Linux 7.2-rc3

[Linus Torvalds]

Things continue to look normal (the "new normal" with slightly higher
rates of commits, although I do get the feeling that we're seeing that
slightly balanced out by people starting to go on summer vacation).

About half the changes are to drivers - spread all over. Yes, there's
GPU and networking as always, but there's a fair amount of other misc
driver noise too.

The rest is similarly spread out: networking and filesystems are the
biggest areas, but we have some documentation fixes (ok, some of it is
just a pure re-indent), some core kernel, some architecture fixes, and
various tooling fixes.

Nothing looks particularly scary or strange.

Go forth and test,

                Linus

---

Alan Stern (1):
      USB: chaoskey: Fix slab-use-after-free in chaoskey_release()

Alex Deucher (1):
      drm/gfx10: Program DB_RING_CONTROL

Alexandru Hossu (8):
      staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
      staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
      staging: rtl8723bs: fix OOB reads in IE loops in
issue_assocreq() and join_cmd_hdl()
      staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
      staging: rtl8723bs: fix OOB write in HT_caps_handler()
      staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
      staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
      staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),
rtw_get_wapi_ie(), and rtw_get_wps_attr()

Alice Ryhl (2):
      rust_binder: fix BINDER_GET_EXTENDED_ERROR
      rust_binder: clear freeze listener on node removal

Anas Khan (1):
      drm/xe: remove duplicate <kunit/test-bug.h> include

Andreas Kemnade (1):
      gpios: palmas: add .get_direction() op

Andreas Kempe (1):
      iio: imu: st_lsm6dsx: deselect shub page before reading whoami

Andrei Kuchynski (1):
      usb: typec: ucsi: Invert DisplayPort role assignment

Andrew Jones (2):
      selftests: riscv: Bypass libc in inactive vector ptrace test
      riscv: hwprobe.rst: Make indentation consistent

Andy Shevchenko (2):
      iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for()
      serial: 8250_mid: Disable DMA for selected platforms

Andy Yan (1):
      usb: typec: tcpm: Fix VDM type for Enter Mode commands

Ankit Nautiyal (1):
      Revert "drm/i915/psr: Allow SCL=0 on platforms with always-on VRR TG"

Anshuman Khandual (1):
      arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()

Anuj Gupta (1):
      blk-mq: bound blk_hctx_poll() to one jiffy

Ariana Lazar (1):
      iio: dac: mcp47feb02: Fix passing uninitialized vref1_uV for no Vref1 case

Arnd Bergmann (1):
      usb: ucsi: huawei_gaokun: move typec_altmode off stack

Arunpravin Paneer Selvam (1):
      gpu/buddy: bail out of try_harder when alignment cannot be honoured

Badhri Jagan Sridharan (1):
      usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

Bartosz Golaszewski (1):
      gpio: shared: make the voting mechanism adaptable

Bastian Blank (1):
      s390: Add build salt to the vDSO

Ben Dooks (3):
      tracing: Make tracepoint_printk static as not exported
      usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
      drm/imagination: make pvr_fw_trace_init_mask_ops static

Benjamin Coddington (2):
      NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
      NFS: Charge unstable writes by request size, not folio size

Benjamin Marzinski (1):
      dm-log: fix a bitset_size overflow on 32bit machines

Biren Pandya (3):
      iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
      iio: pressure: mpl115: fix runtime PM leak on read error
      iio: light: gp2ap002: fix runtime PM leak on read error

Bryam Vargas (1):
      iio: accel: bmc150: clamp the device-reported FIFO frame count

Cao Guanghui (2):
      dm era: fix NULL pointer dereference in metadata_open()
      dm era: fix error code propagation in era_ctr()

Carlos Llamas (2):
      binder: fix UAF in binder_thread_release()
      binder: fix UAF in binder_free_transaction()

Catalin Marinas (1):
      arm64: Avoid eager DVMSync reclaim batches with C1-Pro SME erratum

Cen Zhang (6):
      ntfs: avoid stale runlist element dereference in MFT writeback
      ntfs: avoid stale runlist element dereference in fallocate
      Bluetooth: 6lowpan: avoid untracked enable work
      Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
      Bluetooth: MGMT: Fix adv monitor add failure cleanup
      usb: misc: usbio: fix disconnect UAF in client teardown

ChenXiaoSong (4):
      smb/client: use stack-allocated smb2_file_all_info in
smb3_query_mf_symlink()
      smb/client: pass cifs_open_info_data to SMB2_open()
      smb/client: zero-initialize stack-allocated cifs_open_info_data
      smb/client: fix incorrect nlink returned by fstat()

Chi Wang (1):
      audit: Fix data races of skb_queue_len() readers on audit_queue

Chris Mason (1):
      binder: cache secctx size before release zeroes it

Christian König (1):
      drm/drm_exec: avoid indirect goto

Christophe JAILLET (1):
      dm-inlinecrypt: Fix an error handling path in inlinecrypt_ctr()

Christopher Mackle (1):
      staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()

Chuck Lever (3):
      net/tls: Consume empty data records in tls_sw_read_sock()
      SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
      SUNRPC: pin upper rpc_clnt across the TLS connect_worker

Cihan Karadag (1):
      selftests: gpio: add gpio-cdev-uaf to .gitignore

Connor Williamson (1):
      block: remove redundant GD_NEED_PART_SCAN in add_disk_final()

Crystal Wood (1):
      tracing/osnoise: Call synchronize_rcu() when unregistering

Daehyeon Ko (1):
      macsec: don't read an unset MAC header in macsec_encrypt()

Damien Le Moal (1):
      block: avoid potential deadlock on zone revalidation failure

Damon Ding (1):
      drm/bridge: analogix_dp: Fix PE/VS value shift mismatch during
link training

Daniel Gibson (1):
      platform/x86/amd/pmc: Avoid logging "(null)" for DMI values

Dave Airlie (1):
      nouveau/vmm: fix another SPT/LPT race

David Carlier (1):
      ring-buffer: Fix ring_buffer_read_page() copying only one event per page

David Francis (4):
      drm/amdkfd: Check bounds on CRIU restore event id
      drm/amdkfd: Don't acquire buffers during CRIU queue restore.
      drm/amdkfd: Check bounds in allocate_event_notification_slot
      drm/amdkfd: Check bounds on CRIU restore queue type and mqd size

Dawei Feng (2):
      octeontx2-pf: fix SQB pointer leak on init failure
      usb: free iso schedules on failed submit

Dexuan Cui (2):
      net: mana: Validate the packet length reported by the NIC
      net: mana: Sync page pool RX frags for CPU

Dmitry Torokhov (4):
      Input: maplemouse - set driver data before registering input device
      Input: maplecontrol - set driver data before registering input device
      Input: maple_keyb - set driver data before registering input device
      Input: mms114 - fix multi-touch slot corruption

Dong Yibo (1):
      net: rnpgbe: fix mailbox endianness and remove pointer casts

Doruk Tan Ozturk (1):
      xen-blkfront: fix double completion of split requests on resume

Dust Li (1):
      dibs: loopback: validate offset and size in move_data()

Enrico Pozzobon (1):
      net: usb: lan78xx: disable VLAN filter in promiscuous mode

Eric Dumazet (4):
      amt: fix size calculation in amt_get_size()
      ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
      ipv6: mcast: Fix potential UAF in MLD delayed work
      ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and
igmp_stop_timer()

Erich E. Hoover (1):
      USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD

Fabio Porcedda (1):
      USB: serial: option: add Telit Cinterion FE990D50 compositions

Fan Wu (1):
      usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

Feng Liu (3):
      net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
      net/mlx5e: Fix HV VHCA stats agent registration race
      net/mlx5e: Fix publication race for priv->channel_stats[]

Feng Wu (1):
      netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()

Florian Fuchs (1):
      Input: maplemouse - fix NULL pointer dereference in open()

Florian Westphal (4):
      netfilter: nf_nat_sip: reload possible stale data pointer
      netfilter: ebtables: zero chainstack array
      netfilter: ebtables: module names must be null-terminated
      netfilter: handle unreadable frags

Fredric Cover (1):
      smb: client: use GFP_KERNEL for DFS cache allocations

Gal Pressman (1):
      ethtool: rss: Fix hfunc and input_xfrm parsing on big endian

Genjian Zhang (1):
      dm thin metadata: fix superblock refcount leak on snapshot shadow failure

Georgiy Osokin (1):
      HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

Gerald Schaefer (1):
      s390/mm: Fix type mismatch in get_align_mask().

Greg Kroah-Hartman (1):
      MAINTAINERS: USB: add usb.rs to USB subsystem file list

Greg Ungerer (1):
      m68k: coldfire: fix breakage of missed IO access updates

Griffin Kroah-Hartman (2):
      usb: gadget: function: rndis: add length check to response query
      usb: gadget: function: rndis: add length check for header

Guangshuo Li (4):
      iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
      cifs: validate DFS referral string offsets
      drm/xe: free madvise VMA array on L2 flush failure
      smb: client: fix overflow in passthrough ioctl bounds check

Guodong Xu (2):
      dt-bindings: riscv: sort multi-letter Z extensions alphanumerically
      riscv: hwprobe.rst: Document EXT_ZICFISS and EXT_ZICFILP

Guzebing (1):
      block: Make WBT latency writes honor enable state

HE WEI (ギカク) (1):
      usb: misc: usbio: bound bulk IN response length to the received transfer

Hao-Qun Huang (2):
      staging: vme_user: fix location monitor leak in fake bridge
      staging: vme_user: fix location monitor leak in tsi148 bridge

Hao-Yu Yang (1):
      io_uring: fix dangling iovec after provided-buffer bundle grow failure

Haoxiang Li (2):
      usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
      usb: mtu3: unmap request DMA on queue failure

Harman Kalra (1):
      octeontx2-af: fix VF bringup affecting PF promiscuous state

Heiko Carstens (1):
      s390/diag: Add missing array_index_nospec() call to
memtop_get_page_count()

Herman van Hazendonk (1):
      iio: common: st_sensors: honour channel endianness in read_axis_data

Hui Wang (2):
      ring-buffer: Fix event length with forced 8-byte alignment
      selftests/rseq: Fix a building error for riscv arch

Huihui Huang (1):
      tracing: Prevent out-of-bounds read in glob matching

Huiwen He (1):
      smb/server: map SET_INFO ENOSPC to disk full

HyeongJun An (1):
      HID: logitech-dj: Fix maxfield check in DJ short report validation

Hyunchul Lee (1):
      ntfs: avoid self-deadlock during inode eviction

Hyunwoo Kim (1):
      rust_binder: use a u64 stride when cleaning up the offsets array

Ingo Blechschmidt (1):
      dm: avoid leaking the caller's thread keyring via the table device file

Jaewon Yang (1):
      tpm: Make the TPM character devices non-seekable

Jamal Hadi Salim (2):
      net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
      net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload

Jan Kara (1):
      mm: a second pagecache maintainer

Jani Nikula (1):
      drm/i915/mst: limit DP MST ESI service loop

Jared Baldridge (1):
      usb: cdc_acm: Add quirk for Uniden BC125AT scanner

Jean-Baptiste Maneyrol (2):
      iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
      iio: imu: inv_icm42600: fix timestamp clock period by using lower value

Jens Axboe (1):
      Revert "io_uring: grab RCU read lock marking task run"

Jens Emil Schulz Østergaard (1):
      net: microchip: vcap: fix races on the shared Super VCAP block

Jens Glathe (1):
      Revert "usb: typec: mux: avoid duplicated mux switches"

Jesse Zhang (1):
      drm/amdgpu: trigger GPU recovery when userq destroy fails to
unmap a hung queue

Jia He (1):
      arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1

Jia Wang (3):
      gpio: dwapb: Defer clock gating until noirq
      riscv: add UltraRISC SoC family Kconfig support
      riscv: defconfig: enable ARCH_ULTRARISC

Jimmy Hu (1):
      usb: gadget: udc: Fix use-after-free in gadget_match_driver

Jinjiang Tu (1):
      fs/proc: fix KPF_KSM reported for all anonymous pages

Jinjie Ruan (2):
      arm64: smp: Fix hot-unplug tearing by forcing unregistration
      cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()

Johan Hovold (10):
      USB: ulpi: fix memory leak on registration failure
      USB: iowarrior: fix use-after-free on disconnect
      USB: iowarrior: fix use-after-free on disconnect race
      USB: idmouse: fix use-after-free on disconnect race
      USB: ldusb: fix use-after-free on disconnect race
      USB: legousbtower: fix use-after-free on disconnect race
      USB: serial: digi_acceleport: fix write buffer corruption
      USB: serial: digi_acceleport: fix hard lockup on disconnect
      USB: serial: digi_acceleport: fix broken rx after throttle
      USB: serial: keyspan_pda: fix information leak

John Ogness (1):
      serial: 8250: Ignore flow control on suspend/resume with
no_console_suspend

Joonas Lahtinen (3):
      drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
      drm/i915/gt: Fix NULL deref on sched_engine alloc failure
      drm/i915/gem: Do not leak siblings[] on proto context error

Joshua Crofts (5):
      iio: light: al3000a: add missing REGMAP_I2C to Kconfig
      iio: light: al3010: add missing REGMAP_I2C to Kconfig
      iio: light: al3320a: add missing REGMAP_I2C to Kconfig
      iio: adc: ad4130: add missing `select IIO_TRIGGERED_BUFFER` to Kconfig
      iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig

Jozsef Kadlecsik (4):
      netfilter: ipset: mark the rcu locked areas properly
      netfilter: ipset: exclude gc when resize is in progress
      netfilter: ipset: cleanup the add/del backlog when resize failed
      netfilter: ipset: allocate the proper memory for the generic
hash structure

Julian Anastasov (1):
      ipvs: ensure inner headers in ICMP errors are in headroom

Kanala Ramalingeswara Reddy (2):
      drm/amdgpu: add support for PSP version 15.0.9
      drm/amdgpu: add support for SMU version 15.0.9

Kenneth Feng (1):
      drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled

Keshav Verma (2):
      rust_binder: synchronize Rust Binder stats with freeze commands
      rust_binder: reject context manager self-transaction

Ketan (1):
      mm: page_ext: add count limit to page_ext_iter_next to prevent
invalid PFN access

Kiran K (1):
      Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()

Lars-Peter Clausen (1):
      iio: event: Fix event FIFO reset race

Lee Jia Jie (1):
      perf/aux: Fix page UAF in map_range()

Lee Jones (1):
      HID: core: Fix OOB read in hid_get_report for numbered reports

Li RongQing (1):
      net/mlx5: Fix L3 tunnel entropy refcount leak

Liang Hao (1):
      gpio: dwapb: Mask interrupts at hardware initialization

Linus Torvalds (1):
      Linux 7.2-rc3

Lizhi Hou (10):
      accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()
      accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register()
      accel/amdxdna: Fix VMA access race
      accel/amdxdna: Fix potential amdxdna_umap lifetime race
      accel/amdxdna: fix open_ref leak and stale client pointer on dma
map failure
      accel/amdxdna: Fix deadlock on debug BO command timeout
      accel/amdxdna: Fix hardware context race in amdxdna_update_heap()
      accel/amdxdna: Check drmm_mutex_init() return value
      accel/amdxdna: Check init_srcu_struct() return value
      accel/amdxdna: Fix potential NULL pointer dereference of abo->client

Lorenzo Stoakes (1):
      MAINTAINERS: add Lance as an rmap reviewer

Luigi Santivetti (1):
      drm/imagination: fix error checking of pvr_vm_context_lookup()

Luiz Augusto von Dentz (1):
      Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev

Madhu M (1):
      usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for
DP alt mode

Manish Khadka (2):
      HID: letsketch: fix UAF on inrange_timer at driver unbind
      HID: appleir: fix UAF on pending key_up_timer in remove()

Maoyi Xie (3):
      usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
      HID: lg-g15: cancel pending work on remove to fix a use-after-free
      Bluetooth: btnxpuart: Fix out-of-bounds firmware read in
nxp_recv_fw_req_v3()

Marco Scardovi (1):
      platform/x86: asus-armoury: update power limits for G614PR

Mario Limonciello (1):
      x86/video: Only fall back to vga_default_device() without screen info

Mathias Nyman (1):
      xhci: dbc: support runtime suspend while DbC is in enabled state

Matthew Brost (2):
      drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
      drm/xe: Wait on external BO kernel fences in exec IOCTL

Matthias Feser (1):
      serial: 8250_omap: clear rx_running on zero-length DMA completes

Mauricio Faria de Oliveira (1):
      usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()

Maxwell Doose (2):
      iio: adc: lpc32xx: Initialize completion before requesting IRQ
      iio: adc: spear: Initialize completion before requesting IRQ

Maíra Canal (1):
      drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

Mehdi Hassan (1):
      smb: client: refactor cifs_revalidate_mapping() to use
clear_and_wake_up_bit()

Melbin K Mathew (1):
      io_uring/msg_ring: reject CQE32 flag pass-through to normal rings

Michael Bommarito (3):
      tracing/user_events: Fix use-after-free in user_event_mm_dup()
      selftests/user_events: Wait for deferred event teardown after unregister
      drbd: reject data replies with an out-of-range payload size

Michael Tautschnig (1):
      staging: vme_user: bound slave read/write to the kern_buf size

Mikulas Patocka (14):
      dm-verity: fix buffer overflow in FEC calculation
      dm-integrity: fix the 'fix_hmac' option
      dm-integrity: fix leaking uninitialized kernel memory
      dm-integrity: don't increment hash_offset twice
      dm-integrity: fix a bug if the bio is out of limits
      dm_early_create: fix freeing used table on dm_resume failure
      dm-ioctl: fix a possible overflow in list_version_get_info
      dm-verity: avoid double increment of &use_bh_wq_enabled
      dm-verity: fix a possible NULL pointer dereference
      dm-verity: increase sprintf buffer size
      dm-verity: make error counter atomic
      dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
      dm-stats: fix merge accounting
      dm-stats: fix dm_jiffies_to_msec64

Ming-Hung Tsai (1):
      dm thin metadata: fix metadata snapshot consistency on commit failure

Mingyou Chen (1):
      platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference
during suspend/resume

Muhammad Bilal (2):
      Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
      Bluetooth: L2CAP: validate option length before reading conf opt value

Myeonghun Pak (4):
      USB: misc: uss720: unregister parport on probe failure
      usb: typec: anx7411: use devm_pm_runtime_enable()
      usb: sl811-hcd: disable controller wakeup on remove
      usb: typec: tcpci_rt1711h: unregister TCPCI port with devres

Namjae Jeon (12):
      ntfs: make system files immutable to prevent corruption
      ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()
      ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()
      ksmbd: validate SID namespace before mapping IDs
      ksmbd: fix multichannel binding and enforce channel limit
      ksmbd: coalesce sub-15ms write time updates on close
      ksmbd: mark invalid session responses as signed
      ksmbd: find bound sessions during reauthentication
      ksmbd: handle channel binding with a different user
      ksmbd: sign rejected SMB2.1 session binding responses
      ksmbd: mark rejected cross-dialect bindings as signed
      ksmbd: use the session dialect for rejected binding signatures

Neill Kapron (2):
      usb: gadget: f_fs: Initialize epfile->in early to fix endpoint
direction checks
      usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile

Nick Desaulniers (1):
      MAINTAINERS: update ndesaulniers

Nicolas Pitre (1):
      vt: fix spurious modifier in CSI/cursor key sequences

Nirmoy Das (1):
      selftests: net: make busywait timeout clock portable

Norbert Manthey (1):
      smb: client: mask server-provided mode to 07777 in modefromsid

Oliver Neukum (1):
      USB: core: ratelimit cabling message

Pablo Neira Ayuso (5):
      netfilter: nfnetlink_cthelper: cap to maximum number of
expectation per master on updates
      netfilter: nft_set_rbtree: get command skips end element with
open interval
      netfilter: flowtable: use dst in this direction when pushing IPIP header
      netfilter: flowtable: IPIP tunnel hardware offload is not yet support
      netfilter: flowtable: support IPIP tunnel with direct xmit

Pali Rohár (5):
      cifs: Fix support for creating SFU socket
      cifs: Fix support for creating SFU fifo
      cifs: Show reason why autodisabling serverino support
      cifs: Fix and improve cifs_is_path_accessible() function
      cifs: Remove CIFSSMBSetPathInfoFB() fallback function

Paul Cercueil (1):
      usb: gadget: f_fs: Fix DMA fence leak

Paul Menzel (1):
      usb: typec: ucsi: cancel pending work on system suspend

Pauli Virtanen (3):
      Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
      Bluetooth: ISO: fix malformed ISO_END/CONT handling
      Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length

Pedro Falcato (1):
      mm: do file ownership checks with the proper mount idmap

Peiyang He (3):
      ntfs: fix mrec_lock ABBA deadlock in rename
      ntfs: fix hole runlist memory leak in insert range error path
      ntfs: fail attrlist updates when the superblock is inactive

Pengpeng Hou (4):
      iio: temperature: Build mlx90635 with CONFIG_MLX90635
      iio: adc: ti-ads124s08: Return reset GPIO lookup errors
      regulator: mt6316: add missing MODULE_DEVICE_TABLE()
      regulator: mt6363: add missing MODULE_DEVICE_TABLE()

Qi Zheng (2):
      mm: shrinker: fix shrinker_info teardown race with expansion
      mm: shrinker: fix NULL pointer dereference in debugfs

Qihang (1):
      gue: validate REMCSUM private option length

Radu Rendec (1):
      mailmap: add entries for Radu Rendec

Reinette Chatre (1):
      fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list

Ricardo Robaina (1):
      audit: fix potential integer overflow in audit_log_n_hex()

Robert Mader (1):
      drm: Guard DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE

Rodrigo Lugathe da Conceição Alves (1):
      USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub

Rongguang Wei (1):
      s390/zcrypt: Remove the empty file

Rosen Penev (2):
      net: mdio: select REGMAP_MMIO instead of depending on it
      gpio: mvebu: free generic chips on unbind

Runyu Xiao (4):
      iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
      iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
      Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
      usb: dwc3: run gadget disconnect from sleepable suspend context

SJ Park (2):
      mm/damon: add a kernel-doc comment for damon_ctx->probes
      mm/damon: add a kernel-doc comment for damon_ctx->rnd_state

Sam Day (1):
      usbip: vudc: fix NULL deref in vep_dequeue()

Samuel Moelius (4):
      iio: adc: ad7380: select REGMAP
      net/sched: cake: reject overhead values that underflow length
      dm era: fix out-of-bounds memory access for non-zero start sector
      dm-pcache: reject option groups without values

Samuel Page (1):
      Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete

Sandipan Das (3):
      perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
      perf/x86/amd/lbr: Fix kernel address leakage
      perf/x86/amd/brs: Fix kernel address leakage

Sarthak Sharma (1):
      selftests/mm: fix ksft_process_madv.sh test category

SeongJae Park (3):
      mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
      mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
      mm/damon/ops-common: handle extreme intervals in damon_hot_score()

Shahyan Soltani (1):
      drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

Shay Drory (3):
      net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
      net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
      net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable

Shigeru Yoshida (1):
      qede: fix off-by-one in BD ring consumption on build_skb failure

Shoichiro Miyamoto (1):
      smb: client: restrict implied bcc[0] exemption to responses
without data area

Shuangpeng Bai (2):
      llc: fix SAP refcount leak in llc_ui_autobind()
      usb: typec: class: drop PD lookup reference

Shuicheng Lin (1):
      drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n

Shyam Sundar S K (1):
      platform/x86: amd-pmc: Use correct IP block table for AMD 1Ah M80H SoC

Siwei Zhang (2):
      Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
      Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

Srinivas Pandruvada (1):
      HID: sensor-hub: Add sensor_hub_input_attr_read_values() for
multi-byte reads

Stepan Ionichev (1):
      iio: light: tsl2591: return actual error from probe IRQ failure

Stephan Gerhold (2):
      serial: msm: Disable DMA for kernel console UART
      usb: typec: ps883x: Fix DP+USB3 configuration

Stephen Smalley (1):
      selinux: check connect-related permissions on TCP Fast Open

Steve French (1):
      smb: client: preserve leading slash for POSIX absolute symlink targets

Steven Rostedt (2):
      ufs: core: tracing: Do not dereference pointers in TP_printk()
      tracing: Add a no-rcu-check version of trace_##event##_enabled()

Stig Hornang (1):
      Bluetooth: L2CAP: fix tx ident leak for commands without a response

Suman Ghosh (1):
      octeontx2-pf: check DMAC extraction support before filtering

Sungwoo Kim (1):
      Bluetooth: sco: Fix a race condition in sco_sock_timeout()

Suraj Kandpal (1):
      drm/i915/ltphy: Fix SSC Enablement bit in PORT_CLOCK_CTL

Suresh Guttula (1):
      drm/amdgpu: Disable JDPG on VCN5_3

Sven Eckelmann (9):
      batman-adv: ensure minimal ethernet header on TX
      batman-adv: fix VLAN priority offset
      batman-adv: clean untagged VLAN on netdev registration failure
      batman-adv: tt: avoid request storms during pending request
      batman-adv: tt: prevent TVLV OOB check overflow
      batman-adv: frag: free unfragmentable packet
      batman-adv: frag: fix primary_if leak on failed linearization
      batman-adv: mcast: avoid OOB read of num_dests header
      batman-adv: dat: fix tie-break for candidate selection

TJ Adams (2):
      ata: libata-core: Skip HPA resize for locked drives
      ata: libata-core: Allow capacity transition to zero for locked drives

Tamaki Yanagawa (1):
      netfilter: nft_lookup: fix catchall element handling with inverted lookups

Tao Liu (1):
      riscv: Prevent NULL pointer dereference in machine_kexec_prepare()

Tapio Reijonen (1):
      serial: max310x: implement gpio_chip::get_direction()

Thomas Gleixner (1):
      posix-cpu-timers: Prevent UAF caused by non-leader exec() race

Thomas Zimmermann (1):
      drm/fb-helper: Only consider active CRTCs for vblank sync

Théo Lebrun (1):
      net: macb: drop in-flight Tx SKBs on close

Timur Tabi (1):
      regulator: core: regulator_lock_two() should test for EDEADLK
not EDEADLOCK

Tony Luck (2):
      fs/resctrl: Free mon_data structures on rdt_get_tree() failure
      fs/resctrl: Fix use-after-free during unmount

Tristan Madani (1):
      selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

Trung Nguyen (2):
      HID: multitouch: fix out-of-bounds bit access on mt_io_flags
      selftests/hid: multitouch: test a large ContactCountMaximum

Tycho Andersen (AMD) (1):
      x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"

Tyler Baker (1):
      usb: gadget: f_fs: initialize reset_work at allocation time

Valeriy Yashnikov (1):
      ntfs: avoid calling post_write_mst_fixup() for invalid index_block

Vidhu Sarwal (1):
      iio: light: al3010: fix incorrect scale for the highest gain range

Vincent Donnefort (3):
      tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path
      tracing/remotes: Fix struct_len in trace_remote_alloc_buffer()
      ring-buffer: Allow sparse CPU masks in ring_buffer_desc()

Wang Yan (3):
      selftests/arm64: fix spelling errors in comments
      selftests/net: fix EVP_MD_CTX leak in tcp_mmap
      selftests/riscv: ptrace: Fix memory leak of regset_data in vector tests

Wayen.Yan (1):
      tracing: Remove unused ret assignment in tracing_set_tracer()

Weiming Shi (1):
      Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

WenTao Liang (1):
      usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()

Wentao Liang (1):
      accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()

Woraphat Khiaodaeng (1):
      io_uring: restore RCU read section in io_req_local_work_add()

Wyatt Feng (2):
      netfilter: xt_u32: reject invalid shift counts
      netfilter: xt_connmark: reject invalid shift parameters

Xiang Mei (5):
      net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
      net: qualcomm: rmnet: validate MAP frame length before ingress parsing
      net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
      netfilter: nf_conntrack_reasm: guard mac_header adjustment after
IPv6 defrag
      netfilter: ebtables: terminate table name before find_table_lock()

Xu Rao (5):
      USB: storage: include US_FL_NO_SAME in quirks mask
      usb: gadget: f_printer: take kref only for successful open
      USB: usb-storage: ene_ub6250: restore media-ready check
      xhci: sideband: fix ring sg table pages leak
      smb: client: fix atime clamp check in read completion

Yang Wang (1):
      drm/amd/pm: fix smu14 power limit range calculation

Yang Xiuwei (1):
      io_uring/uring_cmd: fix uring_cmd.c comments

Yi Xie (1):
      io_uring/memmap: return -EINVAL from get_unmapped_area() on bad mmap

Yichong Chen (3):
      tools/virtio: add missing compat definitions for vhost_net_test
      tools/include: include stdint.h for SIZE_MAX in overflow.h
      usbip: tools: support SuperSpeedPlus devices

Yiyang Chen (3):
      HID: bpf: Fix hid_bpf_get_data() range check
      selftests/hid: Load only requested struct_ops maps
      selftests/hid: Cover hid_bpf_get_data() size overflow

Yizhou Zhao (5):
      ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
      ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
      ipvs: pass parsed transport offset to state handlers
      ipvs: use parsed transport offset in TCP state lookup
      ipvs: use parsed transport offset in SCTP state lookup

Yousef Alhouseen (4):
      ublk: snapshot batch commands before preparing I/O
      mac802154: remove interfaces with RCU list deletion
      Bluetooth: bnep: pin L2CAP connection during netdev registration
      Bluetooth: fix UAF in bt_accept_dequeue()

Yu Peng (2):
      tracing/synthetic: Free pending field on error path
      tracing/synthetic: Free type string on error path

Yuanhe Shu (1):
      tracing: Fix NULL pointer dereference in func_set_flag()

Yudistira Putra (1):
      samples: ftrace: Fix typos in benchmark comment

Yuho Choi (1):
      net/liquidio: drop cached VF pci_dev LUT

Yuyang Huang (1):
      ipv4: igmp: remove multicast group from hash table on device destruction

Zenghui Yu (3):
      selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
      selftests/mm: hmm-tests: include linux/mman.h to access MADV_COLLAPSE
      samples/damon/mtier: fail early if address range parameters are invalid

Zhang Lixu (1):
      iio: hid-sensor-rotation: Fix stale or zero output when reading raw values

Zhixing Chen (1):
      netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop

Zhu Lingshan (1):
      amdkfd: properly free secondary context id

Zi Yan (1):
      mm/compaction: handle free_pages_prepare() properly in compaction_free()

Zizhi Wo (1):
      smb: client: fix busy dentry warning on unmount after DIO

胡连勤 (1):
      usb: xhci: Fix sleep in atomic context in xhci_free_streams()