Linux 7.2-rc7

Another week, another -rc.

I can't say that I'm exactly thrilled about the size of this all, but
it is what it is: the new normal with a lot of fixes, many of them due
to review by various AI tools.

And nothing looks particularly scary per se - it's just that there's a
lot here. Most of it is fairly small, although we have a couple of
larger diffs: s390/zcrypt fixes stand out in the diffstat, and so does
btrfs bringing back the fixup worker infrastructure. And some
netfilter ipset fixes.

But aside from a few places like that, most of this is just lots of
tiny fixes. It's pretty much spread all over - drivers (gpu, sound,
networking, you name it), filesystems, core networking, arch code..

I don't currently see any value in delaying the 7.2 release, so I
would expect that to happen next weekend unless something really bad
pops up.

                    Linus

---

Achilles Gaikwad (1):
      NFSv4.2: fix nfs4_listxattr size accounting

Aelin Reidel (1):
      nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI

Ahmad Byagowi (1):
      ptp: ocp: Fix board ID over-read

Ahmed Naseef (1):
      net: phy: mediatek: fix TX blink masks using the RX bits

Akhil P Oommen (1):
      arm64: dts: qcom: purwa: Fix GPU IOMMU property

Aleksandr Nogikh (1):
      usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()

Alex Deucher (2):
      drm/amdgpu/gmc12.1: implement tlb inv semaphore
      drm/amdgpu/gmc12.1: fix MMHUB0 check in pasid tlb flush

Alexander Koskovich (1):
      arm64: dts: qcom: sm8650: Fix IPA IMEM slice

Alexander Usyskin (1):
      mei: pull kvfree out of spinlock

Alexandra Winter (1):
      s390/ism: Fix UAF of sba and ieq during ism_dev_exit()

Alexandre Hamamdjian (1):
      Input: edt-ft5x06 - ignore contacts with an out-of-range slot id

Ali Ahmet Memis (1):
      hwmon: (corsair-psu) serialize debugfs access against hwmon

Alice Ryhl (1):
      rust_binder: do not query current thread for all ioctls

Alok Tiwari (2):
      bnge: Fix NULL pointer dereference in aux device release
      bnge: use int for bnge_fix_rings_count() return value

Anandu Krishnan E (1):
      misc: fastrpc: fix channel ctx ref leak when session alloc fails

Anatolii Shumak (2):
      smb: compress: reject Pattern_V1 when not negotiated
      ksmbd: validate compression Flags before kvmalloc

Andrey Albershteyn (2):
      fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
      xfs: fix inverted clearance of inode junk flags

Andy Lutomirski (1):
      mm: fix incorrect flush address in direct page table reclaim

Anna Schumaker (2):
      NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
      NFS: Decrement refcounts if allocating nfs_free_stateid_data fails

Antonio Quartulli (7):
      ovpn: skip rehash for peers already removed from by_id
      ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET
      ovpn: ensure socket is owned by ovpn before deref sk_user_data
      ovpn: zero-initialize sockaddr before learning a floated endpoint
      ovpn: hash floated peer by transport identity only
      ovpn: disable IPv4 redirects on MP interfaces
      ovpn: ensure TCP vars are initialized first

Asad Kamal (2):
      Revert "drm/amdgpu: fix aperture mapping leak"
      drm/amdgpu: fix aperture iounmap skipped on device removal

Babanpreet Singh (1):
      counter: microchip-tcb-capture: Fix DT channel validation

Bard Liao (2):
      ASoC: SOF: topology: Use acpi mach from the machine driver
      ASoC/soundwire: Intel: reset the PCMSyCM registers in hda_sdw_bpt_close

Baul Lee (7):
      net/x25: fix use-after-free of the socket by its timers
      net: bridge: mrp: fix uninitialised bytes on the wire
      sctp: keep chunk->transport in step with the list it is queued on
      ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
      ALSA: us144mkii: re-anchor capture URBs on resubmission
      ALSA: usb-audio: fix OOB write on Type II inbound URBs
      ALSA: usx2y: bound the hwdep mmap fault offset

Bhargava Marreddy (1):
      bnge: Fix resource leak in bnge_init_nic() error path

Billy Tsai (1):
      MAINTAINERS: add Ryan Chen and Billy Tsai as reviewer for ARM/ASPEED

Bjorn Andersson (2):
      arm64: dts: qcom: glymur: fix PCIe SMMU interrupts
      arm64: dts: qcom: glymur: fix QUP serial engine IRQs

Bobby Eshleman (1):
      net/mlx5e: fix BQL reset on SQ re-activation

Boris Burkov (2):
      btrfs: trigger cow fixup via dirty_folio()
      btrfs: flush the fixup workers during close_ctree

Borislav Petkov (AMD) (1):
      x86/bugs: Make Safe-RET robust against interrupt injection

Brendan Jackman (1):
      MAINTAINERS: update address for Brendan Jackman

Breno Leitao (1):
      x86/mce: Set up the polling timer before CMCI discovery

Bryam Vargas (8):
      thunderbolt: Bound the DROM dual link port number before
indexing sw->ports
      selinux: reject a permission value exceeding the class permission count
      selinux: reject a class permission count below its inherited common
      selinux: do not cancel a policy conversion that never started
      selinux: require a class's permission values to cover its permission count
      selinux: reject an unclaimed class value in security_get_classes()
      selinux: require every boolean value to be defined
      Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

Candice Li (1):
      drm/amdgpu: reject oversized IBs with per-ring packet limits

Carlos Llamas (1):
      selinux: bpf: check SBLABEL_MNT before isec init

Cen Zhang (Microsoft) (1):
      net/openvswitch: check Ethernet header length in key_extract()

ChenXiaoSong (1):
      smb/client: show compress mount option

Chengfeng Ye (3):
      netfilter: ebt_nflog: pin the NFLOG backend
      bpf, sockmap: Fix sk_redir use-after-free in send verdict
      bpf: Fix netns reference imbalance in conntrack kfuncs

Chris Mi (1):
      net/mlx5: SF, Handle function changed event

Christian A. Ehrhardt (2):
      drm/shmem_helper: Check VMA boundaries for PMD mappings
      drm/panthor: Check VMA boundaries for PMD mappings

Christian Borntraeger (1):
      vdpa/mlx5: Fix buffer length in create_direct_keys()

Christoph Hellwig (4):
      xfs: update BDI {io,ra}_pages values based on the RT device limits
      xfs: add a separate bio_set for spliting GC writes
      xfs: add a comment to describe xfs_gc_bio.victim_rtg
      xfs: check v5 superblock features early

Claudio Imbrenda (13):
      KVM: s390: Fix unlikely NULL gmap dereference
      KVM: s390: Do not free SCA if it was not allocated
      KVM: s390: Fix kvm_s390_vcpu_unsetup_cmma()
      KVM: s390: Fix overclearing ESCA in case of error
      KVM: s390: ucontrol: Fix sca_clear_ext_call()
      KVM: s390: Fix leaking of PGM_ADDRESSING to userspace
      KVM: s390: Fix race in __do_essa()
      KVM: s390: cmma: Fix dirty tracking when removing memslot
      KVM: s390: ucontrol: Add missing locking around gmap_remove_child()
      KVM: s390: Free the mmu cache when kvm_arch_vcpu_create() fails
      KVM: s390: Return -EINTR if a signal is pending while faulting-in
      KVM: s390: Fix ordering when adding to SCA
      KVM: s390: Fix cleanup in kvm_s390_pv_create_cpu()

Cunhao Lu (1):
      serial: 8250_dma: Clear stale RX state on shutdown

Daming Li (1):
      net: smc: fix splice entry lifetime imbalance in smc_rx_splice

Daniel Drake (1):
      arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer

Danila Tikhonov (1):
      mailmap: map old addresses to Danila Tikhonov

Danilo Krummrich (2):
      rust: io: gate ioremap/iounmap on CONFIG_HAS_IOMEM
      rust: io: gate ioremap doctests on CONFIG_HAS_IOMEM

Darrick J. Wong (21):
      xfs: check cowextsize in xrep_inode_cowextsize
      xfs: fix transaction block reservation in xrep_rtbitmap
      xfs: rtsummary scrub should treat rtbitmap corruption errors as
an xref error
      xfs: zero i_nlink before repair puts inode on unlinked list
      xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems
      xfs: only check mergeability of bnobt records
      xfs: don't double-lock when deleting a self-referential directory
      xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
      xfs: don't zap the attr fork on repair when there are queued pptr updates
      xfs: nlink scrub must take IOLOCK before determining ILOCK state
      xfs: avoid UAF on sc->tempip in xrep_tempfile_create
      xfs: hoist per-bucket unlinked list check to helper
      xfs: don't livelock in scrub on a circular unlinked list
      xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
      xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
      xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
      xfs: check xfarray iteration errors when committing unlinked inode lists
      xfs: fix allocated inodes that show up in the unlinked list
      xfs: fix another iunlink infinite loop bug in online fsck
      xfs: set the prev pointer when reinserting an inode on the unlinked list
      xfs: don't ignore runtime errors in xrep_iunlink_reload_next

David Lee (1):
      btrfs: lzo: reject inline extents without valid headers

David Weber (1):
      drm/amd/display: allow self-refresh exit while entry is blocked

Dawid Wróbel (2):
      ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
      ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses

Dmitry Antipov (1):
      btrfs: fix memory leak in btrfs_do_encoded_write()

Dmitry Baryshkov (1):
      arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle

Dmitry Torokhov (6):
      Input: evdev - fix information leak in evdev_pass_values()
      Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
      Input: synaptics-rmi4 - zero report size on F54 work error
      Input: synaptics-rmi4 - block s_input when F54 queue is busy
      Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
      Input: evdev - sanitize event type index when fetching event masks

Dongli Zhang (1):
      net: tap: set skb->dev before parsing virtio net header in
tap_get_user_xdp()

Donglin Lyu (1):
      Input: atkbd - skip deactivate for HONOR ZQC-P

Doruk Tan Ozturk (2):
      net/packet: reset the MAC header on the packet-socket transmit path
      net: usb: ipheth: fix carrier_work UAF on disconnect

Dragos Tatulea (1):
      net: Defer netdev KOBJ_ADD uevent until the device is published

Eddie Lin (1):
      misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free

Eduard Zingerman (1):
      bpf: Simplify sanitize_err() signature

Ekansh Gupta (2):
      misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
      misc: fastrpc: Remove buffer from list prior to unmap operation

Eric Biggers (2):
      fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
      fsverity: Fix silent truncation in bpf_get_fsverity_digest()

Eric Dumazet (3):
      netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
      net: remove WARN_ON_ONCE() from sk_mc_loop()
      net/atm: fix slab-out-of-bounds read in vcc_setsockopt()

Eric Farman (10):
      s390/vfio_ccw: Free all memory if cp_init() fails
      s390/vfio_ccw: Limit the number of channel program segments
      s390/vfio_ccw: Fix out of bounds check on CCW array
      s390/vfio_ccw: Ensure first IDAW remains constant
      s390/vfio_ccw: Calculate idal length based on idaw type
      s390/vfio_ccw: Ensure index for read/write regions are within range
      s390/vfio_ccw: Cancel existing workqueues
      s390/vfio_ccw: Move cp cleanup out of not operational
      s390/vfio_ccw: Selectively expand io_mutex
      s390/vfio_ccw: Implement a crw lock

Fan Wu (3):
      serial: amba-pl011: fix indefinite RS485 post-send delay
      serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
      serial: amba-pl011: synchronize DMA teardown

Fan XinRan (1):
      net: thunderbolt: Tear down DMA paths before stopping the rings

Fan Ye (1):
      Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"

Florian Westphal (3):
      netfilter: ipset: add small wrappers for hash and bucket sizes
      netfilter: ipset: add and use mtype_del_cidr_all helper
      netfilter: ipset: switch to rcu work

Frank Li (1):
      MAINTAINERS: ARM/FREESCALE: merge Layerscape entry into i.MX entry

Frank Sorenson (1):
      smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()

Gang Yan (1):
      selftests: mptcp: join: mark tests with data corruption as failed

George Wilson (3):
      powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
      powerpc/pseries: pci - logic bug
      powerpc/pseries: lparcfg - fix kbuf[] underflow

Guanghui Yang (1):
      xfs: propagate errors from xfs_rtginode_load

Guenter Roeck (7):
      hwmon: (pmbus/core) Avoid race condition during probe
      hwmon: (pmbus) Fix type confusion in notification logic
      hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
      hwmon: (ltc4282) Avoid overflow in maximum power calculation
      hwmon: (ltc4282) Clamp negative current limits
      hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
      hwmon: (corsair-psu) Fix linear11 calculation

Hans Ulli Kroll (2):
      pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function
      pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function

Harald Freudenberger (5):
      s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code
      s390/zcrypt: Improve CCA CPRB length and overflow checks
      s390/zcrypt: Improve EP11 CPRB length and overflow checks
      s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
      s390/zcrypt: Pad trailing CCA or EP11 message with zeros

Henry Martin (1):
      net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

Hidayath Khan (2):
      s390/qeth: validate user buffer length in SNMP and ARP query ioctls
      dibs: initialise dibs->lock in dibs_dev_alloc()

Hongyan Xu (2):
      ata: pata_sl82c105: fix bridge revision use-after-free
      watchdog: at91sam9_wdt: prevent timer rearm during teardown

Hugh Dickins (1):
      mm/filemap: __filemap_add_folio() restore index before retrying

Hui Su (1):
      ring-buffer: Fix crash passing ERR_PTR to kthread_stop()

HyeongJun An (1):
      Input: cs40l50-vibra - validate custom data from user space

Ibrahim Hashimov (1):
      xfs: bounds-check buffer log item's dirty bitmap

Ishaan Dandekar (1):
      usb: quirks: Add ShanWan gamepad to quirk list

Ivan Vecera (1):
      MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li

Jakub Kicinski (1):
      net: avoid theoretical races with ref drain

Jamal Hadi Salim (2):
      net/sched: cls_route: fix fastmap use-after-free on filter
      net/sched: cls_api: Always acquire rtnl_lock when destroying
locked classifiers

Jan Sebastian Götte (1):
      serial: qcom-geni: fix TX DMA buffer flush

Jesse Zhang (4):
      drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode
      drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode
      drm/amdgpu: fix JPEG v5.3.0 queue reset failure in DPG mode
      drm/amdgpu/userq: serialize queue map against GPU reset

Jia Jia (2):
      vhost-scsi: flush backend after device ioctls
      vhost-scsi: reject feature changes after endpoint

Jiangshan Yi (1):
      usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

Jianing Li (1):
      Input: hynitron_cstxxx - validate touch count and finger IDs

Jiawen Liu (1):
      net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete

Jiayuan Chen (1):
      tcp: fix TFO max_qlen accounting across reuseport migration

Jijie Shao (2):
      net: hns3: fix speed configuration residue after driver reload
      MAINTAINERS: add myself as a maintainer for Hisilicon Network Subsystem

Jose Fernandez (Anthropic) (1):
      bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

Josh Poimboeuf (1):
      ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()

Joshua Rogers (2):
      vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
      vt: add permission check for KDSKBMETA ioctl

Jozsef Kadlecsik (2):
      netfilter: ipset: rework cidr bookkeeping
      netfilter: ipset: switch ext_size to atomic64_t

Julian Anastasov (2):
      ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
      ipvs: return the csum validation for forward hook

Jun Yang (1):
      vhost: reset the vring metadata cache on vring reconfiguration

Junrui Luo (1):
      misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke

Jérémy Jean (1):
      tls: rx: restore msg_iter before TLS 1.3 optimistic retry

Karthikeyan KS (1):
      soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read

Keegan Freyhof (1):
      bnxt_en: Fix PTP PPS setting bug

Keno Fischer (1):
      futex: Prevent robust futex exit race some more

Krzysztof Kozlowski (2):
      arm64: dts: qcom: monaco: Add default GIC address cells
      arm64: dts: qcom: eliza: Fix DSI1 phy reference clock rate

Kuba Piecuch (2):
      sched_ext: Mark waker CPU busy when selected in WAKE_SYNC case
      selftests/sched_ext: Handle sleeping task affinity changes in numa test

Kumar Kartikeya Dwivedi (1):
      rqspinlock: Reset tail when preserving queue on deadlock

Kyle Zeng (1):
      ipv6: prevent in6_dev_get() from resurrecting inet6_dev

Kyohei Kadota (1):
      Input: xpad - add support for ZENAIM LEVERLESS

Lachlan Hodges (1):
      usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask

Laurent Vivier (1):
      usbnet: cap max_mtu for drivers without bind callback

Leon Hwang (4):
      ftrace: Protect direct_functions in ftrace_find_rec_direct
      ftrace: Protect direct_functions in update_ftrace_direct_del
      ftrace: Protect direct_functions in update_ftrace_direct_mod
      ftrace: Drop extra comma in trace_buffered_event_enable

Lijo Lazar (2):
      drm/amdgpu: Use virtual alloc during coredump
      drm/amdgpu: Allocate coredump ring buffers per ring

Lin Jiapeng (1):
      xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

Lincoln Wallace (1):
      ima: fix out-of-bounds read in xattr_verify()

Linfeng Sun (1):
      vhost-scsi: Validate T10 PI scatterlist counts

Linfeng Sun  (1):
      vhost_iotlb: bound map allocation in add_range

Linmao Li (2):
      Input: byd - synchronize timer deletion before freeing private data
      Input: psxpad-spi - set driver data before use

Linus Torvalds (1):
      Linux 7.2-rc7

Lizhi Hou (2):
      accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
      accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()

Long Li (2):
      xfs: fix ilock leak on error in xfs_dq_get_next_id
      xfs: don't swallow dquot recovery verification errors

Lorenzo Stoakes (ARM) (5):
      mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
      mm/ptdump: always stabilise against page table freeing using init_mm
      arm64: remove redundant concurrent ptdump UAF mitigation
      mm/huge_memory: fix huge_zero_pfn race
      mm/huge_memory: separate out CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic

Luca Fresi (1):
      serial: sc16is7xx: enable THRI before filling TX FIFO

Luxiao Xu (1):
      bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie

Mahanta Jambigi (1):
      net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT
in smc_llc_event_handler()

Marcin Bernatowicz (1):
      drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs

Marco Baffo (1):
      ovpn: limit keepalive values to one day

Mariano Baragiola (1):
      staging: rtl8723bs: validate monitor transmit frame lengths

Martin Kaiser (1):
      selftests/ftrace: refactor eprobes test to fix argument checks

Mathieu Dubois-Briand (1):
      nvmem: layouts: Add fixed-layout driver

Matt Fleming (1):
      mm/huge_memory: initialise workingset state before folio split

Matthieu Baerts (NGI0) (3):
      mptcp: options: reset DSS fields in case of unexpected size
      mptcp: avoid combining some incoming suboptions
      mptcp: remove MPC && MPJ check

Matti Vaittinen (1):
      watchdog: bd96801_wdt: Fix timeout for enabled WDG

Maximilian Immanuel Brandtner (1):
      tls: don't abort the connection on signal-interrupted sends

Maíra Canal (1):
      drm/v3d: Serialize the scheduler timeout handlers

Melbin K Mathew (3):
      fbdev: bound mode sysfs output to the sysfs buffer
      fbdev: clear fb_info->mode before deleting a videomode
      fbdev: serialize mode sysfs access with lock_fb_info()

Michael Chan (1):
      bnxt_en: Disable EOP for TPA on all chips to prevent data corruption

Michael Guralnik (1):
      net/mlx5: fw_tracer, return NULL on create error

Michal Clapinski (1):
      kho: align kho_scratch to MAX_ORDER_NR_PAGES pages

Michał Winiarski (1):
      drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()

Mika Westerberg (1):
      thunderbolt: Initialize ->domain_released completion before it
is being used

Mimi Zohar (1):
      ima: Instantiate file_truncate and path_truncate hooks

Mingyu Wang (1):
      fbdev: core: Fix pointer desynchronization in fb_io_read()

Muhammad Bilal (2):
      staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
      staging: rtl8723bs: fix OOB read in WMM_param_handler()

Nathan Gao (1):
      tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()

Nikhil P. Rao (2):
      pds_core: keep the health thread stopped during reset
      pds_core: cancel pending PCI reset work on AER recovery

Nikhil Solanke (2):
      usb: core: Add quirk for 255-bytes initial config read
      usb: hub: Split announce_device() to log device identity before
enumeration

Niklas Cassel (1):
      ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0

Or Har-Toov (1):
      devlink: fix net namespace reference leak in reload

Osama Abdelkader (1):
      drm/panthor: skip zero-sized firmware sections

Panagiotis Petrakopoulos (1):
      staging: rtl8723bs: fix missing shared-key auth challenge length check

Paolo Abeni (1):
      mptcp: reclaim forward-allocated memory on RX path errors

Paolo Bonzini (2):
      KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled
      KVM: SVM: Serialize accesses to the owner and mirror list with
separate lock

Pavel Begunkov (1):
      net: devmem: prevent net-iov / page mixing

Pawel Laszczak (1):
      usb: cdnsp: fix incorrect endian conversions for APB timeout register

Pengpeng Hou (3):
      Input: iforce - validate input packet lengths
      drm/bridge: ps8640: propagate AUX transfer register errors
      net: prestera: validate firmware header length

Pengyu Luo (2):
      arm64: dts: qcom: sc8280xp: add several missing pdc map entries
      arm64: dts: qcom: sc8280xp: gaokun3: correct EC interrupt pin

Peter Ujfalusi (6):
      ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
      ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
      ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
      ASoC: cs35l41: sort the register default table
      ASoC: cs35l45: sort the register default table
      ASoC: cs4265: sort the register default table

Philipp David (1):
      igc: fix netdev not re-attached after resume if interface is down

Qiang Ma (1):
      xfs: clear zapped attr fork state when bmap repair finds no attr fork

Qiang Yu (1):
      drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12

Qihang Tang (3):
      net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
      packet: use consistent hard_header_len in non-ring send paths
      packet: use consistent hard_header_len in TX_RING send path

Qing Luo (2):
      sctp: fix addip_serial increment on ASCONF_ACK allocation failure
      mptcp: pm: fix data race in add_addr timer callback

Qingfang Deng (1):
      ovpn: fix incorrect use of rcu_access_pointer()

Qingshuang Fu (2):
      hwmon: (nzxt-smart2) Check return value of init_device() in probe
      hwmon: (ads7828) Fix external VREF regulator handling

Qu Wenruo (3):
      btrfs: disable large folios for systems with highmem
      btrfs: disable bs > ps support if no transparent hugepage support
      btrfs: initialize inode mapping flags for cached inodes

Rafael J. Wysocki (3):
      Revert "thermal: hwmon: Use extra_groups for adding temperature
attributes"
      Revert "thermal: hwmon: Register a hwmon device for each thermal zone"
      Revert "thermal/drivers/hwmon: Cleanup coding style a bit"

Ralf Lici (1):
      ovpn: add missing rtnl_link_ops->get_size callback

Ramin Moussavi (1):
      microblaze: restore the page alignment of swapper_pg_dir

Randy Dunlap (2):
      driver core: add missing kernel-doc for union members
      fixp-arith: convert comments to kernel-doc format

Ray Wu (1):
      drm/amd/display: Check for tg ops in dce110_set_avmute

Richard Davies (1):
      Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

Rik van Riel (1):
      fbdev: bitblit: bound-check glyph index in bit_cursor()

Rong Zhang (1):
      ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN for
Logitech PRO X 2 LIGHTSPEED

Rosen Penev (2):
      ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
      ARM: dts: BCM5301X: EA9200: fix NVRAM size

Rudi Heitbaum (1):
      ASoC: rt5645: Make the Kconfig symbol user selectable

Ryan Wilbur (1):
      serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx

SJ Park (5):
      samples/damon/mtier: error out for zero quota goal target values
      mm/damon/lru_sort: error out for >10000 active_mem_bp
      mm/damon/reclaim: skip damon_call() if ctx has not started
      mm/damon/lru_sort: skip damon_call() if ctx has not started
      mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}

Satish Kharat (1):
      enic: fix tx_hang_reset use-after-free on device removal

Sean Christopherson (1):
      KVM: x86/mmu: WARN and clear role.invalid when creating a child
shadow page

Sergey V. Frolov (1):
      net: octeontx2-pf: Fix UB in shift operation

Shardul Bankar (1):
      mptcp: pm: fix memory leak from alloc-during-teardown race

Shay Drory (1):
      net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock

Shravya KN (3):
      bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
      bnxt_en: Determine and store default RX ring in vnic structure
      bnxt_en: Refresh VNIC default ring on queue restart if needed

Shuangpeng Bai (2):
      smb: client: Fix use-after-free in cifs_try_adding_channels()
      eventfs: Fix use-after-free in eventfs_remove_rec()

Sidraya Jayagond (1):
      net/smc: fix TOCTOU race between smc_listen_out() and listener close

Sonali Pradhan (1):
      usb: gadget: f_ncm: Use unsigned int for ndp_index

Stanislav Fomichev (6):
      xsk: require at least 16 bytes of TX metadata
      xsk: pass TX metadata pointer by reference
      xsk: clear metadata pointer when no timestamp is requested
      xsk: validate launch-time metadata size
      xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h
      xsk: validate metadata when processing requests

Stefan Agner (1):
      net: stmmac: resume PHY before hardware setup when opening the interface

Stephen Smalley (1):
      selinux: check level category sets once at load time

Steven Rostedt (1):
      eventfs: Use children field for rcu head and add memory barriers

Sujal Tuladhar (1):
      ksmbd: apply the pre-authentication PDU limit when decompressing

Surendra Singh Chouhan (1):
      watchdog: atcwdt200: fix return value when watchdog is enabled

Taceddin Sancak (1):
      pinctrl: qcom: ipq9650: fix audio_sec_mclk_in1/out1 group pins

Takashi Iwai (1):
      ALSA: usb-audio: Fix sticky mixer regressions on M-Audio Fast Track Ultra

Tao Cui (1):
      Docs/admin-guide/cgroup-v2: document io.latency rotational vs
non-rotational behavior

Tejun Heo (6):
      sched/psi: Create the psimon kthread outside of cgroup_mutex
      sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
      sched_ext: Reject setting disallow from init_task outside the enable path
      sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
      sched_ext: Skip sub-disable teardown for never-linked sub-schedulers
      sched_ext: Don't enable non-ext tasks in the sub-sched task loops

Tengda Wu (1):
      ring-buffer: Use current_context for safe per-CPU buffer swap

Toke Høiland-Jørgensen (1):
      net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter

Travis K. Bangs (1):
      drm/amd: Disable DP audio spread spectrum for Cyan Skillfish

Troy Mitchell (1):
      MAINTAINERS: add SpacemiT K1/K3 I2S entry

Vincent Donnefort (3):
      ring-buffer: Prevent resizing of persistent ring buffer
      ring-buffer: Prevent subbuf order change when resizing is disabled
      ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()

Vitaly Prosyak (1):
      drm/amdgpu: Fix lockdep false positive in amdgpu_lockdep_init

Wang Jiang (1):
      drm/radeon: restore hardware polling in fence_is_signaled to fix
performance regression

Weiming Shi (2):
      vsock/virtio: read virtqueues under worker locks
      vsock/virtio: avoid refilling the RX queue after teardown

Wilken Gottwalt (1):
      hwmon: (corsair-psu) fix possible out-of-bounds access on
missing string termination

Will Chen (1):
      bnxt: fix memory leak in bnxt_queue_mem_alloc error cases

Willy Tarreau (5):
      docs: threat-model: clarify "security bug" vs "vulnerability"
      docs: threat-model: move fake devices out of "non production use"
      docs: security-bugs: clarify what counts as a valid version
      docs: coding-assistant: explain important steps when looking for bugs
      docs: security-bugs: clarify some mandatory steps for AI reports

Wyatt Feng (1):
      mptcp: fastopen: only mark MPTFO subflows with SYN data

Xiang Mei (1):
      xfs: fix off-by-one in rtrefcount btree root level validation

Xiang Mei (Microsoft) (1):
      bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor

Xin Long (1):
      sctp: clear control chunk transport if it is being removed

Xu Rao (4):
      thunderbolt: stream: Unmap buffers with mapped size
      thunderbolt: Fix bandwidth group reservation indexing
      thunderbolt: icm: Preserve USB4 proxy data-valid bit
      ALSA: hda/tas2781: fix ACPI reference handling

Xuanqiang Luo (1):
      udp: fix potential use-after-free in tunnel segmentation

Yangyu Chen (2):
      net: atlantic: free stranded TX buffers on ring deinit
      net: atlantic: free RX pages of consumed but not refilled buffers

Yao Kai (1):
      futex: Fix race in futex_pivot_pending() during private hash resize

Yi Cong (1):
      net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

Yiyang Chen (3):
      bpf: Preserve pointer state for commuted arithmetic
      bpf: Propagate untrusted pointer state in commuted arithmetic
      selftests/bpf: Cover commuted pointer state propagation

Yousef Alhouseen (1):
      vhost/vdpa: reject overflowing PA map page counts on 32-bit

Yuejie Shi (1):
      ipv6: fix Route Information option length validation

Yuho Choi (1):
      ARM: npcm: Fix OF node refcount leaks in SMP setup

Yun Zhou (1):
      xfs: handle NULL b_addr in xfs_buf_free

Zhan Xusheng (1):
      fscrypt: use the mount idmap for the owner check in
fscrypt_ioctl_set_policy()

Zhang Heng (3):
      ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx
      ASoC: amd: yc: Add DMI quirk for Xiaomi RedmiBook 16 2025
      ASoC: amd: yc: Add DMI quirk for MSI Raider A18 HX A7VHG

Zhefu Zhang (1):
      Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard

Zhiling Zou (6):
      ipvs: stop estimator after disabled calc phase
      inet: frags: publish queues before arming timer
      net: openvswitch: reallocate update replies for mismatched IDs
      mm/page_table_check: skip special zero mappings
      ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
      xdp: reject clones that overrun skb_shared_info tailroom

Zihan Xi (3):
      ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
      packet: synchronize pressure clearing with ring reconfiguration
      mac802154: fix netdev use-after-free in beacon worker

Zijie Huang (2):
      net/sched: reject overly deep qdisc hierarchies
      selftests/tc-testing: add qdisc hierarchy depth tests

Zizhi Wo (1):
      fbdev: Fix out-of-bounds access when rotating console after font resize

chanyoung (2):
      tls: don't leave a full plaintext sk_msg ring unpushed
      selftests: tls: add a test for splicing onto a full plaintext record

liyouhong (1):
      mm/damon/ops-common: putback folios on invalid migrate nid

Łukasz Patron (1):
      net: qrtr: ns: Raise lookup limit to 128