Linux 7.1-rc3

[Linus Torvalds]

It's Sunday afternoon, and we all know what that means: Mother's Day.

But also your regularly scheduled kernel release candidate.

And I think this answers the "is 7.1 continuing the larger size
pattern that we saw with 7.0?" question, and the answer is yes: that
wasn't a fluke brought on by a .0 release - it simply seems to be the
new normal.

This time around, about a third of the patch is networking - both on
the driver side and in core. And related selftests.

The rest is pretty spread out, with other drivers (sound and gpu being
the bigger ones, but there's a little bit of everything in there),
architecture updates (powerpc and x86, but also some loongarch and
parisc), and various other fixes (smb updates, various core kernel
updates, Rust infrastructure, selinux, documentation etc).

The shortlog below isn't exactly _short_, but not so long that you
can't scroll through it to get some kind of idea of the details.

               Linus

---

Aaradhana Sahu (1):
      wifi: ath12k: fix OF node refcount imbalance in WSI graph traversal

Aaro Koskinen (1):
      USB: omap_udc: DMA: Don't enable burst 4 mode

Aksh Garg (1):
      MAINTAINERS: Add Aksh Garg as PCIe CADENCE reviewer

Aleksander Jan Bajkowski (1):
      net: usb: r8152: add TRENDnet TUC-ET2G v2.0

Alex Cheema (1):
      net: usb: cdc_ncm: add Apple Mac USB-C direct networking quirk

Alex Deucher (3):
      drm/amdgpu/pm: add missing revision check for CI
      drm/amdgpu/pm: align Hawaii mclk workaround with radeon
      drm/radeon: add missing revision check for CI

Alok Tiwari (1):
      accel/qaic: fix incorrect counter check in RAS message decode

Alyssa Ross (1):
      ipv6: default IPV6_SIT to m

Amery Hung (1):
      bpf: Fix sk_local_storage diag dumping uninitialized special fields

Amir Mohammad Jahangirzad (1):
      wifi: libertas: fix integer underflow in process_cmdrequest()

Amit Sunil Dhamne (1):
      usb: typec: tcpm: reset internal port states on soft reset AMS

Andreas Haarmann-Thiemann (1):
      net: ethernet: cortina: Drop half-assembled SKB

Anton Swart (1):
      ALSA: usb-audio: Add quirk flags for AlphaTheta EUPHONIA

Ard Biesheuvel (2):
      efi/libstub: Move efi_relocate_kernel() into its only remaining user
      x86/efi: Restore IRQ state in EFI page fault handler

Arnd Bergmann (4):
      media: venus: fix QCOM_MDT_LOADER dependency
      media: iris: fix QCOM_MDT_LOADER dependency
      media: qcom: camss: avoid format string warning
      drm/panel: hx83121a: select DRM_DISPLAY_DSC_HELPER

Athira Rajeev (4):
      powerpc/pseries/htmdump: Free the global buffers in htmdump module exit
      powerpc/pseries/htmdump: Fix the offset value used in processor
configuration dump
      powerpc/pseries/htmdump: Fix the offset value used in htm status dump
      powerpc/pseries/htmdump: Add memory configuration dump support
to htmdump module

Aurelien DESBRIERES (1):
      Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv
is uninitialized

Baochen Qiang (2):
      wifi: ath12k: prepare REO update element only for primary link
      wifi: ath12k: fix peer_id usage in normal RX path

Bart Van Assche (1):
      wifi: cw1200: Revert "Fix locking in error paths"

Benjamin Berg (1):
      wifi: mac80211: use safe list iteration in radar detect work

Bibo Mao (3):
      LoongArch: KVM: Move AVEC interrupt injection into switch loop
      LoongArch: KVM: Fix HW timer interrupt lost when inject
interrupt by software
      LoongArch: KVM: Move unconditional delay into timer clear scenery

Bjoern Doebel (1):
      smb: client: use kzalloc to zero-initialize security descriptor buffer

Bob Song (1):
      ASoC: amd: yc: Add DMI quirk for MSI Bravo 15 C7VE

Bobby Eshleman (1):
      eth: fbnic: fix double-free of PCS on phylink creation failure

Breno Leitao (3):
      workqueue: fix devm_alloc_workqueue() va_list misuse
      netpoll: pass buffer size to egress_dev() to avoid MAC truncation
      arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's

Brian Bunker (1):
      scsi: scsi_dh_alua: Increase default ALUA timeout to maximum spec value

Brian Masney (1):
      MAINTAINERS: add myself as a reviewer for the clk subsystem

Carlos Bilbao (1):
      scsi: target: iscsi: reject invalid size Extended CDB AHS

Catherine (1):
      wifi: mac80211: drop stray 'static' from fast-RX rx_result

Chen Ni (2):
      fbdev: defio: Remove duplicate include of linux/module.h
      drm/panel: himax-hx83121a: Fix incorrect error check for
devm_drm_panel_alloc()

Christian König (1):
      drm/amdgpu: nuke amdgpu_userq_fence_slab v2

Christian Van (1):
      drm/panel: feiyang-fy07024di26a30d: return display-on error

Christoph Hellwig (1):
      scsi: sg: Don't use GFP_ATOMIC in sg_start_req()

Christophe Leroy (CS GROUP) (1):
      powerpc/8xx: Fix interrupt mask in cpm1_gpiochip_add16()

Colin Walters (1):
      ovl: fix verity lazy-load guard broken by fsverity_active()
semantic change

Conor Dooley (3):
      spi: microchip-core-qspi: control built-in cs manually
      spi: microchip-core-qspi: don't attempt to transmit during
emulated read-only dual/quad operations
      spi: microchip-core-qspi: remove some inline markings

Corey Minyard (4):
      ipmi: Check event message buffer response for bad data
      ipmi: Add limits to event and receive message requests
      ipmi:si: Return state to normal if message allocation fails
      ipmi:ssif: NULL thread on error

Cosmin Ratiu (6):
      tools/selftests: Use a sensible timeout value for iperf3 client
      tools/selftests: Add a VXLAN+IPsec traffic test
      xfrm: Don't clobber inner headers when already set
      net/mlx5e: psp: Fix invalid access on PSP dev registration fail
      net/mlx5e: psp: Expose only a fully initialized priv->psp
      net/mlx5e: psp: Hook PSP dev reg/unreg to profile enable/disable

Cássio Gabriel (6):
      ALSA: pcmtest: Return -EFAULT on pattern read copy failure
      ASoC: fsl_xcvr: Fix event generation for cached controls
      ALSA: firewire-tascam: Do not drop unread control events
      ALSA: usb-audio: midi2: Restart output URBs on resume
      ALSA: seq: Fix UMP group 16 filtering
      ALSA: core: Serialize deferred fasync state checks

D. Wythe (1):
      net/smc: fix missing sk_err when TCP handshake fails

DaeMyung Kang (3):
      ksmbd: centralize ksmbd_conn final release to plug transport leak
      ksmbd: harden file lifetime during session teardown
      ksmbd: close durable scavenger races against m_fp_list lookups

Daniel Borkmann (1):
      ipv6: Implement limits on extension header parsing

Daniel Golle (1):
      net: dsa: mt7530: fix .get_stats64 sleeping in atomic context

Daniel Machon (2):
      net: sparx5: fix wrong chip ids for TSN SKUs
      net: sparx5: configure serdes for 1000BASE-X in sparx5_port_init()

Daniel Zahka (3):
      netdevsim: psp: only call nsim_psp_uninit() on PFs
      netdevsim: psp: serialize calls to nsim_psp_uninit()
      netdevsim: psp: rcu protect psp_dev reference

Danilo Krummrich (1):
      MAINTAINERS: nova: update mailing list

Dapeng Mi (4):
      perf/x86/intel: Improve validation and configuration of ACR masks
      perf/x86/intel: Always reprogram ACR events to prevent stale masks
      perf/x86/intel: Disable PMI for self-reloaded ACR events
      perf/x86/intel: Enable auto counter reload for DMR

David Carlier (3):
      sched_ext: idle: Recheck prev_cpu after narrowing allowed mask
      psp: strip variable-length PSP header in psp_dev_rcv()
      Bluetooth: hci_conn: fix potential UAF in create_big_sync

David Gow (2):
      rust: arch: um: Fix building 32-bit UML with GCC
      x86/boot/e820: Re-enable BIOS fallback if e820 table is empty

Derek Fang (1):
      ASoC: sdw_utils: avoid the SDCA companion function not supported failure

Dikshita Agarwal (1):
      media: iris: Fix use-after-free in iris_release_internal_buffers()

Dipayaan Roy (4):
      net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
      net: mana: Skip WQ object destruction for uninitialized RXQ
      net: mana: remove double CQ cleanup in mana_create_rxq error path
      net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR

Dmitry Baryshkov (2):
      wifi: ath10k: snoc: select POWER_SEQUENCING
      media: qcom: iris: increase H265D_MAX_SLICE to fix H.265
decoding on SC7280

Dudu Lu (2):
      Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()
extension handling
      Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req

Edward Srouji (2):
      RDMA/mlx5: Fix UAF in SRQ destroy due to race with create
      RDMA/mlx5: Fix UAF in DCT destroy due to race with create

Eliot Courtney (2):
      rust: drm: gem: clean up GEM state in init failure case
      rust: drm: fix unsound initialization in drm::Device::new

Eric Dumazet (12):
      ipmr: prevent info-leak in pmr_cache_report()
      ipv4: igmp: annotate data-races in igmp_heard_query()
      net/sched: sch_pie: annotate more data-races in pie_dump_stats()
      net/sched: sch_cake: annotate data-races in cake_dump_class_stats (I)
      net/sched: sch_cake: annotate data-races in cake_dump_class_stats (II)
      vsock/virtio: fix potential unbounded skb queue
      net: prevent possible UAF in rtnl_prop_list_size()
      net/sched: sch_fq_codel: annotate data-races from
fq_codel_dump_class_stats()
      ipv6: fix potential UAF caused by ip6_forward_proxy_check()
      inetpeer: add a missing read_seqretry() in inet_getpeer()
      net/sched: sch_sfq: annotate data-races from sfq_dump_class_stats()
      tcp: tcp_child_process() related UAF

Fabio Porcedda (1):
      USB: serial: option: add Telit Cinterion LE910Cx compositions

Felix Gu (1):
      usb: ulpi: fix memory leak on ulpi_register() error paths

Felix Kuehling (1):
      drm/amdkfd: Make all TLB-flushes heavy-weight

Fenglin Wu (1):
      regulator: qcom-rpmh: Fix index for pmh0101 ldo16

Fernando Antunez Antonio (1):
      ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx

Fernando Fernandez Mancera (3):
      netfilter: nf_socket: skip socket lookup for non-first fragments
      netfilter: nf_tables: skip L4 header parsing for non-first fragments
      netfilter: xtables: fix L4 header parsing for non-first fragments

Florian Westphal (2):
      netfilter: xt_CT: fix usersize for v1 and v2 revision
      netfilter: nf_tables: fix netdev hook allocation memleak with
dormant tables

Francesco Lavra (1):
      drm/fb-helper: Fix clipping when damage area spans a single scanline

Francis, David (1):
      drm: Set old handle to NULL before prime swap in change_handle

Frederic Weisbecker (1):
      timers/migration: Fix another hotplug activation race

Gary Guo (2):
      rust: pin-init: internal: move alignment check to `make_field_check`
      rust: pin-init: fix incorrect accessor reference lifetime

Greg Kroah-Hartman (3):
      scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
      usb: usblp: fix heap leak in IEEE 1284 device ID via short response
      usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl

Gregory Fuchedgi (1):
      amd-xgbe: fix PTP addend overflow causing frozen clock

Gui-Dong Han (1):
      hwmon: (lm63) Add locking to avoid TOCTOU

Gustavo Sousa (1):
      drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()

Hans Zhang (1):
      MAINTAINERS: Update Hans Zhang email for PCIe CIX Sky1

Helge Deller (3):
      Revert "parisc: led: fix reference leak on failed device registration"
      parisc: Fix build failure for 32-bit kernel with PA2.0 instruction set
      parisc: Fix 64-bit kernel build when CONFIG_COMPAT=n

Holger Brunck (2):
      net: wan: fsl_ucc_hdlc: fix uhdlc_memclean
      net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove

Hongling Zeng (1):
      parisc: Fix IRQ leak in LASI driver

Huacai Chen (4):
      LoongArch: Make CONFIG_64BIT as the default option
      LoongArch: Specify -m32/-m64 explicitly for 32BIT/64BIT
      LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT
      LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup

Hugo Villeneuve (1):
      scsi: pmcraid: Fix typo in comments

Hyunwoo Kim (1):
      rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

Icenowy Zheng (2):
      drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
      drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds

Ilya Maximets (3):
      openvswitch: vport: fix race between tunnel creation and linking
      openvswitch: vport: fix self-deadlock on release of tunnel ports
      selftests: openvswitch: add tests for tunnel vport refcounting

Ivan Hu (1):
      x86/efi: Fix graceful fault handling after FPU softirq changes

Jakov Novak (1):
      wifi: libertas: notify firmware load wait on disconnect

Jakub Kicinski (3):
      net: tls: fix silent data drop under pipe back-pressure
      selftests: tls: add test for data loss on small pipe
      selftests: drv-net: fix sort order of makefile and config

Jamal Hadi Salim (1):
      net/sched: sch_red: Replace direct dequeue call with peek and
qdisc_dequeue_peeked

James Calligeros (2):
      ASoC: tas2764: Deal with bogus initial temperature register value
      ASoC: tas2770: Deal with bogus initial temperature value

Jann Horn (1):
      Bluetooth: hci_event: fix memset typo

Janne Grunau (1):
      dt-bindings: i2c: apple,i2c: Add t8122 compatible

Jason Gunthorpe (15):
      RDMA/ionic: Fix typo in format string
      RDMA/mlx5: Restore zero-init to mlx5_ib_modify_qp() ucmd
      RDMA/mlx5: Add missing store/release for lock elision pattern
      RDMA/mana: Validate rx_hash_key_len
      RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
      RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
      RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
      RDMA/ocrdma: Clarify the mm_head searching
      RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
      RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
      RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
      RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
      RDMA/hns: Fix xarray race in hns_roce_create_srq()
      RDMA/hns: Fix xarray race in hns_roce_create_qp_common()
      RDMA/hns: Fix unlocked call to hns_roce_qp_remove()

Jason Xing (8):
      xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devices
      xsk: free the skb when hitting the upper bound MAX_SKB_FRAGS
      xsk: handle NULL dereference of the skb without frags issue
      xsk: fix use-after-free of xs->skb in xsk_build_skb() free_err path
      xsk: prevent CQ desync when freeing half-built skbs in xsk_build_skb()
      xsk: avoid skb leak in XDP_TX_METADATA case
      xsk: fix xsk_addrs slab leak on multi-buffer error path
      xsk: fix u64 descriptor address truncation on 32-bit architectures

Jens Axboe (2):
      ublk: don't issue uring_cmd from fallback task work
      block: only read from sqe on initial invocation of blkdev_uring_cmd()

Jeongjun Park (1):
      wifi: rsi: fix kthread lifetime race between self-exit and external-stop

Jeremy Kerr (2):
      net: mctp: test: use a zeroed struct sockaddr_mctp
      net: mctp: test: Use dev_direct_xmit for TX to our test device

Jerome Brunet (1):
      clk: eyeq: use the auxiliary device creation helper

Jesper Dangaard Brouer (1):
      veth: fix OOB txq access in veth_poll() with asymmetric queue counts

Jiawei Liu (1):
      spi: ch341: correct company name in MODULE_DESCRIPTION

Jiawen Wu (2):
      net: libwx: fix VF illegal register access
      net: libwx: use request_irq for VF misc interrupt

Jiexun Wang (1):
      af_unix: Reject SIOCATMARK on non-stream sockets

Jiri Slaby (SUSE) (1):
      wifi: ath5k: do not access array OOB

Joey Lu (1):
      net: stmmac: dwmac-nuvoton: fix NULL pointer dereference in
nvt_set_phy_intf_sel()

Johan Hovold (3):
      parisc: drivers: switch to dynamic root device
      clk: rk808: fix OF node reference imbalance
      staging: vme_user: fix root device leak on init failure

Johannes Berg (3):
      wifi: mac80211: tests: mark HT check strict
      wifi: mac80211: remove station if connection prep fails
      wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage

John B. Moore (2):
      drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
      drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission

John Madieu (3):
      spi: imx: Fix precedence bug in spi_imx_dma_max_wml_find()
      spi: imx: Fix UAF on package-1 prepare failure in
spi_imx_dma_data_prepare()
      spi: imx: Propagate prepare_transfer() error from spi_imx_setupxfer()

Juergen Gross (1):
      x86/xen: Fix a potential problem in xen_e820_resolve_conflicts()

Juha-Pekka Heikkila (1):
      drm/i915/display: enable ccs modifiers on dg2

Julian Anastasov (6):
      ipvs: fixes for the new ip_vs_status info
      ipvs: fix races around the conn_lfactor and svc_lfactor sysctl vars
      ipvs: fix the spin_lock usage for RT build
      ipvs: do not leak dest after get from dest trash
      ipvs: fix races around est_mutex and est_cpulist
      ipvs: fix shift-out-of-bounds in ip_vs_rht_desired_size

Junrui Luo (1):
      RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

Junyoung Jang (1):
      bpf: Fix off-by-one boundary validation in arena direct-value access

Justin Chen (1):
      net: phy: broadcom: Save PHY counters during suspend

KaFai Wan (4):
      bpf: Reject TCP_NODELAY in TCP header option callbacks
      bpf: Reject TCP_NODELAY in bpf-tcp-cc
      selftests/bpf: Test TCP_NODELAY in TCP hdr opt callbacks
      selftests/bpf: Verify bpf-tcp-cc rejects TCP_NODELAY

Kai Zen (1):
      net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak
in rtnl_fill_vfinfo

Kalesh AP (1):
      bnxt_en: Check return value of bnxt_hwrm_vnic_cfg

Karol Wachowski (1):
      accel/ivpu: Disallow re-exporting imported GEM objects

Keith Busch (1):
      PCI: Don't fallback to bus reset after failed slot reset

Kory Maincent (TI) (2):
      drm/bridge: tda998x: Use __be32 for audio port OF property pointer
      drm/bridge: tda998x: Return NULL instead of 0 in tda998x_edid_read()

Krishna Chomal (1):
      platform/x86: hp-wmi: silence unknown board warning for 8D41

Krzysztof Kozlowski (2):
      powerpc/ps3: Drop redundant result assignment
      powerpc/pasemi: Drop redundant res assignment

Kuan-Ting Chen (1):
      xfrm: esp: avoid in-place decrypt on shared skb frags

Kuniyuki Iwashima (13):
      sockmap: Fix sk_psock_drop() race vs sock_map_{unhash,close,destroy}().
      selftest: net: Add test for TCP flow failover with ECMP routes.
      af_unix: Set gc_in_progress to true in unix_gc().
      ipmr: Add __rcu to netns_ipv4.mrt.
      ipv6: Fix null-ptr-deref in fib6_mtu().
      ipmr: Call ipmr_fib_lookup() under RCU.
      tcp: Fix dst leak in tcp_v6_connect().
      bpf: tcp: Fix type confusion in bpf_tcp_sock().
      selftest: bpf: Add test for bpf_tcp_sock() and RAW socket.
      bpf: tcp: Fix type confusion in bpf_skc_to_tcp_sock().
      bpf: tcp: Fix type confusion in bpf_skc_to_tcp6_sock().
      bpf: tcp: Fix type confusion in sol_tcp_sockopt().
      bpf: Free reuseport cBPF prog after RCU grace period.

Kurt Borja (1):
      platform/wmi: Fix unchecked min_size in wmidev_invoke_method()

Li RongQing (1):
      IB/hfi1: Fix potential use-after-free in PIO and SDMA map teardown

Linpu Yu (1):
      xskmap: reject TX-only AF_XDP sockets

Linus Torvalds (1):
      Linux 7.1-rc3

Lorenzo Bianconi (1):
      net: airoha: Move entries to queue head in case of DMA mapping
failure in airoha_dev_xmit()

Luiz Augusto von Dentz (1):
      Bluetooth: hci_event: Fix OOB read and infinite loop in
hci_le_create_big_complete_evt

Lukas Wunner (1):
      PCI: Update saved_config_space upon resource assignment

Maciej W. Rozycki (1):
      MAINTAINERS: Add self for the DEC LANCE network driver

Maher Sanalla (1):
      IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg()

Maoyi Xie (5):
      ip6_gre: Use cached t->net in ip6erspan_changelink().
      wifi: nl80211: require CAP_NET_ADMIN over the target netns in
SET_WIPHY_NETNS
      wifi: nl80211: re-check wiphy netns in
nl80211_prepare_wdev_dump() continuation
      io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS
      io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER

Marco Crivellari (1):
      i2c: testunit: Replace system_long_wq with system_dfl_long_wq

Marek Szyprowski (1):
      wifi: brcmfmac: Fix potential use-after-free issue when stopping
watchdog task

Marek Vasut (2):
      i2c: stm32f7: reinit_completion() per transfer not per msg
      MAINTAINERS: Update Marek Vasut email for PCIe R-Car

Mark Brown (1):
      selftests/rseq: Don't run tests with runner scripts outside of the scripts

Markus Baier (1):
      net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks

Markus Stockhausen (2):
      hwmon: (lm75) Fix AS6200 and TMP112 setup and alarm handling
      hwmon: (lm75) Fix configuration register writes.

Matthew Brost (1):
      drm/ttm: Fix GPU MM stats during pool shrinking

Matthieu Baerts (NGI0) (13):
      mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf
      mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
      mptcp: pm: ADD_ADDR rtx: allow ID 0
      mptcp: pm: ADD_ADDR rtx: fix potential data-race
      mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
      mptcp: pm: ADD_ADDR rtx: free sk if last
      mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
      mptcp: pm: ADD_ADDR rtx: skip inactive subflows
      mptcp: pm: ADD_ADDR rtx: return early if no retrans
      mptcp: pm: prio: skip closed subflows
      selftests: mptcp: check output: catch cmd errors
      selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl
      mptcp: bpf: Fix type confusion in bpf_mptcp_sock_from_subflow()

Maíra Canal (1):
      drm/etnaviv: Fix armed job not being pushed to the DRM scheduler

Michael Bommarito (9):
      xfrm: ah: account for ESN high bits in async callbacks
      wifi: nl80211: require admin perm on SET_PMK / DEL_PMK
      wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path
      RDMA/rxe: Reject unknown opcodes before ICRC processing
      RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
      Bluetooth: virtio_bt: clamp rx length before skb_put
      Bluetooth: virtio_bt: validate rx pkt_type header length
      Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem
      smb: client: validate dacloffset before building DACL pointers

Michael Chan (2):
      bnxt_en: Delay for 5 seconds after AER DPC for all chips
      bnxt_en: Set bp->max_tpa according to what the FW supports

Michael Guralnik (2):
      RDMA/core: Fix rereg_mr use-after-free race
      RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation

Michal Kosiorek (1):
      xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

Miguel Ojeda (2):
      rust: allow `clippy::collapsible_match` globally
      rust: allow `clippy::collapsible_if` globally

Mikhail Gavrilov (1):
      Bluetooth: l2cap: defer conn param update to avoid
conn->lock/hdev->lock inversion

Ming Lei (2):
      ublk: validate physical_bs_shift, io_min_shift and io_opt_shift
      ublk: fix use-after-free in ublk_cancel_cmd()

Mingyu Wang (1):
      i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl

Mostafa Saleh (1):
      iommu/pages: Fix iommu_pages_flush_incoherent() for non-x86

Mukesh Kumar Chaurasiya (IBM) (1):
      rust/drm: import ARef from sync crate

Myeonghun Pak (3):
      hwmon: (corsair-psu) Close HID device on probe errors
      drm/qxl: Fix missing KMS poll cleanup
      drm/bochs: Drop manual put on probe error path

Namjae Jeon (1):
      ksmbd: fix kernel-doc warnings from ksmbd_conn_get/put()

Nan Li (1):
      net/rds: handle zerocopy send cleanup before the message is queued

Nathan Chancellor (1):
      powerpc/vdso: Drop -DCC_USING_PATCHABLE_FUNCTION_ENTRY from
32-bit flags with clang

Nicola Lunghi (1):
      ALSA: usb-audio: add clock quirk for Motu 1248

Nicolas Escande (1):
      wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions

Niels Franke (1):
      i2c: acpi: Add ELAN0678 to i2c_acpi_force_100khz_device_ids

Nikola Z. Ivanov (1):
      i2c: Compare the return value of gpiod_get_direction against
GPIO_LINE_DIRECTION_OUT

Ninad Naik (1):
      Documentation: hwmon: fix link to ideapad-laptop.c file

Osama Abdelkader (2):
      drm/sti: remove bridge when sti_hda component_add fails
      drm/exynos: remove bridge when component_add fails

Pablo Neira Ayuso (8):
      netfilter: replace skb_try_make_writable() by skb_ensure_writable()
      netfilter: nft_fwd_netdev: add device and headroom validate with
neigh forwarding
      netfilter: x_tables: add .check_hooks to matches and targets
      netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate
      netfilter: flowtable: ensure sufficient headroom in xmit path
      netfilter: flowtable: fix inline vlan encapsulation in xmit path
      netfilter: flowtable: fix inline pppoe encapsulation in xmit path
      netfilter: flowtable: use skb_pull_rcsum() to pop vlan/pppoe header

Paolo Abeni (1):
      mptcp: fix rx timestamp corruption on fastopen

Paolo Bonzini (2):
      KVM: x86: check for nEPT/nNPT in slow flush hypercalls
      KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty

Paul Chaignon (2):
      tools/headers: Regenerate stddef.h to fix BPF selftests
      bpf: Don't run arg-tracking analysis twice on main subprog

Pauli Virtanen (3):
      ALSA: usb-audio: add min_mute quirk for Razer Nommo V2 X
      Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
      Bluetooth: SCO: hold sk properly in sco_conn_ready

Pavan Chebbi (1):
      bnxt_en: Use absolute target ns from ptp_clock_request

Pavitra Jha (1):
      net: wwan: t7xx: validate port_count against message length in
t7xx_port_enum_msg_handler

Pengpeng Hou (1):
      Bluetooth: RFCOMM: pull credit byte with skb_pull_data()

Peter Rosin (1):
      MAINTAINERS: Update mail for Peter Rosin

Peter Zijlstra (1):
      perf/core: Fix deadlock in perf_mmap() failure path

Philip Yang (1):
      drm/amdgpu: zero-initialize GART table on allocation

Piyush Sachdeva (2):
      smb: client: Use FullSessionKey for AES-256 encryption key derivation
      smb: client: Zero-pad short GSS session keys per MS-SMB2

Prasanna Kumar T S M (1):
      EDAC/versalnet: Fix device name memory leak

Qiang Ma (1):
      LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS

Qingfang Deng (1):
      ovpn: reset MAC header before passing skb up

Rajat Gupta (1):
      fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free

Ralf Lici (2):
      ovpn: ensure packet delivery happens with BH disabled
      selftests: ovpn: reduce ping count in test.sh

Rameshkumar Sundaram (1):
      wifi: ath12k: initialize RSSI dBm conversion event state

Randy Dunlap (1):
      fbdev: ipu-v3: clean up kernel-doc warnings

Ranjan Kumar (1):
      scsi: mpt3sas: Limit NVMe request size to 2 MiB

Ratheesh Kannoth (10):
      octeontx2-af: npc: cn20k: Propagate MCAM key-type errors on cn20k
      octeontx2-af: npc: cn20k: Drop debugfs_create_file() error checks in init
      octeontx2-af: npc: cn20k: Propagate errors in defrag MCAM alloc rollback
      octeontx2-af: npc: cn20k: Fix target map and rule
      octeontx2-af: npc: cn20k: Clear MCAM entries by index and key width
      octeontx2-af: npc: cn20k: Fix bank value
      octeontx2-af: npc: cn20k: Fix MCAM actions read
      octeontx2-af: npc: cn20k: Initialize default-rule index outputs up front
      octeontx2-af: npc: cn20k: Tear down default MCAM rules explicitly on free
      octeontx2-af: npc: cn20k: Reject missing default-rule MCAM indices

Richard Fitzgerald (6):
      ASoC: cs35l56: Fix hibernate write in runtime resume error path
      ASoC: cs35l56: Fix out-of-bounds in dev_err() in
cs35l56_read_onchip_spkid()
      ASoC: wm_adsp_fw_find_test: Redirect wm_adsp_release_firmware_files()
      ASoC: wm_adsp_fw_find_test: Clear searched_fw_files in find-by-index test
      ASoC: cs35l56: Don't use devres to unregister component
      ASoC: cs35l56: Destroy workqueue in probe error path

Rio Liu (1):
      wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check
in non-strict mode

Ritesh Harjani (IBM) (9):
      pseries/papr-hvpipe: Fix race with interrupt handler
      pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
      pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()
      pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init()
      pseries/papr-hvpipe: Fix the usage of copy_to_user()
      pseries/papr-hvpipe: Simplify spin unlock usage in
papr_hvpipe_handle_release()
      pseries/papr-hvpipe: Kill task_struct pointer from struct
hvpipe_source_info
      pseries/papr-hvpipe: Refactor and simplify hvpipe_rtas_recv_msg()
      pseries/papr-hvpipe: Fix style and checkpatch issues in
enable_hvpipe_IRQ()

Robert Marko (1):
      net: phy: micrel: fix LAN8814 QSGMII soft reset

Rodrigo Faria (1):
      ALSA: hda/realtek: Add mute LED fixup for HP Pavilion 15-cs1xxx

Ronald Claveau (1):
      dt-bindings: i2c: amlogic: Add compatible for T7 SOC

Rong Zhang (1):
      ALSA: usb-audio: Add quirk flags for JBL Pebbles

Rosen Penev (1):
      ALSA: sparc/dbri: add missing fallthrough

Ruijie Li (1):
      xfrm: provide message size for XFRM_MSG_MAPPING

Rámon van Raaij (1):
      ALSA: hda/realtek: Add codec SSID quirk for Lenovo Yoga Pro 9 16IMH9

Sagarika Sharma (1):
      ipv6: update route serial number on NETDEV_CHANGE

Sai Teja Aluvala (1):
      Bluetooth: btintel_pcie: treat boot stage bit 12 as warning

Samiullah Khawaja (1):
      PCI: Initialize temporary device in new_id_store()

Sanman Pradhan (2):
      hwmon: (ltc2992) Clamp threshold writes to hardware range
      hwmon: (ltc2992) Fix u32 overflow in power read path

Sarthak Sharma (1):
      selftests: kselftest: fix wrong test number in ksft_exit_skip

Sasha Levin (1):
      hwmon: Remove stale CONFIG_SENSORS_SBRMI Makefile reference

Satyanarayana K V P (1):
      drm/xe/guc: Exclude indirect ring state page from ADS engine state size

Sean Christopherson (2):
      KVM: x86: Fix misleading variable names and add more comments
for PIR=>IRR flow
      KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

Selvarasu Ganesan (1):
      usb: dwc3: Move GUID programming after PHY initialization

SeungJu Cheon (2):
      Bluetooth: ISO: Fix data-race on dst in iso_sock_connect()
      Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths

Shardul Bankar (2):
      mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
      mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure

Shay Drory (4):
      net/mlx5: SD: Serialize init/cleanup
      net/mlx5: SD, Keep multi-pf debugfs entries on primary
      net/mlx5e: SD, Fix missing cleanup on probe error
      net/mlx5e: SD, Fix race condition in secondary device probe/remove

Shitalkumar Gandhi (1):
      net: rtsn: fix mdio_node leak in rtsn_mdio_alloc()

Shivani Nittor (1):
      powerpc/perf: Update check for PERF_SAMPLE_DATA_SRC marked events

Shota Zaizen (1):
      ksmbd: validate inherited ACE SID length

Shuhao Fu (1):
      ksmbd: fail share config requests when path allocation fails

Shuicheng Lin (2):
      drm/xe/pf: Fix EAGAIN sign in pf_migration_consume()
      drm/xe/pf: Fix MMIO access using PF view instead of VF view
during migration

Shyam Prasad N (1):
      cifs: abort open_cached_dir if we don't request leases

Shyam Sunder Reddy Padira (1):
      staging: rtl8723bs: os_dep: avoid NULL pointer dereference in
rtw_cbuf_alloc

Siwei Zhang (3):
      Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
      Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
      Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()

Sourabh Jain (2):
      powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o
      powerpc/vmx: avoid KASAN instrumentation in enter_vmx_ops() for kexec

Stefan Metzmacher (2):
      smb: smbdirect: make use of DEFAULT_SYMBOL_NAMESPACE and EXPORT_SYMBOL_GPL
      smb: smbdirect: introduce and use include/linux/smbdirect.h

Stephen Smalley (5):
      selinux: prune /sys/fs/selinux/checkreqprot
      selinux: prune /sys/fs/selinux/disable
      selinux: prune /sys/fs/selinux/user
      selinux: allow multiple opens of /sys/fs/selinux/policy
      selinux: shrink critical section in sel_write_load()

Sunil Khatri (1):
      drm/amdgpu/userq: fix access to stale wptr mapping

T.J. Mercier (1):
      docs: cgroup-v1: Update charge-commit section

Tabrez Ahmed (1):
      hwmon: (ads7871) Fix endianness bug in 16-bit register reads

Tao Cui (2):
      LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read()
      LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte()

Tejun Heo (4):
      workqueue: Annotate alloc_workqueue_va() with __printf(1, 0)
      cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated
      cgroup, sched_ext: Include exiting tasks in cgroup iter
      sched_ext: Skip past-sched_ext_dead() tasks in scx_task_iter_next_locked()

Thomas Fourier (1):
      media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init()

Thomas Gleixner (10):
      rseq: Set rseq::cpu_id_start to 0 on unregistration
      rseq: Protect rseq_reset() against interrupts
      rseq: Don't advertise time slice extensions if disabled
      rseq: Revert to historical performance killing behaviour
      selftests/rseq: Skip tests if time slice extensions are not available
      selftests/rseq: Make registration flexible for legacy and optimized mode
      selftests/rseq: Validate legacy behavior
      rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode
      rseq: Reenable performance optimizations conditionally
      selftests/rseq: Expand for optimized RSEQ ABI v2

Thomas Huth (1):
      efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error

Thomas Weißschuh (2):
      selftests: harness: Restore order of test functions
      LoongArch: vDSO: Drop custom __arch_vdso_hres_capable()

Thomas Zimmermann (2):
      lib/fonts: Fix bit position when rotating by 180 degrees
      arch/powerpc: Drop CONFIG_FIRMWARE_EDID from defconfig files

Thorsten Blum (1):
      efivarfs: use QSTR() in efivarfs_alloc_dentry

Théo Lebrun (2):
      clk: eyeq: add EyeQ5 children auxiliary device for generic PHYs
      reset: eyeq: drop device_set_of_node_from_dev() done by parent

Timur Tabi (1):
      Revert "drm/nouveau/gsp: add support for GA100"

Tomas Henzl (1):
      scsi: smartpqi: Silence a recursive lock warning

Tommaso Soncin (1):
      ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line
in quirk table

Tristan Madani (3):
      wifi: b43: enforce bounds check on firmware key index in b43_rx()
      wifi: b43legacy: enforce bounds check on firmware key index in RX path
      Bluetooth: btmtk: validate WMT event SKB length before struct access

Troy Mitchell (2):
      clk: spacemit: k3: mark top_dclk as CLK_IS_CRITICAL
      ASoC: spacemit: fix RX DMA params not set when TX is running

Tzung-Bi Shih (1):
      platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration

Ulf Hansson (1):
      pmdomain: core: Fix detach procedure for virtual devices in genpd

Uwe Kleine-König (The Capable Hub) (1):
      ASoC: codecs: ab8500: Remove suspicious code

Vasant Hegde (2):
      iommu/amd: Use maximum Event log buffer size when SNP is enabled
on Family 0x19
      iommu/amd: Use maximum PPR log buffer size when SNP is enabled
on Family 0x19

Victor Nogueira (1):
      selftests/tc-testing: Add tests that force red and sfb to
dequeue from child's gso_skb

Victor Nogueria (1):
      net/sched: sch_sfb: Replace direct dequeue call with peek and
qdisc_dequeue_peeked

Vikash Garodia (1):
      media: iris: switch to hardware mode after firmware boot

Vincent Guittot (1):
      sched/fair: Fix wakeup_preempt_fair() for not waking up task

Vishnu Reddy (1):
      media: iris: fix use-after-free of fmt_src during MBPF check

WANG Rui (2):
      efi/loongarch: Implement efi_cache_sync_image()
      efi/libstub: Synchronize instruction cache after kernel relocation

Waiman Long (2):
      ipvs: Guard access of HK_TYPE_KTHREAD cpumask with RCU
      sched/isolation: Make HK_TYPE_KTHREAD an alias of HK_TYPE_DOMAIN

Wang Shuaiwei (1):
      scsi: ufs: core: Fix bRefClkFreq write failure in HS-LSS mode

Wei Fang (1):
      net: enetc: fix VSI mailbox timeout handling and DMA lifecycle

Weiming Shi (5):
      bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
      bpf: Fix NULL pointer dereference in bpf_skb_fib_lookup()
      netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
      i2c: stub: Reject I2C block transfers with invalid length
      i2c: smbus: reject oversized block transfers in the common path

Weinan Liu (1):
      iommu/amd: Fix precedence order in set_dte_passthrough()

Wenmeng Liu (3):
      media: qcom: camss: Fix csid IRQ offset for sa8775p
      media: qcom: camss: Fix csid clock configuration for sa8775p
      media: qcom: camss: Add missing clocks for VFE lite on sa8775p

Wentao Guan (1):
      LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()

Wentao Liang (1):
      pmdomain: mediatek: fix use-after-free in
scpsys_get_bus_protection_legacy()

Xianglai Li (2):
      LoongArch: KVM: Compile switch.S directly into the kernel
      LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry

Xiaogang Chen (1):
      drm/amdkfd: Check if there are kfd porcesses using adev by
kfd_processes_count

Xu Yang (1):
      usb: typec: tcpm: fix debug accessory mode detection for sink ports

Yi Kuo (1):
      smb: smbdirect: fix MR registration for coalesced SG lists

Yihang Li (1):
      scsi: hisi_sas: Fix sparse warnings in prep_ata_v3_hw()

Yilin Zhu (1):
      ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()

Yu-Hsiang Tseng (1):
      wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions

Yufan Chen (2):
      io_uring/napi: clear tracked NAPI entries on unregister
      io_uring/eventfd: reset deferred signal state

Yufei CHENG (1):
      platform/x86: lenovo: wmi-other: Fix uninitialized variable in
lwmi_om_hwmon_write()

Yuriy Padlyak (1):
      ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi
Mi Laptop Pro 15

Zhan Xusheng (1):
      sched/fair: Fix overflow in vruntime_eligible()

Zisen Ye (2):
      smb/client: fix out-of-bounds read in symlink_data()
      smb/client: fix out-of-bounds read in smb2_compound_op()