UPDATE: 5.15.210

[fepitre-bot]

Update to 5.15.210

Details

Changes since previous version:
gregkh/linux@e7cdcb266ba0 Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
gregkh/linux@c205da704c84 net/sched: cls_fw: fix NULL dereference of "old" filters before change()
gregkh/linux@b37da3ac099e net: mctp: ensure our nlmsg responses are initialised
gregkh/linux@1e70274d3b81 net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
gregkh/linux@0042675c70a2 drm: Remove plane hsub/vsub alignment requirement for core helpers
gregkh/linux@70ae35be58d4 dmaengine: idxd: Fix not releasing workqueue on .release()
gregkh/linux@d31a12cee10b net: cpsw_new: Fix potential unregister of netdev that has not been registered yet
gregkh/linux@fb29f6bbe433 nfc: llcp: Fix use-after-free in llcp_sock_release()
gregkh/linux@bd08bb7443c5 nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
gregkh/linux@1021d2877b68 xfrm: Check for underflow in xfrm_state_mtu
gregkh/linux@4ba8858f5799 nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
gregkh/linux@d3019c61799a netfilter: synproxy: refresh tcphdr after skb_ensure_writable
gregkh/linux@516a758b5824 netfilter: xt_cpu: prefer raw_smp_processor_id
gregkh/linux@21af4c030567 netfilter: ebtables: fix OOB read in compat_mtw_from_user
gregkh/linux@0e8211fcf942 tun: free page on short-frame rejection in tun_xdp_one()
gregkh/linux@d5bc7c9130e6 net: netlink: fix sending unassigned nsid after assigned one
gregkh/linux@03f374ac125d net: netlink: don't set nsid on local notifications
gregkh/linux@2006605006e5 net/smc: Do not re-initialize smc hashtables
gregkh/linux@45bb8de8c95d net/iucv: fix locking in .getsockopt
gregkh/linux@a0ffc6081a8b ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
gregkh/linux@a053ac3eb2f4 ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
gregkh/linux@7254aef4d1a7 tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6
gregkh/linux@9257f56ac47e vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
gregkh/linux@c7b7ec3e69e6 tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
gregkh/linux@6fb653b62f16 ASoC: codecs: simple-mux: Fix enum control bounds check
gregkh/linux@9903a04becf0 Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
gregkh/linux@69b78b5f3033 bonding: refuse to enslave CAN devices
gregkh/linux@0e1826898312 ethtool: eeprom: add more safeties to EEPROM Netlink fallback
gregkh/linux@fd238c51b0fa ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
gregkh/linux@ae0152d77d10 Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
gregkh/linux@ecfed1e0d8ef Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
gregkh/linux@7c3f72eba2ab gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
gregkh/linux@bcfeac79af74 sctp: fix race between sctp_wait_for_connect and peeloff
gregkh/linux@70c9f6ab0d8f batman-adv: v: stop OGMv2 on disabled interface
gregkh/linux@03d222b1214f batman-adv: tvlv: abort OGM send on tvlv append failure
gregkh/linux@53cb3511f6ed batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
gregkh/linux@1595628a2f87 batman-adv: tvlv: reject oversized TVLV packets
gregkh/linux@041329a4d99c batman-adv: iv: recover OGM scheduling after forward packet error
gregkh/linux@32c8d080a12e selftests: forwarding: lib: Add helpers for checksum handling
gregkh/linux@00bf4bb9947b batman-adv: tp_meter: directly shut down timer on cleanup
gregkh/linux@724a8eb41556 batman-adv: tt: fix TOCTOU race for reported vlans
gregkh/linux@9a02c8fc963d batman-adv: tt: avoid empty VLAN responses
gregkh/linux@5328b9596077 batman-adv: bla: avoid double decrement of bla.num_requests
gregkh/linux@c75600e69e66 wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work
gregkh/linux@65e31290385a drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
gregkh/linux@032f631f87ad drm/i915/psr: Read Intel DPCD workaround register
gregkh/linux@5817d127afa7 drm/dp: Add eDP 1.5 bit definition
gregkh/linux@6de0e360032e drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
gregkh/linux@3bdad903d3dd Revert "RDMA/rxe: Fix double free in rxe_srq_from_init"
gregkh/linux@d493e0bfc748 RDMA/rxe: Fix double free in rxe_srq_from_init
gregkh/linux@30781c9520b7 phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table
gregkh/linux@dbdcbacd585e phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
gregkh/linux@aa4cf7615328 smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
gregkh/linux@fe1a7f99e72e iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
gregkh/linux@2f395ca1263b usb: typec: ucsi: ccg: reject firmware images without a ':' record header
gregkh/linux@f9699b9e0399 usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
gregkh/linux@dd7118c010f3 usb: typec: altmodes/displayport: validate count before reading Status Update VDO
gregkh/linux@f2a1edc0bd14 usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
gregkh/linux@c7336c0fba5c USB: serial: safe_serial: fix memory corruption with small endpoint
gregkh/linux@e53d55a8981d Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
gregkh/linux@c7fe9c60fabf Bluetooth: btusb: Allow firmware re-download when version matches
gregkh/linux@d98d8562b328 hpfs: fix a crash if hpfs_map_dnode_bitmap fails
gregkh/linux@8c58a9284917 ipc: limit next_id allocation to the valid ID range
gregkh/linux@b5c59a5b469e Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
gregkh/linux@1f08a90013e1 Bluetooth: HIDP: fix missing length checks in hidp_input_report()
gregkh/linux@290f515c5e3b parport: Fix race between port and client registration
gregkh/linux@4d7eab55eea0 iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
gregkh/linux@563e28acbeb5 iio: dac: max5821: fix return value check in powerdown sync
gregkh/linux@97e37b8ea79e iio: dac: ad5686: fix input raw value check
gregkh/linux@36031acc04e1 wireguard: send: append trailer after expanding head
gregkh/linux@9d502a1bc304 iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
gregkh/linux@8654b5e26178 iio: gyro: itg3200: fix i2c read into the wrong stack location
gregkh/linux@772500198096 iio: ssp_sensors: cancel delayed work_refresh on remove
gregkh/linux@37dd98f32f6a iio: temperature: tsys01: fix broken PROM checksum validation
gregkh/linux@671b867896e9 iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
gregkh/linux@d1c7bad4d9c2 iio: light: cm3323: fix reg_conf not being initialized correctly
gregkh/linux@2ff615fc455a iio: buffer: hw-consumer: fix use-after-free in error path
gregkh/linux@b496e25ead59 USB: serial: omninet: fix memory corruption with small endpoint
gregkh/linux@3cc1a09b2f2e usb: cdns3: gadget: fix request skipping after clearing halt
gregkh/linux@105f40696e6d usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles
gregkh/linux@63b0dafa676a usb: dwc2: Fix use after free in debug code
gregkh/linux@c2c3b33b3c0b Input: elan_i2c - validate firmware size before use
gregkh/linux@d81b323af2dc bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
gregkh/linux@d15130461df3 macsec: fix replay protection at XPN lower-PN wrap
gregkh/linux@645b99b1a185 ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
gregkh/linux@e506cc07d3b6 ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
gregkh/linux@f8aabed3ff3e ipv6: exthdrs: refresh nh after handling HAO option
gregkh/linux@df42ac708acc ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
gregkh/linux@931b4a1f1340 ipv6: validate extension header length before copying to cmsg
gregkh/linux@2df7059a18af xfrm: input: hold netns during deferred transport reinjection
gregkh/linux@f5c68875e25f ip6: vti: Use ip6_tnl.net in vti6_changelink().
gregkh/linux@83bd8a5756a3 HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
gregkh/linux@5de58df307df iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
gregkh/linux@b99366d74b53 nfc: hci: fix out-of-bounds read in HCP header parsing
gregkh/linux@6df815754734 xfrm: route MIGRATE notifications to caller's netns
gregkh/linux@f34726477fa9 xfrm: ah: use skb_to_full_sk in async output callbacks
gregkh/linux@6476c17d536d netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
gregkh/linux@0ff7fbdbf61a ASoC: qcom: q6asm-dai: close stream only when running
gregkh/linux@ebc89798e6b2 ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
gregkh/linux@5d7ab86e2b6b xfrm: esp: restore combined single-frag length gate
gregkh/linux@5c3681c3abc3 Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
gregkh/linux@234189f082cd Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
gregkh/linux@0bc71228fe0f comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
gregkh/linux@1184d1f81d62 comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
gregkh/linux@5f2e2a240dc1 tty: serial: pch_uart: add check for dma_alloc_coherent()
gregkh/linux@1d07b37d61cd usb: chipidea: core: convert ci_role_switch to local variable
gregkh/linux@df4c0304f205 usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
gregkh/linux@82a682cac9f7 USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
gregkh/linux@b1ba2cbc375b usb: storage: Add quirks for PNY Elite Portable SSD
gregkh/linux@dcc1c90b28b2 usbip: vudc: Fix use after free bug in vudc_remove due to race condition
gregkh/linux@e3eec3005de4 usb: usbtmc: check URB actual_length for interrupt-IN notifications
gregkh/linux@ca9d2ee02a1a usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
gregkh/linux@dcd3816fb24d USB: serial: option: add MeiG SRM813Q
gregkh/linux@bd5b381dc511 USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
gregkh/linux@f361359a952d USB: serial: belkin_sa: validate interrupt status length
gregkh/linux@aaa66708bfb1 USB: serial: cypress_m8: validate interrupt packet headers
gregkh/linux@e124120e89b6 USB: serial: keyspan: fix missing indat transfer sanity check
gregkh/linux@2f3661eb2446 USB: serial: mxuport: fix memory corruption with small endpoint
gregkh/linux@8b93ee5baeef USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
gregkh/linux@550fa4d071a8 usb: gadget: net2280: Fix double free in probe error path
gregkh/linux@742e3dd8a0be usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
gregkh/linux@90ccf5fb6324 usb: gadget: f_fs: copy only received bytes on short ep0 read
gregkh/linux@e8a0b0a93a6e thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
gregkh/linux@e2d4d51cf578 thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
gregkh/linux@fda976f7390b scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
gregkh/linux@07776b7779c9 scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
gregkh/linux@57d5d697642e drm/hyperv: validate VMBus packet size in receive callback
gregkh/linux@e2b5c2b7a1b8 serial: sh-sci: fix memory region release in error path
gregkh/linux@9f09c32a88aa serial: zs: Fix swapped RI/DSR modem line transition counting
gregkh/linux@e1f8d21db0e7 serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
gregkh/linux@693664fde1c9 serial: dz: Fix bootconsole message clobbering at chip reset
gregkh/linux@8d21fccdc2da serial: zs: Fix bootconsole handover lockup
gregkh/linux@8c58c9152cf9 serial: zs: Switch to using channel reset
gregkh/linux@ad3d1628a461 USB: serial: cypress_m8: fix memory corruption with small endpoint
gregkh/linux@6f59d1468a9a HID: core: Add printk_ratelimited variants to hid_warn() etc
gregkh/linux@a4d6cb7cf45b HID: pass the buffer size to hid_report_raw_event
gregkh/linux@8c15ac42db0c HID: core: Fix size_t specifier in hid_report_raw_event()
gregkh/linux@25b93d0f229a USB: serial: digi_acceleport: fix memory corruption with small endpoints
gregkh/linux@aceb0f617003 xhci: tegra: Fix ghost USB device on dual-role port unplug
gregkh/linux@bff9266bad68 serial: dz: Fix bootconsole handover lockup
gregkh/linux@05186946bc04 usb: core: Fix SuperSpeed root hub wMaxPacketSize
gregkh/linux@fec41484e7c2 bpf: Free reuseport cBPF prog after RCU grace period.
gregkh/linux@bd2ddb3fe905 USB: serial: mct_u232: fix memory corruption with small endpoint
gregkh/linux@80e416880b98 compiler-clang.h: Add __diag infrastructure for clang
gregkh/linux@44860077bef7 Disable -Wattribute-alias for clang-23 and newer
gregkh/linux@0b88ecfbc9dc i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
gregkh/linux@1354271c89d0 ipv6: mcast: Fix use-after-free when processing MLD queries
gregkh/linux@724d0caffd42 tee: optee: prevent use-after-free when the client exits before the supplicant
gregkh/linux@797c264bff8d netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
gregkh/linux@e4feec317403 ipvs: clear the svc scheduler ptr early on edit
gregkh/linux@56ffbe3a08c0 netfilter: synproxy: add mutex to guard hook reference counting
gregkh/linux@8a1d6e40dedf netfilter: conntrack_irc: fix possible out-of-bounds read
gregkh/linux@76280b78cc9f netfilter: bridge: make ebt_snat ARP rewrite writable
gregkh/linux@13da856c86fb dm cache policy smq: check allocation under invalidate lock
gregkh/linux@18af5d2ef0c4 net/sched: act_api: use RCU with deferred freeing for action lifecycle
gregkh/linux@da8cbb64b47e 6lowpan: fix off-by-one in multicast context address compression
gregkh/linux@6b08dc78d5c0 drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
gregkh/linux@8f5ccba09a3f pcnet32: stop holding device spin lock during napi_complete_done
gregkh/linux@973cf7c433d2 net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
gregkh/linux@cd3e75dc141a net: lan743x: permit VLAN-tagged packets up to configured MTU
gregkh/linux@a07d741c077d Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
gregkh/linux@06fcbd79c3c3 Bluetooth: MGMT: validate advertising TLV before type checks
gregkh/linux@7c15c7c28789 Bluetooth: RFCOMM: validate skb length in MCC handlers
gregkh/linux@29ecc9d93cf4 Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
gregkh/linux@0ef2ea86c82b Bluetooth: bnep: reject short frames before parsing
gregkh/linux@5b7dfca6f852 Bluetooth: fix memory leak in error path of hci_alloc_dev()
gregkh/linux@2a87c3e8f03c ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
gregkh/linux@3150e6d3223d ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
gregkh/linux@36d259711872 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
gregkh/linux@f46e1d1a7588 sctp: purge outqueue on stale COOKIE-ECHO handling
gregkh/linux@391ebe74456a signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
gregkh/linux@a69e0b7ea34a time: Fix off-by-one in settimeofday() usec validation
gregkh/linux@c5839b34704c ext4: validate p_idx bounds in ext4_ext_correct_indexes
gregkh/linux@6557c4504c5a fs/ntfs3: Return error for inconsistent extended attributes
gregkh/linux@e4316bd85e42 nfsd: don't ignore the return code of svc_proc_register()
gregkh/linux@f979971835dd tap: free page on error paths in tap_get_user_xdp()
gregkh/linux@793385c15477 tun: free page on build_skb failure in tun_xdp_one()
gregkh/linux@55469cd78aef KVM: arm64: Remove VPIPT I-cache handling
gregkh/linux@e4e7fdfb85cf arm64: tlb: Allow XZR argument to TLBI ops
gregkh/linux@dbf672e0dec2 arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
gregkh/linux@c4c1ea36d83b xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
gregkh/linux@672f0f3b8f87 netlabel: validate unlabeled address and mask attribute lengths
gregkh/linux@03bfa95e452e net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
gregkh/linux@1132e5edc286 ipv6: sit: reload inner IPv6 header after GSO offloads
gregkh/linux@0bb5b2dc1b90 net: openvswitch: fix possible kfree_skb of ERR_PTR
gregkh/linux@928dd94db23e sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
gregkh/linux@71ff5cdd5da6 net: guard timestamp cmsgs to real error queue skbs
gregkh/linux@4dd262f875e8 net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
gregkh/linux@fc657ac0767c ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
gregkh/linux@c85e8d5e2365 rds: mark snapshot pages dirty in rds_info_getsockopt()
gregkh/linux@0b35dc8527cc netfilter: x_tables: avoid leaking percpu counter pointers
gregkh/linux@d704ee9c7bc6 netfilter: nf_log: validate MAC header was set before dumping it
gregkh/linux@19748967d59c netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
gregkh/linux@19f8bc139e9b net: mvpp2: sync RX data at the hardware packet offset
gregkh/linux@a3ee9231ccec net: mvpp2: limit XDP frame size to the RX buffer
gregkh/linux@4051c3689f94 net: mvpp2: Add metadata support for xdp mode
gregkh/linux@a88b3293b556 net: mvpp2: refill RX buffers before XDP or skb use
gregkh/linux@164339c92709 net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
gregkh/linux@30165a09f76e drm/vc4: fix krealloc() memory leak
gregkh/linux@55b79b1ae423 netfilter: nft_tunnel: fix use-after-free on object destroy
gregkh/linux@fa5823126239 Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
gregkh/linux@1ec8fc63e9cd drm/i915/gem: Fix phys BO pread/pwrite with offset
gregkh/linux@1777ceac4bea xfrm: espintcp: do not reuse an in-progress partial send
gregkh/linux@561edb021486 USB: serial: io_ti: fix heap overflow in get_manuf_info()
gregkh/linux@b7faf660eefa USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
gregkh/linux@5d1d590e2f30 USB: serial: option: add usb-id for Dell Wireless DW5826e-m
gregkh/linux@0a57320f7194 USB: serial: kl5kusb105: fix bulk-out buffer overflow
gregkh/linux@117743d62e12 ALSA: timer: Fix UAF at snd_timer_user_params()
gregkh/linux@b6880da3da20 drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
gregkh/linux@ed77cc819ad6 RDMA/srp: bound SRP_RSP sense copy by the received length
gregkh/linux@caa039f68c1e ARM: socfpga: Fix OF node refcount leak in SMP setup
gregkh/linux@a3049e49e68b ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
gregkh/linux@6586aae52526 mptcp: fix retransmission loop when csum is enabled
gregkh/linux@12357c6f4df0 mptcp: sockopt: check timestamping ret value
gregkh/linux@cf7090e255d7 vsock/vmci: fix sk_ack_backlog leak on failed handshake
gregkh/linux@964b1c3eb71a bnxt_en: Fix NULL pointer dereference
gregkh/linux@e8a013c0c3ca IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
gregkh/linux@5437679f9e2a pidfd: refuse access to tasks that have started exiting harder
gregkh/linux@bd23fa0c16c5 fuse: reject fuse_notify() pagecache ops on directories
gregkh/linux@4d2b4a9cda68 i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
gregkh/linux@e9aa2473cf94 i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
gregkh/linux@09e41cebb54c i2c: tegra: Fix NOIRQ suspend/resume
gregkh/linux@003dd8b5d06e Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
gregkh/linux@323a11de71de Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
gregkh/linux@92cda2593cf2 ipc/shm: serialize orphan cleanup with shm_nattch updates
gregkh/linux@e1e3a05efe59 misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
gregkh/linux@2d0f47e27c1f misc: fastrpc: fix DMA address corruption due to find_vma misuse
gregkh/linux@b02b2e3e876c net: bonding: fix NULL pointer dereference in bond_do_ioctl()
gregkh/linux@ed876ab2fb26 net: mv643xx: fix OF node refcount
gregkh/linux@2c5e5e4a5970 net: rds: clear i_sends on setup unwind
gregkh/linux@460cd4ac8875 mmc: core: Fix host controller programming for fixed driver type
gregkh/linux@bff9b9614380 mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
gregkh/linux@d3f0b8739e8a mmc: sdhci: add signal voltage switch in sdhci_resume_host
gregkh/linux@b2be72d40183 sctp: diag: reject stale associations in dump_one path
gregkh/linux@a6724b7b812a sctp: stream: fully roll back denied add-stream state
gregkh/linux@35d6c9252a15 thunderbolt: Reject zero-length property entries in validator
gregkh/linux@b212bc161d8a thunderbolt: Bound root directory content to block size
gregkh/linux@6021d39ccd97 thunderbolt: Clamp XDomain response data copy to allocation size
gregkh/linux@7720654b4842 thunderbolt: Limit XDomain response copy to actual frame size
gregkh/linux@3d1561537237 slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
gregkh/linux@91fb41218c41 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
gregkh/linux@029571d51140 drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
gregkh/linux@b781f90a9528 drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
gregkh/linux@31180638a33a drm/amd/display: Use krealloc_array() in dal_vector_reserve()
gregkh/linux@897d6a724773 fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
gregkh/linux@21a9b19ce2e8 mm/damon/ops-common: call folio_test_lru() after folio_get()
gregkh/linux@72ab76ea680d io_uring/poll: fix signed comparison in io_poll_get_ownership()
gregkh/linux@ff44ec94d4fc net/tcp-md5: Fix MAC comparison to be constant-time
gregkh/linux@1abd50fc3cfa lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
gregkh/linux@3fec4b1f36ac f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
gregkh/linux@ffb94770dbdf f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
gregkh/linux@dc2e7d595d68 smb: server: fix active_num_conn leak on transport allocation failure
gregkh/linux@c3ba5ca64216 smb: server: fix max_connections off-by-one in tcp accept path
gregkh/linux@1592a6cd6f65 smb: client: require a full NFS mode SID before reading mode bits
gregkh/linux@9e203dbb5402 smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
gregkh/linux@282cbbb476b9 ksmbd: require minimum ACE size in smb_check_perm_dacl()
gregkh/linux@714aa973da81 net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
gregkh/linux@9a6ebc670128 arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
gregkh/linux@71b7a80c267b rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID
gregkh/linux@959c13da6c36 wifi: rtw88: check for PCI upstream bridge existence
gregkh/linux@8e563d8db50f thermal: core: Fix thermal zone governor cleanup issues
gregkh/linux@1958a92599b2 wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
gregkh/linux@d956208576ad ALSA: aoa: Use guard() for mutex locks
gregkh/linux@2c3819138074 ALSA: aoa: i2sbus: clear stale prepared state
gregkh/linux@6ed4e39cb6ea media: rc: ttusbir: respect DMA coherency rules
gregkh/linux@d17c282163b7 ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
gregkh/linux@aa16dca1b062 erofs: fix the out-of-bounds nameoff handling for trailing dirents
gregkh/linux@81f0fb813e4b media: rc: igorplugusb: heed coherency rules
gregkh/linux@64d9b734b6fe sched: Use u64 for bandwidth ratio calculations
gregkh/linux@358fc03cd96b ALSA: core: Fix potential data race at fasync handling
gregkh/linux@91cb30b6bb18 net: qrtr: ns: Limit the maximum number of lookups
gregkh/linux@9524198e7a12 net: qrtr: ns: Change servers radix tree to xarray
gregkh/linux@a5a454f33648 net: qrtr: ns: Free the node during ctrl_cmd_bye()
gregkh/linux@8a93d7ae8498 net: mctp: fix don't require received header reserved bits to be zero
gregkh/linux@823310645065 net: qrtr: ns: Limit the total number of nodes
gregkh/linux@a6ae4511c07b net: bridge: use a stable FDB dst snapshot in RCU readers
gregkh/linux@4aab89603b63 fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
gregkh/linux@7e1b6b281aa8 randomize_kstack: Maintain kstack_offset per task
gregkh/linux@237c6759e427 mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
gregkh/linux@a6c1e6014df1 mtd: spi-nor: sst: Fix write enable before AAI sequence
gregkh/linux@68013a9bd4c0 udf: fix partition descriptor append bookkeeping
gregkh/linux@8be69532e399 hfsplus: fix uninit-value by validating catalog record size
gregkh/linux@6499c9c8ec43 hfsplus: fix held lock freed on hfsplus_fill_super()
gregkh/linux@d28311539ac9 Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
gregkh/linux@3a429c9d29be can: ucan: fix typos in comments
gregkh/linux@cb2e41e87a28 can: ucan: fix devres lifetime
gregkh/linux@778acd52e949 erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
gregkh/linux@73b47a1f06de ceph: only d_add() negative dentries when they are unhashed
gregkh/linux@345c24b2bcf0 ALSA: aloop: Fix peer runtime UAF during format-change stop
gregkh/linux@a59ac34ee8eb printk: add print_hex_dump_devel()
gregkh/linux@cd849c07b8d7 crypto: caam - guard HMAC key hex dumps in hash_digest_key
gregkh/linux@4f1756d043e5 tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
gregkh/linux@b8603d9ae6c9 smb: client: validate the whole DACL before rewriting it in cifsacl
gregkh/linux@c21c0ef864db usb: typec: tcpm: reset internal port states on soft reset AMS
gregkh/linux@df2e90d6a995 wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
gregkh/linux@e589ee5dcc02 usb: dwc3: Move GUID programming after PHY initialization
gregkh/linux@3c27fc51603d net: ipv4: stop checking crypto_ahash_alignmask
gregkh/linux@ef09fb575973 net: ipv6: stop checking crypto_ahash_alignmask
gregkh/linux@ec406c26c975 xfrm: ah: account for ESN high bits in async callbacks
gregkh/linux@3943fcad7694 xfrm: defensively unhash xfrm_state lists in _xfrm_state_delete
gregkh/linux@91bd3c49822f spi: syncuacer: fix controller deregistration
gregkh/linux@90bffa1e4514 spi: sun4i: fix controller deregistration
gregkh/linux@f6c80082b413 spi: spi-ti-qspi: Convert to platform remove callback returning void
gregkh/linux@83568b18fc85 spi: ti-qspi: fix controller deregistration
gregkh/linux@ddeb2582d49b spi: zynq-qspi: fix controller deregistration
gregkh/linux@3ef5e323e31f spi: sun6i: fix controller deregistration
gregkh/linux@241e46a9193a spi: tegra114: fix controller deregistration
gregkh/linux@350de10c4923 spi: tegra20-sflash: fix controller deregistration
gregkh/linux@13508c60ef38 spi: uniphier: fix controller deregistration
gregkh/linux@339ff953f7e0 mm/hugetlb_cma: round up per_node before logging it
gregkh/linux@46cf3646dea5 fbcon: Avoid OOB font access if console rotation fails
gregkh/linux@76240ae8364f spi: topcliff-pch: Convert to platform remove callback returning void
gregkh/linux@5a60bef9d3a2 spi: topcliff-pch: fix controller deregistration
gregkh/linux@d8224b1be662 btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
gregkh/linux@70cc336f5b58 tracing/probes: Limit size of event probe to 3K
gregkh/linux@98b810497847 pmdomain: core: Fix detach procedure for virtual devices in genpd
gregkh/linux@5de2665e913a smb: client: validate dacloffset before building DACL pointers
gregkh/linux@2525998ac956 btrfs: fix missing last_unlink_trans update when removing a directory
gregkh/linux@7c27e6c4f089 smb: client: Use FullSessionKey for AES-256 encryption key derivation
gregkh/linux@d8a8adccf831 mptcp: pm: prio: skip closed subflows
gregkh/linux@23079e0b7742 mptcp: pm: ADD_ADDR rtx: fix potential data-race
gregkh/linux@278c56581eb0 mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
gregkh/linux@f4e1a88c18a9 f2fs: fix incorrect file address mapping when inline inode is unwritten
gregkh/linux@8ae13862d860 f2fs: fix false alarm of lockdep on cp_global_sem lock
gregkh/linux@e036acad26f0 spi: st-ssc4: fix controller deregistration
gregkh/linux@ee125bbff756 spi: lantiq-ssc: fix controller deregistration
gregkh/linux@ad499e4c0914 genetlink: Use internal flags for multicast groups
gregkh/linux@9cf7eb891934 smb: client: require net admin for CIFS SWN netlink
gregkh/linux@407217734835 Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
gregkh/linux@c4351d220046 Bluetooth: hci_qca: Convert timeout from jiffies to ms
gregkh/linux@42fe380baaac Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2
gregkh/linux@0d5104390b44 Bluetooth: MGMT: validate Add Extended Advertising Data length
gregkh/linux@a00b379cb9ce qed: Use the bitmap API to simplify some functions
gregkh/linux@06fa8e69019f qed: fix double free in qed_cxt_tables_alloc()
gregkh/linux@c0e0d037d930 Bluetooth: Consolidate code around sk_alloc into a helper function
gregkh/linux@444f4530df36 Bluetooth: Init sk_peer* on bt_sock_alloc
gregkh/linux@41c8c1c7923e Bluetooth: serialize accept_q access
gregkh/linux@8be6685cdd12 net: hsr: defer node table free until after RCU readers
gregkh/linux@1b2af820247c ice: fix VF queue configuration with low MTU values
gregkh/linux@2b2df0082d96 ipv6/addrconf: annotate data-races around devconf fields (II)
gregkh/linux@c7e8971abd70 ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
gregkh/linux@31882893cafa use less confusing names for iov_iter direction initializers
gregkh/linux@c5eea9a24dd0 mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
gregkh/linux@bdb6183d2685 selftests: mptcp: drop nanoseconds width specifier
gregkh/linux@4649d600cb4a mptcp: do not drop partial packets
gregkh/linux@985b5e38ac4f octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
gregkh/linux@b92e7ea408b6 octeontx2-pf: avoid double free of pool->stack on AQ init failure
gregkh/linux@e0f43aceef40 spi: qup: switch to use modern name
gregkh/linux@d577c55d189e spi: qup: fix error pointer deref after DMA setup failure
gregkh/linux@47490bbb05c8 arm64: tlb: Flush walk cache when unsharing PMD tables
gregkh/linux@60b699e5508c phy: tegra: xusb: Disable trk clk when not in use
gregkh/linux@ed9297ad5ead phy: tegra: xusb: Fix per-pad high-speed termination calibration
gregkh/linux@e1c100e2d61b Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
gregkh/linux@19eb8565c450 iio: gyro: adis16260: fix division by zero in write_raw
gregkh/linux@ac12ecbc8aed iio: chemical: scd30: Use guard(mutex) to allow early returns
gregkh/linux@6308b812acdc iio: chemical: scd30: fix division by zero in write_raw
gregkh/linux@664b13498fe9 iio: dac: ad5686: fix ref bit initialization for single-channel parts
gregkh/linux@9391e9472687 usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
gregkh/linux@9b40bdc2a329 net: skbuff: fix missing zerocopy reference in pskb_carve helpers
gregkh/linux@cf72e08d4913 serial: samsung_tty: Use port lock wrappers
gregkh/linux@96873527fc5f tty: serial: samsung: use u32 for register interactions
gregkh/linux@10014eb7eee3 tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
gregkh/linux@96fc71f3dac1 usb: dwc3: xilinx: fix error handling in zynqmp init error paths
gregkh/linux@54e73e1e5d20 usb: gadget: f_hid: tidy error handling in hidg_alloc
gregkh/linux@2da2bf68cdaa usb: gadget: f_hid: fix device reference leak in hidg_alloc()
gregkh/linux@95839a67ea56 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
gregkh/linux@b19382dfc6e7 scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
gregkh/linux@3907130abbb7 usb: typec: ucsi: Check if power role change actually happened before handling
gregkh/linux@c3edc162a39c drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7
gregkh/linux@96f7de3172d4 drm/hyperv: validate resolution_count and fix WIN8 fallback
gregkh/linux@c575130a1342 serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt
gregkh/linux@d10085481cd3 serial: altera_jtaguart: handle uart_add_one_port() failures
gregkh/linux@abf959334379 tty: serial: qcom-geni-serial: remove unused symbols
gregkh/linux@ef082969e2c3 tty: serial: qcom-geni-serial: align #define values
gregkh/linux@9bb6ec4e32c2 serial: qcom-geni: fix UART_RX_PAR_EN bit position
gregkh/linux@badf178b76b0 scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
gregkh/linux@eca18feed38b netfilter: nft_fib: fix stale stack leak via the OIFNAME register
gregkh/linux@a82d4251918f hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
gregkh/linux@806e620a8690 RDMA/umem: fix kernel-doc warnings
gregkh/linux@0493cef03411 RDMA: Move DMA block iterator logic into dedicated files
gregkh/linux@dee2a49adeeb RDMA/umem: Fix truncation for block sizes >= 4G
gregkh/linux@108963978a68 mm/huge_memory: update file PMD counter before folio_put()
gregkh/linux@54add3b7d3c1 ipvs: skip ipv6 extension headers for csum checks
gregkh/linux@da6cc648c1f5 blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init
gregkh/linux@268078acae72 batman-adv: stop tp_meter sessions during mesh teardown
gregkh/linux@78fe6844471d batman-adv: tp_meter: fix tp_num leak on kmalloc failure
gregkh/linux@d3a1fb2ca323 net/ipv6: ioam6: prevent schema length wraparound in trace fill
gregkh/linux@8a665d733940 ksmbd: Compare MACs in constant time
gregkh/linux@2665887a6943 nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
gregkh/linux@c2f5b2b8dd24 ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
gregkh/linux@74331684c50a selinux: enable genfscon labeling for securityfs
gregkh/linux@401fbd171e5e arm64: cputype: Add NVIDIA Olympus definitions
gregkh/linux@6bb606b13477 arm64: cputype: Add C1-Ultra definitions
gregkh/linux@521008bee0c5 arm64: cputype: Add C1-Premium definitions
gregkh/linux@8364384ae82f arm64: errata: Mitigate TLBI errata on various Arm CPUs
gregkh/linux@f040e78cde73 arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
gregkh/linux@6a26fd2e6b6f arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
gregkh/linux@301a33fd590c mptcp: close TOCTOU race while computing rcv_wnd
gregkh/linux@edd05afa4184 fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter
gregkh/linux@20bc319ad383 apparmor: validate default DFA states are in bounds
gregkh/linux@d55b2c906170 x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function
gregkh/linux@e0f0647985b2 media: rc: ttusbir: fix inverted error logic
gregkh/linux@7715c73f3326 batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
gregkh/linux@2243ad78ce64 media: rc: igorplugusb: fix control request setup packet
gregkh/linux@aa094e6ef513 Bluetooth: MGMT: Fix backward compatibility with userspace
gregkh/linux@5500ba1d410a ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
gregkh/linux@df9b09555005 batman-adv: tp_meter: fix race condition in send error reporting
gregkh/linux@7b9a966cc058 batman-adv: tp_meter: avoid role confusion in tp_list
gregkh/linux@4435888e1bf1 netfilter: require Ethernet MAC header before using eth_hdr()
gregkh/linux@eceeec79dbc6 Linux 5.15.210