Linux 7.2-rc6 [LWN.net]

Hmm. This rc is huge.  Even by the "new normal" standards this is a
big rc, and I think it's the biggest rc6 we've had in years at least
by commit count.

The stats don't look particularly strange: it's just under 60%
drivers, 20% networking, and 20% "rest" (arch, tooling, filesystems -
nothing particularly odd). And that driver side is the usual gpu and
networking drivers, but not exclusively so - we have sound, spi, ata
etc in there too.

So a lot of networking stuff, which is at least partly the whole
continued backlog from conference timing. I hope that's all there is
to this, but it is a bit unnerving how bit the changes are at this
point, even if nothing in here actually looks all that strange.

There's nothing in here that screams "bad" or implies that the release
needs delaying, but I sure hope we calm down for the remaining two
weeks.

          Linus

---
Aaron Ma (1):
      ice: wait for reset completion in ice_resume()

Abdun Nihaal (3):
      gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
      cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
      can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory
leak in kvaser_usb_hydra_get_busparams()

Aboorva Devarajan (1):
      mm/util: don't read __page_2 for order-1 folios in snapshot_page()

Aditya Garg (1):
      net: mana: Return error code from mana_create_rxq()

Alan Swanson (1):
      drm/amd/display: Silence link_dpms I2C retimer failures

Aldo Ariel Panzardo (1):
      Bluetooth: SCO: give the socket its own sco_conn reference

Alessio Belle (1):
      drm/imagination: Fix value of HWRT address in pvr_job_create tracepoint

Alex Deucher (1):
      drm/amd/display: check if dml21_add_phantom_plane() is successful

Alex Hung (2):
      drm/amdgpu: Fix __rcu fence pointer accesses
      drm/amdgpu: Pack nested ucode_info struct

Alex Tran (1):
      gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper

Alexander Kaplan (2):
      drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
      drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder

Alexandru Elisei (1):
      KVM: arm64: Reject guest_memfd memslots when the VM has MTE

Alexey Charkov (1):
      phy: rockchip: naneng-combphy: Always configure SSC spread direction

Alvin Šipraga (1):
      MAINTAINERS: make Luiz a maintainer and myself reviewer for Realtek DSA

André Pragosa (1):
      ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED)

AngeloGioacchino Del Regno (1):
      drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable

Anirudh Srinivasan (1):
      riscv: drop __init from vec_check_unaligned_access_speed_all_cpus

Ao Sun (1):
      scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

Asim Viladi Oglu Manizada (1):
      sctp: prevent peer transport count overflow

Aswin Karuvally (1):
      s390/qeth: Check CAP_NET_ADMIN for private ioctls

Avi Weiss (4):
      can: ctucanfd: unmap BAR0 using base address
      can: ctucanfd: mark error-active controller status valid
      can: ctucanfd: handle bus error interrupts
      can: ctucanfd: use self-test mode for PRESUME_ACK

Balamurugan C (1):
      ASoC: Intel: soc-acpi: Add entry for sof_rt5682 in NVL match table.

Baochen Qiang (8):
      wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
      wifi: ath12k: factor out peer assoc send-and-wait into a helper
      wifi: ath12k: keep ATH12K_PEER_ML_ID_VALID set in ath12k_sta::ml_peer_id
      wifi: ath12k: add support for HTT_T2H_MSG_TYPE_MLO_RX_PEER_MAP
      wifi: ath12k: introduce host_alloc_ml_id hardware parameter
      wifi: ath12k: do not advertise MLD peer ID for firmware-allocate devices
      wifi: ath12k: defer dp_peer registration when firmware allocates
MLD peer ID
      wifi: ath12k: resolve PENDING ML peer ID from MLO_PEER_MAP HTT event

Bart Van Assche (1):
      scsi: ufs: core: Revert "Delegate the interrupt service routine
to a threaded IRQ handler"

Baul Lee (4):
      ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
      ALSA: ump: fix double free of out_cvts on rawmidi error
      ALSA: usb-audio: fix stack info leak in RME Digiface status
      ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()

Benjamin Block (1):
      scsi: zfcp: Fix memory leak during adapter release by destroying
gid_pn_req

Benjamin Boortz (2):
      pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
      pinctrl: bm1880: add missing select GENERIC_PINCONF

Bob Zhou (1):
      drm/amdgpu: skip clearing empty freed VM list on GEM close

Brajesh Gupta (1):
      drm/imagination: Update the trace point pvr_job_submit_fw()

Breno Leitao (2):
      mm: memcg: initialize *locked in memcg1_oom_prepare() stub
      uprobes: Fix NULL pointer dereference in hprobe_expire()

Burak Emir (1):
      MAINTAINERS: update address for Burak Emir

Candice Li (1):
      drm/amdgpu: restore UMD profile pstate after runtime resume

Carlo Caione (1):
      of/address: Fix NULL bus dereference in of_pci_range_parser_one()

Carlos López (2):
      KVM: arm64: vgic: Fix race between LPI release and re-registration
      KVM: arm64: vgic: Mitigate potential LPI registration failure

Carlos Song (1):
      i2c: imx: mark I2C adapter when hardware is powered down

Cen Zhang (Microsoft) (1):
      net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds

Chandrakanth Patil (1):
      scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit

Chao Shi (1):
      block: stop the timeout timer when releasing a never added disk

Charles Keepax (11):
      ASoC: SDCA: Correct pointer passed to devm_acpi_table_put
      ASoC: SDCA: Always free firmware in FDL path
      ASoC: SDCA: Make UMP message size check more robust
      ASoC: SDCA: Ensure that Control Range is large enough for header
      ASoC: SDCA: Rename sdca_irq_allocate() to include devm
      ASoC: SDCA: Add sdca_irq_cleanup_late()
      ASoC: SDCA: Remove devm from primary IRQ cleanup
      ASoC: SDCA: Populate IRQ data earlier
      ASoC: Add a component fixup_controls callback
      ASoC: SDCA: Switch to fixup_controls callback for IRQ registration
      ASoC: SDCA: Move kcontrol search out of IRQ

Charles Vosburgh (1):
      sctp: validate Adaptation Indication parameter length

Chengfeng Ye (2):
      net: pktgen: fix proc entry use-after-free
      Bluetooth: hci_sync: Fix advertising data UAFs

Chenguang Zhao (4):
      forcedeth: fix UAF of txrx_stats in nv_remove
      net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in
poll_controller
      net: sxgbe: free TX rings on RX allocation failure
      net: sxgbe: check descriptor ring allocation failures

Chris Gellermann (2):
      selftests/clone3: fix wild pointer access of getline due to missing init
      selftests/mm: fix potential wild pointer access of getline due
to missing init

Christian Brauner (5):
      binfmt_misc: don't let an 'F' entry pin its own instance
      binfmt_misc: restore write access when removing an entry
      binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
      binfmt_misc: reject a flag character as the field delimiter
      binfmt_misc: don't leak the user namespace when the mount fails

Christian Loehle (3):
      ACPI: CPPC: Check all controls for fast switching
      cpufreq: cppc: Sanitize lockless policy limit snapshots
      ACPI: CPPC: Skip writes to unsupported performance controls

Christian Marangi (1):
      net: phylink: put link_gpio if phylink_create fails

Christoph Hellwig (1):
      iomap: add a separate bio_set for iomap_split_ioend

D Scott Phillips (1):
      KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context

Damien Le Moal (3):
      ata: libata-scsi: terminate deferred commands on time out
      ata: libata-scsi: schedule deferred atapi command
      scsi: libsas: terminate deferred commands on time out

Daniel Golle (4):
      gpiolib: tolerate gpio-hogs lacking a hogging state
      net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
      net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling
      net: dsa: mt7530: error out on failed reads in MT7531 PHY polling

David Carlier (2):
      dmaengine: switchtec-dma: fix FIELD_GET misuse when programming
SE threshold
      igc: remove napi_synchronize() in igc_down()

David Corvaglia (1):
      net: bridge: mrp: fix Option TLV length in MRP_Test frames

David Francis (1):
      drm/amdkfd: Handle invalid event type in CRIU event restore

David Howells (4):
      afs: Fix afs_fs_fetch_data() to set call->async
      afs: Fix afs_fs_fetch_data() to subtract transferred from len
      afs: Fix UAF when sending a message
      netfs: Fix folio_queue ENOMEM in writeback by adding a mempool

David Lee (1):
      netfilter: ipset: do not update comments from kernel-side hash adds

Dawei Feng (3):
      smb: client: fix buffer leaks in SMB1 read and write
      ice: fix memory leak in ice_lbtest_prepare_rings()
      e1000: fix memory leak in e1000_probe()

Dawid Osuchowski (1):
      ice: fix VF interrupts cleanup

Deepanshu Kartikey (1):
      wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()

Denis V. Lunev (1):
      qede: sync udp_tunnel ports outside qede_lock in the recovery path

Dmitry Antipov (1):
      smb: client: simplify cifs_fscache_get_super_cookie()

Dongjiang Zhu (2):
      btrfs: skip global block reserve accounting for rescue mounts
      btrfs: report missing raid stripe tree root during lookup

Eckhart Mohr (1):
      ALSA: hda/realtek: Add quirk for TongFang X6SP45xU

Eric Dumazet (7):
      net: do not send ICMP/NDISC Redirects when peer allocation fails
      vxlan: re-fetch eth header after route_shortcircuit()
      vxlan: unclone skb head before modifying eth header in
route_shortcircuit()
      vxlan: use neigh_ha_snapshot() in route_shortcircuit()
      vxlan: use pskb_network_may_pull() in route_shortcircuit()
      vxlan: use pskb_network_may_pull() for transmit path header pulls
      net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()

Eric Joyner (1):
      ethtool: Embed FEC hist ranges as buffer in struct

Fabio Estevam (1):
      ASoC: dt-bindings: realtek,rt5640: Make interrupts optional

Fabrice Derepas (1):
      KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type

Fares Soliman (1):
      drm/amdgpu: Update message IDs to PMFW to correctly gather
GFXOFF residency logs

Farhan Ali (6):
      KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
      KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
      KVM: s390: pci: Fix missing error codes and memory unaccounting
      KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
      KVM: s390: pci: Fix resource leak on IRQ registration failure
      KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

Frank Sorenson (3):
      cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
      cifs: fix time_last_write stamp placement in setattr/truncate paths
      cifs: add fscache_resize_cookie() to cifs_setsize()

Fredric Cover (1):
      smb: client: use GFP_KERNEL for registry allocation

Fuad Tabba (1):
      KVM: arm64: Update Fuad Tabba's email address

Gabriele Monaco (1):
      sched/deadline: Use revised wakeup rule only for running dl_server

Gang Ba (1):
      drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE

Gao Xiang (1):
      erofs: ensure valid f_path for page cache sharing

George Zhang (1):
      drm/amd/display: Fix divide-by-zero in calculate_mcache_setting
on zero viewport

Greg Kroah-Hartman (3):
      Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
      Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
      Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()

Gregory Price (1):
      mm/vmstat: fold stranded per-cpu node stats when a node comes online

Guanghui Yang (1):
      btrfs: zoned: fix missing chunk metadata reservation

Guangshuo Li (3):
      drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2
      scsi: ufs: core: Cancel RTC work in active-active suspend
      can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak
on URB resubmit failure

Guenter Roeck (9):
      hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
      hwmon: (ina2xx) Fix various overflow issues
      hwmon: (ltc4282) Fix reading the minimum alarm voltage
      hwmon: (sht3x) Fix unaligned accesses
      hwmon: (lm90) Only report alarms if driver is ready
      hwmon: (nzxt-smart2) DMA-align output buffer
      hwmon: (lm63) Mask PWM frequency multiplier to supported bits
      hwmon: (nct6775-core) Prevent access to unsupported weight registers
      hwmon: (pmbus) Fix return value from pmbus_update_byte_data()

Gunal Seenivasagan (1):
      ALSA: hda/realtek: Add quirk for Infinix INBOOK X3 Slim

H. Nikolaus Schaller (1):
      i2c: jz4780: Cache host clock rate at probe to prevent CCF
prepare_lock deadlock

Haibo Chen (3):
      spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all
supported SoCs
      spi: spi-nxp-fspi: enter stop mode before reconfiguring MCR0 and DLL
      spi: spi-nxp-fspi: propagate clock reconfig failures in
nxp_fspi_select_mem()

Haidar Lee (2):
      ASoC: tas2562: fix DVC coefficient write order
      ASoC: tas2562: fix broken entries in the volume lookup table

Haofeng Li (1):
      selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE

Harald Freudenberger (4):
      s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
      s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
      s390/zcrypt: Close speculative mem read possibility
      s390/zcrypt: Fix missing mem scrub at clear key import in
cca_clr2cipherkey()

Hardik Garg (1):
      Drivers: hv: vmbus: add VTL2 redirect connection ID

Hardik Prakash (1):
      i2c: designware: defer probe if child GpioInt controllers are not bound

Hariprasad Kelam (1):
      octeontx2-af: Block VFs from clobbering special CGX PKIND state

Harkirat Gill (1):
      drm/amdgpu: cap GTT size to physical RAM on APUs

Hidayath Khan (1):
      dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

Himal Prasad Ghimiray (1):
      drm/xe/pt: check no-DMA huge-pte cases before DMA segment test

Holger Dengler (2):
      s390/zcrypt: Validate length for CCA AES cipher key requests
      s390/zcrypt: Validate length for CCA ECC private key requests

Hongbo Li (1):
      MAINTAINERS: update Hongbo Li's email address

Hongling Zeng (1):
      dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA

Hongyan Xu (1):
      hwmon: (npcm750-pwm-fan): stop fan timer on device detach

HyeongJun An (2):
      scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
      scsi: libiscsi_tcp: Bound SCSI Response data segment to the
connection buffer

Ibrahim Hashimov (1):
      scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

Ilya Maximets (3):
      net: openvswitch: fix skb leak on flow key update failure during
recirculation
      net: openvswitch: fix skb leak on flow key update failure during ct
      net: openvswitch: fix potential UAF on meter attach failure

Ivan Vecera (1):
      dpll: use pin owner's dpll ref for pin-level attribute reporting

Jackie Dong (2):
      ALSA:hda/realtek:ALC269 fixup for Legion 7 15ASH11 Mic Mute LED
      ASoC: amd: acp: Add DMI quirk for Lenovo Legion 7 15ASH11

Jaehoon Kim (1):
      KVM: s390: Fall back to short-term pinning in MAP ioctl

James Gao (1):
      can: peak_usb: add bounds check for USB channel index

Jan Höppner (1):
      s390/dasd: Fix potential NULL pointer dereference

Jason Xing (2):
      xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
      xsk: drain continuation descs after overflow in xsk_build_skb()

Jens Axboe (3):
      io_uring/net: initialize mshot_len for send
      io_uring/kbuf: cap buffer selection length at MAX_RW_COUNT
      Revert "io_uring/epoll: disallow adding an epoll file to an epoll context"

Jerome Tollet (1):
      drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status

Jiakai Xu (1):
      riscv/mm: use physical alignment for vmemmap_start_pfn

Jiale Yao (2):
      Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
      Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame

Jianing Li (1):
      power: supply: max17040: handle missing status supplier

Jiawen Wu (1):
      net: libwx: fix FDIR ATR queue mismatch for software VLAN packets

Jinu Kim (2):
      KVM: x86/mmu: Check write tracking in all address spaces
      KVM: x86/mmu: Check all address spaces before skipping unsync

Jiri Slaby (SUSE) (1):
      drm/amd/display: use proper context for logging

Johan Hovold (1):
      drm/mediatek: mtk_hdmi_common: take i2c adapter module reference

Johannes Thumshirn (3):
      btrfs: zoned: fix deadlock between metadata writeback and
transaction commit
      btrfs: zoned: reset meta_write_pointer on zone reset
      btrfs: zoned: skip fully truncated ordered extents at zone finish

John Ericson (2):
      af_unix: fix listen() succeeding on sockets in the wrong state
      selftests/net/af_unix: test listen() rejects wrong socket states

Jonas Gorski (1):
      i2c: iproc: reset bus after timeout if START_BUSY is stuck

Jonas Köppeler (1):
      net/sched: sch_cake: skip clearing unused tins during rate adjustment

Jori Koolstra (1):
      selftest: fix headers in fclog.c

Jorn Baayen (1):
      ASoC: amd: yc: Add DMI quirk for Acer Aspire AG14-22P

Jose Maria Casanova Crespo (1):
      drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size

Joseph Qi (1):
      ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset

Joshua Hay (1):
      idpf: adjust TxQ ring count minimum

Julian Anastasov (5):
      ipvs: adjust double hashing when fwd method changes
      ipvs: fix the checksum validations
      ipvs: fix places with wrong packet offsets
      ipvs: do not mangle ICMP replies for non-first fragments
      ipvs: clear the nfct flag under lock

Junjie Cao (1):
      gpio: pch: use raw_spinlock_t for the register lock

Kanala Ramalingeswara Reddy (2):
      drm/amdgpu: Update driver if header for SMU V15.0.5
      drm/amdgpu: enable mode2 reset for SMU IP v15.0.5

Karl Mehltretter (2):
      pinctrl: devicetree: don't free uninitialized dev_name on error path
      riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove

Kefeng Wang (1):
      mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

Kiran Kella (1):
      psp: fix NULL genl_sock deref race with concurrent netns teardown

Kiryl Shutsemau (Meta) (4):
      fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
      mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
      fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
      mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

Konrad Dybcio (1):
      pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151

Krishna Kurapati (1):
      phy: qcom: m31-eusb2: Fix return value of init call

Kuan-Ying Lee (1):
      selftests/seccomp: Fix pointer type mismatch build error

Kyumin Lee (1):
      io_uring: preserve task restrictions across exec

Laurent Pinchart (1):
      drm/bridge: display-connector: Fix I2C adapter resource leak

Leo Li (1):
      drm/amd/display: Exit idle optimizations before programming

Leon Romanovsky (1):
      scsi: target: Clear cmd_cnt when initial counter enrollment fails

Li Qiang (1):
      cifs: validate idmap key payload length

Lianqin Hu (2):
      ALSA: usb-audio: Add iface reset and delay quirk for Generic USB Headphone
      ALSA: usb-audio: Add iface reset and delay quirk for JKY Technology Q2A

Liem (2):
      i2c: imx: Fix slave registration race and error handling
      i2c: imx: Cancel hrtimer before clearing slave pointer

Link Lin (1):
      mm/page_reporting: use system_freezable_wq to fix UAF during suspend

Linmao Li (1):
      i2c: spacemit: request IRQ after controller initialization

Linus Torvalds (1):
      Linux 7.2-rc6

Lorenzo Bianconi (1):
      selftests: netfilter: nft_flowtable.sh: fix offload counter
verification for tunnel tests

Lucas Martins Alves (1):
      can: c_can: c_can_chip_config(): keep controller in init mode
until bittiming is configured

Luiz Angelo Daros de Luca (12):
      hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
      hwmon: (adt7470) Fix cache updated before hardware write on I2C error
      hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
      hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
      hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
      hwmon: (adt7470) Use cached PWM frequency value
      hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
      hwmon: (adt7470) Fix PWM auto temp state array and bounds check
      net: dsa: realtek: rtl8365mb: use devm_mutex_init for mib_lock
      net: dsa: realtek: use devm_mutex_init for regmap lock
      net: dsa: realtek: use devm_mutex_init for vlan_lock
      net: dsa: realtek: use devm_mutex_init for l2_lock

Luxiao Xu (1):
      audit: fix potential use-after-free in audit_del_rule()

Maciej Fijalkowski (4):
      xsk: provide sufficient space in pool->tx_descs
      xsk: reclaim invalid Tx descriptors in ZC batch path
      selftests/xsk: fix too-many-frags multi-buffer Tx test
      selftests/xsk: account reclaimed invalid Tx descriptors

Madhavender Singh (1):
      ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx

Manivannan Sadhasivam (1):
      MAINTAINERS: Drop Karthikeyan Mitran from Mobiveil PCIe entry

Maoyi Xie (1):
      can: peak_usb: peak_usb_start(): fix double free of transfer
buffer on URB submit error

Marc Kleine-Budde (1):
      can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb
allocation failure

Marcos Paulo Medeiros (1):
      ALSA: hda/realtek: Fix headset mic on Acer Nitro 5 AN515-46

Mario Limonciello (2):
      cpufreq/amd-pstate: Loosen requirement on lowest nonlinear
frequency != min freq
      pinctrl-amd: Don't clear S4 wake bits at probe

Mark Brown (3):
      ASoC: tas2562: Validate values for volume writes
      ASoC: tas2562: Fix event generation for volume control
      ASoC: tas2562: Fix default digital volume

Mark Tomlinson (1):
      gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

Markus Lindner (1):
      ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4

Masami Hiramatsu (Google) (6):
      fprobe: Fix module reference count leak on error in register_fprobe()
      tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
      tracing/mmiotrace: Add NULL check for mmio_trace_array in
logging functions
      tracing: Check return value of __register_event() in
trace_module_add_events()
      tracing/filters: Fix false positive match in regex_match_full()
      ring-buffer: Fix subbuf_ids memory leak in
rb_allocate_cpu_buffer() error path

Matt Fleming (1):
      veth: convert frag_list skbs before running XDP

Matt Vollrath (2):
      ata: libata-eh: Increase STANDBY IMMEDIATE timeout
      igbvf: Fix leak in TX DMA error cleanup

Mauricio Faria de Oliveira (1):
      x86/boot: Add volatile, clobbers and zero-length test in memcmp()

Maíra Canal (1):
      drm/vc4: Zero the tile state data array before each BIN job

Md Sadre Alam (1):
      dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+

Michael Bommarito (6):
      keys: fix out-of-bounds read in keyring_get_key_chunk()
      keys: make keyring key-chunk byte order agree with keyring_diff_objects()
      assoc_array: trim the final shortcut word using the current chunk end
      um: vector: fix use-after-free in vector_mmsg_rx()
      erofs: cap LZMA stream pool size
      idpf: bound interrupt-vector register fill to the allocated array

Michael Diesen (1):
      ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)

Michael Ellerman (1):
      MAINTAINERS: Demote myself to reviewer

Michael Kelley (1):
      Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices

Mikhail Gavrilov (1):
      ALSA: usb-audio: Add GET_SAMPLE_RATE quirk for C-Media CM6206

Ming Lei (1):
      ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

Minhong He (1):
      can: isotp: check register_netdevice_notifier() error in module init

Muhammad Bilal (1):
      accel/qaic: use sizeof(*trans_hdr) for transaction length check

Mukesh Kumar Chaurasiya (IBM) (2):
      powerpc/970: fix nap return address corruption on async interrupt exit
      powerpc: Fix exit_flags field placement in pt_regs for ptrace

Myeonghun Pak (2):
      i2c: amd-mp2: Unregister callback on adapter add failure
      drm/mediatek: ovl_adaptor: balance component registrations

Mykola Lysenko (1):
      btrfs: raid56: fix scrub read assembly submitting no reads

Nam Cao (1):
      riscv: time: Add missing __iomem in get_cycles() and get_cycles_hi()

Namjae Jeon (6):
      ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points
      ntfs: harden runlist realloc size calculations
      ntfs: drop stale page-cache when shrinking a non-resident attr
      ksmbd: fix use-after-free in __close_file_table_ids()
      ksmbd: reject repeated SMB2 NEGOTIATE requests
      ksmbd: use memcmp() to compare ClientGUIDs

Nathan Chancellor (1):
      fortify: Disable -Wstringop-overread in tests

Nava kishore Manne (3):
      phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
      phy: zynqmp: use read-modify-write for SERDES scrambler bypass
      phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB

Nazim Amirul (1):
      net: stmmac: Fix E2E delay mechanism

Nico Pache (2):
      mm: decrement MTHP_STAT_NR_ANON in free_zone_device_folio()
      mm/migrate: exclude hugetlb folios from MTHP_STAT_NR_ANON accounting

Nico Pache (Red Hat) (1):
      MAINTAINERS: update Nico Pache's email address

Nicolas Schier (1):
      kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos

Nicolin Chen (3):
      iommufd/viommu: Release the igroup lock on the vdevice_size error path
      iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
      iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE

Niklas Cassel (3):
      ata: libata-core: Disable LPM on some WD drives
      ata: libata-core: Disable LPM on WD Green 2.5 480GB
      ata: libata-sata: fix ata_scsi_lpm_supported() iteration

Niklas Schnelle (1):
      s390/pci: Fix s390_pci_mmio_write syscall error return without MIO

Norbert Szetei (3):
      ALSA: seq: Fix division by zero in initialize_timer()
      ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
      ALSA: pcm: wake linked drain waiters on unlink

Oleksij Rempel (1):
      can: j1939: transport: j1939_session_fresh_new(): initialize
receive buffer

Oliver Hartkopp (1):
      can: isotp: fix timer drain order, wakeup handling and tx_gen ordering

Osama Abdelkader (2):
      drm/panthor: reject firmware sections with oversized data
      drm/panthor: validate firmware interface structure sizes

Pablo Neira Ayuso (3):
      netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()
      netfilter: nf_tables: make nft_object rhltable per table
      netfilter: xt_hashlimit: validate hashtable supports
XT_HASHLIMIT_RATE_MATCH

Paolo Bonzini (1):
      KVM: VMX: add memory clobber to asm for VMX instructions

Paul E. McKenney (1):
      btrfs: initialize 'args' to avoid compiler warning in
btrfs_ioctl_get_csums()

Pauli Virtanen (19):
      Bluetooth: ISO: clear iso_data always when detaching conn from hcon
      Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
      Bluetooth: ISO: lock sk in iso_sock_getname
      Bluetooth: ISO: lock sk in iso_connect_ind
      Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
      Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
      Bluetooth: ISO: hold sk properly in iso_conn_ready
      Bluetooth: ISO: fix leaking sk after socket release
      Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
      Bluetooth: ISO: ensure no dangling hcon references in iso_conn
      Bluetooth: ISO: fix refcounting of iso_conn
      Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
      Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
      Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
      Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
      Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
      Bluetooth: hci_sync: hold conn in hci_past_sync() callback
      Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
      Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync

Peiyang He (3):
      iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
      iommufd: Reject DMABUF pages from the access pin path
      iommu/iommufd: Fix IOPF group ownership UAF

Pengpeng Hou (5):
      can: ctucanfd: add missing MODULE_DEVICE_TABLE()
      can: peak_usb: validate uCAN receive record lengths
      can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate
received command extents
      can: softing: fw_parse(): validate firmware record spans
      can: ems_usb: validate CPC message lengths

Peter Collingbourne (1):
      arm64, mailmap: update email address for Peter Collingbourne

Pierre-Eric Pelloux-Prayer (1):
      drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini

Pratik Vishwakarma (1):
      x86/CPU/AMD: Carve out a Zen5 models range

Przemyslaw Korba (1):
      ice: suppress DPLL errors during reset recovery

Qi Zheng (1):
      mm: mglru: fix stale batch updates after memcg reparenting

Qu Wenruo (2):
      btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
      btrfs: raid56: fix an incorrect csum skip during scrub

Radhey Shyam Pandey (3):
      ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
      phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
      phy: zynqmp: fix runtime PM leak on probe allocation failure

Randy Dunlap (2):
      power: supply: bd71828: add a terminating table border
      ata: libata: avoid kernel-doc warnings

Raushan Patel (2):
      tracing/probes: Reject $arg0 in meta argument expansion
      tracing/fprobe: Roll back on enable_trace_fprobe() failure

Ray Wu (2):
      drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
      drm/amd/display: Add AV mute wait frames to dce110_set_avmute

Richard Chang (1):
      mm: vmscan: abort proactive reclaim early when freezing for suspend

Richard Zhu (1):
      PCI: imx6: Fix i.MX6Q/DL boot hang caused by improper PHY power sequencing

Robert Abrahamse (1):
      ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)

Rong Zhang (1):
      cpufreq/amd-pstate: Prevent the driver from loading on
unsupported hardware

Rosen Penev (1):
      ata: sata_mv: accept 1 or 2 resources in platform probe

Ruoyu Wang (1):
      drm/mediatek: Check CRTC state before freeing

Sang-Heon Jeon (2):
      of: reserved_mem: prevent OOB when too many dynamic regions are defined
      smb: client: remove conditional return with no effect

Sangho Lee (2):
      Bluetooth: HIDP: reject frames without a transaction header
      Bluetooth: HIDP: validate numbered report payloads

Sasha Finkelstein (1):
      power: supply: macsmc: Support macOS 27 SMC firmware

Sean Christopherson (1):
      KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited
while L2 is active

Sebastian Andrzej Siewior (2):
      Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with
lockdep annotation
      Drivers: hv: vmbus: Remove vmbus_irq_initialized

Shawn Guo (1):
      scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc

Shengjiu Wang (2):
      ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return
      ASoC: fsl_easrc: fix m2m_init error path to use goto instead of
bare return

Shuangpeng Bai (1):
      ipv6: release fib6_null_entry on subtree failure

Shubhankar Milind Sardeshpande (2):
      drm/amdgpu: Enable support for PSP 15_0_5
      drm/amdgpu: Fix NBIO 7.11.5 offsets

Shuming Fan (1):
      ASoC: rt722: reset codec to fix abnormal sound

Simon Schippers (4):
      Revert "tun/tap & vhost-net: avoid ptr_ring tail-drop when a
qdisc is present"
      Revert "ptr_ring: move free-space check into separate helper"
      Revert "vhost-net: wake queue of tun/tap after ptr_ring consume"
      Revert "tun/tap: add ptr_ring consume helper with netdev queue wakeup"

Sneh Mankad (1):
      pinctrl: qcom: Unconditionally mark gpio as wakeup enable

Soeren Moch (1):
      PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with
iMSI-RX to work around hardware bug

Sonali Pradhan (2):
      ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
      ALSA: usb-audio: Clamp frame size in implicit-feedback mode

Srikanth Boyapally (1):
      spi: spi-cadence: Move TX FIFO full busy-wait into FIFO

Stanislav Kinsburskii (9):
      lib: test_hmm: use device devt for coherent device range selection
      mshv: Fix duplicate GSI detection for GSI 0
      mshv: Fix sleeping under spinlock in mshv_portid_alloc
      mshv: Use kfree_rcu in mshv_portid_free
      mshv: Fix race in mshv_irqfd_deassign
      mshv: Fix level-triggered check on uninitialized data
      mshv: Fix missing error code on VP allocation failure
      mshv: Order pt_vp_array publish against irqfd assertion path
      mshv: Publish VP to pt_vp_array before installing the file descriptor

Stanislaw Gruszka (1):
      wifi: iwlegacy: replace BUG_ON() with WARN_ON() on num_stations check

Stanislaw Pal (1):
      spi: spi-qpic-snand: write the feature value before executing SET_FEATURE

Stefan Haberland (2):
      s390/dasd: Fix path verification interrupted by concurrent
dasd_sleep_on_immediatly
      s390/dasd: Fix undersized format-check buffer

Suman Ghosh (1):
      octeontx2-pf: Set correct sequence for carrier off and tx queue stop

Sunil Khatri (1):
      drm/amdgpu: dont pin wptr bo instead use eviction fence

Surendra Singh Chouhan (3):
      spi: spacemit: prepare both DMA descriptors before submitting
      platform/x86: dell-dw5826e: fix ACPI _DSM function index and bitmask usage
      ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()

Suresh Guttula (1):
      drm/amdgpu : update mmhub eco sec lvl for vcn5_3

Takashi Iwai (1):
      ALSA: 6fire: Fix UAF at error handling during probe

TanZheng (1):
      scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE

Tetsuo Handa (1):
      can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking

Thomas Weißschuh (1):
      riscv: vdso: Only try to install vDSO when present

Thorsten Blum (7):
      powerpc/boot: Fix simpleboot CPU node lookup check
      powerpc/boot: Fix treeboot-currituck CPU node lookup check
      powerpc/boot: Fix treeboot-akebono CPU node lookup check
      powerpc/ps3: Remove unused struct table in setup_areas()
      powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
      powerpc/perf: Use strstarts() to simplify is_thread_imc_pmu()
      powerpc/serial: Fix include guard comment

Tomas Glozar (1):
      rtla/timerlat_top: Fix on-threshold actions firing on signal

Troy Mitchell (1):
      riscv: mm: fix SWIOTLB initialization for systems with DRAM above 4GB

Tu Nguyen (1):
      can: rcar_canfd: change the initializing flow for clocks and resets

Uday Khare (2):
      ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
      ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup

Usama Arif (1):
      userfaultfd: wait on source PMD during UFFDIO_MOVE

Vaibhav Jain (2):
      powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash
      powerpc/pseries: Skip vpa_init() for boot cpu in smp_setup_cpu()

Vijaya Krishna Nivarthi (1):
      spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure

Vincent Donnefort (5):
      KVM: arm64: Fix hyp_trace clock disabling
      KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing
      KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load()
      KVM: arm64: Add missing hyp_enter when trapping sysreg
      ring-buffer: Fix reader page read offset for remote buffers

Vincent Jardin (1):
      hwmon: (pmbus/core) notify on the hwmon device, not the i2c client

Vladimir Marioukhine (1):
      drm/amdkfd: fix QID bit leak in pqm_create_queue()

Wei Fang (1):
      ptp: netc: fix potential interrupt storm caused by incorrect unbind order

Wei Liu (1):
      mshv: fix hv_input_get_system_property struct

Weiming Shi (1):
      KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs

Wenjia Zhang (1):
      MAINTAINERS: Update SHARED MEMORY COMMUNICATIONS (SMC) maintainer entries

Wenmeng Liu (1):
      i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers

William Palacek (3):
      drm/amdkfd: Add bounds check for CRAT subtype length
      drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
      drm/amdkfd: hold event_mutex while checkpointing CRIU events

Woraphat Khiaodaeng (1):
      io_uring/zcrx: don't clear master_ctx from the import path

Xiang Mei (2):
      netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in
sip_help_tcp()
      rds: tcp: hold the RCU lock across ipv6_chk_addr() in
rds_tcp_laddr_check()

Xiang Mei (Microsoft) (3):
      netfilter: nft_payload: fix mask build for partial field offload
      nexthop: take nh->lock for f6i_list walks in replace check and notify
      nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush

Xiangfeng Cai (1):
      mm/hugetlb: fix list corruption in allocate_file_region_entries()

Xingui Yang (1):
      scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race

Xu Rao (2):
      power: supply: bq25890: fix the -10 C NTC lookup entry
      ALSA: lx6464es: fix period byte count for 16-bit streams

Xuanqiang Luo (3):
      fou: Fix use-after-free in fou_create()
      net/smc: fix socket use-after-free during link group termination
      bpf: lwt: Fix dst reference leak on reroute failure

Yafang Shao (1):
      kbuild: rpm-pkg: Preserve BTF sections in kernel modules during
debuginfo stripping

Yang Wang (4):
      drm/amd/pm: fix pptable use-after-free
      drm/amd/pm: fix torn gpu metrics reads
      drm/amd/pm: use milliwatts for GPU power sensors
      drm/amd/pm: hide pp_table sysfs on APUs

Yehyeong Lee (1):
      net: mpls: initialize rtm_tos in mpls_getroute()

Yi Xie (2):
      mshv_vtl: fix fd leak in mshv_ioctl_create_vtl()
      mshv_vtl: bounds-check cpu index in vtl mmap fault handler

Yichong Chen (4):
      smb: client: free partially allocated transform folio queue
      netfs: clear PG_private_2 on copy-to-cache append failure
      netfs: handle single writeback rolling buffer allocation failure
      netfs: release readahead folios on iterator preparation failure

Yong-Xuan Wang (1):
      riscv/sifive: remove warning in errata

Yousef Alhouseen (1):
      mshv_vtl: clear hypercall output before copyout

Yuho Choi (3):
      dmaengine: idxd: fix double free of wq, engine, and group structs
      dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
      idpf: Fix mailbox IRQ name leak on request failure

Yun Lu (1):
      rtase: fix double free of multi-frag skb on DMA map failure

Yuxiang Yang (1):
      sctp: reject stale cookies with mismatched verification tags

Zack Rusin (12):
      drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
      drm/vmwgfx: reject DX_BIND_QUERY without a DX context
      drm/vmwgfx: clamp dirty-page range with min, not max
      drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
      drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
      drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
      drm/vmwgfx: bound DMA command body size against suffix pointer
      drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
      drm/vmwgfx: enforce cursor size limits for MOB cursors
      drm/vmwgfx: skip hash_del_rcu when validation context has no hash table
      drm/vmwgfx: use check_add_overflow for shader size+offset bound
      drm/vmwgfx: validate external BO copy bounds for both stride paths

Zhan Xusheng (1):
      audit: fix potential integer overflow in audit_log_n_string()

Zhang Heng (2):
      ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1403CDA
      ALSA: hda/realtek: Add quirk for HP Pavilion All-in-One 27-ca1xxx

Zhao Li (4):
      wifi: mac80211: fix tid_tx use-after-free on BA session stop
      wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
      wifi: cfg80211: publish PMSR request before starting the driver
      wifi: mac80211: validate individual TWT params before driver setup

Zhiling Zou (3):
      ipvs: do not propagate one-packet flag to synced conns
      net: ipv6: clear suppressed fib6 rule result
      net: bridge: stop fast-leave after deleting a port group

Zhongqiu Han (1):
      cpufreq: schedutil: Publish util hooks only after all sg_cpu are
initialized

Zi Yan (1):
      mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()

Zihan Xi (3):
      tipc: avoid use-after-free in poll trace queue dumps
      Bluetooth: mgmt: fix UAF in pair command cancellation
      Bluetooth: mgmt: fix pending command UAF in EIR updates

Zijun Hu (1):
      Bluetooth: btintel: Validate length before parsing diagnostics TLV

bui duc phuc (1):
      gpio: pca953x: fix cache_only and IRQ state on restore_context() failure

wangdicheng (1):
      ASoC: tas2781: Use correct calibration data for SINEGAIN2 register

郑鸿源 (1):
      ASoC: amd: yc: Add MSI Crosshair A16 HX D7WFKG to quirk table