Changelog in Linux kernel 6.12.117

drm/amdgpu/atomfirmware: WARN() rather than BUG()

drm/amdgpu/gfx11: WARN() rather than BUG() for invalid SDMA engine

drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub()

drm/amdgpu/pm: add workload profile pause helper

drm/amdgpu/powerplay: Align get_tonga_state_array() header with prototype

drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set

drm/amdgpu: add bounds check to prevent array overflow

drm/amdgpu: add buf length check

drm/amdgpu: Add checks to vbios fetch through ATRM

drm/amdgpu: Disable runtime PM for externally attached dGPUs

drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages

drm/amdgpu: Gate debugfs MMIO access on kernel lockdown

drm/amdgpu: Guard reads in pcie state readout

drm/amdgpu: recompute the dw estimate after allocating a new VM update job

drm/amdgpu: reject ANONONLY userptrs that span multiple VMAs

drm/amdgpu: remove gart_window_lock usage from gmc v12

drm/amdgpu: require _PR3 for BOCO

drm/amdgpu: reset CIK ASIC on Apple boards with VRAM at 0

drm/amdgpu: reset VI ASIC on Apple boards with VRAM at 0

drm/amdgpu: skip gfx switch_power_profile during GPU reset

drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU

drm/amdgpu: Support some Barco AMD based graphics adapters

drm/amdgpu: Validate ATIF buffer length before use

drm/amdkfd: add sanity check in svm_range_is_valid

drm/amdkfd: Avoid integer underflow in EOP ring size calculation.

drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc

drm/amdkfd: don't drop an SVM CWSR reference that was never taken

drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO

drm/amdkfd: fix doorbell allocation race creating duplicate allocations

drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size

drm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mapping

drm/amdkfd: stop restore retries on device unplug

drm/amdkfd: validate SRAT subtables before parsing

drm/amdkfd: wait for a GPU reset before freeing a BO

drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties

drm/etnaviv: check all modules for idle after reset

drm/etnaviv: force flush on power register ops

drm/i915/dmc: Add sanity check for DMC load address

drm/i915/dp_mst: Fix configuring TUs for a disconnected stream

drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable()

drm/msm/adreno: Add support for A704 GPU

drm/msm/hdmi_bridge: Correct poweroff/audio cleanup order in post_disable

drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure

drm/msm: RCU-free the scheduler-containing ring and VM objects

drm/nouveau/svm: drain fault handler before freeing svmm

drm/nouveau: cancel the DP IRQ work before freeing the connector

drm/nouveau: disable the fence uevent work instead of just cancelling it

drm/nouveau: don't dereference outp before checking it in nouveau_dp_irq

drm/nouveau: reject zero-size notifier object allocation

drm/panel-edp: Add BOE NE160QDM-NY1 panel

drm/panel-edp: Support MB116AS01'3 edp panel

drm/panel: simple: Add Kyocera tcg070wvlq panel

drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase

drm/radeon: avoid double free in r600 DPM cleanup

drm/radeon: fix internal display on iMac11, 1 (RV770/DCE3.1)

drm/rockchip: dw_hdmi: Use resume_early pm ops for system suspend

drm/ttm: return an error when kmapping a BO without pages

drm/virtio: reclaim pending vbufs before tearing down vqs

drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs

drm/xe: only resume exec queues that were actually suspended

dt-bindings: arm: qcom,ids: Add SoC ID for Snapdragon SDM 850

dt-bindings: clock: ma35d1: Document the missing crystal inputs

EDAC/i10nm: Fix mdev reference leak in i10nm_get_ddr_munits()

EDAC/mc: Really fix error path ordering in edac_mc_alloc()

efi/libstub: Don't replace an existing LINUX_EFI_MEMRESERVE table

erofs: use on-disk blkszbits for lz4 max pcluster bound

exec: cancel io_uring requests before de_thread()

exfat: clean up new entry on add entry failure

exfat: free new directory cluster if zeroing fails

exfat: keep FITRIM within the requested range

exfat: write moved entry before removing source

exportfs: Release the get_name() directory file synchronously

ext4: check return value of ext4_get_block() in ext4_load_tail_bh()

ext4: don't report delalloc data as a hole on indirect-mapped inodes

ext4: fix ABBA deadlock in ext4_rmdir()

ext4: fix fast commit replay failing on a read-only mount

ext4: fix out-of-bounds read in ext4_get_group_info()

ext4: guard against NULL s_group_info in ext4_get_group_info

ext4: reduce max cluster size to match documented 256MB limit

ext4: reject mount if clusters/inodes per group are not 8-aligned

ext4: set EXT4_STATE_NO_EXPAND in ext4_evict_inode

ext4: skip extra isize expansion while unmounting

ext4: use FGP_WRITEBEGIN for tail block zeroing

ext4: validate readdir offset before accessing dirent

f2fs: allow pinning empty compressed files

f2fs: avoid setting SBI_NEED_FSCK on transient resize failure

f2fs: check every cur_*_segno[] entry on readonly images

f2fs: compress: fix to handle race between truncate and writeback

f2fs: convert inline quota files when turning quota on

f2fs: disallow mmap write and data-modifying fallocate on atomic files

f2fs: fix defragment writeback range truncation on 32-bit

f2fs: fix submit accounting for IPU writeback

f2fs: flush SIT journal during filesystem resize

f2fs: force out-place update for all writes on compressed file

f2fs: read i_size once in f2fs_vm_page_mkwrite

f2fs: remove mappedtodisk flag usage in mmap write path

fanotify: report names longer than NAME_MAX

fat: fix fat_ent_write() for reverting the value

fat: reject name longer than NAME_MAX in msdos_format_name()

fault-inject: fix dentry leak

fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo

fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe

fbdev: atmel_lcdfb: Prevent FIFO work after removal

fbdev: bitblit: Fix glyph clipping when fbcon pans

fbdev: maxine: fix 64-bit build error

fbdev: omap2: dsi: do not copy isr table

fbdev: platinumfb: add error checking for ioremap calls

fbdev: sh_mobile_lcdc: check for fb_deferred_io_init() error

fbdev: smscufx: check for fb_deferred_io_init() error

fbdev: ssd1307fb: check for fb_deferred_io_init() error

fbdev: udlfb: check for fb_deferred_io_init() error

fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use

fbdev: udlfb: validate vendor descriptor items

fbdev: xen-fbfront: check for fb_deferred_io_init() error

firewire: core: fix source bus ID detection for AT context in big-endian systems

firmware: imx: scu: manage mailbox channels and global handle

floppy: don't store a stack buffer in timeout_message

floppy: return the drive state flags from the 32-bit FDGETDRVSTAT

fork: don't create io threads once PF_POSTCOREDUMP is set

fork: move the coredump and exec checks into create_io_thread()

fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs

fs/ntfs3: bound CreateAttribute asize against record_size in do_action

fs/ntfs3: bound DeleteAttribute asize against rec->used in do_action

fs/ntfs3: fix integer overflow in find_log_rec() causing OOB read

fs/ntfs3: fix lseek EINVAL on sparse/compressed files with 64-bit clusters

fs/ntfs3: Fix memory leak in indx_find_sort()

fs/ntfs3: load ATTR_BITMAP run extents from $MFT extension records

fs/ntfs3: reserve NUL byte when converting UTF-16 names

fs/proc/task_mmu: pin mm_users in do_pagemap_scan()

fs: don't fail __d_obtain_alias() for unlinked inodes

fs: don't silently unmount busy mounts

fs: make sure to call fsnotify_inoderemove() only once when inode is dead

fs: skip copy_file_range write limits when there is no data

fs_pin: publish pins with RCU list helpers

fscrypt: Fix missing barrier in fscrypt_find_mode_key()

fsverity: Be more careful with return value of ->get_verity_descriptor()

fsverity: hoist statx reporting of fs-verity flag

fuse: zero the partial EOF page when extending a file

futex: Sanitize and document task_struct::futex::state transitions

genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes

genirq: Move interrupt thread exit_work object to irqaction

gfs2: fix the escaped block copy in gfs2_before_commit()

gpio: davinci: Clear interrupt status in every bank on suspend

gpio: mvebu: keep resume masks within the irqchip cache

gpio: pca953x: Handle direction register read errors in IRQ paths

gpio: pca9570: Use I2C match data

gpio: sifive: add missing MODULE_DEVICE_TABLE()

gpiolib: don't report -ENOMEM for a requested line without a label

gpiolib: Free chip resources when allocating the label fails

gpu: host1x: Wait for timeout worker completion on channel free

gre: fix ERSPAN o_flags race/corruption in xmit and fill_info

greybus: manifest: validate string descriptor header

gve: fix out-of-bounds read in gve_get_flow_rule_entry()

hfsplus: validate extent record length before writing it back

HID: amd_sfh: Remove unsupported motion-state field from accelerometer report

HID: amd_sfh: Serialize access to the shared emp2 pointer

HID: amd_sfh: Use report type from request node

HID: core: Fix out-of-bounds left shift by 32 in s32ton()

HID: cougar: reject short special-key reports

HID: cp2112: validate response report lengths

HID: elo: reject short touchscreen reports

HID: hiddev: keep state alive through disconnect unlock

HID: i2c-hid: Add a quirk for a Cirque I2C device.

HID: i2c-hid: Add i2c-hid-quirk-bad-input-size quirk for 0911:5288 device

HID: input: read battery capacity from its actual report offset

HID: intel-ish-hid: ignore post-init ENUM_DEVICES from firmware

HID: logitech-dj: validate unnumbered keyboard reports

HID: logitech-hidpp: Add support for G502 X Plus USB mouse

HID: mcp2200: validate READ_ALL response length

HID: mcp2221: validate response report length

HID: multitouch: Fix stale MT slots when contact count drops to zero

HID: picoLCD: check for fb_deferred_io_init() error

HID: prodikeys: validate fixed-format MIDI reports

HID: pxrc: reject short input reports

HID: quirks: add ALWAYS_POLL quirk for AULA Mini 60 HE Pro Dongle

HID: quirks: Add ALWAYS_POLL quirk for Beitong BTP-KP20D dongle

HID: quirks: Always poll the Anne Pro 2 with product ID a292

HID: rmi: check report length before trimming sentinel bytes

HID: roccat: fix locking in roccat_connect() and roccat_disconnect()

HID: roccat: isku: reject short button reports

HID: roccat: koneplus: reject short button reports

HID: roccat: konepure: reject short button reports

HID: roccat: kovaplus: reject short button reports

HID: roccat: pyra: reject short button reports

HID: roccat: ryos: reject short special reports

HID: roccat: savu: reject short special reports

HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration

HID: wacom: Fix Use-After-Free in wacom_bamboo_pad

HID: wacom: Fix Use-After-Free in wacom_intuos_pad

HID: wacom: Redesign shared sibling data lifecycle

HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration

HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities

HID: wacom: Write shared touch initial status only once

HID: zydacron: validate key report length

hsi: omap_ssi: remove debugfs on port creation failure

hte: tegra194: Initialize slice locks before registering chip

hwmon: (asus_rog_ryujin) Synchronize HID command and report handling

hwmon: (coretemp) Fix handling of isolated SMT siblings

hwmon: (coretemp) Refresh the temperature on the first read

hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe

hwmon: (gigabyte_waterforce) reject short input reports

hwmon: (lm95245) Fix negative temperature conversion

hwmon: (sht3x) Return the consumed count for heater writes

hwrng: amd - report partial reads in non-blocking mode

hwrng: ba431 - fix reported byte count

hwrng: core - reject unknown RNG names

i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()

i2c: acpi: Force ELAN1300 touchpads to 100 kHz

i2c: designware: queue only one read command for block reads

i2c: imx-lpi2c: properly unwind resources on probe failure

i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len

i2c: qcom-cci: Do not check return value of cci_init()

i2c: qcom-cci: fix autosuspend cleanup

i2c: qcom-cci: Remove overcautious disable_irq() calls

i3c: master: Fix potential UAF in i3c_device_uevent()

iio: accel: adis16201: fix channel order for buffer mode

iio: accel: adxl313: reject devices without match data

iio: accel: adxl380: reject devices without match data

iio: accel: fxls8962af: clamp the device-reported FIFO sample count

iio: accel: kxcjk-1013: Disable autosuspend on remove

iio: accel: mma9551: disable autosuspend on remove

iio: accel: mma9553: disable autosuspend on remove

iio: adc: adi-axi-adc: Initialize state mutex

iio: adc: at91-sama5d2: disable autosuspend on remove

iio: adc: max11205: reject devices without match data

iio: adc: max1241: add missing MODULE_DEVICE_TABLE()

iio: adc: mcp3911: reject devices without match data

iio: adc: stm32: fix minimum sampling time values

iio: adc: ti-adc128s052: validate SPI match data

iio: dac: ad5755: validate SPI match data

iio: frequency: adf4377: reject devices without match data

iio: hid-sensor: als: scale each channel individually

iio: imu: inv_icm42600: fix odr change not caught in certain cases

iio: imu: inv_icm42600: force accel odr change when switching power mode

iio: light: apds9306: fix default sampling frequency definition

iio: potentiometer: x9250: reject devices without match data

iio: pressure: bmp280: validate SPI match data

inet: reject unhashed sockets during established lookups

init/bootconfig: pass init arguments in documented order

init: fix early boot crash with bare hostname parameter

Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox

io_uring/io-wq: no new workers once the exit has begun

io_uring/io-wq: save worker type before dropping its reference

io_uring/kbuf: advance head when a pickup empties the buffer ring

io_uring/net: don't retry a non-blocking connect() that fails with -EAGAIN

io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT

io_uring/rsrc: charge buffer arrays and nodes to memcg

io_uring/sqpoll: don't wait for the thread to exit

io_uring/timeout: count cancelled timeouts in cq_timeouts

io_uring/waitid: honor task_work cancellation

io_uring: charge tctx nodes and personalities

io_uring: free XArray nodes left by a failed store

iomap: don't lose a fiemap iteration error when emitting the last extent

iommu/amd: Fix missing CMD_COMPLETE_PPR response for invalid PPR requests

iommu/arm-smmu-qcom: Add SM8450 MDSS compatible

iommu/dma: Catch scatterlist length overflows

iommu/qcom: Check pm_runtime_resume_and_get() return in probe

iommu/qcom: Enable clocks before hardware access in qcom_iommu_ctx_probe()

iommu/qcom: Publish pgtbl_ops before releasing init_mutex

iommu/rockchip: Clear stale page faults before enabling stall

iommu/tegra241-cmdqv: Rate-limit the error ISR's log message

iommu/vt-d: Avoid out-of-range shift in qi_desc_dev_iotlb_pasid()

iommu/vt-d: Fix CACHE_TAG_NESTING_DEVTLB polluting shared variables in flush loop

iommufd: Fix event queue release use-after-free

iommufd: Reject a zero-length dirty bitmap request

ipack: ipoctal: add rwsem to guard against TOCTOU in remove path

ipc, msg: Account msg_msg allocations with GFP_KERNEL_ACCOUNT again

ipc/mqueue: release notification resources during inode eviction

ipc/shm: fix RSS accounting for hugetlb shared memory

ipc: create_ipc_ns: drop mqueue mount on sysctl setup failure

ipc: drop the mqueue mount with kern_unmount() on setup failure

ipmi: Fix leak in __ipmi_bmc_register

ipmr: fully initialize the synthetic IP header in ipmr_get_route()

ipv6: defrag: orphan skb before queuing

ipv6: do not restart DAD for a dead ifaddr

ipv6: Fix redirect exception creation for UDP/RAW sockets

ipv6: initialize temporary ifaddr before publication

ipv6: remove ifaddr from hash during ifdown list cleanup

ipv6: serialize address publication with device teardown

ipv6: udp: Create exceptions before socket matching

irqchip/gic-v3-its: Don't clamp nvecs to zero when id_bits is 32

irqchip/imx-intmux: Fix runtime PM teardown on remove

irqchip/irq-msi-lib: Free wired MSI descriptors

irqchip/mchp-eic: Fix clock reference leak in mchp_eic_probe()

irqchip/riscv-imsic: Report successful hardware retrigger

irqdomain: Plug leak in irq_domain_alloc_irqs_locked() error path

isofs: fix Rock Ridge CE extent validation on multisession media

iwlwifi: dvm: add missing cleaup for on error path

ixgbe: reserve TX timestamp after skb preparation

jbd2: don't advance j_fc_off before the buffer is recorded

kbuild: link-vmlinux.sh: improve detection of third pass requirement

kconfig: abort rather than loop for ever on EOF

kcov: ignore an out-of-range comparison count in write_comp_data()

kcsan: Avoid division by zero in kcsan_prandom_u32_max()

kgdb: Fix buffer overflow in the 'M' and 'X' packet handlers

kgdb: Fix buffer overflow in the 'm' packet handler

kgdb: Fix buffer overflow in the qRcmd packet handler

klist: avoid accesses after waking klist_remove()

kobject: fix out-of-bounds access in kobject_action_type()

ksmbd: accept share config responses from ksmbd-tools before 3.5.3

ksmbd: allow FSCTL_SET_SPARSE without input buffer

ksmbd: allow I/O on directory named streams

ksmbd: avoid restoring only in-memory EOF after allocation change

ksmbd: deny access for an empty DACL instead of granting the request

ksmbd: enable TCP keepalive for accepted connections

ksmbd: fix AsyncId zeroed before use in smb2_lock() cancel response

ksmbd: fix breaking_cnt leak on early return in oplock_break()

ksmbd: fix durable handle v2 default timeout units (60 -> 60000)

ksmbd: fix extended session security negotiation for raw NTLMSSP

ksmbd: fix invalid pointer dereference when get_inode_acl() fails

ksmbd: fix named stream write and EOF handling

ksmbd: fix off-by-one rejecting minimal COPYCHUNK query-limits request

ksmbd: fix OOB read and cross-share confusion in ksmbd_validate_name_reconnect()

ksmbd: fix out-of-bounds read when padding the final compound response

ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()

ksmbd: fix parent dentry lifetime in directory enumeration

ksmbd: fix session reference leak on compounded SESSION_SETUP

ksmbd: fix SMB2 byte-range lock end offset

ksmbd: fix use-after-free after a failed durable reconnect

ksmbd: handle allocated range queries on dense files

ksmbd: handle empty QUERY_ALLOCATED_RANGES output

ksmbd: honor byte-range locks for zero data

ksmbd: honor client signing-required in all modes

ksmbd: ignore network devices of other namespaces

ksmbd: notify parent directory leases on child create

ksmbd: preserve access denied status for copychunk

ksmbd: preserve unreadable named streams on open

ksmbd: prevent share root removal through empty paths

ksmbd: prevent stale data from being written by SMB2 WRITE requests

ksmbd: protect private extended attributes

ksmbd: reject blocking compound lock requests

ksmbd: reject SMB3.1.1 binding with mismatched cipher

ksmbd: report actual xattr value length in stream enumeration

ksmbd: reserve space for the UTF-16 terminator in stream info

ksmbd: return buffer too small for short security queries

ksmbd: return end of file for reads past a named stream's data

ksmbd: serialize directory emptiness checks with readdir

ksmbd: skip fallocate for SMB2_CREATE_ALLOCATION_SIZE on a stream handle

ksmbd: use the existing xattr name for a named stream

ksmbd: use u8 for SMB2 oplock level values

ksmbd: validate security descriptor offsets before pointer arithmetic

ksmbd: verify transform SessionId matches the decrypted header

ksmbd: wait for negotiation before receiving another PDU

KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved

KVM: arm64: Transfer the hyp stack pages out of the host stage-2

KVM: arm64: Turn vcpu->arch.pause into a counter

KVM: arm64: vgic-v3: Roll back assignments from the new region

KVM: arm64: vgic-v3: Undo assignment on iodev registration failure

KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot

KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state

KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users

KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls

KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form

KVM: SEV: Extract loading of guest-provided VMSA to a separate helper

KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable

KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN

KVM: SVM: Trigger new ASID allocation in both VMCBs on pCPU switch

KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded

KVM: Use goto to handle errors during memslot preparation

KVM: VMX: Formally define KVM's "0xdead" exit reason used for failed VM-Enter

KVM: VMX: Preserve negative return value in vmx_handle_exit() with bus lock detected

KVM: VMX: Synthesize nested EPT violation GVA_IS_VALID/GVA_TRANSLATED bits

KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has

KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0

KVM: x86/mmu: pass PFERR_GUEST_PAGE/FINAL_MASK to kvm_translate_gpa

KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot

KVM: x86/xen: Enforce 4-byte alignment of vcpu_info registration

KVM: x86/xen: Take kvm->srcu in __kvm_xen_has_interrupt()

KVM: x86: Always initialize EFER reserved bits on vendor initialization

KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages() error paths

KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload

KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails

KVM: x86: Request event processing for exception VM-Exits

KVM: x86: Take SRCU in kvm_zap_gfn_range()

KVM: x86: Tell ->inject_page_fault() whether or a fault came from hardware

KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak

landlock: Fix superblock use-after-free in release_inode()

leds: ktd2692: Pass context to regulator cleanup

lib/842: reject output overflows from index and short data

lib/842: require a complete history block for repeat templates

lib/buildid: reject file offsets that do not fit in pgoff_t

lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state

lib/decompress_bunzip2: fix off-by-one in run-length bounds check

lib: decompress_bunzip2: fix integer overflow in run-length decoding

libbpf: Fix ring buffer consumer loop on 32-bit position wrap

libbpf: Skip bpf_object__probe_loading() when BPF token is in use

libceph: bound mon_command ack decode to front len

libceph: Fix multiple unsafe decodes in ceph_oloc_decode()

libceph: fix out-of-bounds reads from repeated CRUSH bucket entries

libceph: Fix unsafe decode in ceph_redirect_decode()

libceph: only set read_from_replica on read requests

libceph: reject an initial monmap with no monitors

libceph: reject mismatched CRUSH weight-set sizes

Linux: Linux 6.12.117

listmount: don't wrap around with a U64_MAX cursor

lockd: Fix use-after-free in nlmsvc_retry_blocked

LoongArch: Expand module virtual address space to 2GB

LoongArch: Fix architectural naming typo for CSR_FWPS_SKIP

LoongArch: Fix bitmask corruption in update_bp_registers()

LoongArch: Fix perf hardware breakpoint failure via installation

LoongArch: KVM: Check kvm_request_pending() in kvm_late_check_requests()

LoongArch: KVM: Deliver interrupt after IN_GUEST_MODE is set

LoongArch: KVM: Set vcpu->cpu before IN_GUEST_MODE is set

LoongArch: KVM: Skip PMU checking on vCPU context switch

LoongArch: Only send SIGTRAP signal if necessary in do_watch()

LoongArch: Remove arch-specific __smp_mb__{before,after}_atomic()

LoongArch: Remove redundant call in update_bp_registers()

LoongArch: Use pa_to_nid()/nid_to_addrbase() rather than hard-code

loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl()

m68k: dmasound: Keep the Q40 IRQ handler registered

macvlan: fix passthru promiscuity accounting while down

mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush()

mailbox: qcom-ipcc: Guard against NULL con_priv in send_data()

md/raid5: fix NULL pointer dereference in raid5_free_percpu

md/raid5: reject zero-sector reshape chunks

md/raid5: track disks array size to fix extra_page leak on error paths

md/raid5: validate payload size before calculating payload_len

md: add cond_resched() to md_do_sync()'s skip path

md: don't hand out the array before md_alloc() has added mddev->kobj

md: validate bblog_size when loading v1.x badblocks metadata

media: adv7180: Initialize mutex before ancillary clients

media: adv7604: avoid negative array index in log_status when cp_read fails

media: amphion: drain message work before releasing core state

media: amphion: fix runtime PM imbalance on probe failure

media: amphion: prevent unbind while video instances are open

media: atmel-isi: release unregistered video device on remove

media: au0828: Fix media device leak in au0828_usb_probe()

media: au0828: fix use-after-free in bulk_timeout timer on disconnect

media: au0828: Free URBs when starting DVB streaming fails

media: cec/core: drop cec_post_state_event call

media: cec: extron: clear response tail before dispatch

media: cec: stm32: return an error when log-address wait times out

media: cec: tegra: add missing MODULE_DEVICE_TABLE()

media: cec: tegra_cec: don't break off msg on NACK

media: chips-media: wave5: Resume device before setting EOS flag

media: chips-media: wave5: Set inst->std during default format initialization

media: cx18: Disable PCI device on probe failure

media: cx18: stop VBI start-code scan before short tail

media: cx231xx-audio: drain wq_trigger before audio fini

media: cx231xx: Fix cleanup path on failure

media: cx231xx: preserve I2C transfer length

media: cx23885: Fix use-after-free in cx23885_finidev due to race condition

media: cx23885: unregister DVB bus when SP2 CI setup fails

media: cx88: Disable PCI device on MPEG initialization failure

media: cx88: fix memory leak in cx8802_register_driver() error path

media: dvb-core: fix feed leak on failed DMX_ADD_PID

media: em28xx: dev_info->pr_info since dev has been freed

media: em28xx: fix double free in em28xx_alloc_urbs

media: em28xx: reject audio endpoint with zero packet size

media: em28xx: requeue buffers if start_streaming fails

media: em28xx: use vb2_video_unregister_device

media: em28xx: use video_unregister_device for radio_dev

media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler

media: go7007: avoid undefined shifts in MPEG-4 headers

media: go7007: bound EZ-USB I2C transfers to the usb_buf size

media: go7007: only set audio_enabled if go7007_snd_init() succeeded

media: go7007: s2250: propagate control I/O failures

media: go7007: unregister the I2C adapter on USB probe failure

media: gspca: use vb2_video_unregister_device() on disconnect

media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path

media: hantro: disable runtime PM before hardware teardown

media: hantro: Harden MPEG-2 control access against NULL

media: i2c: alvium-csi2: balance runtime PM usage count on remove

media: i2c: ov8856: fix debug message to report actual CSI-2 lane count

media: i2c: ov8865: Drop the runtime PM usage count on stream failure

media: i2c: ov8865: Program the sensor on stream start

media: i2c: tc358743: add missing color-space strings

media: imagination: Fix value clamping in calculate_qp_tables

media: imon: fix use-after-free in display_close via dev_dbg

media: imx-jpeg: cancel timeout worker when streaming stops

media: imx-jpeg: finish the job on device_run() error paths

media: ipu-bridge: Fix use-after-free in IVSC error path

media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled

media: ir_toy: Validate the maximum tx carrier

media: ivtv: stop VBI start-code scan before short tail

media: m2m-deinterlace: fix default capture field

media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA

media: marvell: manage the MMP camera clock provider

media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA buffers

media: mediatek: jpeg: retry HW selection after successful wait

media: mediatek: vcodec: destroy core workqueue on remove

media: mediatek: vpu: free IRQ before destroying watchdog workqueue

media: mediatek: vpu: release reserved memory on remove

media: meson-ir-tx: Ensure clock is disabled on unbind

media: meson-ir-tx: Ensure probe error is propagated

media: meson-ir-tx: Ensure rc_free_device() is called on unbind

media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse()

media: meson: vdec: size capture planes from the aligned canvas

media: microchip-csi2dc: fix async notifier leak on probe error path

media: microchip-isc: disable histogram and flush AWB work on teardown

media: microchip-isc: do not touch WB registers when not streaming

media: microchip-isc: don't sleep in the clk .is_enabled callback

media: microchip-isc: fix awb_mutex and lock lifecycle

media: microchip-isc: fix PM runtime leak in AWB work handler

media: microchip-isc: synchronize the IRQ before disabling clocks on stop

media: microchip-isc: take a reference on the parsed endpoints

media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker()

media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker()

media: nuvoton: npcm-video: quiesce VCD IRQ before teardown

media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init()

media: pvrusb2: Fix USB parent device leak in class_dev_create()

media: qcom: camss: vfe-17x: Fix write master buffer done being dropped

media: qcom: camss: vfe: Fix VFE reset while another line is streaming

media: rc: After rc_unregister_device() timers can be re-armed

media: rc: Ensure registered is cleared in error path

media: rc: Ensure that rc_unregister_device() does not free input device

media: rc: fintek-cir: process a full RX buffer instead of overflowing it

media: rc: Fix ABBA deadlock by making locks more fine grained

media: rc: Fix build failure with CONFIG_LIRC disabled

media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister

media: rc: Fix use after free in bpf progs

media: rc: mce_kbd: Fix inconsistent locking of keylock

media: rc: Use after free in ir_raw_event_handle()

media: redrat3: Ensure all urbs are suspended

media: redrat3: Ensure we don't read beyond the end of the packet

media: redrat3: fix UAF in probe error path leaving rc device registered

media: rtl28xxu: fix SDR platform device leak

media: s5p-mfc: use timer_shutdown_sync() for the self-rearming watchdog

media: saa7146: Initialize interrupt lock before requesting IRQ

media: sti: delta: use unaligned accessors for MJPEG SOF fields

media: streamzap: Add missing rc_unregister_device()

media: stv0900: bound DiSEqC reply length to msg[] size

media: stv090x: bound DiSEqC reply length to msg[] size

media: sunxi-cir: Ensure no more interrupts can occur before free

media: tw686x: fix V4L2 device lifetime on probe failure

media: tw68: balance PCI enable on cleanup

media: usbtv: drop redundant device reference

media: usbtv: fix null-pointer dereference on disconnect

media: uvcvideo: Fix NULL deref on events for uninitialized controls

media: v4l2-common: Fix P010 format info

media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions

media: v4l2-tpg: reduce stack usage for kasan builds

media: verisilicon: rockchip: Fix leaks in init

media: vicodec: fix NULL deref on oversized frame

media: vicodec: fix out-of-bounds write on under-rounded coded dimensions

media: vicodec: make encoder CAPTURE dimensions read-only

media: vicodec: zero-initialize stateful decoder heap buffers

media: vidtv: fix frontend reference leak on unbind

media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail

media: vim2m: keep transaction buffer count stable while streaming

media: vivid: cancel svid ctrl work on release

media: vivid: round the height down to the vertical subsampling factor

media: vpif_capture: Fix i2c adapter reference leak in vpif_probe()

media: vpif_display: Fix i2c adapter reference leak in vpif_probe()

mei: vsc: Fix packet CRC computed over pointer size

memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done

memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT

memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset

mfd: axp20x: Preserve other control bits when powering off

mfd: da903x: Cancel IRQ work during teardown

mfd: ipaq-micro: Fix out-of-bounds stack read in ipaq_micro_str

mfd: tps65217: Check return value when masking interrupt sources

mfd: tps65217: Fix NULL pointer dereference on IRQ init failure

mfd: tps65217: Use devres for IRQ domain and wake teardown

mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral

mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set"

microblaze: don't clobber r3/r4 restored by rt_sigreturn

microblaze: Fix MB_MANAGER build with older binutils

microblaze: preserve the MSR carry flags across signals

microblaze: reserve the ABI argument-home area in the signal frame

MIPS: mm: do not write a huge TLB entry when the probe misses

mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ

misc: bcm-vk: validate write size before allocation

misc: genwqe: handle a first DMA address of zero

misc: hpilo: validate device queue entries before use

misc: ibmvmc: reject oversized inbound messages

misc: ibmvmc: release send buffer on write errors

mm,hugetlb: change mechanism to detect a COW on private mapping

mm,hugetlb: sort out folio locking in the faulting path

mm/damon/core: charge only the part of a region the filter left

mm/damon/core: error damos_commit_quota_goal() for zero target_value

mm/damon/sysfs-schemes: read sysfs_filter->addr_range only once

mm/damon/sysfs: put target pids for apply_inputs() failure

mm/damon/sysfs: put target pids for damon_start() failure

mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte()

mm/hugetlb: fix use-after-free of a new anon folio

mm/hugetlb: rename avoid_reserve to cow_from_owner

mm/hugetlb: stop using avoid_reserve flag in fork()

mm/hugetlb_cgroup: move per-node usage on cgroup reparenting

mm/hugetlb_cgroup: move per-node usage on cross node migration

mm/kmemleak: report RCU-tasks quiescent states during the scan

mm/kmemleak: stop the task stack scan early when interrupted

mm/madvise: add cond_resched() in THP branch of madvise_cold_or_pageout_pte_range()

mm/madvise: atomically clear the young bit on THP MADV_COLD

mm/madvise: reclaim isolated folios if PTE restart fails

mm/madvise: use folio_trylock() in the cold/pageout PMD split

mm/mempolicy: apply bind policies against the scoped allocation zone

mm/mempolicy: take a cpuset cookie for the interleave node count

mm/migrate: use huge_ptep_get() in remove_migration_pte()

mm/mlock: use a long for the page count in mlock_fixup()

mm/nommu: reject wrapping ranges in access_remote_vm()

mm/page_alloc: count guard pages as free again when their buddy merges

mm/page_alloc: do not boost watermarks in kdump capture kernels

mm/percpu: account full object size for percpu memory allocations

mm/rmap: don't discard lazyfree THPs at PMD level

mm/rmap: use huge_ptep_get() in try_to_migrate_one()

mm/shmem: report RCU-tasks quiescent states while undoing a range

mm/slab: sample slab_state once in kmem_cache_destroy()

mm/zswap: enable zswap_ever_enabled in zswap_pool_create()

mm: khugepaged: fix folio is used after folio_put/unlock()

mm: khugepaged: fix swap entry value to folio_pfn()

mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings

mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline

mm: remove unnecessary whitespace before a quoted newline

mm: vmscan: fix dirty folios throttling on cgroup v1 for MGLRU

mmc: block: reject invalid perdev_minors before division

mmc: cqhci: fix to missed endian conversions

mmc: dw_mmc: stop and complete DMA also in STATE_DATA_BUSY state

mmc: moxart: report DMA completion timeout

mmc: sdhci-of-ma35d1: add missing MODULE_DEVICE_TABLE()

module/kallsyms: fix nextval for data symbol lookup

module: Factor out elf_validity_cache_index_info

module: Factor out elf_validity_cache_index_mod

module: Factor out elf_validity_cache_index_str

module: Factor out elf_validity_cache_index_sym

module: Factor out elf_validity_cache_sechdrs

module: Factor out elf_validity_cache_secstrings

module: Factor out elf_validity_ehdr

module: Use RCU in find_kallsyms_symbol().

module: validate string table section types

mount: refuse setns() with a shared fs_struct again

mptcp: hold MP_JOIN msk ref when cloning reqsk

mptcp: reset msk state on early connect failure

mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one()

mtd: Call get_wunit() on the master partition

mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device

mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx()

mtd: maps: l440gx: Fix double put of the PM device in init_l440gx()

mtd: maps: pci: balance PCI enable on cleanup

mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb()

mtd: parsers: qcom: fix offset/size overflow on large partitions

mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init()

mtd: rawnand: sunxi: reject ECC maximization on small pages

mtd: spi-nor: sfdp: check the length of the SCCR map

mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table

mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption

namespace: check a recursive bind mount for mount namespace loops

namespace: never expire a locked mount

nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()

net/packet: check TX_RING fragments before memory accounting

net/rds: don't use unpin_user_pages_dirty_lock() from atomic context

net/rds: fix rds_message leak in the rds_send_xmit() drop path

net/rds: hold the socket while an rds_mr references it

net/rds: ib: don't enable IRQs in rds_ib_conn_free()

net/rds: unpin MR pages with unpin_user_pages_dirty_lock()

net/sched: act_ct: remove 'add_helper' dead code

net/sched: act_ife: do not consume the inner header on egress

net/sched: cls_bpf: accept dev-bound programs on shared blocks

net/sched: cls_flower: avoid stale mask references after delete

net/sched: fix packet reordering on requeue

net/sched: sch_teql: fix slaves_lock IRQ deadlock

net/sched: sch_teql: fix use-after-free on lower qdisc drop

net/smc: queue the copied chunk when smc_tx_sendmsg() faults

net: dsa: mt7530: check bus->read() error in core_rmw()

net: dsa: mt7530: check CORE_PLL_GROUP4 access in mt7531_setup()

net: dsa: mt7530: error out on failed PHY_IAC command writes

net: ethernet: mtk_wed: increase WED v2 WDMA RESV_BUFF to 0x80

net: gro: don't chain linear parts larger than gso_size into frag_list

net: gso: limit recursive IP-in-IP segmentation

net: hisilicon: hisi_femac: Stop the receiver before releasing the RX ring

net: ipv4: add zero check for snd_cwnd_clamp

net: mvneta_bm: add suspend/resume support to prevent crash after resume

net: pcs: mtk-lynxi: check regmap reads in mtk_pcs_lynxi_get_state()

net: prestera: ignore duplicate RIF destruction events

net: sfp: add quirk for HORACO copper SFP+ module

net: skbuff: don't BUG() on a bad csum_start in skb_copy_and_csum_dev()

net: skbuff: propagate shared-frag marker in skb_zerocopy()

net: stmmac: fix device node reference leaks in stmmac_mtl_setup()

net: stmmac: raise TX completion interrupt at the end of an xmit burst

net: stmmac: use dma_addr_t for DMA addresses

net: team: free skb when broadcast has no txable port

net: unix: reject negative max_dgram_qlen values

net: usb: cdc_ether: add quirk for AMI BMC stale link events

net: usb: pegasus: check rx pkt_len against the received length

net: usb: pegasus: do not advance rx_skb->data on dropped frames

net: usb: qmi_wwan: add Rolling Wireless RN947R

net: usb: rtl8150: handle link status read failures

net: wwan: iosm: validate msg_head before indexing msg_ring

netdevsim: reject cls_bpf programs bound to another device

netfilter: conntrack: always lower timeout for non-closing RST packets

netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets

netfilter: ctnetlink: fix inverted IPv6 address match in dump filter

netfilter: ebtables: bound num_counters like nentries in do_replace()

netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()

netfilter: nf_reject: initialize IPCB at inet ingress

netfilter: nf_tables: call skb_valid_dst() before skb_dst()

netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks

netfs: Fix missing alloc tagging of direct mempool allocations

nfc: mrvl: spi: Unregister dev on allocation fail

nfc: nxp-nci: Add remove on IRQ error

NFS: Verify symlink inode before caching target

NFSD: cap the number of listeners accepted in listener_set

nfsd: clear XDR padding in GETXATTR replies

NFSD: copy SETXATTR data from all XDR buffer segments

NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients

NFSD: Don't complete a cld upcall the daemon has not read

nfsd: don't modify a session slot when replaying its cached reply

NFSD: Fail a pool_threads read whose reply does not fit

nfsd: Fix id-to-name cache entry leak in idtoname_parse()

NFSD: Fix out-of-bounds read in the rpc_status dump

nfsd: hold cl_lock in client_has_openowners()

nfsd: honour client-provided attributes for NFS4_CREATE_EXCLUSIVE4_1

NFSD: map fh_verify() status codes for NFS_ACLv3 replies

nfsd: preflight SEQUENCE replies before accepting a slot

nfsd: propagate SETXATTR value decode errors

NFSD: Reject an oversized principal hash from nfsdcld

NFSD: Resolve the recall-any mask names in the trace format

NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE on a non-regular file

NFSD: Set nn->cld_net before registering the cld pipe

nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update

NFSD: validate transport name in listener_set before serv creation

nfsd: zero NFSv4 COMPOUND tag padding

NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from LAYOUTGET

NFSv4/filelayout: Anchor page coalescing on pattern_offset

NFSv4/flexfiles: fail I/O to the data server once a lock is lost

NFSv4: pin the superblock for active state owners

nilfs2: clear dirty flag on bdev buffers on log write failure

nilfs2: fix checkpoint root lifetime on sysfs errors

nilfs2: fix deadlock between nilfs_evict_inode() and find_inode()

nilfs2: validate directory position after llseek in readdir

ntfs3: bound index head insertions by buffer capacity

ntfs3: fix info-leak in ntfs_rename()

ntfs3: fix mapping pairs bounds check for alignment

ntfs3: free replaced mount options after a grace period

ntfs3: initialize err in attr_wof_frame_info

nvme-auth: fail when the controller does not authenticate itself

nvme-auth: use crypto_memneq for DH-HMAC-CHAP response comparison

nvme-fc: do not warn on controller removal race

nvme-rdma: don't complete a request after a bogus remote invalidation

nvme-tcp: look up host_iface in the current netns

nvme-tcp: start error recovery when read_sock fails

nvme: bound ns descriptor header and body to identify buffer

nvme: don't reference NS after unlocking in nvme_ns_head_ctrl_ioctl()

nvme: handle positive error codes in nuse_show()

nvme: make the DH-HMAC-CHAP secret attributes readable by root only

nvme: ratelimit the completion-path messages driven by device data

nvme: zns: cap zone report nr_zones by DMA buffer size

nvmem: brcm_nvram: fix out-of-bounds access on malformed flash data

nvmem: brcm_nvram: reject empty NVRAM partition

nvmem: core: Fix OOB read for bit offsets of more than one byte

nvmet-auth: fix error handling on CHALLENGE failure

nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF

nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection()

nvmet-fc: only send read data for successful commands

nvmet-fc: Tear down the association when the admin queue allocation fails

nvmet-rdma: reject short connection requests

nvmet: Finish the blk plug when integrity allocation fails

nvmet: free the bvec on file namespace range errors

nvmet: Free the old negotiation state when restarting authentication

nvmet: passthru: fix OOB reads when parsing ns id descriptor list

nvmet: replace use of system_wq with system_percpu_wq

nvmet: take subsys->lock while force-reconnecting in nvmet_subsys_attr_qid_max_store()

nvmet: zns: don't leak stale memory in zone management receive

objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0

ocfs2/cluster: initialize heartbeat regions before publishing them

ocfs2/cluster: remove zero-address nodes from IP tree on teardown

ocfs2/dlm: drain join handlers before releasing module text

ocfs2/dlm: hold a lock reference across grant AST enqueue

ocfs2/dlm: hold the lookup reference across convert AST enqueue

ocfs2/heartbeat: unlink live slots when their node is missing

ocfs2: cancel quota sync work before freeing quota info

ocfs2: deal with legacy signed dir index name hash values

ocfs2: deal with legacy signed xattr name hash values

ocfs2: drain quorum work before removing the cluster

ocfs2: exit recovery thread on mount error path

ocfs2: fix chunk number of the first chunk in a local quota file

ocfs2: free replay slots in ocfs2_recovery_exit()

ocfs2: pin owning modules for open debugfs files

ocfs2: pin refcount trees before dropping the lookup lock

ocfs2: publish the filecheck owner before adding sysfs attributes

ocfs2: read the xattr entry hash before defragmenting the bucket

ocfs2: reserve metadata for a new xattr block and its value tree

ocfs2: reserve value tree metadata when moving an xattr into the inode

ocfs2: skip uninitialized lockres in ocfs2_mark_lockres_freeing()

ocfs2: snapshot dentry names in file and setattr traces

ocfs2: snapshot the dentry name while tracing file release

ocfs2: use the stored hash when checking xattr bucket collision

opp: fix use after free in _update_opp_table_clk()

opp: Use clk_get_optional() to avoid leaving opp_table->clk as an error pointer

ovl: always encode the origin fh when index is enabled

ovl: check that the parents of volatile/dirty are dirs

ovl: do not copy up a dentry that was removed

ovl: do not copy up an xattr value that was never read

ovl: fix a torn path in ovl_get_redirect()

ovl: fortify ovl_copy_xattr() against underlying layer modifications

ovl: hold a reference on the parent in readdir

ovl: read the nlink xattr of every indexed non-dir

ovl: set OVL_WHITEOUTS before publishing the upper dir

ovl: set the revalidate flags after d_instantiate()

ovl: skip copy up of empty security.capability

ovl: take a snapshot of the name for copy up

ovl: use the pinned upper dir in ovl_fix_origin()

parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer

PCI/AER: Emit TLP Log only for unmasked errors

PCI/AER: Fix mapping of errors to agent & layer

PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow

PCI/ATS: Ensure pci_ats_supported() is PF-aware for VFs

PCI/portdrv: Allow probing even without child services

PCI/sysfs: Pass the device name length in UTF-16 code units

PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream ports

PCI: Avoid saving config space state if inaccessible

PCI: Disable MSI for ULi M1575 EHCI controller

PCI: pciehp: Make 'pciehp_poll_mode' parameter read-only

PCI: qcom-ep: Deinitialize endpoint on remove

PCI: rockchip-host: Do not attempt 5.0 GT/s retraining

PCI: Set supported_speeds in set_pcie_port_type()

PCI: switchtec: Add Microchip PCI1008 device ID

PCI: switchtec: Add Microchip PCI1008 to NTB DMA alias quirk

PCI: vmd: Handle BUS_RESTRICT_CFG value 3 for Arrow Lake-HX

PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain()

peci: aspeed: Initialize state before requesting IRQ

peci: npcm: Initialize state before requesting IRQ

perf loongarch: Fix discarded const qualifier in _get_field()

perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failure

perf/x86/intel: Fallback to sw branch type decoding if no hw decoding

perf/x86: Free hybrid state on PMU init failure

perf/x86: Unregister PMI handler on PMU init failure

perf: marvell: Cancel CN10K DDR PMU hrtimer on device remove

perf: xgene: initialize lock before requesting IRQ

phy: core: Fix race-condition between _of_phy_get() and try_module_get()

pinctrl: npcm8xx: clear pending GPIO events during init

pinctrl: npcm8xx: enable RMII outputs from RMII groups

pinctrl: npcm8xx: fix debounce register selection

pinctrl: npcm8xx: move GPIO IRQ setup into request_resources

pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank()

pinctrl: sx150x: add missing MODULE_DEVICE_TABLE()

platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2()

platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc()

platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop()

platform/x86/amd/pmf: Validate the APTS state index

platform/x86/intel-uncore-freq: Continue restoring limits on resume

platform/x86/intel/pmt: Block mmap when callback is present

platform/x86: asus-nb-wmi: map ProArt key (0x8b) to KEY_PROG3

platform/x86: asus-wmi: fix screenpad power state detection

platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming

platform/x86: asus-wmi: fix unclear usage of bd->props.power

platform/x86: dell-smbios-wmi: Fix chardev resource management

platform/x86: hp-bioscfg: allow clearing current_password

platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token

platform/x86: hp-bioscfg: fix non-ASCII truncation in hp_get_string_from_buffer()

platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer()

platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str()

platform/x86: hp-bioscfg: NUL-terminate the SPM auth token

platform/x86: hp-bioscfg: return -E2BIG from validate_password_input()

platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()

platform/x86: int1092: Fix info leak in parse_package()

platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response

platform/x86: msi-ec: Add MSI Katana GF76 11UEK EC firmware

platform/x86: simatic-ipc: fix platform device leak on registration failure

platform/x86: thinkpad_acpi: Fix fan speed reporting on Edge E330

platform: cznic: turris-omnia-mcu: Add missing MODULE_DEVICE_TABLE()

PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier()

pmdomain: qcom: rpmhpd: Skip retention by default

pnfs/blocklayout: Complete a device upcall only on its own reply

pnfs/blocklayout: Complete a device upcall when the pipe is closed

pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume ndc_immediate

pNFS: honor clora_changed when recalling a layout

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() signal path

power: reset: piix4-poweroff: add missing MODULE_DEVICE_TABLE()

power: supply: ab8500_fg: Accept status from supplied power

power: supply: ab8500_fg: Report sub-percent charge changes

power: supply: bq27xxx: synchronize work cancellation on suspend

power: supply: cros_pchg: unregister EC notifier

power: supply: generic-adc-battery: fix status with no supplier

power: supply: qcom_smbx: fix float voltage selector

power: supply: qcom_smbx: include base when petting watchdog

power: supply: qcom_smbx: notify battery overvoltage recovery

power: supply: qcom_smbx: test battery health status bits

power: supply: sbs-battery: disable polling before supply teardown

powercap: intel_rapl: Fix kernel panic during PMU unbind

ppp: fix stale pointer access after pskb_may_pull in ppp_ccp_peek

pseries/plpks: clear SED key data after use

pseries/plpks: clear sensitive PLPKS buffers

pseries/plpks: clear signed update authentication buffer

pseries/plpks: fix error handling in plpks_read_var()

pseries/plpks: validate input to plpks_signed_update_var()

pwm: tiehrpwm: Clear period on disable to allow reconfiguration

rapidio: mport_cdev: fix use-after-free in mport_mm_close()

RDMA/rxe: Check PDs for memory window binds

RDS/IB: validate receive fragment completions

regmap: maple: Workaround for another false-positive compiler warning

regmap: Remove debugfs before cache teardown

regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling()

regulator: core: Fix coupled regulators reference leak on removal

regulator: core: Fix rdev reference leak in regulator_resolve_supply()

regulator: fan53555: Add support for FAN53555BUC23X type

regulator: of: fill in supply names in of_regulator_bulk_get_all()

regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable()

regulator: rt6245: Restore state on enable failure

remoteproc: core: cancel crash_handler work in rproc_add() error path

remoteproc: core: Full attach detach during recovery

remoteproc: elf_loader: Bound the section header table

remoteproc: qcom: Check subdev start status in rproc_stop()

resource: fix lost wakeup when waiting for a muxed region

resource: report a devm_request_resource() conflict under the lock

Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU"

Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU"

Revert "Input: matrix_keypad - force switch rows to input mode"

Revert "KVM: s390: Fix FOLL_*/FAULT_FLAG_* confusion"

Revert "KVM: s390: move gmap_shadow_pgt_lookup() into kvm"

Revert "KVM: s390: move pv gmap functions into kvm"

Revert "KVM: s390: pv: fix race when making a page secure"

Revert "KVM: s390: use __kvm_faultin_pfn()"

Revert "namei: don't reveal overmounted entries in refwalk"

Revert "s390/uv: Don't return 0 from make_hva_secure() if the operation was not successful"

ring-buffer: Take cpus_read_lock() when changing the subbuf order

RISC-V: KVM: Fix double-free of sdata in kvm_pmu_clear_snapshot_area()

RISC-V: KVM: Fix IPI delivery for out-of-order vcpu_id

RISC-V: KVM: Fix sdata leak and stale snapshot_addr in snapshot_set_shmem

RISC-V: KVM: Propagate interrupted G-stage faults

RISC-V: perf: fix resource cleanup on driver probe failure

riscv, bpf: Add support for BPF_MOVSX in RV32 JIT

riscv, bpf: Add support for BPF_SDIV and BPF_SMOD in RV32 JIT

riscv: kprobes: Prevent probes in breakpoint handlers

riscv: mm: exclude invalid THP PMDs from page table check

romfs: detect hard link cycles

rpmsg: char: Check for ongoing chrdev destroy

rtc: ab-eoz9: add missing MODULE_DEVICE_TABLE()

rtc: brcmstb-waketimer: add missing MODULE_DEVICE_TABLE()

rtc: cmos: Disable ACPI RTC event before handling it

rtc: ds1307: fix RX8130 wakeup alarm WADA bit for day-of-month mode

rust: allow `clippy::as_underscore` in the generated bindings

rust: cfi: disable function merging if CFI is enabled

rxrpc: Fix double IRQ enablement

rxrpc: Fix return in rxrpc_recvmsg_data() for service calls

s390/cpum_cf: Check session mask before cpu offline

s390/dasd: Snapshot intrc before freeing the request block

s390/probes: Fix wrong opcode for cgrb fixup

s390/signal: Fix incorrect return address in signal frame

s390/zcrypt: Fix out-of-bounds ptr advance in cca_query_crypto_facility()

sched/fair: Reset NUMA fault locality after scan period update

sched_ext/scx_flatcg: expire cached hweights on weight changes

sched_ext: Fix exit_task leak on fork failure during enable

scsi: dc395x: sync the waiting_timer before freeing the host

scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC Symmetrix

scsi: ibmvfc: check for NULL evt in implicit LOGO and target delete path

scsi: ibmvfc: free ibmvfc_target allocations with mempool_free

scsi: libiscsi_tcp: Prevent R2T range check overflow

scsi: qla2xxx: Handle INTx not connected while passing through

scsi: smartpqi: Add new PCI device-ids

scsi: snic: Fix SCSI host leak on workqueue allocation failure

scsi: ufs: bsg: Clear the reply buffer before use

scsi: ufs: bsg: Complete the job on error

scsi: ufs: core: Clear stale UIC result byte before peer DME retries

scsi: ufs: core: Remove an always-false WARN_ONCE()

scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort()

sctp: auth: discard auth_chunk when skb_clone fails

sctp: hold transport reference across connect wait

seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted

selftests/core: fix unshare_test with large fs.nr_open

selftests/ftrace: Force C locale in ftracetest

selftests/net: fin_ack_lat: fix latency threshold typo

selftests: net: reuseport_bpf_numa: consider cpuless numa node

serial: 8250: force synchronous probe for the ISA and PNP drivers

serial: 8250_exar: store the GPIO platform device in struct exar8250

serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit()

serial: 8250_omap: fix wake irq cleared during suspend

serial: core: shut down initialized port on removal

serial: pmac_zilog: push received data to the port that received it

serial: qcom_geni: Disable closing_wait for console to prevent shutdown timeout

sfc: add X4D PF support

sh: intc: Sort the prio and sense lists after filling them

sh: maple: Use the matching IRQ cookie when invoking free_irq()

signalfd: don't dequeue the forced fatal signals

slimbus: messaging: fix leaked PM vote on tid allocation failure

smb/server: cancel async requests when closing connection

smb: client: clear post-EOF pagecache when extending a file via truncate

smb: client: delete compound mids on send failure before unlock

smb: client: discard post-EOF pagecache when extending a file via clone range

smb: client: do not pass a NULL buf to is_oplock_break()

smb: client: don't resurrect an exiting tcon from cached dir workers

smb: client: drain and invalidate before server-side copy/clone

smb: client: fix buffer overflow in SMB2_tcon()

smb: client: fix early procfs exposure race

smb: client: fix fattr leaking on wsl_to_fattr() failure

smb: client: fix fiemap wild read on empty truncated response

smb: client: fix file type corruption in posix_reparse_to_fattr()

smb: client: fix OOB last_entry pointer from unbounded LastNameOffset

smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()

smb: client: fix uid/gid override in getattr with posix extensions

smb: client: fix use-after-free in cifs_ses_add_channel()

smb: client: fix use-after-free infoleak via the readdir resume name

smb: client: fix WSL reparse point uid/gid override

smb: client: flush and commit data before querying allocated ranges

smb: client: flush dirty data before zeroing a range

smb: client: only require read lease for size-extending zero range

smb: client: reject SetEA requests that do not fit the request buffer

smb: client: require stable pages for signed connections

smb: client: stop processing a read response after a receive error

smb: server: Free session data in user_session.c with kfree_sensitive()

smb: server: Make sure that passkey is not leaked on the heap in user_config.c

smb: server: size directory name conversion buffer correctly

smb: smbdirect: fix buffer length underflow in RDMA transfers

soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()

soc: fsl: dpio: Fix cleanup on IRQ registration failure

soc: fsl: dpio: Free the IRQ before releasing the I/O object

soc: ixp4xx: qmgr: add missing MODULE_DEVICE_TABLE()

soc: qcom: socinfo: Add SoC ID for SDM850

soundwire: dmi-quirks: add a global ghost list

soundwire: dmi-quirks: Disable ghost Realtek on Asus Expertbook

soundwire: dmi-quirks: Disable ghost Realtek on Asus ROG Zephyrus Duo

soundwire: dmi-quirks: Disable ghost Realtek on Asus Zenbook Duo

soundwire: intel_auxdevice: Add cs42l44 to wake_capable_list

speakup: Fix NULL pointer dereference on VT switch + selection

spi: amd: fix len==0 underflow and FIFO overflow

spi: amd: validate FIFO usage before executing message

spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op

spi: bcm-qspi: return error from failed controller suspend

spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup()

spi: bcm63xx-hsspi: return error from failed controller suspend

spi: bcm63xx: return error from failed controller suspend

spi: bcmbca-hsspi: return error from failed controller suspend

spi: cadence-qspi: Fix status polling with octal DTR chips

spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path

spi: ch341: handle transfers without a TX or RX buffer

spi: jcore: fix divide-by-zero when speed_hz is zero

spi: ljca: Don't require data in write replies

spi: ljca: validate the response length before copying the data

spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer

spi: nxp-fspi: disable runtime PM on probe failures

spi: zynq-qspi: fix address buffer corruption and support 4-byte address

splice: avoid stale f_pos writeback on error

staging: greybus: uart: fix racy TIOCMIWAIT implementation

staging: media: av7110: fix corrupted BER reporting in sp8870

staging: media: av7110: fix sp8870 initialization failure state

staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error

staging: rtl8723bs: fix missing unregister_netdev on sdio_alloc_irq failure

staging: rtl8723bs: fix protected RX frame validation in decrypt path

staging: rtl8723bs: fix RX buffer OOB write from device-reported length

staging: rtl8723bs: fix spacing around operators in rtw_recv.c

statmount: don't copy the reserved empty string past the buffer

SUNRPC: Copy the deferred RPC Call from the head buffer

SUNRPC: Do not credit control-record octets to the RPC stream

SUNRPC: fix netns use-after-free in write_gssp()

SUNRPC: fix oversized GSS proxy token copy

SUNRPC: keep the first error in svc_register()

sunrpc: pin gss module across auth_domain RCU free

SUNRPC: Reject a socket that already has an svc_sock attached

SUNRPC: Reject a TLS alert record that is not two octets

SUNRPC: Resume receiving after a TLS control record

SUNRPC: trace an accepted transport before publishing it

sunrpc: treat empty auth.unix.gid replies as negative entries

SUNRPC: Treat every TLS error alert as fatal

svcrdma: Grant credits from the clamped sc_max_requests

tap: fix incorrect variable used for USO check in set_offload()

tcp: check congestion control restriction first

tcp: Fix potential UAF in reqsk_timer_handler().

tcp: fix reordering addition overflow in MTU probing

tcp: limit tcp_tso_rtt_log to a valid shift count

thermal: intel: int340x: clean up RFIM groups on DVFS failure

thermal: intel: int340x: Fix temperature selection around 0 C

thermal: intel: powerclamp: Reject invalid window_size values

thunderbolt: Do not RPM complete unrelated subtrees on unplug

time/namespace: Fix overflow when converting absolute deadlines

timekeeping: Update offsets on sequence counter retry in ktime_get_update_offsets_now()

timers/itimer: Keep a nonzero value at CPU timer expiry

tipc: fix broadcast sender hang on last acker departure

tools/lib/api: Fix potential double-free from fdarray__grow()

tools/lib/thermal: Fix misplaced extern "C" closing brace

tpm: fix zero-length read discarding the pending response

tpm: tpm_nsc: fix NULL pointer dereference on init failure

tpm: tpm_nsc: stop using the cleanup callback as dev.release

tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume is null

tracing: Bound histogram expression strings with seq_buf

tracing: Fix fully-qualified variable reference printing in histograms

tracing: Fix NULL dereference when copying keys for a field variable

tracing: Return ERR_PTR() from expr_str()

tracing: Use __free() for expr_str() buffer

tty: serial: pch_uart: add check for pci_get_slot()

tun: Require CAP_NET_ADMIN to attach to an ownerless device

ucount: take the rlimit reference before checking the limit

udf: avoid recursive s_alloc_mutex deadlock when freeing AED blocks

udf: bound lengthAllocDescs from unallocated space entry

udf: Fix bh leak for unallocated space entries

udf: fix return value for non-recorded-allocated extents in udf_map_block()

udf: Make sure there's enough space for LVID implementation use field

udf: validate extent partition references in udf_current_aext()

ufs: fix ufs_read_cylinder() failure handling

ufs: use u64 for directory size in ufs_last_byte

uio: sercos3: add missing MODULE_DEVICE_TABLE()

USB: cdc-acm: add VeriFone VX820 device ID

USB: cdc-acm: fix urb leak on disconnect

usb: fotg210: validate endpoint index in ep0 handlers

usb: fsl_qe_udc: check qe_alloc_request() failure in ch9getstatus()

usb: gadget: fix refcount underflow in gadgetfs_bind() error path

USB: gadget: inode: fix mm lifetime handling

usb: gadget: u_audio: clean up capture endpoint on feedback failure

USB: gadgetfs: do not WARN about excessively large memory allocations

usb: misc: cypress_cy7c63: check result of IO

USB: misc: uss720: Fix leak in get_1284_register

usb: mtu3: Fix double dereference in TP_printk

usb: musb: host: clear stale RX interrupt on three-strikes error

USB: serial: option: add Rolling Wireless RN947R

USB: serial: option: add support for ASR 1286:4e3c modem

USB: serial: sierra: fix urb leak on write completion

USB: serial: usb_wwan: fix urb leak on disconnect

usb: typec: ucsi_ccg: Add retry mechanism in ccg_read

usb_string_copy: Use kzalloc() to avoid leaking old data

vdpa/mlx5: roll back MR update after VQ setup failure

vdpa_sim: hold iommu_lock across dma_unmap passthrough transition

veth: fix stale peer max_mtu on XDP program replacement

vfio/mlx5: Fix boundary check in set_report_output()

virtio_balloon: warn on failed buffer add in tell_host()

virtio_console: take a kref in find_port_by_vq() to fix port UAF

virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree

virtio_net: atomically disable rx mode work

virtio_ring: fix infinite loop in virtnet_poll_cleantx when device is broken

vlan: restore HW VLAN tag insertion with reorder_hdr off

vsock/vmci: validate packet source for connected sockets

w1: ds2482: add OF device match table

watchdog: rzv2h: Add support for configurable count clock source

watchdog: rzv2h: Avoid division by zero

watchdog: rzv2h: Obtain clock-divider and timeout values from OF match data

wifi: ath10k: trigger hardware recovery upon rx failures

wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup()

wifi: ath11k: fix resource leak on error in ext IRQ setup

wifi: ath11k: validate regulatory capability phy_id

wifi: ath12k: avoid setting 320MHz support on non 6GHz band

wifi: ath12k: fix scan command endianness on big endian

wifi: ath9k: delete channel-context timers on deinit

wifi: b43: fix use-after-free in b43_bcma_remove()

wifi: brcmfmac: map msgbuf RX packet IDs bidirectional

wifi: brcmfmac: Set DMA direction for msgbuf packet IDs

wifi: brcmfmac: validate msgbuf flowring IDs before use

wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz

wifi: cfg80211: include cf1 offset when sending chandef

wifi: iwlwifi: mvm: ignore sync frames when sync is disabled

wifi: iwlwifi: mvm: reset the smart fifo state upon FW stop

wifi: mac80211: ibss: read deauth reason_code after frame length check

wifi: mac80211_hwsim: clear PMSR request state on abort

wifi: mt76: fix memory leak in USB TX path

wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits()

wifi: mt76: mt7603: add 0x7592 EEPROM chip ID

wifi: mt76: mt7603: file buffered frames under the TID reported to mac80211

wifi: mt76: mt7603: fix U-APSD service period termination

wifi: mt76: mt7603: free beacon SKB on error

wifi: mt76: mt7615: cancel reset work during unregister

wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs

wifi: mt76: mt7615: fix NULL deref in mt7615_mac_set_rates

wifi: mt76: mt7615: restore DBDC state after ext PHY failure

wifi: mt76: mt76x02: report rx FCS errors to mac80211

wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff

wifi: mt76: mt7915: configure noise floor reporting on reset

wifi: mt76: mt7921: fix memory leak when skb_linearize fails in mcu rx event

wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory

wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement

wifi: mt76: set the EOSP bit in the QoS header of the last released frame

wifi: rsi: Fix types to appease CFI

wifi: rtlwifi: fix disabling of ASPM for RTL8723BE with AER flooding

wifi: rtlwifi: rtl8723be: Remove unnecessary irq save/restore in hw_init()

wifi: rtw88: fix out-of-bounds CAM write when key table is full

wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields

wifi: rtw89: cap firmware section_num before parsing

wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM

wifi: rtw89: wow: add QoS control field to WoWLAN ARP response for MLO

wifi: rtw89: wow: only WiFi 6 chips initialize RF registers in WoWLAN mode

wifi: wilc1000: validate monitor transmit frame headers

writeback: clear old wb dirty state after inode switches

writeback: reset dirtied_when when switching wbs

wwan: wwan_hwsim: Pin module for debugfs file operations

x86/bugs: Mitigate TSA on AMD Zen5

x86/ioperm: Prevent NULL dereference on theoretical missing IO bitmap

x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()

x86/mm/pat: Use pr_warn() for early W^X warnings

xen-blkfront: Fix IO race during unplug

xen-blkfront: unbind irq before tearing down ring and shadow requests

xen-netback: Fix XenBus connection failure cleanup

xen-netback: Zero out sring pointers on unmap

xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf()

xen/gntdev: prevent private mappings from becoming writable

xen/pcifront: check that an AER callback exists before calling it

xen/privcmd: Only claim ioreqs matching an ioeventfd

xfs: abort directory tree repair whenever dl->aborted is set

xfs: abort dirtree repair if the live update hook dies

xfs: actually report corrupt xattrs as XFAIL during cross-referencing

xfs: adjust checks for cross-AG reaping issues

xfs: allow softlimit with no hardlimit in quota scrub

xfs: always forget cached ACLs if the attr fork swap succeeds

xfs: always report inode repair setup failures

xfs: always report scrub errors in tracepoints

xfs: always reset incore attr fork buffer when resetting fork

xfs: always zero the whole shortform header when zeroing attr fork

xfs: assign an owner to scrub_stats_fops

xfs: bail out of directory tree repairs on error

xfs: bound da-node entry count against the correct geometry

xfs: bound inode fork length against the fork size during log recovery

xfs: check for fragments when full-extent sharing matches

xfs: check for termination during rmap btree walk

xfs: check fork type against dabtree block magic number

xfs: clarify various parts of the bitmap API

xfs: clear set[ug]id mode bits when zapping attr fork

xfs: clear the symlink zapped flag if inline symlink is ok

xfs: compute the correct fdblocks/frextents for repair when they're negative

xfs: don't clear COWEXTSIZE on directories on reflink filesystems

xfs: don't cross reference rmapbt with bitmaps if they're incomplete

xfs: don't fix the directory tree if live update fails

xfs: don't overrun incore inode when cleaning attr forks

xfs: don't pass iget failures up when marking ondisk inodes

xfs: don't proceed with xattr repair if the live update fails

xfs: don't repair fs summary counters with garbage

xfs: don't rescan ifree and icount when frozen

xfs: don't subtract excess usage twice when computing agf_btreeblks

xfs: fix buffer overflow in corrupt inline attr structure

xfs: fix buffer overruns in xfs_ioc_attr_list

xfs: fix correction of unwritten extents in quota file data fork

xfs: fix data fork block count check in xrep_inode_blockcounts

xfs: fix inode btree repair when a cluster is larger than a chunk

xfs: fix lost errno returned from xfarray_foliosort

xfs: fix missing xfs_qm_adjust_dqlimits call in quotacheck repair

xfs: fix ondisk symlink target validation in xrep_dinode_check_dfork

xfs: fix revalidation of xchk_dquot_iter cached mappings

xfs: fix skipped inode mask handling in iscan

xfs: fix unnecessary dapos truncation in xchk_dir_walk

xfs: fix xchk_stats_estimate_bufsize to allow for the trailing null

xfs: fix xfs_rename_space_res for non-pptr filesystems

xfs: jump out of xchk_bmap_check_rmap if fatal signals

xfs: mark overfull dabtree node blocks as corrupt

xfs: never reset the default quota timer

xfs: online quotacheck must dirty dquot if enforcement adjustments needed

xfs: only written file data blocks can be shared

xfs: opportunistically skip btree block checks

xfs: propagate errors while checking null siblings

xfs: range-check bc_levels array access in scrub tracepoints

xfs: reject absurdly large xattr value lengths in xchk_xattr_actor

xfs: reject out-of-range attribute value lengths in xfs_attr_copy_value

xfs: reject remote xattr entries with an out-of-range value length

xprtrdma: prevent disconnect feedback during endpoint teardown

xprtrdma: trim head iovec when the payload arrives via a Write chunk

xsk: account ring allocations to memcg

xsk: restore UMEM flags after failed pool assignment