6.18.57 (longterm, Branch 6.18)

Betroffene Bereiche

Änderungen (621)

• HID: steam: Clean up locking
• HID: steam: Refactor registration
• HID: steam: Rearrange teardown sequence
• HID: steam: Fully unregister controller when hidraw is opened
• sched_ext: Generate qseq from a per-task counter
• drm/amd/display: Don't replace a sink mode that shares the native totals
• regulator: of: fill in supply names in of_regulator_bulk_get_all()
• SUNRPC: Add Kconfig dependency on CRYPTO_KRB5
• can: fix unique skb identifier regression under RPS
• xfs: fix exchange-range-to-eof file size exchange
• xfs: stop exchanging reflink flags when exchanging mappings
• xfs: remove duplicate INO1_WRITTEN check
• ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons
• ACPI: scan: Do not mark button ACPI devices as wakeup-capable
• workqueue: Annotate alloc_workqueue_va() with __printf(1, 0)
• accel/amdxdna: Fix crash when destroying a suspended hardware context
• accel/amdxdna: Fix race condition when checking rpm_on
• accel/amdxdna: Resume power for creating and destroying hardware context
• s390/zcrypt: Pad trailing CCA or EP11 message with zeros
• s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
• s390/zcrypt: Improve EP11 CPRB length and overflow checks
• s390/zcrypt: Improve CCA CPRB length and overflow checks
• workqueue: fix devm_alloc_workqueue() va_list misuse
• netfs: Fix missing alloc tagging of direct mempool allocations
• net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT
• media: verisilicon: Fix kernel panic due to __initconst misuse
• netfs, afs: Fix symlink reading
• cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
• btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock
• drm/panthor: validate userspace queue count against initialized firmware slot count
• x86/CPU/AMD: Fix AMD TLBI Erratum #1718
• drm/vc4: Fix binner slot allocation failing on an idle GPU
• vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
• net: openvswitch: validate transport header presence in set_ipv6_addr
• ptp: ocp: fix PCIe delay estimation calculation
• mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
• net/mlx5e: Order ICOSQ cc update after CQ doorbell
• veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
• drm/imagination: Fix reference and vm_bo handling in remap()
• flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
• bnxt_en: Re-write the BARs following any type of PCIe errors
• bnxt_en: Drop pci_save_state() after pci_restore_state()
• bnxt_en: Delay for 5 seconds after AER DPC for all chips
• bnxt_en: Fix driver init in kdump kernel
• bnxt_en: Add bnxt_clear_bars() helper
• pfcp: make sure the SEID is linear before reading it
• net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET
• Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification"
• net/sched: cls_route: reject change with no routing attribute
• devlink: fix devlink_rel reference leak when notify work is pending
• net: sparx5: start the TOD counters on non-PTP lan969x variants
• flow_dissector: avoid u16 truncation of skb->len when computing thoff
• cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()
• spi: sg2044-nor: Honor SPI clock limits
• spi: sg2044-nor: Return transfer errors
• ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
• ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
• ASoC: adau1372: allow sleepy powerdown GPIOs
• Revert "wifi: ath12k: add panic handler"
• wifi: mt76: mt792x: pick the SAR table layout from the table itself
• wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
• wifi: mt76: mt7925: don't put the band auto marker in TGID
• wifi: mt76: mt7915: disable rx napi when removing device
• wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
• wifi: mt76: mt7925: restore the legacy BSS after MLO teardown
• wifi: mt76: use ALTX queue for packets to disassociated stations
• wifi: mt76: route nullfunc frames to PSD/ALTX queue
• wifi: mt76: account non-AQL frames per peer rather than per link
• wifi: mt76: add PS buffering support for HW-managed TIM drivers
• wifi: mac80211: add ieee80211_txq_aql_pending()
• wifi: mac80211: add AQL support for multicast packets
• wifi: mt76: don't return TXQ when exceeding max non-AQL packets
• riscv: vector: Fix output operands in context save
• riscv: vector: Fix data pointer constraints in context save/restore
• net: make dev_xdp_sb_prog_count() see programs attached through a link
• drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums
• btrfs: fix lost error return value in btrfs_listxattr()
• btrfs: fix xattr replace when multiple xattrs are packed in the same item
• btrfs: unlock inode and extent in caller when io_uring read extent fails
• btrfs: free iov when btrfs_uring_read_extent() fails
• btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
• zloop: zero out only the unread tail of short reads
• arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
• nvmet: use the local P2P device on metadata allocation failure
• nvmet: return Invalid Field for invalid NSIDs feature 82h
• ice: Restore Ordered MMIO Writes for Tx Doorbells
• tee: optee: ffa: support shared memory offsets on large-page kernels
• tee: optee: fix kernel-doc warnings
• cxgb4/ch_ktls: disable softirqs around tid_list erases
• amt: send the relay's General Query directly from the receive path
• net/sched: em_text: reject unterminated algo before autoload
• drm/vc4: Free the BO cache size list on teardown
• drm/aspeed: Balance the display clock enable on teardown
• gpio: exar: initialize the ID before registering its cleanup
• drm/dp: don't mark the AUX backlight enabled when enabling failed
• Bluetooth: btintel_pcie: Add shared HW reset for clean start
• Bluetooth: btintel_pcie: fix TX descriptor bounds check
• fs: don't let a migrating task hide its reference from do_umount()
• fs: move mntput_no_expire() slowpath into a dedicated routine
• mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount
• arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value
• arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
• arm64: dts: lx2160a: fix incorrect pinmux
• smb/server: fix tree connection leak in smb2_tree_connect()
• ksmbd: convert tree_conns_lock to rw_semaphore
• printk: Don't WARN on kthread_run failure.
• bpf: check_cond_jmp_op(): properly infer if register is null
• net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
• ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
• ipv6: mcast: annotate data-races around mca_users
• bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
• bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
• bpf: Mark syscall helpers as sleepable
• ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
• ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer
• bpf: zero extend the result of an arena 32-bit cmpxchg
• bpf: don't rewrite bpf_fastcall patterns entered by a jump
• bpf: Don't infer non-NULL from a pointer with an unbounded offset
• bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
• bpf: Mark NULL kptr stores precise
• bpf: Preserve inner map identity in callback frames
• tracing: Fix subbuf resize races with trace_pipe_raw readers
• bpf: mark a NULL call argument precise
• iommu/riscv: Serialize command queue publishing
• virtio_ring: fix stale descriptor flags after a failed packed add
• vduse: validate virtqueue alignment
• vhost: invalidate vring access on IOTLB transitions
• tracing: Take trace_array reference when opening a tracer options file
• drm/amdgpu: skip the VMID 0 flush for VRAM
• smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
• smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
• ksmbd: fix maximum allowed access checks
• ksmbd: remove redundant DACL check in smb_check_perm_dacl
• remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
• powerpc/xive: propagate IPI init errors to prevent use-after-free
• powerpc/xive: add error return value to xive_smp_probe()
• ACPI: bus: Introduce acpi_bus_get_primary_device()
• drm/xe: don't WARN on kernel job timeout when device already wedged
• nfsd: convert nfsd_net boolean flags to unsigned long flags word
• nfsd: use workqueue enable/disable APIs for v4_end_grace sync
• dm-pcache: validate seg_id fields from persistent memory
• drm/amd/display: Fix dangling pointer in plane reset function
• drm/amd/display: Fix dangling pointer in CRTC reset function
• dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
• uprobes/x86: Move optimized uprobe from nop5 to nop10
• bpf: Reject MEM_ALLOC BTF accesses past object bounds
• bpf: Reject writes through untrusted BTF pointers
• platform/x86: dell-wmi-base: Fix handling of ultra performance key
• bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
• usb: gadget: uac: validate rate list length before storing
• platform/x86: asus-wmi: fix resource leaks on probe failure
• esp: do not unref managed frag pages in esp_ssg_unref()
• RDMA/rvt: Return NULL after port allocation failure
• fs/resctrl: Fix UAF from worker threads when domains are removed
• cxl/features: Serialize multi-part Get/Set Feature transfers
• firmware: arm_scmi: Fix SCMI device destroy lifetimes
• firmware: arm_scmi: Fix OF node reference handling
• firmware: arm_scmi: Clear SystemPower flag on create failure
• ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()
• bpf: Fix WARNING in bpf_tracing_link_release
• pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
• scsi: ufs: core: Validate string descriptors
• scsi: ufs: core: Convert string descriptor format macros to enum
• iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
• PCI: Fix UAF when probe runs concurrent to dyn ID removal
• PCI: Fix dyn_id add TOCTOU
• PCI: Make pci_match_one_device() match on ID instead of device
• RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
• nvmet: fix return status of RMI log page on allocation failure
• drm/panthor: Add vm_bind region with kbo range overlap check
• wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
• md: remove REQ_NOWAIT support from raid1/10/456
• wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
• wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
• wifi: mt76: cancel reset and rc work on device unregister
• bpf: Reject >8 byte return values on return-reading trampoline paths
• wifi: mt76: mt7996: clear stale link state on full reset
• arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
• wifi: nl80211: clean up color-change beacon data on errors
• wifi: brcmfmac: fix P2P action frame handling without device vif
• serial: core: do fallible allocations before the console can be registered
• serial: core: clear freed pointers on uart_register_driver() failure
• tty: skip cdev_del() when no cdev is registered
• HID: logitech-hidpp: Fix FF device cleanup on init failure
• ublk: validate auto buf reg before taking uring_cmd
• bpf: Invalidate RCU pointers after final spin unlock
• PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
• thermal: hwmon: Remove hwmon class device along with its parent
• ocfs2: o2hb: quiesce negotiate handlers and timeout work
• ocfs2/heartbeat: fix slot mapping rollback leaks on error paths
• bpf: Clear buf on error in __bpf_get_task_stack
• bpf: Remove trace_in argument from __bpf_get_stack
• bpf: Factor callchain_finalize function from __bpf_get_stack
• bpf: Factor callchain_store function from __bpf_get_stack
• drm/amd/display: Resize MST HDCP per-connector arrays to 32
• drm/amd/display: disable replay when crc source is enabled
• coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
• scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
• scsi: sd: Move the sd_config_discard() function definition
• btrfs: check if root is readonly when setting posix acl
• btrfs: apply the AUTO_K(V)FREE macros throughout the code
• btrfs: zoned: flush active metadata block group at btree_writepages() start
• iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
• iommu: Pass in old domain to attach_dev callback functions
• NFS: Return a delegation the client fails to record
• bpf: Compare iterator types during state pruning
• clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
• nvmet: fix max_qid race between configfs and controller allocation
• blk-iolatency: clear delay state when freeing policy data
• blk-iocost: clear delay state when freeing policy data
• blk-cgroup: delay freeing policy data after rcu grace period
• bpf: Check pointer type for all atomic RMW paths
• ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
• ksmbd: serialize oplock close with pending break ownership
• ksmbd: defer publishing granted locks to prevent UAF/double-free race
• ksmbd: safely discard unregistered deferred locks
• ksmbd: detach blocked lock requests before freeing
• ksmbd: scope session state changes to bound connections
• dpll: fix NULL deref in dpll_device_ops() during teardown race
• virtio_net: Fix resize of the RX ring
• irqchip/gic-v5: Clear per-CPU IRS data on teardown
• ip6mr: do not clone dst in ip6mr_cache_report()
• net: bridge: arp/nd proxy: fix reading neigh ha
• vxlan: fix reading neigh ha
• NFSv4.1: zero referring call lists before decoding
• net/sched: account classifier filter allocations to memcg
• fuse: Fix the condition to enable over-io-uring
• Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
• Bluetooth: do not leak an hci_conn when a second LE connect is rejected
• net: mana: Cap MSI-X vectors to the device MSI-X table size
• octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()
• netfilter: nf_tables: skip double clone set expressions on element insert
• KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
• LoongArch: KVM: Validate MSI data before routing it to EIOINTC
• LoongArch: KVM: Get VM PMU capability from HW GCFG register
• media: chips-media: wave5: Resume device before setting EOS flag
• drm/amdgpu: force complete the KIQ ring fences on reset
• drm/amdgpu: force complete the MES ring fences on reset
• zram: fix out-of-bounds access in writeback_store()
• lockd, nfsd: RCU-protect nlmsvc_ops dispatch
• nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
• ceph: fix UAF in check_new_map() on session freed during unlock
• cifs: call pagecache_isize_extended() in cifs_setsize() when extending
• ext2: Fix lost inode updates for IS_SYNC inodes
• kho: fix size calculation in kho_preserved_memory_reserve()
• SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
• SUNRPC: Switch MIC token verification to crypto/krb5
• SUNRPC: Switch MIC token generation to crypto/krb5
• SUNRPC: Switch wrap token decryption to crypto/krb5
• SUNRPC: Switch wrap token encryption to crypto/krb5
• SUNRPC: Prepare crypto/krb5 encryption and checksum handles
• SUNRPC: Add errno-to-GSS status conversion helper
• SUNRPC: Add crypto/krb5 enctype lookup to krb5_ctx
• svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
• svcrdma: wake sq waiters when the transport closes
• svcrdma: Add Write chunk WRs to the RPC's Send WR chain
• RISC-V: KVM: Fix PMU event info array size overflow
• KVM: riscv: Fix Spectre-v1 in PMU counter access
• ntb: Store original DMA address for future release
• NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers
• NTB: core: Add .get_dma_dev() callback to ntb_dev_ops
• tipc: avoid busy looping in tipc_exit_net()
• fbdev: Wrap user-invoked calls to fb_set_var() in helper
• drm/amdkfd: Add bounds check for CRAT subtype length
• drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
• bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
• drm/amd/display: check if dml21_add_phantom_plane() is successful
• dmaengine: idxd: fix double free of wq, engine, and group structs
• idpf: bound interrupt-vector register fill to the allocated array
• Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
• soc: xilinx: Fix race condition in event registration
• drivers: firmware: xilinx: Switch to new family code in zynqmp_pm_get_family_info()
• drivers: firmware: xilinx: Add unique family code for all platforms
• netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
• btrfs: lzo: reject compressed segment that overflows the compressed input
• optee: ffa: Add NULL check in optee_ffa_lend_protmem
• scsi: core: pair EH runtime PM get and put
• ovpn: defer key slot crypto freeing to workqueue
• ipvs: revalidate ihl to prevent out-of-bounds access
• eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
• eth: bnxt: decrease indent in bnxt_request_irq()
• gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
• soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
• btrfs: lzo: reject inline extents without valid headers
• accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
• accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
• bpf: Fix netns reference imbalance in conntrack kfuncs
• vhost_iotlb: bound map allocation in add_range
• eventfs: Use children field for rcu head and add memory barriers
• btrfs: skip global block reserve accounting for rescue mounts
• btrfs: warn about extent buffer that can not be released
• btrfs: only invalidate btree inode pages after all ebs are released
• btrfs: split btrfs_fs_closing() and change return type to bool
• KVM: arm64: vgic: Fix race between LPI release and re-registration
• nexthop: take nh->lock for f6i_list walks in replace check and notify
• nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
• xsk: reclaim invalid Tx descriptors in ZC batch path
• xsk: provide sufficient space in pool->tx_descs
• net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
• netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
• Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
• Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs
• net: Convert proto_ops bind() callbacks to use sockaddr_unsized
• hdlc_ppp: fix potential null pointer in ppp_cp_event logging
• Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
• octeontx2-af: Block VFs from clobbering special CGX PKIND state
• s390/zcrypt: Close speculative mem read possibility
• s390/zcrypt: Rework domain processing within zcrypt device driver
• s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code
• drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
• md/raid1,raid10: fix error-path detection with md_cloned_bio()
• md/raid1,raid10: fix bio accounting for split md cloned bios
• md/raid1,raid10: fix deadlock in read error recovery path
• md: replace wait loop with wait_event() in md_handle_request()
• wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
• wifi: ath12k: fix inconsistent arvif state in vdev_create error paths
• ocfs2: validate fast symlink target during inode read
• bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
• wifi: mac80211: bound S1G TIM PVB walk to the TIM element
• wifi: ieee80211: split S1G definitions out
• ixgbe: do not configure xps for XDP queues
• ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
• ext4: add mext_check_validity() to do basic check
• iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path
• cxl/region: Block region delete during region creation
• netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them
• netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
• netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding
• RDMA/bnxt_re: Free CQ toggle page after firmware teardown
• RDMA/bnxt_re: Add a max slot check for SQ
• net: serialize netif_running() check in enqueue_to_backlog()
• net: fully inline backlog_unlock_irq_restore()
• net: optimize enqueue_to_backlog() for the fast path
• fs/ntfs3: call _ntfs_bad_inode() when failing to rename
• fs/ntfs3: Reformat code and update terminology
• i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
• md/raid1: fix writes_pending and barrier reference leaks on write failures
• md/raid10: fix writes_pending leak on write request failures
• bpf: Guard conntrack opts error writes
• bpf: net: netfilter: drop dead NULL checks
• tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
• drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock
• xen/pvcalls: bound backend response req_id before indexing rsp[]
• iomap: release pages on atomic dio size mismatch
• net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
• Bluetooth: 6lowpan: avoid untracked enable work
• accel/amdxdna: Fix VMA access race
• accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval
• accel/amdxdna: Fill invalid payload for failed command
• net/liquidio: drop cached VF pci_dev LUT
• accel/amdxdna: reject user command submission without a command BO
• ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
• ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC
• wifi: mac80211: validate extension-frame layout before RX
• net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
• drm/amd/display: use kvzalloc to allocate struct dc
• wifi: cfg80211: use wiphy work for socket owner autodisconnect
• bpf: Fix UAF in sock clone early bailouts
• bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c
• drm/xe/guc: Keep scheduler timeline name alive
• drm/xe/guc: Hold device ref until queue teardown completes
• bnxt_en: Handle partially initialized auxiliary devices
• fwctl/bnxt_en: Refactor aux bus functions to be more generic
• tipc: serialize udp bearer replicast list updates
• cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
• cifs: prevent readdir from changing file size due to stale directory metadata
• drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
• LoongArch: BPF: Zero-extend signed ALU32 div/mod results
• idpf: fix max_vport related crash on allocation error during init
• drm/i915/gt: Fix NULL deref on sched_engine alloc failure
• drm/amdgpu: Fix kernel panic during driver load failure
• ksmbd: prevent path traversal bypass by restricting caseless retry
• smb/client: fix chown/chgrp with SMB3 POSIX Extensions
• wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
• KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
• netfs: Fix zeropoint update where i_size > remote_i_size
• drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
• erofs: fix metabuf leak in inode xattr initialization
• net: hsr: defer node table free until after RCU readers
• wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
• wifi: mac80211: fix missing RX bitrate update for mesh forwarding path
• netfilter: x_tables: allocate hook ops while under mutex
• netfilter: x_tables: allow initial table replace without emitting audit log message
• netfs: Fix missing barriers when accessing stream->subrequests locklessly
• afs: Fix the locking used by afs_get_link()
• cachefiles: Fix error return when vfs_mkdir() fails
• nvme-pci: fix dma_vecs leak on p2p memory
• nvme-pci: fix dma mapping leak on data setup error
• ACPI: button: Fix ACPI GPE handler leak during removal
• ACPI: button: Tweak acpi_button_remove()
• ACPI: button: Convert the driver to a platform one
• ACPI: button: Adjust event notification routines
• net/sched: fix packet loop on netem when duplicate is on
• net: Introduce skb tc depth field to track packet loops
• KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
• drm/amdgpu: fix amdgpu_hmm_range_get_pages
• netfilter: nf_tables: add hook transactions for device deletions
• f2fs: read COW data with the original inode during atomic write
• fbdev: omap2: fix use-after-free in omapfb_mmap
• fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
• power: supply: max77705: Free allocated workqueue and fix removal order
• power: supply: max77705: Drop duplicated IRQ error message
• workqueue: devres: Add device-managed allocate workqueue
• net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
• drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
• wifi: cfg80211: enforce HE/EHT cap/oper consistency
• ptp: ocp: fix resource freeing order
• ptp: ocp: Make ptp_ocp_unregister_ext() NULL-aware
• ublk: reset per-IO canceled flag on each fetch
• powerpc/64s: Fix unmap race with PMD migration entries
• greybus: raw: fix use-after-free on cdev close
• f2fs: fix data loss caused by incorrect use of nat_entry flag
• ice: fix double-free of tx_buf skb
• ice: fix potential NULL pointer deref in error path of ice_set_ringparam()
• ice: fix race condition in TX timestamp ring cleanup
• ice: reshuffle and group Rx and Tx queue fields by cachelines
• ceph: put folios not suitable for writeback
• libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
• drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure
• drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure
• Revert "net/smc: Introduce TCP ULP support"
• drm/amdgpu/userq: fix access to stale wptr mapping
• pseries/papr-hvpipe: Fix race with interrupt handler
• papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()
• drm/amd/display: Fix dc_link NULL handling in HPD init
• media: iris: fix use-after-free of fmt_src during MBPF check
• media: iris: turn platform caps into constants
• KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
• udf: fix partition descriptor append bookkeeping
• gfs2: fix memory leaks in gfs2_fill_super error path
• gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn
• gfs2: Get rid of delayed withdraws
• gfs2: Asynchronous withdraw
• gfs2: Add clean argument to lm_unmount hook
• gfs2: Clean up quotad timeout handling
• gfs2/sysfs: Replace sprintf/snprintf with sysfs_emit
• ASoC: amd: acp-mach-common: Add missing error check for clock acquisition
• scsi: qla2xxx: Completely fix fcport double free
• soc/tegra: pmc: Fix unsafe generic_handle_irq() call
• media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
• media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
• btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
• btrfs: remove 'reserved' argument from btrfs_pin_extent()
• btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
• hfs: Replace BUG_ON with error handling for CNID count checks
• ASoC: qcom: q6asm: drop DSP responses for closed data streams
• ASoC: qcom: q6asm: handle the responses after closing
• drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
• drm/amd/display: Rename FAMS2 global control lock to DMUB HW control lock
• srcu: Use irq_work to start GP in tiny SRCU
• irqwork: Move data struct to a types header
• mshv: Fix error handling in mshv_region_pin
• mshv: Move region management to mshv_regions.c
• mshv: Centralize guest memory region destruction
• mshv: Refactor and rename memory region handling functions
• static_call: allow using STATIC_CALL_TRAMP_STR() from assembly
• Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
• ALSA: ctxfi: Check the error for index mapping
• ALSA: ctxfi: Refactor resource alloc for sparse mappings
• ALSA: ctxfi: Use explicit output flag for DAIO resources
• ALSA: ctxfi: Add hw parameter to daio_mgr_dao_init()
• Bluetooth: hci_event: move wake reason storage into validated event handlers
• net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
• net: ti: icssg-prueth: Make emac_run_xdp function independent of page
• net: ti: icssg-prueth: Add functions to create and destroy Rx/Tx queues
• ti: icssg: convert to ndo_hwtstamp API
• blktrace: fix __this_cpu_read/write in preemptible context
• accel/amdxdna: Fix NULL pointer dereference of mgmt_chann
• PCI: endpoint: Add missing NULL check for alloc_workqueue()
• PCI: Add WQ_PERCPU to alloc_workqueue() users
• accel/amdxdna: Fix potential NULL pointer dereference in context cleanup
• accel/amdxdna: Add hardware specific attributes
• accel/amdxdna: Enhance runtime power management
• ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
• namespace: handle mount locking for automounts correctly
• namespace: never expire a locked mount
• namespace: refuse an automount below a mount that is in no namespace
• fcntl: refuse F_SET_RW_HINT on an immutable inode
• namei: don't reveal overmounted entries in refwalk
• namespace: unhash a dentry before detaching the mounts on it
• namespace: don't let a pseudo dentry become the root of a mount
• dcache: don't put a mountpoint on a dentry that's being removed
• namespace: check the mounts before reading their parents in pivot_root()
• namespace: remove the fsnotify marks of a mount namespace in process context
• namespace: look at the topmost mount for a mount namespace file
• namespace: check a recursive bind mount for mount namespace loops
• namespace: check a submount for references right before unmounting it
• namespace: queue a mount only once for mount notifications
• namespace: check the target before walking it in do_mount_setattr()
• fs: refuse fspick() on internal superblocks
• namespace: don't copy an unmounted mount tree
• namespace: don't inherit MNT_UMOUNT in clone_mnt()
• namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
• fs: don't silently unmount busy mounts
• mount: keep a copied mount unbindable
• drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
• drm/amdgpu/userq: return the memdup_user() error for the user MQD
• drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
• drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
• drm/amdgpu: make Mac FB workaround generic
• drm/amdgpu: serialize vblank counter reads against GPU reset
• drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
• drm/amdkfd: align SDMA doorbell base for shader doorbell writes
• drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
• drm/xe: Fix shrinker accounting double-subtraction on nested external pins
• drm/vmwgfx: validate pitch coming from userspace
• drm/vc4: Fix firmware reference leak in vc4_drm_bind()
• drm/vc4: drain the hangcheck timer and works on V3D unbind
• drm/imagination: Size page table preallocation by device address
• drm/i915/gt: Unmask interrupts only when ACTIVE is true
• drm/i915/gem: Prevent overstepping exec array boundary
• drm/gud: don't keep a connector without a CRTC as connector_state
• drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
• Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
• Bluetooth: RFCOMM: free the skb when the DLC has no owner
• Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
• Bluetooth: MGMT: Fix status of pending commands flushed on power off
• Bluetooth: ISO: Serialize concurrent connect calls
• Bluetooth: ISO: Reject concurrent BIS listener setup
• Bluetooth: hci_sync: Fix command skb lifetime during scan setup
• Bluetooth: hci_sock: Serialize dead-device detachment
• Bluetooth: btintel_pcie: use managed IRQ teardown
• riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
• riscv: futex: untag the user pointer before the atomic access
• riscv: fix load_unaligned_zeropad() fixup for RV32
• riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
• riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
• scsi: qedi: Initialize callback state before registration
• pmdomain: rockchip: propagate subdomain add errors
• pmdomain: rockchip: fix clock leak on domain probe failure
• pmdomain: rockchip: don't ignore clock lookup errors on attach
• pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
• regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
• regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
• optee: register TEE devices only once fully initialized
• openvswitch: fix soft lockup in the netlink flow dump
• nvme: fix swapped ZRASF zone state values for full and read only
• net: team: free skb when broadcast has no txable port
• net: team: stop reusing skb after queue override
• net: usb: ax88179_178a: fix rx frame length for non-last packets
• net: sparx5: free the matchall entry on destroy
• net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
• net: dsa: microchip: fix KSZ8765 fiber detection
• net: bridge: avoid recursive multicast port cleanup
• net/smc: protect clcsock lifetime in smc_getname
• net/packet: guard the ll header push in packet_rcv_spkt()
• mmc: sdhci-sprd: disable runtime PM on remove
• mmc: mtk-sd: Cancel request timeout work on remove
• mmc: cavium-thunderx: destroy slot platform devices on remove
• mmc: cavium-octeon: destroy slot platform devices on remove
• dm: fix reading free memory in do_resume
• dm-snap: reject the transient exception store for snapshot-merge
• dm-integrity: fix buffer overflow in inline mode with large tag size
• dm-crypt: reject the lmk IV mode with AEAD ciphers
• mm: don't schedule deferred kernel page table freeing while booting
• memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
• memstick: core: wait for request completion before freeing card
• KEYS: Fix add_key() race with keyring restriction
• keys: finalize persistent keyring timeout after link attempt
• ice: fix metadata_dst refcount handling on representor teardown
• ice: fix use-after-free in dynamic port cleanup
• ibmveth: fix TX LTB and filter unwind on open-fail
• ibmveth: h_free logical LAN on open-fail after register
• gve: fix XSK buffer leak on error descriptor
• gve: fix XSK buffer leak when rings are stopped
• gve: fix napi_disable deadlock when attempting to disable XSK pools
• gpio: xilinx: fix runtime PM leak on request error path
• gpio: mpsse: fix race when arming the IRQ poll worker
• EDAC/amd64: Mask UMC chip select to the four implemented selects
• sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute
• selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
• selinux: fix data race on AVC latest_notif
• Revert "wifi: libertas: reject short monitor TX frames"
• tipc: hold a reference to nodes found by link name
• tipc: destroy topsrv workqueues before closing connections
• tcp: reject net_iov in zerocopy receive mapping hints
• swiotlb: fix default_swiotlb_limit() for non-growable default pool
• strparser: make sure __strp_recv isn't running before tearing down the parser
• tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
• xen/netfront: don't leak the skb when xennet_fill_frags() fails
• workqueue: Fix NULL current_pwq deref in chained work check
• wireguard: noise: reject response consumption after intermediate initiation
• wireguard: queueing: preserve tstamp_type when encapsulating packet
• wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()
• wifi: mt76: mt7603: initialize global station WCID
• wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
• vsock/virtio: account only unread bytes in read_skb()
• usb: f81604: fix struct f81604_int_data size mismatch
• dm ioctl: don't let data_start run past the buffer
• cipso: adjust cached option offsets when removing CIPSO
• cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
• btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
• ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
• arm64: irq: exclude the softirq stack switch from KCOV
• ALSA: hda/tas2781: Accept V1 calibration data without CRC
• ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
• Input: xpad - add support for Corsair Novablade Pro
• Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
• Input: ati_remote2 - fix type confusion in device attribute handlers
• ipv6: do not warn on route notification size race
• ipv4: do not warn on route notification size race
• ipv4: stop route notification sizing when nexthop group shrinks
• ipv4: stop exception dump when nexthop group shrinks
• ipv4: stop PMTU walk when nexthop group shrinks
• rust_binder: reschedule node refcount update on thread exit
• ipv4: validate checksum_start before completing checksum
• ipv6: Fix redirect exception creation for UDP/RAW sockets
• crypto: drbg - Fix ineffective sanity check
• net: dsa: mt7530: fix .get_stats64 sleeping in atomic context
• f2fs: fix to reset all pinned status during fggc
• f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
• accel/amdxdna: Bound the sync_bo flush range to the BO size
• ynl: fix schema check errors
• doc/netlink: netlink-raw: Add max check
• netfs: zero the tail of a short DIO/unbuffered read
• net: mana: Skip WQ object destruction for uninitialized RXQ
• net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
• net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
• net/mlx5e: Prevent stale XSK buffer release on refill retry
• fs: Free any excess xarray nodes in clear_inode()
• bnxt_en: fix DMA mapping length for padded small packets