50 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	769612f594	Merge tag 'android14-6.1.43_r00' into android14-6.1 ... This catches the android14-6.1 branch up with the 6.1.43 LTS upstream release. It contains the following commits: * e8ac95d4bc Revert "arm64: errata: Mitigate Ampere1 erratum AC03_CPU_38 at stage-2" * cf0f262265 Revert "locking/rtmutex: Fix task->pi_waiters integrity" * 38b64945f1 Revert "ring-buffer: Fix wrong stat of cpu_buffer->read" * 7f81705800 Merge 6.1.43 into android14-6.1-lts |\ | * 52a953d093 Linux 6.1.43 | * c3d576baa6 dma-buf: fix an error pointer vs NULL bug | * 23acc2b850 dma-buf: keep the signaling time of merged fences v3 | * 665e6fd714 test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation | * 0ab95d5ce8 selftests: mptcp: sockopt: use 'iptables-legacy' if available | * bd2decac73 mptcp: ensure subflow is unhashed before cleaning the backlog | * ab79c7541d cpufreq: intel_pstate: Drop ACPI _PSS states table patching | * 602a1cbc24 ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily | * f7fcc0f1b2 ACPI: processor: perflib: Use the "no limit" frequency QoS | * d701687c89 drm/amd/display: Write to correct dirty_rect | * d58fb94f24 drm/amd/display: perform a bounds check before filling dirty rectangles | * 0441c44154 tracing: Fix trace_event_raw_event_synth() if else statement | * f5e8f7a02c drm/amd/display: set per pipe dppclk to 0 when dpp is off | * 73679f8c45 rbd: retrieve and check lock owner twice before blocklisting | * 0c0b6412c9 rbd: harden get_lock_owner_info() a bit | * c0d067c79b rbd: make get_lock_owner_info() return a single locker or NULL | * 3d215ad49c dm cache policy smq: ensure IO doesn't prevent cleaner policy progress | * 507f70c06a drm/i915/dpt: Use shmem for dpt objects | * e046aecb73 ceph: never send metrics if disable_send_metrics is set | * 8ab9ad1638 PM: sleep: wakeirq: fix wake irq arming | * 356e711640 arm64/sme: Set new vector length before reallocating | * ff54cb993b ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register | * 6deb8727f2 s390/dasd: print copy pair message only for the correct error | * c4ae208cc3 s390/dasd: fix hanging device after quiesce/resume | * 2b58bd3847 LoongArch: BPF: Enable bpf_probe_read{, str}() on LoongArch | * 8a5e0c1f71 LoongArch: BPF: Fix check condition to call lu32id in move_imm() | * 024ed3b9b8 Revert "um: Use swap() to make code cleaner" | * e1d54962a6 soundwire: fix enumeration completion | * dda7cfcaa4 selftests: mptcp: join: only check for ip6tables if needed | * aedec6019d net: dsa: qca8k: fix mdb add/del case with 0 VID | * 828f9526f0 net: dsa: qca8k: fix broken search_and_del | * d42c326288 net: dsa: qca8k: fix search_and_insert wrong handling of new rule | * e1fda7c125 virtio-net: fix race between set queues and probe | * cd1a8952ff xen: speed up grant-table reclaim | * af7aa4fe94 proc/vmcore: fix signedness bug in read_from_oldmem() | * 7f1715d827 locking/rtmutex: Fix task->pi_waiters integrity | * d392d2d72a irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation | * a80d2cb27d irq-bcm6345-l1: Do not assume a fixed block to cpu mapping | * 2edb87931a tpm_tis: Explicitly check for error code | * c9af433b11 ACPI/IORT: Remove erroneous id_count check in iort_node_get_rmr_info() | * d79f730bb8 nfsd: Remove incorrect check in nfsd4_validate_stateid | * e5a87723e8 file: always lock position for FMODE_ATOMIC_POS | * 2663e2cb91 x86/MCE/AMD: Decrement threshold_bank refcount when removing threshold blocks | * 360c98f583 btrfs: check for commit error at btrfs_attach_transaction_barrier() | * a7b85dc316 btrfs: check if the transaction was aborted at btrfs_wait_for_commit() | * cbec34d302 btrfs: account block group tree when calculating global reserve size | * 5fec6f7903 hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled | * 85f8077893 hwmon: (k10temp) Enable AMD3255 Proc to show negative temperature | * bf7b30dc16 ALSA: hda/relatek: Enable Mute LED on HP 250 G8 | * db3c5ca314 ALSA: hda/realtek: Support ASUS G713PV laptop | * 96a0b80eb1 Revert "xhci: add quirk for host controllers that don't update endpoint DCS" | * 9615ca54bc tty: n_gsm: fix UAF in gsm_cleanup_mux | * 7ae9f55a49 staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() | * 41e05572e8 staging: r8712: Fix memory leak in _r8712_init_xmit_priv() | * ef301c41a1 Documentation: security-bugs.rst: clarify CVE handling | * ddb9503d1c Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group | * 9ae3d7941f Revert "usb: xhci: tegra: Fix error check" | * cf8203ea19 usb: xhci-mtk: set the dma max_seg_size | * c0ebcc7e7f usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config | * 9590eeef4d USB: quirks: add quirk for Focusrite Scarlett | * 98a6054d51 usb: ohci-at91: Fix the unhandle interrupt when resume | * a280625541 usb: misc: ehset: fix wrong if condition | * c1fad1695b usb: dwc3: don't reset device side if dwc3 was configured as host-only | * 84ff2e988b usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy | * bf4986fbeb Revert "usb: dwc3: core: Enable AutoRetry feature in the controller" | * 60816ac26f usb: typec: Use sysfs_emit_at when concatenating the string | * 9e4c1e68bf usb: typec: Iterate pds array when showing the pd list | * 59feda7f38 usb: typec: Set port->pd before adding device for typec_port | * efd354eb79 can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED | * 60dea45ea3 USB: serial: simple: sort driver entries | * 889122fe36 USB: serial: simple: add Kaufmann RKS+CAN VCP | * 6341ef50ca USB: serial: option: add Quectel EC200A module support | * f13b7a9f16 USB: serial: option: support Quectel EM060K_128 | * 71bef922ff serial: sifive: Fix sifive_serial_console_setup() section | * ace0efeb56 serial: 8250_dw: Preserve original value of DLF register | * 016a4a2a75 serial: qcom-geni: drop bogus runtime pm state update | * eb1a542824 KVM: x86: Disallow KVM_SET_SREGS{2} if incoming CR0 is invalid | * d8eb0c480f KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest | * ed8bbe6627 KVM: Grab a reference to KVM for VM and vCPU stats file descriptors | * c80b7c8f9d usb: gadget: core: remove unbalanced mutex_unlock in usb_gadget_activate | * de77000c19 USB: gadget: Fix the memory leak in raw_gadget driver | * 0f23a9eb8a usb: gadget: call usb_gadget_check_config() to verify UDC capability | * 0cf9741aa3 Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()" | * a3a3c7bdda tracing: Fix warning in trace_buffered_event_disable() | * 77996fa5c6 ring-buffer: Fix wrong stat of cpu_buffer->read | * 9d0a4a7777 ata: pata_ns87415: mark ns87560_tf_read static | * 84415f934a ublk: fail to recover device if queue setup is interrupted | * 0d5916c439 ublk: fail to start device if queue setup is interrupted | * c741076a3c ublk_drv: move ublk_get_device_from_id into ublk_ctrl_uring_cmd | * a39bf13f86 drm/msm: Disallow submit with fence id 0 | * 3398e8b283 drm/msm: Switch idr_lock to spinlock | * d722661362 RDMA/irdma: Report correct WC error | * fe3409cd01 RDMA/irdma: Fix op_type reporting in CQEs | * e139cc2974 drm/amd/display: Unlock on error path in dm_handle_mst_sideband_msg_ready_event() | * 5c58d120bf drm/amd: Fix an error handling mistake in psp_sw_init() | * ce114218f7 dm raid: protect md_stop() with 'reconfig_mutex' | * e08db3f85d dm raid: clean up four equivalent goto tags in raid_ctr() | * d43c7edfeb dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths | * 37b5a0bdb8 xenbus: check xen_domain in xenbus_probe_initcall | * a71cd15a85 drm/i915: Fix an error handling path in igt_write_huge() | * ddac66e802 smb3: do not set NTLMSSP_VERSION flag for negotiate not auth request | * 55704f087f block: Fix a source code comment in include/uapi/linux/blkzoned.h | * f656ba177f ASoC: fsl_spdif: Silence output on stop | * 6806494ed4 cxl/acpi: Return 'rc' instead of '0' in cxl_parse_cfmws() | * 748fadc08b cxl/acpi: Fix a use-after-free in cxl_parse_cfmws() | * 1b8b835373 drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb() | * b8500538b8 RDMA/bnxt_re: Prevent handling any completions after qp destroy | * d335b5fb33 RDMA/mthca: Fix crash when polling CQ for shared QPs | * 5986e96be7 RDMA/irdma: Fix data race on CQP request done | * 4e1a5842a3 RDMA/irdma: Fix data race on CQP completion stats | * b83e4c1e4c RDMA/irdma: Add missing read barriers | * 14627d02b1 drm/msm/adreno: Fix snapshot BINDLESS_DATA size | * b6432b6870 drm/msm/dpu: drop enum dpu_core_perf_data_bus_id | * 10b5920c33 RDMA/mlx4: Make check for invalid flags stricter | * 539cf23cb4 tipc: stop tipc crypto on failure in tipc_node_create | * 5f6a842db1 tipc: check return value of pskb_trim() | * 0069a11a6f benet: fix return value check in be_lancer_xmit_workarounds() | * 0f7432b7c3 net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 | * eefc0b3215 net/sched: mqprio: add extack to mqprio_parse_nlattr() | * 5523d2e319 net/sched: mqprio: refactor nlattr parsing to a separate function | * 7218974aba mm: suppress mm fault logging if fatal signal already pending | * 268cb07ef3 netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID | * 4237462a07 netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR | * 89a4d1a897 netfilter: nft_set_rbtree: fix overlap expiration walk | * c09df09241 igc: Fix Kernel Panic during ndo_tx_timeout callback | * 1ecdbf2467 x86/traps: Fix load_unaligned_zeropad() handling for shared TDX memory | * cb160f4f90 platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 | * 847265678e net: stmmac: Apply redundant write work around on 4.xx too | * 17e67a071b octeontx2-af: Fix hash extraction enable configuration | * 9b0c968a13 octeontx2-af: Removed unnecessary debug messages. | * 517a4f3b09 team: reset team's flags when down link is P2P device | * 4c50927853 bonding: reset bond's flags when down link is P2P device | * 46bf2459d6 ice: Fix memory management in ice_ethtool_fdir.c | * 51aea7e9d5 tcp: Reduce chance of collisions in inet6_hashfn(). | * 776da4eca0 ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address | * 6ed1e466ef ethernet: atheros: fix return value check in atl1e_tso_csum() | * 85c38ac62c atheros: fix return value check in atl1_tso() | * 01cb355bb9 phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() | * 69534f5ab7 vxlan: fix GRO with VXLAN-GPE | * 9e22b434ff vxlan: generalize vxlan_parse_gpe_hdr and remove unused args | * ddc6ab3834 vxlan: calculate correct header length for GPE | * 4de5cd8d89 net: hns3: fix wrong bw weight of disabled tc issue | * 487b685c81 net: hns3: fix wrong tc bandwidth weight data issue | * b93161779b net: hns3: fix the imp capability bit cannot exceed 32 bits issue | * e3339d44e0 net: phy: marvell10g: fix 88x3310 power up | * c76d3742b6 iavf: check for removal state before IAVF_FLAG_PF_COMMS_FAILED | * 469879eda3 iavf: fix potential deadlock on allocation failure | * c0fa9a5a7a i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() | * 940a2c75f5 media: amphion: Fix firmware path to match linux-firmware | * 70f9f05aba media: staging: atomisp: select V4L2_FWNODE | * accc838fd6 soundwire: qcom: update status correctly with mask | * cf52320a39 phy: qcom-snps-femto-v2: properly enable ref clock | * 01d8e49999 phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend | * b6132813be phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc | * 3a5dbdc53a phy: phy-mtk-dp: Fix an error code in probe() | * 15c94c3151 drm/amd/display: Prevent vtotal from being set to 0 | * d5741133e6 drm/amd/display: Fix possible underflow for displays with large vblank | * 342ec1696d drm/amd/display: update extended blank for dcn314 onwards | * 27931ea53c drm/amd/display: Add FAMS validation before trying to use it | * 6415d5de13 drm/amd/display: fix dc/core/dc.c kernel-doc | * 549f205819 drm/amd/display: Rework comments on dc file | * 4eed29e8a8 maple_tree: fix 32 bit mas_next testing | * 1b6e8744ed maple_tree: add __init and __exit to test module | * cba7ddf552 test_maple_tree: test modifications while iterating | * a6e2a0e414 tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if fails | * bee9946688 Revert "tracing: Add "(fault)" name injection to kernel probes" | * f3baa42afe tracing: Allow synthetic events to pass around stacktraces | * d92ee6bce1 tracing/probes: Fix to avoid double count of the string length on the array | * 16cc222026 tracing/probes: Add symstr type for dynamic events | * f5ded0c11d mptcp: do not rely on implicit state check in mptcp_listen() | * fbe9fa195e mptcp: introduce 'sk' to replace 'sock->sk' in mptcp_listen() | * cde7f2fd63 arm64: errata: Mitigate Ampere1 erratum AC03_CPU_38 at stage-2 | * eb1de0a234 KVM: arm64: Condition HW AF updates on config option | * 17e188e0fe drm/ttm: never consider pinned BOs for eviction&swap | * a7451c38e1 tty: fix hang on tty device with no_room set | * 72deb17550 n_tty: Rename tail to old_tail in n_tty_read() | * e9c44738cb drm/ttm: Don't leak a resource on eviction error | * 3a8f9b8ccf drm/ttm: Don't print error message if eviction was interrupted | * 76fcfc6ae3 drm/amd/display: Set minimum requirement for using PSR-SU on Phoenix | * f8b61a2c29 drm/amd/display: Set minimum requirement for using PSR-SU on Rembrandt | * 41c666e2b7 drm/amd/display: Update correct DCN314 register header | * 8f0582fb6d drm/amd/display: fix dcn315 single stream crb allocation | * 38fa05cad9 drm/amd/display: add pixel rate based CRB allocation support | * ad8c209544 drm/amd/display: fix unbounded requesting for high pixel rate modes on dcn315 | * acba20a5b2 drm/amd/display: use low clocks for no plane configs | * 8d515d39d8 drm/amd/display: add ODM case when looking for first split pipe | * 3a88351318 drm/amd/display: Use min transition for all SubVP plane add/remove | * a5397c85f0 drm/amd/display: Include surface of unaffected streams | * d5b3e4cf99 drm/amd/display: Copy DC context in the commit streams | * 4efb2d2200 drm/amd/display: Enable new commit sequence only for DCN32x | * bc2c700388 drm/amd/display: Rework context change check | * 810329d3d4 drm/amd/display: Check if link state is valid | * f1edb2f58a drm/amd/display: add FB_DAMAGE_CLIPS support | * ed92b595af PCI: rockchip: Don't advertise MSI-X in PCIe capabilities | * 7b65231b65 PCI: rockchip: Fix window mapping and address translation for endpoint | * 3b117fd8cf PCI: rockchip: Remove writes to unused registers | * 13b9c5f605 PCI/ASPM: Avoid link retraining race | * 4d1cd90cea PCI/ASPM: Factor out pcie_wait_for_retrain() | * 8dfeae8082 PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link() | * ecd9da1d05 MIPS: Loongson: Fix build error when make modules_install | * 3fac9a39f8 MIPS: Loongson: Move arch cflags to MIPS top level Makefile | * 70957ae160 i2c: nomadik: Remove a useless call in the remove function | * a9be061237 i2c: nomadik: Use devm_clk_get_enabled() | * 82dee5b258 i2c: nomadik: Remove unnecessary goto label | * 1dc23fb83b i2c: Improve size determinations | * 38a8983ae1 i2c: Delete error messages for failed memory allocations | * 7b7291ab29 btrfs: fix race between quota disable and relocation | * 44e2afbf65 gpio: mvebu: fix irq domain leak | * 8ee94aab99 gpio: mvebu: Make use of devm_pwmchip_add | * 19156bcb88 pwm: Add a stub for devm_pwmchip_add() | * b2d8ac988f gpio: tps68470: Make tps68470_gpio_output() always set the initial value | * 04f7d49174 io_uring: don't audit the capability check in io_uring_create() | * 017f686bcb KVM: s390: pv: fix index value of replaced ASCE | * e8df129860 powerpc/pseries/vas: Hold mmap_mutex after mmap lock during window close | * 557ea2ff05 blk-mq: Fix stall due to recursive flush plug | * 0935bbbf6e jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint | * 6e385845ee drm/amd: Align SMU11 SMU_MSG_OverridePcieParameters implementation with SMU13 | * 32631ac27c drm/amd: Move helper for dynamic speed switch check out of smu13 | * 53dd2ca2c0 ovl: fix null pointer dereference in ovl_permission() | * a9174f0d7a drm/amd/display: Keep PHY active for dp config | * 2bb9121616 platform/x86/amd/pmf: reduce verbosity of apmf_get_system_params | * fd14866ebe platform/x86/amd/pmf: Notify OS power slider update | * b068314fd8 netfilter: nf_tables: fix underflow in chain reference counter | * 35651fde1a netfilter: nf_tables: fix underflow in object reference counter * | f5aa90efe8 FROMLIST: Revert "fuse: Apply flags2 only when userspace set the FUSE_INIT_EXT" * | 469cf75fcc Revert "sched/psi: Fix avgs_work re-arm in psi_avgs_work()" * | d18fe3efda Revert "sched/psi: Rearrange polling code in preparation" * | 5b039dbb91 Revert "sched/psi: Rename existing poll members in preparation" * | ed063a7e76 Revert "sched/psi: Extract update_triggers side effect" * | 2c1e89916b Revert "sched/psi: Allow unprivileged polling of N*2s period" * | ffed79e366 Revert "sched/psi: use kernfs polling functions for PSI trigger polling" * | 8976ff249f Merge 6.1.42 into android14-6.1-lts |\| | * d2a6dc4eaf Linux 6.1.42 | * 1d4607f2a5 Revert "drm/amd/display: edp do not add non-edid timings" | * 2f2ba3c162 drm/amd/display: Add polling method to handle MST reply packet | * 78ea2ed76c drm/amd/display: fix linux dp link lost handled only one time | * b31143b0fb drm/amd/display: Clean up errors & warnings in amdgpu_dm.c | * c14702daf1 drm/amd/display: force connector state when bpc changes during compliance | * 00f68f5c1b drm/dp_mst: Clear MSG_RDY flag before sending new message | * c085ffaf67 drm/amd/display: fix some coding style issues | * 374735cbe2 drm/amd/display: use max_dsc_bpp in amdgpu_dm | * 268bfb3782 selftests/bpf: Fix sk_assign on s390x | * fd1e31d1bc selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code | * a7c1eb9cb8 selftests/bpf: make test_align selftest more robust | * 4c8f30a2ad bpf: aggressively forget precise markings during state checkpointing | * 8b57a37d0e bpf: stop setting precise in current state | * 56675ddcb0 bpf: allow precision tracking for programs with subprogs | * dd33fbe4af scripts/kallsyms: update the usage in the comment block | * 5fab8c91e5 scripts/kallsyms.c Make the comment up-to-date with current implementation | * 320f980bc0 kallsyms: add kallsyms_seqs_of_names to list of special symbols | * 7531eb07b2 spi: dw: Remove misleading comment for Mount Evans SoC | * 70a3015683 drm/ttm: fix bulk_move corruption when adding a entry | * 61622fa379 tracing/histograms: Return an error if we fail to add histogram to hist_vars list | * bae17da3ae jbd2: recheck chechpointing non-dirty buffer | * b9f0f20ab0 net: phy: prevent stale pointer dereference in phy_init() | * f311c76800 tcp: annotate data-races around fastopenq.max_qlen | * 01a1563a09 tcp: annotate data-races around icsk->icsk_user_timeout | * 918a1beb0a tcp: annotate data-races around tp->notsent_lowat | * b02f8fce7c tcp: annotate data-races around rskq_defer_accept | * 17c3d75833 tcp: annotate data-races around tp->linger2 | * e639397202 tcp: annotate data-races around icsk->icsk_syn_retries | * d27a1aa37e tcp: annotate data-races around tp->keepalive_probes | * 161b069389 tcp: annotate data-races around tp->keepalive_intvl | * 87b8466eb0 tcp: annotate data-races around tp->keepalive_time | * 2c84a3d78a tcp: annotate data-races around tp->tsoffset | * 949eb83880 tcp: annotate data-races around tp->tcp_tx_delay | * 0d4d6b083d Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() | * e969bfed84 Bluetooth: ISO: fix iso_conn related locking and validity issues | * 59bd1e476b Bluetooth: hci_event: call disconnect callback before deleting conn | * 13ad45ad14 Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync | * e18922ce3e netfilter: nf_tables: skip bound chain on rule flush | * ec3e856075 netfilter: nf_tables: skip bound chain in netns release path | * 90c3955beb netfilter: nft_set_pipapo: fix improper element removal | * f372992820 netfilter: nf_tables: can't schedule in nft_chain_validate | * 6026fa4f47 netfilter: nf_tables: fix spurious set element insertion failure | * c1dc350a37 ALSA: hda/realtek: Fix generic fixup definition for cs35l41 amp | * 050c24656a llc: Don't drop packet from non-root netns. | * 50e4b32d2e fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe | * a44ff12573 Revert "tcp: avoid the lookup process failing to get sk in ehash table" | * d1a4d697a9 net:ipv6: check return value of pskb_trim() | * 205bad1b30 net: ipv4: Use kfree_sensitive instead of kfree | * fac47182d3 tcp: annotate data-races around tcp_rsk(req)->ts_recent | * aa32235da4 tcp: annotate data-races around tcp_rsk(req)->txhash | * f62a00b7d1 net: ipv4: use consistent txhash in TIME_WAIT and SYN_RECV | * 1d8e3ec4f0 igc: Prevent garbled TX queue with XDP ZEROCOPY | * c0268bc0d7 igc: Avoid transmit queue timeout for XDP | * bb6ae775ff bpf, arm64: Fix BTI type used for freplace attached functions | * 8620c53ced bpf: Repeat check_max_stack_depth for async callbacks | * d55ff358b0 bpf: Fix subprog idx logic in check_max_stack_depth | * c355f3a27b octeontx2-pf: Dont allocate BPIDs for LBK interfaces | * 0f56bfe19a security: keys: Modify mismatched function name | * 3fc081eddd iavf: fix reset task race with iavf_remove() | * 2647ff59c5 iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies | * 9743519240 iavf: Wait for reset in callbacks which trigger it | * f43ab442a8 iavf: make functions static where possible | * 9e36533d66 iavf: send VLAN offloading caps once after VFR | * 5d1c0ac33d iavf: Move netdev_update_features() into watchdog task | * 6d9d01689b iavf: use internal state to free traffic IRQs | * 6e1d8f1332 iavf: Fix out-of-bounds when setting channels on remove | * ca12b98e04 iavf: Fix use-after-free in free_netdev | * ce3ec3fc64 net: dsa: microchip: correct KSZ8795 static MAC table access | * 54830adfd9 net: dsa: microchip: ksz8_r_sta_mac_table(): Avoid using error code for empty entries | * 8a60427c8a net: dsa: microchip: ksz8: Make ksz8_r_sta_mac_table() static | * e4820a764e net: dsa: microchip: ksz8: Separate static MAC table operations for code reuse | * 155f594534 net: sched: cls_bpf: Undo tcf_bind_filter in case of an error | * 2256b27f54 net: sched: cls_u32: Undo refcount decrement in case update failed | * a934579346 net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode | * fa753f8656 net: sched: cls_matchall: Undo tcf_bind_filter in case of failure after mall_set_parms | * 813572a08d ASoC: SOF: ipc3-dtrace: uninitialized data in dfsentry_trace_filter_write() | * c55901d381 cifs: fix mid leak during reconnection after timeout threshold | * 855643c8d2 net: ethernet: mtk_eth_soc: handle probe deferral | * 6924f3c898 bridge: Add extack warning when enabling STP in netns. | * 3325b8ddfe net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() | * 4148d6c766 dsa: mv88e6xxx: Do a final check before timing out | * f4c0a6b8ce kallsyms: strip LTO-only suffixes from promoted global functions | * 5004d383fe kallsyms: Correctly sequence symbols when CONFIG_LTO_CLANG=y | * 28fdfda791 kallsyms: Improve the performance of kallsyms_lookup_name() | * c401b72836 spi: s3c64xx: clear loopback bit after loopback test | * 9c85f71d3f btrfs: be a bit more careful when setting mirror_num_ret in btrfs_map_block | * 08bdd70974 perf build: Fix library not found error when using CSLIBS | * 6aa851f627 fbdev: imxfb: Removed unneeded release_mem_region | * e7bb9436ea fbdev: imxfb: warn about invalid left/right margin | * 7a2d80a8c2 spi: bcm63xx: fix max prepend length | * 6af800f917 pinctrl: renesas: rzg2l: Handle non-unique subnode names | * be087281dc pinctrl: renesas: rzv2m: Handle non-unique subnode names | * 92cc015332 sched/psi: use kernfs polling functions for PSI trigger polling | * d5dca19776 sched/psi: Allow unprivileged polling of N*2s period | * fb4bc32fc1 sched/psi: Extract update_triggers side effect | * c1623d4d0b sched/psi: Rename existing poll members in preparation | * c176dda0a6 sched/psi: Rearrange polling code in preparation | * 7d8bba4da1 sched/psi: Fix avgs_work re-arm in psi_avgs_work() | * 45f739e8fb sched/fair: Use recent_used_cpu to test p->cpus_ptr | * 6ede0d0f88 ASoC: qcom: q6apm: do not close GPR port before closing graph | * 5da98d0438 ASoC: codecs: wcd938x: fix dB range for HPHL and HPHR | * e3495bc994 ASoC: codecs: wcd938x: fix mbhc impedance loglevel | * 3122e90b5c ASoC: amd: acp: fix for invalid dai id handling in acp_get_byte_count() | * da64c8889f net: hns3: fix strncpy() not using dest-buf length as length issue | * 39695e87d8 igb: Fix igb_down hung on surprise removal | * 6887f35881 wifi: iwlwifi: pcie: add device id 51F1 for killer 1675 | * 6862557e9a wifi: iwlwifi: mvm: avoid baid size integer overflow | * a46a624914 wifi: iwlwifi: Add support for new PCI Id | * 8e0a94e31a wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() | * 408d40c729 devlink: report devlink_port_type_warn source device | * 0d14264155 net: ethernet: litex: add support for 64 bit stats | * 86f9330a49 wifi: ath11k: fix memory leak in WMI firmware stats | * 766e606536 spi: dw: Add compatible for Intel Mount Evans SoC | * d0124848c7 wifi: mac80211_hwsim: Fix possible NULL dereference | * 8656b31d2e wifi: ath11k: add support default regdb while searching board-2.bin for WCN6855 | * 4e291a07af bpf: tcp: Avoid taking fast sock lock in iterator | * c006fe361c bpf: Address KCSAN report on bpf_lru_list | * 10fa03a9c1 bpf: Print a warning only if writing to unprivileged_bpf_disabled. | * 8d1342108c wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range | * 78a5f711ef sched/fair: Don't balance task to its current running CPU | * 896f4d6046 rcu: Mark additional concurrent load from ->cpu_no_qs.b.exp | * 9027d69221 rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() | * e055d0ec88 ACPI: video: Add backlight=native DMI quirk for Dell Studio 1569 | * aa7cdf487a FS: JFS: Check for read-only mounted filesystem in txBegin | * 3e5eb6c5ec FS: JFS: Fix null-ptr-deref Read in txBegin | * da0a7c6975 MIPS: dec: prom: Address -Warray-bounds warning | * bdf07ab159 fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev | * a682414980 udf: Fix uninitialized array access for some pathnames | * cce9107c31 ovl: check type and offset of struct vfsmount in ovl_entry | * 5228d4d505 HID: add quirk for 03f0:464a HP Elite Presenter Mouse | * 6432843deb quota: fix warning in dqgrab() | * 1f2ec87f4a quota: Properly disable quotas when add_dquot_ref() fails | * 2a97ec7809 ALSA: emu10k1: roll up loops in DSP setup code for Audigy | * 2e1be420b8 drm/radeon: Fix integer overflow in radeon_cs_parser_init | * 0ca3768534 ext4: correct inline offset when handling xattrs in inode body | * aba8f85eca ASoC: codecs: wcd938x: fix soundwire initialisation race | * 1a261a4193 ASoC: codecs: wcd938x: fix codec initialisation race | * 8b11d2f0e5 ASoC: codecs: wcd934x: fix resource leaks on component remove | * bb241ae928 ASoC: codecs: wcd938x: fix missing mbhc init error handling | * 4eac89ffc5 ASoC: codecs: wcd938x: fix resource leaks on component remove | * c584b5eca3 ASoC: tegra: Fix AMX byte map | * d55fc2bdaa ASoC: qdsp6: audioreach: fix topology probe deferral | * 17feff71d0 ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove | * b0fbf3c353 ASoC: codecs: wcd938x: fix missing clsh ctrl error handling | * 1dd61a5b5c ASoC: cs42l51: fix driver to properly autoload with automatic module loading | * 0e3cf64324 ASoC: rt5640: Fix sleep in atomic context | * e5b2389e04 ASoC: tegra: Fix ADX byte map | * 24bed70aa6 ASoC: fsl_sai: Revert "ASoC: fsl_sai: Enable MCTL_MCLK_EN bit for master mode" | * 6518812877 ASoC: fsl_sai: Disable bit clock with transmitter | * b9741ba942 drm/amd/display: Keep PHY active for DP displays on DCN31 | * 889bac5fd7 drm/amd/display: check TG is non-null before checking if enabled | * 9f28e8c2be drm/amd/display: Disable MPC split by default on special asic | * 4385420741 drm/amd/display: only accept async flips for fast updates | * 917bef37cf drm/client: Fix memory leak in drm_client_modeset_probe | * b5359d7a50 drm/client: Fix memory leak in drm_client_target_cloned | * 91bd7acf89 drm/amdgpu/pm: make mclk consistent for smu 13.0.7 | * 0b4f3d9a5c drm/amdgpu/pm: make gfxclock consistent for sienna cichlid | * 13cb7bfbcc drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel | * 19e7b9f1f7 dma-buf/dma-resv: Stop leaking on krealloc() failure | * 25ad249699 selftests: tc: add ConnTrack procfs kconfig | * 54950747d5 can: gs_usb: gs_can_open(): improve error handling | * 995f47d766 can: bcm: Fix UAF in bcm_proc_show() | * a2d31762d7 can: mcp251xfd: __mcp251xfd_chip_set_mode(): increase poll timeout | * aa5cf8bd13 arm64/fpsimd: Ensure SME storage is allocated after SVE VL changes | * 3e463a4f38 regmap: Account for register length in SMBus I/O limits | * ef7ad397fb of: Preserve "of-display" device name for compatibility | * f16c2eb694 regmap: Drop initial version of maximum transfer length fixes | * efeac348cd selftests: tc: add 'ct' action kconfig dep | * 4986dd1b51 selftests: tc: set timeout to 15 minutes | * ddf7e8984c btrfs: fix race between balance and cancel/pause | * c828e913c8 fuse: ioctl: translate ENOSYS in outarg | * c35ea60619 btrfs: zoned: fix memory leak after finding block group with super blocks | * 0a5e0bc8e8 btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand | * 549f5093e9 fuse: Apply flags2 only when userspace set the FUSE_INIT_EXT | * af6d1fc5b8 fuse: revalidate: don't invalidate if interrupted | * 89e994688e btrfs: fix warning when putting transaction with qgroups enabled after abort | * c1b3d1a9c6 perf probe: Add test for regression introduced by switch to die_get_decl_file() | * 00edfa6d4f keys: Fix linking a duplicate key to a keyring's assoc_array | * 4984a10a21 maple_tree: fix node allocation testing on 32 bit | * 85718972b0 maple_tree: set the node limit when creating a new root node | * e0c3e25cfc ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx | * 0f493b5bfe ALSA: hda/realtek: Add quirk for Clevo NS70AU | * 7ed4e52973 ALSA: hda/realtek - remove 3k pull low procedure | * 1b87f546a0 io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq * | b2d799c4d4 Merge 6.1.41 into android14-6.1-lts |\| | * 5302e81aa2 Linux 6.1.41 | * ed9b87010a x86/cpu/amd: Add a Zenbleed fix | * 5fc203d8d3 x86/cpu/amd: Move the errata checking functionality up * | f12524c9de Revert "Revert "8250: add support for ASIX devices with a FIFO bug"" * | f1311733c2 Merge 6.1.40 into android14-6.1-lts |\| | * 7538911373 Linux 6.1.40 | * 9879d6e1ca net/ncsi: change from ndo_set_mac_address to dev_set_mac_address | * e2c3356907 net/ncsi: make one oem_gma function for all mfr id | * e4a0e09b79 drm/atomic: Fix potential use-after-free in nonblocking commits | * d34a3470ed net/sched: sch_qfq: reintroduce lmax bound check for MTU | * ff06cd411a swiotlb: mark swiotlb_memblock_alloc() as __init | * d64b70df23 Revert "drm/amd: Disable PSR-SU on Parade 0803 TCON" | * fbfb6b7cb2 MIPS: kvm: Fix build error with KVM_MIPS_DEBUG_COP0_COUNTERS enabled | * fec55ec035 scsi: qla2xxx: Fix end of loop test | * f459d586fd scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue | * b06d1b5253 scsi: qla2xxx: Pointer may be dereferenced | * b88b1241fb scsi: qla2xxx: Correct the index of array | * e466930717 scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() | * ce2cdbe530 scsi: qla2xxx: Fix potential NULL pointer dereference | * 2dddbf8de1 scsi: qla2xxx: Fix buffer overrun | * 477bc74ad1 scsi: qla2xxx: Avoid fcport pointer dereference | * 2b3bdef089 scsi: qla2xxx: Array index may go out of bound | * d994ac7c78 scsi: qla2xxx: Fix mem access after free | * 90770dad1e scsi: qla2xxx: Wait for io return on terminate rport | * 1802e5d098 scsi: qla2xxx: Fix hang in task management | * 35985b0741 scsi: qla2xxx: Fix task management cmd fail due to unavailable resource | * 843665c426 scsi: qla2xxx: Fix task management cmd failure | * ff92567d90 scsi: qla2xxx: Multi-que support for TMF | * 95e34129f3 tracing/user_events: Fix struct arg size match check | * a95c1fede2 tracing/probes: Fix to update dynamic data counter if fetcharg uses it | * 837f92d27f tracing/probes: Fix not to count error code to total length | * 2f41d35b58 selftests: mptcp: pm_nl_ctl: fix 32-bit support | * ee352299a6 selftests: mptcp: depend on SYN_COOKIES | * 08daab11f3 selftests: mptcp: userspace_pm: report errors with 'remove' tests | * 4098a43182 selftests: mptcp: userspace_pm: use correct server port | * c118baa05f selftests: mptcp: sockopt: return error if wrong mark | * 671486793f selftests: mptcp: connect: fail if nft supposed to work | * 938d5b7a75 tracing: Fix null pointer dereference in tracing_err_log_open() | * fbcd0c2b56 fprobe: Ensure running fprobe_exit_handler() finished before calling rethook_free() | * ce3ec57faf fprobe: Release rethook after the ftrace_ops is unregistered | * 2e9a46e467 pwm: meson: fix handling of period/duty if greater than UINT_MAX | * ba1ede19e6 pwm: meson: modify and simplify calculation in meson_pwm_get_state | * 9a2c57fd32 PM: QoS: Restore support for default value on frequency QoS | * 15ec83da43 perf/x86: Fix lockdep warning in for_each_sibling_event() on SPR | * 22fc9fd723 xtensa: ISS: fix call to split_if_spec | * 6a05de6da5 cifs: if deferred close is disabled then close files immediately | * bd8cd38d3a drm/amd/pm: conditionally disable pcie lane/speed switching for SMU13 | * 11dc77a645 drm/amd/pm: share the code around SMU13 pcie parameters update | * 99fe81d219 ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() | * 8b0b63fdac ring-buffer: Fix deadloop issue on reading trace_pipe | * 90947ebf87 net: ena: fix shift-out-of-bounds in exponential backoff | * b1a726ad33 regmap-irq: Fix out-of-bounds access when allocating config buffers | * aeb62beaf9 perf: RISC-V: Remove PERF_HES_STOPPED flag checking in riscv_pmu_start() | * e2c7a05a48 samples: ftrace: Save required argument registers in sample trampolines | * 9d6a260bbf nvme: don't reject probe due to duplicate IDs for single-ported PCIe devices | * be970e22c5 tracing: Fix memory leak of iter->temp when reading trace_pipe | * 5fd32eb6fa tracing/histograms: Add histograms to hist_vars if they have referenced variables | * 0a1dc6377a dm: verity-loadpin: Add NULL pointer check for 'bdev' parameter | * 08aaeda414 s390/decompressor: fix misaligned symbol build error | * 2ebf4ddcc6 bus: ixp4xx: fix IXP4XX_EXP_T1_MASK | * 599c0ebdb5 Revert "8250: add support for ASIX devices with a FIFO bug" | * 801daff007 soundwire: qcom: fix storing port config out-of-bounds | * 76ab057de7 opp: Fix use-after-free in lazy_opp_tables after probe deferral | * be06ffa8f4 meson saradc: fix clock divider mask length | * 610ddd79fc xhci: Show ZHAOXIN xHCI root hub speed correctly | * 892ef75930 xhci: Fix TRB prefetch issue of ZHAOXIN hosts | * 8e273a2190 xhci: Fix resume issue of some ZHAOXIN hosts | * 8293614798 ceph: don't let check_caps skip sending responses for revoke msgs | * 0471d907d8 ceph: fix blindly expanding the readahead windows | * d545ff97cf ceph: add a dedicated private data for netfs rreq | * 183c0ae4fa libceph: harden msgr2.1 frame segment length checks | * cb8a31a56d firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool() | * 5553d587a3 tty: serial: imx: fix rs485 rx after tx | * f0bf102ef9 tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk | * 34f5b826dd tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error | * 9fd9e1d098 serial: atmel: don't enable IRQs prematurely | * f037f60387 drm/ttm: Don't leak a resource on swapout move error | * fe26d0fa94 drm/amdgpu: avoid restore process run into dead loop. | * 8404d0e274 drm/amd/display: Add monitor specific edid quirk | * 7ad40467fd drm/amd/display: Correct `DMUB_FW_VERSION` macro | * ad85fc99d6 drm/amd/display: add a NULL pointer check | * 3092beeb25 drm/amd: Disable PSR-SU on Parade 0803 TCON | * 91e69e67d4 drm/amdgpu: fix clearing mappings for BOs that are always valid in VM | * 3546f76c7a drm/amd/display: disable seamless boot if force_odm_combine is enabled | * a2ef3163c3 drm/amd/display: Remove Phantom Pipe Check When Calculating K1 and K2 | * c4629c7575 drm/amd/display: edp do not add non-edid timings | * 31fb25ecbb drm/amd/display: fix seamless odm transitions | * c41963e50a drm/rockchip: vop: Leave vblank enabled in self-refresh | * db0a9a2991 drm/atomic: Allow vblank-enabled + self-refresh "disable" | * 6436ca035b scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() | * 7adcc32eb5 fs: dlm: fix mismatch of plock results from userspace | * adeaef5a00 fs: dlm: make F_SETLK use unkillable wait_event | * 2a37d73395 fs: dlm: interrupt posix locks only when process is killed | * a1b6adf4b1 fs: dlm: fix cleanup pending ops when interrupted | * 3346ffdee4 fs: dlm: return positive pid value for F_GETLK | * be19cb6716 dm init: add dm-mod.waitfor to wait for asynchronously probed block devices | * e30128926a md/raid0: add discard support for the 'original' layout | * 31df8b9609 mfd: pm8008: Fix module autoloading | * 7ef181f84e misc: pci_endpoint_test: Re-init completion for every test | * c2dba13bc0 misc: pci_endpoint_test: Free IRQs before removing the device | * 0813bb2f2c PCI: rockchip: Set address alignment for endpoint mode | * 5b15ebec56 PCI: rockchip: Use u32 variable to access 32-bit registers | * 1a48294ade PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core | * dfd20ebcae PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked | * 05f55f7530 PCI: rockchip: Write PCI Device ID to correct register | * b2e2ffbfd3 PCI: rockchip: Assert PCI Configuration Enable bit after probe | * 07d997ef10 PCI: epf-test: Fix DMA transfer completion detection | * bcd276f143 PCI: epf-test: Fix DMA transfer completion initialization | * cf0d7b7270 PCI: qcom: Disable write access to read only registers for IP v2.3.3 | * c459365ec7 PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 | * 465c195e86 PCI: Release resource invalidated by coalescing | * 3367d4be9b PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold | * 25cb64ecc3 s390/zcrypt: do not retry administrative requests | * 026e46d26a scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O | * b933df9dda dm integrity: reduce vmalloc space footprint on 32-bit architectures | * ef709350ef hwrng: imx-rngc - fix the timeout for init and self check | * c7feb54b11 jfs: jfs_dmap: Validate db_l2nbperpage while mounting | * 9e54fd14bd ext2/dax: Fix ext2_setsize when len is page aligned | * 33f8dff6e1 soc: qcom: mdt_loader: Fix unconditional call to scm_pas_mem_setup | * 5dc507de0c fs: dlm: revert check required context while close | * 95d49f79e9 ext4: only update i_reserved_data_blocks on successful block allocation | * deef86fa30 ext4: turn quotas off if mount failed after enabling quotas | * 029c6b106f ext4: fix to check return value of freeze_bdev() in ext4_shutdown() | * e861961f3a ext4: fix wrong unit use in ext4_mb_new_blocks | * 2038d35749 ext4: get block from bh in ext4_free_blocks for fast commit replay | * 782166ac85 ext4: fix wrong unit use in ext4_mb_clear_bb | * 0a90e70efa ext4: Fix reusing stale buffer heads from last failed mounting | * bd9cf2a5f9 MIPS: KVM: Fix NULL pointer dereference | * d56b7a43a2 MIPS: Loongson: Fix cpu_probe_loongson() again | * 58d1c81307 powerpc/64s: Fix native_hpte_remove() to be irq-safe | * 484b8fb1ff powerpc/security: Fix Speculation_Store_Bypass reporting on Power10 | * 23ab732b96 misc: fastrpc: Create fastrpc scalar with correct buffer count | * 16eceb3959 powerpc: Fail build if using recordmcount with binutils v2.37 | * 5aea2ac374 tracing/user_events: Fix incorrect return value for writing operation when events are disabled | * a4336343ea kasan: add kasan_tag_mismatch prototype | * 6d806841f1 net: phy: dp83td510: fix kernel stall during netboot in DP83TD510E PHY driver | * eac0aac07f net: bcmgenet: Ensure MDIO unregistration has clocks enabled | * de67dadd5c mtd: rawnand: meson: fix unaligned DMA buffers handling | * bb4e824d6b tpm: return false from tpm_amd_is_rng_defective on non-x86 platforms | * ad249709d2 tpm: tis_i2c: Limit write bursts to I2C_SMBUS_BLOCK_MAX (32) bytes | * f5a734a689 tpm: tis_i2c: Limit read bursts to I2C_SMBUS_BLOCK_MAX (32) bytes | * 99b998fb9d tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation | * 0028313700 tpm: Do not remap from ACPI resources again for Pluton TPM | * 6d8488509e pinctrl: amd: Unify debounce handling into amd_pinconf_set() | * dce19c966d pinctrl: amd: Drop pull up select configuration | * 326b3f17be pinctrl: amd: Use amd_pinconf_set() for all config options | * 3cadcab402 pinctrl: amd: Only use special debounce behavior for GPIO 0 | * 57f6d48af4 pinctrl: amd: Revert "pinctrl: amd: disable and mask interrupts on probe" | * 1cd1a0151f pinctrl: amd: Detect and mask spurious interrupts | * 1516518794 pinctrl: amd: Fix mistake in handling clearing pins at startup | * 8a2d8e17c7 pinctrl: amd: Detect internal GPIO0 debounce handling | * 4484ce0e49 pinctrl: amd: Add fields for interrupt status and wake status | * a56afed6d5 pinctrl: amd: Adjust debugfs output | * 03590f9be9 pinctrl: amd: Add Z-state wake control bits | * a996fec74c f2fs: fix deadlock in i_xattr_sem and inode page lock | * 2cb10f4e6c f2fs: fix the wrong condition to determine atomic context | * 13e8af958c drm/amd/pm: add abnormal fan detection for smu 13.0.0 | * e8b6b7b813 drm/amdgpu: Fix minmax warning | * d7d53c669d drm/amdgpu: add the fan abnormal detection feature | * c8c703befd drm/amd/pm: revise the ASPM settings for thunderbolt attached scenario | * 4596c81291 drm/amdgpu/sdma4: set align mask to 255 | * 7c880188c7 drm/client: Send hotplug event after registering a client | * 40e2ed0e56 cifs: fix session state check in smb2_find_smb_ses | * c4a5fb1ae5 ovl: fix null pointer dereference in ovl_get_acl_rcu() | * 06b3f0bf41 ovl: let helper ovl_i_path_real() return the realinode | * 000a9a72ef fs/ntfs3: Check fields while reading | * bf2f2c059f nvme-pci: fix DMA direction of unmapping integrity data | * 70feebdbfa net/sched: sch_qfq: account for stab overhead in qfq_enqueue | * 4b33836824 net/sched: sch_qfq: refactor parsing of netlink parameters | * 0aec8dab2b wifi: rtw89: debug: fix error code in rtw89_debug_priv_send_h2c_set() | * 3d1dc71b8f net/sched: make psched_mtu() RTNL-less safe | * 1c806e4066 netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write() | * 1b125be4e0 riscv: mm: fix truncation warning on RV32 | * 174cfa0317 net/sched: flower: Ensure both minimum and maximum ports are specified | * b11a9b4f28 bpf: cpumap: Fix memory leak in cpu_map_update_elem | * 4719576d6e wifi: airo: avoid uninitialized warning in airo_get_rate() | * 9e6474e5d7 erofs: fix fsdax unavailability for chunk-based regular files | * dc8158a95f erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF | * 83879f72e0 erofs: avoid useless loops in z_erofs_pcluster_readmore() when reading beyond EOF | * 27272795a7 octeontx2-pf: Add additional check for MCAM rules | * 5a9aecb665 drm/i915: Fix one wrong caching mode enum usage | * f1e746aedd drm/i915: Don't preserve dpll_hw_state for slave crtc in Bigjoiner | * ba05762e4a riscv, bpf: Fix inconsistent JIT image generation | * 13a30e22ea nvme: fix the NVME_ID_NS_NVM_STS_MASK definition | * 66afb6a54e igc: Fix inserting of empty frame for launchtime | * 1b87509ef6 igc: Fix launchtime before start of cycle | * f92a82dc48 kernel/trace: Fix cleanup logic of enable_trace_eprobe | * 7772d5c440 platform/x86: wmi: Break possible infinite loop when parsing GUID | * 89726b0303 net: dsa: qca8k: Add check for skb_copy | * 436b7cc7ea ipv6/addrconf: fix a potential refcount underflow for idev | * 5554414227 NTB: ntb_tool: Add check for devm_kcalloc | * 8d7b875866 NTB: ntb_transport: fix possible memory leak while device_register() fails | * bece67815a ntb: intel: Fix error handling in intel_ntb_pci_driver_init() | * d4317d41f0 NTB: amd: Fix error handling in amd_ntb_pci_driver_init() | * 4e5daadf8c ntb: idt: Fix error handling in idt_pci_driver_init() | * 360db93beb udp6: fix udp6_ehashfn() typo | * 1462e9d9aa icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). | * 1731234e8b net: prevent skb corruption on frag list segmentation | * 685b57a122 net: bgmac: postpone turning IRQs off to avoid SoC hangs | * dc47046675 ionic: remove WARN_ON to prevent panic_on_warn | * 6cc293d29c octeontx2-af: Move validation of ptp pointer before its usage | * bb56b7905b octeontx2-af: Promisc enable/disable through mbox | * 2b4086a66a gve: Set default duplex configuration to full | * c91fb29bb0 net/sched: cls_fw: Fix improper refcount update leads to use-after-free | * 831fbc2065 net: mvneta: fix txq_map in case of txq_number==1 | * b2e74dedb0 bpf: Fix max stack depth check for async callbacks | * 714d81a5c4 scsi: ufs: ufs-mediatek: Add dependency for RESET_CONTROLLER | * 574d5236a8 scsi: qla2xxx: Fix error code in qla2x00_start_sp() | * 49f6ac6f1c blk-crypto: use dynamic lock class for blk_crypto_profile::lock | * d752be635b igc: Handle PPS start time programming for past time values | * 246fc961c8 igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings | * e962fd5933 net/mlx5e: Check for NOT_READY flag state after locking | * 83a8f7337a net/mlx5e: fix memory leak in mlx5e_ptp_open | * 75df2fe6d1 net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create | * 7ca1914cbd net/mlx5e: fix double free in mlx5e_destroy_flow_table | * 68b654e9eb igc: Remove delay during TX ring configuration | * dfaed769b9 ice: Fix max_rate check while configuring TX rate limits | * 1294311ce9 drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags | * fd5b64c1cf swiotlb: reduce the number of areas to match actual memory pool size | * fc3db7fbdf swiotlb: reduce the swiotlb buffer size on allocation failure | * 24b24863a0 swiotlb: always set the number of areas before allocating the pool | * 02d43b8a4f drm/bridge: ti-sn65dsi86: Fix auxiliary bus lifetime | * d48029c655 drm/panel: simple: Add connector_type for innolux_at043tn24 | * ef572ffa8e ksmbd: fix out of bounds read in smb2_sess_setup | * 869ef4f296 ksmbd: add missing compound request handing in some commands | * 2d57a1590f workqueue: clean up WORK_* constant types, clarify masking | * 4b5ab640aa net: lan743x: Don't sleep in atomic context | * 5a45ed1ae3 HID: amd_sfh: Fix for shift-out-of-bounds | * d0b30d8e4d HID: amd_sfh: Rename the float32 variable * | bd041b5977 ANDROID: GKI: Fix block/genhd.c exports from having their CRC changed * | c0e5631df8 Revert "blk-mq: fix potential io hang by wrong 'wake_batch'" * | c057db2f88 Revert "bpf: Remove bpf trampoline selector" * | 17f0b3c7ee Revert "drm/bridge: Introduce pre_enable_prev_first to alter bridge init order" * | b3c3fc85c7 Revert "drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec" * | b435525822 Merge 6.1.39 into android14-6.1-lts |\| | * a456e17438 Linux 6.1.39 | * f32dfc802e io_uring: Use io_schedule* in cqring wait | * c55b552e0b sh: hd64461: Handle virq offset for offchip IRQ base and HD64461 IRQ | * 0ff5d219eb sh: mach-dreamcast: Handle virq offset in cascaded IRQ demux | * 5628b9aa31 sh: mach-highlander: Handle virq offset in cascaded IRL demux | * fe7daa313d sh: mach-r2d: Handle virq offset in cascaded IRL demux | * 899cc8f798 block/partition: fix signedness issue for Amiga partitions | * da012a025f tty: serial: fsl_lpuart: add earlycon for imx8ulp platform | * 3173bfdf89 wireguard: netlink: send staged packets when setting initial private key | * 561aaadf0d wireguard: queueing: use saner cpu selection wrapping | * 40f83dd66a netfilter: nf_tables: prevent OOB access in nft_byteorder_eval | * fc95c8b02c netfilter: nf_tables: do not ignore genmask when looking up chain by id | * 05561f822f netfilter: conntrack: Avoid nf_ct_helper_hash uses after free | * f145373334 netfilter: nf_tables: unbind non-anonymous set if rule construction fails | * ad2928e7f3 mtd: parsers: refer to ARCH_BCMBCA instead of ARCH_BCM4908 | * 1bdcffaa0d drm/i915/tc: Fix system resume MST mode restore for DP-alt sinks | * 99025116f5 drm/i915/tc: Fix TC port link ref init for DP MST during HW readout | * eaa0043a85 drm/i915: Fix TypeC mode initialization during system resume | * a02c6dc0ef mm/mmap: Fix extra maple tree write | * 9222068bc8 xfs: fix xfs_inodegc_stop racing with mod_delayed_work | * 1b20685295 xfs: disable reaping in fscounters scrub | * 25c1991f9f xfs: check that per-cpu inodegc workers actually run on that cpu | * f6e37e2400 xfs: explicitly specify cpu when forcing inodegc delayed work to run immediately | * 6b7c52f373 fs: no need to check source | * d53879f54b blktrace: use inline function for blk_trace_remove() while blktrace is disabled | * ab0bd172d6 leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename | * 9077ec19ad ARM: orion5x: fix d2net gpio initialization | * 600b51aa44 ARM: dts: qcom: ipq4019: fix broken NAND controller properties override | * 9030a7e836 regulator: tps65219: Fix matching interrupts for their regulators | * d9eaa90d7d ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path | * 1c9b356bbe ASoC: mediatek: mt8173: Fix irq error path | * 3929b5dd8f btrfs: do not BUG_ON() on tree mod log failure at __btrfs_cow_block() | * bc662a1e1f btrfs: fix extent buffer leak after tree mod log failure at split_node() | * a53d78d9a8 btrfs: fix race when deleting quota root from the dirty cow roots list | * 9634e5360b btrfs: reinsert BGs failed to reclaim | * d9f1e518ab btrfs: add block-group tree to lockdep classes | * 3702c5342c btrfs: bail out reclaim process if filesystem is read-only | * 8560861095 btrfs: delete unused BGs while reclaiming BGs | * 4fadf53fa9 btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile | * 8fcb478b55 ipvs: increase ip_vs_conn_tab_bits range for 64BIT | * 759e582b1c usb: typec: ucsi: Mark dGPUs as DEVICE scope | * f2a6ce3eec i2c: nvidia-gpu: Remove ccgx,firmware-build property | * 7b67af8dea i2c: nvidia-gpu: Add ACPI property to align with device-tree | * f40d621387 fs: Lock moved directories | * 10c159f994 fs: Establish locking order for unrelated directories | * 6654d2a165 Revert "f2fs: fix potential corruption when moving a directory" | * 6aaa22ec73 ext4: Remove ext4 locking of moved directory | * 606e463eef fs: avoid empty option when generating legacy mount string | * 6df680709d jffs2: reduce stack usage in jffs2_build_xattr_subsystem() | * 1f34bf8b44 shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs | * 23fbff67b0 mm/damon/ops-common: atomically test and clear young on ptes and pmds | * 33893c6c1f autofs: use flexible array in ioctl structure | * cd52323ac4 integrity: Fix possible multiple allocation in integrity_inode_get() | * 0cbbb029ff um: Use HOST_DIR for mrproper | * 219a9ec09d watch_queue: prevent dangling pipe pointer | * 7ecea5ce3d bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent | * 68118c339c bcache: Remove unnecessary NULL point check in node allocations | * 25ec4779d0 bcache: fixup btree_cache_wait list damage | * 97ccc14d11 wifi: mt76: mt7921e: fix init command fail with enabled device | * d8985a0e44 wifi: ath10k: Serialize wake_tx_queue ops | * 1a312d5a8c wifi: cfg80211: fix regulatory disconnect for non-MLO | * 5b2b6586c5 mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used. | * 30c5f362b6 mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS | * 69bc320351 mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M | * 182bf07a24 mmc: core: disable TRIM on Kingston EMMC04G-M627 | * b50d6e06cc io_uring: wait interruptibly for request completions on exit | * 9440b24fbc irqchip/loongson-pch-pic: Fix initialization of HT vector register | * 2b4e43b5ad NFSD: add encoding of op_recall flag for write delegation | * f672f2ca9d irqchip/loongson-pch-pic: Fix potential incorrect hwirq assignment | * 8753eeb2d3 i2c: qup: Add missing unwind goto in qup_i2c_probe() | * b990e37603 btrfs: do not BUG_ON() on tree mod log failure at balance_level() | * 2445a35d05 extcon: usbc-tusb320: Unregister typec port on driver removal | * ee08e1fc94 extcon: usbc-tusb320: Convert to i2c's .probe_new() | * d5eb0375d7 dm ioctl: Avoid double-fetch of version | * 2798779419 dm ioctl: have constant on the right side of the test | * fd4497aca3 dm: avoid split of quoted strings where possible | * 0783867a30 dm: fix undue/missing spaces | * 15970b0828 i2c: xiic: Don't try to handle more interrupt events after error | * e9fbb7c2f6 apparmor: fix missing error check for rhashtable_insert_fast | * 8fb11fa480 sh: dma: Fix DMA channel offset calculation | * b837c69236 s390/qeth: Fix vipa deletion | * f5ea303502 afs: Fix accidental truncation when storing data | * 4a141c3c03 octeontx-af: fix hardware timestamp configuration | * 947d741adf net: dsa: sja1105: always enable the send_meta options | * 079dc659e3 net: dsa: tag_sja1105: fix MAC DA patching from meta frames | * 97a6d99c54 pptp: Fix fib lookup calls. | * 0a1b80ff4f riscv: move memblock_allow_resize() after linear mapping is ready | * 78c6cf1dc7 fanotify: disallow mount/sb marks on kernel internal pseudo fs | * 18d78c5552 net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX | * 67eb4aee2c xsk: Honor SO_BINDTODEVICE on bind | * 6baa6e4836 bpf, btf: Warn but return no error for NULL btf from __register_btf_kfunc_id_set() | * cd398daabe tcp: annotate data races in __tcp_oow_rate_limited() | * ced61418f4 net: fix net_dev_start_xmit trace event vs skb_transport_offset() | * 6469dc1c13 net: dsa: tag_sja1105: fix source port decoding in vlan_filtering=0 bridge mode | * fd03500476 net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode | * d50baa75c6 powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node | * d33b0ddf7a powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y | * c86a2517df ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() | * a5485a9431 octeontx2-af: Add validation before accessing cgx and lmac | * bd246c92d2 octeontx2-af: Fix mapping for NIX block from CGX connection | * c2c5c6d2c4 f2fs: fix error path handling in truncate_dnode() | * cfdb9c1a74 mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 | * 4033b47642 drm/amd: Don't try to enable secure display TA multiple times | * 0d4e60e23c drm/amdgpu: fix number of fence calculations | * d3dcdb43c8 spi: bcm-qspi: return error if neither hif_mspi nor mspi is available | * d4f5b1dd81 mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init | * 0b24d3e4b9 net: dsa: vsc73xx: fix MTU configuration | * f67ef8f9f6 ibmvnic: Do not reset dql stats on NON_FATAL err | * c07efe4dbc Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable | * 40ca66eef3 Bluetooth: MGMT: Use BIT macro when defining bitfields | * 1a7f268ccc Bluetooth: MGMT: add CIS feature bits to controller information | * 4aa515393f Bluetooth: ISO: use hci_sync for setting CIG parameters | * 018b12ff16 Bluetooth: fix invalid-bdaddr quirk for non-persistent setup | * 102f3555ce Add MODULE_FIRMWARE() for FIRMWARE_TG357766. | * f721042447 net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT | * 060d36670d net: dsa: sja1105: always enable the INCL_SRCPT option | * 2f99d19dc6 net: dsa: felix: don't drop PTP frames with tag_8021q when RX timestamping is disabled | * e9dda2b68c net: mscc: ocelot: don't keep PTP configuration of all ports in single structure | * 7826202689 net: mscc: ocelot: don't report that RX timestamping is enabled by default | * a252547c89 spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode | * 946edfb7d4 net/sched: act_ipt: add sanity checks on skb before calling target | * a6c9b0f7ba net: add a couple of helpers for iph tot_len | * 201948effa net/sched: act_ipt: add sanity checks on table name and hook locations | * 1aa5a6a6d2 sctp: fix potential deadlock on &net->sctp.addr_wq_lock | * 9dbcfc01d6 media: cec: i2c: ch7322: also select REGMAP | * 0623f13959 f2fs: check return value of freeze_super() | * dcb526d768 drm/i915/guc/slpc: Apply min softlimit correctly | * 61070305d5 drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake times | * df53f7a3db rtc: st-lpc: Release some resources in st_rtc_probe() in case of error | * 3781d0e6c1 md/raid10: fix the condition to call bio_end_io_acct() | * 07e81c9208 pwm: mtk_disp: Fix the disable flow of disp_pwm | * 75439e6cd2 pwm: ab8500: Fix error code in probe() | * 61aad933e5 pwm: sysfs: Do not apply state to already disabled PWMs | * c8fa254b77 pwm: imx-tpm: force 'real_period' to be zero in suspend | * 29ddfd5460 lib/bitmap: drop optimization of bitmap_{from,to}_arr64 | * d986fb02a1 phy: tegra: xusb: check return value of devm_kzalloc() | * 055ea8efdf mfd: stmpe: Only disable the regulators if they are enabled | * f7d56de13c hwtracing: hisi_ptt: Fix potential sleep in atomic context | * 34eef9e8c8 clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags | * 94f3bcfcd1 misc: fastrpc: check return value of devm_kasprintf() | * 7e3ee25e8c cpufreq: mediatek: correct voltages for MT7622 and MT7623 | * 86bfb18bad KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler | * c78ad1060c KVM: s390: vsie: fix the length of APCB bitmap | * e716693f02 mfd: stmfx: Nullify stmfx->vdd in case of error | * 18abe5f4c3 mfd: stmfx: Fix error path in stmfx_chip_init | * 5bd9dc3e76 bus: fsl-mc: don't assume child devices are all fsl-mc devices | * e27948f329 nvmem: rmem: Use NVMEM_DEVID_AUTO | * 2791847940 nvmem: sunplus-ocotp: release otp->clk before return | * e3a71d821e drivers: fwnode: fix fwnode_irq_get[_byname]() | * 51ae92e329 device property: Clarify description of returned value in some functions | * 73209e3f8a device property: Fix documentation for fwnode_get_next_parent() | * 852659fe83 serial: 8250_omap: Use force_suspend and resume for system suspend | * e348173400 Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection" | * 22b1e2af69 mfd: intel-lpss: Add missing check for platform_get_resource | * 2e8ab68460 mfd: wcd934x: Fix an error handling path in wcd934x_slim_probe() | * 7a37abf096 usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe() | * 04b1c0798d usb: common: usb-conn-gpio: Set last role to unknown before initial detection | * 155bb9b4e3 usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() | * 63b3360d43 usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() | * 90159b329f KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes | * ebe83e9bb8 f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() | * 15c073e752 f2fs: fix potential deadlock due to unpaired node_write lock use | * 2e980eb955 gfs2: Fix duplicate should_fault_in_pages() call | * f5d7f9e155 sh: Avoid using IRQ0 on SH3 and SH4 | * d199218881 media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var() | * c8470b7de8 media: venus: helpers: Fix ALIGN() of non power of two | * 8339bd9181 mfd: rt5033: Drop rt5033-battery sub-device | * 6d702c7a22 coresight: Fix loss of connection info when a module is unloaded | * 76efcb6cda i3c: master: svc: fix cpu schedule in spin lock | * c0ed8b8049 lkdtm: replace ll_rw_block with submit_bh | * f5d80ad7b6 kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR | * 9c4f52b618 serial: 8250: lock port for UART_IER access in omap8250_irq() | * 3a1ab191e0 serial: core: lock port for start_rx() in uart_resume_port() | * 65a7cfc009 serial: 8250: lock port for stop_rx() in omap8250_irq() | * 44470207db serial: core: lock port for stop_rx() in uart_suspend_port() | * c494fe1b66 usb: misc: eud: Fix eud sysfs path (use 'qcom_eud') | * b5ab04a19e usb: hide unused usbfs_notify_suspend/resume functions | * dd9b7c89a8 usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() | * ac961d0571 extcon: Fix kernel doc of property capability fields to avoid warnings | * e4c94de6ca extcon: Fix kernel doc of property fields to avoid warnings | * e60a827ac0 usb: gadget: u_serial: Add null pointer check in gserial_suspend | * c3b322b84a usb: dwc3: qcom: Fix potential memory leak | * 6aecf5e19b staging: vchiq_arm: mark vchiq_platform_init() static | * 2ed441a763 clk: qcom: mmcc-msm8974: use clk_rcg2_shared_ops for mdp_clk_src clock | * 3c4f7d4990 clk: qcom: dispcc-qcm2290: Fix GPLL0_OUT_DIV handling | * 203ab76704 clk: qcom: dispcc-qcm2290: Fix BI_TCXO_AO handling | * b80c4629e9 clk: qcom: ipq6018: fix networking resets | * b20854ef6c clk: qcom: reset: support resetting multiple bits | * 0e481ef854 media: mediatek: vcodec: using decoder status instead of core work count | * 42ec6269f9 media: hi846: fix usage of pm_runtime_get_if_in_use() | * 1ac45cab77 media: i2c: Correct format propagation for st-mipid02 | * 8abb53c516 media: usb: siano: Fix warning due to null work_func_t function pointer | * e230146b86 media: videodev2.h: Fix struct v4l2_input tuner index comment | * cb8e8950d7 media: amphion: initiate a drain of the capture queue in dynamic resolution change | * c0d500726c media: amphion: drop repeated codec data for vc1g format | * bc43061b42 media: amphion: drop repeated codec data for vc1l format | * a8af55f7f4 media: usb: Check az6007_read() return value | * 0b3d2aa627 clk: qcom: gcc-qcm2290: Mark RCGs shared where applicable | * 792998a8cf clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks | * f0cafc443c clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs | * 51e5f4e720 clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk | * 9812b33d17 serial: 8250: omap: Fix freeing of resources on failed register | * b6e30a54a5 usb: dwc2: Fix some error handling paths | * 98b6582b37 usb: dwc2: platform: Improve error reporting for problems during .remove() | * e91366b72c sh: j2: Use ioremap() to translate device tree address into kernel memory | * d6dd477436 f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED | * 190bdec8a7 dt-bindings: power: reset: qcom-pon: Only allow reboot-mode pre-pmk8350 | * c3f5604aba w1: fix loop in w1_fini() | * eab6485377 w1: w1_therm: fix locking behavior in convert_t | * ef04741188 SUNRPC: Fix UAF in svc_tcp_listen_data_ready() | * 6f1c81886b btrfs: fix race when deleting free space root from the dirty cow roots list | * defc914227 block: increment diskseq on all media change events | * 28b58a8d10 block: change all __u32 annotations to __be32 in affs_hardblocks.h | * 40d6a1261a block: add overflow checks for Amiga partition support | * a4c79ea1e9 block: fix signed int overflow in Amiga partition support | * 3eb4e47a94 ALSA: pcm: Fix potential data race at PCM memory allocation helpers | * 14eb1a2b6f ALSA: jack: Fix mutex call in snd_jack_report() | * 83c6725556 ALSA: hda/realtek: Add quirk for Clevo NPx0SNx | * 21ce551a85 ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook | * e0d7a96b27 mm/mmap: Fix VM_LOCKED check in do_vmi_align_munmap() | * b91748bdbf Revert "drm/amd/display: edp do not add non-edid timings" | * 96b1bc9a6f iio: accel: fxls8962af: fixup buffer scan element type | * 04a579517b iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF | * fcdae54e3d iio: adc: ad7192: Fix internal/external clock selection | * b61f26a8a0 iio: adc: ad7192: Fix null ad7192_state pointer access | * 238edc04dd phy: tegra: xusb: Clear the driver reference in usb-phy dev | * c2a0884134 usb: dwc3: gadget: Propagate core init errors to UDC during pullup | * a0b3696203 USB: serial: option: add LARA-R6 01B PIDs | * f57e2c0830 md/raid1-10: fix casting from randomized structure in raid1_submit_write() | * b6872b4a7d x86/efi: Make efi_set_virtual_address_map IBT safe | * 9766921494 arm64: sme: Use STR P to clear FFR context field in streaming SVE mode | * be54803be8 ksmbd: avoid field overflow warning | * babaab6ef6 smb: client: fix broken file attrs with nodfs mounts | * 9fb981a86a cifs: do all necessary checks for credits within or before locking | * 4fe07d55a5 cifs: prevent use-after-free by freeing the cfile later | * e28d7a3f4b efi/libstub: Disable PCI DMA before grabbing the EFI memory map | * 1e596c181c kbuild: Disable GCOV for *.mod.o | * c5696a8a54 hwrng: st - keep clock enabled while hwrng is registered | * d88158d816 dax/kmem: Pass valid argument to memory_group_register_static | * 7b8106d905 dax: Introduce alloc_dev_dax_id() | * 03859868ab dax: Fix dax_mapping_release() use after free | * 1bf709b962 SMB3: Do not send lease break acknowledgment if all file handles have been closed | * c2bf8d7b8f NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION | * 7053178436 NFSv4.2: fix wrong shrinker_id | * 08749a9005 crypto: qat - unmap buffers before free for RSA | * 32b09834c3 crypto: qat - unmap buffer before free for DH | * da1729e661 crypto: qat - Use helper to set reqsize | * 2db49992fc crypto: kpp - Add helper to set reqsize | * c14964fe8e ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard | * dd872d5576 modpost: fix off by one in is_executable_section() | * 64c358c9ab crypto: jitter - correct health test during initialization | * 7ab0e37f80 crypto: marvell/cesa - Fix type mismatch warning | * 6852d82e6c modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} | * 1df287bd89 modpost: fix section mismatch message for R_ARM_ABS32 | * 5a4adb1ece crypto: nx - fix build warnings when DEBUG_FS is not enabled | * 2be41ef57c modpost: remove broken calculation of exception_table_entry size | * 22c30022cd hwrng: virtio - Fix race on data_avail and actual data | * 8f98749d53 vfio/mdev: Move the compat_class initialization to module init | * e2e52c8dfb PCI: vmd: Fix uninitialized variable usage in vmd_enable_domain() | * 222f64e56b PCI: endpoint: functions/pci-epf-test: Fix dma_chan direction | * e14379d026 PCI: endpoint: Fix a Kconfig prompt of vNTB driver | * 38b64bdb72 PCI: endpoint: Fix Kconfig indent style | * 4e6c406ccb powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary | * ea356080c1 powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo | * 526129937c riscv: uprobes: Restore thread.bad_cause | * d25166e1e9 PCI: qcom: Disable write access to read only registers for IP v2.9.0 | * 1cf0ecb0c7 PCI: qcom: Use DWC helpers for modifying the read-only DBI registers | * 8640e941fd PCI: qcom: Use lower case for hex | * a350f10777 PCI: qcom: Sort and group registers and bitfield definitions | * db962c7a71 PCI: qcom: Remove PCIE20_ prefix from register definitions | * 865d128cab powerpc: update ppc_save_regs to save current r1 in pt_regs | * 4cff1be1cb powerpc: simplify ppc_save_regs | * d9a1aaea85 powerpc/powernv/sriov: perform null check on iov before dereferencing iov | * 0af388fce3 pinctrl: at91-pio4: check return value of devm_kasprintf() | * 35404a47ba pinctrl: microchip-sgpio: check return value of devm_kasprintf() | * 4e82f92c34 powerpc/64s: Fix VAS mm use after free | * 75d65c1cc4 perf tool x86: Fix perf_env memory leak | * 0dafc849b9 perf tool x86: Consolidate is_amd check into single function | * c94376dbd6 platform/x86/dell/dell-rbtn: Fix resources leaking on error path | * 9999a9f004 perf dwarf-aux: Fix off-by-one in die_get_varname() | * 4e06e8b1f9 platform/x86: thinkpad_acpi: Fix lkp-tests warnings for platform profiles | * 4309bd9e98 perf script: Fix allocation of evsel->priv related to per-event dump files | * 7cfd310111 powerpc/signal32: Force inlining of __unsafe_save_user_regs() and save_tm_user_regs_unsafe() | * af0c61c5bb powerpc/interrupt: Don't read MSR from interrupt_exit_kernel_prepare() | * 081f642b31 kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures | * c32afc7e86 pinctrl: npcm7xx: Add missing check for ioremap | * fc45a8be5e pinctrl:sunplus: Add check for kmalloc | * 8362ea6158 platform/x86: think-lmi: Correct NVME password handling | * 699b593101 platform/x86: think-lmi: Correct System password interface | * 61545eb787 platform/x86: think-lmi: mutex protection around multiple WMI calls | * d1390b057d pinctrl: cherryview: Return correct value if pin in push-pull mode | * 1ebe7d40ed perf bench: Add missing setlocale() call to allow usage of %'d style formatting | * 251c6615a7 scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state | * 7d3664d24f PCI: Add pci_clear_master() stub for non-CONFIG_PCI | * 019d4fd93a pinctrl: sunplus: Add check for kmalloc | * bc796f65cd PCI: ftpci100: Release the clock resources | * a982c13e11 PCI: pciehp: Cancel bringup sequence if card is not present | * 6c1b079e26 scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() | * 7aecdd4791 PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free | * 3a080e1b11 platform/x86: lenovo-yogabook: Set default keyboard backligh brightness on probe() | * fa177f7011 platform/x86: lenovo-yogabook: Reprobe devices on remove() | * 3e6c92a346 platform/x86: lenovo-yogabook: Fix work race on remove() | * 727fb7083e pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors | * c316bde418 scsi: qedf: Fix NULL dereference in error handling | * c52502b674 PCI: vmd: Reset VMD config register between soft reboots | * ebafa12c8f PCI: cadence: Fix Gen2 Link Retraining process | * 79e1d940fd ASoC: amd: acp: clear pdm dma interrupt mask | * c6764757e8 ARM: dts: lan966x: kontron-d10: fix SPI CS | * 712a7f3a06 ARM: dts: lan966x: kontron-d10: fix board reset | * 49451db71b clk: Fix memory leak in devm_clk_notifier_register() | * 03a705c1d7 ASoC: imx-audmix: check return value of devm_kasprintf() | * e4f2a1feeb ovl: update of dentry revalidate flags after copy up | * 83356d6f0a drivers: meson: secure-pwrc: always enable DMA domain | * 511b47f8cb clk: ti: clkctrl: check return value of kasprintf() | * 67684f0688 clk: keystone: sci-clk: check return value of kasprintf() | * a20450f473 clk: si5341: free unused memory on probe failure | * 11581850a7 clk: si5341: check return value of {devm_}kasprintf() | * 0a89a906ba clk: si5341: return error if one synth clock registration fails | * 5470a0e81f clk: cdce925: check return value of kasprintf() | * 0b5c9e9695 clk: vc5: check memory returned by kasprintf() | * af8affd123 drm/msm/dpu: correct MERGE_3D length | * 0e2c51a16f drm/amdgpu: Fix usage of UMC fill record in RAS | * 8d68ba9255 drm/amdgpu: Fix memcpy() in sienna_cichlid_append_powerplay_table function. | * 643a85190a arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz | * 846c79d2a5 arm64: dts: mediatek: Add cpufreq nodes for MT8192 | * 4e9f1a2367 drm/msm/dp: Free resources after unregistering them | * ecf02762d4 drm/msm/dsi: Remove incorrect references to slice_count | * ef25872788 drm/msm/dsi: Flip greater-than check for slice_count and slice_per_intf | * 937da3db61 drm/msm/dsi: Use DSC slice(s) packet size to compute word count | * bc6d856b1c drm/msm/dpu: Fix slice_last_group_size calculation | * 7dca0dde50 drm/msm/dpu: do not enable color-management if DSPPs are not available | * d28b83252e ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer | * 96bafece6f clk: tegra: tegra124-emc: Fix potential memory leak | * b35cb0c05b clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider() | * 9ff9f928c6 clk: bcm: rpi: Fix off by one in raspberrypi_discover_clocks() | * 4842a84639 arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k | * 7089f1aa0b arm64: dts: qcom: sdm845: Flush RSC sleep & wake votes | * 6317d03026 clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() | * 280a5ff665 clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe | * 9ba3693b03 clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe | * 1839032251 clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probe | * bf7ab557d6 RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context | * c9be352be9 RDMA/bnxt_re: wraparound mbox producer index | * 154bed0fd6 drm/msm/a5xx: really check for A510 in a5xx_gpu_init | * b10db1d213 amdgpu: validate offset_in_bo of drm_amdgpu_gem_va | * 1afca9e0fe RDMA/rxe: Fix access checks in rxe_check_bind_mw | * 0cd210c594 RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_mw.c | * 34bbf074f7 RDMA/rxe: Add ibdev_dbg macros for rxe | * 78cb71dd60 HID: uclogic: Modular KUnit tests should not depend on KUNIT=y | * 1420545b8a drm/radeon: fix possible division-by-zero errors | * c1164aeb96 drm/amd/display: Fix artifacting on eDP panels when engaging freesync video mode | * 82934a338b soc: mediatek: SVS: Fix MT8192 GPU node name | * fabadad9e2 drm/amdkfd: Fix potential deallocation of previously deallocated memory. | * 384717042d drm/amd/display: Fix a test dml32_rq_dlg_get_rq_reg() | * 36786e2a73 drm/amd/display: Fix a test CalculatePrefetchSchedule() | * 4812faba0a clk: Export clk_hw_forward_rate_request() | * 90d4c487cd ARM: dts: BCM5301X: fix duplex-full => full-duplex | * 1ae94553dc hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272 | * 421d359127 hwmon: (gsc-hwmon) fix fan pwm temperature scaling | * 9e633411d1 ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx | * dc2707deeb ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 | * 03b2c470a1 Input: pm8941-powerkey - fix debounce on gen2+ PMICs | * 421ce97657 arm64: dts: ti: k3-j7200: Fix physical address of pin | * 3b4c218040 fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() | * 52b04ac85f drm/msm/dpu: set DSC flush bit correctly at MDP CTL flush register | * 6878bdd757 arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 | * 5d14292dba ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier | * 766e0b6f4c RDMA/hns: Fix hns_roce_table_get return value | * b99395ab60 IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate | * ebec507398 RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes | * 750f0a302a soc/fsl/qe: fix usb.c build errors | * b2194d7dfc ARM: dts: meson8: correct uart_B and uart_C clock references | * 863054be8d ASoC: es8316: Do not set rate constraints for unsupported MCLKs | * 3b575d9302 ASoC: es8316: Increment max value for ALC Capture Target Volume control | * c02f27c295 ARM: dts: qcom: apq8074-dragonboard: Set DMA as remotely controlled | * 9f79e638d4 memory: brcmstb_dpfe: fix testing array offset after use | * 09722ac9f1 ARM: dts: stm32: Shorten the AV96 HDMI sound card name | * 666be7fef4 arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to kukui | * 1bdb9751b4 arm64: dts: qcom: apq8096: fix fixed regulator name property | * 75c019119e arm64: dts: qcom: pm7250b: add missing spmi-vadc include | * c63997426d ARM: omap2: fix missing tick_broadcast() prototype | * e91ffbd655 ARM: ep93xx: fix missing-prototype warnings | * deda0761dc drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H | * 25a724c2fa drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec | * 5044e5f251 drm/bridge: Introduce pre_enable_prev_first to alter bridge init order | * 1d9473b88e arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion | * 638d54f5c5 arm64: dts: qcom: apq8016-sbc: Fix regulator constraints | * 2ad75715fc arm64: dts: qcom: sdm845-polaris: add missing touchscreen child node reg | * 266cf247dd arm64: dts: qcom: sm8350: correct DMA controller unit address | * 42d0fbbbf4 arm64: dts: qcom: sm8350: Add GPI DMA compatible fallback | * aa14fefca2 arm64: dts: qcom: sdm845: correct camss unit address | * e3789d63a3 arm64: dts: qcom: sdm630: correct camss unit address | * 173b6412a5 arm64: dts: qcom: msm8996: correct camss unit address | * 4d810c12d6 arm64: dts: qcom: msm8994: correct SPMI unit address | * 98cd405217 arm64: dts: qcom: msm8916: correct MMC unit address | * aa2d2407f5 arm64: dts: qcom: msm8916: correct camss unit address | * 0cff846820 ARM: dts: qcom: msm8974: do not use underscore in node name (again) | * 376daf3aa8 drm/bridge: anx7625: Prevent endless probe loop | * 4536679f79 drm/bridge: anx7625: Convert to i2c's .probe_new() | * 93a0378035 ARM: dts: gta04: Move model property out of pinctrl node | * af5bcfb4f8 clk: renesas: rzg2l: Fix CPG_SIPLL5_CLK1 register write | * 2128318c91 iommu/virtio: Return size mapped for a detached domain | * 0f2c11ccfd iommu/virtio: Detach domain on endpoint release | * ed41f708b3 drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK | * f4c6e5d734 drm/msm/disp/dpu: get timing engine status from intf status register | * 74abb8d3cd drm/msm/dsi: don't allow enabling 14nm VCO with unprogrammed rate | * dd129da1fd RDMA/bnxt_re: Fix to remove an unnecessary log | * c37eca42ac RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid | * 66eb6c47b5 RDMA/bnxt_re: Use unique names while registering interrupts | * f2279e3e38 RDMA/bnxt_re: Fix to remove unnecessary return labels | * b43b064498 RDMA/bnxt_re: Disable/kill tasklet only if it is enabled | * 280e58d8b0 hwmon: (f71882fg) prevent possible division by zero | * 08cc7cd2c2 clk: imx: scu: use _safe list iterator to avoid a use after free | * 3fc9637f37 drm/bridge: tc358767: Switch to devm MIPI-DSI helpers | * 929b6c6e6a arm64: dts: microchip: sparx5: do not use PSCI on reference boards | * 13602e6132 bus: ti-sysc: Fix dispc quirk masking bool variables | * 46a8dff210 ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards | * 7a3c39e34c drm/vkms: Fix RGB565 pixel conversion | * 048b7168ac drm: Add fixed-point helper to get rounded integer values | * fa4ee16e81 drm/vkms: isolate pixel conversion functionality | * 9d59f5f52c ASoC: Intel: sof_sdw: remove SOF_SDW_TGL_HDMI for MeteorLake devices | * 49fca83f6f driver: soc: xilinx: use _safe loop iterator to avoid a use after free | * 39bdb97f87 drm/panel: sharp-ls043t1le01: adjust mode settings | * aeca0e1c33 drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks` | * ac96a15163 Input: adxl34x - do not hardcode interrupt trigger type | * 3134cc51e9 clk: rs9: Fix .driver_data content in i2c_device_id | * 6014e7422c clk: vc7: Fix .driver_data content in i2c_device_id | * 53b5b4d1a8 clk: vc5: Fix .driver_data content in i2c_device_id | * 4db655d1b2 bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page | * 548b67c0aa clk: vc5: Use `clamp()` to restrict PLL range | * 50fb32197f mm: call arch_swap_restore() from do_swap_page() | * 5cf97c2df2 ARM: dts: meson8b: correct uart_B and uart_C clock references | * 2b55a98572 ARM: dts: BCM5301X: Drop "clock-names" from the SPI node | * 2dc8b685d9 drm/vram-helper: fix function names in vram helper doc | * 8e739c8c6e drm/bridge: tc358768: fix THS_TRAILCNT computation | * 010f68aecd drm/bridge: tc358768: fix TXTAGOCNT computation | * 7b19315737 drm/bridge: tc358768: fix THS_ZEROCNT computation | * 2545a8d06a drm/bridge: tc358768: fix TCLK_TRAILCNT computation | * 587ba0805e drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation | * 06dc491cf4 drm/bridge: tc358768: fix TCLK_ZEROCNT computation | * 9d56ec0b24 drm/bridge: tc358768: fix PLL target frequency | * d2aad3c1e4 drm/bridge: tc358768: fix PLL parameters computation | * c4cf126320 drm/bridge: tc358768: always enable HS video mode | * 63f3bc83b1 drm/bridge: ti-sn65dsi83: Fix enable error path | * df3b7e337d Input: drv260x - sleep between polling GO bit | * 9d27705e3c drm/bridge: it6505: Move a variable assignment behind a null pointer check in receive_timing_debugfs_show() | * 9fbe61e3c2 drm/amd/display: Explicitly specify update type per plane info change | * cb86b0e3d9 radeon: avoid double free in ci_dpm_init() | * 064e33b359 drm/amd/display: Add logging for display MALL refresh setting | * 3b3186c770 netlink: Add __sock_i_ino() for __netlink_diag_dump(). | * f6d2e25c64 ipvlan: Fix return value of ipvlan_queue_xmit() | * d6cf5026af netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. | * 5c618daa50 netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one | * cfcb9f0a49 lib/ts_bm: reset initial match offset for every block of text | * 425d9d3a92 net: nfc: Fix use-after-free caused by nfc_llcp_find_local | * 446f556793 sfc: fix crash when reading stats while NIC is resetting | * 94817712b5 ocfs2: Fix use of slab data with sendpage | * 8c438ff5d9 net: axienet: Move reset before 64-bit DMA detection | * 17d6b6354f gtp: Fix use-after-free in __gtp_encap_destroy(). | * b48c24392d selftests: rtnetlink: remove netdevsim device after ipsec offload test | * 37b6143376 bonding: do not assume skb mac_header is set | * e9331c8fa4 netlink: do not hard code device address lenth in fdb dumps | * 61ffe8b1ee netlink: fix potential deadlock in netlink_set_err() | * 509d5d40c2 net: stmmac: fix double serdes powerdown | * 12bcb53328 can: kvaser_pciefd: Set hardware timestamp on transmitted packets | * 70ace9ba20 can: kvaser_pciefd: Add function to set skb hwtstamps | * 787b404209 can: length: fix bitstuffing count | * cfb3106234 bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings | * c7415c521a bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint | * 5e9b38de66 bpf: Factor out socket lookup functions for the TC hookpoint. | * e3754e9741 wifi: ath9k: convert msecs to jiffies where needed | * 52bc4b89cd wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection | * ed98f5c074 mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019 | * f114b159b2 wifi: ieee80211: Fix the common size calculation for reconfiguration ML | * ffb0733664 wifi: cfg80211/mac80211: Fix ML element common size calculation | * 132b7129c5 wifi: cfg80211: fix regulatory disconnect with OCB/NAN | * 27268ba347 wifi: cfg80211: drop incorrect nontransmitted BSS update code | * 0862669693 wifi: cfg80211: rewrite merging of inherited elements | * d875120c35 wifi: mac80211: Remove "Missing iftype sband data/EHT cap" spam | * 2d690495eb wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() | * 657a83f079 wifi: iwlwifi: pull from TXQs with softirqs disabled | * 41b1704fad wifi: ath11k: Add missing check for ioremap | * 228dd5d5fd rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO | * c682018f5c wifi: mac80211: Fix permissions for valid_links debugfs entry | * 41fc1c5678 wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() | * 16b5292bee memstick r592: make memstick_debug_get_tpc_name() static | * 93126e3966 mmc: mediatek: Avoid ugly error message when SDIO wakeup IRQ isn't used | * fd4f89302f kexec: fix a memory leak in crash_shrink_memory() | * 6525435d14 watchdog/perf: more properly prevent false positives with turbo modes | * a3cf423b58 watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config | * b27af27fc9 selftests: cgroup: fix unexpected failure on test_memcg_low | * 75704a10ea ice: handle extts in the miscellaneous interrupt thread | * 77f09d836b wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown | * eb205a0690 wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled | * 54257a7634 selftests/bpf: Fix check_mtu using wrong variable type | * da79a0bc36 wifi: mac80211: recalc min chandef for new STA links | * 272240f20d wifi: ath10k: Trigger STA disconnect after reconfig complete on hardware restart | * cf5beb8ce9 samples/bpf: xdp1 and xdp2 reduce XDPBUFSIZE to 60 | * 09740fa982 wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes | * 0d89e50952 wifi: ray_cs: Fix an error handling path in ray_probe() | * 3d218755c4 wifi: wl3501_cs: Fix an error handling path in wl3501_probe() | * d5569b970b wifi: atmel: Fix an error handling path in atmel_probe() | * e48b7c2416 wifi: orinoco: Fix an error handling path in orinoco_cs_probe() | * 9a201822ad wifi: orinoco: Fix an error handling path in spectrum_cs_probe() | * 4fc6481323 regulator: core: Streamline debugfs operations | * 6a241e6b9e regulator: core: Fix more error checking for debugfs_create_dir() | * be84e69082 selftests/bpf: Do not use sign-file as testcase | * 20109ddd5b bpf: Fix memleak due to fentry attach failure | * 8ea165e1f8 bpf: Remove bpf trampoline selector | * 1949721c74 bpftool: JIT limited misreported as negative value on aarch64 | * bac93b35f9 nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() | * 34d04d7019 spi: dw: Round of n_bytes to power of 2 | * c6a9fc82fe bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen | * 34fe7aa8ef libbpf: fix offsetof() and container_of() to work with CO-RE | * 8404f8de1e sctp: add bpf_bypass_getsockopt proto callback | * f21f2ae562 wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan() | * 51cb8329f2 wifi: wilc1000: fix for absent RSN capabilities WFA testcase | * ded1a7a570 spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG | * 56c25f2763 samples/bpf: Fix buffer overflow in tcp_basertt | * a7434a4dcc libbpf: btf_dump_type_data_check_overflow needs to consider BTF_MEMBER_BITFIELD_SIZE | * d1c2ff2bd8 wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx | * 6928d6e9b0 wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation | * bb3a9ed2b1 igc: Enable and fix RX hash usage by netstack | * f57ba91a46 pstore/ram: Add check for kstrdup | * 2672144b86 ima: Fix build warnings | * 9085f2ca94 evm: Fix build warnings | * b050ade6e0 evm: Complete description of evm_inode_setattr() | * ea1432a402 locking/atomic: arm: fix sync ops | * 6b54f5c684 x86/mm: Fix __swp_entry_to_pte() for Xen PV guests | * 3745f628c3 perf/ibs: Fix interface via core pmu events | * 64d09c0e83 kselftest: vDSO: Fix accumulation of uninitialized ret when CLOCK_REALTIME is undefined | * b8a6ba524d rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale | * 3506e64ec1 rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup() | * 7a34922194 rcuscale: Move shutdown from wait_event() to wait_event_idle() | * a0a1f1c924 rcutorture: Correct name of use_softirq module parameter | * b1cdc56bc1 rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs | * d58f0f0ce6 rcu: Make rcu_cpu_starting() rely on interrupts being disabled | * 5d56a8d670 thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe() | * 2b7e2251c4 cpufreq: intel_pstate: Fix energy_performance_preference for passive | * 50d64210ee ARM: 9303/1: kprobes: avoid missing-declaration warnings | * 3f9e54eb38 PM: domains: Move the verification of in-params from genpd_add_device() | * f1f5248ced powercap: RAPL: Fix CONFIG_IOSF_MBI dependency | * be9c8c9c84 drivers/perf: hisi: Don't migrate perf to the CPU going to teardown | * 6b025ec148 x86/tdx: Fix race between set_memory_encrypted() and load_unaligned_zeropad() | * c598fefef3 x86/mm: Allow guest.enc_status_change_prepare() to fail | * 3e03681f07 perf/arm-cmn: Fix DTC reset | * 6368a71dca PM: domains: fix integer overflow issues in genpd_parse_state() | * 919dd531eb clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe | * 2d3f42d22f tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode(). | * 77cc52f1b8 tick/rcu: Fix bogus ratelimit condition | * e7aff15ba2 posix-timers: Prevent RT livelock in itimer_delete() | * 9a53410038 erofs: fix compact 4B support for 16k block size | * ec94df6bcf erofs: simplify iloc() | * 423453bb50 svcrdma: Prevent page release when nothing was received | * faf004e98d irqchip/jcore-aic: Fix missing allocation of IRQ descriptors | * 0cf83d3698 irqchip/stm32-exti: Fix warning on initialized field overwritten | * aa07e56c6a block: fix blktrace debugfs entries leakage | * 067c08f78d md/raid1-10: submit write io directly if bitmap is not enabled | * f98b89fbf8 md/raid1-10: factor out a helper to submit normal write | * fa0f13a833 md/raid1-10: factor out a helper to add bio to plug | * a5a1ec06ef md/raid10: fix io loss while replacement replace rdev | * 222cc459d5 md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request | * 05d10428e8 md/raid10: fix wrong setting of max_corr_read_errors | * b5cb16d31b md/raid10: fix overflow of md/safe_mode_delay | * be1a3ec63a md/raid10: check slab-out-of-bounds in md_bitmap_get_counter | * e1379e067b nvme-core: fix dev_pm_qos memleak | * bf3c2caab9 nvme-core: add missing fault-injection cleanup | * a584cf03ff nvme-auth: don't ignore key generation failures when initializing ctrl keys | * 43d0724d75 nvme-core: fix memory leak in dhchap_ctrl_secret | * 2e9b141307 nvme-core: fix memory leak in dhchap_secret_store | * 0a220ef9dd nvme-auth: no need to reset chap contexts on re-authentication | * 3999c850e7 nvme-auth: remove symbol export from nvme_auth_reset | * 9de0a1dfe3 nvme-auth: rename authentication work elements | * 3f6c988897 nvme-auth: rename __nvme_auth_[reset|free] to nvme_auth[reset|free]_dhchap | * ce16368280 lockd: drop inappropriate svc_get() from locked_get() | * 931bd6758b blk-mq: fix potential io hang by wrong 'wake_batch' | * c2a0eb3b20 virt: sevguest: Add CONFIG_CRYPTO dependency | * 7ca5e95f2a x86/sev: Fix calculation of end address based on number of pages | * 8ceeb3fc86 blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost | * c0df916535 x86/resctrl: Only show tasks' pid in current pid namespace | * d3b39ea248 erofs: kill hooked chains to avoid loops on deduplicated compressed images | * daed10290b erofs: move zdata.h into zdata.c | * 041ff2c21b erofs: remove tagged pointer helpers | * 3379f13ebc erofs: avoid tagged pointers to mark sync decompression | * 3564500b0d erofs: clean up cached I/O strategies | * 73b9d7ea08 block: Fix the type of the second bdev_op_is_zoned_write() argument | * 0fd958feae fs: pipe: reveal missing function protoypes | * 9f12effd40 drm: use mgr->dev in drm_dbg_kms in drm_dp_add_payload_part2 * | 79ad050bdd Merge 6.1.38 into android14-6.1-lts |\| | * 61fd484b2c Linux 6.1.38 | * c50065a392 drm/amd/display: Ensure vmin and vmax adjust for DCE | * 9d0b2afadf drm/amdgpu: Validate VM ioctl flags. | * fe56f507a1 docs: Set minimal gtags / GNU GLOBAL version to 6.6.5 | * c437b26bc3 scripts/tags.sh: Resolve gtags empty index generation | * 50e36c2897 perf symbols: Symbol lookup with kcore can fail if multiple segments match stext | * 67e3b5230c nubus: Partially revert proc_create_single_data() conversion | * 296927dbae execve: always mark stack as growing down during early stack setup | * d856e6f8a0 PCI/ACPI: Call _REG when transitioning D-states | * 788c76c33d PCI/ACPI: Validate acpi_pci_set_power_state() parameter | * a905b0b318 drm/amd/display: Do not update DRR while BW optimizations pending | * dd6d6f9d47 drm/amd/display: Remove optimization for VRR updates | * 6b2849b3e0 xtensa: fix lock_mm_and_find_vma in case VMA not found * | 8dc085b841 Merge 6.1.37 into android14-6.1-lts |\| | * 0f4ac6b4c5 Linux 6.1.37 | * 323846590c xtensa: fix NOMMU build with lock_mm_and_find_vma() conversion | * c2d89256de csky: fix up lock_mm_and_find_vma() conversion | * 4a1db15878 parisc: fix expand_stack() conversion | * 0a1da2dde4 sparc32: fix lock_mm_and_find_vma() conversion | * 00f04a3385 Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe" | * a536383ef0 HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651. | * d89750b196 HID: wacom: Use ktime_t rather than int when dealing with timestamps | * 879e79c3ae HID: hidraw: fix data race on device refcount | * cae8542495 fbdev: fix potential OOB read in fast_imageblit() | * e6bbad7571 mm: always expand the stack with the mmap write lock held | * c4b31d1b69 execve: expand new process stack manually ahead of time | * 6a6b5616c3 mm: make find_extend_vma() fail if write lock not held | * 48c232819e powerpc/mm: convert coprocessor fault to lock_mm_and_find_vma() | * 21ee33d51b mm/fault: convert remaining simple cases to lock_mm_and_find_vma() | * 1f4197f050 arm/mm: Convert to using lock_mm_and_find_vma() | * ac764deea7 riscv/mm: Convert to using lock_mm_and_find_vma() | * 7227d70acc mips/mm: Convert to using lock_mm_and_find_vma() | * 82972ea17b powerpc/mm: Convert to using lock_mm_and_find_vma() | * b92cd80e5f arm64/mm: Convert to using lock_mm_and_find_vma() | * 755aa1bc6a mm: make the page fault mmap locking killable | * d6a5c7a1a6 mm: introduce new 'lock_mm_and_find_vma()' page fault helper | * 4e2ad53aba maple_tree: fix potential out-of-bounds access in mas_wr_end_piv() | * 31cde3bdad can: isotp: isotp_sendmsg(): fix return error fix on TX path | * 0af4750eaa x86/smp: Cure kexec() vs. mwait_play_dead() breakage | * 6d3b2e0aef x86/smp: Use dedicated cache-line for mwait_play_dead() | * 50a1abc677 x86/smp: Remove pointless wmb()s from native_stop_other_cpus() | * e47037d28b x86/smp: Dont access non-existing CPUID leaf | * edadebb349 x86/smp: Make stop_other_cpus() more robust | * 94a69d6999 x86/microcode/AMD: Load late on both threads too | * 84f077802e mm, hwpoison: when copy-on-write hits poison, take page offline | * 4af5960d7c mm, hwpoison: try to recover from copy-on write faults | * 69925a346a mptcp: ensure listener is unhashed before updating the sk status | * 42a018a796 mm/mmap: Fix error return in do_vmi_align_munmap() | * a149174ff8 mm/mmap: Fix error path in do_vmi_align_munmap() * | 8b02e8901d Merge branch 'android14-6.1' into 'android14-6.1-lts' * | 16e5091129 ANDROID: ABI: Update STG ABI to format version 2 * | 1ef7816a50 Merge branch 'android14-6.1' into 'android14-6.1-lts' * | 524f946fbc Merge branch 'android14-6.1' into 'android14-6.1-lts' * | bfa917516c Revert "gpiolib: Fix irq_domain resource tracking for gpiochip_irqchip_add_domain()" * | a09603eb2f Merge 6.1.36 into android14-6.1-lts |\| | * a1c449d00f Linux 6.1.36 | * 29429a1f58 smb: move client and server files to common directory fs/smb | * 9d3e4bca4b i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle | * 81d4078f7a x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys | * 679354bea0 KVM: arm64: Restore GICv2-on-GICv3 functionality | * 6ab9468d3e vhost_net: revert upend_idx only on retriable error | * 454e4f391a vhost_vdpa: tell vqs about the negotiated | * 1af1cd7be3 drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl | * 022f2306d9 drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl | * aa88042218 drm/exynos: vidi: fix a wrong error return | * 711f727f7b null_blk: Fix: memory release when memory_backed=1 | * f6076a1386 ARM: dts: Fix erroneous ADS touchscreen polarities | * 1d1baefacd i2c: mchp-pci1xxxx: Avoid cast to incompatible function type | * 8e32575994 ALSA: hda/realtek: Add "Intel Reference board" and "NUC 13" SSID in the ALC256 | * cfa01235b5 ASoC: fsl_sai: Enable BCI bit if SAI works on synchronous mode with BYP asserted | * 570583c625 s390/purgatory: disable branch profiling | * c2888c460d gfs2: Don't get stuck writing page onto itself under direct I/O | * 878dad66b9 ASoC: amd: yc: Add Thinkpad Neo14 to quirks list for acp6x | * 1c97025d44 ASoC: nau8824: Add quirk to active-high jack-detect | * 5cc506e9b3 soundwire: qcom: add proper error paths in qcom_swrm_startup() | * 2839e0b64e soundwire: dmi-quirks: add new mapping for HP Spectre x360 | * ee4d36a14d ASoC: simple-card: Add missing of_node_put() in case of error | * e701fb0a5d ASoC: codecs: wcd938x-sdw: do not set can_multi_write flag | * 06b9522ca8 spi: lpspi: disable lpspi module irq in DMA mode | * 39a77f005f s390/cio: unregister device when the only path is gone | * 552a24eb71 arm64: dts: qcom: sc7280-qcard: drop incorrect dai-cells from WCD938x SDW | * 4de58b7c14 arm64: dts: qcom: sc7280-idp: drop incorrect dai-cells from WCD938x SDW | * 2e8ebf1a44 Input: soc_button_array - add invalid acpi_index DMI quirk handling | * ba0cc7a2e5 nvme: improve handling of long keep alives | * 06d9ec407f nvme: check IO start time when deciding to defer KA | * 8a72260619 nvme: double KA polling frequency to avoid KATO with TBKAS on | * c8f988c37a usb: gadget: udc: fix NULL dereference in remove() | * 3f6391062d btrfs: fix an uninitialized variable warning in btrfs_log_inode | * a2c3e9bfc0 nfcsim.c: Fix error checking for debugfs_create_dir | * a05df06431 media: cec: core: don't set last_initiator if tx in progress | * f37956a140 media: cec: core: disable adapter in cec_devnode_unregister | * 9d8ac2726c smb3: missing null check in SMB2_change_notify | * 3e8458c5b2 arm64: Add missing Set/Way CMO encodings | * 8428f4c00d HID: wacom: Add error check to wacom_parse_and_register() | * aaa50510ad scsi: target: iscsi: Prevent login threads from racing between each other | * 0357259cb1 gpiolib: Fix irq_domain resource tracking for gpiochip_irqchip_add_domain() | * 8592ada80e gpio: sifive: add missing check for platform_get_irq | * cb1108e174 gpiolib: Fix GPIO chip IRQ initialization restriction | * 90714f7ed7 arm64: dts: rockchip: fix nEXTRST on SOQuartz | * e51abd4808 arm64: dts: rockchip: Enable GPU on SOQuartz CM4 | * ec3d0f12e7 revert "net: align SO_RCVMARK required privileges with SO_MARK" | * b2e2f9c093 sch_netem: acquire qdisc lock in netem_change() | * 0434277b72 platform/x86/amd/pmf: Register notify handler only if SPS is enabled | * 2d580c73af selftests: forwarding: Fix race condition in mirror installation | * eff07bf118 io_uring/net: use the correct msghdr union member in io_sendmsg_copy_hdr | * 1b7b048c22 bpf: Force kprobe multi expected_attach_type for kprobe_multi link | * fc3afb3378 bpf/btf: Accept function names that contain dots | * 22cc989f2b Revert "net: phy: dp83867: perform soft reset and retain established link" | * 3e04743dba netfilter: nfnetlink_osf: fix module autoload | * abd3afddbf netfilter: nf_tables: disallow updates of anonymous sets | * c34b220385 netfilter: nf_tables: reject unbound chain set before commit phase | * 46f801ab5f netfilter: nf_tables: reject unbound anonymous set before commit phase | * b60c0ce0ff netfilter: nf_tables: disallow element updates of bound anonymous sets | * 0d836f9175 netfilter: nft_set_pipapo: .walk does not deal with generations | * d60be2da67 netfilter: nf_tables: drop map element references from preparation phase | * df27be7c15 netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain | * 891cd2eddd netfilter: nf_tables: fix chain binding transaction logic | * f5b6dbec26 be2net: Extend xmit workaround to BE3 chip | * 50f689918d net: dsa: mt7530: fix handling of LLDP frames | * a50f84af21 net: dsa: mt7530: fix handling of BPDUs on MT7530 switch | * a4e4c71901 net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch | * 7fd2e9a69e ipvs: align inner_mac_header for encapsulation | * 6d1eec1f2d mmc: usdhi60rol0: fix deferred probing | * 7e10fff133 mmc: sh_mmcif: fix deferred probing | * 565b8bd290 mmc: sdhci-acpi: fix deferred probing | * 645f89ee3e mmc: owl: fix deferred probing | * 251101c32a mmc: omap_hsmmc: fix deferred probing | * 0057a905de mmc: omap: fix deferred probing | * f73b380518 mmc: mvsdio: fix deferred probing | * 4806f6b6b7 mmc: mtk-sd: fix deferred probing | * d28b7a8733 net: qca_spi: Avoid high load if QCA7000 is not available | * 1d4dd09f13 sfc: use budget for TX completions | * 0bbb8164ed net/mlx5: DR, Fix wrong action data allocation in decap action | * b062caf4f7 xfrm: Linearize the skb after offloading if needed. | * fff9a18e01 selftests: net: fcnal-test: check if FIPS mode is enabled | * 0793ead2ff selftests: net: vrf-xfrm-tests: change authentication and encryption algos | * 6919634176 selftests: net: tls: check if FIPS mode is enabled | * ac5671d100 bpf: Fix a bpf_jit_dump issue for x86_64 with sysctl bpf_jit_enable. | * 8bb51cdc4f xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets | * d9a0b1a53c bpf: Fix verifier id tracking of scalars on spill | * 461fc3391c bpf: track immediate values written to stack by BPF_ST instruction | * b36ba84f09 KVM: arm64: PMU: Restore the host's PMUSERENR_EL0 | * c803e91600 xfrm: Ensure policies always checked on XFRM-I input path | * 94e81817f0 xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c | * 8ea03341f7 xfrm: Treat already-verified secpath entries as optional | * 43489b2cba ieee802154: hwsim: Fix possible memory leaks | * caddcdf2a9 mmc: meson-gx: fix deferred probing | * 1a2793a25a memfd: check for non-NULL file_seals in memfd_create() syscall | * 364fdcbb03 x86/mm: Avoid using set_pgd() outside of real PGD pages | * cbfee3d9d5 nilfs2: prevent general protection fault in nilfs_clear_dirty_page() | * 24f473769e io_uring/poll: serialize poll linked timer start with poll removal | * 2d80c85fa4 arm64: dts: rockchip: Fix rk356x PCIe register and range mappings | * 277a7c23b5 regmap: spi-avmm: Fix regmap_bus max_raw_write | * b385b1d28e regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK | * ad5daeaa3d spi: spi-geni-qcom: correctly handle -EPROBE_DEFER from dma_request_chan() | * 21945b7a86 wifi: iwlwifi: pcie: Handle SO-F device for PCI id 0x7AF0 | * 1dfca388fc bpf: ensure main program has an extable | * 03b2149d5a mmc: sunxi: fix deferred probing | * 8b8756324c mmc: bcm2835: fix deferred probing | * 1db5a39a90 mmc: sdhci-spear: fix deferred probing | * f1b17198e4 mmc: mmci: stm32: fix max busy timeout calculation | * 6c2af0fd83 mmc: meson-gx: remove redundant mmc_request_done() call from irq context | * 687d34c578 mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916 | * 3dd0041c41 mmc: litex_mmc: set PROBE_PREFER_ASYNCHRONOUS | * 0d7a4e6589 cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex in freezer_css_{online,offline}() | * 7b162a18d3 cgroup: Do not corrupt task iteration when rebinding subsystem | * c2c46a7028 mptcp: consolidate fallback and non fallback state machine | * 1d31275426 mptcp: fix possible list corruption on passive MPJ | * b747e75598 mptcp: fix possible divide by zero in recvmsg() | * b7bb71dfb5 mptcp: handle correctly disconnect() failures | * 1d9dc9bed9 io_uring/net: disable partial retries for recvmsg with cmsg | * 4d729cc67b io_uring/net: clear msg_controllen on partial sendmsg retry | * 4db49d59a8 PCI: hv: Add a per-bus mutex state_lock | * 091d03d198 PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic | * 5c09925b18 PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev | * da2fff20d9 Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally" | * a74a9d9b75 PCI: hv: Fix a race condition bug in hv_pci_query_relations() | * ba803d7ac1 Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs | * 191cb91329 Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails | * 4f7e702b74 KVM: Avoid illegal stage2 mapping on invalid memory slot | * 390aeb5ae7 ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep() | * 8e63b1fd24 nilfs2: fix buffer corruption due to concurrent device reads | * d5d7cde2ad scripts: fix the gfp flags header path in gfp-translate | * 4a89bfb1a1 writeback: fix dereferencing NULL mapping->host on writeback_page_template | * 1fed1f8513 selftests: mptcp: join: fix "userspace pm add & remove address" | * 53e096bcae selftests: mptcp: join: skip fail tests if not supported | * f17459121c selftests: mptcp: join: skip userspace PM tests if not supported | * f40a7ded34 selftests: mptcp: join: skip test if iptables/tc cmds fail | * bce23d1254 selftests: mptcp: sockopt: skip TCP_INQ checks if not supported | * 157dcb2000 selftests: mptcp: diag: skip listen tests if not supported | * 755c8857ab selftests/mount_setattr: fix redefine struct mount_attr build error | * 94851666af selftests: mptcp: join: skip MPC backups tests if not supported | * fe1f28db73 selftests: mptcp: join: skip fullmesh flag tests if not supported | * 6313c493e3 selftests: mptcp: join: skip backup if set flag on ID not supported | * efb4f6c2dd selftests: mptcp: join: skip implicit tests if not supported | * dd6c284a34 selftests: mptcp: join: support RM_ADDR for used endpoints or not | * 695cce2f2c selftests: mptcp: join: skip Fastclose tests if not supported | * 0381f30735 selftests: mptcp: join: support local endpoint being tracked or not | * 1c0d9b4b47 selftests: mptcp: join: skip check if MIB counter not supported | * e35edb09e5 selftests: mptcp: join: helpers to skip tests | * 4d65ec947d selftests: mptcp: join: use 'iptables-legacy' if available | * 44d3366bf4 selftests: mptcp: lib: skip if not below kernel version | * c5bdd8eb8e selftests: mptcp: userspace pm: skip if not supported | * 733bf9d80d selftests: mptcp: userspace pm: skip if 'ip' tool is unavailable | * bfe225dec6 selftests: mptcp: sockopt: skip getsockopt checks if not supported | * 103b4e62de selftests: mptcp: sockopt: relax expected returned size | * 61c1bf0666 selftests: mptcp: pm nl: skip fullmesh flag checks if not supported | * 41f7f7f6e4 selftests: mptcp: pm nl: remove hardcoded default limits | * e79e5e7642 selftests: mptcp: connect: skip disconnect tests if not supported | * cba0db9c15 selftests: mptcp: connect: skip transp tests if not supported | * 9ead68270b selftests: mptcp: lib: skip if missing symbol | * 4bed22c687 selftests: mptcp: join: fix ShellCheck warnings | * a032ccca15 selftests: mptcp: remove duplicated entries in usage | * 0c6552f837 tick/common: Align tick period during sched_timer setup | * 854156d12c ksmbd: validate session id and tree id in the compound request | * c86211159b ksmbd: fix out-of-bound read in smb2_write | * 9650cf70ec ksmbd: validate command payload size | * 0fd4ac3773 tpm_crb: Add support for CRB devices based on Pluton | * a46fa56966 tpm, tpm_tis: Claim locality in interrupt handler | * 2e7ad879e1 mm: Fix copy_from_user_nofault(). | * 4ed740c648 ata: libata-scsi: Avoid deadlock on rescan after device resume | * c4465bff4d tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A | * 17732fed85 tty: serial: fsl_lpuart: make rx_watermark configurable for different platforms | * 9bcac45389 drm/amd/display: fix the system hang while disable PSR | * e538342002 drm/amd/display: Add wrapper to call planes and stream update | * 8d855bc676 drm/amd/display: Use dc_update_planes_and_stream * | 1118d7f559 ANDROID: GKI: irq-gic-v3: fix up breakage in 6.1.35 merge * | 1e4b07ffa3 Merge 6.1.35 into android14-6.1-lts |\| | * e84a4e368a Linux 6.1.35 | * a76d4933c3 kbuild: Update assembler calls to use proper flags and language target | * 5abcd2c18d MIPS: Prefer cc-option for additions to cflags | * 1d485ddcba MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option | * d51d258997 x86/boot/compressed: prefer cc-option for CFLAGS additions | * bdd22f2aa1 scsi: target: core: Fix error path in target_setup_session() | * 741c96715f neighbour: delete neigh_lookup_nodev as not used | * 26435338f9 net/sched: act_api: add specific EXT_WARN_MSG for tc action | * ab1bbd79f4 Revert "net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy" | * 8f37599811 net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy | * 4b4cae8e4b drm/amdgpu: Don't set struct drm_driver.output_poll_changed | * c6cbb4e1c1 rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period | * 8d842af30b parisc: Delete redundant register definitions in <asm/assembly.h> | * 616aba5536 afs: Fix vlserver probe RTT handling | * 34dc1eed99 octeon_ep: Add missing check for ioremap | * 35d848164f selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET | * 6ab77b3b85 net: tipc: resize nlattr array to correct size | * d24c965817 dm: don't lock fs when the map is NULL during suspend or resume | * 010179208c sfc: fix XDP queues mode with legacy IRQ | * 23efdbfa8e net: macsec: fix double free of percpu stats | * 4ea1f33444 net: lapbether: only support ethernet devices | * 59f0c7bec3 net: dsa: felix: fix taprio guard band overflow at 10Mbps with jumbo frames | * 3626e93cd8 net/sched: cls_api: Fix lockup on flushing explicitly created chain | * fa285d799d ext4: drop the call to ext4_error() from ext4_get_group_info() | * d7d6e830cd cifs: fix lease break oops in xfstest generic/098 | * e8119d4d16 selftests: forwarding: hw_stats_l3: Set addrgenmode in a separate step | * ea3f336f71 net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting | * ac57be24dc net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs | * 096c00ea80 sched: add new attr TCA_EXT_WARN_MSG to report tc extact message | * e568e0e168 selftests/tc-testing: Fix SFB db test | * 700d7bf300 selftests/tc-testing: Fix Error: failed to find target LOG | * 8a086daf20 selftests/tc-testing: Fix Error: Specified qdisc kind is unknown. | * 62aecf23f3 drm/nouveau: add nv_encoder pointer check for NULL | * fb725beca6 drm/nouveau/dp: check for NULL nv_connector->native_mode | * a5acbe4ea5 drm/bridge: ti-sn65dsi86: Avoid possible buffer overflow | * 90748be0f4 drm/nouveau: don't detect DSM for non-NVIDIA device | * 835457c0d6 net: phylink: use a dedicated helper to parse usgmii control word | * fabf9cb413 net: phylink: report correct max speed for QUSGMII | * df7477a8bd igb: fix nvm.ops.read() error handling | * 9710e5c30b igc: Fix possible system crash when loading module | * c6612bf33e igc: Clean the TX buffer and TX descriptor ring | * fe289f8fee sctp: fix an error code in sctp_sf_eat_auth() | * 0b8ae7d6e4 ipvlan: fix bound dev checking for IPv6 l3s mode | * 33bd6b76ac net: ethtool: correct MAX attribute value for stats | * 277fbf63b3 IB/isert: Fix incorrect release of isert connection | * f77965f487 IB/isert: Fix possible list corruption in CMA handler | * 4e55c9abe9 IB/isert: Fix dead lock in ib_isert | * 1def2a94f4 RDMA/mlx5: Fix affinity assignment | * 8618f8f723 IB/uverbs: Fix to consider event queue closing also upon non-blocking mode | * 4dc0b367c3 RDMA/cma: Always set static rate to 0 for RoCE | * ec6d49687d RDMA/mlx5: Create an indirect flow table for steering anchor | * 3a83145b66 RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions | * c764fed5e5 octeontx2-af: fix lbk link credits on cn10k | * 7c6d504146 octeontx2-af: fixed resource availability check | * b4a3cae58c iavf: remove mask from iavf_irq_enable_queues() | * 26256aa7ed RDMA/rxe: Fix the use-before-initialization error of resp_pkts | * b0b3848e03 RDMA/rxe: Removed unused name from rxe_task struct | * e83bc93886 wifi: mac80211: take lock before setting vif links | * 170ceadf4a wifi: cfg80211: fix link del callback to call correct handler | * 49f3a79f03 wifi: mac80211: fix link activation settings order | * 07f9cc229b net/sched: cls_u32: Fix reference counter leak leading to overflow | * c9411f014e octeontx2-af: Fix promiscuous mode | * 5cf38fbc82 net/sched: act_pedit: Parse L3 Header for L4 offset | * fb25478f66 net/sched: act_pedit: remove extra check for key type | * b4e5d0c4cf net/sched: simplify tcf_pedit_act | * 300be9f1dc igb: Fix extts capture value format for 82580/i354/i350 | * a4a912aee1 ping6: Fix send to link-local addresses with VRF. | * 381d49ec68 net: enetc: correct the indexes of highest and 2nd highest TCs | * 4aaa3b730d netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE | * bec51844f9 ice: Fix XDP memory leak when NIC is brought up and down | * 8fddf3f051 netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM | * 55b7a00f34 netfilter: nf_tables: integrate pipapo into commit protocol | * 839d38d3b0 spi: fsl-dspi: avoid SCK glitches with continuous transfers | * 4857924806 spi: cadence-quadspi: Add missing check for dma_set_mask | * 2906e0d75b RDMA/rxe: Fix ref count error in check_rkey() | * 7617a59f00 RDMA/rxe: Fix packet length checks | * 00b276bc7b RDMA/rtrs: Fix rxe_dealloc_pd warning | * 77226c9785 RDMA/rtrs: Fix the last iu->buf leak in err path | * 03285557de usb: dwc3: gadget: Reset num TRBs before giving back the request | * 7bee7f13c0 USB: dwc3: fix use-after-free on core driver unbind | * 307fe59490 USB: dwc3: qcom: fix NULL-deref on suspend | * d8195536ce usb: gadget: udc: core: Prevent soft_connect_store() race | * 3c048d42c3 usb: gadget: udc: core: Offload usb_udc_vbus_handler processing | * 3a1882841f usb: typec: Fix fast_role_swap_current show function | * 2bf8ea2e9e usb: typec: ucsi: Fix command cancellation | * b352f7b6a6 serial: lantiq: add missing interrupt ack | * 04b3145db2 USB: serial: option: add Quectel EM061KGL series | * 03b5964a28 clk: pxa: fix NULL pointer dereference in pxa3xx_clk_update_accr | * 5532962c9e thunderbolt: Mask ring interrupt on Intel hardware as well | * d799f73d5d thunderbolt: dma_test: Use correct value for absent rings when creating paths | * 081b5f1ebc thunderbolt: Do not touch CL state configuration during discovery | * 1eb0eff7da ALSA: hda/realtek: Add a quirk for Compaq N14JP6 | * 21863dc45a drm/amdgpu: add missing radeon secondary PCI ID | * 6f5b5ce939 drm/amd/pm: workaround for compute workload type on some skus | * b69a10df90 drm/amd: Tighten permissions on VBIOS flashing attributes | * b2706d862b drm/amd: Make sure image is written to trigger VBIOS image update flow | * ee8c6580c3 drm/amd/display: edp do not add non-edid timings | * 2cb6026df1 net: usb: qmi_wwan: add support for Compal RXM-G1 | * 5d1fdfb3d1 drm/amdgpu: vcn_4_0 set instance 0 init sched score to 1 | * f6d74371ce RDMA/uverbs: Restrict usage of privileged QKEYs | * 5a144bad3e nouveau: fix client work fence deletion race | * 33965ac340 net: ethernet: stmicro: stmmac: fix possible memory leak in __stmmac_open | * bfaf388d35 dm thin: fix issue_discard to pass GFP_NOIO to __blkdev_issue_discard | * 088ad777ee dm thin metadata: check fail_io before using data_sm | * 1886db9a4e ALSA: usb-audio: Add quirk flag for HEM devices to enable native DSD playback | * 029e0f1f75 ALSA: usb-audio: Fix broken resume due to UAC3 power state | * 9e1c7968a2 btrfs: can_nocow_file_extent should pass down args->strict from callers | * 4e9da0cda1 btrfs: fix iomap_begin length for nocow writes | * 4389fb6b6a btrfs: do not ASSERT() on duplicated global roots | * 7e23b1ec72 powerpc/purgatory: remove PGO flags | * 352f62431a riscv/purgatory: remove PGO flags | * 2cf6e32e86 x86/purgatory: remove PGO flags | * 013027918a kexec: support purgatories with .text.hot sections | * c9c3163c7a io_uring/net: save msghdr->msg_control for retries | * cffaa97ffb LoongArch: Fix perf event id calculation | * ad64865722 nilfs2: reject devices with insufficient block count | * 69caea4eed nilfs2: fix possible out-of-bounds segment allocation in resize ioctl | * 8f47a9665a nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() | * 3d4bc38f71 nios2: dts: Fix tse_mac "max-frame-size" property | * 447f325497 zswap: do not shrink if cgroup may not zswap | * 9f17645f85 ocfs2: check new file size on fallocate call | * 534b4bbc85 ocfs2: fix use-after-free when unmounting read-only filesystem | * 3a340c63c0 epoll: ep_autoremove_wake_function should use list_del_init_careful | * 6d304091e0 wifi: cfg80211: fix double lock bug in reg_wdev_chan_valid() | * b11f953a61 wifi: cfg80211: fix locking in regulatory disconnect | * 9a9adc42a5 irqchip/gic: Correctly validate OF quirk descriptors | * 22efb27a21 NVMe: Add MAXIO 1602 to bogus nid list. | * c9c2059450 io_uring: unlock sqd->lock before sq thread release CPU | * 8ca9880735 drm:amd:amdgpu: Fix missing buffer object unlock in failure path | * 41c383c496 xen/blkfront: Only check REQ_FUA for writes | * 75955d6986 ASoC: dwc: move DMA init to snd_soc_dai_driver probe() | * 7e57a56374 ASoC: cs35l41: Fix default regmap values for some registers | * 424fc90272 mips: Move initrd_start check after initrd address sanitisation. | * dd035c08ee MIPS: Alchemy: fix dbdma2 | * 34dd1a90ab MIPS: Restore Au1300 support | * 048ad52d52 MIPS: unhide PATA_PLATFORM | * 3d48ea53c4 parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory() | * e522a12e48 parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu() | * 0b09b35cae ASoC: Intel: avs: Add missing checks on FE startup | * 5daa27bcb3 ASoC: Intel: avs: Account for UID of ACPI device | * c33fded7f1 ASoC: soc-pcm: test if a BE can be prepared | * 0a9b2164b7 btrfs: handle memory allocation failure in btrfs_csum_one_bio | * e9a5175d5e btrfs: scrub: try harder to mark RAID56 block groups read-only | * c45aed7431 drm: panel-orientation-quirks: Change Air's quirk to support Air Plus | * 2d9144c0ca power: supply: Fix logic checking if system is running from battery | * 808e103eba irqchip/meson-gpio: Mark OF related data as maybe unused | * 0cdb593c2f irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues | * bf8324676b regulator: Fix error checking for debugfs_create_dir | * c94be1f039 platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0 | * cdf9cfc1bb PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports | * 22358b9c41 power: supply: Ratelimit no data debug output | * a7620312a0 selftests: gpio: gpio-sim: Fix BUG: test FAILED due to recent change | * 79a0a3695e tools: gpio: fix debounce_period_us output of lsgpio | * cc1444a363 ARM: dts: vexpress: add missing cache properties | * 398bf0d67b power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() | * 66a88d04cf power: supply: sc27xx: Fix external_power_changed race | * e3d2bdca18 power: supply: ab8500: Fix external_power_changed race | * 628e40a225 of: overlay: Fix missing of_node_put() in error case of init_overlay_changeset() | * e01fc7caac ksmbd: validate smb request protocol id | * fec79e4f7d EDAC/qcom: Get rid of hardcoded register offsets | * 4b3ec6b6ff qcom: llcc/edac: Fix the base address used for accessing LLCC banks | * 314e973f36 cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks() | * c68b4db581 cgroup: always put cset in cgroup_css_set_put_fork | * 7a2e2ca9ad cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers | * 6111f0add6 test_firmware: prevent race conditions by a correct implementation of locking | * aa2dfdc4ed test_firmware: Use kstrtobool() instead of strtobool() | * 100cd6d0e5 x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed * | ed6634a559 Merge 'android14-6.1' into 'android14-6.1-lts' * | 3a63e65526 Revert "Bluetooth: fix debugfs registration" * | fb909d9bea Revert "Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER" * | 18dcace71e Revert "net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down" * | 16cecdd743 Revert "neighbour: fix unaligned access to pneigh_entry" * | ee4c9c95ff Merge 6.1.34 into android14-6.1-lts |\| | * ca87e77a2e Linux 6.1.34 | * 1aaa74177f Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE" | * a7e9c2e407 wifi: rtw88: correct PS calculation for SUPPORTS_DYNAMIC_PS | * 8fafd87155 wifi: rtw89: correct PS calculation for SUPPORTS_DYNAMIC_PS | * 5b2438f0a7 ext4: only check dquot_initialize_needed() when debugging | * 77eed67ba2 Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled" | * 543c12c264 ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop | * 8f2984233c ksmbd: fix out-of-bound read in parse_lease_state() | * bf12d7fb63 ksmbd: fix out-of-bound read in deassemble_neg_contexts() | * fb322da83c vhost_vdpa: support PACKED when setting-getting vring_base | * b839b65456 vhost: support PACKED when setting-getting vring_base | * 6c5a69c5dd vduse: avoid empty string for dev name | * 7e48d635f2 riscv: fix kprobe __user string arg print fault issue | * 14e4f37e46 soundwire: stream: Add missing clear of alloc_slave_rt | * e17734900a eeprom: at24: also select REGMAP | * 67180e079b riscv: mm: Ensure prot of VM_WRITE and VM_EXEC must be readable | * e4b76cd771 i2c: sprd: Delete i2c adapter in .remove's error path | * c53f2e8462 gpio: sim: fix memory corruption when adding named lines and unnamed hogs | * 4106894328 firmware: arm_ffa: Set handle field to zero in memory descriptor | * f24cb5a042 i2c: mv64xxx: Fix reading invalid status value in atomic mode | * 8e64012c03 arm64: dts: imx8mn-beacon: Fix SPI CS pinmux | * b64bbe8b1a blk-mq: fix blk_mq_hw_ctx active request accounting | * c3d87d415f ASoC: simple-card-utils: fix PCM constraint error check | * c0f9f799ba ASoC: mediatek: mt8195: fix use-after-free in driver remove path | * 50f2160afb ASoC: mediatek: mt8195-afe-pcm: Convert to platform remove callback returning void | * 370711d7f0 arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts | * efe115560a arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals | * 5a607e53f2 arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified sc7180-lite boards | * 037449ce1c ASoC: codecs: wsa881x: do not set can_multi_write flag | * 8b13854f26 ASoC: codecs: wsa883x: do not set can_multi_write flag | * 58ab8a0ff8 ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc | * 4b8ebe5393 ARM: at91: pm: fix imbalanced reference counter for ethernet devices | * c97f30d215 arm64: dts: qcom: sc8280xp: Flush RSC sleep & wake votes | * df9bc25d13 mm: page_table_check: Ensure user pages are not slab pages | * 08378f0314 mm: page_table_check: Make it dependent on EXCLUSIVE_SYSTEM_RAM | * 3901170529 usb: usbfs: Use consistent mmap functions | * 80e29f11be usb: usbfs: Enforce page requirements for mmap | * 42a7314f2b pinctrl: meson-axg: add missing GPIOA_18 gpio group | * fdeb712929 soc: qcom: icc-bwmon: fix incorrect error code passed to dev_err_probe() | * 30c26b985c virtio_net: use control_buf for coalesce params | * 222a6bc8a7 rbd: get snapshot context after exclusive lock is ensured to be held | * d647ee673c rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting | * 939f00e482 tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta' | * d088bea08a Bluetooth: hci_qca: fix debugfs registration | * e5ae01fd46 Bluetooth: fix debugfs registration | * a5490d6a74 Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk | * 1e1e2ee0cf s390/dasd: Use correct lock while counting channel queue length | * 6f5c0eec89 ceph: fix use-after-free bug for inodes when flushing capsnaps | * 443cf752f7 selftests: mptcp: update userspace pm subflow tests | * 8f0ba8ec18 selftests: mptcp: update userspace pm addr tests | * 3fa051b18f mptcp: update userspace pm infos | * 9b7fa33fda mptcp: add address into userspace pm list | * d80a36ad40 mptcp: only send RM_ADDR in nl_cmd_remove | * e0b04a9f97 can: j1939: avoid possible use-after-free when j1939_can_rx_register fails | * 8a46c4a2bc can: j1939: change j1939_netdev_lock type to mutex | * db15e90a8c can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket | * 727964650a wifi: iwlwifi: mvm: Fix -Warray-bounds bug in iwl_mvm_wait_d3_notif() | * 8953be60ec drm/amd/display: Reduce sdp bw after urgent to 90% | * 8695a443ad drm/amd/pm: Fix power context allocation in SMU13 | * 8e143bae25 drm/amdgpu: change reserved vram info print | * 34419aa0b4 drm/amdgpu: fix xclk freq on CHIP_STONEY | * 416ba40ff3 drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs | * 8d42c563e4 drm/i915/gt: Use the correct error value when kernel_context() fails | * b40b349132 ALSA: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41 | * b1acff11b6 ALSA: hda/realtek: Add Lenovo P3 Tower platform | * 6321135063 ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01 | * 0df0097ea2 ALSA: ice1712,ice1724: fix the kcontrol->id initialization | * caad8a0a10 ALSA: hda/realtek: Add quirk for Clevo NS50AU | * 3454490e03 ALSA: cmipci: Fix kctl->id initialization | * c35034fd64 ALSA: gus: Fix kctl->id initialization | * 1f6c520932 ALSA: ymfpci: Fix kctl->id initialization | * be0b9b7a6d ALSA: hda: Fix kctl->id initialization | * c8a46f39dd Input: fix open count when closing inhibited device | * f9172a0bb5 Input: psmouse - fix OOB access in Elantech protocol | * 00b59734f5 Input: xpad - delete a Razer DeathAdder mouse VID/PID entry | * 32c2c234bc batman-adv: Broken sync while rescheduling delayed work | * f9b9c84696 bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks | * abc7062313 bnxt_en: Prevent kernel panic when receiving unexpected PHC_UPDATE event | * 5ce24936d5 bnxt_en: Skip firmware fatal error recovery if chip is not accessible | * 5fc86a4580 bnxt_en: Query default VLAN before VNIC setup on a VF | * 53a0c6d5c9 bnxt_en: Don't issue AP reset during ethtool's reset operation | * 5df74018d1 net: bcmgenet: Fix EEE implementation | * d4925800a4 lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() | * c5a17f3247 drm/amdgpu: fix Null pointer dereference error in amdgpu_device_recover_vram | * dbc880567a bpf: Add extra path pointer check to d_path helper | * 06177b9290 net: sched: fix possible refcount leak in tc_chain_tmplt_add() | * e582ceda5a net: sched: act_police: fix sparse errors in tcf_police_dump() | * 60f39768ef net: sched: move rtm_tca_policy declaration to include file | * 76eef453a6 drm/i915/selftests: Add some missing error propagation | * 4e7f1f6da7 drm/i915/selftests: Stop using kthread_stop() | * 9d9a38b563 net: sched: add rcu annotations around qdisc->qdisc_sleeping | * 8a74ea37e1 rfs: annotate lockless accesses to RFS sock flow table | * 3d9eface2e rfs: annotate lockless accesses to sk->sk_rxhash | * f8e6aa0e60 tcp: gso: really support BIG TCP | * 251b5d68ac ipv6: rpl: Fix Route of Death. | * 65f2def206 netfilter: nf_tables: out-of-bound check in chain blob | * fea199dbf6 netfilter: ipset: Add schedule point in call_ad(). | * f057da51c0 netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper | * 1f26ea49a5 netfilter: nft_bitwise: fix register tracking | * 81e11b6c1a selftests/bpf: Fix sockopt_sk selftest | * 1ba0353545 selftests/bpf: Verify optval=NULL case | * 0d18f8b90b wifi: cfg80211: fix locking in sched scan stop work | * 4a64e92846 qed/qede: Fix scheduling while atomic | * 79c975514c wifi: mac80211: don't translate beacon/presp addrs | * 4dd40fec5b wifi: mac80211: mlme: fix non-inheritence element | * 8b6ab4bfba wifi: cfg80211: reject bad AP MLD address | * 434cf4fbee wifi: mac80211: use correct iftype HE cap | * 3e8a7573ff Bluetooth: L2CAP: Add missing checks for invalid DCID | * 66b3f7425a Bluetooth: ISO: don't try to remove CIG if there are bound CIS left | * 9c7e51b947 Bluetooth: Fix l2cap_disconnect_req deadlock | * 17aac12002 Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER | * 5f285409c9 drm/i915: Use 18 fast wake AUX sync len | * 7bf7bebdc2 drm/i915: Explain the magic numbers for AUX SYNC/precharge length | * 1d37434ffc net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values | * a22c0a0346 net: enetc: correct rx_bytes statistics of XDP | * b3fc768a74 net: enetc: correct the statistics of rx bytes | * 7a5cdd4bc1 net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT | * 76e38e6e1b net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down | * 3849e7fcea bpf: Fix elem_size not being set for inner maps | * d7612a922b bpf: Fix UAF in task local storage | * 9166225c3b net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294 | * 332f36a09c net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods | * 8af3119388 neighbour: fix unaligned access to pneigh_entry | * 898c9a0ee7 bpf, sockmap: Avoid potential NULL dereference in sk_psock_verdict_data_ready() | * e783f639b8 wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll | * 84c699681a afs: Fix setting of mtime when creating a file/dir/symlink | * fb7058dd02 spi: qup: Request DMA before enabling clocks | * ec2e12b14a platform/surface: aggregator_tabletsw: Add support for book mode in KIP subsystem | * 24845da026 platform/surface: aggregator: Allow completion work-items to be executed in parallel | * 31c3de5f7b spi: mt65xx: make sure operations completed before unloading | * 097acf0aa6 net: sfp: fix state loss when updating state_hw_mask | * ec3ce2c7cf scsi: megaraid_sas: Add flexible array member for SGLs * | 32d0f34bbc Revert "tcp: deny tcp_disconnect() when threads are waiting" * | 2a77668d45 Merge 6.1.33 into android14-6.1-lts |\| | * 2f3918bc53 Linux 6.1.33 | * c3fcfe8931 ext4: enable the lazy init thread when remounting read/write | * 84683a2cf5 selftests: mptcp: join: avoid using 'cmp --bytes' | * fbb6db561d selftests: mptcp: simult flows: skip if MPTCP is not supported | * 4bc022b953 selftests: mptcp: diag: skip if MPTCP is not supported | * e8631d84c0 arm64: efi: Use SMBIOS processor version to key off Ampere quirk | * b026755cc9 tls: rx: strp: don't use GFP_KERNEL in softirq context | * a2961463d7 xfs: verify buffer contents when we skip log replay | * 4042d7ad40 drm/amd/display: Have Payload Properly Created After Resume | * 4a9d63181f iommu/amd/pgtbl_v2: Fix domain max address | * 3264d875f5 tpm, tpm_tis: Request threaded interrupt handler | * 77ee4f8c02 regmap: Account for register length when chunking | * a8eaa9a06a fs/ntfs3: Validate MFT flags before replaying logs | * 0b28edf227 KEYS: asymmetric: Copy sig and digest in public_key_verify_signature() | * 4f303c0b9d ksmbd: fix multiple out-of-bounds read during context decoding | * 522a9417f6 ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate | * 4c6bdaacb3 ksmbd: fix incorrect AllocationSize set in smb2_get_info | * f7add4d159 ksmbd: fix UAF issue from opinfo->conn | * 8072ea6743 ksmbd: fix credit count leakage | * 5f4d3810ca KVM: x86: Account fastpath-only VM-Exits in vCPU stats | * b1d5667afa KVM: arm64: Populate fault info for watchpoint | * 0659aee089 test_firmware: fix the memory leak of the allocated firmware buffer | * eef67dfdc0 test_firmware: fix a memory leak with reqs buffer | * 33aebb0148 powerpc/xmon: Use KSYM_NAME_LEN in array size | * 97211945ef serial: cpm_uart: Fix a COMPILE_TEST dependency | * 7493392a37 serial: 8250_tegra: Fix an error handling path in tegra_uart_probe() | * 3270095f6e fbcon: Fix null-ptr-deref in soft_cursor | * ef8aeffb2c ext4: add lockdep annotations for i_data_sem for ea_inode's | * 140aa33f96 ext4: disallow ea_inodes with extended attributes | * 277cea6f77 ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find() | * b112babc56 ext4: add EA_INODE checking to ext4_iget() | * 9ce0319b05 mptcp: fix active subflow finalization | * 977a63afd4 mptcp: fix connect timeout handling | * 97ecfe67f5 selftests: mptcp: userspace pm: skip if MPTCP is not supported | * f324df8de0 selftests: mptcp: sockopt: skip if MPTCP is not supported | * 0fea987ccf selftests: mptcp: join: skip if MPTCP is not supported | * 17ddf2a54e selftests: mptcp: pm nl: skip if MPTCP is not supported | * 68ecc09a14 selftests: mptcp: connect: skip if MPTCP is not supported | * 3f731926a1 tracing/probe: trace_probe_primary_from_call(): checked list_first_entry | * 7403630eb9 tracing/histograms: Allow variables to have some modifiers | * 2a1195f0e0 tracing/timerlat: Always wakeup the timerlat thread | * 007c042256 mtdchar: mark bits of ioctl handler noinline | * d7c34c8f60 selinux: don't use make's grouped targets feature yet | * 6fb0b098f6 io_uring: undeprecate epoll_ctl support | * 94f97b8df0 riscv: perf: Fix callchain parse error with kernel tracepoint events | * c40dc6e266 tpm, tpm_tis: correct tpm_tis_flags enumeration values | * b0e21c42c1 iommu/amd: Fix domain flush size when syncing iotlb | * 251cf7fd5a powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall | * 2a72e6814f block: fix revalidate performance regression | * 867ad8cba2 phy: qcom-qmp-pcie-msm8996: fix init-count imbalance | * 5daf7a171d phy: qcom-qmp-combo: fix init-count imbalance | * 1af8dd5403 btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds | * 380d2da555 tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK | * 2c8aa1163a mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order | * f25568e080 mmc: vub300: fix invalid response handling | * 03974abbf2 x86/mtrr: Revert 90b926e68f50 ("x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case") | * 8db2ea7b80 drm/amd/pm: reverse mclk and fclk clocks levels for renoir | * f05f3fcc78 drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp | * 1c729bd5b3 drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5 | * 0f8f233ed7 drm/amd/pm: resolve reboot exception for si oland | * e0a0f5d2ba drm/amd/pm: reverse mclk and fclk clocks levels for vangogh | * 00abb872ef drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4 | * 2f91f92bd8 drm/amdgpu: enable tmz by default for GC 11.0.1 | * 009886965e ata: libata-scsi: Use correct device no in ata_find_dev() | * 63a44b01df scsi: stex: Fix gcc 13 warnings | * 2e787e5153 misc: fastrpc: reject new invocations during device removal | * 93f2aa05af misc: fastrpc: return -EPIPE to invocations on device removal | * cbfed647fd md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk() | * 704842c97a usb: gadget: f_fs: Add unbind event before functionfs_unbind | * cc8c9864da usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM | * 08e8ff68a3 dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type | * ef12610ff5 net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 | * 3cfdc3fc18 iio: dac: build ad5758 driver when AD5758 is selected | * f453753900 iio: adc: stm32-adc: skip adc-diff-channels setup if none is present | * 735d033bed iio: adc: ad7192: Change "shorted" channels to differential | * 84f4d63ae1 iio: addac: ad74413: fix resistance input processing | * ab0c2dffe8 iio: dac: mcp4725: Fix i2c_master_send() return value handling | * 89f92d4353 iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag | * 2eb2696051 iio: adc: stm32-adc: skip adc-channels setup if none is present | * 54d737d796 iio: light: vcnl4035: fixed chip ID check | * 2896a356ed dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value | * cb2a612c39 iio: imu: inv_icm42600: fix timestamp reset | * 3fb021f5c1 HID: wacom: avoid integer overflow in wacom_intuos_inout() | * 254be1f648 HID: google: add jewel USB id | * 23c241676f iio: adc: mxs-lradc: fix the order of two cleanup operations | * b6867ce5fb iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method | * 47cc3cae30 media: uvcvideo: Don't expose unsupported formats to userspace | * 4d77637112 drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug | * 7d233f9359 mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() | * 4124000cf4 media: mediatek: vcodec: Only apply 4K frame sizes on decoder formats | * bafe94ac99 KVM: arm64: vgic: Fix locking comment | * 150a5f74a5 KVM: arm64: vgic: Wrap vgic_its_create() with config_lock | * 4129d71e5b KVM: arm64: vgic: Fix a circular locking issue | * 7df6008b87 block: Deny writable memory mapping if block is read-only | * 16ddd3bc67 nvme-pci: Add quirk for Teamgroup MP33 SSD | * a731273f3c ublk: fix AB-BA lockdep warning | * 68ce1d57e5 drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged | * baa8901ad7 ceph: silence smatch warning in reconnect_caps_cb() | * 56e5d63e4e atm: hide unused procfs functions | * 47d0f62679 drm/msm: Be more shouty if per-process pgtables aren't working | * c62a9a6bea ALSA: oss: avoid missing-prototype warnings | * e4f1532a9c nvme: do not let the user delete a ctrl before a complete initialization | * f481c2af49 nvme-multipath: don't call blk_mark_disk_dead in nvme_mpath_remove_disk | * d001347067 netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT | * def67e27f2 net: wwan: t7xx: Ensure init is completed before system sleep | * ae72bd1a4b wifi: b43: fix incorrect __packed annotation | * c061e13c72 scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed | * 7402fb48ef wifi: iwlwifi: mvm: Add locking to the rate read flow | * 788f129f63 wifi: mac80211: recalc chanctx mindef before assigning | * a034600611 wifi: mac80211: consider reserved chanctx for mindef | * aefa37aa32 wifi: mac80211: simplify chanctx allocation | * bdd97c99b3 arm64: vdso: Pass (void *) to virt_to_page() | * 6bf0f6bfcd arm64/mm: mark private VM_FAULT_X defines as vm_fault_t | * e0b5316e2e ARM: dts: stm32: add pin map for CAN controller on stm32f7 | * de16dfe7ca wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value | * 329da6d07c ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P | * 905b247f6e s390/topology: honour nr_cpu_ids when adding CPUs | * 26cfe2faa8 s390/pkey: zeroize key blobs | * 9f2f538cd8 ASoC: SOF: pm: save io region state in case of errors in resume | * eb708aee41 ASoC: SOF: sof-client-probes: fix pm_runtime imbalance in error handling | * 1cc6301dfc ASoC: SOF: pcm: fix pm_runtime imbalance in error handling | * a6637d5a8f ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions | * d5d61f747e media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 | * d0088ea444 media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() | * 4a8ecfb220 media: dvb-core: Fix use-after-free due to race at dvb_register_device() | * 93b5dfebcb media: dvb-core: Fix use-after-free due on race condition at dvb_net | * bf3b6f82fd media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table | * ea2938c27b media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() | * dd68399361 media: dvb_ca_en50221: fix a size write bug | * 058822591b media: netup_unidvb: fix irq init by register it at the end of probe | * b769fbf04a media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address | * 5d2923fb0b media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() | * 6906e613e6 media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer | * 4e896b2263 media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() | * 336ca9b371 media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() | * 1027c8c068 media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() | * 8914ae00db media: dvb_demux: fix a bug for the continuity counter | * 59dad726de ASoC: ssm2602: Add workaround for playback distortions | * 7fbdd3bd7b ALSA: hda/realtek: Add quirks for ASUS GU604V and GU603V | * 603f239216 ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs | * f6d2aa322c xfrm: Check if_id in inbound policy/secpath match | * 40798c566b um: harddog: fix modular build | * c03dd93905 ASoC: dwc: limit the number of overrun messages | * 0960fb87cd ASoC: amd: yc: Add DMI entry to support System76 Pangolin 12 | * 7d98a36b10 nvme-pci: add quirk for missing secondary temperature thresholds | * 53786bfadc nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G | * 46193dd43d block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE | * 5af920e4d1 nbd: Fix debugfs_create_dir error checking | * f83c32ed05 fbdev: stifb: Fix info entry in sti_struct on error path | * be2aefa202 fbdev: modedb: Add 1920x1080 at 60 Hz video mode | * c6c0a9f619 fbdev: imsttfb: Fix use after free bug in imsttfb_probe | * 3e336ad6f5 drm/amdgpu: set gfx9 onwards APU atomics support to be true | * 5ae4a618a1 gfs2: Don't deref jdesc in evict | * 61c3962ab1 platform/mellanox: fix potential race in mlxbf-tmfifo driver | * 809efd7a69 platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield | * 18913fc7c1 media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE | * 705f4dcc41 hwmon: (k10temp) Add PCI ID for family 19, model 78h | * 6578e0f196 ARM: 9295/1: unwind:fix unwind abort for uleb128 case | * 0433baa893 btrfs: abort transaction when sibling keys check fails for leaves | * e2d161c539 drm/ast: Fix ARM compatibility | * cad1abbe48 mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() | * 88a042d599 drm/amdgpu: Use the default reset when loading or reloading the driver | * 6a40da6007 ASoC: Intel: soc-acpi-cht: Add quirk for Nextbook Ares 8A tablet | * a7ec48a419 ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs. | * 867dae5547 watchdog: menz069_wdt: fix watchdog initialisation | * 787e74b213 drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init" | * e2feb39312 mptcp: add annotations around sk->sk_shutdown accesses | * 0b9e6d64cd mptcp: fix data race around msk->first access | * 519f16d96c mptcp: consolidate passive msk socket initialization | * fa2cbd1d68 mptcp: simplify subflow_syn_recv_sock() | * 9872e8c632 mptcp: avoid unneeded address copy | * 1b9e3ab669 mptcp: add annotations around msk->subflow accesses | * c5ebb5cec9 mptcp: avoid unneeded __mptcp_nmpc_socket() usage | * ea9d7382d5 rtnetlink: call validate_linkmsg in rtnl_create_link | * 62dcac528b mtd: rawnand: marvell: don't set the NAND frequency select | * 2187cb72b9 mtd: rawnand: marvell: ensure timing values are written | * a0843347a9 net: dsa: mv88e6xxx: Increase wait after reset deactivation | * c3fc733798 tcp: fix mishandling when the sack compression is deferred. | * eac615ed3c net/sched: flower: fix possible OOB write in fl_set_geneve_opt() | * 4fc2724f44 iommu/mediatek: Flush IOTLB completely only if domain has been attached | * 9316fdd57f net/mlx5: Read embedded cpu after init bit cleared | * 4156c6ff33 net/mlx5e: Fix error handling in mlx5e_refresh_tirs | * 7c3e271626 nvme: fix the name of Zone Append for verbose logging | * 4e5a5cda3d nfsd: fix double fget() bug in __write_ports_addfd() | * 401a1cf50b udp6: Fix race condition in udp6_sendmsg & connect | * 507182f132 net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report | * 5c05ef3630 net: sched: fix NULL pointer dereference in mq_attach | * f8884108a2 net/sched: Prohibit regrafting ingress or clsact Qdiscs | * be3e1f71cb net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs | * 1ec1434630 net/sched: sch_clsact: Only create under TC_H_CLSACT | * 89a0f4dcae net/sched: sch_ingress: Only create under TC_H_INGRESS | * d67a5a587c net/smc: Don't use RMBs not mapped to new link in SMCRv2 ADD LINK | * 8c3ec8e789 net/smc: Scan from current RMB list when no position specified | * 752836e1a2 tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set | * c2251ce048 tcp: deny tcp_disconnect() when threads are waiting | * 0dec22a09d af_packet: do not use READ_ONCE() in packet_bind() | * 906134664f RDMA/irdma: Fix Local Invalidate fencing | * 07322c8a12 RDMA/irdma: Prevent QP use after free | * 3cf7747414 mtd: rawnand: ingenic: fix empty stub helper definitions | * 789394f1df perf ftrace latency: Remove unnecessary "--" from --use-nsec option | * 7164961a9c amd-xgbe: fix the false linkup in xgbe_phy_status | * d615070b0e tls: improve lockless access safety of tls_err_abort() | * 0b64a2bf16 af_packet: Fix data-races of pkt_sk(sk)->num. | * a2c2364e5f netrom: fix info-leak in nr_write_internal() | * ae0ef97f1e net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure | * 724aa4fd9e net/mlx5e: Don't attach netdev profile while handling internal error | * 9c7ae143a0 net/mlx5: fw_tracer, Fix event handling | * e73b7de4bf net/mlx5: SF, Drain health before removing device | * 9e49af9766 net/mlx5: Drain health before unregistering devlink | * ddd8d552a8 riscv: Fix unused variable warning when BUILTIN_DTB is set | * 72fef70abe dmaengine: pl330: rename _start to prevent build error | * bd424277a1 nfsd: make a copy of struct iattr before calling notify_change | * dac09fec5b iommu/amd: Fix up merge conflict resolution | * 817ce9b1d2 iommu/amd: Handle GALog overflows | * c3ff24625a iommu/amd: Don't block updates to GATag if guest mode is on | * bf1f3f4aa4 iommu/rockchip: Fix unwind goto issue | * 0021441cbb RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx | * dcaa61b73d RDMA/bnxt_re: Fix a possible memory leak | * 44fc5eb0e2 dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved() | * ef8c761693 RDMA/hns: Modify the value of long message loopback slice | * 736e1c4e54 RDMA/hns: Fix base address table allocation | * 38771c0eef RDMA/hns: Fix timeout attr in query qp for HIP08 | * 241de3fec1 RDMA/efa: Fix unsupported page sizes in device | * 21c0eb0648 phy: amlogic: phy-meson-g12a-mipi-dphy-analog: fix CNTL2_DIF_TX_CTL0 value | * 836f874d43 RDMA/bnxt_re: Fix the page_size used during the MR creation * | c5df11c964 Merge branch 'android14-6.1' into branch 'android14-6.1-lts' * | 3a53767f1f Revert "bpf, sockmap: Pass skb ownership through read_skb" * | 8e369c7704 Revert "bpf, sockmap: Convert schedule_work into delayed_work" * | d7c3711e7d Revert "bpf, sockmap: Reschedule is now done through backlog" * | 4903ee3f95 Revert "bpf, sockmap: Improved check for empty queue" * | 51ffabff7c Revert "bpf, sockmap: Handle fin correctly" * | 3ce63059c1 Revert "bpf, sockmap: TCP data stall on recv before accept" * | c7e4973846 Revert "bpf, sockmap: Wake up polling after data copy" * | 0851b00164 Revert "bpf, sockmap: Incorrectly handling copied_seq" * | 26b6ad0f34 Merge 6.1.32 into android14-6.1-lts |\| | * 76ba310227 Linux 6.1.32 | * cd51ba98ae tools headers UAPI: Sync the linux/in.h with the kernel sources | * 2cd02ae656 netfilter: ctnetlink: Support offloaded conntrack entry deletion | * 55ce796e9b cpufreq: amd-pstate: Add ->fast_switch() callback | * c18f6919b4 cpufreq: amd-pstate: Update policy->cur in amd_pstate_adjust_perf() | * efc8ec1636 block: fix bio-cache for passthru IO | * 5d08604754 Revert "thermal/drivers/mellanox: Use generic thermal_zone_get_trip() function" | * 2333dbc88f bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() | * 6c1fad655b drm/amd: Don't allow s0ix on APUs older than Raven | * 83a7f27c5b octeontx2-af: Add validation for lmac type | * 3236221bb8 RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task" | * 592af07ac0 wifi: iwlwifi: mvm: fix potential memory leak | * 0c469078bd wifi: iwlwifi: mvm: support wowlan info notification version 2 | * b5ceb6aac6 wifi: rtw89: correct 5 MHz mask setting | * 07c8c1a3cf net: phy: mscc: enable VSC8501/2 RGMII RX clock | * 7c95f56995 page_pool: fix inconsistency for page_pool_ring_[un]lock() | * 7dccd5fa7e net: page_pool: use in_softirq() instead | * cd3c5e4e0d vfio/type1: check pfn valid before converting to struct page | * 6793a3c632 blk-mq: fix race condition in active queue accounting | * fe735073a5 bpf, sockmap: Incorrectly handling copied_seq | * dd628fc697 bpf, sockmap: Wake up polling after data copy | * ab90b68f65 bpf, sockmap: TCP data stall on recv before accept | * 3a2129ebae bpf, sockmap: Handle fin correctly | * ba4fec5bd6 bpf, sockmap: Improved check for empty queue | * 1e4e379ccd bpf, sockmap: Reschedule is now done through backlog | * 9f4d7efb33 bpf, sockmap: Convert schedule_work into delayed_work | * 4ae2af3e59 bpf, sockmap: Pass skb ownership through read_skb | * 49b5b5bfee gpio-f7188x: fix chip name and pin count on Nuvoton chip | * 085f27f48c net/mlx5: E-switch, Devcom, sync devcom events and devcom comp register | * 3347ac7a81 tls: rx: strp: preserve decryption status of skbs when needed | * ba93977437 tls: rx: strp: factor out copying skb data | * 52a89de3e9 tls: rx: strp: force mixed decrypted records into copy mode | * c48b8399e4 tls: rx: strp: fix determining record length in copy mode | * ecd9f6ed9e tls: rx: strp: set the skb->len of detached / CoW'ed skbs | * e734a693a2 tls: rx: device: fix checking decryption status | * b3e54fb3a3 platform/x86/amd/pmf: Fix CnQF and auto-mode after resume | * 8e8c33cc89 selftests/bpf: Fix pkg-config call building sign-file | * ca39992f10 firmware: arm_ffa: Fix usage of partition info get count flag | * 3f5413c954 ipv{4,6}/raw: fix output xfrm lookup wrt protocol | * 6728486447 inet: Add IP_LOCAL_PORT_RANGE socket option * | c3dee37bcd Revert "Revert "binder_alloc: add missing mmap_lock calls when using the VMA"" * | f9689ed69b Revert "Revert "android: binder: stop saving a pointer to the VMA"" * | 896fd52618 Revert "binder: add lockless binder_alloc_(set|get)_vma()" * | 9f67f4f500 Revert "binder: fix UAF caused by faulty buffer cleanup" * | 940f3dad8f Revert "binder: fix UAF of alloc->vma in race with munmap()" * | 03c3264a15 Merge 6.1.31 into android14-6.1-lts |\| | * d2869ace6e Linux 6.1.31 | * 2f32b89d81 net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE | * 3bcb97e424 3c589_cs: Fix an error handling path in tc589_probe() | * 9540765d18 net/smc: Reset connection when trying to use SMCRv2 fails. | * be4022669e regulator: mt6359: add read check for PMIC MT6359 | * 22157f7445 firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors | * 1ae70faa86 arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay | * 3e8a82fb55 net/mlx5: Devcom, serialize devcom registration | * eaa365c104 net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device | * 411e4d6caa net/mlx5: Collect command failures data only for known commands | * 390aa5c006 net/mlx5: Fix error message when failing to allocate device memory | * 59dd110ca2 net/mlx5: DR, Check force-loopback RC QP capability independently from RoCE | * b17294e7aa net/mlx5: Handle pairing of E-switch via uplink un/load APIs | * e501ab1366 net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs | * 6f0dce5f78 net/mlx5e: do as little as possible in napi poll when budget is 0 | * 00959a1bad net/mlx5e: Use correct encap attribute during invalidation | * 362063df6c net/mlx5e: Fix deadlock in tc route query code | * 2051f762c5 net/mlx5e: Fix SQ wake logic in ptp napi_poll context | * 47b4f741a3 platform/mellanox: mlxbf-pmc: fix sscanf() error checking | * 04238c2385 forcedeth: Fix an error handling path in nv_probe() | * 0392c9185d sctp: fix an issue that plpmtu can never go to complete state | * c9e09b070d cxl: Wait Memory_Info_Valid before access memory related info | * ad72cb5899 ASoC: Intel: avs: Access path components under lock | * 6ae9cf40b4 ASoC: Intel: avs: Fix declaration of enum avs_channel_config | * 5eaaad19c8 ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg | * d8cfe5ccc9 x86/show_trace_log_lvl: Ensure stack pointer is aligned, again | * a7edc86e14 xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() | * 53384076f7 x86/pci/xen: populate MSI sysfs entries | * 84b211b028 ARM: dts: imx6qdl-mba6: Add missing pvcie-supply regulator | * 225a5f394b coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() | * 5522469095 platform/x86: ISST: Remove 8 socket limit | * f34428b5a3 regulator: pca9450: Fix BUCK2 enable_mask | * ccc6e9ded6 fs: fix undefined behavior in bit shift for SB_NOUSER | * dfc5aaa57f firmware: arm_ffa: Fix FFA device names for logical partitions | * ad73dc7263 firmware: arm_ffa: Check if ffa_driver remove is present before executing | * 06ec5be891 optee: fix uninited async notif value | * 9c744c6ff2 power: supply: sbs-charger: Fix INHIBITED bit for Status reg | * 71e60a58d7 power: supply: bq24190: Call power_supply_changed() after updating input current | * 1f02bfd5d9 power: supply: bq25890: Call power_supply_changed() after updating input current or voltage | * 57842035d2 power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize | * 221f7cb122 power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes | * 3c573e7910 power: supply: bq27xxx: Move bq27xxx_battery_update() down | * 9108ede08d power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status() | * d952a1eaaf power: supply: bq27xxx: Fix poll_interval handling and races on remove | * e65fee4568 power: supply: bq27xxx: Fix I2C IRQ race on remove | * d746fbf4f0 power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition | * e1073f8147 power: supply: mt6360: add a check of devm_work_autocancel in mt6360_charger_probe | * 2ac38f130e power: supply: leds: Fix blink to LED on transition | * 94373413e1 cifs: mapchars mount option ignored | * 91dd8aab9c ipv6: Fix out-of-bounds access in ipv6_find_tlv() | * 9bc1dbfd91 lan966x: Fix unloading/loading of the driver | * 1a9e80f757 bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps | * 177ee41f61 bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields | * a1d7c357f4 octeontx2-pf: Fix TSOv6 offload | * 4883d9e2a2 selftests: fib_tests: mute cleanup error message | * 722af06e61 drm: fix drmm_mutex_init() | * cc18b46859 net: fix skb leak in __skb_tstamp_tx() | * 8d81d3b0ed ASoC: lpass: Fix for KASAN use_after_free out of bounds | * 53764a17f5 media: radio-shark: Add endpoint checks | * d5dba4b7bf USB: sisusbvga: Add endpoint checks | * 09e9d1f52f USB: core: Add routines for endpoint checks in old drivers | * 2a112f0462 udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). | * ed66e6327a net: fix stack overflow when LRO is disabled for virtual interfaces | * c8fdf7feca fbdev: udlfb: Fix endpoint check | * d7fff52c99 debugobjects: Don't wake up kswapd from fill_pool() | * 8694853768 irqchip/mips-gic: Use raw spinlock for gic_lock | * dc1b7641a9 irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable | * 4ca6b06e9b x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms | * ed0ef89508 perf/x86/uncore: Correct the number of CHAs on SPR | * f3078be2fe drm/amd/amdgpu: limit one queue per gang | * 34570f85a2 selftests/memfd: Fix unknown type name build failure | * 931ea1ed31 binder: fix UAF of alloc->vma in race with munmap() | * e1e198eff1 binder: fix UAF caused by faulty buffer cleanup | * d7cee853bc binder: add lockless binder_alloc_(set|get)_vma() | * 72a94f8c14 Revert "android: binder: stop saving a pointer to the VMA" | * 7e6b854854 Revert "binder_alloc: add missing mmap_lock calls when using the VMA" | * 8069bcaa5b drm/amd/pm: Fix output of pp_od_clk_voltage | * 6acfbdda4d drm/amd/pm: add missing NotifyPowerSource message mapping for SMU13.0.7 | * 8756863c7f drm/radeon: reintroduce radeon_dp_work_func content | * 3897ac532a drm/mgag200: Fix gamma lut not initialized. | * 3970ee926e dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type | * 937264cd9a btrfs: use nofs when cleaning up aborted transactions | * 63e12910b7 gpio: mockup: Fix mode of debugfs files | * b49706d179 parisc: Handle kprobes breakpoints only in kernel context | * 5596e2ef5f parisc: Enable LOCKDEP support | * d935edd510 parisc: Allow to reboot machine after system halt | * c49ffd89b6 parisc: Fix flush_dcache_page() for usage from irq context | * c0993b463f parisc: Handle kgdb breakpoints only in kernel context | * e1f14a4071 parisc: Use num_present_cpus() in alternative patching code | * bd90ac0002 xtensa: add __bswap{si,di}2 helpers | * 522bbbfcb6 xtensa: fix signal delivery to FDPIC process | * 0845660508 m68k: Move signal frame following exception on 68020/030 | * 6147745d43 net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize | * da1e8adab3 ASoC: rt5682: Disable jack detection interrupt during suspend | * 72c28207c1 power: supply: bq25890: Fix external_power_changed race | * 0456b91212 power: supply: axp288_fuel_gauge: Fix external_power_changed race | * 7d5e0150ee mmc: block: ensure error propagation for non-blk | * a24aec210a mmc: sdhci-esdhc-imx: make "no-mmc-hs400" works | * 0d97634ad4 SUNRPC: Don't change task->tk_status after the call to rpc_exit_task | * 40599969ff ALSA: hda/realtek: Enable headset onLenovo M70/M90 | * 7d3d306f15 ALSA: hda: Fix unhandled register update during auto-suspend period | * 5222e81afa ALSA: hda/ca0132: add quirk for EVGA X299 DARK | * 688c9af6e5 platform/x86/intel/ifs: Annotate work queue on stack so object debug does not complain | * c26b9e1931 x86/mm: Avoid incomplete Global INVLPG flushes | * 4eb600f386 arm64: Also reset KASAN tag if page is not PG_mte_tagged | * 8bdf47f9db ocfs2: Switch to security_inode_init_security() | * 28ee628fff drm/amd/display: hpd rx irq not working with eDP interface | * 7bfd4c0ebc net: dsa: mv88e6xxx: Add RGMII delay to 88E6320 | * 66ede2e423 platform/x86: hp-wmi: Fix cast to smaller integer type warning | * 0dbc898f59 skbuff: Proactively round up to kmalloc bucket size | * ac2f5739fd drm/amdgpu/mes11: enable reg active poll | * a2fe4534bb drm/amd/amdgpu: update mes11 api def | * ae9e65319f watchdog: sp5100_tco: Immediately trigger upon starting. | * 7cd46930b8 tpm: Prevent hwrng from activating during resume | * 25d38d5eaa tpm: Re-enable TPM chip boostrapping non-tpm_tis TPM drivers | * e76f61a2c5 tpm, tpm_tis: startup chip before testing for interrupts | * 9953dbf65f tpm_tis: Use tpm_chip_{start,stop} decoration inside tpm_tis_resume | * c5a5d33886 tpm, tpm_tis: Only handle supported interrupts | * 5c4c8075bc tpm, tpm_tis: Avoid cache incoherency in test for interrupts | * 1ec145277a usb: dwc3: fix gadget mode suspend interrupt handler issue * | fd07e1d347 ANDROID: GKI: add skb_pull_data to android/abi_gki_aarch64_virtual_device * | 83377b0a3f ANDROID: GKI: preserve CRC generation for some bluetooth symbols * | 907f29932c Revert "Revert "usb: gadget: udc: core: Invoke usb_gadget_connect only when started"" * | bfd5fc9a7e Revert "tipc: add tipc_bearer_min_mtu to calculate min mtu" * | d71d75e074 Revert "tipc: do not update mtu if msg_max is too small in mtu negotiation" * | 9626cfb677 Revert "tipc: check the bearer min mtu properly when setting it by netlink" * | 5caf658594 Revert "platform: Provide a remove callback that returns no value" * | f1fdb6e6a9 Revert "ASoC: fsl_micfil: Fix error handler with pm_runtime_enable" * | e2b436192b Revert "firmware: arm_sdei: Fix sleep from invalid context BUG" * | 26c1cc6858 Merge 6.1.30 into android14-6.1-lts |\| | * a343b0dd87 Linux 6.1.30 | * da9a8dc33d drm/amdgpu: reserve the old gc_11_0_*_mes.bin | * 616843d5a1 drm/amd/amdgpu: introduce gc_*_mes_2.bin v2 | * 09bf14907d drm/amdgpu: declare firmware for new MES 11.0.4 | * f05ccf6a6a crypto: testmgr - fix RNG performance in fuzz tests | * 682679fc95 remoteproc: imx_dsp_rproc: Fix kernel test robot sparse warning | * 7099e14f60 rethook, fprobe: do not trace rethook related functions | * c46d3efb4d rethook: use preempt_{disable, enable}_notrace in rethook_trampoline_handler | * 4e38a02b22 arm64: mte: Do not set PG_mte_tagged if tags were not initialized | * 02cf4a336e s390/qdio: fix do_sqbs() inline assembly constraint | * 25e8d30507 s390/crypto: use vector instructions only if available for ChaCha20 | * eeb63c07ba s390/dasd: fix command reject error on ESE devices | * acc2a40e42 nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() | * 0fc73f310c powerpc/64s/radix: Fix soft dirty tracking | * ae5d148965 tpm/tpm_tis: Disable interrupts for more Lenovo devices | * 9a74146540 powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device | * fc983cf5dd powerpc/iommu: DMA address offset is incorrectly calculated with 2MB TCEs | * 6e092fa42e dt-bindings: ata: ahci-ceva: Cover all 4 iommus entries | * 76313a63f7 drm/amdgpu/gfx11: update gpu_clock_counter logic | * 055852074c drm/amdgpu: refine get gpu clock counter method | * 4e2f9159f9 drm/amdgpu/gfx11: Adjust gfxoff before powergating on gfx11 as well | * abfe2ffc00 drm/amdgpu/gfx10: Disable gfxoff before disabling powergating. | * 9de5a98588 drm/amdgpu/gmc11: implement get_vbios_fb_size() | * 903e942500 drm/amd/pm: fix possible power mode mismatch between driver and PMFW | * 595824a450 ceph: force updating the msg pointer in non-split case | * 3338d0b9ac vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF | * e16629c639 thunderbolt: Clear registers properly when auto clear isn't in use | * abc7e50e89 serial: qcom-geni: fix enabling deactivated interrupt | * 1db5db7a99 serial: 8250_exar: Add support for USR298x PCI Modems | * cda8aa19bf serial: Add support for Advantech PCI-1611U card | * 2cab13f500 mm: fix zswap writeback race condition | * 254ee53028 maple_tree: make maple state reusable after mas_empty_area() | * 6c4172d44c statfs: enforce statfs[64] structure initialization | * 154de42fe3 KVM: Fix vcpu_array[0] races | * 75378b03a9 ksmbd: fix global-out-of-bounds in smb2_find_context_vals | * 40d90ee027 ksmbd: fix wrong UserName check in session_user | * af7335a4b9 ksmbd: allocate one more byte for implied bcc[0] | * f1d013b0f0 ksmbd: smb2: Allow messages padded to 8byte boundary | * 4d25f93e64 SMB3: drop reference to cfile before sending oplock break | * 3b66d58c89 SMB3: Close all deferred handles of inode in case of handle lease break | * 107677a8f4 wifi: rtw88: use work to update rate to avoid RCU warning | * d61191092d can: kvaser_pciefd: Disable interrupts in probe error path | * eabb11236a can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt | * 45ce3beb02 can: kvaser_pciefd: Clear listen-only bit if not explicitly requested | * fcdfc1860f can: kvaser_pciefd: Empty SRB buffer in probe | * 50bdf44a1b can: kvaser_pciefd: Call request_irq() before enabling interrupts | * 24bdfcb099 can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() | * 9cd1025b1a can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag | * 836641cc41 can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag | * 0eee95cbbb ALSA: hda/realtek: Fix mute and micmute LEDs for yet another HP laptop | * 0cc95fdb67 ALSA: hda/realtek: Add quirk for HP EliteBook G10 laptops | * 4ea7c3388f ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 | * 9328c65694 ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 | * 30043b0a06 ALSA: hda/realtek: Add quirk for Clevo L140AU | * 0e1e6c0779 ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table | * dc8c569d59 ALSA: hda: Fix Oops by 9.1 surround channel names | * 44f2ed29e1 xhci: Fix incorrect tracking of free space on transfer rings | * 643a453878 xhci-pci: Only run d3cold avoidance quirk for s2idle | * ea56ede911 Revert "usb: gadget: udc: core: Invoke usb_gadget_connect only when started" | * 7356d42cef Revert "usb: gadget: udc: core: Prevent redundant calls to pullup" | * 08bd1be1c7 usb: typec: altmodes/displayport: fix pin_assignment_show | * f1f810e541 usb: gadget: u_ether: Fix host MAC address case | * a9342bd4c2 usb: dwc3: debugfs: Resume dwc3 before accessing registers | * ad43004fd5 usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume() | * 56a0769fa4 USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value | * 4c3312745f usb-storage: fix deadlock when a scsi command timeouts more than once | * 0ced12bdf6 USB: usbtmc: Fix direction for 0-length ioctl control messages | * 2cd7d88fcb ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go | * d319fe244e bridge: always declare tunnel functions | * a836be60a3 netfilter: nft_set_rbtree: fix null deref on element insertion | * 8f58c53857 netfilter: nf_tables: fix nft_trans type confusion | * d862b63605 net: selftests: Fix optstring | * fdc5c8fb57 net: pcs: xpcs: fix C73 AN not getting enabled | * ee44bacf46 net: wwan: iosm: fix NULL pointer dereference when removing device | * c3e3e8933f vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() | * e02d2b987c igb: fix bit_shift to be in [1..8] range | * 516114d7fb net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset | * 172146c26f cassini: Fix a memory leak in the error handling path of cas_init_one() | * 9cae243b9a tun: Fix memory leak for detached NAPI queue. | * e2d59768f8 net: tun: rebuild error handling in tun_get_user | * ae42c6f79c scsi: storvsc: Don't pass unused PFNs to Hyper-V host | * 557ba100d8 wifi: iwlwifi: mvm: don't trust firmware n_channels | * a270c552ce wifi: iwlwifi: mvm: fix OEM's name in the tas approved list | * bc907fbf48 wifi: iwlwifi: fix OEM's name in the ppag approved list | * 2160e11981 wifi: iwlwifi: fw: fix DBGI dump | * a20550b3aa wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock | * bc22656432 wifi: mac80211: Abort running color change when stopping the AP | * 01a4503d9f wifi: mac80211: fix min center freq offset tracing | * c79d794a2c wifi: mac80211: fortify the spinlock against deadlock by interrupt | * f9a85347e4 wifi: cfg80211: Drop entries with invalid BSSIDs in RNR | * dda9c9b117 ice: Fix ice VF reset during iavf initialization | * f181d799fb ice: introduce clear_reset_state operation | * 36e6c7ada5 net: bcmgenet: Restore phy_stop() depending upon suspend/close | * 41357a52b8 net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() | * e90cefcffd can: dev: fix missing CAN XL support in can_put_echo_skb() | * c9abef1e07 s390/cio: include subchannels without devices also for evaluation | * f215b62f59 tipc: check the bearer min mtu properly when setting it by netlink | * 259683001d tipc: do not update mtu if msg_max is too small in mtu negotiation | * 735c64ea88 tipc: add tipc_bearer_min_mtu to calculate min mtu | * 73f53bc295 virtio_net: Fix error unwinding of XDP initialization | * 978a55b0c0 virtio-net: Maintain reverse cleanup order | * 6fbedf987b net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() | * 82ede43544 drm/exynos: fix g2d_open/close helper function definitions | * 866c78a3a9 ASoC: SOF: topology: Fix logic for copying tuples | * 3e56a1c048 ASoC: mediatek: mt8186: Fix use-after-free in driver remove path | * da1b698976 SUNRPC: Fix trace_svc_register() call site | * 47adb84916 SUNRPC: always free ctxt when freeing deferred request | * fd86534872 SUNRPC: double free xprt_ctxt while still in use | * 07821524f6 media: netup_unidvb: fix use-after-free at del_timer() | * 4147a0cee1 net: hns3: fix reset timeout when enable full VF | * 89982e0501 net: hns3: fix reset delay time to avoid configuration timeout | * 2a06c5ab7b net: hns3: fix sending pfc frames after reset issue | * 8ee34c90ce net: hns3: fix output information incomplete for dumping tx queue info with debugfs | * 37c1e28967 net: dsa: rzn1-a5psw: disable learning for standalone ports | * 7ceeb5608d net: dsa: rzn1-a5psw: fix STP states handling | * 374c9cf3ad net: dsa: rzn1-a5psw: enable management frames for CPU port | * 33a93db909 erspan: get the proto with the md version for collect_md | * 2a3e5f428f serial: 8250_bcm7271: fix leak in `brcmuart_probe` | * dcf08087c2 serial: 8250_bcm7271: balance clk_enable calls | * 081790eee6 serial: arc_uart: fix of_iomap leak in `arc_serial_probe` | * 820a60a416 tcp: fix possible sk_priority leak in tcp_v4_send_reset() | * 9bcf4794f1 vsock: avoid to close connected socket after the timeout | * 116cc7670f sfc: disable RXFCS and RXALL features by default | * 1c052acd71 ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 | * a16bf8f9c8 wifi: mt76: connac: fix stats->tx_bytes calculation | * ee1a221d94 ALSA: firewire-digi00x: prevent potential use after free | * ea9c758184 net: phy: dp83867: add w/a for packet errors seen with short cables | * 9407454a9b net: fec: Better handle pm_runtime_get() failing in .remove() | * e412fa5d81 selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test | * 7099beeec9 selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test | * c498e5d392 drm/msm: Fix submit error-path leaks | * 474d57adf1 af_key: Reject optional tunnel/BEET mode templates in outbound policies | * e5a0b280b0 xfrm: Reject optional tunnel/BEET mode templates in outbound policies | * 0d778f0cb1 cpupower: Make TSC read per CPU for Mperf monitor | * ce6c7befc2 ASoC: fsl_micfil: Fix error handler with pm_runtime_enable | * 9d3ac384cb platform: Provide a remove callback that returns no value | * 394336e139 dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and qcom, sync-dual-dsi | * 97d6437cbf drm/msm/dpu: Remove duplicate register defines from INTF | * d6d90e1402 drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header | * 092f382f65 drm/msm/dpu: Assign missing writeback log_mask | * ccde7016d1 drm/msm/dp: unregister audio driver during unbind | * 6867c4b5db Revert "Fix XFRM-I support for nested ESP tunnels" | * 070d0047c6 xfrm: don't check the default policy if the policy allows the packet | * 7b5a8a23ac drm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs | * b5f3f923d4 platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct | * 1189b7f495 platform/x86: Move existing HP drivers to a new hp subdir | * c9888aaed1 parisc: Replace regular spinlock with spin_trylock on panic path | * e112b2e265 mfd: intel-lpss: Add Intel Meteor Lake PCH-S LPSS PCI IDs | * 77f43c014a mfd: dln2: Fix memory leak in dln2_probe() | * d3ee2f9e30 mfd: intel_soc_pmic_chtwc: Add Lenovo Yoga Book X90F to intel_cht_wc_models | * 4e5e9da139 soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow | * 60eb1afb4f soundwire: qcom: gracefully handle too many ports in DT | * 3060b08d63 phy: st: miphy28lp: use _poll_timeout functions for waits | * 81e8f1abd0 soundwire: dmi-quirks: add remapping for Intel 'Rooks County' NUC M15 | * 895130e63c recordmcount: Fix memory leaks in the uwrite function | * 4e2df91118 lkdtm/stackleak: Fix noinstr violation | * fa825017fb sched: Fix KCSAN noinstr violation | * eaa182a6c8 mcb-pci: Reallocate memory region to avoid memory overlapping | * af4d6dbb1a serial: 8250: Reinit port->pm on port specific driver unbind | * 6a4cef8244 usb: typec: tcpm: fix multiple times discover svids error | * 1edff076cc HID: wacom: generic: Set battery quirk only when we see battery data | * 37358a22a3 HID: Ignore battery for ELAN touchscreen on ROG Flow X13 GV301RA | * 10ba1c3424 HID: apple: Set the tilde quirk flag on the Geyser 3 | * f3e2f3e0a7 ASoC: amd: yc: Add ThinkBook 14 G5+ ARP to quirks list for acp6x | * 1a6371c50b ASoC: amd: Add Dell G15 5525 to quirks list | * 26fda37345 ALSA: hda: LNL: add HD Audio PCI ID | * 907d6b615e usb: typec: ucsi: acpi: add quirk for ASUS Zenbook UM325 | * b484aa2147 spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 | * 1844749dcf HID: logitech-hidpp: Reconcile USB and Unifying serials | * 16420da845 HID: logitech-hidpp: Don't use the USB serial for USB devices | * 2e64faf655 ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A42) | * 6ce24d176e staging: axis-fifo: initialize timeouts in init only | * b268082188 HID: apple: Set the tilde quirk flag on the Geyser 4 and later | * ec310591cf staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE | * 022fe9fcac Bluetooth: btrtl: Add the support for RTL8851B | * fd269a0435 Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp | * 2f4a1b24da Bluetooth: Add new quirk for broken set random RPA timeout for ATS2851 | * 76dd7893bd Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set | * 803ba6dcc4 Bluetooth: btintel: Add LE States quirk support | * ea160ece08 Bluetooth: btrtl: check for NULL in btrtl_set_quirks() | * f4f3cbdbf2 Bluetooth: Improve support for Actions Semi ATS2851 based devices | * 88deda7cd8 Bluetooth: btrtl: add support for the RTL8723CS | * c97ab50441 Bluetooth: Add new quirk for broken local ext features page 2 | * d9a68e9e89 Bluetooth: btusb: Add new PID/VID 04ca:3801 for MT7663 | * 75481fa7aa ipvs: Update width of source for ip_vs_sync_conn_options | * fab766c8a1 nbd: fix incomplete validation of ioctl arg | * 068fd06148 wifi: ath11k: Fix SKB corruption in REO destination ring | * 57189c8851 wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace | * fd35b7bb6d null_blk: Always check queue mode setting from configfs | * 63e2d06adf wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO | * e78526a06b wifi: ath11k: Ignore frags from uninitialized peer in dp. | * 1655cfc852 block, bfq: Fix division by zero error on zero wsum | * dbebdee3f2 wifi: iwlwifi: mvm: fix ptk_pn memory leak | * eb1ef44efa wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf | * 19f063df73 wifi: iwlwifi: add a new PCI device ID for BZ device | * 0f9a1bcb94 wifi: iwlwifi: pcie: fix possible NULL pointer dereference | * b4acb6c3ed md: fix soft lockup in status_resync | * 60039bf72f bpf: Add preempt_count_{sub,add} into btf id deny list | * f2065b8b0a samples/bpf: Fix fout leak in hbm's run_bpf_prog | * e05d63f8b4 f2fs: fix to check readonly condition correctly | * 7741ddc882 f2fs: fix to drop all dirty pages during umount() if cp_error is set | * f4631d295a f2fs: Fix system crash due to lack of free space in LFS | * c1b0b32f2d crypto: jitter - permanent and intermittent health errors | * 9d4430b7f8 ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() | * c6bee89700 ext4: set goal start correctly in ext4_mb_normalize_request | * 7739981b9c scsi: ufs: ufs-pci: Add support for Intel Lunar Lake | * d485903231 gfs2: Fix inode height consistency check | * 9c6da3b7f1 scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition | * c9115f49cf lib: cpu_rmap: Avoid use after free on rmap->obj array entries | * a7a4def6c7 scsi: target: iscsit: Free cmds before session free | * d957a100bc netdev: Enforce index cap in netdev_get_tx_queue | * cf1fe8ccb5 net: Catch invalid index in XPS mapping | * ee5929c1e8 net: pasemi: Fix return type of pasemi_mac_start_tx() | * efb1a25751 bnxt: avoid overflow in bnxt_get_nvram_directory() | * 8a72289694 scsi: lpfc: Correct used_rpi count when devloss tmo fires with no recovery | * a9df88cb31 scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow | * e6f4fb2889 ext2: Check block size validity during mount | * f8a6c53ff1 wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex | * c35105f375 wifi: brcmfmac: pcie: Provide a buffer of random bytes to the device | * 4e7a81b5e7 bpf: Annotate data races in bpf_local_storage | * 660ab31561 wifi: ath: Silence memcpy run-time false positive warning | * 48e4e06e2c media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup | * 83c42283bf media: Prefer designated initializers over memset for subdev pad ops | * 210ef6cd8e drm/amdgpu: Fix sdma v4 sw fini error | * 5675ecd2e0 drm/amd: Fix an out of bounds error in BIOS parser | * ec5f00a59a drm/amd/display: Correct DML calculation to follow HW SPEC | * cf180afea3 ACPI: video: Remove desktops without backlight DMI quirks | * 86ba4f7b9f irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 | * 57b5a56cec arm64: dts: qcom: sdm845-polaris: Drop inexistent properties | * fee6133490 ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects | * 8c4a7163b7 ACPICA: Avoid undefined behavior: applying zero offset to null pointer | * b1db73e27f drm/msm/dp: Clean up handling of DP AUX interrupts | * a6eb3aa0ec drm/tegra: Avoid potential 32-bit integer overflow | * a7f9c14ace remoteproc: stm32_rproc: Add mutex protection for workqueue | * 3dc61a19c9 drm/amd/display: fixed dcn30+ underflow issue | * 86a159fd5b ACPI: EC: Fix oops when removing custom query handlers | * a8267bc8de firmware: arm_sdei: Fix sleep from invalid context BUG | * b963e1b706 arm64: dts: imx8mq-librem5: Remove dis_u3_susphy_quirk from usb_dwc3_0 | * 9a342d4eb9 memstick: r592: Fix UAF bug in r592_remove due to race condition | * 110d420252 drm/rockchip: dw_hdmi: cleanup drm encoder during unbind | * 79ca94bc3e ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() | * cc4273233a media: pvrusb2: VIDEO_PVRUSB2 depends on DVB_CORE to use dvb_* symbols | * 3c67f49a66 media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish | * 6738841f6f media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() | * 346c975524 arm64: dts: qcom: msm8996: Add missing DWC3 quirks | * 44361033a8 remoteproc: imx_dsp_rproc: Add custom memory copy implementation for i.MX DSP Cores | * 10add04ee6 regmap: cache: Return error in cache sync operations for REGCACHE_NONE | * 34813f041d drm/amd/display: Use DC_LOG_DC in the trasform pixel function | * d547d499e4 drm/amd/display: Enable HostVM based on rIOMMU active | * 898b031dc2 platform/x86: x86-android-tablets: Add Acer Iconia One 7 B1-750 data | * 09f7da1301 drm/amd/display: Correct DML calculation to align HW formula | * 92e6c79aca drm/amd/display: populate subvp cmd info only for the top pipe | * 4b17053ba2 drm/displayid: add displayid_get_header() and check bounds better | * 48960a503f fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() | * e8c322b76e open: return EINVAL for O_DIRECTORY | O_CREAT | * d0a8c0e31a rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access | * 801593f70b selftests: cgroup: Add 'malloc' failures checks in test_memcontrol | * 522c441faf refscale: Move shutdown from wait_event() to wait_event_idle() | * b4319e457d ext4: allow ext4_get_group_info() to fail | * f12aa035e8 ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set | * cd2341c26f ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled | * cc4086759f ext4: reflect error codes from ext4_multi_mount_protect() to its callers | * 5a08a72da3 fbdev: arcfb: Fix error handling in arcfb_probe() | * dcd289136b drm/i915: taint kernel when force probing unsupported devices | * 36fa618775 drm/i915: Expand force_probe to block probe of devices as well. | * 86d73b1f98 drm/i915/dp: prevent potential div-by-zero | * dbf25cc21b drm/i915: Fix NULL ptr deref by checking new_crtc_state | * 1b485f39ac drm/i915/guc: Don't capture Gen8 regs on Xe devices | * e410895892 af_unix: Fix data races around sk->sk_shutdown. | * 75924fb0f3 af_unix: Fix a data race of sk->sk_receive_queue->qlen. | * 8759c1a361 net: datagram: fix data-races in datagram_poll() | * 9e62a49608 net: mscc: ocelot: fix stat counter register values | * 610a433810 ipvlan:Fix out-of-bounds caused by unclear skb->cb | * d695dccb74 gve: Remove the code of clearing PBA bit | * b4c0af8974 tcp: add annotations around sk->sk_shutdown accesses | * 55caf900e1 net: add vlan_get_protocol_and_depth() helper | * 65531f5675 net: deal with most data-races in sk_wait_event() | * bd0f360ee8 net: annotate sk->sk_err write from do_recvmmsg() | * a115dadf89 netlink: annotate accesses to nlk->cb_running | * 6b4585a3c9 bonding: fix send_peer_notif overflow | * d9176dc690 netfilter: conntrack: fix possible bug_on with enable_hooks=1 | * 30e4b13b1b netfilter: nf_tables: always release netdev hooks from notifier | * 6fa2e7bb7b net: phy: bcm7xx: Correct read from expansion register | * 7145f2309d net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). | * edc1f6d89b net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register | * 9e916db758 linux/dim: Do nothing if no time delta between samples | * a84b08314f tick/broadcast: Make broadcast device replacement work correctly | * 2628417026 scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend | * 27c6b573d1 net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe() | * 3e785c8deb net: skb_partial_csum_set() fix against transport header magic value | * 8547757056 ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings | * 3ff962242f drm/mipi-dsi: Set the fwnode for mipi_dsi_device | * efd2821b8a drm/fbdev-generic: prohibit potential out-of-bounds access * | 51b8218413 Merge 6.1.29 into android14-6.1-lts |\| | * fa74641fb6 Linux 6.1.29 | * 49f63bd062 drm/amd/display: Fix hang when skipping modeset | * 7f6738e003 spi: fsl-cpm: Use 16 bit mode for large transfers with even size | * 441fa64299 spi: fsl-spi: Re-organise transfer bits_per_word adaptation | * 76ce326826 x86: fix clear_user_rep_good() exception handling annotation | * 4ae066699d x86/amd_nb: Add PCI ID for family 19h model 78h | * 514728ffc0 f2fs: inode: fix to do sanity check on extent cache correctly | * 85eb8b61dd f2fs: fix to do sanity check on extent cache correctly | * 18ecffd036 drm/dsc: fix DP_DSC_MAX_BPP_DELTA_* macro values | * c5fa4eeddd ext4: fix invalid free tracking in ext4_xattr_move_to_block() | * d87a4e4094 ext4: remove a BUG_ON in ext4_mb_release_group_pa() | * 19fb73b8ea ext4: fix lockdep warning when enabling MMP | * 6e7a97628f ext4: bail out of ext4_xattr_ibody_get() fails for any reason | * 1d2caddbee ext4: add bounds checking in get_max_inline_xattr_value_size() | * 665cc3ba50 ext4: fix deadlock when converting an inline directory in nojournal mode | * f68876aeef ext4: improve error handling from ext4_dirhash() | * 25c9fca7b7 ext4: improve error recovery code paths in __ext4_remount() | * 748e4bb27d ext4: check iomap type only if ext4_iomap_begin() does not fail | * b006e22285 ext4: fix data races when using cached status extents | * 1fffe47505 ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum | * dba62fa84a ext4: fix WARNING in mb_find_extent | * 1b9c92432f locking/rwsem: Add __always_inline annotation to __down_read_common() and inlined callers | * 98643c9910 drm/dsc: fix drm_edp_dsc_sink_output_bpp() DPCD high byte usage | * f95a60099d drm: Add missing DP DSC extended capability definitions. | * 4aba9ab6a0 ksmbd: fix racy issue from smb2 close and logoff with multichannel | * 502cf97090 ksmbd: block asynchronous requests when making a delay on session setup | * 1fc8a2b14e ksmbd: destroy expired sessions | * f623f627ad ksmbd: fix racy issue from session setup and logoff | * 91bbf9cb23 ksmbd: Implements sess->ksmbd_chann_list as xarray | * 3db734e4d9 drm/amd/display: Change default Z8 watermark values | * a009acf687 drm/amd/display: Update Z8 SR exit/enter latencies | * e22ef15610 drm/amd/display: Update Z8 watermarks for DCN314 | * cf49b2ff25 ASoC: codecs: wcd938x: fix accessing regmap on unattached devices | * 400950f66a ASoC: codecs: constify static sdw_slave_ops struct | * 5279ab199c ASoC: rt1318: Add RT1318 SDCA vendor-specific driver | * 1d383f9d65 drm/amd/display: Lowering min Z8 residency time | * e6332695d4 drm/amd/display: Update minimum stutter residency for DCN314 Z8 | * 25f6036242 drm/amd/display: Add minimum Z8 residency debug option | * 97b3d8eed0 drm/amd/display: Fix Z8 support configurations | * 1822513408 drm/amd/display: Add debug option to skip PSR CRTC disable | * bcde2c8779 drm/amd/display: Add Z8 allow states to z-state support list | * 8346882016 drm/amd/display: Refactor eDP PSR codes | * 74a03d3c8d drm/i915: Check pipe source size when using skl+ scalers | * 549ce5199d drm/i915/mtl: update scaler source and destination limits for MTL | * 20a1064a75 wifi: rtw88: rtw8821c: Fix rfe_option field width | * 6578ae84e9 irqchip/loongson-eiointc: Fix registration of syscore_ops | * fa29d577e2 irqchip/loongson-eiointc: Fix incorrect use of acpi_get_vec_parent | * 9e7f788dd7 irqchip/loongarch: Adjust acpi_cascade_irqdomain_init() and sub-routines | * c5111be873 drm/msm: fix missing wq allocation error handling | * 46062a1c0a drm/msm: Hangcheck progress detection | * a7fdb37d93 drm/msm/adreno: Simplify read64/write64 helpers | * cba2856958 f2fs: factor out victim_entry usage from general rb_tree use | * 4377b1d3b1 f2fs: allocate the extent_cache by default | * 33112a0a17 f2fs: refactor extent_cache to support for read and more | * 3af09dee7f f2fs: remove unnecessary __init_extent_tree | * 91b1554e66 f2fs: move internal functions into extent_cache.c | * 155ff41cf2 f2fs: specify extent cache for read explicitly | * 77d2651cc8 drm/msm/adreno: adreno_gpu: Use suspend() instead of idle() on load error | * b2bd08be1a fs/ntfs3: Refactoring of various minor issues | * fb98336e23 HID: wacom: insert timestamp to packed Bluetooth (BT) events | * fb2f0c0004 HID: wacom: Set a default resolution for older tablets | * 7a07311304 drm/amd: Use `amdgpu_ucode_*` helpers for MES | * a3e3a640d4 drm/amd: Add a new helper for loading/validating microcode | * 3e1fa150e7 drm/amd: Load MES microcode during early_init | * 369b891842 drm/amdgpu: remove deprecated MES version vars | * 506da05a5e drm/amd/pm: avoid potential UBSAN issue on legacy asics | * 2a179117a3 drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend | * 17a6941567 drm/amd/pm: parse pp_handle under appropriate conditions | * 348dcdf102 drm/amd/display: Enforce 60us prefetch for 200Mhz DCFCLK modes | * 7a8248317b drm/amdgpu: Fix vram recover doesn't work after whole GPU reset (v2) | * 6197fb331a drm/amdgpu: change gfx 11.0.4 external_id range | * 28c2e072fa drm/amdgpu/jpeg: Remove harvest checking for JPEG3 | * f661ad5365 drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras | * 02e6cb9b3a drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v11_0_hw_fini | * 59cb2d46e1 drm/amdgpu: fix an amdgpu_irq_put() issue in gmc_v9_0_hw_fini() | * 59e2439111 drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini | * f2e43c9804 drm/amd/display: fix flickering caused by S/G mode | * 4c1e747ca6 drm/amd/display: filter out invalid bits in pipe_fuses | * c2b2641ecb drm/amd/display: Fix 4to1 MPC black screen with DPP RCO | * cc9942840a drm/amd/display: Add NULL plane_state check for cursor disable logic | * bfe56245f4 drm/panel: otm8009a: Set backlight parent to panel device | * 2e51d7c09d irqchip/loongson-eiointc: Fix returned value on parsing MADT | * 84c64fb578 irqchip/loongson-pch-pic: Fix pch_pic_acpi_init calling | * 8a0b544b7c f2fs: fix potential corruption when moving a directory | * 424f8cdc0a f2fs: fix null pointer panic in tracepoint in __replace_atomic_write_block | * aa0f98c5d1 drm/i915/dsi: Use unconditional msleep() instead of intel_dsi_msleep() | * 6e1476225e drm/msm: fix workqueue leak on bind errors | * 544711591a drm/msm: fix vram leak on bind errors | * 0fad173f9c drm/msm: fix drm device leak on bind errors | * dd8ce825b1 drm/msm: fix NULL-deref on irq uninstall | * 16e0e6fb45 drm/msm: fix NULL-deref on snapshot tear down | * 5b6b81decd drm/i915/color: Fix typo for Plane CSC indexes | * 2b01534c8f drm/bridge: lt8912b: Fix DSI Video Mode | * 47bfe12804 drm/msm/adreno: fix runtime PM imbalance at gpu load | * 3d0fdfefb3 ARM: dts: aspeed: romed8hm3: Fix GPIO polarity of system-fault LED | * f327c74436 ARM: dts: s5pv210: correct MIPI CSIS clock name | * 5503ea70de ARM: dts: exynos: fix WM8960 clock name in Itop Elite | * 6efe88c34f ARM: dts: aspeed: asrock: Correct firmware flash SPI clocks | * a64910ba86 sysctl: clarify register_sysctl_init() base directory order | * c3c70209a9 remoteproc: rcar_rproc: Call of_node_put() on iteration error | * 948f81dac3 remoteproc: imx_rproc: Call of_node_put() on iteration error | * fe3497c3bf remoteproc: imx_dsp_rproc: Call of_node_put() on iteration error | * 8a0fc842af remoteproc: st: Call of_node_put() on iteration error | * 0d6b66657c remoteproc: stm32: Call of_node_put() on iteration error | * fde64a409b proc_sysctl: enhance documentation | * f4708645c1 proc_sysctl: update docs for __register_sysctl_table() | * c93185ffd9 sh: nmi_debug: fix return value of __setup handler | * 2ebd006435 sh: init: use OF_EARLY_FLATTREE for early init | * ab2221dc3c sh: mcount.S: fix build error when PRINTK is not enabled | * fdac282b3c sh: math-emu: fix macro redefined warning | * 6d103a5765 SMB3: force unmount was failing to close deferred close files | * bb0091a5c9 smb3: fix problem remounting a share after shutdown | * 145f54ea33 inotify: Avoid reporting event with invalid wd | * d759abeb27 platform/x86: thinkpad_acpi: Add profile force ability | * 66d4f7f327 platform/x86: touchscreen_dmi: Add info for the Dexp Ursus KX210i | * e614c1de9e platform/x86: thinkpad_acpi: Fix platform profiles on T490 | * a02d29de79 platform/x86: touchscreen_dmi: Add upside-down quirk for GDIX1002 ts on the Juno Tablet | * 61549b7414 platform/x86/intel-uncore-freq: Return error on write frequency | * b886ad6b6b cifs: release leases for deferred close handles when freezing | * 187f89cff7 cifs: fix pcchunk length type in smb2_copychunk_range | * c5544c95ad btrfs: zoned: fix full zone super block reading on ZNS | * 4def3a0a85 btrfs: zoned: zone finish data relocation BG with last IO | * 1e8de3223b btrfs: fix space cache inconsistency after error loading it from disk | * 1689eabbc3 btrfs: print-tree: parent bytenr must be aligned to sector size | * 83ae0282f1 btrfs: make clear_cache mount option to rebuild FST without disabling it | * dd5a21941f btrfs: zero the buffer before marking it dirty in btrfs_redirty_list_add | * 15e877e592 btrfs: don't free qgroup space unless specified | * 44c52544b2 btrfs: fix encoded write i_size corruption with no-holes | * 17eaeee4c5 btrfs: fix assertion of exclop condition when starting balance | * 0a99cd08e2 btrfs: properly reject clear_cache and v1 cache for block-group-tree | * 8583cc10aa btrfs: zoned: fix wrong use of bitops API in btrfs_ensure_empty_zones | * bcd7aa2963 btrfs: fix btrfs_prev_leaf() to not return the same key twice | * 000322b29c x86/retbleed: Fix return thunk alignment | * 2feac714c6 RISC-V: fix taking the text_mutex twice during sifive errata patching | * 0fad198fff RISC-V: take text_mutex during alternative patching | * 13a0e212dd perf stat: Separate bperf from bpf_profiler | * 602603baae perf tracepoint: Fix memory leak in is_valid_tracepoint() | * 3fb0d061dd perf symbols: Fix return incorrect build_id size in elf_read_build_id() | * 2dd641d78d crypto: engine - fix crypto_queue backlog handling | * 14a2259317 crypto: engine - Use crypto_request_complete | * 6ba620fc91 crypto: api - Add scaffolding to change completion function signature | * 1055eddce7 crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs() | * 267db6bff3 perf cs-etm: Fix timeless decode mode detection | * b6671b7172 perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp() | * d592598f47 perf pmu: zfree() expects a pointer to a pointer to zero it after freeing its contents | * 36a840a862 perf vendor events power9: Remove UTF-8 characters from JSON files | * 0dabe1ae74 perf ftrace: Make system wide the default target for latency subcommand | * 4406061261 perf tests record_offcpu.sh: Fix redirection of stderr to stdin | * 6d20672d52 perf vendor events s390: Remove UTF-8 characters from JSON file | * b2b9169960 perf scripts intel-pt-events.py: Fix IPC output for Python 2 | * f108cbc836 perf record: Fix "read LOST count failed" msg with sample read | * 2424b456c3 net: enetc: check the index of the SFI rather than the handle | * d86d42e4a9 virtio_net: suppress cpu stall when free_unused_bufs | * 4a61d79656 ice: block LAN in case of VF to VF offload | * 2f80efc46b net: dsa: mt7530: fix network connectivity with multiple CPU ports | * 9d46edd93a net: dsa: mt7530: split-off common parts from mt7531_setup | * 98fc75c172 net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL MT7621 | * c6fafaa6f2 KVM: s390: fix race in gmap_make_secure() | * 4e875cf90d ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` | * 7887397338 drm/amdgpu: add a missing lock for AMDGPU_SCHED | * f2e8e33862 af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). | * 0d02efe7f2 ionic: catch failure from devlink_alloc | * 942a2a0184 ethtool: Fix uninitialized number of lanes | * a05e5634c1 ionic: remove noise from ethtool rxnfc error msg | * 3cad35b62e octeontx2-vf: Detach LF resources on probe cleanup | * 401d11f274 octeontx2-pf: Disable packet I/O for graceful exit | * d28f6ad8b1 octeontx2-af: Skip PFs if not enabled | * ac613d0bd2 octeontx2-af: Fix issues with NPC field hash extract | * ab0742bd5b octeontx2-af: Update/Fix NPC field hash extract feature | * 2b84d24d3a octeontx2-pf: Add additional checks while configuring ucast/bcast/mcast rules | * bd9234da97 octeontx2-af: Allow mkex profile without DMAC and add L2M/L2B header extraction support | * 14504aaa8b octeontx2-pf: Increase the size of dmac filter flows | * 2376ca72b5 octeontx2-af: Fix depth of cam and mem table. | * 1c98271e0c octeontx2-af: Fix start and end bit for scan config | * e92399f527 octeontx2-af: Secure APR table update with the lock | * 419cc2c507 selftests: netfilter: fix libmnl pkg-config usage | * 4b08cdd239 drm/i915/mtl: Add the missing CPU transcoder mask in intel_device_info | * 2bb120405a riscv: compat_syscall_table: Fixup compile warning | * 40f8b3f5e6 rxrpc: Fix hard call timeout units | * ab14de49e4 sfc: Fix module EEPROM reporting for QSFP modules | * 68b1614b32 r8152: move setting r8153b_rx_agg_chg_indicate() | * 2642d7c136 r8152: fix the poor throughput for 2.5G devices | * fbdde7ef25 r8152: fix flow control issue of RTL8156A | * e2efb94966 net/sched: act_mirred: Add carrier check | * 3b3537d4a0 i2c: tegra: Fix PEC support for SMBUS block read | * ffa97b5952 RISC-V: mm: Enable huge page support to kernel_page_present() function | * 1e8ad3e45b watchdog: dw_wdt: Fix the error handling path of dw_wdt_drv_probe() | * c36975a654 block: Skip destroyed blkg when restart in blkg_destroy_all() | * 7c4c6e2a40 writeback: fix call of incorrect macro | * 5ac2914f67 net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu | * 1f274d5316 net: ipv6: fix skb hash for some RST packets | * 686c70131e selftests: srv6: make srv6_end_dt46_l3vpn_test more robust | * 5a98019e96 sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() | * 55866fe3fd net/sched: cls_api: remove block_cb from driver_list before freeing | * 7fa93e39fb tcp: fix skb_copy_ubufs() vs BIG TCP | * 449280afaa net/ncsi: clear Tx enable mode when handling a Config required AEN | * a78b922d11 octeontx2-pf: mcs: Do not reset PN while updating secy | * fd59ec1455 octeontx2-pf: mcs: Fix shared counters logic | * a8ddb974f0 octeontx2-pf: mcs: Clear stats before freeing resource | * c52ebecd89 octeontx2-pf: mcs: Match macsec ethertype along with DMAC | * a3dcc45eca octeontx2-pf: mcs: Fix NULL pointer dereferences | * 9ff806d070 octeontx2-af: mcs: Fix MCS block interrupt | * add6bdb8d6 octeontx2-af: mcs: Config parser to skip 8B header | * 39b436f0ac octeontx2-af: mcs: Write TCAM_DATA and TCAM_MASK registers at once | * 06fdaf7711 octeonxt2-af: mcs: Fix per port bypass config | * 1924450175 ixgbe: Fix panic during XDP_TX with > 64 CPUs | * 80a791a199 drm/amd/display: Update bounding box values for DCN321 | * 7bba2e5e09 drm/amd/display: Do not clear GPINT register when releasing DMUB from reset | * ccb0ad946a drm/amd/display: Reset OUTBOX0 r/w pointer on DMUB reset | * bb13726625 drm/amd/display: Fixes for dcn32_clk_mgr implementation | * b7ae53dd0d drm/amd/display: Return error code on DSC atomic check failure | * 374f7fa01a drm/amd/display: Add missing WA and MCLK validation | * 0b47019f54 drm/amd/display: Remove FPU guards from the DML folder | * 3738a23083 scsi: qedi: Fix use after free bug in qedi_remove() | * e60e5d6722 ASoC: Intel: soc-acpi-byt: Fix "WM510205" match no longer working | * 1193a36f58 KVM: x86/mmu: Refresh CR0.WP prior to checking for emulated permission faults | * 71e848bac0 KVM: VMX: Make CR0.WP a guest owned bit | * 27ec4cbc1d KVM: x86: Make use of kvm_read_cr*_bits() when testing bits | * 956777b253 KVM: x86: Do not unload MMU roots when only toggling CR0.WP with TDP enabled | * d20a0195b3 KVM: x86/mmu: Avoid indirect call for get_cr3 | * 28d0f85aff drm/amd/display: Ext displays with dock can't recognized after resume | * d69d5e2a81 fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup() | * 93eb8dd4b4 mtd: spi-nor: spansion: Enable JFFS2 write buffer for Infineon s25hx SEMPER flash | * 50f54a48f6 mailbox: zynqmp: Fix counts of child nodes | * e63a796b85 mailbox: zynq: Switch to flexible array to simplify code | * b12078b67a soc: qcom: llcc: Do not create EDAC platform device on SDM845 | * bf9712195f qcom: llcc/edac: Support polling mode for ECC handling | * 4fdb257b2a mtd: spi-nor: spansion: Enable JFFS2 write buffer for Infineon s28hx SEMPER flash | * 8630dfcdab mtd: spi-nor: Add a RWW flag | * 897a40dbcf mtd: spi-nor: add SFDP fixups for Quad Page Program | * de26d26f55 mtd: spi-nor: spansion: Remove NO_SFDP_FLAGS from s28hs512t info | * b951d4924c KVM: x86/pmu: Disallow legacy LBRs if architectural LBRs are available | * 189cdd8fe7 KVM: x86: Track supported PERF_CAPABILITIES in kvm_caps | * 0457b6d04f perf/x86/core: Zero @lbr instead of returning -1 in x86_perf_get_lbr() stub | * 9239f895a8 crypto: ccp - Clear PSP interrupt status register before calling handler | * add662775d drm/vmwgfx: Fix Legacy Display Unit atomic drm support | * b3204cb3e0 drm/vmwgfx: Remove explicit and broken vblank handling | * c613c951e6 usb: dwc3: gadget: Execute gadget stop after halting the controller | * 065c3d4319 USB: dwc3: gadget: drop dead hibernation code * | ec2daee24c ANDROID: add memset32 to db835c list of exported symbols needed. * | 3ec1d2a158 Revert "uapi/linux/const.h: prefer ISO-friendly __typeof__" * | b4c489e551 Revert "posix-cpu-timers: Implement the missing timer_wait_running callback" * | e4446b24fd Revert "KVM: arm64: Avoid vcpu->mutex v. kvm->lock inversion in CPU_ON" * | 2bd2fb9c82 Revert "KVM: arm64: Avoid lock inversion when setting the VM register width" * | b8b87a4a37 Revert "KVM: arm64: Use config_lock to protect data ordered against KVM_RUN" * | 6c2658e477 Revert "KVM: arm64: Use config_lock to protect vgic state" * | c937035a5d Revert "KVM: arm64: vgic: Don't acquire its_lock before config_lock" * | ef75a88787 Merge 6.1.28 into android14-6.1-lts |\| | * bf4ad6fa4e Linux 6.1.28 | * 4507918cd1 netfilter: nf_tables: deactivate anonymous set from preparation phase | * 1887a4faff scsi: libsas: Grab the ATA port lock in sas_ata_device_link_abort() | * 6dc7e36334 debugobject: Ensure pool refill (again) | * 010842e882 drm/amd/display (gcc13): fix enum mismatch | * 915923898f i40e: use int for i40e_status | * 8c82be5525 i40e: Remove string printing for i40e_status | * 3cd9d45e87 i40e: Remove unused i40e status codes | * b593f157a8 sfc (gcc13): synchronize ef100_enqueue_skb()'s return type | * 245653ed73 block/blk-iocost (gcc13): keep large values in a new enum | * 40db6d172b perf intel-pt: Fix CYC timestamps after standalone CBR | * 376e662ebb perf auxtrace: Fix address filter entire kernel size | * 146b7251c1 wifi: ath11k: synchronize ath11k_mac_he_gi_to_nl80211_he_gi()'s return type | * d8d206beb3 bonding (gcc13): synchronize bond_{a,t}lb_xmit() types | * 55c91905b9 thunderbolt: Use correct type in tb_port_is_clx_enabled() prototype | * e4a37e9060 cifs: protect session status check in smb2_reconnect() | * 64d62ac6d6 cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname | * a744060574 blk-iocost: avoid 64-bit division in ioc_timer_fn | * 7ac1a137be dm: don't lock fs when the map is NULL in process of resume | * 9a94ebc74c dm ioctl: fix nested locking in table_clear() to remove deadlock concern | * cb874a190f dm flakey: fix a crash with invalid table line | * 3877b5c150 dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path | * 21d5198c21 dm clone: call kmem_cache_destroy() in dm_clone_init() error path | * 1da79e01e4 dm verity: fix error handling for check_at_most_once on FEC | * 2f5aa54e40 vhost_vdpa: fix unmap process in no-batch mode | * 6b5b755463 mm/mempolicy: correctly update prev when policy is equal on mbind | * 840516585c ia64: fix an addr to taddr in huge_pte_offset() | * 7964bacf83 s390/dasd: fix hanging blockdevice after request requeue | * 9628d45a06 btrfs: scrub: reject unsupported scrub flags | * 7a0a402930 scripts/gdb: fix lx-timerlist for Python3 | * a16e911775 clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent | * 5b4052aa95 clk: microchip: fix potential UAF in auxdev release callback | * 39712c8aeb wifi: rtw89: fix potential race condition between napi_init and napi_enable | * 4309330641 wifi: rtl8xxxu: RTL8192EU always needs full init | * ead3b023ae mailbox: zynqmp: Fix typo in IPI documentation | * 706ae66574 kcsan: Avoid READ_ONCE() in read_instrumented_memory() | * c051c472fb mailbox: zynqmp: Fix IPI isr handling | * 8cc1ab7de2 mtd: spi-nor: core: Update flash's current address mode when changing address mode | * f1b4affca1 mtd: core: fix error path for nvmem provider | * 26358f3304 mtd: core: fix nvmem error reporting | * 43a72c1619 mtd: core: provide unique name for nvmem device, take two | * da4c747730 kasan: hw_tags: avoid invalid virt_to_page() | * 507fbfa79a md/raid5: Improve performance for sequential IO | * b50fd1c3d9 md/raid10: fix null-ptr-deref in raid10_sync_request | * acffdf1a7f drbd: correctly submit flush bio on barrier | * 8d67449f90 mm: do not reclaim private data from pinned page | * 25457d07c8 nilfs2: fix infinite loop in nilfs_mdt_get_block() | * a73201c607 nilfs2: do not write dirty data after degenerating to read-only | * 4844052acb ALSA: hda/realtek: Fix mute and micmute LEDs for an HP laptop | * 358aa78c02 ALSA: hda/realtek: support HP Pavilion Aero 13-be0xxx Mute LED | * 6d57f6cc21 ALSA: hda/realtek: Add quirk for ASUS UM3402YAR using CS35L41 | * b433bfab89 ALSA: hda/realtek: Add quirk for ThinkPad P1 Gen 6 | * 9e915d81f5 ALSA: usb-audio: Add quirk for Pioneer DDJ-800 | * fd02867177 parisc: Ensure page alignment in flush functions | * b80b7a9bb8 parisc: Fix argument pointer in real64_call_asm() | * 274c0b0c2f afs: Avoid endless loop if file is larger than expected | * 7b6ccf752a afs: Fix getattr to report server i_size on dirs, not local size | * 2cfce11132 afs: Fix updating of i_size with dv jump from server | * 72f3217aa1 PM: hibernate: Do not get block device exclusively in test_resume mode | * 208ba216cc PM: hibernate: Turn snapshot_test into global variable | * fc3153a914 ACPI: PM: Do not turn of unused power resources on the Toshiba Click Mini | * fed87ce073 hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id() | * a51e150ef9 hte: tegra: fix 'struct of_device_id' build error | * 5790f76dd2 mfd: arizona-spi: Add missing MODULE_DEVICE_TABLE | * d617022971 mfd: ocelot-spi: Fix unsupported bulk read | * eefc8cbb60 mfd: tqmx86: Correct board names for TQMxE39x | * 4598908562 mfd: tqmx86: Specify IO port register range more precisely | * 8c989fa9e8 mfd: tqmx86: Do not access I2C_DETECT register through io_base | * b3b3f66bd4 thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe | * 86dfb47094 pinctrl-bcm2835.c: fix race condition when setting gpio dir | * 6107896806 dmaengine: at_xdmac: do not enable all cyclic channels | * a8c24a80de dmaengine: dw-edma: Fix to enable to issue dma request on DMA processing | * 7d28c500e5 dmaengine: dw-edma: Fix to change for continuous transfer | * 502c33c7e7 dma: gpi: remove spurious unlock in gpi_ch_init | * a1f131d2e1 phy: ti: j721e-wiz: Fix unreachable code in wiz_mode_select() | * 548113502e phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port | * 6c0df503cd soundwire: intel: don't save hw_params for use in prepare | * bae3248bb1 soundwire: cadence: rename sdw_cdns_dai_dma_data as sdw_cdns_dai_runtime | * 655b647245 pwm: mtk-disp: Configure double buffering before reading in .get_state() | * 7cbcb1ca53 pwm: mtk-disp: Disable shadow registers before setting backlight values | * 19f5910a1e leds: tca6507: Fix error handling of using fwnode_property_read_string | * 8c16219c96 dmaengine: mv_xor_v2: Fix an error code. | * 60d95b747f pinctrl: ralink: reintroduce ralink,rt2880-pinmux compatible string | * 1b50402d3a leds: TI_LMU_COMMON: select REGMAP instead of depending on it | * eefc7676d5 pinctrl: renesas: r8a779g0: Fix ERROROUTC function names | * d6004abdf5 pinctrl: renesas: r8a779g0: Fix Group 6/7 pin functions | * 3727fafed7 pinctrl: renesas: r8a779g0: Fix Group 4/5 pin functions | * 9af5833818 pinctrl: renesas: r8a779f0: Fix tsn1_avtp_pps pin group | * 6a02dda054 pinctrl: renesas: r8a779a0: Remove incorrect AVB[01] pinmux configuration | * 96d440bee1 ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline | * d30090eb54 ext4: fix i_disksize exceeding i_size problem in paritally written case | * 32dce45c8e SMB3: Close deferred file handles in case of handle lease break | * 3aa9d065b0 SMB3: Add missing locks to protect deferred close file list | * c2b990d7aa timekeeping: Fix references to nonexistent ktime_get_fast_ns() | * b265609a2a openrisc: Properly store r31 to pt_regs on unhandled exceptions | * 369d9e8fae clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails | * 07ad6cc82b RDMA/mlx5: Use correct device num_ports when modify DC | * 43d48cec9a SUNRPC: remove the maximum number of retries in call_bind_status | * 10dcd0ed78 RDMA/mlx5: Fix flow counter query via DEVX | * 9116528937 RDMA/mlx5: Check pcie_relaxed_ordering_enabled() in UMR | * 4aa9243ebe swiotlb: fix debugfs reporting of reserved memory pools | * e6c69b06e7 swiotlb: relocate PageHighMem test away from rmem_swiotlb_setup | * 36d087e49d Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe | * ed90364b42 clk: qcom: dispcc-qcm2290: Remove inexistent DSI1PHY clk | * 86d9cafdd8 clk: qcom: dispcc-qcm2290: get rid of test clock | * c3d4119fa5 clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling | * b75450f51c clk: qcom: lpassaudiocc-sc7280: Add required gdsc power domain clks in lpass_cc_sc7280_desc | * 0b421824ec clk: qcom: lpasscc-sc7280: Skip qdsp6ss clock registration | * 8f7f8d06af iommu/amd: Set page size bitmap during V2 domain allocation | * c49a8c5c8b NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease | * 9b75bd4eef clk: imx: imx8ulp: Fix XBAR_DIVBUS and AD_SLOW clock parents | * 72ff6c1156 clk: imx: fracn-gppll: disable hardware select control | * b32bb99316 clk: imx: fracn-gppll: fix the rate table | * dce59b5443 IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests | * 39d39bfb82 IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order | * 4323aaedeb RDMA/srpt: Add a check for valid 'mad_agent' pointer | * 720c915a62 RDMA/cm: Trace icm_send_rej event before the cm state is reset | * 40b4ad4c17 power: supply: rk817: Fix low SOC bugs | * 8be358c804 clk: qcom: gcc-sm6115: Mark RCGs shared where applicable | * e70ce21939 RDMA/siw: Remove namespace check from siw_netdev_event() | * d3b2acaa14 clk: add missing of_node_put() in "assigned-clocks" property parsing | * a2b3eaaa97 power: supply: generic-adc-battery: fix unit scaling | * 37f689d859 iommu/mediatek: Set dma_mask for PGTABLE_PA_35_EN | * 9163a5b4ed fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() | * 17048287ac fs/ntfs3: Fix OOB read in indx_insert_into_buffer | * 7898db22ed fs/ntfs3: Add check for kmemdup | * 1bc6bb657d fs/ntfs3: Fix memory leak if ntfs_read_mft failed | * 7d374becc0 RDMA/erdma: Use fixed hardware page size | * bb0433ae6f rtc: k3: handle errors while enabling wake irq | * 8a4e9482f4 rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time | * 3ce0df3493 RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() | * 5f5876ae29 rtc: omap: include header for omap_rtc_power_off_program prototype | * c3c2aee6f9 workqueue: Fix hung time report of worker pools | * 8fbcfff083 clk: qcom: gcc-qcm2290: Fix up gcc_sdcc2_apps_clk_src | * bddbb3b9dc RDMA/rdmavt: Delete unnecessary NULL check | * a6d8529dcf clk: mediatek: mt8135: Properly use CLK_IS_CRITICAL flag | * d193c4aea3 clk: mediatek: mt7622: Properly use CLK_IS_CRITICAL flag | * 2b18f12fe6 clk: mediatek: Consistently use GATE_MTK() macro | * 6f24e8ef33 clk: mediatek: mt2712: Add error handling to clk_mt2712_apmixed_probe() | * 23cc819125 RDMA/siw: Fix potential page_array out of range access | * d7c8d32e5d IB/hifi1: add a null check of kzalloc_node in hfi1_ipoib_txreq_init | * a2290ed2af clk: at91: clk-sam9x60-pll: fix return value check | * 0489c2b2c3 tracing/user_events: Ensure write index cannot be negative | * 6472a6d0c7 sched/rt: Fix bad task migration for rt tasks | * 1969b143d0 riscv: Fix ptdump when KASAN is enabled | * e38f070a57 Revert "objtool: Support addition to set CFA base" | * 2d44928903 perf/core: Fix hardlockup failure caused by perf throttle | * 944465c772 sched/fair: Fix inaccurate tally of ttwu_move_affine | * 46f773f39e powerpc/rtas: use memmove for potentially overlapping buffer copy | * 8bcecadabb macintosh: via-pmu-led: requires ATA to be set | * 5dae22c28f powerpc/sysdev/tsi108: fix resource printk format warnings | * 89e458456c powerpc/wii: fix resource printk format warnings | * 2f40b71e46 powerpc/mpc512x: fix resource printk format warning | * f9325ac52f powerpc/perf: Properly detect mpc7450 family | * 7c71aee351 macintosh/windfarm_smu_sat: Add missing of_node_put() | * c0f49bbb30 selftests/powerpc/pmu: Fix sample field check in the mmcra_thresh_marked_sample_test | * ae69d36d46 fbdev: mmp: Fix deferred clk handling in mmphw_probe() | * ce818ee162 virtio_ring: don't update event idx on get_buf | * 428cc25270 spmi: Add a check for remove callback when removing a SPMI driver | * ec01408c0f staging: rtl8192e: Fix W_DISABLE# does not work after stop/start | * 7f43a5bde8 spi: cadence-quadspi: use macro DEFINE_SIMPLE_DEV_PM_OPS | * 727e92fe13 serial: 8250: Add missing wakeup event reporting | * 1ae3e5f202 tty: serial: fsl_lpuart: adjust buffer length to the intended size | * 26d40b3fca firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe | * f262734286 usb: mtu3: fix kernel panic at qmu transfer done irq handler | * 17993a13b5 usb: chipidea: fix missing goto in `ci_hdrc_probe` | * 94fa043a47 usb: gadget: tegra-xudc: Fix crash in vbus_draw | * 6a1cfc3036 sh: sq: Fix incorrect element size for allocating bitmap buffer | * ef9f854103 uapi/linux/const.h: prefer ISO-friendly __typeof__ | * 9bc5e54177 scripts/gdb: raise error with reduced debugging information | * 06e661a259 i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path | * a712b5a952 i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path | * 79acf7fb85 spi: cadence-quadspi: fix suspend-resume implementations | * eef4c4109a drm/panel: novatek-nt35950: Only unregister DSI1 if it exists | * 08e9653bb9 PCI/PM: Extend D3hot delay for NVIDIA HDA controllers | * 402299cca8 ASoC: fsl_mqs: move of_node_put() to the correct location | * 225e81c3af drm/panel: novatek-nt35950: Improve error handling | * 18e21fa199 coresight: etm_pmu: Set the module field | * f0b58720f2 cacheinfo: Check sib_leaf in cache_leaves_are_shared() | * 8ba48e58ba HID: amd_sfh: Handle "no sensors" enabled for SFH1.1 | * 198474bef3 HID: amd_sfh: Increase sensor command timeout for SFH1.1 | * a5e4df860d HID: amd_sfh: Correct the stop all command | * 959f6ae96b HID: amd_sfh: Add support for shutdown operation | * dac12293c7 HID: amd_sfh: Fix illuminance value | * e66a085d90 HID: amd_sfh: Correct the sensor enable and disable command | * 269259b7c7 HID: amd_sfh: Correct the structure fields | * 7035d8b73a scripts/gdb: bail early if there are no generic PD | * ce81376364 scripts/gdb: bail early if there are no clocks | * 15b29ac9b8 ia64: salinfo: placate defined-but-not-used warning | * f890f34a15 ia64: mm/contig: fix section mismatch warning/error | * ab0f424cd2 PCI/EDR: Clear Device Status after EDR error recovery | * 3e28d59a5f of: Fix modalias string generation | * d22b2a3572 vmci_host: fix a race condition in vmci_host_poll() causing GPF | * 282efdf472 spi: fsl-spi: Fix CPM/QE mode Litte Endian | * 55a32fd96e interconnect: qcom: rpm: drop bogus pm domain attach | * 2d0f63077f spi: qup: Don't skip cleanup in remove's error path | * 5e678bfebb linux/vt_buffer.h: allow either builtin or modular for macros | * 321946fa10 ASoC: es8316: Handle optional IRQ assignment | * 873fff9fd6 PCI: imx6: Install the fault handler only on compatible match | * 9de1183f3f ASoC: soc-compress: Inherit atomicity from DAI link for Compress FE | * df23805209 usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition | * 6d16305a15 spi: imx: Don't skip cleanup in remove's error path | * f6974fb204 spi: atmel-quadspi: Free resources even if runtime resume failed in .remove() | * d748e32026 spi: atmel-quadspi: Don't leak clk enable count in pm resume | * 3eb8bebd02 serial: 8250_bcm7271: Fix arbitration handling | * 1757621b87 iio: light: max44009: add missing OF device matching | * 53cdfec251 fpga: bridge: fix kernel-doc parameter description | * c996ca87cf serial: stm32: Re-assert RTS/DE GPIO in RS485 mode only if more data are transmitted | * 3c5fafc27c usb: dwc3: gadget: Change condition for processing suspend event | * cd5708f605 usb: host: xhci-rcar: remove leftover quirk handling | * 9145880e8c pstore: Revert pmsg_lock back to a normal mutex | * 70ee7b8a6d drivers: staging: rtl8723bs: Fix locking in rtw_scan_timeout_handler() | * 2a50e44a66 drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler() | * a616392011 ASoC: cs35l41: Only disable internal boost | * 5eb0e23ab0 ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it | * cb52e7f24c tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. | * 0211342dd6 net: amd: Fix link leak when verifying config failed | * f040bee291 netlink: Use copy_to_user() for optval in netlink_getsockopt(). | * 952030c914 Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" | * fc60067260 ipv4: Fix potential uninit variable access bug in __ip_make_skb() | * 4fbefeab88 net/sched: sch_fq: fix integer overflow of "credit" | * 8fa6c8dad4 net: dpaa: Fix uninitialized variable in dpaa_stop() | * 6cf1d03a42 netfilter: nf_tables: don't write table validation state without mutex | * 551a26668c bpf: Don't EFAULT for getsockopt with optval=NULL | * c3fb321447 bpf: Fix race between btf_put and btf_idr walk. | * ad5b2cf5d1 net: stmmac:fix system hang when setting up tag_8021q VLAN for DSA ports | * fd40d2eb5e net/mlx5e: Nullify table pointer when failing to create | * 15968f6508 net/mlx5: Use recovery timeout on sync reset flow | * c63830a1cc Revert "net/mlx5: Remove "recovery" arg from mlx5_load_one() function" | * c499593821 net/mlx5: Suspend auxiliary devices only in case of PCI device suspend | * d481a6800b net/mlx5: Remove "recovery" arg from mlx5_load_one() function | * 62fea2c2e4 net/mlx5e: Fix error flow in representor failing to add vport rx rule | * 2ca9f9b837 net/mlx5: E-switch, Don't destroy indirect table in split rule | * 8b5f696288 net/mlx5: E-switch, Create per vport table based on devlink encap mode | * c382b693ff net/mlx5e: Don't clone flow post action attributes second time | * 707a31951f ixgbe: Enable setting RSS table to default values | * c8b37d2b5b ixgbe: Allow flow hash to be set via ethtool | * 37f64bc8e0 wifi: iwlwifi: fw: fix memory leak in debugfs | * 80c5ba0078 netfilter: conntrack: fix wrong ct->timeout value | * 6a62a2a09c netfilter: conntrack: restore IPS_CONFIRMED out of nf_conntrack_hash_check_insert() | * d6e03af0a4 wifi: iwlwifi: mvm: check firmware response size | * 180c4ae0de wifi: mt76: connac: fix txd multicast rate setting | * d365e14483 wifi: mt76: mt7921e: stop chip reset worker in unregister hook | * 741bf262bd wifi: mt76: mt7921e: improve reliability of dma reset | * 1ab837a342 wifi: mt76: mt7921: fix missing unwind goto in `mt7921u_probe` | * 11181b6c86 mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data | * c42efff820 wifi: mt76: fix 6GHz high channel not be scanned | * c5cdab3c04 wifi: mt76: mt7921e: fix probe timeout after reboot | * 27ce664b7f wifi: mt76: add flexible polling wait-interval support | * 710f3c7fb3 wifi: mt76: handle failure of vzalloc in mt7615_coredump_work | * 9c036152ad wifi: mt76: mt7915: expose device tree match table | * bd5121ef18 wifi: iwlwifi: make the loop for card preparation effective | * 5611be6c3d io_uring/rsrc: use nospec'ed indexes | * f1bd3414d9 jdb2: Don't refuse invalidation of already invalidated buffers | * f6b46f8438 wifi: iwlwifi: fw: move memset before early return | * 6b345ddd49 wifi: iwlwifi: mvm: initialize seq variable | * 243f6d6ba5 wifi: iwlwifi: yoyo: Fix possible division by zero | * 7c31103f7f wifi: iwlwifi: yoyo: skip dump correctly on hw error | * 164acf216c wifi: iwlwifi: mvm: don't drop unencrypted MCAST frames | * 8f3382624c md/raid10: don't call bio_start_io_acct twice for bio which experienced read error | * 36ba0c7b86 md/raid10: fix memleak of md thread | * b21019a220 md/raid10: fix memleak for 'conf->bio_split' | * 11141630f0 md/raid10: fix leak of 'r10bio->remaining' for recovery | * 9050576bff md/raid10: fix task hung in raid10d | * df6222b01f f2fs: fix to check return value of inc_valid_block_count() | * 2eb5d0165b f2fs: fix to check return value of f2fs_do_truncate_blocks() | * a8091dc814 bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap | * 339d14334a wifi: iwlwifi: mvm: don't set CHECKSUM_COMPLETE for unsupported protocols | * 6f14a94501 wifi: iwlwifi: trans: don't trigger d3 interrupt twice | * 8e5d05ca15 wifi: iwlwifi: debug: fix crash in __iwl_err() | * 6aa401a654 blk-mq: don't plug for head insertions in blk_execute_rq_nowait | * 3c0b799346 selftests/bpf: Fix leaked bpf_link in get_stackid_cannot_attach | * 67c81ecbf7 selftests/bpf: Use read_perf_max_sample_freq() in perf_event_stackmap | * 160fcf5c6b nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage" | * 0f1c4ae80d nvme: fix async event trace event | * 1e4f23c61f nvmet: fix I/O Command Set specific Identify Controller | * fd95ae3bb8 nvmet: fix Identify Active Namespace ID list handling | * 4898a8d6b1 nvmet: fix Identify Controller handling | * 4a7a14e87c nvmet: fix Identify Namespace handling | * b743d68c9f nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns() | * 1d4ac7b0ff bpf, sockmap: fix deadlocks in the sockhash and sockmap | * cfc7ee210f wifi: ath11k: fix writing to unintended memory region | * f43744872a net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling | * c649bf43a2 net: ethernet: stmmac: dwmac-rk: rework optional clock handling | * e6f1ef4a53 scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() | * 52c3d68d99 bpf/btf: Fix is_int_ptr() | * 1f1267ce0b wifi: iwlwifi: fix duplicate entry in iwl_dev_info_table | * 7d058f0ab1 f2fs: fix to avoid use-after-free for cached IPU bio | * 3ee343914c xsk: Fix unaligned descriptor validation | * 8bc8e34e80 crypto: drbg - Only fail when jent is unavailable in FIPS mode | * 81366e333c bpftool: Fix bug for long instructions in program CFG dumps | * d199c2b394 selftests/bpf: Wait for receive in cg_storage_multi test | * 751168d0d2 selftests: xsk: Deflakify STATS_RX_DROPPED test | * 0ea59567d0 selftests: xsk: Disable IPv6 on VETH1 | * 30a4ff7eb4 selftests: xsk: Use correct UMEM size in testapp_invalid_desc | * 90d2f5225d net: qrtr: correct types of trace event parameters | * a7f5be2ac0 f2fs: fix iostat lock protection | * bea3f8aa99 wifi: rt2x00: Fix memory leak when handling surveys | * 828439964f scsi: hisi_sas: Handle NCQ error when IPTT is valid | * cd94f74888 scsi: libsas: Add sas_ata_device_link_abort() | * f7871c9df1 wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg() | * 4eb666646c wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg() | * 7f6714fc2a crypto: sa2ul - Select CRYPTO_DES | * be42155499 crypto: caam - Clear some memory in instantiate_rng | * 74f74c8b84 f2fs: fix scheduling while atomic in decompression path | * 6604df2a9d f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages() | * 88fccb8d0c f2fs: apply zone capacity to all zone type | * d9e30b8ed4 f2fs: fix uninitialized skipped_gc_rwsem | * 61fbf097b7 f2fs: handle dqget error in f2fs_transfer_project_quota() | * 10f7b4975b net: sunhme: Fix uninitialized return code | * e3e55385fa scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS | * 770c3fd4d7 scsi: target: iscsit: Fix TAS handling during conn cleanup | * eacfe32c36 scsi: target: Fix multiple LUN_RESET handling | * cc84bbdde9 scsi: target: iscsit: Stop/wait on cmds during conn close | * edd9002071 scsi: target: iscsit: isert: Alloc per conn cmd counter | * b7ca8ded37 scsi: target: Pass in cmd counter to use during cmd setup | * 741443436e scsi: target: Move cmd counter allocation | * 76b77646f1 scsi: target: Move sess cmd counter to new struct | * 87ee7227cc scsi: target: core: Change the way target_xcopy_do_work() sets restiction on max I/O | * f9361cf40b bpf: Fix __reg_bound_offset 64->32 var_off subreg propagation | * 2361aee1c5 netfilter: keep conntrack reference until IPsecv6 policy checks are done | * 8d05f25475 net: dsa: qca8k: remove assignment of an_enabled in pcs_get_state() | * c997f28917 libbpf: Fix ld_imm64 copy logic for ksym in light skeleton. | * 382310d9c8 net/packet: convert po->auxdata to an atomic flag | * 3eae0f4c31 net/packet: convert po->origdev to an atomic flag | * f2d971608a net/packet: annotate accesses to po->xmit | * c3ee3540a1 vlan: partially enable SIOCSHWTSTAMP in container | * 07782db81e net: pcs: xpcs: remove double-read of link state when using AN | * 157c84b793 bpf: Remove misleading spec_v1 check on var-offset stack read | * b73438a4a6 selftests/bpf: Fix a fd leak in an error path in network_helpers.c | * 0324300dce wifi: ath11k: fix deinitialization of firmware resources | * af5265c64d scm: fix MSG_CTRUNC setting condition for SO_PASSSEC | * 1f1fba8b3a crypto: qat - fix concurrency issue when device state changes | * a62ba7e0d2 bpf: fix precision propagation verbose logging | * 0049d2edda bpf: take into account liveness when propagating precision | * 78eee85913 wifi: rtw88: mac: Return the original error from rtw_mac_power_switch() | * 154d4d630e wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser() | * 1c8f46578d tools: bpftool: Remove invalid \' json escape | * 644df7e865 wifi: ath6kl: reduce WARN to dev_dbg() in callback | * 0022a3936e wifi: brcmfmac: support CQM RSSI notification with older firmware | * 9354826c02 wifi: ath11k: fix SAC bug on peer addition with sta band migration | * 76f9b0d6f0 wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() | * 7e5f42abfc wifi: ath5k: Use platform_get_irq() to get the interrupt | * 7d3fd8da72 wifi: ath11k: Use platform_get_irq() to get the interrupt | * 9b9356a301 wifi: ath9k: hif_usb: fix memory leak of remain_skbs | * 1a59067bde wifi: ath6kl: minor fix for allocation size | * 830d79af9e platform/chrome: cros_typec_switch: Add missing fwnode_handle_put() | * aefea3016a hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E | * d29faefa8d rpmsg: glink: Propagate TX failures in intentless mode as well | * 2f51bac276 cpufreq: use correct unit when verify cur freq | * 0985838a9c ACPI: bus: Ensure that notify handlers are not running after removal | * 290e26ec0d tick/common: Align tick period with the HZ tick. | * 0fe6ef82e4 drm/i915: Make intel_get_crtc_new_encoder() less oopsy | * fc2b20c092 debugobject: Prevent init race with static objects | * 1d1735c6fb media: mediatek: vcodec: add remove function for decoder platform driver | * c692a44bc5 media: mediatek: vcodec: fix decoder disable pm crash | * 54e85ee2b4 perf/arm-cmn: Fix port detection for CMN-700 | * a8897bffca arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step | * 3df8a87394 x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() | * f25994f7a9 regulator: stm32-pwr: fix of_iomap leak | * 16c7fcbfe0 media: venus: dec: Fix capture formats enumeration order | * 1e229899e3 media: venus: dec: Fix handling of the start cmd | * b21a9a57c7 media: rc: gpio-ir-recv: Fix support for wake-up | * b75aaebac2 drm/amd/display: Fix potential null dereference | * fd22e8c8c3 media: hi846: Fix memleak in hi846_init_controls() | * 893b267ccc media: v4l: async: Return async sub-devices to subnotifier list | * 45b7461d91 media: rcar_fdp1: Fix refcount leak in probe and remove function | * affad9e791 media: platform: mtk-mdp3: fix potential frame size overflow in mdp_try_fmt_mplane() | * 5a72aea9ac media: saa7134: fix use after free bug in saa7134_finidev due to race condition | * 305262a23c media: dm1105: Fix use after free bug in dm1105_remove due to race condition | * 1495945f7c platform/x86/amd: pmc: Move out of BIOS SMN pair for STB init | * 1603a098b4 platform/x86/amd: pmc: Utilize SMN index 0 for driver probe | * f82af0dd22 platform/x86/amd: pmc: Move idlemask check into `amd_pmc_idlemask_read` | * 4e6c35193a platform/x86/amd: pmc: Don't dump data after resume from s0i3 on picasso | * abfb0ff870 platform/x86/amd: pmc: Hide SMU version and program attributes for Picasso | * d1dbf5b7ea platform/x86/amd: pmc: Don't try to read SMU version on Picasso | * 1c1798c45b platform/x86/amd/pmf: Move out of BIOS SMN pair for driver probe | * 6a17add9c6 media: rkvdec: fix use after free bug in rkvdec_remove | * 2cdc8f729d media: cedrus: fix use after free bug in cedrus_remove due to race condition | * 231a6947ff media: mediatek: vcodec: change lat thread decode error condition | * b02cd74741 media: mediatek: vcodec: making sure queue_work successfully | * 60fe2a3d6d media: mediatek: vcodec: remove unused lat_buf | * 8be5ead0b3 media: mediatek: vcodec: add core decode done event | * 894278b772 media: mediatek: vcodec: move lat_buf to the top of core list | * f08900ca36 media: mediatek: vcodec: using each instance lat_buf count replace core ready list | * 8aae2e6444 media: mediatek: vcodec: add params to record lat and core lat_buf count | * 01dc8f41fc media: mediatek: vcodec: Force capture queue format to MM21 | * 4d5c8a8916 media: mediatek: vcodec: Make MM21 the default capture format | * 5c4cc91b77 media: mediatek: vcodec: Use 4K frame size when supported by stateful decoder | * 0333177548 arm64: dts: sc7280: Rename qspi data12 as data23 | * edbbd78148 arm64: dts: sc7180: Rename qspi data12 as data23 | * 39f6de10df arm64: dts: qcom: msm8994-angler: removed clash with smem_region | * 57aa05d59b arm64: dts: qcom: msm8994-angler: Fix cont_splash_mem mapping | * 7eaa457d1e x86/apic: Fix atomic update of offset in reserve_eilvt_offset() | * 849ab4cf18 regulator: core: Avoid lockdep reports when resolving supplies | * fd092b355a regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow() | * d2151c5d9d drm/ttm/pool: Fix ttm_pool_alloc error path | * 5e5a4185c6 drm/ttm: optimize pool allocations a bit v2 | * dfd1c26e40 arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 regulator | * 3a0c0f7c2f arm64: dts: qcom: msm8994-msft-lumia-octagon: drop unit address from PMI8994 regulator | * 3c8cb6155a arm64: dts: qcom: msm8994-kitakami: drop unit address from PMI8994 regulator | * f3694202d9 arm64: dts: qcom: sc7180-trogdor-pazquel: correct trackpad supply | * f89b2591bb arm64: dts: qcom: sc7180-trogdor-lazor: correct trackpad supply | * d7d13d353a arm64: dts: qcom: sc7280-herobrine-villager: correct trackpad supply | * 958c6cbc32 gpu: host1x: Fix memory leak of device names | * b81cfee967 gpu: host1x: Fix potential double free if IOMMU is disabled | * 62cb9c468d soc: renesas: renesas-soc: Release 'chipid' from ioremap() | * 724911eeae soc: bcm: brcmstb: biuctrl: fix of_iomap leak | * 4cf71779ea mailbox: mpfs: switch to txdone_poll | * 41a51318ab drm/mediatek: dp: Change the aux retries times when receiving AUX_DEFER | * e80c69eb79 drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe() | * a260921b81 ACPI: VIOT: Initialize the correct IOMMU fwspec | * 1a258bfa00 arm64: dts: mediatek: mt8192-asurada: Fix voltage constraint for Vgpu | * 82f6ffb8e0 cpufreq: qcom-cpufreq-hw: Revert adding cpufreq qos | * 2e8aad9cd5 cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623 | * 9a5fa6333f cpufreq: mediatek: raise proc/sram max voltage for MT8516 | * 4bacdbd7d9 cpufreq: mediatek: fix KP caused by handler usage after regulator_put/clk_put | * bd1c006872 cpufreq: mediatek: fix passing zero to 'PTR_ERR' | * f977dbefea arm64: dts: apple: t8103: Disable unused PCIe ports | * eb617ab023 ARM: dts: stm32: fix spi1 pin assignment on stm32mp15 | * 7ff92db0dd perf/arm-cmn: Move overlapping wp_combine field | * 198ca89dea firmware: arm_scmi: Fix xfers allocation on Rx channel | * da3babe96b ARM: dts: gta04: fix excess dma channel usage | * fd67875eba drm: rcar-du: Fix a NULL vs IS_ERR() bug | * 46a1c9ba90 arm64: dts: qcom: sm8450: fix pcie1 gpios properties name | * 98893ae40b mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data | * 1975bf0259 ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 | * a24194121e drm/amd/display/dc/dce60/Makefile: Fix previous attempt to silence known override-init warnings | * acd8f2efa2 arm64: dts: qcom: sm8350-microsoft-surface: fix USB dual-role mode property | * 577a64725b virt/coco/sev-guest: Double-buffer messages | * 0289170151 drm: msm: adreno: Disable preemption on Adreno 510 | * a8d2b46954 drm/msm/adreno: drop bogus pm_runtime_set_active() | * a9b3ef13eb arm64: dts: ti: k3-am62a7: Correct L2 cache size to 512KB | * fe9dc0a264 arm64: dts: ti: k3-am625: Correct L2 cache size to 512KB | * 1e9fc6c473 media: max9286: Free control handler | * 052d22acd7 drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535 | * 1f141fe515 firmware: qcom_scm: Clear download bit during reboot | * 423350af9e media: av7110: prevent underflow in write_ts_to_decoder() | * 0883003ffb media: amphion: decoder implement display delay enable | * 51fc1880e4 media: platform: mtk-mdp3: Add missing check and free for ida_alloc | * c2e5548173 media: bdisp: Add missing check for create_workqueue | * ba8ffb1251 x86/MCE/AMD: Use an u64 for bank_map | * c0a8025c74 ARM: dts: qcom: sdx55: Fix the unit address of PCIe EP node | * 2b5325f9cc ARM: dts: qcom: ipq8064: Fix the PCI I/O port range | * 2ebb3f120e ARM: dts: qcom: ipq4019: Fix the PCI I/O port range | * 671c3a4d7d arm64: dts: qcom: sm8450: Fix the PCI I/O port range | * 5334324f09 arm64: dts: qcom: sm8150: Fix the PCI I/O port range | * be81014936 arm64: dts: qcom: sm8250: Fix the PCI I/O port range | * 87397ffbc9 arm64: dts: qcom: msm8996: Fix the PCI I/O port range | * c8178285ba arm64: dts: qcom: ipq6018: Fix the PCI I/O port range | * 7803b357d9 arm64: dts: qcom: ipq8074: Fix the PCI I/O port range | * ec67a4ef28 arm64: dts: qcom: sc7280: Fix the PCI I/O port range | * a35d6fdd7f arm64: dts: qcom: msm8998: Fix the PCI I/O port range | * 6035794dd2 arm64: dts: qcom: sdm845: Fix the PCI I/O port range | * 44018ad5f2 arm64: dts: qcom: sdm845: correct dynamic power coefficients | * 7cb0802954 arm64: dts: qcom: sc7280: fix EUD port properties | * bd90d249bc arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name | * 6c6a69f822 arm64: dts: broadcom: bcmbca: bcm4908: fix procmon nodename | * 1be866857a arm64: dts: broadcom: bcmbca: bcm4908: fix LED nodenames | * c0454f814b arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name | * 93c22d107a arm64: dts: ti: k3-j721e-main: Remove ti,strobe-sel property | * 5ea54b26d6 arm64: dts: ti: k3-am62a7-sk: Fix DDR size to full 4GB | * 5d77e665ee arm64: dts: ti: k3-am62-main: Fix GPIO numbers in DT | * d585d1072e regulator: core: Shorten off-on-delay-us for always-on/boot-on by time since booted | * 36ecd6c6ed ARM: dts: qcom-apq8064: Fix opp table child name | * 6006310a47 EDAC/skx: Fix overflows on the DRAM row address mapping arrays | * 2c8c8398e1 drm/msm/disp/dpu: check for crtc enable rather than crtc active to release shared resources | * 6524d3d587 drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached | * 6fcfd2861f arm64: dts: renesas: r9a07g043: Update IRQ numbers for SSI channels | * 14c480b2f3 arm64: dts: renesas: r9a07g043: Introduce SOC_PERIPHERAL_IRQ() macro to specify interrupt property | * e83e635bec arm64: dts: renesas: r9a07g054: Update IRQ numbers for SSI channels | * 684fecd4f3 arm64: dts: renesas: r9a07g044: Update IRQ numbers for SSI channels | * dc062516db arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table | * c82f50e55f arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table | * 6dbcc493a1 soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe | * f5222fbd79 tools/x86/kcpuid: Fix avx512bw and avx512lvl fields in Fn00000007 | * 78e32896ec drm/amdgpu: register a vga_switcheroo client for MacBooks with apple-gmux | * 809a3fb8d8 drm/probe-helper: Cancel previous job before starting new one | * 6bd38a1454 drm/vgem: add missing mutex_destroy | * 46473f3bd1 drm/i915/dg2: Drop one PCI ID | * 86a77cef09 drm/rockchip: Drop unbalanced obj unref | * 0955b8eac3 erofs: fix potential overflow calculating xattr_isize | * 50f1c1fba0 erofs: initialize packed inode after root inode is assigned | * 7ee7a86e28 erofs: stop parsing non-compact HEAD index if clusterofs is invalid | * fe2f093b05 tpm, tpm_tis: Claim locality when interrupts are reenabled on resume | * 380f9f79b4 tpm, tpm: Implement usage counter for locality | * 71becf3ffe tpm, tpm_tis: Claim locality before writing interrupt registers | * 0085052a2c tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed | * 10eea3cfda tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register | * 12839c326a tpm, tpm_tis: Do not skip reset of original interrupt vector | * 784c206c66 selinux: ensure av_permissions.h is built when needed | * 5453f22911 selinux: fix Makefile dependencies of flask.h | * 74f77a799d selftests/resctrl: Check for return value after write_schemata() | * bceef0c7f6 selftests/resctrl: Allow ->setup() to return errors | * 7a570dda1d selftests/resctrl: Move ->setup() call outside of test specific branches | * 0bf90aac43 selftests/resctrl: Return NULL if malloc_and_init_memory() did not alloc mem | * ae6803b663 rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check | * 05f437eba0 kunit: fix bug in the order of lines in debugfs logs | * 9ad3b38677 kunit: improve KTAP compliance of KUnit test output | * d0e2f01b53 ASoC: dt-bindings: qcom,lpass-rx-macro: correct minItems for clocks | * a2cbb1a45a bus: mhi: host: Range check CHDBOFF and ERDBOFF | * 4afe300afb bus: mhi: host: Use mhi_tryset_pm_state() for setting fw error state | * cc3e7c0333 bus: mhi: host: Remove duplicate ee check for syserr | * a6f5c84b41 cxl/hdm: Fail upon detecting 0-sized decoders | * 0ae98a8b4f xfs: don't consider future format versions valid | * 2b2515b809 ceph: fix potential use-after-free bug when trimming caps | * 9f565752b3 ubifs: Fix memory leak in do_rename | * 29738e1bcc ubifs: Free memory for tmpfile name | * 884e961674 ubi: Fix return value overwrite issue in try_write_vid_and_data() | * ef9aac6036 ubifs: Fix memleak when insert_old_idx() failed | * 18c2346856 Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" | * ccfe866220 RISC-V: Align SBI probe implementation with spec | * f8076d2a7f iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE | * f455c9cb9e drm/amd/pm: re-enable the gfx imu when smu resume | * d78777c1d4 swsmu/amdgpu_smu: Fix the wrong if-condition | * d79d3430e1 tracing: Fix permissions for the buffer_percent file | * 339dd534f2 riscv: mm: remove redundant parameter of create_fdt_early_page_table | * 3c96dd239a i2c: omap: Fix standard mode false ACK readings | * 142a975738 ACPI: video: Remove acpi_backlight=video quirk for Lenovo ThinkPad W530 | * 18973b73fa ksmbd: fix deadlock in ksmbd_find_crypto_ctx() | * 1f04905865 ksmbd: not allow guest user on multichannel | * c3a3259675 ksmbd: fix memleak in session setup | * a70751dd7b ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() | * b80422474f ksmbd: call rcu_barrier() in ksmbd_server_exit() | * bd80d35725 ksmbd: fix racy issue under cocurrent smb2 tree disconnect | * cec378687a KVM: RISC-V: Retry fault if vma_lookup() results become invalid | * e43cf7abec drm/amd/display: fix a divided-by-zero error | * 09c41688b6 drm/amd/display: fix PSR-SU/DSC interoperability support | * 2abff94db2 drm/amd/display: limit timing for single dimm memory | * 5e1574aa06 drm/amd/display: Remove stutter only configurations | * f6ee841ff2 relayfs: fix out-of-bounds access in relay_file_read | * 5bd77c2393 KVM: arm64: vgic: Don't acquire its_lock before config_lock | * 569f33c3c2 KVM: arm64: Use config_lock to protect vgic state | * 2b57af7bb9 KVM: arm64: Use config_lock to protect data ordered against KVM_RUN | * 6c9d3f2a5e KVM: arm64: Avoid lock inversion when setting the VM register width | * 36e0c405b8 KVM: arm64: Avoid vcpu->mutex v. kvm->lock inversion in CPU_ON | * f01c5f1ae9 KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted | * eae127cd2c reiserfs: Add security prefix to xattr name in reiserfs_security_write() | * c8a3341b33 rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed | * c0bf94154c crypto: ccp - Don't initialize CCP for PSP 0x1649 | * b952a9cf3d crypto: arm64/aes-neonbs - fix crash with CFI enabled | * 4d9d2fd867 crypto: safexcel - Cleanup ring IRQ workqueues on load failure | * 42ca037d0c crypto: api - Demote BUG_ON() in crypto_unregister_alg() to a WARN_ON() | * d9834abd8b ring-buffer: Sync IRQ works before buffer destruction | * ad7cc2a29e ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus | * cb99866895 pinctrl: qcom: lpass-lpi: set output value before enabling output | * 956bbf1871 soundwire: qcom: correct setting ignore bit on v1.5.1 | * c2c563c137 pwm: meson: Fix g12a ao clk81 name | * f7e930b179 pwm: meson: Fix axg ao mux parents | * 1b0341e8fb wifi: mt76: add missing locking to protect against concurrent rx/status calls | * b9f6845a49 kheaders: Use array declaration instead of char | * 9fd4768b09 iio: addac: stx104: Fix race condition for stx104_write_raw() | * c38a4eb8aa iio: addac: stx104: Fix race condition when converting analog-to-digital | * 44847a506e ipmi: fix SSIF not responding under certain cond. | * aeff5808f1 ipmi:ssif: Add send_retries increment | * a6b54af407 MIPS: fw: Allow firmware to pass a empty env | * 7f3340bf06 fs: fix sysctls.c built | * 3e7b8a723b tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem | * c94e5baa98 serial: max310x: fix IO data corruption in batched operations | * 65fdabefd9 serial: 8250: Fix serial8250_tx_empty() race with DMA Tx | * 719a2f969b serial: fix TIOCSRS485 locking | * 27df5bca96 xhci: fix debugfs register accesses while suspended | * 7fb0b81e85 tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH | * ad44530d46 staging: iio: resolver: ads1210: fix config mode | * 64ef787bb1 blk-crypto: make blk_crypto_evict_key() more robust | * 26632a5382 blk-crypto: make blk_crypto_evict_key() return void | * 7d206ec7a0 blk-mq: release crypto keyslot before reporting I/O complete | * 3b5fbb8219 blk-crypto: Add a missing include directive | * 5ca1668a9f blk-crypto: move internal only declarations to blk-crypto-internal.h | * 3aab3abb85 blk-crypto: add a blk_crypto_config_supported_natively helper | * f0efb23651 blk-crypto: don't use struct request_queue for public interfaces | * 316ad076e0 blk-stat: fix QUEUE_FLAG_STATS clear | * 3285613127 media: ov8856: Do not check for for module version | * bccf9fe296 posix-cpu-timers: Implement the missing timer_wait_running callback | * 1408d27f25 tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site | * ee508dfbaf hwmon: (adt7475) Use device_property APIs when configuring polarity | * d899ae3e76 hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write | * 986bd947bc USB: dwc3: fix runtime pm imbalance on unbind | * d4b1e04d27 USB: dwc3: fix runtime pm imbalance on probe errors | * befdcb8e88 usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive | * 491d32c896 usb: gadget: udc: core: Prevent redundant calls to pullup | * f6aaeacf05 usb: gadget: udc: core: Invoke usb_gadget_connect only when started | * 5b6c295947 IMA: allow/fix UML builds | * 38a42842a6 phy: qcom-qmp-pcie: sc8180x PCIe PHY has 2 lanes | * 5c274804e2 PCI: qcom: Fix the incorrect register usage in v2.7.0 config | * 58e56aa838 PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock | * a071769560 PCI: kirin: Select REGMAP_MMIO | * 6e5bf8c9f7 powerpc/boot: Fix boot wrapper code generation with CONFIG_POWER10_CPU | * 4403c7b7e5 arm64: Stash shadow stack pointer in the task struct on interrupt | * 2dd0f8994d arm64: Always load shadow stack pointer directly from the task struct | * 06003e3975 ASoC: amd: ps: update the acp clock source. | * f9dc736e68 ASoC: amd: fix ACP version typo mistake | * f66cd99959 wifi: mt76: mt7921e: Set memory space enable in PCI_COMMAND if unset | * 24d158856c wireguard: timers: cast enum limits members to int in prints | * 103f618cee x86/cpu: Add model number for Intel Arrow Lake processor | * 88b9e97c14 asm-generic/io.h: suppress endianness warnings for readq() and writeq() | * 5ded8299b7 tracing: Error if a trace event has an array for a __field() | * 324b854ce4 wifi: ath11k: reduce the MHI timeout to 20s | * cde9040428 platform/x86: thinkpad_acpi: Add missing T14s Gen1 type to s2idle quirk list | * 7e26bfb49d net: sfp: add quirk enabling 2500Base-x for HG MXPD-483II | * 388764ea64 scsi: mpi3mr: Handle soft reset in progress fault code (0xF002) | * 0ac10535ae selftests mount: Fix mount_setattr_test builds failed | * ec6f22171d net: wwan: t7xx: do not compile with -Werror | * c58f26bdee ASoC: da7213.c: add missing pm_runtime_disable() | * e373f76e20 ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750 | * 372bec6747 iio: adc: palmas_gpadc: fix NULL dereference on rmmod | * c81f5c8b8c ASoC: amd: yc: Add DMI entries to support Victus by HP Laptop 16-e1xxx (8A22) | * 32aae78314 x86/hyperv: Block root partition functionality in a Confidential VM | * 5c7648e96d ASoC: soc-pcm: fix hw->formats cleared by soc_pcm_hw_init() for dpcm | * a89c7b86b5 ASoC: Intel: soc-acpi: add table for Intel 'Rooks County' NUC M15 | * 4f7b42a9bf ASOC: Intel: sof_sdw: add quirk for Intel 'Rooks County' NUC M15 * | 473e97f66c ANDROID: add Android KABI build files to root .gitignore file * | db91e7bd8c ANDROID: add more gki_module headers to .gitignore file * | 9fcc8018f0 Merge 6.1.27 into android14-6.1-lts |\| | * ca48fc16c4 Linux 6.1.27 | * 0bbec73fdd riscv: No need to relocate the dtb as it lies in the fixmap region | * 17509e73ac riscv: Do not set initial_boot_params to the linear address of the dtb | * ed96b31435 riscv: Move early dtb mapping into the fixmap region | * 7cb8c95c0a driver core: Don't require dynamic_debug for initcall_debug probe timing | * ce0555352a USB: serial: option: add UNISOC vendor and TOZED LT70C product | * 17e5ce4d89 btrfs: fix uninitialized variable warnings | * 47e6893a5b bluetooth: Perform careful capability checks in hci_sock_ioctl() | * c4acbf3761 gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xNU | * d27acf15c8 drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var | * e29661611e wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() | * 34cec5cd7a mptcp: fix accept vs worker race | * b45d8f5375 mptcp: stops worker on unaccepted sockets at listener close | * 862ea63fad mm/mempolicy: fix use-after-free of VMA iterator | * e1562cc202 KVM: arm64: Retry fault if vma_lookup() results become invalid | * d70f63be62 phy: phy-brcm-usb: Utilize platform_get_irq_byname_optional() | * 7d057bf201 um: Only disable SSE on clang to work around old GCC bugs * | da95c44967 Merge branch android14-6.1 into android14-6.1-lts * | b6c9bd5fa6 Merge 6.1.26 into android14-6.1-lts |/ * ca1c9012c9 Linux 6.1.26 * ab91b09f39 ASN.1: Fix check for strdup() success * 1831d8cbae ASoC: fsl_sai: Fix pins setting for i.MX8QM platform * 6cb818ed5f ASoC: fsl_asrc_dma: fix potential null-ptr-deref * 7a6593b5d7 ASoC: SOF: pm: Tear down pipelines only if DSP was active * b528537d13 mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock * 71b6df69f1 fpga: bridge: properly initialize bridge device before populating children * f8c3eb751a iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() * 342c1db4fa Input: pegasus-notetaker - check pipe type when probing * a93c20f583 gcc: disable '-Warray-bounds' for gcc-13 too * a09b9383b7 sctp: Call inet6_destroy_sock() via sk->sk_destruct(). * a530b33fe9 dccp: Call inet6_destroy_sock() via sk->sk_destruct(). * a8cf114105 inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). * 588d682251 purgatory: fix disabling debug info * 7ca973d830 fuse: always revalidate rename target dentry * f9a20ef5e8 MIPS: Define RUNTIME_DISCARD_EXIT in LD script * 8d6a870a42 KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg() * 9e7976c0cd KVM: arm64: Make vcpu flag updates non-preemptible * d362a03d92 sched/fair: Fixes for capacity inversion detection * 799c7301de sched/fair: Consider capacity inversion in util_fits_cpu() * fe1c982958 sched/fair: Detect capacity inversion * 7e6631f782 mm/mmap: regression fix for unmapped_area{_topdown} * 059f24aff6 mm: page_alloc: skip regions with hugetlbfs pages when allocating 1G pages * bd6f3421a5 mm: kmsan: handle alloc failures in kmsan_vmap_pages_range_noflush() * 433a7ecaed mm: kmsan: handle alloc failures in kmsan_ioremap_page_range() * e8a7bdb6f7 mm/huge_memory.c: warn with pr_warn_ratelimited instead of VM_WARN_ON_ONCE_FOLIO * 519dbe737f mm/khugepaged: check again on anon uffd-wp during isolation * cc647e05db mm/userfaultfd: fix uffd-wp handling for THP migration entries Change-Id: I350bd9237fc904298f9b2c6756a227389bcf722e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-10-26 17:34:36 +00:00
Laszlo Ersek	d95b2b008e	UPSTREAM: net: tap_open(): set sk_uid from current_fsuid() ... commit 5c9241f3ceab3257abe2923a59950db0dc8bb737 upstream. Commit 66b2c338adce initializes the "sk_uid" field in the protocol socket (struct sock) from the "/dev/tapX" device node's owner UID. Per original commit 86741ec254 ("net: core: Add a UID field to struct sock.", 2016-11-04), that's wrong: the idea is to cache the UID of the userspace process that creates the socket. Commit 86741ec254 mentions socket() and accept(); with "tap", the action that creates the socket is open("/dev/tapX"). Therefore the device node's owner UID is irrelevant. In most cases, "/dev/tapX" will be owned by root, so in practice, commit 66b2c338adce has no observable effect: - before, "sk_uid" would be zero, due to undefined behavior (CVE-2023-1076), - after, "sk_uid" would be zero, due to "/dev/tapX" being owned by root. What matters is the (fs)UID of the process performing the open(), so cache that in "sk_uid". Bug: 295995961 Cc: Eric Dumazet <edumazet@google.com> Cc: Lorenzo Colitti <lorenzo@google.com> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Pietro Borrello <borrello@diag.uniroma1.it> Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org Fixes: 66b2c338adce ("tap: tap_open(): correctly initialize socket uid") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2173435 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 767800fc40) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Ib5f80015e5c0280acf9f35124d3ff267ff0420f0	2023-09-04 09:44:46 +00:00
Eric Dumazet	55caf900e1	net: add vlan_get_protocol_and_depth() helper ... [ Upstream commit 4063384ef762cc5946fc7a3f89879e76c6ec51e2 ] Before blamed commit, pskb_may_pull() was used instead of skb_header_pointer() in __vlan_get_protocol() and friends. Few callers depended on skb->head being populated with MAC header, syzbot caught one of them (skb_mac_gso_segment()) Add vlan_get_protocol_and_depth() to make the intent clearer and use it where sensible. This is a more generic fix than commit e9d3f80935 ("net/af_packet: make sure to pull mac header") which was dealing with a similar issue. kernel BUG at include/linux/skbuff.h:2655 ! invalid opcode: 0000 [#1] SMP KASAN CPU: 0 PID: 1441 Comm: syz-executor199 Not tainted 6.1.24-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 RIP: 0010:__skb_pull include/linux/skbuff.h:2655 [inline] RIP: 0010:skb_mac_gso_segment+0x68f/0x6a0 net/core/gro.c:136 Code: fd 48 8b 5c 24 10 44 89 6b 70 48 c7 c7 c0 ae 0d 86 44 89 e6 e8 a1 91 d0 00 48 c7 c7 00 af 0d 86 48 89 de 31 d2 e8 d1 4a e9 ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 RSP: 0018:ffffc90001bd7520 EFLAGS: 00010286 RAX: ffffffff8469736a RBX: ffff88810f31dac0 RCX: ffff888115a18b00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90001bd75e8 R08: ffffffff84697183 R09: fffff5200037adf9 R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000012 R13: 000000000000fee5 R14: 0000000000005865 R15: 000000000000fed7 FS: 000055555633f300(0000) GS:ffff8881f6a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 0000000116fea000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> [<ffffffff847018dd>] __skb_gso_segment+0x32d/0x4c0 net/core/dev.c:3419 [<ffffffff8470398a>] skb_gso_segment include/linux/netdevice.h:4819 [inline] [<ffffffff8470398a>] validate_xmit_skb+0x3aa/0xee0 net/core/dev.c:3725 [<ffffffff84707042>] __dev_queue_xmit+0x1332/0x3300 net/core/dev.c:4313 [<ffffffff851a9ec7>] dev_queue_xmit+0x17/0x20 include/linux/netdevice.h:3029 [<ffffffff851b4a82>] packet_snd net/packet/af_packet.c:3111 [inline] [<ffffffff851b4a82>] packet_sendmsg+0x49d2/0x6470 net/packet/af_packet.c:3142 [<ffffffff84669a12>] sock_sendmsg_nosec net/socket.c:716 [inline] [<ffffffff84669a12>] sock_sendmsg net/socket.c:736 [inline] [<ffffffff84669a12>] __sys_sendto+0x472/0x5f0 net/socket.c:2139 [<ffffffff84669c75>] __do_sys_sendto net/socket.c:2151 [inline] [<ffffffff84669c75>] __se_sys_sendto net/socket.c:2147 [inline] [<ffffffff84669c75>] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147 [<ffffffff8551d40f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff8551d40f>] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80 [<ffffffff85600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 469aceddfa ("vlan: consolidate VLAN parsing code and limit max parsing depth") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Toke Høiland-Jørgensen <toke@redhat.com> Cc: Willem de Bruijn <willemb@google.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-24 17:32:32 +01:00
Pietro Borrello	035a80733e	tap: tap_open(): correctly initialize socket uid ... [ Upstream commit 66b2c338adce580dfce2199591e65e2bab889cff ] sock_init_data() assumes that the `struct socket` passed in input is contained in a `struct socket_alloc` allocated with sock_alloc(). However, tap_open() passes a `struct socket` embedded in a `struct tap_queue` allocated with sk_alloc(). This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the `struct sock` in input. On default configuration, the type confused field overlaps with padding bytes between `int vnet_hdr_sz` and `struct tap_dev __rcu *tap` in `struct tap_queue`, which makes the uid of all tap sockets 0, i.e., the root one. Fix the assignment by using sock_init_data_uid(). Fixes: 86741ec254 ("net: core: Add a UID field to struct sock.") Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:33:01 +01:00
Cezar Bulinaru	4f61f133f3	net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null ... Fixes a NULL pointer derefence bug triggered from tap driver. When tap_get_user calls virtio_net_hdr_to_skb the skb->dev is null (in tap.c skb->dev is set after the call to virtio_net_hdr_to_skb) virtio_net_hdr_to_skb calls dev_parse_header_protocol which needs skb->dev field to be valid. The line that trigers the bug is in dev_parse_header_protocol (dev is at offset 0x10 from skb and is stored in RAX register) if (!dev->header_ops || !dev->header_ops->parse_protocol) 22e1: mov 0x10(%rbx),%rax 22e5: mov 0x230(%rax),%rax Setting skb->dev before the call in tap.c fixes the issue. BUG: kernel NULL pointer dereference, address: 0000000000000230 RIP: 0010:virtio_net_hdr_to_skb.constprop.0+0x335/0x410 [tap] Code: c0 0f 85 b7 fd ff ff eb d4 41 39 c6 77 cf 29 c6 48 89 df 44 01 f6 e8 7a 79 83 c1 48 85 c0 0f 85 d9 fd ff ff eb b7 48 8b 43 10 <48> 8b 80 30 02 00 00 48 85 c0 74 55 48 8b 40 28 48 85 c0 74 4c 48 RSP: 0018:ffffc90005c27c38 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888298f25300 RCX: 0000000000000010 RDX: 0000000000000005 RSI: ffffc90005c27cb6 RDI: ffff888298f25300 RBP: ffffc90005c27c80 R08: 00000000ffffffea R09: 00000000000007e8 R10: ffff88858ec77458 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000014 R14: ffffc90005c27e08 R15: ffffc90005c27cb6 FS: 0000000000000000(0000) GS:ffff88858ec40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000230 CR3: 0000000281408006 CR4: 00000000003706e0 Call Trace: tap_get_user+0x3f1/0x540 [tap] tap_sendmsg+0x56/0x362 [tap] ? get_tx_bufs+0xc2/0x1e0 [vhost_net] handle_tx_copy+0x114/0x670 [vhost_net] handle_tx+0xb0/0xe0 [vhost_net] handle_tx_kick+0x15/0x20 [vhost_net] vhost_worker+0x7b/0xc0 [vhost] ? vhost_vring_call_reset+0x40/0x40 [vhost] kthread+0xfa/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Fixes: 924a9bc362 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct") Signed-off-by: Cezar Bulinaru <cbulinaru@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2022-08-05 08:56:35 +01:00
Dongli Zhang	736f16de75	net: tap: track dropped skb via kfree_skb_reason() ... The TAP can be used as vhost-net backend. E.g., the tap_handle_frame() is the interface to forward the skb from TAP to vhost-net/virtio-net. However, there are many "goto drop" in the TAP driver. Therefore, the kfree_skb_reason() is involved at each "goto drop" to help userspace ftrace/ebpf to track the reason for the loss of packets. The below reasons are introduced: - SKB_DROP_REASON_SKB_CSUM - SKB_DROP_REASON_SKB_GSO_SEG - SKB_DROP_REASON_SKB_UCOPY_FAULT - SKB_DROP_REASON_DEV_HDR - SKB_DROP_REASON_FULL_RING Cc: Joao Martins <joao.m.martins@oracle.com> Cc: Joe Jin <joe.jin@oracle.com> Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2022-03-06 11:04:01 +00:00
Harold Huang	74a335a07a	tuntap: add sanity checks about msg_controllen in sendmsg ... In patch [1], tun_msg_ctl was added to allow pass batched xdp buffers to tun_sendmsg. Although we donot use msg_controllen in this path, we should check msg_controllen to make sure the caller pass a valid msg_ctl. [1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fe8dd45bb7556246c6b76277b1ba4296c91c2505 Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Suggested-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Harold Huang <baymaxhuang@gmail.com> Acked-by: Jason Wang <jasowang@redhat.com> Link: https://lore.kernel.org/r/20220303022441.383865-1-baymaxhuang@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>	2022-03-02 22:00:59 -08:00
Cong Wang	3b23a32a63	net: fix dev_ifsioc_locked() race condition ... dev_ifsioc_locked() is called with only RCU read lock, so when there is a parallel writer changing the mac address, it could get a partially updated mac address, as shown below: Thread 1 Thread 2 // eth_commit_mac_addr_change() memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN); // dev_ifsioc_locked() memcpy(ifr->ifr_hwaddr.sa_data, dev->dev_addr,...); Close this race condition by guarding them with a RW semaphore, like netdev_get_name(). We can not use seqlock here as it does not allow blocking. The writers already take RTNL anyway, so this does not affect the slow path. To avoid bothering existing dev_set_mac_address() callers in drivers, introduce a new wrapper just for user-facing callers on ioctl and rtnetlink paths. Note, bonding also changes slave mac addresses but that requires a separate patch due to the complexity of bonding code. Fixes: 3710becf8a ("net: RCU locking for simple ioctl()") Reported-by: "Gong, Sishuai" <sishuai@purdue.edu> Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Cong Wang <cong.wang@bytedance.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2021-02-11 18:14:19 -08:00
Menglong Dong	b69df26082	net: tap: check vlan with eth_type_vlan() method ... Replace some checks for ETH_P_8021Q and ETH_P_8021AD in drivers/net/tap.c with eth_type_vlan. Signed-off-by: Menglong Dong <dong.menglong@zte.com.cn> Link: https://lore.kernel.org/r/20210115023238.4681-1-dong.menglong@zte.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>	2021-01-15 20:13:49 -08:00
Jonathan Lemon	9ee5e5ade0	tap/tun: add skb_zcopy_init() helper for initialization. ... Replace direct assignments with skb_zcopy_init() for zerocopy cases where a new skb is initialized, without changing the reference counts. Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>	2021-01-07 16:08:37 -08:00
Jonathan Lemon	06b4feb37e	net: group skb_shinfo zerocopy related bits together. ... In preparation for expanded zerocopy (TX and RX), move the zerocopy related bits out of tx_flags into their own flag word. Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>	2021-01-07 16:08:37 -08:00
Jonathan Lemon	36177832f4	skbuff: Add skb parameter to the ubuf zerocopy callback ... Add an optional skb parameter to the zerocopy callback parameter, which is passed down from skb_zcopy_clear(). This gives access to the original skb, which is needed for upcoming RX zero-copy error handling. Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>	2021-01-07 16:06:37 -08:00
Jason A. Donenfeld	5643a552d3	net: tap: use skb_list_walk_safe helper for gso segments ... This is a straight-forward conversion case for the new function, and while we're at it, we can remove a null write to skb->next by replacing it with skb_mark_not_on_list. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-01-08 15:19:55 -08:00
Arnd Bergmann	407e9ef724	compat_ioctl: move drivers to compat_ptr_ioctl ... Each of these drivers has a copy of the same trivial helper function to convert the pointer argument and then call the native ioctl handler. We now have a generic implementation of that, so use it. Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: David S. Miller <davem@davemloft.net> Acked-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Jason Gunthorpe <jgg@mellanox.com> Reviewed-by: Jiri Kosina <jkosina@suse.cz> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>	2019-10-23 17:23:43 +02:00
Colin Ian King	faeacb6ddb	net: tap: clean up an indentation issue ... There is a statement that is indented too deeply, remove the extraneous tab. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-09-27 20:58:35 +02:00
Al Viro	333f7909a8	coallocate socket_wq with socket itself ... socket->wq is assign-once, set when we are initializing both struct socket it's in and struct socket_wq it points to. As the matter of fact, the only reason for separate allocation was the ability to RCU-delay freeing of socket_wq. RCU-delaying the freeing of socket itself gets rid of that need, so we can just fold struct socket_wq into the end of struct socket and simplify the life both for sock_alloc_inode() (one allocation instead of two) and for tun/tap oddballs, where we used to embed struct socket and struct socket_wq into the same structure (now - embedding just the struct socket). Note that reference to struct socket_wq in struct sock does remain a reference - that's unchanged. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-07-08 19:25:19 -07:00
Thomas Gleixner	09c434b8a0	treewide: Add SPDX license identifier for more missed files ... Add SPDX license identifiers to all files which: - Have no license information of any form - Have MODULE_LICENCE("GPL*") inside which was used in the initial scan/conversion to ignore the file These files fall under the project license, GPL v2 only. The resulting SPDX license identifier is: GPL-2.0-only Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-05-21 10:50:45 +02:00
Maxim Mikityanskiy	d2aa125d62	net: Don't set transport offset to invalid value ... If the socket was created with socket(AF_PACKET, SOCK_RAW, 0), skb->protocol will be unset, __skb_flow_dissect() will fail, and skb_probe_transport_header() will fall back to the offset_hint, making the resulting skb_transport_offset incorrect. If, however, there is no transport header in the packet, transport_header shouldn't be set to an arbitrary value. Fix it by leaving the transport offset unset if it couldn't be found, to be explicit rather than to fill it with some wrong value. It changes the behavior, but if some code relied on the old behavior, it would be broken anyway, as the old one is incorrect. Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-02-22 12:55:31 -08:00
Willem de Bruijn	8c76e77f90	tap: call skb_probe_transport_header after setting skb->dev ... The BPF flow dissector expects either skb->sk or skb->dev set on all skbs. Delay flow dissection until after skb->dev is set. This requires calling from within an rcu read-side critical section. That is fine, see also the call from tun_xdp_one. Fixes: d0e13a1488 ("flow_dissector: lookup netns by skb->sk if skb->dev is NULL") Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-01-01 12:01:02 -08:00
Petr Machata	3a37a9636c	net: dev: Add extack argument to dev_set_mac_address() ... A follow-up patch will add a notifier type NETDEV_PRE_CHANGEADDR, which allows vetoing of MAC address changes. One prominent path to that notification is through dev_set_mac_address(). Therefore give this function an extack argument, so that it can be packed together with the notification. Thus a textual reason for rejection (or a warning) can be communicated back to the user. Signed-off-by: Petr Machata <petrm@mellanox.com> Acked-by: Jiri Pirko <jiri@mellanox.com> Reviewed-by: Ido Schimmel <idosch@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2018-12-13 18:41:38 -08:00
zhong jiang	144a6adfa1	net: tap: remove redundant null pointer check before kfree_skb ... kfree_skb has taken the null pointer into account. hence it is safe to remove the redundant null pointer check before kfree_skb. Signed-off-by: zhong jiang <zhongjiang@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2018-09-21 09:04:37 -07:00
Jason Wang	0efac27791	tap: accept an array of XDP buffs through sendmsg() ... This patch implement TUN_MSG_PTR msg_control type. This type allows the caller to pass an array of XDP buffs to tuntap through ptr field of the tun_msg_control. Tap will build skb through those XDP buffers. This will avoid lots of indirect calls thus improves the icache utilization and allows to do XDP batched flushing when doing XDP redirection. Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2018-09-13 09:25:41 -07:00
Jason Wang	fe8dd45bb7	tun: switch to new type of msg_control ... This patch introduces to a new tun/tap specific msg_control: #define TUN_MSG_UBUF 1 #define TUN_MSG_PTR 2 struct tun_msg_ctl { int type; void *ptr; }; This allows us to pass different kinds of msg_control through sendmsg(). The first supported type is ubuf (TUN_MSG_UBUF) which will be used by the existed vhost_net zerocopy code. The second is XDP buff, which allows vhost_net to pass XDP buff to TUN. This could be used to implement accepting an array of XDP buffs from vhost_net in the following patches. Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2018-09-13 09:25:40 -07:00
Willem de Bruijn	fd3a886258	net: in virtio_net_hdr only add VLAN_HLEN to csum_start if payload holds vlan ... Tun, tap, virtio, packet and uml vector all use struct virtio_net_hdr to communicate packet metadata to userspace. For skbuffs with vlan, the first two return the packet as it may have existed on the wire, inserting the VLAN tag in the user buffer. Then virtio_net_hdr.csum_start needs to be adjusted by VLAN_HLEN bytes. Commit f09e2249c4 ("macvtap: restore vlan header on user read") added this feature to macvtap. Commit 3ce9b20f19 ("macvtap: Fix csum_start when VLAN tags are present") then fixed up csum_start. Virtio, packet and uml do not insert the vlan header in the user buffer. When introducing virtio_net_hdr_from_skb to deduplicate filling in the virtio_net_hdr, the variant from macvtap which adds VLAN_HLEN was applied uniformly, breaking csum offset for packets with vlan on virtio and packet. Make insertion of VLAN_HLEN optional. Convert the callers to pass it when needed. Fixes: e858fae2b0 ("virtio_net: use common code for virtio_net_hdr and skb GSO conversion") Fixes: 1276f24eee ("packet: use common code for virtio_net_hdr and skb GSO conversion") Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2018-06-07 16:15:38 -04:00
Linus Torvalds	a9a08845e9	vfs: do bulk POLL* -> EPOLL* replacement ... This is the mindless scripted replacement of kernel use of POLL* variables as described by Al, done by this script: for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'` for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done done with de-mangling cleanups yet to come. NOTE! On almost all architectures, the EPOLL* constants have the same values as the POLL* constants do. But they keyword here is "almost". For various bad reasons they aren't the same, and epoll() doesn't actually work quite correctly in some cases due to this on Sparc et al. The next patch from Al will sort out the final differences, and we should be all done. Scripted-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>	2018-02-11 14:34:03 -08:00
Linus Torvalds	b2fe5fa686	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next ... Pull networking updates from David Miller: 1) Significantly shrink the core networking routing structures. Result of http://vger.kernel.org/~davem/seoul2017_netdev_keynote.pdf 2) Add netdevsim driver for testing various offloads, from Jakub Kicinski. 3) Support cross-chip FDB operations in DSA, from Vivien Didelot. 4) Add a 2nd listener hash table for TCP, similar to what was done for UDP. From Martin KaFai Lau. 5) Add eBPF based queue selection to tun, from Jason Wang. 6) Lockless qdisc support, from John Fastabend. 7) SCTP stream interleave support, from Xin Long. 8) Smoother TCP receive autotuning, from Eric Dumazet. 9) Lots of erspan tunneling enhancements, from William Tu. 10) Add true function call support to BPF, from Alexei Starovoitov. 11) Add explicit support for GRO HW offloading, from Michael Chan. 12) Support extack generation in more netlink subsystems. From Alexander Aring, Quentin Monnet, and Jakub Kicinski. 13) Add 1000BaseX, flow control, and EEE support to mvneta driver. From Russell King. 14) Add flow table abstraction to netfilter, from Pablo Neira Ayuso. 15) Many improvements and simplifications to the NFP driver bpf JIT, from Jakub Kicinski. 16) Support for ipv6 non-equal cost multipath routing, from Ido Schimmel. 17) Add resource abstration to devlink, from Arkadi Sharshevsky. 18) Packet scheduler classifier shared filter block support, from Jiri Pirko. 19) Avoid locking in act_csum, from Davide Caratti. 20) devinet_ioctl() simplifications from Al viro. 21) More TCP bpf improvements from Lawrence Brakmo. 22) Add support for onlink ipv6 route flag, similar to ipv4, from David Ahern. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1925 commits) tls: Add support for encryption using async offload accelerator ip6mr: fix stale iterator net/sched: kconfig: Remove blank help texts openvswitch: meter: Use 64-bit arithmetic instead of 32-bit tcp_nv: fix potential integer overflow in tcpnv_acked r8169: fix RTL8168EP take too long to complete driver initialization. qmi_wwan: Add support for Quectel EP06 rtnetlink: enable IFLA_IF_NETNSID for RTM_NEWLINK ipmr: Fix ptrdiff_t print formatting ibmvnic: Wait for device response when changing MAC qlcnic: fix deadlock bug tcp: release sk_frag.page in tcp_disconnect ipv4: Get the address of interface correctly. net_sched: gen_estimator: fix lockdep splat net: macb: Handle HRESP error net/mlx5e: IPoIB, Fix copy-paste bug in flow steering refactoring ipv6: addrconf: break critical section in addrconf_verify_rtnl() ipv6: change route cache aging logic i40e/i40evf: Update DESC_NEEDED value to reflect larger value bnxt_en: cleanup DIM work on device shutdown ...	2018-01-31 14:31:10 -08:00
Linus Torvalds	168fe32a07	Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Pull poll annotations from Al Viro: "This introduces a __bitwise type for POLL### bitmap, and propagates the annotations through the tree. Most of that stuff is as simple as 'make ->poll() instances return __poll_t and do the same to local variables used to hold the future return value'. Some of the obvious brainos found in process are fixed (e.g. POLLIN misspelled as POLL_IN). At that point the amount of sparse warnings is low and most of them are for genuine bugs - e.g. ->poll() instance deciding to return -EINVAL instead of a bitmap. I hadn't touched those in this series - it's large enough as it is. Another problem it has caught was eventpoll() ABI mess; select.c and eventpoll.c assumed that corresponding POLL### and EPOLL### were equal. That's true for some, but not all of them - EPOLL### are arch-independent, but POLL### are not. The last commit in this series separates userland POLL### values from the (now arch-independent) kernel-side ones, converting between them in the few places where they are copied to/from userland. AFAICS, this is the least disruptive fix preserving poll(2) ABI and making epoll() work on all architectures. As it is, it's simply broken on sparc - try to give it EPOLLWRNORM and it will trigger only on what would've triggered EPOLLWRBAND on other architectures. EPOLLWRBAND and EPOLLRDHUP, OTOH, are never triggered at all on sparc. With this patch they should work consistently on all architectures" * 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (37 commits) make kernel-side POLL... arch-independent eventpoll: no need to mask the result of epi_item_poll() again eventpoll: constify struct epoll_event pointers debugging printk in sg_poll() uses %x to print POLL... bitmap annotate poll(2) guts 9p: untangle ->poll() mess ->si_band gets POLL... bitmap stored into a user-visible long field ring_buffer_poll_wait() return value used as return value of ->poll() the rest of drivers/*: annotate ->poll() instances media: annotate ->poll() instances fs: annotate ->poll() instances ipc, kernel, mm: annotate ->poll() instances net: annotate ->poll() instances apparmor: annotate ->poll() instances tomoyo: annotate ->poll() instances sound: annotate ->poll() instances acpi: annotate ->poll() instances crypto: annotate ->poll() instances block: annotate ->poll() instances x86: annotate ->poll() instances ...	2018-01-30 17:58:07 -08:00
Michael S. Tsirkin	88fae87327	tap: fix use-after-free ... Lockless access to __ptr_ring_full is only legal if ring is never resized, otherwise it might cause use-after free errors. Simply drop the lockless test, we'll drop the packet a bit later when produce fails. Fixes: 362899b8 ("macvtap: switch to use skb array") Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2018-01-29 12:02:53 -05:00
Jason Wang	5990a30510	tun/tap: use ptr_ring instead of skb_array ... This patch switches to use ptr_ring instead of skb_array. This will be used to enqueue different types of pointers by encoding type into lower bits. Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2018-01-09 10:56:10 -05:00
Wei Xu	61d7853784	tap: free skb if flags error ... tap_recvmsg() supports accepting skb by msg_control after commit 3b4ba04acc ("tap: support receiving skb from msg_control"), the skb if presented should be freed within the function, otherwise it would be leaked. Signed-off-by: Wei Xu <wexu@redhat.com> Reported-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-12-02 21:31:03 -05:00
Al Viro	afc9a42b74	the rest of drivers/*: annotate ->poll() instances ... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>	2017-11-28 11:06:58 -05:00
Willem de Bruijn	0c19f846d5	net: accept UFO datagrams from tuntap and packet ... Tuntap and similar devices can inject GSO packets. Accept type VIRTIO_NET_HDR_GSO_UDP, even though not generating UFO natively. Processes are expected to use feature negotiation such as TUNSETOFFLOAD to detect supported offload types and refrain from injecting other packets. This process breaks down with live migration: guest kernels do not renegotiate flags, so destination hosts need to expose all features that the source host does. Partially revert the UFO removal from 182e0b6b5846~1..d9d30adf5677. This patch introduces nearly(*) no new code to simplify verification. It brings back verbatim tuntap UFO negotiation, VIRTIO_NET_HDR_GSO_UDP insertion and software UFO segmentation. It does not reinstate protocol stack support, hardware offload (NETIF_F_UFO), SKB_GSO_UDP tunneling in SKB_GSO_SOFTWARE or reception of VIRTIO_NET_HDR_GSO_UDP packets in tuntap. To support SKB_GSO_UDP reappearing in the stack, also reinstate logic in act_csum and openvswitch. Achieve equivalence with v4.13 HEAD by squashing in commit 939912216f ("net: skb_needs_check() removes CHECKSUM_UNNECESSARY check for tx.") and reverting commit 8d63bee643 ("net: avoid skb_warn_bad_offload false positives on UFO"). (*) To avoid having to bring back skb_shinfo(skb)->ip6_frag_id, ipv6_proxy_select_ident is changed to return a __be32 and this is assigned directly to the frag_hdr. Also, SKB_GSO_UDP is inserted at the end of the enum to minimize code churn. Tested Booted a v4.13 guest kernel with QEMU. On a host kernel before this patch `ethtool -k eth0` shows UFO disabled. After the patch, it is enabled, same as on a v4.13 host kernel. A UFO packet sent from the guest appears on the tap device: host: nc -l -p -u 8000 & tcpdump -n -i tap0 guest: dd if=/dev/zero of=payload.txt bs=1 count=2000 nc -u 192.16.1.1 8000 < payload.txt Direct tap to tap transmission of VIRTIO_NET_HDR_GSO_UDP succeeds, packets arriving fragmented: ./with_tap_pair.sh ./tap_send_ufo tap0 tap1 (from https://github.com/wdebruij/kerneltools/tree/master/tests) Changes v1 -> v2 - simplified set_offload change (review comment) - documented test procedure Link: http://lkml.kernel.org/r/<CAF=yD-LuUeDuL9YWPJD9ykOZ0QCjNeznPDr6whqZ9NGMNF12Mw@mail.gmail.com> Fixes: fb652fdfe8 ("macvlan/macvtap: Remove NETIF_F_UFO advertisement.") Reported-by: Michal Kubecek <mkubecek@suse.cz> Signed-off-by: Willem de Bruijn <willemb@google.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-11-24 01:37:35 +09:00
Ingo Molnar	8c5db92a70	Merge branch 'linus' into locking/core, to resolve conflicts ... Conflicts: include/linux/compiler-clang.h include/linux/compiler-gcc.h include/linux/compiler-intel.h include/uapi/linux/stddef.h Signed-off-by: Ingo Molnar <mingo@kernel.org>	2017-11-07 10:32:44 +01:00
Craig Gallek	93161922c6	tun/tap: sanitize TUNSETSNDBUF input ... Syzkaller found several variants of the lockup below by setting negative values with the TUNSETSNDBUF ioctl. This patch adds a sanity check to both the tun and tap versions of this ioctl. watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [repro:2389] Modules linked in: irq event stamp: 329692056 hardirqs last enabled at (329692055): [<ffffffff824b8381>] _raw_spin_unlock_irqrestore+0x31/0x75 hardirqs last disabled at (329692056): [<ffffffff824b9e58>] apic_timer_interrupt+0x98/0xb0 softirqs last enabled at (35659740): [<ffffffff824bc958>] __do_softirq+0x328/0x48c softirqs last disabled at (35659731): [<ffffffff811c796c>] irq_exit+0xbc/0xd0 CPU: 0 PID: 2389 Comm: repro Not tainted 4.14.0-rc7 #23 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880009452140 task.stack: ffff880006a20000 RIP: 0010:_raw_spin_lock_irqsave+0x11/0x80 RSP: 0018:ffff880006a27c50 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 RAX: ffff880009ac68d0 RBX: ffff880006a27ce0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff880006a27ce0 RDI: ffff880009ac6900 RBP: ffff880006a27c60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 000000000063ff00 R12: ffff880009ac6900 R13: ffff880006a27cf8 R14: 0000000000000001 R15: ffff880006a27cf8 FS: 00007f4be4838700(0000) GS:ffff88000cc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020101000 CR3: 0000000009616000 CR4: 00000000000006f0 Call Trace: prepare_to_wait+0x26/0xc0 sock_alloc_send_pskb+0x14e/0x270 ? remove_wait_queue+0x60/0x60 tun_get_user+0x2cc/0x19d0 ? __tun_get+0x60/0x1b0 tun_chr_write_iter+0x57/0x86 __vfs_write+0x156/0x1e0 vfs_write+0xf7/0x230 SyS_write+0x57/0xd0 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x7f4be4356df9 RSP: 002b:00007ffc18101c08 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4be4356df9 RDX: 0000000000000046 RSI: 0000000020101000 RDI: 0000000000000005 RBP: 00007ffc18101c40 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000293 R12: 0000559c75f64780 R13: 00007ffc18101d30 R14: 0000000000000000 R15: 0000000000000000 Fixes: 33dccbb050 ("tun: Limit amount of queued packets per device") Fixes: 20d29d7a91 ("net: macvtap driver") Signed-off-by: Craig Gallek <kraig@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-11-01 20:52:36 +09:00
Girish Moodalbail	dea6e19f4e	tap: reference to KVA of an unloaded module causes kernel panic ... The commit 9a393b5d59 ("tap: tap as an independent module") created a separate tap module that implements tap functionality and exports interfaces that will be used by macvtap and ipvtap modules to create create respective tap devices. However, that patch introduced a regression wherein the modules macvtap and ipvtap can be removed (through modprobe -r) while there are applications using the respective /dev/tapX devices. These applications cause kernel to hold reference to /dev/tapX through 'struct cdev macvtap_cdev' and 'struct cdev ipvtap_dev' defined in macvtap and ipvtap modules respectively. So, when the application is later closed the kernel panics because we are referencing KVA that is present in the unloaded modules. ----------8<------- Example ----------8<---------- $ sudo ip li add name mv0 link enp7s0 type macvtap $ sudo ip li show mv0 |grep mv0| awk -e '{print $1 $2}' 14:mv0@enp7s0: $ cat /dev/tap14 & $ lsmod |egrep -i 'tap|vlan' macvtap 16384 0 macvlan 24576 1 macvtap tap 24576 3 macvtap $ sudo modprobe -r macvtap $ fg cat /dev/tap14 ^C <...system panics...> BUG: unable to handle kernel paging request at ffffffffa038c500 IP: cdev_put+0xf/0x30 ----------8<-----------------8<---------- The fix is to set cdev.owner to the module that creates the tap device (either macvtap or ipvtap). With this set, the operations (in fs/char_dev.c) on char device holds and releases the module through cdev_get() and cdev_put() and will not allow the module to unload prematurely. Fixes: 9a393b5d59 (tap: tap as an independent module) Signed-off-by: Girish Moodalbail <girish.moodalbail@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-10-28 19:17:21 +09:00
Girish Moodalbail	78e0ea6791	tap: double-free in error path in tap_open() ... Double free of skb_array in tap module is causing kernel panic. When tap_set_queue() fails we free skb_array right away by calling skb_array_cleanup(). However, later on skb_array_cleanup() is called again by tap_sock_destruct through sock_put(). This patch fixes that issue. Fixes: 362899b872 (macvtap: switch to use skb array) Signed-off-by: Girish Moodalbail <girish.moodalbail@oracle.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-10-26 17:57:39 +09:00
Mark Rutland	6aa7de0591	locking/atomics: COCCINELLE/treewide: Convert trivial ACCESS_ONCE() patterns to READ_ONCE()/WRITE_ONCE() ... Please do not apply this to mainline directly, instead please re-run the coccinelle script shown below and apply its output. For several reasons, it is desirable to use {READ,WRITE}_ONCE() in preference to ACCESS_ONCE(), and new code is expected to use one of the former. So far, there's been no reason to change most existing uses of ACCESS_ONCE(), as these aren't harmful, and changing them results in churn. However, for some features, the read/write distinction is critical to correct operation. To distinguish these cases, separate read/write accessors must be used. This patch migrates (most) remaining ACCESS_ONCE() instances to {READ,WRITE}_ONCE(), using the following coccinelle script: ---- // Convert trivial ACCESS_ONCE() uses to equivalent READ_ONCE() and // WRITE_ONCE() // $ make coccicheck COCCI=/home/mark/once.cocci SPFLAGS="--include-headers" MODE=patch virtual patch @ depends on patch @ expression E1, E2; @@ - ACCESS_ONCE(E1) = E2 + WRITE_ONCE(E1, E2) @ depends on patch @ expression E; @@ - ACCESS_ONCE(E) + READ_ONCE(E) ---- Signed-off-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: davem@davemloft.net Cc: linux-arch@vger.kernel.org Cc: mpe@ellerman.id.au Cc: shuah@kernel.org Cc: snitzer@redhat.com Cc: thor.thayer@linux.intel.com Cc: tj@kernel.org Cc: viro@zeniv.linux.org.uk Cc: will.deacon@arm.com Link: http://lkml.kernel.org/r/1508792849-3115-19-git-send-email-paulmck@linux.vnet.ibm.com Signed-off-by: Ingo Molnar <mingo@kernel.org>	2017-10-25 11:01:08 +02:00
stephen hemminger	120390468b	tun/tap: use paren's with sizeof ... Although sizeof is an operator in C. The kernel coding style convention is to always use it like a function and add parenthesis. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-08-16 11:01:57 -07:00
Colin Ian King	d17eb73bb7	tap: make struct tap_fops static ... The structure tap_fops is local to the source and does not need to be in global scope, so make it static. Cleans up sparse warning: symbol 'tap_fops' was not declared. Should it be static? Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-08-13 20:10:31 -07:00
David S. Miller	d591a1f3aa	tun/tap: Remove references to NETIF_F_UFO. ... It is going away. Signed-off-by: David S. Miller <davem@davemloft.net>	2017-07-17 09:52:57 -07:00
WANG Cong	ffa423fb32	tap: convert a mutex to a spinlock ... We are not allowed to block on the RCU reader side, so can't just hold the mutex as before. As a quick fix, convert it to a spinlock. Fixes: d9f1f61c08 ("tap: Extending tap device create/destroy APIs") Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Sainath Grandhi <sainath.grandhi@intel.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-07-11 13:41:57 -07:00
Jason Wang	3b4ba04acc	tap: support receiving skb from msg_control ... This patch makes tap_recvmsg() can receive from skb from its caller through msg_control. Vhost_net will be the first user. Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-05-18 10:07:41 -04:00
Jason Wang	49f96fd0cb	tap: export skb_array ... This patch exports skb_array through tap_get_skb_array(). Caller can then manipulate skb array directly. Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-05-18 10:07:41 -04:00
Ingo Molnar	c3edc4010e	sched/headers: Move task_struct::signal and task_struct::sighand types and accessors into <linux/sched/signal.h> ... task_struct::signal and task_struct::sighand are pointers, which would normally make it straightforward to not define those types in sched.h. That is not so, because the types are accompanied by a myriad of APIs (macros and inline functions) that dereference them. Split the types and the APIs out of sched.h and move them into a new header, <linux/sched/signal.h>. With this change sched.h does not know about 'struct signal' and 'struct sighand' anymore, trying to put accessors into sched.h as a test fails the following way: ./include/linux/sched.h: In function ‘test_signal_types’: ./include/linux/sched.h:2461:18: error: dereferencing pointer to incomplete type ‘struct signal_struct’ ^ This reduces the size and complexity of sched.h significantly. Update all headers and .c code that relied on getting the signal handling functionality from <linux/sched.h> to include <linux/sched/signal.h>. The list of affected files in the preparatory patch was partly generated by grepping for the APIs, and partly by doing coverage build testing, both all[yes|mod|def|no]config builds on 64-bit and 32-bit x86, and an array of cross-architecture builds. Nevertheless some (trivial) build breakage is still expected related to rare Kconfig combinations and in-flight patches to various kernel code, but most of it should be handled by this patch. Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mike Galbraith <efault@gmx.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>	2017-03-03 01:43:37 +01:00
Sainath Grandhi	9a393b5d59	tap: tap as an independent module ... This patch makes tap a separate module for other types of virtual interfaces, for example, ipvlan to use. Signed-off-by: Sainath Grandhi <sainath.grandhi@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-02-11 20:59:41 -05:00
Sainath Grandhi	d9f1f61c08	tap: Extending tap device create/destroy APIs ... Extending tap APIs get/free_minor and create/destroy_cdev to handle more than one type of virtual interface. Signed-off-by: Sainath Grandhi <sainath.grandhi@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-02-11 20:59:41 -05:00
Sainath Grandhi	6fe3faf867	tap: Abstract type of virtual interface from tap implementation ... macvlan object is re-structured to hold tap related elements in a separate entity, tap_dev. Upon NETDEV_REGISTER device_event, tap_dev is registered with idr and fetched again on tap_open. Few of the tap functions are modified to accepted tap_dev as argument. tap_dev object includes callbacks to be used by underlying virtual interface to take care of tx and rx accounting. Signed-off-by: Sainath Grandhi <sainath.grandhi@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-02-11 20:59:41 -05:00
Sainath Grandhi	ebc05ba7e8	tap: Tap character device creation/destroy API ... This patch provides tap device create/destroy APIs in tap.c. Signed-off-by: Sainath Grandhi <sainath.grandhi@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-02-11 20:59:41 -05:00
Sainath Grandhi	635b8c8ecd	tap: Renaming tap related APIs, data structures, macros ... Renaming tap related APIs, data structures and macros in tap.c from macvtap_.* to tap_.* Signed-off-by: Sainath Grandhi <sainath.grandhi@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-02-11 20:59:41 -05:00
Sainath Grandhi	a8e0469873	tap: Refactoring macvtap.c ... macvtap module has code for tap/queue management and link management. This patch splits the code into macvtap_main.c for link management and tap.c for tap/queue management. Functionality in tap.c can be re-used for implementing tap on other virtual interfaces. Signed-off-by: Sainath Grandhi <sainath.grandhi@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-02-11 20:59:41 -05:00