC header to be present in __vlan_insert_inner_tag()

Frank Sorenson <sorenson@xxxxxxxxxx>
    smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

Frank Sorenson <sorenson@xxxxxxxxxx>
    smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

Frank Sorenson <sorenson@xxxxxxxxxx>
    smb: client: fix potential OOB read in smb3_enum_snapshots()

Daehyeon Ko <4ncienth@xxxxxxxxx>
    wifi: libipw: reject TKIP frames without a full MIC

Xiang Mei <xmei5@xxxxxxx>
    ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity

Takashi Iwai <tiwai@xxxxxxx>
    ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling

Bjoern Doebel <doebel@xxxxxxxxx>
    smb: client: fix heap overflow in DACL owner/group rewrite

Bjoern Doebel <doebel@xxxxxxxxx>
    smb: client: avoid leaking refcount in cifs_queue_oplock_break()

Aohan Mei <henrymei@xxxxxxxxxxx>
    smb: client: reject userspace cifs.idmap descriptions

Zhiling Zou <zhilinz@xxxxxxxxxx>
    net: bridge: use option bits for CFM/MRP frame handlers

Jens Axboe <axboe@xxxxxxxxx>
    io_uring/rw: end write accounting from ->ki_complete

XingWang Xiang <v3rdant.xiang@xxxxxxxxx>
    genetlink: pin family module during policy dump

Xu Rao <raoxu@xxxxxxxxxxxxx>
    Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev

Uwe Kleine-König <u.kleine-koenig@xxxxxxxxxxxxxx>
    Bluetooth: btqcomsmd: Convert to platform remove callback returning void

Thomas Gleixner <tglx@xxxxxxxxxxxxx>
    tick/broadcast: Plug clockevents replacement race

Chao Yu <chao@xxxxxxxxxx>
    f2fs: embed f2fs_gc_kthread in f2fs_sb_info

Nilesh Javali <njavali@xxxxxxxxxxx>
    scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]

Nilesh Javali <njavali@xxxxxxxxxxx>
    scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown

Nilesh Javali <njavali@xxxxxxxxxxx>
    scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking

Nilesh Javali <njavali@xxxxxxxxxxx>
    scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak

Christian Borntraeger <borntraeger@xxxxxxxxxxxxx>
    KVM: s390: Zero initialize data structures for inject_pfault_token

Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
    nvme: add missing SRCU grace period in error path

Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
    kprobes: Protect kprobe_blacklist with RCU

Steven Rostedt <rostedt@xxxxxxxxxxx>
    ftrace: Take trace_array reference before accessing its ftrace_ops

Muhammad Bilal <meatuni001@xxxxxxxxx>
    staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

Vivek BalachandharTN <vivek.balachandhar@xxxxxxxxx>
    staging: rtl8723bs: fix spacing around operators

Myeonghun Pak <mhun512@xxxxxxxxx>
    usb: storage: realtek_cr: fix use-after-free on disconnect

Fan Wu <fanwu01@xxxxxxxxxx>
    wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop

Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
    nvme-tcp: fix host memory disclosure on R2T for a read command

Varun Prakash <varun@xxxxxxxxxxx>
    nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t()

Doruk Tan Ozturk <doruk@xxxxxxx>
    ocfs2: validate directory-index entry counts when reading metadata

Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>
    ocfs2: validate dx_root extent list fields during block read

Dave Airlie <airlied@xxxxxxxxxx>
    nouveau/gem: reserve the bo in the info ioctl around the vma lookup

Doruk Tan Ozturk <doruk@xxxxxxx>
    HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind

Frank Sorenson <sorenson@xxxxxxxxxx>
    smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

Michael Bommarito <michael.bommarito@xxxxxxxxx>
    ceph: bound copied dentry name length in NFS export get_name

Jeff Layton <jlayton@xxxxxxxxxx>
    nfsd: fix nfsd_file leak on inter-server COPY setup failure

Xu Yang <xu.yang_2@xxxxxxx>
    device property: fix infinite loop in fwnode_for_each_child_node()

Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
    device property: Add cleanup.h based fwnode_handle_put() scope based cleanup.

Hyunwoo Kim <imv4bel@xxxxxxxxx>
    apparmor: fix out-of-bounds write when null terminating a label vec

Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
    tls: device: fix out-of-bounds write in tls_append_frag()


-------------

Diffstat:

 Documentation/arm64/silicon-errata.rst             |   2 +
 Documentation/networking/strparser.rst             |   2 +-
 Makefile                                           |   4 +-
 arch/arm64/Kconfig                                 |  30 +
 arch/arm64/boot/dts/qcom/sdm845-db845c.dts         |   9 +
 arch/arm64/kernel/cpu_errata.c                     |  24 +-
 arch/arm64/kernel/cpufeature.c                     |   2 +-
 arch/arm64/kernel/topology.c                       |  11 +-
 arch/arm64/kvm/mmu.c                               |  25 +-
 arch/arm64/kvm/vgic/vgic-its.c                     |   8 +
 arch/arm64/mm/fault.c                              |  17 +-
 arch/arm64/tools/cpucaps                           |   2 +-
 arch/nios2/include/asm/checksum.h                  |   2 +-
 arch/s390/kvm/kvm-s390.c                           |   4 +-
 arch/s390/pci/pci_sysfs.c                          |   3 +
 arch/x86/events/intel/core.c                       |  10 +-
 arch/x86/events/perf_event.h                       |   2 +-
 arch/x86/kvm/mmu/mmu.c                             |   4 +-
 arch/x86/kvm/svm/svm.c                             |   3 +-
 arch/x86/kvm/vmx/nested.c                          |   4 +-
 arch/x86/kvm/x86.h                                 |   4 +-
 crypto/drbg.c                                      |  11 +-
 drivers/base/property.c                            |  19 +-
 drivers/block/zram/zram_drv.c                      |   6 +-
 drivers/bluetooth/btintel.c                        |  15 +-
 drivers/bluetooth/btqcomsmd.c                      |  10 +-
 drivers/bluetooth/btusb.c                          |   2 +
 drivers/char/hw_random/stm32-rng.c                 |  12 +-
 drivers/dma/dmaengine.c                            |  30 +
 drivers/edac/amd64_edac.c                          |   2 +-
 drivers/gpio/gpio-exar.c                           |   2 +-
 drivers/gpio/gpio-xilinx.c                         |   9 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c            |  46 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c        |  66 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c            |  17 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c              |   9 +
 drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c             |  25 +-
 drivers/gpu/drm/amd/amdgpu/vce_v3_0.c              |   2 +-
 drivers/gpu/drm/amd/amdgpu/vi.c                    |  21 +
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  16 +-
 .../gpu/drm/amd/display/dc/dce60/dce60_resource.c  |   1 -
 .../gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c    |  10 +-
 .../gpu/drm/amd/pm/powerplay/hwmgr/ppatomfwctrl.c  |  11 +-
 drivers/gpu/drm/amd/pm/powerplay/si_dpm.c          |  39 +-
 drivers/gpu/drm/aspeed/aspeed_gfx_drv.c            |   5 +-
 drivers/gpu/drm/drm_dp_helper.c                    |   4 +-
 drivers/gpu/drm/drm_fb_helper.c                    |   8 +-
 drivers/gpu/drm/gud/gud_pipe.c                     |   1 +
 drivers/gpu/drm/i915/display/intel_dmc.c           |  21 +-
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c     |   2 +-
 drivers/gpu/drm/i915/gt/intel_rps.c                |   3 +-
 drivers/gpu/drm/msm/adreno/a6xx_gpu.c              |   3 +-
 drivers/gpu/drm/msm/adreno/adreno_gpu.c            |   2 +
 drivers/gpu/drm/msm/msm_gpu.c                      |   1 -
 drivers/gpu/drm/nouveau/nouveau_gem.c              |  11 +-
 drivers/gpu/drm/radeon/radeon_bios.c               |   6 +-
 drivers/gpu/drm/vc4/vc4_bo.c                       |   1 +
 drivers/gpu/drm/vc4/vc4_v3d.c                      |   8 +
 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c                |  22 +-
 drivers/hid/hid-alps.c                             |  21 +-
 drivers/hid/hid-core.c                             |  26 +-
 drivers/hid/hid-sony.c                             |   4 +-
 drivers/hid/hid-steam.c                            | 211 ++---
 drivers/hid/i2c-hid/i2c-hid-core.c                 |   5 +-
 drivers/hid/uhid.c                                 |   8 +-
 drivers/hid/usbhid/hid-core.c                      |  11 +-
 drivers/hv/connection.c                            |   1 -
 drivers/hv/vmbus_drv.c                             |   1 -
 drivers/hwmon/drivetemp.c                          |  10 +-
 drivers/hwmon/pwm-fan.c                            |  15 +-
 .../hwtracing/coresight/coresight-etm3x-sysfs.c    |  15 +-
 drivers/i2c/busses/i2c-at91-master.c               |   8 +-
 drivers/i2c/busses/i2c-mxs.c                       |   5 +-
 drivers/i2c/busses/i2c-qcom-cci.c                  |   4 +-
 drivers/i2c/busses/i2c-wmt.c                       |   2 +-
 drivers/i2c/i2c-core-base.c                        |  14 +
 drivers/i3c/master.c                               |  20 +-
 drivers/iio/accel/kxcjk-1013.c                     |   2 +-
 drivers/iio/accel/sca3000.c                        |   2 +-
 drivers/iio/adc/aspeed_adc.c                       |   4 +-
 drivers/iio/adc/max1363.c                          |   8 +
 drivers/iio/adc/sun4i-gpadc-iio.c                  |  10 +-
 drivers/iio/gyro/adis16136.c                       |   2 +-
 drivers/iio/imu/adis16400.c                        |   2 +-
 drivers/iio/imu/adis16480.c                        |   4 +-
 drivers/iio/industrialio-buffer.c                  |   2 +
 drivers/iio/industrialio-trigger.c                 |   2 +
 drivers/iio/light/gp2ap020a00f.c                   |   2 +
 drivers/iio/proximity/isl29501.c                   |   2 +-
 drivers/iio/proximity/pulsedlight-lidar-lite-v2.c  |   4 +-
 drivers/iio/proximity/vcnl3020.c                   |  24 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |   3 +-
 drivers/input/keyboard/atkbd.c                     |   8 +
 drivers/input/mouse/byd.c                          |   2 +-
 drivers/input/mouse/synaptics.c                    |   7 +-
 drivers/input/serio/i8042-acpipnpio.h              |   9 +
 drivers/input/touchscreen/exc3000.c                |  10 +
 drivers/input/touchscreen/s6sy761.c                |  14 +-
 drivers/isdn/capi/capi.c                           |   8 +-
 drivers/md/dm-cache-target.c                       |  59 +-
 drivers/md/dm-crypt.c                              |  10 +-
 drivers/md/dm-ebs-target.c                         |   3 +-
 drivers/md/dm-integrity.c                          |   5 +-
 drivers/md/dm-ioctl.c                              |  14 +-
 drivers/md/dm-snap.c                               |  14 +
 drivers/md/dm-table.c                              |   2 +-
 drivers/md/md.c                                    |  28 +-
 drivers/md/md.h                                    |   2 -
 drivers/md/raid0.c                                 |  16 +-
 drivers/md/raid5.c                                 |  41 +-
 drivers/media/pci/saa7164/saa7164-core.c           |   6 +
 drivers/memstick/core/memstick.c                   |   8 +-
 drivers/memstick/host/rtsx_usb_ms.c                |  31 +-
 drivers/mmc/host/cavium-octeon.c                   |   5 +-
 drivers/mmc/host/cavium-thunderx.c                 |   5 +-
 drivers/mmc/host/mtk-sd.c                          |   1 +
 drivers/mmc/host/sdhci-sprd.c                      |   4 +
 drivers/mmc/host/via-sdmmc.c                       |   4 +
 drivers/mtd/devices/block2mtd.c                    |   2 +-
 drivers/mtd/maps/vmu-flash.c                       |   2 +-
 drivers/mtd/mtdcore.c                              | 134 +--
 drivers/mtd/mtdcore.h                              |   1 +
 drivers/mtd/mtdpart.c                              |  14 +-
 drivers/mtd/nand/raw/cadence-nand-controller.c     |   6 +-
 drivers/mtd/nand/raw/vf610_nfc.c                   |  85 +-
 drivers/mtd/nand/spi/core.c                        |  34 +-
 drivers/net/bonding/bond_main.c                    |  27 +-
 drivers/net/can/dev/skb.c                          |   2 +
 drivers/net/can/slcan.c                            |   1 +
 drivers/net/ethernet/amazon/ena/ena_com.c          |  25 +-
 drivers/net/ethernet/amazon/ena/ena_com.h          |  14 -
 drivers/net/ethernet/amazon/ena/ena_netdev.c       |   1 +
 drivers/net/ethernet/broadcom/bcmsysport.c         |   4 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |  23 +-
 drivers/net/ethernet/brocade/bna/bnad.c            |  16 +-
 .../chelsio/inline_crypto/ch_ktls/chcr_ktls.c      |   4 +-
 drivers/net/ethernet/ibm/ibmveth.c                 |   7 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c    |   6 +-
 drivers/net/gtp.c                                  |  18 +-
 drivers/net/team/team.c                            |  67 +-
 drivers/net/team/team_mode_loadbalance.c           |   4 +-
 drivers/net/usb/ax88179_178a.c                     |   6 +-
 drivers/net/usb/qmi_wwan.c                         |   1 +
 drivers/net/vxlan/vxlan_core.c                     |  12 +-
 drivers/net/wireguard/noise.c                      |   7 +-
 drivers/net/wireless/ath/ath11k/mac.c              |   1 +
 drivers/net/wireless/ath/wcn36xx/dxe.c             |   2 +-
 drivers/net/wireless/ath/wcn36xx/smd.c             |   4 +
 .../wireless/broadcom/brcm80211/brcmfmac/core.c    |  27 +-
 drivers/net/wireless/intel/iwlegacy/3945-mac.c     |   1 +
 drivers/net/wireless/intersil/p54/fwio.c           |  42 +-
 drivers/net/wireless/marvell/libertas/tx.c         |   7 -
 .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  |  19 +-
 drivers/net/wireless/st/cw1200/bh.c                |   8 +-
 drivers/net/wireless/st/cw1200/txrx.c              |  14 +
 drivers/net/wireless/ti/wl12xx/main.c              |   9 +-
 drivers/net/wireless/ti/wl18xx/main.c              |   2 +-
 drivers/net/wireless/ti/wlcore/main.c              |  10 +-
 drivers/net/wireless/ti/wlcore/wlcore.h            |   2 +-
 drivers/net/xen-netfront.c                         |  16 +-
 drivers/nvme/host/core.c                           |   3 +
 drivers/nvme/host/multipath.c                      |   5 +-
 drivers/nvme/host/tcp.c                            |  62 +-
 drivers/nvme/target/configfs.c                     |   9 +-
 drivers/nvme/target/core.c                         |   2 +-
 drivers/of/irq.c                                   |  14 +-
 drivers/of/overlay.c                               |  17 +-
 drivers/opp/core.c                                 |   6 +-
 drivers/pci/pci.c                                  |  15 +-
 drivers/pinctrl/sunxi/pinctrl-sunxi.c              | 197 +++--
 drivers/pinctrl/sunxi/pinctrl-sunxi.h              | 100 +--
 drivers/power/supply/ds2780_battery.c              |   2 +-
 drivers/power/supply/max17040_battery.c            |  10 +-
 drivers/power/supply/rt9455_charger.c              |  26 +-
 drivers/regulator/ltc3676.c                        |  15 +-
 drivers/rtc/rtc-spear.c                            |  11 +-
 drivers/s390/net/ctcm_mpc.c                        |   3 +-
 drivers/scsi/ch.c                                  |  30 +-
 drivers/scsi/libiscsi.c                            |  14 +-
 drivers/scsi/qedi/qedi_main.c                      |   3 +-
 drivers/scsi/qla2xxx/qla_bsg.c                     |  47 +-
 drivers/scsi/qla2xxx/qla_init.c                    |  17 +
 drivers/scsi/qla2xxx/qla_iocb.c                    |   4 +-
 drivers/scsi/qla2xxx/qla_isr.c                     |  27 +-
 drivers/scsi/qla2xxx/qla_mbx.c                     |   4 +-
 drivers/scsi/qla2xxx/qla_mid.c                     |  33 +-
 drivers/scsi/qla2xxx/qla_nvme.c                    |  10 +-
 drivers/scsi/qla2xxx/qla_os.c                      |  13 +
 drivers/scsi/sd_zbc.c                              |  11 +-
 drivers/scsi/st.c                                  |  18 +-
 drivers/soc/rockchip/pm_domains.c                  |  20 +-
 drivers/spi/spi-bcm63xx.c                          |   6 +-
 drivers/staging/greybus/uart.c                     |  10 +-
 drivers/staging/media/rkvdec/rkvdec.c              |   4 +-
 drivers/staging/media/zoran/zoran_card.c           |   2 +-
 drivers/staging/octeon-usb/octeon-hcd.c            |   2 +-
 drivers/staging/rtl8723bs/core/rtw_mlme.c          |   5 +-
 drivers/staging/sm750fb/sm750.c                    |   2 +-
 drivers/staging/sm750fb/sm750.h                    |   2 +-
 drivers/staging/sm750fb/sm750_accel.c              |   6 +-
 drivers/staging/sm750fb/sm750_accel.h              |   4 +-
 drivers/target/iscsi/iscsi_target_configfs.c       |  26 +-
 drivers/tee/optee/core.c                           |  26 +-
 drivers/thunderbolt/ctl.c                          |  47 +-
 drivers/thunderbolt/xdomain.c                      |   4 +
 drivers/tty/amiserial.c                            |   9 +-
 drivers/tty/serial/8250/8250_bcm7271.c             |   2 +-
 drivers/tty/serial/imx.c                           |  25 +-
 drivers/tty/serial/kgdboc.c                        |   9 +
 drivers/tty/serial/max3100.c                       |  14 +-
 drivers/tty/serial/qcom_geni_serial.c              |   5 +-
 drivers/tty/serial/serial-tegra.c                  |  18 +-
 drivers/tty/serial/serial_core.c                   |  11 +-
 drivers/tty/serial/vt8500_serial.c                 |   1 +
 drivers/tty/tty_io.c                               | 919 ++++++++++-----------
 drivers/tty/tty_port.c                             |  43 +-
 drivers/tty/vcc.c                                  |   5 +-
 drivers/tty/vt/vc_screen.c                         |  25 +-
 drivers/tty/vt/vt.c                                |   5 +-
 drivers/usb/cdns3/cdns3-gadget.c                   |   4 +
 drivers/usb/cdns3/cdns3-pci-wrap.c                 |   5 +
 drivers/usb/class/cdc-acm.c                        |  45 +-
 drivers/usb/class/cdc-acm.h                        |   1 -
 drivers/usb/core/hub.c                             |   7 +-
 drivers/usb/core/message.c                         |   8 +-
 drivers/usb/dwc2/hcd.c                             |   3 +-
 drivers/usb/dwc3/core.h                            |  19 +
 drivers/usb/dwc3/ep0.c                             |   9 +
 drivers/usb/dwc3/gadget.c                          | 104 ++-
 drivers/usb/gadget/function/f_fs.c                 |  15 +-
 drivers/usb/gadget/function/f_mass_storage.c       |   3 +
 drivers/usb/gadget/function/f_uac1_legacy.c        |   6 +
 drivers/usb/gadget/udc/aspeed-vhub/core.c          |   4 +
 drivers/usb/gadget/udc/aspeed-vhub/dev.c           |   2 +-
 drivers/usb/gadget/udc/aspeed-vhub/hub.c           |   5 +-
 drivers/usb/gadget/udc/aspeed-vhub/vhub.h          |   1 +
 drivers/usb/gadget/udc/at91_udc.c                  |  33 +-
 drivers/usb/gadget/udc/dummy_hcd.c                 |   4 +
 drivers/usb/host/ohci-da8xx.c                      |   2 +
 drivers/usb/host/ohci-s3c2410.c                    |   1 +
 drivers/usb/host/ohci-spear.c                      |   4 +-
 drivers/usb/host/ohci-st.c                         |   1 +
 drivers/usb/host/xhci.c                            |  12 +-
 drivers/usb/serial/bus.c                           |   6 +-
 drivers/usb/serial/cp210x.c                        |   1 +
 drivers/usb/serial/generic.c                       |  10 +-
 drivers/usb/serial/option.c                        |  14 +
 drivers/usb/serial/quatech2.c                      |  19 +-
 drivers/usb/serial/ssu100.c                        |  18 +-
 drivers/usb/serial/usb-serial.c                    | 168 ++--
 drivers/usb/storage/realtek_cr.c                   |   9 +-
 drivers/usb/storage/sierra_ms.c                    |   7 +
 drivers/usb/typec/tcpm/tcpm.c                      |  41 +-
 drivers/usb/typec/tipd/core.c                      |   3 +-
 drivers/usb/typec/ucsi/displayport.c               |   9 +-
 drivers/usb/typec/ucsi/ucsi.c                      |  17 +-
 drivers/usb/typec/ucsi/ucsi_acpi.c                 |  18 +
 drivers/virt/nitro_enclaves/ne_misc_dev.c          |   1 +
 drivers/watchdog/cpu5wdt.c                         |   2 +-
 drivers/watchdog/rtd119x_wdt.c                     |  21 +-
 fs/autofs/waitq.c                                  |  25 +-
 fs/btrfs/dev-replace.c                             |   1 +
 fs/btrfs/scrub.c                                   |   4 +-
 fs/ceph/export.c                                   |  23 +-
 fs/cifs/cifsacl.c                                  |  27 +-
 fs/cifs/cifsfs.c                                   |  16 +-
 fs/cifs/cifsglob.h                                 |   6 +-
 fs/cifs/connect.c                                  |   1 +
 fs/cifs/dir.c                                      |  37 +-
 fs/cifs/file.c                                     |  22 +-
 fs/cifs/inode.c                                    |  29 +-
 fs/cifs/link.c                                     |  15 +-
 fs/cifs/misc.c                                     |   7 +-
 fs/cifs/smb1ops.c                                  |  21 +-
 fs/cifs/smb2misc.c                                 |   9 +-
 fs/cifs/smb2ops.c                                  | 102 ++-
 fs/cifs/smb2pdu.c                                  |  85 +-
 fs/cifs/smb2pdu.h                                  |   6 +-
 fs/cifs/transport.c                                |  62 +-
 fs/dcache.c                                        |   4 +-
 fs/dlm/lock.c                                      |   2 +
 fs/f2fs/debug.c                                    |   4 -
 fs/f2fs/dir.c                                      |   1 +
 fs/f2fs/f2fs.h                                     |  22 +-
 fs/f2fs/gc.c                                       |  33 +-
 fs/f2fs/gc.h                                       |  20 -
 fs/f2fs/recovery.c                                 |  33 +-
 fs/f2fs/segment.c                                  |   9 +-
 fs/f2fs/super.c                                    |   4 +-
 fs/f2fs/sysfs.c                                    |   8 +-
 fs/fcntl.c                                         |   3 +
 fs/fsopen.c                                        |   3 +
 fs/inode.c                                         |  23 +-
 fs/ksmbd/smb2pdu.c                                 |   7 +-
 fs/lockd/svcsubs.c                                 |   2 +-
 fs/namespace.c                                     | 123 ++-
 fs/nfsd/netns.h                                    |   1 +
 fs/nfsd/nfs2acl.c                                  |  21 +-
 fs/nfsd/nfs4proc.c                                 |  25 +-
 fs/nfsd/nfs4state.c                                |   3 +-
 fs/nfsd/trace.h                                    |   4 +-
 fs/nfsd/vfs.c                                      |   4 +-
 fs/notify/mark.c                                   |  11 +
 fs/ocfs2/dir.c                                     |  71 +-
 fs/ocfs2/dlm/dlmcommon.h                           |   2 +
 fs/ocfs2/dlm/dlmdebug.c                            |   5 +-
 fs/ocfs2/dlm/dlmrecovery.c                         |   2 +-
 fs/pipe.c                                          |   6 +-
 fs/unicode/utf8-core.c                             |   9 +-
 fs/verity/Kconfig                                  |   3 +
 fs/xfs/libxfs/xfs_alloc.c                          |  45 +-
 fs/xfs/libxfs/xfs_ialloc.c                         |  32 +-
 fs/xfs/libxfs/xfs_sb.c                             |  17 +-
 fs/xfs/xfs_bmap_item.c                             |   2 +-
 fs/xfs/xfs_buf_item.c                              | 382 ++++++---
 fs/xfs/xfs_buf_item.h                              |   3 +-
 fs/xfs/xfs_extfree_item.c                          |   2 +-
 fs/xfs/xfs_icache.c                                |  10 +-
 fs/xfs/xfs_inode.c                                 |   4 +-
 fs/xfs/xfs_inode_item.c                            | 164 +++-
 fs/xfs/xfs_inode_item.h                            |   1 +
 fs/xfs/xfs_log.c                                   |   2 +-
 fs/xfs/xfs_log_cil.c                               |   2 +-
 fs/xfs/xfs_refcount_item.c                         |   2 +-
 fs/xfs/xfs_rmap_item.c                             |   2 +-
 fs/xfs/xfs_trace.h                                 |   4 +-
 fs/xfs/xfs_trans.c                                 |   2 +-
 fs/xfs/xfs_trans.h                                 |   3 +-
 include/linux/can/skb.h                            |   3 +
 include/linux/cgroup-defs.h                        |   5 +-
 include/linux/device-mapper.h                      |   5 +
 include/linux/dmaengine.h                          |   7 +
 include/linux/fsnotify_backend.h                   |   1 +
 include/linux/ftrace.h                             |   5 +-
 include/linux/futex.h                              |  14 +-
 include/linux/hid.h                                |   6 +-
 include/linux/i2c.h                                |   1 +
 include/linux/if_team.h                            |   3 +-
 include/linux/if_vlan.h                            |   3 +
 include/linux/key-type.h                           |   1 +
 include/linux/key.h                                |   5 +
 include/linux/kprobes.h                            |   1 +
 include/linux/lockd/lockd.h                        |   2 +-
 include/linux/mm.h                                 |   2 +-
 include/linux/mm_types.h                           |   4 +
 include/linux/mount.h                              |   2 +-
 include/linux/mtd/mtd.h                            |   2 +-
 include/linux/netlink.h                            |   3 +-
 include/linux/nvme.h                               |   4 +-
 include/linux/property.h                           |   3 +
 include/linux/qcom-geni-se.h                       |  15 +-
 include/linux/sched/signal.h                       |   5 +-
 include/linux/skbuff.h                             |  12 +-
 include/linux/tty.h                                |  81 +-
 include/linux/tty_driver.h                         |   5 +
 include/linux/tty_port.h                           |   1 +
 include/linux/unicode.h                            |   1 +
 include/linux/usb/serial.h                         |   1 +
 include/net/af_vsock.h                             |   3 +
 include/net/bluetooth/hci_core.h                   |   4 +-
 include/net/bluetooth/rfcomm.h                     |   1 +
 include/net/codel_impl.h                           |   1 +
 include/net/mctpdevice.h                           |   5 +
 include/net/netfilter/nf_tables.h                  |  18 +-
 include/net/netns/xfrm.h                           |   1 +
 include/net/strparser.h                            |  10 +-
 include/net/tcp.h                                  |   4 +
 include/uapi/linux/sched.h                         |   5 +-
 io_uring/io-wq.c                                   |   2 +
 io_uring/io_uring.c                                |   9 +-
 kernel/audit_tree.c                                |  36 +-
 kernel/bpf/arraymap.c                              |  18 +-
 kernel/cgroup/cgroup.c                             |   6 +-
 kernel/events/core.c                               |  18 +-
 kernel/fork.c                                      |  20 +-
 kernel/futex/core.c                                |  49 +-
 kernel/kprobes.c                                   |  27 +-
 kernel/params.c                                    |  61 +-
 kernel/ptrace.c                                    |   3 +-
 kernel/signal.c                                    |   8 +
 kernel/time/clockevents.c                          |  35 +-
 kernel/time/tick-broadcast.c                       |  37 +-
 kernel/time/tick-internal.h                        |   2 +
 kernel/trace/ftrace.c                              |  72 +-
 kernel/trace/ring_buffer.c                         |   6 +-
 kernel/trace/trace.h                               |   4 +-
 kernel/trace/trace_events_filter.c                 |   6 +
 kernel/trace/trace_events_hist.c                   |  50 +-
 kernel/trace/trace_functions.c                     |   2 +-
 kernel/trace/trace_stack.c                         |   2 +-
 kernel/watch_queue.c                               |  11 +-
 kernel/workqueue.c                                 |   2 +-
 mm/huge_memory.c                                   |   3 +
 mm/hugetlb.c                                       |  22 +-
 mm/mmap.c                                          |  31 +-
 mm/mremap.c                                        |  38 +-
 mm/rmap.c                                          |   6 +-
 mm/vmalloc.c                                       |  51 +-
 net/bluetooth/hci_core.c                           |  12 +-
 net/bluetooth/hci_debugfs.c                        |   2 +-
 net/bluetooth/hci_sock.c                           |   2 +
 net/bluetooth/l2cap_core.c                         |   7 +-
 net/bluetooth/l2cap_sock.c                         |  59 +-
 net/bluetooth/mgmt.c                               |   9 +-
 net/bluetooth/rfcomm/core.c                        | 134 ++-
 net/bluetooth/rfcomm/sock.c                        |   5 +-
 net/bluetooth/rfcomm/tty.c                         |  16 +-
 net/bridge/br_cfm.c                                |  11 +-
 net/bridge/br_device.c                             |   1 -
 net/bridge/br_input.c                              |  35 +-
 net/bridge/br_mrp.c                                |  13 +-
 net/bridge/br_multicast.c                          |  45 +-
 net/bridge/br_private.h                            |  26 +-
 net/can/af_can.c                                   |   6 +-
 net/can/bcm.c                                      |   2 +
 net/can/isotp.c                                    |  11 +-
 net/can/j1939/socket.c                             |   1 +
 net/can/j1939/transport.c                          |   2 +
 net/can/raw.c                                      |   7 +-
 net/core/flow_dissector.c                          |  26 +-
 net/core/page_pool.c                               |   3 +-
 net/hsr/hsr_framereg.c                             |   4 +-
 net/ipv4/fib_semantics.c                           |   5 +-
 net/ipv4/fib_trie.c                                |   2 -
 net/ipv4/ipconfig.c                                |  90 +-
 net/ipv4/ipmr.c                                    |   3 +-
 net/ipv4/ipmr_base.c                               |   2 +-
 net/ipv4/route.c                                   |   2 +
 net/ipv4/tcp.c                                     |   4 +-
 net/ipv4/tcp_dctcp.c                               |   2 +-
 net/ipv4/tcp_input.c                               |   6 +
 net/ipv4/udp.c                                     |   9 +
 net/ipv6/ip6_gre.c                                 |   5 -
 net/ipv6/ip6_output.c                              |  35 +-
 net/ipv6/ip6mr.c                                   |   2 +-
 net/ipv6/route.c                                   |   2 -
 net/ipv6/seg6_iptunnel.c                           |   2 +-
 net/iucv/af_iucv.c                                 |  42 +-
 net/mac80211/agg-rx.c                              |   2 +-
 net/mac80211/chan.c                                |  36 +-
 net/mac80211/fils_aead.c                           |   8 +
 net/mac80211/mesh_pathtbl.c                        |  16 +-
 net/mac80211/mlme.c                                |   5 +-
 net/mac80211/rc80211_minstrel_ht.c                 |  30 +-
 net/mac80211/sta_info.c                            |   6 +-
 net/mac80211/tx.c                                  |   6 +
 net/mctp/device.c                                  |  29 +-
 net/mctp/neigh.c                                   |   4 +-
 net/mctp/route.c                                   |   4 +-
 net/netfilter/ipset/ip_set_bitmap_gen.h            |   2 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |   3 +
 net/netfilter/ipvs/ip_vs_lblc.c                    |   4 +
 net/netfilter/ipvs/ip_vs_lblcr.c                   |   3 +
 net/netfilter/ipvs/ip_vs_sync.c                    |  33 +-
 net/netfilter/nf_tables_api.c                      |  54 +-
 net/netfilter/nf_tables_core.c                     |  29 +-
 net/netfilter/nf_tables_trace.c                    |  44 +-
 net/netfilter/nft_flow_offload.c                   |   8 +-
 net/netfilter/nft_set_bitmap.c                     |   4 +-
 net/netfilter/nft_set_hash.c                       |   8 +-
 net/netfilter/nft_set_pipapo.c                     |  10 +-
 net/netfilter/nft_set_rbtree.c                     |  10 +-
 net/netlink/af_netlink.c                           |  24 +-
 net/netlink/genetlink.c                            |  28 +-
 net/openvswitch/actions.c                          |   7 +-
 net/openvswitch/conntrack.c                        |  23 +-
 net/openvswitch/datapath.c                         |   8 +
 net/openvswitch/vport-netdev.c                     |   8 +-
 net/packet/af_packet.c                             |   6 +-
 net/rds/rdma_transport.c                           |  38 +-
 net/rds/tcp.c                                      |   9 +-
 net/sched/act_api.c                                |  20 +-
 net/sched/cls_api.c                                |  15 +-
 net/sched/cls_flower.c                             |   5 +
 net/sched/cls_u32.c                                |  41 +-
 net/sched/em_text.c                                |   3 +
 net/sched/sch_codel.c                              |   2 +-
 net/sched/sch_fq_codel.c                           |   4 +-
 net/sctp/inqueue.c                                 |   6 +-
 net/sctp/socket.c                                  |  39 +-
 net/smc/af_smc.c                                   |   7 +-
 net/strparser/strparser.c                          |   6 +-
 net/sunrpc/auth_gss/gss_rpc_xdr.c                  |  15 +-
 net/tipc/crypto.c                                  |  20 +-
 net/tipc/node.c                                    |  12 +-
 net/tipc/topsrv.c                                  |  80 +-
 net/tls/tls_device.c                               |   7 +-
 net/vmw_vsock/af_vsock.c                           |  49 +-
 net/vmw_vsock/virtio_transport_common.c            |   3 +-
 net/wireless/lib80211_crypt_tkip.c                 |  13 +-
 net/wireless/scan.c                                |  29 +-
 net/xfrm/xfrm_policy.c                             |  19 +-
 samples/pidfd/Makefile                             |   2 +-
 security/apparmor/include/label.h                  |   6 +-
 security/keys/key.c                                |  19 +-
 security/keys/keyctl.c                             |  15 +-
 security/keys/keyring.c                            | 151 ++--
 security/keys/persistent.c                         |  55 +-
 security/keys/process_keys.c                       |   5 +-
 security/keys/trusted-keys/trusted_tpm1.c          |   6 +-
 security/keys/trusted-keys/trusted_tpm2.c          |   2 +-
 security/selinux/avc.c                             |   5 +-
 security/selinux/hooks.c                           |   9 +-
 sound/core/seq/seq_compat.c                        |   2 +
 sound/soc/codecs/adau1372.c                        |  18 +-
 sound/soc/codecs/cs42l52.c                         |   2 +-
 sound/soc/codecs/cs42l56.c                         |   2 +-
 sound/soc/codecs/max98371.c                        |   2 +-
 sound/soc/codecs/nau8822.c                         |   4 +-
 sound/soc/codecs/pcm3168a.c                        |   2 +-
 sound/soc/codecs/rt274.c                           |   4 +-
 sound/soc/codecs/wm8903.c                          |   2 +-
 sound/soc/codecs/wm8978.c                          |   4 +-
 sound/soc/qcom/lpass-cpu.c                         |   4 +-
 sound/soc/samsung/i2s.c                            |   8 +
 sound/soc/stm/stm32_spdifrx.c                      |   2 +-
 sound/usb/caiaq/device.c                           |   3 +
 sound/usb/card.h                                   |   3 +-
 sound/usb/endpoint.c                               |  16 +-
 sound/usb/line6/playback.c                         |   7 +
 sound/usb/misc/ua101.c                             |   9 +
 sound/usb/quirks.c                                 |   4 +-
 sound/virtio/virtio_card.c                         |   4 +-
 tools/gpio/Makefile                                |   6 +
 tools/perf/tests/bpf.c                             |   3 +-
 tools/perf/util/parse-events.c                     |   2 +-
 .../test.d/filter/event-filter-incomplete.tc       |  24 +
 527 files changed, 6088 insertions(+), 3172 deletions(-)